]> cvs.zerfleddert.de Git - hmcfgusb/blob - flash-ota.c
projects / hmcfgusb / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
AES: add public-domain AES implementation from Brad Conte
[hmcfgusb] / flash-ota.c
1 /* flasher for HomeMatic-devices supporting OTA updates
2 *
3 * Copyright (c) 2014 Michael Gernoth <michael@gernoth.net>
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a copy
6 * of this software and associated documentation files (the "Software"), to
7 * deal in the Software without restriction, including without limitation the
8 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
9 * sell copies of the Software, and to permit persons to whom the Software is
10 * furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be included in
13 * all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 */
23
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <unistd.h>
27 #include <stdint.h>
28 #include <string.h>
29 #include <strings.h>
30 #include <poll.h>
31 #include <errno.h>
32 #include <sys/types.h>
33 #include <sys/stat.h>
34 #include <fcntl.h>
35 #include <sys/time.h>
36 #include <libusb-1.0/libusb.h>
37
38 #include "hexdump.h"
39 #include "firmware.h"
40 #include "hm.h"
41 #include "version.h"
42 #include "hmcfgusb.h"
43 #include "culfw.h"
44 #include "util.h"
45
46 #define MAX_RETRIES 5
47 #define NORMAL_MAX_PAYLOAD 37
48 #define LOWER_MAX_PAYLOAD 17
49
50 extern char *optarg;
51
52 uint32_t hmid = 0;
53 uint32_t my_hmid = 0;
54 char key[16] = {0};
55 int32_t kNo = -1;
56
57 /* Maximum payloadlen supported by IO */
58 uint32_t max_payloadlen = NORMAL_MAX_PAYLOAD;
59
60 enum device_type {
61 DEVICE_TYPE_HMCFGUSB,
62 DEVICE_TYPE_CULFW,
63 };
64
65 struct ota_dev {
66 int type;
67 struct hmcfgusb_dev *hmcfgusb;
68 struct culfw_dev *culfw;
69 };
70
71 enum message_type {
72 MESSAGE_TYPE_E = 1,
73 MESSAGE_TYPE_R = 2,
74 };
75
76 struct recv_data {
77 uint8_t message[64];
78 enum message_type message_type;
79 uint16_t status;
80 int speed;
81 uint16_t version;
82 uint8_t credits;
83 };
84
85 static int parse_hmcfgusb(uint8_t *buf, int buf_len, void *data)
86 {
87 struct recv_data *rdata = data;
88
89 if (buf_len < 1)
90 return 1;
91
92 switch (buf[0]) {
93 case 'E':
94 if ((!hmid) ||
95 ((buf[0x11] == ((hmid >> 16) & 0xff)) &&
96 (buf[0x12] == ((hmid >> 8) & 0xff)) &&
97 (buf[0x13] == (hmid & 0xff)))) {
98 memset(rdata->message, 0, sizeof(rdata->message));
99 memcpy(rdata->message, buf + 0x0d, buf[0x0d] + 1);
100 rdata->message_type = MESSAGE_TYPE_E;
101 }
102 break;
103 case 'R':
104 memset(rdata->message, 0, sizeof(rdata->message));
105 memcpy(rdata->message, buf + 0x0e, buf[0x0e] + 1);
106 rdata->status = (buf[5] << 8) | buf[6];
107 rdata->message_type = MESSAGE_TYPE_R;
108 break;
109 case 'G':
110 rdata->speed = buf[1];
111 break;
112 case 'H':
113 rdata->version = (buf[11] << 8) | buf[12];
114 rdata->credits = buf[36];
115 my_hmid = (buf[0x1b] << 16) | (buf[0x1c] << 8) | buf[0x1d];
116 break;
117 default:
118 break;
119 }
120
121 if (buf_len != 1)
122 return 1;
123
124 return 1;
125 }
126
127 static int parse_culfw(uint8_t *buf, int buf_len, void *data)
128 {
129 struct recv_data *rdata = data;
130 int pos = 0;
131
132 memset(rdata, 0, sizeof(struct recv_data));
133
134 if (buf_len <= 3)
135 return 0;
136
137 switch(buf[0]) {
138 case 'A':
139 if (buf[1] == 's')
140 return 0;
141
142 while(validate_nibble(buf[(pos * 2) + 1]) &&
143 validate_nibble(buf[(pos * 2) + 2]) &&
144 (pos + 1 < buf_len)) {
145 rdata->message[pos] = ascii_to_nibble(buf[(pos * 2) + 1]) << 4;
146 rdata->message[pos] |= ascii_to_nibble(buf[(pos * 2) + 2]);
147 pos++;
148 }
149
150 if (hmid && (SRC(rdata->message) != hmid))
151 return 0;
152
153 rdata->message_type = MESSAGE_TYPE_E;
154 break;
155 case 'V':
156 {
157 uint8_t v;
158 char *s;
159 char *e;
160
161 s = ((char*)buf) + 2;
162 e = strchr(s, '.');
163 if (!e) {
164 fprintf(stderr, "Unknown response from CUL: %s", buf);
165 return 0;
166 }
167 *e = '\0';
168 v = atoi(s);
169 rdata->version = v << 8;
170
171 s = e + 1;
172 e = strchr(s, ' ');
173 if (!e) {
174 fprintf(stderr, "Unknown response from CUL: %s", buf);
175 return 0;
176 }
177 *e = '\0';
178 v = atoi(s);
179 rdata->version |= v;
180 }
181 break;
182 default:
183 fprintf(stderr, "Unknown response from CUL: %s", buf);
184 return 0;
185 break;
186 }
187
188 return 1;
189 }
190
191 int send_hm_message(struct ota_dev *dev, struct recv_data *rdata, uint8_t *msg)
192 {
193 static uint32_t id = 1;
194 struct timeval tv;
195 uint8_t out[0x40];
196 int pfd;
197
198 switch(dev->type) {
199 case DEVICE_TYPE_HMCFGUSB:
200 if (gettimeofday(&tv, NULL) == -1) {
201 perror("gettimeofay");
202 return 0;
203 }
204
205 memset(out, 0, sizeof(out));
206
207 out[0] = 'S';
208 out[1] = (id >> 24) & 0xff;
209 out[2] = (id >> 16) & 0xff;
210 out[3] = (id >> 8) & 0xff;
211 out[4] = id & 0xff;
212 out[10] = 0x01;
213 out[11] = (tv.tv_usec >> 24) & 0xff;
214 out[12] = (tv.tv_usec >> 16) & 0xff;
215 out[13] = (tv.tv_usec >> 8) & 0xff;
216 out[14] = tv.tv_usec & 0xff;
217
218 memcpy(&out[0x0f], msg, msg[0] + 1);
219
220 memset(rdata, 0, sizeof(struct recv_data));
221 hmcfgusb_send(dev->hmcfgusb, out, sizeof(out), 1);
222
223 while (1) {
224 if (rdata->message_type == MESSAGE_TYPE_R) {
225 if (((rdata->status & 0xdf) == 0x01) ||
226 ((rdata->status & 0xdf) == 0x02)) {
227 break;
228 } else {
229 if ((rdata->status & 0xff00) == 0x0400) {
230 fprintf(stderr, "\nOut of credits!\n");
231 } else if ((rdata->status & 0xff) == 0x08) {
232 fprintf(stderr, "\nMissing ACK!\n");
233 } else if ((rdata->status & 0xff) == 0x30) {
234 fprintf(stderr, "\nUnknown AES-key requested!\n");
235 } else {
236 fprintf(stderr, "\nInvalid status: %04x\n", rdata->status);
237 }
238 return 0;
239 }
240 }
241 errno = 0;
242 pfd = hmcfgusb_poll(dev->hmcfgusb, 1000);
243 if ((pfd < 0) && errno) {
244 if (errno != ETIMEDOUT) {
245 perror("\n\nhmcfgusb_poll");
246 exit(EXIT_FAILURE);
247 }
248 }
249 }
250 break;
251 case DEVICE_TYPE_CULFW:
252 {
253 char buf[256];
254 int i;
255
256 memset(buf, 0, sizeof(buf));
257 buf[0] = 'A';
258 buf[1] = 's';
259 for (i = 0; i < msg[0] + 1; i++) {
260 buf[2 + (i * 2)] = nibble_to_ascii((msg[i] >> 4) & 0xf);
261 buf[2 + (i * 2) + 1] = nibble_to_ascii(msg[i] & 0xf);
262 }
263 buf[2 + (i * 2) ] = '\r';
264 buf[2 + (i * 2) + 1] = '\n';
265
266 memset(rdata, 0, sizeof(struct recv_data));
267 if (culfw_send(dev->culfw, buf, 2 + (i * 2) + 1) == 0) {
268 fprintf(stderr, "culfw_send failed!\n");
269 exit(EXIT_FAILURE);
270 }
271
272 if (msg[CTL] & 0x20) {
273 int cnt = 3;
274 int pfd;
275 do {
276 errno = 0;
277 pfd = culfw_poll(dev->culfw, 200);
278 if ((pfd < 0) && errno) {
279 if (errno != ETIMEDOUT) {
280 perror("\n\nculfw_poll");
281 exit(EXIT_FAILURE);
282 }
283 }
284 if (rdata->message_type == MESSAGE_TYPE_E) {
285 if (rdata->message[TYPE] == 0x02) {
286 if (rdata->message[PAYLOAD] == 0x04) {
287 printf("AES request received but not implemented for culfw!\n");
288 } else if (rdata->message[PAYLOAD] >= 0x80 && rdata->message[PAYLOAD] <= 0x8f) {
289 printf("NACK\n");
290 } else { /* ACK or ACKinfo */
291 break;
292 }
293 } else {
294 printf("Unexpected message received: ");
295 for (i = 0; i < rdata->message[LEN]; i++) {
296 printf("%02x", rdata->message[i+1]);
297 }
298 printf("\n");
299 }
300 }
301 } while(cnt--);
302
303 if (cnt == -1) {
304 fprintf(stderr, "\nMissing ACK!\n");
305 return 0;
306 }
307 }
308 }
309 break;
310 }
311
312 id++;
313 return 1;
314 }
315
316 static int switch_speed(struct ota_dev *dev, struct recv_data *rdata, uint8_t speed)
317 {
318 uint8_t out[0x40];
319 int pfd;
320
321 printf("Entering %uk-mode\n", speed);
322
323 switch(dev->type) {
324 case DEVICE_TYPE_HMCFGUSB:
325 memset(out, 0, sizeof(out));
326 out[0] = 'G';
327 out[1] = speed;
328
329 hmcfgusb_send(dev->hmcfgusb, out, sizeof(out), 1);
330
331 while (1) {
332 errno = 0;
333 pfd = hmcfgusb_poll(dev->hmcfgusb, 1000);
334 if ((pfd < 0) && errno) {
335 if (errno != ETIMEDOUT) {
336 perror("\n\nhmcfgusb_poll");
337 exit(EXIT_FAILURE);
338 }
339 }
340 if (rdata->speed == speed)
341 break;
342 }
343 break;
344 case DEVICE_TYPE_CULFW:
345 if (speed == 100) {
346 return culfw_send(dev->culfw, "AR\r\n", 4);
347 } else {
348 return culfw_send(dev->culfw, "Ar\r\n", 4);
349 }
350 break;
351 }
352
353 return 1;
354 }
355
356 void flash_ota_syntax(char *prog)
357 {
358 fprintf(stderr, "Syntax: %s parameters options\n\n", prog);
359 fprintf(stderr, "Mandatory parameters:\n");
360 fprintf(stderr, "\t-f firmware.eq3\tfirmware file to flash\n");
361 fprintf(stderr, "\t-s SERIAL\tserial of device to flash (optional when using -D)\n");
362 fprintf(stderr, "\nOptional parameters:\n");
363 fprintf(stderr, "\t-c device\tenable CUL-mode with CUL at path \"device\"\n");
364 fprintf(stderr, "\t-b bps\t\tuse CUL with speed \"bps\" (default: %u)\n", DEFAULT_CUL_BPS);
365 fprintf(stderr, "\t-l\t\tlower payloadlen (required for devices with little RAM, e.g. CUL v2 and CUL v4)\n");
366 fprintf(stderr, "\t-h\t\tthis help\n");
367 fprintf(stderr, "\nOptional parameters for automatically sending device to bootloader\n");
368 fprintf(stderr, "\t-C\t\tHMID of central (3 hex-bytes, no prefix, e.g. ABCDEF)\n");
369 fprintf(stderr, "\t-D\t\tHMID of device (3 hex-bytes, no prefix, e.g. 123456)\n");
370 fprintf(stderr, "\t-K\t\tKNO:KEY AES key-number and key (hex) separated by colon (Fhem hmKey attribute)\n");
371 fprintf(stderr, "\t\t\tAES is currently not supported when using a culfw-device!\n");
372 }
373
374 int main(int argc, char **argv)
375 {
376 const char twiddlie[] = { '-', '\\', '|', '/' };
377 const uint8_t cc1101_regs[] = { 0x10, 0x5B, 0x11, 0xF8, 0x15, 0x47 };
378 char *fw_file = NULL;
379 char *serial = NULL;
380 char *culfw_dev = NULL;
381 char *endptr = NULL;
382 unsigned int bps = DEFAULT_CUL_BPS;
383 struct ota_dev dev;
384 struct recv_data rdata;
385 uint8_t out[0x40];
386 uint8_t *pos;
387 uint8_t msgid = 0x1;
388 uint16_t len;
389 struct firmware *fw;
390 int block;
391 int pfd;
392 int debug = 0;
393 int cnt;
394 int switchcnt = 0;
395 int msgnum = 0;
396 int switched = 0;
397 int opt;
398
399 printf("HomeMatic OTA flasher version " VERSION "\n\n");
400
401 while((opt = getopt(argc, argv, "b:c:f:hls:C:D:K:")) != -1) {
402 switch (opt) {
403 case 'b':
404 bps = atoi(optarg);
405 break;
406 case 'c':
407 culfw_dev = optarg;
408 break;
409 case 'f':
410 fw_file = optarg;
411 break;
412 case 'l':
413 printf("Reducing payload-len from %d to %d\n", max_payloadlen, LOWER_MAX_PAYLOAD);
414 max_payloadlen = LOWER_MAX_PAYLOAD;
415 break;
416 case 's':
417 serial = optarg;
418 break;
419 case 'C':
420 my_hmid = strtoul(optarg, &endptr, 16);
421 if (*endptr != '\0') {
422 fprintf(stderr, "Invalid central HMID!\n\n");
423 flash_ota_syntax(argv[0]);
424 exit(EXIT_FAILURE);
425 }
426 break;
427 case 'D':
428 hmid = strtoul(optarg, &endptr, 16);
429 if (*endptr != '\0') {
430 fprintf(stderr, "Invalid device HMID!\n\n");
431 flash_ota_syntax(argv[0]);
432 exit(EXIT_FAILURE);
433 }
434 break;
435 case 'K':
436 kNo = strtoul(optarg, &endptr, 10);
437 if (*endptr != ':') {
438 fprintf(stderr, "Invalid key number!\n\n");
439 flash_ota_syntax(argv[0]);
440 exit(EXIT_FAILURE);
441 }
442 endptr++;
443 for (cnt = 0; cnt < 16; cnt++) {
444 if (*endptr == '\0' || *(endptr+1) == '\0' ||
445 !validate_nibble(*endptr) ||
446 !validate_nibble(*(endptr+1))) {
447 fprintf(stderr, "Invalid key!\n\n");
448 flash_ota_syntax(argv[0]);
449 exit(EXIT_FAILURE);
450 }
451 key[cnt] = ascii_to_nibble(*endptr) << 4 | ascii_to_nibble(*(endptr+1));
452 endptr += 2;
453 }
454 break;
455 case 'h':
456 case ':':
457 case '?':
458 default:
459 flash_ota_syntax(argv[0]);
460 exit(EXIT_FAILURE);
461 break;
462
463 }
464 }
465
466 if (!fw_file || (!serial && !hmid)) {
467 flash_ota_syntax(argv[0]);
468 exit(EXIT_FAILURE);
469 }
470
471 fw = firmware_read_firmware(fw_file, debug);
472 if (!fw)
473 exit(EXIT_FAILURE);
474
475 memset(&rdata, 0, sizeof(rdata));
476 memset(&dev, 0, sizeof(struct ota_dev));
477
478 if (culfw_dev) {
479 if (kNo != -1) {
480 fprintf(stderr, "\nAES currently not supported with culfw-device!\n");
481 flash_ota_syntax(argv[0]);
482 exit(EXIT_FAILURE);
483 }
484
485 printf("Opening culfw-device at path %s with speed %u\n", culfw_dev, bps);
486 dev.culfw = culfw_init(culfw_dev, bps, parse_culfw, &rdata);
487 if (!dev.culfw) {
488 fprintf(stderr, "Can't initialize CUL at %s with rate %u\n", culfw_dev, bps);
489 exit(EXIT_FAILURE);
490 }
491 dev.type = DEVICE_TYPE_CULFW;
492
493 printf("Requesting firmware version\n");
494 culfw_send(dev.culfw, "\r\n", 2);
495 culfw_flush(dev.culfw);
496
497 while (1) {
498 culfw_send(dev.culfw, "V\r\n", 3);
499
500 errno = 0;
501 pfd = culfw_poll(dev.culfw, 1000);
502 if ((pfd < 0) && errno) {
503 if (errno != ETIMEDOUT) {
504 perror("\n\nhmcfgusb_poll");
505 exit(EXIT_FAILURE);
506 }
507 }
508 if (rdata.version)
509 break;
510 }
511
512 printf("culfw-device firmware version: %u.%02u\n",
513 (rdata.version >> 8) & 0xff,
514 rdata.version & 0xff);
515
516 if (rdata.version < 0x013a) {
517 fprintf(stderr, "\nThis version does _not_ support firmware upgrade mode, you need at least 1.58!\n");
518 exit(EXIT_FAILURE);
519 }
520 } else {
521 uint32_t new_hmid = my_hmid;
522
523 hmcfgusb_set_debug(debug);
524
525 dev.hmcfgusb = hmcfgusb_init(parse_hmcfgusb, &rdata);
526 if (!dev.hmcfgusb) {
527 fprintf(stderr, "Can't initialize HM-CFG-USB\n");
528 exit(EXIT_FAILURE);
529 }
530 dev.type = DEVICE_TYPE_HMCFGUSB;
531
532 memset(out, 0, sizeof(out));
533 out[0] = 'K';
534 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
535
536 while (1) {
537 errno = 0;
538 pfd = hmcfgusb_poll(dev.hmcfgusb, 1000);
539 if ((pfd < 0) && errno) {
540 if (errno != ETIMEDOUT) {
541 perror("\n\nhmcfgusb_poll");
542 exit(EXIT_FAILURE);
543 }
544 }
545 if (rdata.version)
546 break;
547 }
548
549 if (rdata.version < 0x3c7) {
550 fprintf(stderr, "HM-CFG-USB firmware too low: %u < 967\n", rdata.version);
551 exit(EXIT_FAILURE);
552 }
553
554 printf("HM-CFG-USB firmware version: %u, used credits: %u%%\n", rdata.version, rdata.credits);
555
556 if (rdata.credits >= 40) {
557 printf("\nRebooting HM-CFG-USB to avoid running out of credits\n\n");
558
559 if (!dev.hmcfgusb->bootloader) {
560 printf("HM-CFG-USB not in bootloader mode, entering bootloader.\n");
561 printf("Waiting for device to reappear...\n");
562
563 do {
564 if (dev.hmcfgusb) {
565 if (!dev.hmcfgusb->bootloader)
566 hmcfgusb_enter_bootloader(dev.hmcfgusb);
567 hmcfgusb_close(dev.hmcfgusb);
568 }
569 sleep(1);
570 } while (((dev.hmcfgusb = hmcfgusb_init(parse_hmcfgusb, &rdata)) == NULL) || (!dev.hmcfgusb->bootloader));
571 }
572
573 if (dev.hmcfgusb->bootloader) {
574 printf("HM-CFG-USB in bootloader mode, rebooting\n");
575
576 do {
577 if (dev.hmcfgusb) {
578 if (dev.hmcfgusb->bootloader)
579 hmcfgusb_leave_bootloader(dev.hmcfgusb);
580 hmcfgusb_close(dev.hmcfgusb);
581 }
582 sleep(1);
583 } while (((dev.hmcfgusb = hmcfgusb_init(parse_hmcfgusb, &rdata)) == NULL) || (dev.hmcfgusb->bootloader));
584 }
585 }
586
587 printf("\n\nHM-CFG-USB opened\n\n");
588
589 if (new_hmid && (my_hmid != new_hmid)) {
590 printf("Changing hmid from %06x to %06x\n", my_hmid, new_hmid);
591
592 memset(out, 0, sizeof(out));
593 out[0] = 'A';
594 out[1] = (new_hmid >> 16) & 0xff;
595 out[2] = (new_hmid >> 8) & 0xff;
596 out[3] = new_hmid & 0xff;
597
598 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
599
600 my_hmid = new_hmid;
601 }
602
603 if (kNo > 0) {
604 printf("Setting AES-key\n");
605
606 memset(out, 0, sizeof(out));
607 out[0] = 'Y';
608 out[1] = 0x01;
609 out[2] = kNo;
610 out[3] = sizeof(key);
611 memcpy(&(out[4]), key, sizeof(key));
612 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
613
614 memset(out, 0, sizeof(out));
615 out[0] = 'Y';
616 out[1] = 0x02;
617 out[2] = 0x00;
618 out[3] = 0x00;
619 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
620
621 memset(out, 0, sizeof(out));
622 out[0] = 'Y';
623 out[1] = 0x03;
624 out[2] = 0x00;
625 out[3] = 0x00;
626 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
627 }
628 }
629
630 if (!switch_speed(&dev, &rdata, 10)) {
631 fprintf(stderr, "Can't switch speed!\n");
632 exit(EXIT_FAILURE);
633 }
634
635 if (hmid && my_hmid) {
636 printf("Sending device with hmid %06x to bootloader\n", hmid);
637 out[MSGID] = msgid++;
638 out[CTL] = 0x30;
639 out[TYPE] = 0x11;
640 SET_SRC(out, my_hmid);
641 SET_DST(out, hmid);
642 out[PAYLOAD] = 0xCA;
643 SET_LEN_FROM_PAYLOADLEN(out, 1);
644
645 cnt = 3;
646 do {
647 if (send_hm_message(&dev, &rdata, out)) {
648 break;
649 }
650 } while (cnt--);
651 if (cnt == -1) {
652 printf("Failed to send device to bootloader, please enter bootloader manually.\n");
653 }
654 }
655
656 if (serial) {
657 printf("Waiting for device with serial %s\n", serial);
658 } else {
659 printf("Waiting for device with HMID %06x\n", hmid);
660 }
661
662 while (1) {
663 errno = 0;
664 switch (dev.type) {
665 case DEVICE_TYPE_CULFW:
666 pfd = culfw_poll(dev.culfw, 1000);
667 break;
668 case DEVICE_TYPE_HMCFGUSB:
669 default:
670 pfd = hmcfgusb_poll(dev.hmcfgusb, 1000);
671 break;
672 }
673
674 if ((pfd < 0) && errno) {
675 if (errno != ETIMEDOUT) {
676 perror("\n\npoll");
677 exit(EXIT_FAILURE);
678 }
679 }
680
681 if ((rdata.message[LEN] == 0x14) && /* Length */
682 (rdata.message[MSGID] == 0x00) && /* Message ID */
683 (rdata.message[CTL] == 0x00) && /* Control Byte */
684 (rdata.message[TYPE] == 0x10) && /* Messagte type: Information */
685 (DST(rdata.message) == 0x000000) && /* Broadcast */
686 (rdata.message[PAYLOAD] == 0x00)) { /* FUP? */
687 if (serial && !strncmp((char*)&(rdata.message[0x0b]), serial, 10)) {
688 hmid = SRC(rdata.message);
689 break;
690 } else if (!serial && SRC(rdata.message) == hmid) {
691 serial = (char*)&(rdata.message[0x0b]);
692 break;
693 }
694 }
695 }
696
697 printf("Device with serial %s (HMID: %06x) entered firmware-update-mode\n", serial, hmid);
698
699 if (dev.type == DEVICE_TYPE_HMCFGUSB) {
700 printf("Adding HMID\n");
701
702 memset(out, 0, sizeof(out));
703 out[0] = '+';
704 out[1] = (hmid >> 16) & 0xff;
705 out[2] = (hmid >> 8) & 0xff;
706 out[3] = hmid & 0xff;
707
708 hmcfgusb_send(dev.hmcfgusb, out, sizeof(out), 1);
709 }
710
711 switchcnt = 3;
712 do {
713 printf("Initiating remote switch to 100k\n");
714
715 memset(out, 0, sizeof(out));
716
717 out[MSGID] = msgid++;
718 out[CTL] = 0x00;
719 out[TYPE] = 0xCB;
720 SET_SRC(out, my_hmid);
721 SET_DST(out, hmid);
722
723 memcpy(&out[PAYLOAD], cc1101_regs, sizeof(cc1101_regs));
724 SET_LEN_FROM_PAYLOADLEN(out, sizeof(cc1101_regs));
725
726 if (!send_hm_message(&dev, &rdata, out)) {
727 exit(EXIT_FAILURE);
728 }
729
730 if (!switch_speed(&dev, &rdata, 100)) {
731 fprintf(stderr, "Can't switch speed!\n");
732 exit(EXIT_FAILURE);
733 }
734
735 printf("Has the device switched?\n");
736
737 memset(out, 0, sizeof(out));
738
739 out[MSGID] = msgid++;
740 out[CTL] = 0x20;
741 out[TYPE] = 0xCB;
742 SET_SRC(out, my_hmid);
743 SET_DST(out, hmid);
744
745 memcpy(&out[PAYLOAD], cc1101_regs, sizeof(cc1101_regs));
746 SET_LEN_FROM_PAYLOADLEN(out, sizeof(cc1101_regs));
747
748 cnt = 3;
749 do {
750 if (send_hm_message(&dev, &rdata, out)) {
751 /* A0A02000221B9AD00000000 */
752 switched = 1;
753 break;
754 }
755 } while (cnt--);
756
757 if (!switched) {
758 printf("No!\n");
759
760 if (!switch_speed(&dev, &rdata, 10)) {
761 fprintf(stderr, "Can't switch speed!\n");
762 exit(EXIT_FAILURE);
763 }
764 }
765 } while ((!switched) && (switchcnt--));
766
767 if (!switched) {
768 fprintf(stderr, "Too many errors, giving up!\n");
769 exit(EXIT_FAILURE);
770 }
771
772 printf("Yes!\n");
773
774 printf("Flashing %d blocks", fw->fw_blocks);
775 if (debug) {
776 printf("\n");
777 } else {
778 printf(": %04u/%04u %c", 0, fw->fw_blocks, twiddlie[0]);
779 fflush(stdout);
780 }
781
782 for (block = 0; block < fw->fw_blocks; block++) {
783 int first;
784
785 len = fw->fw[block][2] << 8;
786 len |= fw->fw[block][3];
787
788 pos = &(fw->fw[block][2]);
789
790 len += 2; /* length */
791
792 if (debug)
793 hexdump(pos, len, "F> ");
794
795 first = 1;
796 cnt = 0;
797 do {
798 int payloadlen = max_payloadlen - 2;
799 int ack = 0;
800
801 if (first) {
802 payloadlen = max_payloadlen;
803 first = 0;
804 }
805
806 if ((len - (pos - &(fw->fw[block][2]))) < payloadlen)
807 payloadlen = (len - (pos - &(fw->fw[block][2])));
808
809 if (((pos + payloadlen) - &(fw->fw[block][2])) == len)
810 ack = 1;
811
812 memset(&rdata, 0, sizeof(rdata));
813
814 memset(out, 0, sizeof(out));
815
816 out[MSGID] = msgid;
817 if (ack)
818 out[CTL] = 0x20;
819 out[TYPE] = 0xCA;
820 SET_SRC(out, my_hmid);
821 SET_DST(out, hmid);
822
823 memcpy(&out[PAYLOAD], pos, payloadlen);
824 SET_LEN_FROM_PAYLOADLEN(out, payloadlen);
825
826 if (send_hm_message(&dev, &rdata, out)) {
827 pos += payloadlen;
828 } else {
829 pos = &(fw->fw[block][2]);
830 cnt++;
831 if (cnt == MAX_RETRIES) {
832 fprintf(stderr, "\nToo many errors, giving up!\n");
833 exit(EXIT_FAILURE);
834 } else {
835 printf("Flashing %d blocks: %04u/%04u %c", fw->fw_blocks, block + 1, fw->fw_blocks, twiddlie[msgnum % sizeof(twiddlie)]);
836 }
837 }
838
839 msgnum++;
840
841 if (!debug) {
842 printf("\b\b\b\b\b\b\b\b\b\b\b%04u/%04u %c",
843 block + 1, fw->fw_blocks, twiddlie[msgnum % sizeof(twiddlie)]);
844 fflush(stdout);
845 }
846 } while((pos - &(fw->fw[block][2])) < len);
847 msgid++;
848 }
849
850 firmware_free(fw);
851
852 printf("\n");
853
854 if (!switch_speed(&dev, &rdata, 10)) {
855 fprintf(stderr, "Can't switch speed!\n");
856 exit(EXIT_FAILURE);
857 }
858
859 printf("Waiting for device to reboot\n");
860
861 cnt = 10;
862 do {
863 errno = 0;
864 switch(dev.type) {
865 case DEVICE_TYPE_CULFW:
866 pfd = culfw_poll(dev.culfw, 1000);
867 break;
868 case DEVICE_TYPE_HMCFGUSB:
869 default:
870 pfd = hmcfgusb_poll(dev.hmcfgusb, 1000);
871 break;
872 }
873 if ((pfd < 0) && errno) {
874 if (errno != ETIMEDOUT) {
875 perror("\n\npoll");
876 exit(EXIT_FAILURE);
877 }
878 }
879 if (rdata.message_type == MESSAGE_TYPE_E) {
880 break;
881 }
882 } while(cnt--);
883
884 if (rdata.message_type == MESSAGE_TYPE_E) {
885 printf("Device rebooted\n");
886 }
887
888 switch(dev.type) {
889 case DEVICE_TYPE_HMCFGUSB:
890 hmcfgusb_close(dev.hmcfgusb);
891 hmcfgusb_exit();
892 break;
893 case DEVICE_TYPE_CULFW:
894 culfw_close(dev.culfw);
895 break;
896 }
897
898 return EXIT_SUCCESS;
899 }
HM-CFG-USB{,2} linux utilities
Impressum, Datenschutz