Re: sdmmc scsi inquiry emulation

[Stuart Henderson]

On 2016/05/05 12:54, Mark Kettenis wrote:
> > 
> > Sounds good to me though you don't seem to have mids for
> > any of the cards I have, only one of the emmc devices.
> > 
> > I wonder if it is worth skipping the product if it is
> > all '0'/' '
> > 
> > 0x03SanDisk
> > 0x1bSamsung
> > 0x28Lexar (Micron)
> > 0x45SanDisk
> 
> Already added the 0x45 SanDisk one.  Would like some sort of
> confirmation on the others.  The label on the card doesn't always
> correspond to the actual manufacturer of the card.
> 
> > sandisk 4GB SD
> > unknown MID 0x3
> > sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
> > sd1: 3781MB, 512 bytes/sector, 7744512 sectors
> 
> Although this one probably is genuine SanDisk.
> 

0x28 matches the list in Linux mmc-utils for Lexar.
http://git.kernel.org/cgit/linux/kernel/git/cjb/mmc-utils.git/tree/lsmmc.c#n86

For 0x1b mmc-utils says Transcend, but https://sd2snes.de/blog/card-list
has Samsung, and Samsung seems more likely as an actual manufacturer.

Details from some more cards at http://softgun.sourceforge.net/sdcard.shtml

It looks like there is an OEM field as well as MID (2 ascii bytes),
e.g. SD=SanDisk, TM=Toshiba (Toshiba seem to use MID 0x2).

Re: sdmmc scsi inquiry emulation

[Mark Kettenis]

> Date: Mon, 2 May 2016 14:25:51 +1000
> From: Jonathan Gray 
> 
> On Sun, May 01, 2016 at 11:21:18PM +0200, Mark Kettenis wrote:
> > Diff below provides a bit more meaningful information in the SCSI
> > INQUIRY emulation.  It decodes the JDEC manufacturer ID code and
> > provides the product string and revision number as read from the card.
> > 
> > For example:
> > 
> > scsibus1 at sdmmc2: 2 targets, initiator 0
> > sd0 at scsibus1 targ 1 lun 0:  SCSI2 0/direct fixed
> > sd0: 3768MB, 512 bytes/sector, 7716864 sectors
> > scsibus2 at sdmmc0: 2 targets, initiator 0
> > sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
> > sd1: 29184MB, 512 bytes/sector, 59768832 sectors
> > 
> > where sd0 is an SD card and sd1 is the eMMC soldered onto the board of
> > the machine.
> > 
> > Note that the strncpy here is safe.  The strings in the scsi inquiry
> > page don't have to be nul-terminated.
> > 
> > ok?
> 
> Sounds good to me though you don't seem to have mids for
> any of the cards I have, only one of the emmc devices.
> 
> I wonder if it is worth skipping the product if it is
> all '0'/' '
> 
> 0x03  SanDisk
> 0x1b  Samsung
> 0x28  Lexar (Micron)
> 0x45  SanDisk

Already added the 0x45 SanDisk one.  Would like some sort of
confirmation on the others.  The label on the card doesn't always
correspond to the actual manufacturer of the card.

> sandisk 4GB SD
> unknown MID 0x3
> sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
> sd1: 3781MB, 512 bytes/sector, 7744512 sectors

Although this one probably is genuine SanDisk.

Re: sdmmc scsi inquiry emulation

[Jonathan Gray]

On Sun, May 01, 2016 at 11:21:18PM +0200, Mark Kettenis wrote:
> Diff below provides a bit more meaningful information in the SCSI
> INQUIRY emulation.  It decodes the JDEC manufacturer ID code and
> provides the product string and revision number as read from the card.
> 
> For example:
> 
> scsibus1 at sdmmc2: 2 targets, initiator 0
> sd0 at scsibus1 targ 1 lun 0:  SCSI2 0/direct fixed
> sd0: 3768MB, 512 bytes/sector, 7716864 sectors
> scsibus2 at sdmmc0: 2 targets, initiator 0
> sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
> sd1: 29184MB, 512 bytes/sector, 59768832 sectors
> 
> where sd0 is an SD card and sd1 is the eMMC soldered onto the board of
> the machine.
> 
> Note that the strncpy here is safe.  The strings in the scsi inquiry
> page don't have to be nul-terminated.
> 
> ok?

Sounds good to me though you don't seem to have mids for
any of the cards I have, only one of the emmc devices.

I wonder if it is worth skipping the product if it is
all '0'/' '

0x03SanDisk
0x1bSamsung
0x28Lexar (Micron)
0x45SanDisk

element 14 bbb rev C:
=> mmc info
Device: OMAP SD/MMC
Manufacturer ID: 70
OEM: 100
Name: MMC04
Tran Speed: 5200
Rd Block Len: 512
MMC version 4.5
High Capacity: Yes
Capacity: 3.6 GiB
Bus Width: 4-bit
Erase Group Size: 512 KiB
HC WP Group Size: 4 MiB
User Capacity: 3.6 GiB
Boot Capacity: 2 MiB ENH
RPMB Capacity: 128 KiB ENH

samsung 8GB uSD
=> mmc info
Device: FSL_SDHC
Manufacturer ID: 1b
OEM: 534d
Name: 0
Tran Speed: 5000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 7.5 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes

lexar 16GB uSD
=> mmc info
Device: FSL_SDHC
Manufacturer ID: 28
OEM: 4245
Name:   
Tran Speed: 5000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 14.9 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes

sandisk 4GB uSD
=> mmc info
Device: FSL_SDHC
Manufacturer ID: 3
OEM: 5344
Name: SU04G 
Tran Speed: 5000
Rd Block Len: 512
SD version 2.0
High Capacity: Yes
Capacity: 3.7 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes

sandisk 4GB SD
unknown MID 0x3
sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
sd1: 3781MB, 512 bytes/sector, 7744512 sectors

100s emmc
sdhc0 at acpi0: SDHA addr 0x9091d000/0x1000 irq 44
sdhc0: 200 MHz base clock
sdmmc0 at sdhc0: 8-bit, sd high-speed, mmc high-speed, dma
sdhc1 at acpi0: SDHB addr 0x90901000/0x1000 irq 46
sdhc1: 100 MHz base clock
sdmmc1 at sdhc1: 4-bit, sd high-speed, mmc high-speed, dma
sdhc2 at acpi0: SDHD addr 0x90903000/0x1000 irq 47, gpio
sdhc2: 100 MHz base clock
sdmmc2 at sdhc2: 4-bit, sd high-speed, mmc high-speed, dma

...

scsibus1 at sdmmc0: 2 targets, initiator 0
unknown MID 0x45
sd0 at scsibus1 targ 1 lun 0:  SCSI2 0/direct fixed
sd0: 29820MB, 512 bytes/sector, 61071360 sectors

Windows identifies this as "SanDisk DB4032"

> 
> 
> Index: sdmmc_scsi.c
> ===
> RCS file: /cvs/src/sys/dev/sdmmc/sdmmc_scsi.c,v
> retrieving revision 1.35
> diff -u -p -r1.35 sdmmc_scsi.c
> --- sdmmc_scsi.c  14 Mar 2015 03:38:49 -  1.35
> +++ sdmmc_scsi.c  1 May 2016 21:20:05 -
> @@ -376,8 +376,12 @@ void
>  sdmmc_inquiry(struct scsi_xfer *xs)
>  {
>   struct scsi_link *link = xs->sc_link;
> + struct sdmmc_softc *sc = link->adapter_softc;
> + struct sdmmc_scsi_softc *scbus = sc->sc_scsibus;
> + struct sdmmc_scsi_target *tgt = >sc_tgt[link->target];
>   struct scsi_inquiry_data inq;
>   struct scsi_inquiry *cdb = (struct scsi_inquiry *)xs->cmd;
> + char revision[5];
>  
>  if (xs->cmdlen != sizeof(*cdb)) {
>   xs->error = XS_DRIVER_STUFFUP;
> @@ -394,10 +398,29 @@ sdmmc_inquiry(struct scsi_xfer *xs)
>   inq.version = 2;
>   inq.response_format = 2;
>   inq.additional_length = 32;
> - strlcpy(inq.vendor, "SD/MMC ", sizeof(inq.vendor));
> - snprintf(inq.product, sizeof(inq.product),
> - "Drive #%02d", link->target);
> - strlcpy(inq.revision, "   ", sizeof(inq.revision));
> + switch (tgt->card->cid.mid) {
> + case 0x02:
> + strncpy(inq.vendor, "Sandisk", sizeof(inq.vendor));
> + break;
> + case 0x11:
> + strncpy(inq.vendor, "Toshiba", sizeof(inq.vendor));
> + break;
> + case 0x13:
> + strncpy(inq.vendor, "Micron", sizeof(inq.vendor));
> + break;
> + case 0x15:
> + strncpy(inq.vendor, "Samsung", sizeof(inq.vendor));
> + break;
> + case 0x70:
> + strncpy(inq.vendor, "Kingston", sizeof(inq.vendor));
> + break;
> + default:
> + strncpy(inq.vendor, "SD/MMC", sizeof(inq.vendor));
> + break;
> + }
> + strncpy(inq.product, tgt->card->cid.pnm, sizeof(inq.product));
> + snprintf(revision, sizeof(revision), "%04X", tgt->card->cid.rev);
> + strncpy(inq.revision, revision, sizeof(inq.revision));
>  
>  

Re: sdmmc scsi inquiry emulation

[Todd C. Miller]

On Sun, 01 May 2016 23:21:18 +0200, Mark Kettenis wrote:

> Diff below provides a bit more meaningful information in the SCSI
> INQUIRY emulation.  It decodes the JDEC manufacturer ID code and
> provides the product string and revision number as read from the card.

Also looks good.  OK millert@

 - todd

Re: sdmmc scsi inquiry emulation

[Mark Kettenis]

> Date: Sun, 1 May 2016 23:21:18 +0200 (CEST)
> From: Mark Kettenis 
> 
> Diff below provides a bit more meaningful information in the SCSI
> INQUIRY emulation.  It decodes the JDEC manufacturer ID code and
> provides the product string and revision number as read from the card.
> 
> For example:
> 
> scsibus1 at sdmmc2: 2 targets, initiator 0
> sd0 at scsibus1 targ 1 lun 0:  SCSI2 0/direct fixed
> sd0: 3768MB, 512 bytes/sector, 7716864 sectors
> scsibus2 at sdmmc0: 2 targets, initiator 0
> sd1 at scsibus2 targ 1 lun 0:  SCSI2 0/direct fixed
> sd1: 29184MB, 512 bytes/sector, 59768832 sectors
> 
> where sd0 is an SD card and sd1 is the eMMC soldered onto the board of
> the machine.
> 
> Note that the strncpy here is safe.  The strings in the scsi inquiry
> page don't have to be nul-terminated.

Theo isn't to thrilled about the use of strncpy(9), which might be
removed in the future.

The diff below uses strlcpy(9) and memcpy(9) in a way that should be
fairly easy to audit.

As a bonus it converts some bzero/bcopy calls into memset/memcpy.

Thoughts?


Index: sdmmc_scsi.c
===
RCS file: /cvs/src/sys/dev/sdmmc/sdmmc_scsi.c,v
retrieving revision 1.35
diff -u -p -r1.35 sdmmc_scsi.c
--- sdmmc_scsi.c14 Mar 2015 03:38:49 -  1.35
+++ sdmmc_scsi.c1 May 2016 22:31:27 -
@@ -376,8 +376,14 @@ void
 sdmmc_inquiry(struct scsi_xfer *xs)
 {
struct scsi_link *link = xs->sc_link;
+   struct sdmmc_softc *sc = link->adapter_softc;
+   struct sdmmc_scsi_softc *scbus = sc->sc_scsibus;
+   struct sdmmc_scsi_target *tgt = >sc_tgt[link->target];
struct scsi_inquiry_data inq;
struct scsi_inquiry *cdb = (struct scsi_inquiry *)xs->cmd;
+   char vendor[sizeof(inq.vendor) + 1];
+   char product[sizeof(inq.product) + 1];
+   char revision[sizeof(inq.revision) + 1];
 
 if (xs->cmdlen != sizeof(*cdb)) {
xs->error = XS_DRIVER_STUFFUP;
@@ -389,17 +395,43 @@ sdmmc_inquiry(struct scsi_xfer *xs)
goto done;
}
 
-   bzero(, sizeof inq);
+   memset(vendor, 0, sizeof(vendor));
+   memset(product, 0, sizeof(product));
+   memset(revision, 0, sizeof(revision));
+   switch (tgt->card->cid.mid) {
+   case 0x02:
+   case 0x45:
+   strlcpy(vendor, "Sandisk", sizeof(vendor));
+   break;
+   case 0x11:
+   strlcpy(vendor, "Toshiba", sizeof(vendor));
+   break;
+   case 0x13:
+   strlcpy(vendor, "Micron", sizeof(vendor));
+   break;
+   case 0x15:
+   strlcpy(vendor, "Samsung", sizeof(vendor));
+   break;
+   case 0x70:
+   strlcpy(vendor, "Kingston", sizeof(vendor));
+   break;
+   default:
+   strlcpy(vendor, "SD/MMC", sizeof(vendor));
+   break;
+   }
+   strlcpy(product, tgt->card->cid.pnm, sizeof(product));
+   snprintf(revision, sizeof(revision), "%04X", tgt->card->cid.rev);
+
+   memset(, 0, sizeof inq);
inq.device = T_DIRECT;
inq.version = 2;
inq.response_format = 2;
inq.additional_length = 32;
-   strlcpy(inq.vendor, "SD/MMC ", sizeof(inq.vendor));
-   snprintf(inq.product, sizeof(inq.product),
-   "Drive #%02d", link->target);
-   strlcpy(inq.revision, "   ", sizeof(inq.revision));
+   memcpy(inq.vendor, vendor, sizeof(inq.vendor));
+   memcpy(inq.product, product, sizeof(inq.product));
+   memcpy(inq.revision, revision, sizeof(inq.revision));
 
-   bcopy(, xs->data, MIN(xs->datalen, sizeof(inq)));
+   memcpy(xs->data, , MIN(xs->datalen, sizeof(inq)));
 
 done:
scsi_done(xs);