1 /* flasher for HomeMatic-devices supporting OTA updates
3 * Copyright (c) 2014-17 Michael Gernoth <michael@gernoth.net>
4 * Copyright (c) 2017 noansi (TSCULFW-support)
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to
8 * deal in the Software without restriction, including without limitation the
9 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
10 * sell copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
33 #include <sys/types.h>
37 #include <libusb-1.0/libusb.h>
45 #include "hmuartlgw.h"
49 #define NORMAL_MAX_PAYLOAD 37
50 #define LOWER_MAX_PAYLOAD 17
56 uint8_t key
[16] = {0};
59 /* Maximum payloadlen supported by IO */
60 uint32_t max_payloadlen
= NORMAL_MAX_PAYLOAD
;
68 enum hmuartlgw_state
{
69 HMUARTLGW_STATE_GET_HMID
,
70 HMUARTLGW_STATE_GET_FIRMWARE
,
71 HMUARTLGW_STATE_GET_CREDITS
,
73 HMUARTLGW_STATE_WAIT_APP
,
74 HMUARTLGW_STATE_ACK_APP
,
79 enum message_type message_type
;
84 enum hmuartlgw_state uartlgw_state
;
85 uint8_t uartlgw_version
[3];
86 uint8_t is_TSCUL
; // tsculfw
89 static int parse_hmcfgusb(uint8_t *buf
, int buf_len
, void *data
)
91 struct recv_data
*rdata
= data
;
99 ((buf
[0x11] == ((hmid
>> 16) & 0xff)) &&
100 (buf
[0x12] == ((hmid
>> 8) & 0xff)) &&
101 (buf
[0x13] == (hmid
& 0xff)))) {
102 memset(rdata
->message
, 0, sizeof(rdata
->message
));
103 memcpy(rdata
->message
, buf
+ 0x0d, buf
[0x0d] + 1);
104 rdata
->message_type
= MESSAGE_TYPE_E
;
108 memset(rdata
->message
, 0, sizeof(rdata
->message
));
109 memcpy(rdata
->message
, buf
+ 0x0e, buf
[0x0e] + 1);
110 rdata
->status
= (buf
[5] << 8) | buf
[6];
111 rdata
->message_type
= MESSAGE_TYPE_R
;
114 rdata
->speed
= buf
[1];
117 rdata
->version
= (buf
[11] << 8) | buf
[12];
118 rdata
->credits
= buf
[36];
119 my_hmid
= (buf
[0x1b] << 16) | (buf
[0x1c] << 8) | buf
[0x1d];
131 static int parse_culfw(uint8_t *buf
, int buf_len
, void *data
)
133 struct recv_data
*rdata
= data
;
135 int rpos
= 0; // read index
137 memset(rdata
->message
, 0, sizeof(rdata
->message
));
138 rdata
->message_type
= 0;
148 if ((buf
[1] == 'p') || (buf
[1] == 't')) // tsculfw: ping or set timestamp command echoed?
151 if (buf
[1] == '?') {// tsculfw: unknown command
152 fprintf(stderr
, "unknown ASKSIN command sent\n");
156 if (buf
[1] == 'F') { // tsculfw: timestamp message?
158 if (buf_len
<= (3+14)) // tsculfw: reasonable len?
160 if (!validate_nibble(buf
[3]) || !validate_nibble(buf
[4])) // tsculfw: hex?
163 rdata
->credits
= ascii_to_nibble(buf
[3]); // tsculfw: coarse credits info, 0 = full credits (1800 x10ms) available
165 //AFF1B000053A1010F0520CB1122334BD57110
166 switch(ascii_to_nibble(buf
[4]) & 0x7) { // tsculfw: message type?
167 case 0: // tsculfw: send fail message repeat fail or AES Auth error
168 fprintf(stderr
, "send didn't complete, repeat fail or AES Auth error\n");
170 case 1: // tsculfw: received message
171 rpos
+= 7; // tsculfw: ignore timestamp data for now
173 case 2: // tsculfw: ping answer
175 case 3: // tsculfw: send success
176 rdata
->message_type
= MESSAGE_TYPE_B
;
178 case 4: // tsculfw: send fail channel busy message
179 fprintf(stderr
, "CCA didn't complete, too much traffic\n");
181 case 5: // tsculfw: send fail credits message
182 fprintf(stderr
, "send didn't complete, not enough credits left\n");
184 case 6: // tsculfw: send timestamp fail message no buffer or send message length error
185 fprintf(stderr
, "send didn't complete, not enough credits left -> wait 30 minutes with TSCUL powered and not reset\n");
187 case 7: // tsculfw: send fail due to cc1101 TX-FIFO underflow error message
188 fprintf(stderr
, "send didn't complete, cc1101 TX-FIFO underflow\n");
195 while(validate_nibble(buf
[(rpos
* 2) + 1]) &&
196 validate_nibble(buf
[(rpos
* 2) + 2]) &&
197 (rpos
+ 1 < buf_len
)) {
198 rdata
->message
[pos
] = ascii_to_nibble(buf
[(rpos
* 2) + 1]) << 4;
199 rdata
->message
[pos
] |= ascii_to_nibble(buf
[(rpos
* 2) + 2]);
204 if (hmid
&& (SRC(rdata
->message
) != (int)hmid
))
207 rdata
->message_type
= MESSAGE_TYPE_E
;
215 if (!strncmp((char*)buf
, "VTS", 3)) { // tsculfw: "VTS x.xx NNNNNN"
217 rdata
->version
= 0xffff;
221 s
= ((char*)buf
) + 2;
224 fprintf(stderr
, "Unknown response from CUL: %s", buf
);
229 rdata
->version
= v
<< 8;
234 fprintf(stderr
, "Unknown response from CUL: %s", buf
);
247 if (!strcmp(s
, "a-culfw")) {
248 rdata
->version
= 0xffff;
254 if (!strncmp((char*)buf
, "ERR:CCA", 7)) {
255 fprintf(stderr
, "CCA didn't complete, too much traffic\n");
260 fprintf(stderr
, "Unknown response from CUL: %s", buf
);
268 static int parse_hmuartlgw(enum hmuartlgw_dst dst
, uint8_t *buf
, int buf_len
, void *data
)
270 struct recv_data
*rdata
= data
;
272 if (dst
== HMUARTLGW_OS
) {
273 switch (rdata
->uartlgw_state
) {
274 case HMUARTLGW_STATE_GET_FIRMWARE
:
275 if (buf
[0] == HMUARTLGW_OS_ACK
) {
276 rdata
->uartlgw_version
[0] = buf
[5];
277 rdata
->uartlgw_version
[1] = buf
[6];
278 rdata
->uartlgw_version
[2] = buf
[7];
279 rdata
->uartlgw_state
= HMUARTLGW_STATE_DONE
;
282 case HMUARTLGW_STATE_GET_CREDITS
:
283 if (buf
[0] == HMUARTLGW_OS_ACK
) {
284 rdata
->credits
= buf
[2] / 2;
285 rdata
->uartlgw_state
= HMUARTLGW_STATE_DONE
;
295 case HMUARTLGW_APP_ACK
:
296 if (rdata
->uartlgw_state
== HMUARTLGW_STATE_GET_HMID
) {
297 my_hmid
= (buf
[4] << 16) | (buf
[5] << 8) | buf
[6];
300 rdata
->status
= buf
[1];
301 rdata
->message_type
= MESSAGE_TYPE_R
;
302 rdata
->uartlgw_state
= HMUARTLGW_STATE_ACK_APP
;
304 hexdump(buf
, buf_len
, "ACK Status: ");
308 case HMUARTLGW_APP_RECV
:
310 ((buf
[7] == ((hmid
>> 16) & 0xff)) &&
311 (buf
[8] == ((hmid
>> 8) & 0xff)) &&
312 (buf
[9] == (hmid
& 0xff)))) {
313 memset(rdata
->message
, 0, sizeof(rdata
->message
));
314 memcpy(rdata
->message
+ 1, buf
+ 4, buf_len
- 4);
315 rdata
->message
[LEN
] = buf_len
- 4;
316 rdata
->message_type
= MESSAGE_TYPE_E
;
326 int send_wait_hmuartlgw(struct hm_dev
*dev
, struct recv_data
*rdata
, uint8_t *data
, int data_len
,
327 enum hmuartlgw_dst dst
, enum hmuartlgw_state srcstate
,
328 enum hmuartlgw_state dststate
)
333 rdata
->uartlgw_state
= srcstate
;
334 hmuartlgw_send(dev
->hmuartlgw
, data
, data_len
, dst
);
335 do { hmuartlgw_poll(dev
->hmuartlgw
, 500); } while (rdata
->uartlgw_state
!= dststate
);
336 if (rdata
->status
!= HMUARTLGW_ACK_EINPROGRESS
)
340 if (rdata
->status
== HMUARTLGW_ACK_EINPROGRESS
) {
341 fprintf(stderr
, "IO thinks it is busy, you might have to reset it!\n");
348 int send_hm_message(struct hm_dev
*dev
, struct recv_data
*rdata
, uint8_t *msg
)
350 static uint32_t id
= 1;
356 case DEVICE_TYPE_HMCFGUSB
:
357 if (gettimeofday(&tv
, NULL
) == -1) {
358 perror("gettimeofay");
362 memset(out
, 0, sizeof(out
));
365 out
[1] = (id
>> 24) & 0xff;
366 out
[2] = (id
>> 16) & 0xff;
367 out
[3] = (id
>> 8) & 0xff;
370 out
[11] = (tv
.tv_usec
>> 24) & 0xff;
371 out
[12] = (tv
.tv_usec
>> 16) & 0xff;
372 out
[13] = (tv
.tv_usec
>> 8) & 0xff;
373 out
[14] = tv
.tv_usec
& 0xff;
375 memcpy(&out
[0x0f], msg
, msg
[0] + 1);
377 memset(rdata
->message
, 0, sizeof(rdata
->message
));
378 rdata
->message_type
= 0;
379 hmcfgusb_send(dev
->hmcfgusb
, out
, sizeof(out
), 1);
382 if (rdata
->message_type
== MESSAGE_TYPE_R
) {
383 if (((rdata
->status
& 0xdf) == 0x01) ||
384 ((rdata
->status
& 0xdf) == 0x02)) {
387 if ((rdata
->status
& 0xff00) == 0x0400) {
388 fprintf(stderr
, "\nOut of credits!\n");
389 } else if ((rdata
->status
& 0xff) == 0x08) {
390 fprintf(stderr
, "\nMissing ACK!\n");
391 } else if ((rdata
->status
& 0xff) == 0x30) {
392 fprintf(stderr
, "\nUnknown AES-key requested!\n");
394 fprintf(stderr
, "\nInvalid status: %04x\n", rdata
->status
);
400 pfd
= hmcfgusb_poll(dev
->hmcfgusb
, 1000);
401 if ((pfd
< 0) && errno
) {
402 if (errno
!= ETIMEDOUT
) {
403 perror("\n\nhmcfgusb_poll");
409 case DEVICE_TYPE_CULFW
:
414 memset(buf
, 0, sizeof(buf
));
417 for (i
= 0; i
< msg
[0] + 1; i
++) {
418 buf
[2 + (i
* 2)] = nibble_to_ascii((msg
[i
] >> 4) & 0xf);
419 buf
[2 + (i
* 2) + 1] = nibble_to_ascii(msg
[i
] & 0xf);
421 buf
[2 + (i
* 2) ] = '\r';
422 buf
[2 + (i
* 2) + 1] = '\n';
424 memset(rdata
->message
, 0, sizeof(rdata
->message
));
425 rdata
->message_type
= 0;
426 if (culfw_send(dev
->culfw
, buf
, 2 + (i
* 2) + 1) == 0) {
427 fprintf(stderr
, "culfw_send failed!\n");
431 /* Wait for TSCUL to ACK send */
432 if (rdata
->is_TSCUL
) {
435 pfd
= culfw_poll(dev
->culfw
, 200);
436 if ((pfd
< 0) && errno
) {
437 if (errno
!= ETIMEDOUT
) {
438 perror("\n\nculfw_poll");
442 } while (rdata
->message_type
!= MESSAGE_TYPE_B
);
445 if (msg
[CTL
] & 0x20) {
450 pfd
= culfw_poll(dev
->culfw
, 200);
451 if ((pfd
< 0) && errno
) {
452 if (errno
!= ETIMEDOUT
) {
453 perror("\n\nculfw_poll");
457 if (rdata
->message_type
== MESSAGE_TYPE_E
) {
458 if (rdata
->message
[TYPE
] == 0x02) {
459 if (rdata
->message
[PAYLOAD
] == 0x04) {
461 uint8_t challenge
[6];
465 if (rdata
->is_TSCUL
) {
466 printf("AES handled by TSCUL\n");
470 req_kNo
= rdata
->message
[rdata
->message
[LEN
]] / 2;
471 memcpy(challenge
, &(rdata
->message
[PAYLOAD
+1]), 6);
473 if (req_kNo
!= kNo
) {
474 fprintf(stderr
, "AES request for unknown key %d!\n", req_kNo
);
476 resp
= hm_sign(key
, challenge
, msg
, NULL
, respbuf
);
480 memset(rbuf
, 0, sizeof(rbuf
));
481 rbuf
[MSGID
] = rdata
->message
[MSGID
];
482 rbuf
[CTL
] = rdata
->message
[CTL
];
484 SET_SRC(rbuf
, DST(rdata
->message
));
485 SET_DST(rbuf
, SRC(rdata
->message
));
486 memcpy(&(rbuf
[PAYLOAD
]), resp
, 16);
487 SET_LEN_FROM_PAYLOADLEN(rbuf
, 16);
489 usleep(110000); /* Determined by a fair dice roll */
490 return send_hm_message(dev
, rdata
, rbuf
);
493 } else if (rdata
->message
[PAYLOAD
] >= 0x80 && rdata
->message
[PAYLOAD
] <= 0x8f) {
494 fprintf(stderr
, "NACK\n");
495 } else { /* ACK or ACKinfo */
499 fprintf(stderr
, "Unexpected message received: ");
500 for (i
= 0; i
< rdata
->message
[LEN
]; i
++) {
501 fprintf(stderr
, "%02x", rdata
->message
[i
+1]);
503 fprintf(stderr
, "\n");
509 fprintf(stderr
, "\nMissing ACK!\n");
514 /* Delay for non-TSCUL */
515 if (!rdata
->is_TSCUL
) {
520 case DEVICE_TYPE_HMUARTLGW
:
521 memset(out
, 0, sizeof(out
));
523 out
[0] = HMUARTLGW_APP_SEND
;
526 out
[3] = (msg
[CTL
] & 0x10) ? 0x01 : 0x00; /* Burst?! */
527 memcpy(&out
[4], &msg
[1], msg
[0]);
529 memset(rdata
->message
, 0, sizeof(rdata
->message
));
530 rdata
->message_type
= 0;
531 hmuartlgw_send(dev
->hmuartlgw
, out
, msg
[0] + 4, HMUARTLGW_APP
);
534 if (rdata
->message_type
== MESSAGE_TYPE_R
) {
535 if ((rdata
->status
== 0x02) ||
536 (rdata
->status
== 0x03) ||
537 (rdata
->status
== 0x0c)) {
540 if (rdata
->status
== 0x0d) {
541 fprintf(stderr
, "\nAES handshake failed!\n");
542 } else if (rdata
->status
== 0x04 || rdata
->status
== 0x06) {
543 fprintf(stderr
, "\nMissing ACK!\n");
545 fprintf(stderr
, "\nInvalid status: %04x\n", rdata
->status
);
551 pfd
= hmuartlgw_poll(dev
->hmuartlgw
, 1000);
552 if ((pfd
< 0) && errno
) {
553 if (errno
!= ETIMEDOUT
) {
554 perror("\n\nhmcfgusb_poll");
566 static int switch_speed(struct hm_dev
*dev
, struct recv_data
*rdata
, uint8_t speed
)
571 printf("Entering %uk-mode\n", speed
);
574 case DEVICE_TYPE_HMCFGUSB
:
575 memset(out
, 0, sizeof(out
));
579 hmcfgusb_send(dev
->hmcfgusb
, out
, sizeof(out
), 1);
583 pfd
= hmcfgusb_poll(dev
->hmcfgusb
, 1000);
584 if ((pfd
< 0) && errno
) {
585 if (errno
!= ETIMEDOUT
) {
586 perror("\n\nhmcfgusb_poll");
590 if (rdata
->speed
== speed
)
594 case DEVICE_TYPE_CULFW
:
596 return culfw_send(dev
->culfw
, "AR\r\n", 4);
598 return culfw_send(dev
->culfw
, "Ar\r\n", 4);
601 case DEVICE_TYPE_HMUARTLGW
:
603 out
[0] = HMUARTLGW_OS_UPDATE_MODE
;
606 hmuartlgw_send(dev
->hmuartlgw
, out
, 3, HMUARTLGW_OS
);
608 out
[0] = HMUARTLGW_OS_NORMAL_MODE
;
609 hmuartlgw_send(dev
->hmuartlgw
, out
, 1, HMUARTLGW_OS
);
617 void flash_ota_syntax(char *prog
)
619 fprintf(stderr
, "Syntax: %s parameters options\n\n", prog
);
620 fprintf(stderr
, "Mandatory parameters:\n");
621 fprintf(stderr
, "\t-f firmware.eq3\tfirmware file to flash\n");
622 fprintf(stderr
, "\t-s SERIAL\tserial of device to flash (optional when using -D)\n");
623 fprintf(stderr
, "\nOptional parameters:\n");
624 fprintf(stderr
, "\t-c device\tenable CUL-mode with CUL at path \"device\"\n");
625 fprintf(stderr
, "\t-b bps\t\tuse CUL with speed \"bps\" (default: %u)\n", DEFAULT_CUL_BPS
);
626 fprintf(stderr
, "\t-l\t\tlower payloadlen (required for devices with little RAM, e.g. CUL v2 and CUL v4)\n");
627 fprintf(stderr
, "\t-S serial\tuse HM-CFG-USB with given serial\n");
628 fprintf(stderr
, "\t-U device\tuse HM-MOD-UART on given device\n");
629 fprintf(stderr
, "\t-h\t\tthis help\n");
630 fprintf(stderr
, "\nOptional parameters for automatically sending device to bootloader\n");
631 fprintf(stderr
, "\t-C\t\tHMID of central (3 hex-bytes, no prefix, e.g. ABCDEF)\n");
632 fprintf(stderr
, "\t-D\t\tHMID of device (3 hex-bytes, no prefix, e.g. 123456)\n");
633 fprintf(stderr
, "\t-K\t\tKNO:KEY AES key-number and key (hex) separated by colon (Fhem hmKey attribute)\n");
636 int main(int argc
, char **argv
)
638 const char twiddlie
[] = { '-', '\\', '|', '/' };
639 const uint8_t cc1101_regs
[] = { 0x10, 0x5B, 0x11, 0xF8, 0x15, 0x47 };
640 char *fw_file
= NULL
;
642 char *culfw_dev
= NULL
;
644 unsigned int bps
= DEFAULT_CUL_BPS
;
646 struct recv_data rdata
;
652 char *hmcfgusb_serial
= NULL
;
663 printf("HomeMatic OTA flasher version " VERSION
"\n\n");
665 while((opt
= getopt(argc
, argv
, "b:c:f:hls:C:D:K:S:U:")) != -1) {
677 printf("Reducing payload-len from %d to %d\n", max_payloadlen
, LOWER_MAX_PAYLOAD
);
678 max_payloadlen
= LOWER_MAX_PAYLOAD
;
684 my_hmid
= strtoul(optarg
, &endptr
, 16);
685 if (*endptr
!= '\0') {
686 fprintf(stderr
, "Invalid central HMID!\n\n");
687 flash_ota_syntax(argv
[0]);
692 hmid
= strtoul(optarg
, &endptr
, 16);
693 if (*endptr
!= '\0') {
694 fprintf(stderr
, "Invalid device HMID!\n\n");
695 flash_ota_syntax(argv
[0]);
700 kNo
= strtoul(optarg
, &endptr
, 10);
701 if (*endptr
!= ':') {
702 fprintf(stderr
, "Invalid key number!\n\n");
703 flash_ota_syntax(argv
[0]);
707 for (cnt
= 0; cnt
< 16; cnt
++) {
708 if (*endptr
== '\0' || *(endptr
+1) == '\0' ||
709 !validate_nibble(*endptr
) ||
710 !validate_nibble(*(endptr
+1))) {
711 fprintf(stderr
, "Invalid key!\n\n");
712 flash_ota_syntax(argv
[0]);
715 key
[cnt
] = ascii_to_nibble(*endptr
) << 4 | ascii_to_nibble(*(endptr
+1));
720 hmcfgusb_serial
= optarg
;
729 flash_ota_syntax(argv
[0]);
736 if (!fw_file
|| (!serial
&& !hmid
)) {
737 flash_ota_syntax(argv
[0]);
741 fw
= firmware_read_firmware(fw_file
, debug
);
745 memset(&rdata
, 0, sizeof(rdata
));
746 memset(&dev
, 0, sizeof(struct hm_dev
));
749 printf("Opening culfw-device at path %s with speed %u\n", culfw_dev
, bps
);
750 dev
.culfw
= culfw_init(culfw_dev
, bps
, parse_culfw
, &rdata
);
752 fprintf(stderr
, "Can't initialize CUL at %s with rate %u\n", culfw_dev
, bps
);
755 dev
.type
= DEVICE_TYPE_CULFW
;
757 printf("Requesting firmware version\n");
758 culfw_send(dev
.culfw
, "\r\n", 2);
759 culfw_flush(dev
.culfw
);
762 culfw_send(dev
.culfw
, "V\r\n", 3);
765 pfd
= culfw_poll(dev
.culfw
, 1000);
766 if ((pfd
< 0) && errno
) {
767 if (errno
!= ETIMEDOUT
) {
768 perror("\n\nhmcfgusb_poll");
776 printf("culfw-device firmware version: ");
777 if (rdata
.version
!= 0xffff) {
779 (rdata
.version
>> 8) & 0xff,
780 rdata
.version
& 0xff);
782 if (rdata
.is_TSCUL
) {
783 culfw_send(dev
.culfw
, "At1\r\n", 5); // tsculfw: try switch on timestamp protocol
785 culfw_flush(dev
.culfw
);
786 culfw_send(dev
.culfw
, "ApTiMeStAmP\r\n", 13); // tsculfw: send ping to get credits info
787 pfd
= culfw_poll(dev
.culfw
, 1000);
788 if ((pfd
< 0) && errno
) {
789 if (errno
!= ETIMEDOUT
) {
790 perror("\n\nhmcfgusb_poll");
794 if (rdata
.credits
) { // tsculfw: maximum credits available?
795 fprintf(stderr
, "\n\ntsculfw does not report full credits, try again later\n");
800 char keybuf
[64] = { 0 };
803 printf("Setting AES-key\n");
804 snprintf(keybuf
, sizeof(keybuf
) - 1, "Ak%02x", kNo
- 1);
806 for (i
= 0; i
< 16; i
++) {
807 keybuf
[4 + (i
* 2)] = nibble_to_ascii((key
[i
] >> 4) & 0xf);
808 keybuf
[4 + (i
* 2) + 1] = nibble_to_ascii(key
[i
] & 0xf);
810 keybuf
[4 + (i
* 2) ] = '\r';
811 keybuf
[4 + (i
* 2) + 1] = '\n';
812 culfw_send(dev
.culfw
, keybuf
, strlen(keybuf
)); // tsculfw: send ping to get credits info
813 pfd
= culfw_poll(dev
.culfw
, 1000);
814 if ((pfd
< 0) && errno
) {
815 if (errno
!= ETIMEDOUT
) {
816 perror("\n\nhmcfgusb_poll");
827 if (rdata
.version
< 0x013a) {
828 fprintf(stderr
, "\nThis version does _not_ support firmware upgrade mode, you need at least 1.58!\n");
832 uint32_t new_hmid
= my_hmid
;
834 hmuartlgw_set_debug(debug
);
836 dev
.hmuartlgw
= hmuart_init(uart
, parse_hmuartlgw
, &rdata
, 1);
837 if (!dev
.hmuartlgw
) {
838 fprintf(stderr
, "Can't initialize HM-MOD-UART\n");
841 dev
.type
= DEVICE_TYPE_HMUARTLGW
;
843 out
[0] = HMUARTLGW_APP_GET_HMID
;
844 send_wait_hmuartlgw(&dev
, &rdata
, out
, 1, HMUARTLGW_APP
, HMUARTLGW_STATE_GET_HMID
, HMUARTLGW_STATE_ACK_APP
);
846 out
[0] = HMUARTLGW_OS_GET_FIRMWARE
;
847 send_wait_hmuartlgw(&dev
, &rdata
, out
, 1, HMUARTLGW_OS
, HMUARTLGW_STATE_GET_FIRMWARE
, HMUARTLGW_STATE_DONE
);
849 out
[0] = HMUARTLGW_OS_GET_CREDITS
;
850 send_wait_hmuartlgw(&dev
, &rdata
, out
, 1, HMUARTLGW_OS
, HMUARTLGW_STATE_GET_CREDITS
, HMUARTLGW_STATE_DONE
);
852 printf("HM-MOD-UART firmware version: %u.%u.%u, used credits: %u%%\n",
853 rdata
.uartlgw_version
[0],
854 rdata
.uartlgw_version
[1],
855 rdata
.uartlgw_version
[2],
858 if (rdata
.credits
>= 40) {
859 printf("\nRebooting HM-MOD-UART to avoid running out of credits\n");
861 hmuartlgw_enter_bootloader(dev
.hmuartlgw
);
862 hmuartlgw_enter_app(dev
.hmuartlgw
);
865 printf("\nHM-MOD-UART opened\n\n");
867 if (new_hmid
&& (my_hmid
!= new_hmid
)) {
868 printf("Changing hmid from %06x to %06x\n", my_hmid
, new_hmid
);
870 out
[0] = HMUARTLGW_APP_SET_HMID
;
871 out
[1] = (new_hmid
>> 16) & 0xff;
872 out
[2] = (new_hmid
>> 8) & 0xff;
873 out
[3] = new_hmid
& 0xff;
874 send_wait_hmuartlgw(&dev
, &rdata
, out
, 4, HMUARTLGW_APP
, HMUARTLGW_STATE_WAIT_APP
, HMUARTLGW_STATE_ACK_APP
);
880 printf("Setting AES-key\n");
882 memset(out
, 0, sizeof(out
));
883 out
[0] = HMUARTLGW_APP_SET_CURRENT_KEY
;
884 memcpy(&(out
[1]), key
, 16);
886 send_wait_hmuartlgw(&dev
, &rdata
, out
, 18, HMUARTLGW_APP
, HMUARTLGW_STATE_WAIT_APP
, HMUARTLGW_STATE_ACK_APP
);
888 memset(out
, 0, sizeof(out
));
889 out
[0] = HMUARTLGW_APP_SET_OLD_KEY
;
890 memcpy(&(out
[1]), key
, 16);
892 send_wait_hmuartlgw(&dev
, &rdata
, out
, 18, HMUARTLGW_APP
, HMUARTLGW_STATE_WAIT_APP
, HMUARTLGW_STATE_ACK_APP
);
895 uint32_t new_hmid
= my_hmid
;
897 hmcfgusb_set_debug(debug
);
899 dev
.hmcfgusb
= hmcfgusb_init(parse_hmcfgusb
, &rdata
, hmcfgusb_serial
);
901 fprintf(stderr
, "Can't initialize HM-CFG-USB\n");
904 dev
.type
= DEVICE_TYPE_HMCFGUSB
;
906 memset(out
, 0, sizeof(out
));
908 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
912 pfd
= hmcfgusb_poll(dev
.hmcfgusb
, 1000);
913 if ((pfd
< 0) && errno
) {
914 if (errno
!= ETIMEDOUT
) {
915 perror("\n\nhmcfgusb_poll");
923 if (rdata
.version
< 0x3c7) {
924 fprintf(stderr
, "HM-CFG-USB firmware too low: %u < 967\n", rdata
.version
);
928 printf("HM-CFG-USB firmware version: %u, used credits: %u%%\n", rdata
.version
, rdata
.credits
);
930 if (rdata
.credits
>= 40) {
931 printf("\nRebooting HM-CFG-USB to avoid running out of credits\n\n");
933 if (!dev
.hmcfgusb
->bootloader
) {
934 printf("HM-CFG-USB not in bootloader mode, entering bootloader.\n");
935 printf("Waiting for device to reappear...\n");
939 if (!dev
.hmcfgusb
->bootloader
)
940 hmcfgusb_enter_bootloader(dev
.hmcfgusb
);
941 hmcfgusb_close(dev
.hmcfgusb
);
944 } while (((dev
.hmcfgusb
= hmcfgusb_init(parse_hmcfgusb
, &rdata
, hmcfgusb_serial
)) == NULL
) || (!dev
.hmcfgusb
->bootloader
));
947 if (dev
.hmcfgusb
->bootloader
) {
948 printf("HM-CFG-USB in bootloader mode, rebooting\n");
952 if (dev
.hmcfgusb
->bootloader
)
953 hmcfgusb_leave_bootloader(dev
.hmcfgusb
);
954 hmcfgusb_close(dev
.hmcfgusb
);
957 } while (((dev
.hmcfgusb
= hmcfgusb_init(parse_hmcfgusb
, &rdata
, hmcfgusb_serial
)) == NULL
) || (dev
.hmcfgusb
->bootloader
));
961 printf("\n\nHM-CFG-USB opened\n\n");
963 if (new_hmid
&& (my_hmid
!= new_hmid
)) {
964 printf("Changing hmid from %06x to %06x\n", my_hmid
, new_hmid
);
966 memset(out
, 0, sizeof(out
));
968 out
[1] = (new_hmid
>> 16) & 0xff;
969 out
[2] = (new_hmid
>> 8) & 0xff;
970 out
[3] = new_hmid
& 0xff;
972 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
978 printf("Setting AES-key\n");
980 memset(out
, 0, sizeof(out
));
984 out
[3] = sizeof(key
);
985 memcpy(&(out
[4]), key
, sizeof(key
));
986 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
988 memset(out
, 0, sizeof(out
));
993 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
995 memset(out
, 0, sizeof(out
));
1000 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
1004 if (!switch_speed(&dev
, &rdata
, 10)) {
1005 fprintf(stderr
, "Can't switch speed!\n");
1009 if (hmid
&& my_hmid
) {
1011 case DEVICE_TYPE_HMCFGUSB
:
1012 printf("Adding HMID\n");
1014 memset(out
, 0, sizeof(out
));
1016 out
[1] = (hmid
>> 16) & 0xff;
1017 out
[2] = (hmid
>> 8) & 0xff;
1018 out
[3] = hmid
& 0xff;
1020 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
1022 case DEVICE_TYPE_HMUARTLGW
:
1023 printf("Adding HMID\n");
1025 memset(out
, 0, sizeof(out
));
1026 out
[0] = HMUARTLGW_APP_ADD_PEER
;
1027 out
[1] = (hmid
>> 16) & 0xff;
1028 out
[2] = (hmid
>> 8) & 0xff;
1029 out
[3] = hmid
& 0xff;
1030 out
[4] = (kNo
> 0) ? kNo
: 0x00; /* KeyIndex */
1031 out
[5] = 0x00; /* WakeUp? */
1032 out
[6] = 0x00; /* WakeUp? */
1034 send_wait_hmuartlgw(&dev
, &rdata
, out
, 7, HMUARTLGW_APP
, HMUARTLGW_STATE_WAIT_APP
, HMUARTLGW_STATE_ACK_APP
);
1038 printf("Sending device with hmid %06x to bootloader\n", hmid
);
1041 SET_SRC(out
, my_hmid
);
1043 out
[PAYLOAD
] = 0xCA;
1044 SET_LEN_FROM_PAYLOADLEN(out
, 1);
1048 out
[MSGID
] = msgid
++;
1049 if (send_hm_message(&dev
, &rdata
, out
)) {
1054 printf("Failed to send device to bootloader, please enter bootloader manually.\n");
1059 printf("Waiting for device with serial %s\n", serial
);
1061 printf("Waiting for device with HMID %06x\n", hmid
);
1067 case DEVICE_TYPE_CULFW
:
1068 pfd
= culfw_poll(dev
.culfw
, 1000);
1070 case DEVICE_TYPE_HMCFGUSB
:
1071 pfd
= hmcfgusb_poll(dev
.hmcfgusb
, 1000);
1073 case DEVICE_TYPE_HMUARTLGW
:
1074 pfd
= hmuartlgw_poll(dev
.hmuartlgw
, 1000);
1081 if ((pfd
< 0) && errno
) {
1082 if (errno
!= ETIMEDOUT
) {
1088 if ((rdata
.message
[LEN
] == 0x14) && /* Length */
1089 (rdata
.message
[MSGID
] == 0x00) && /* Message ID */
1090 (rdata
.message
[CTL
] == 0x00) && /* Control Byte */
1091 (rdata
.message
[TYPE
] == 0x10) && /* Messagte type: Information */
1092 (DST(rdata
.message
) == 0x000000) && /* Broadcast */
1093 (rdata
.message
[PAYLOAD
] == 0x00)) { /* FUP? */
1094 if (serial
&& !strncmp((char*)&(rdata
.message
[0x0b]), serial
, 10)) {
1095 hmid
= SRC(rdata
.message
);
1097 } else if (!serial
&& SRC(rdata
.message
) == (int)hmid
) {
1098 serial
= (char*)&(rdata
.message
[0x0b]);
1104 printf("Device with serial %s (HMID: %06x) entered firmware-update-mode\n", serial
, hmid
);
1107 case DEVICE_TYPE_HMCFGUSB
:
1108 printf("Adding HMID\n");
1110 memset(out
, 0, sizeof(out
));
1112 out
[1] = (hmid
>> 16) & 0xff;
1113 out
[2] = (hmid
>> 8) & 0xff;
1114 out
[3] = hmid
& 0xff;
1116 hmcfgusb_send(dev
.hmcfgusb
, out
, sizeof(out
), 1);
1118 case DEVICE_TYPE_HMUARTLGW
:
1119 printf("Adding HMID\n");
1121 memset(out
, 0, sizeof(out
));
1122 out
[0] = HMUARTLGW_APP_ADD_PEER
;
1123 out
[1] = (hmid
>> 16) & 0xff;
1124 out
[2] = (hmid
>> 8) & 0xff;
1125 out
[3] = hmid
& 0xff;
1126 out
[4] = 0x00; /* KeyIndex */
1127 out
[5] = 0x00; /* WakeUp? */
1128 out
[6] = 0x00; /* WakeUp? */
1130 send_wait_hmuartlgw(&dev
, &rdata
, out
, 7, HMUARTLGW_APP
, HMUARTLGW_STATE_WAIT_APP
, HMUARTLGW_STATE_ACK_APP
);
1137 printf("Initiating remote switch to 100k\n");
1139 memset(out
, 0, sizeof(out
));
1141 out
[MSGID
] = msgid
++;
1144 SET_SRC(out
, my_hmid
);
1147 memcpy(&out
[PAYLOAD
], cc1101_regs
, sizeof(cc1101_regs
));
1148 SET_LEN_FROM_PAYLOADLEN(out
, sizeof(cc1101_regs
));
1150 if (!send_hm_message(&dev
, &rdata
, out
)) {
1154 if (!switch_speed(&dev
, &rdata
, 100)) {
1155 fprintf(stderr
, "Can't switch speed!\n");
1159 printf("Has the device switched?\n");
1161 memset(out
, 0, sizeof(out
));
1163 out
[MSGID
] = msgid
++;
1166 SET_SRC(out
, my_hmid
);
1169 memcpy(&out
[PAYLOAD
], cc1101_regs
, sizeof(cc1101_regs
));
1170 SET_LEN_FROM_PAYLOADLEN(out
, sizeof(cc1101_regs
));
1174 if (send_hm_message(&dev
, &rdata
, out
)) {
1175 /* A0A02000221B9AD00000000 */
1184 if (!switch_speed(&dev
, &rdata
, 10)) {
1185 fprintf(stderr
, "Can't switch speed!\n");
1189 } while ((!switched
) && (switchcnt
--));
1192 fprintf(stderr
, "Too many errors, giving up!\n");
1198 printf("Flashing %d blocks", fw
->fw_blocks
);
1202 printf(": %04u/%04u %c", 0, fw
->fw_blocks
, twiddlie
[0]);
1206 for (block
= 0; block
< fw
->fw_blocks
; block
++) {
1209 len
= fw
->fw
[block
][2] << 8;
1210 len
|= fw
->fw
[block
][3];
1212 pos
= &(fw
->fw
[block
][2]);
1214 len
+= 2; /* length */
1217 hexdump(pos
, len
, "F> ");
1222 int payloadlen
= max_payloadlen
- 2;
1226 payloadlen
= max_payloadlen
;
1230 if ((len
- (pos
- &(fw
->fw
[block
][2]))) < payloadlen
)
1231 payloadlen
= (len
- (pos
- &(fw
->fw
[block
][2])));
1233 if (((pos
+ payloadlen
) - &(fw
->fw
[block
][2])) == len
)
1236 memset(rdata
.message
, 0, sizeof(rdata
.message
));
1237 rdata
.message_type
= 0;
1239 memset(out
, 0, sizeof(out
));
1245 SET_SRC(out
, my_hmid
);
1248 memcpy(&out
[PAYLOAD
], pos
, payloadlen
);
1249 SET_LEN_FROM_PAYLOADLEN(out
, payloadlen
);
1251 if (send_hm_message(&dev
, &rdata
, out
)) {
1254 pos
= &(fw
->fw
[block
][2]);
1256 if (cnt
== MAX_RETRIES
) {
1257 fprintf(stderr
, "\nToo many errors, giving up!\n");
1260 printf("Flashing %d blocks: %04u/%04u %c", fw
->fw_blocks
, block
+ 1, fw
->fw_blocks
, twiddlie
[msgnum
% sizeof(twiddlie
)]);
1267 printf("\b\b\b\b\b\b\b\b\b\b\b%04u/%04u %c",
1268 block
+ 1, fw
->fw_blocks
, twiddlie
[msgnum
% sizeof(twiddlie
)]);
1271 } while((pos
- &(fw
->fw
[block
][2])) < len
);
1279 if (!switch_speed(&dev
, &rdata
, 10)) {
1280 fprintf(stderr
, "Can't switch speed!\n");
1284 printf("Waiting for device to reboot\n");
1285 rdata
.message_type
= MESSAGE_TYPE_R
;
1288 if (dev
.type
== DEVICE_TYPE_HMUARTLGW
)
1289 cnt
= 200; /* FIXME */
1293 case DEVICE_TYPE_CULFW
:
1294 pfd
= culfw_poll(dev
.culfw
, 1000);
1296 case DEVICE_TYPE_HMCFGUSB
:
1297 pfd
= hmcfgusb_poll(dev
.hmcfgusb
, 1000);
1299 case DEVICE_TYPE_HMUARTLGW
:
1300 pfd
= hmuartlgw_poll(dev
.hmuartlgw
, 1000);
1306 if ((pfd
< 0) && errno
) {
1307 if (errno
!= ETIMEDOUT
) {
1312 if (rdata
.message_type
== MESSAGE_TYPE_E
) {
1317 if (rdata
.message_type
== MESSAGE_TYPE_E
) {
1318 printf("Device rebooted\n");
1322 case DEVICE_TYPE_HMCFGUSB
:
1323 hmcfgusb_close(dev
.hmcfgusb
);
1326 case DEVICE_TYPE_CULFW
:
1327 culfw_close(dev
.culfw
);
1331 return EXIT_SUCCESS
;