Signed-off-by: Anton Lundin glance@acc.umu.se --- src/aes.c | 251 ++++++++++++++++++++++++++++++++------------------------------ 1 file changed, 129 insertions(+), 122 deletions(-)

diff --git a/src/aes.c b/src/aes.c index 4c7645f..4315a65 100644 --- a/src/aes.c +++ b/src/aes.c @@ -63,18 +63,21 @@ NOTE: String length must be evenly divisible by 16byte (str_len % 16 == 0) /*****************************************************************************/ // state - array holding the intermediate results during decryption. typedef uint8_t state_t[4][4]; -static state_t* state;

-// The array that stores the round keys. -static uint8_t RoundKey[176]; +typedef struct aes_state_t { + state_t* state;

-// The Key input to the AES Program -static const uint8_t* Key; + // The array that stores the round keys. + uint8_t RoundKey[176]; + + // The Key input to the AES Program + const uint8_t* Key;

#if defined(CBC) && CBC - // Initial Vector used only for CBC mode - static uint8_t* Iv; + // Initial Vector used only for CBC mode + uint8_t* Iv; #endif +} aes_state_t;

// The lookup-tables are marked const so they can be placed in read-only storage instead of RAM // The numbers below can be computed dynamically trading ROM for RAM - @@ -153,7 +156,7 @@ static uint8_t getSBoxInvert(uint8_t num) }

// This function produces Nb(Nr+1) round keys. The round keys are used in each round to decrypt the states. -static void KeyExpansion(void) +static void KeyExpansion(aes_state_t *state) { uint32_t i, j, k; uint8_t tempa[4]; // Used for the column/row operations @@ -161,10 +164,10 @@ static void KeyExpansion(void) // The first round key is the key itself. for(i = 0; i < Nk; ++i) { - RoundKey[(i * 4) + 0] = Key[(i * 4) + 0]; - RoundKey[(i * 4) + 1] = Key[(i * 4) + 1]; - RoundKey[(i * 4) + 2] = Key[(i * 4) + 2]; - RoundKey[(i * 4) + 3] = Key[(i * 4) + 3]; + state->RoundKey[(i * 4) + 0] = state->Key[(i * 4) + 0]; + state->RoundKey[(i * 4) + 1] = state->Key[(i * 4) + 1]; + state->RoundKey[(i * 4) + 2] = state->Key[(i * 4) + 2]; + state->RoundKey[(i * 4) + 3] = state->Key[(i * 4) + 3]; }

// All other round keys are found from the previous round keys. @@ -172,7 +175,7 @@ static void KeyExpansion(void) { for(j = 0; j < 4; ++j) { - tempa[j]=RoundKey[(i-1) * 4 + j]; + tempa[j]=state->RoundKey[(i-1) * 4 + j]; } if (i % Nk == 0) { @@ -211,37 +214,37 @@ static void KeyExpansion(void) tempa[3] = getSBoxValue(tempa[3]); } } - RoundKey[i * 4 + 0] = RoundKey[(i - Nk) * 4 + 0] ^ tempa[0]; - RoundKey[i * 4 + 1] = RoundKey[(i - Nk) * 4 + 1] ^ tempa[1]; - RoundKey[i * 4 + 2] = RoundKey[(i - Nk) * 4 + 2] ^ tempa[2]; - RoundKey[i * 4 + 3] = RoundKey[(i - Nk) * 4 + 3] ^ tempa[3]; + state->RoundKey[i * 4 + 0] = state->RoundKey[(i - Nk) * 4 + 0] ^ tempa[0]; + state->RoundKey[i * 4 + 1] = state->RoundKey[(i - Nk) * 4 + 1] ^ tempa[1]; + state->RoundKey[i * 4 + 2] = state->RoundKey[(i - Nk) * 4 + 2] ^ tempa[2]; + state->RoundKey[i * 4 + 3] = state->RoundKey[(i - Nk) * 4 + 3] ^ tempa[3]; } }

// This function adds the round key to state. // The round key is added to the state by an XOR function. -static void AddRoundKey(uint8_t round) +static void AddRoundKey(aes_state_t *state, uint8_t round) { uint8_t i,j; for(i=0;i<4;++i) { for(j = 0; j < 4; ++j) { - (*state)[i][j] ^= RoundKey[round * Nb * 4 + i * Nb + j]; + (*state->state)[i][j] ^= state->RoundKey[round * Nb * 4 + i * Nb + j]; } } }

// The SubBytes Function Substitutes the values in the // state matrix with values in an S-box. -static void SubBytes(void) +static void SubBytes(aes_state_t *state) { uint8_t i, j; for(i = 0; i < 4; ++i) { for(j = 0; j < 4; ++j) { - (*state)[j][i] = getSBoxValue((*state)[j][i]); + (*state->state)[j][i] = getSBoxValue((*state->state)[j][i]); } } } @@ -249,32 +252,32 @@ static void SubBytes(void) // The ShiftRows() function shifts the rows in the state to the left. // Each row is shifted with different offset. // Offset = Row number. So the first row is not shifted. -static void ShiftRows(void) +static void ShiftRows(aes_state_t *state) { uint8_t temp;

// Rotate first row 1 columns to left - temp = (*state)[0][1]; - (*state)[0][1] = (*state)[1][1]; - (*state)[1][1] = (*state)[2][1]; - (*state)[2][1] = (*state)[3][1]; - (*state)[3][1] = temp; + temp = (*state->state)[0][1]; + (*state->state)[0][1] = (*state->state)[1][1]; + (*state->state)[1][1] = (*state->state)[2][1]; + (*state->state)[2][1] = (*state->state)[3][1]; + (*state->state)[3][1] = temp;

// Rotate second row 2 columns to left - temp = (*state)[0][2]; - (*state)[0][2] = (*state)[2][2]; - (*state)[2][2] = temp; + temp = (*state->state)[0][2]; + (*state->state)[0][2] = (*state->state)[2][2]; + (*state->state)[2][2] = temp;

- temp = (*state)[1][2]; - (*state)[1][2] = (*state)[3][2]; - (*state)[3][2] = temp; + temp = (*state->state)[1][2]; + (*state->state)[1][2] = (*state->state)[3][2]; + (*state->state)[3][2] = temp;

// Rotate third row 3 columns to left - temp = (*state)[0][3]; - (*state)[0][3] = (*state)[3][3]; - (*state)[3][3] = (*state)[2][3]; - (*state)[2][3] = (*state)[1][3]; - (*state)[1][3] = temp; + temp = (*state->state)[0][3]; + (*state->state)[0][3] = (*state->state)[3][3]; + (*state->state)[3][3] = (*state->state)[2][3]; + (*state->state)[2][3] = (*state->state)[1][3]; + (*state->state)[1][3] = temp; }

static uint8_t xtime(uint8_t x) @@ -283,18 +286,18 @@ static uint8_t xtime(uint8_t x) }

// MixColumns function mixes the columns of the state matrix -static void MixColumns(void) +static void MixColumns(aes_state_t *state) { uint8_t i; uint8_t Tmp,Tm,t; for(i = 0; i < 4; ++i) { - t = (*state)[i][0]; - Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3] ; - Tm = (*state)[i][0] ^ (*state)[i][1] ; Tm = xtime(Tm); (*state)[i][0] ^= Tm ^ Tmp ; - Tm = (*state)[i][1] ^ (*state)[i][2] ; Tm = xtime(Tm); (*state)[i][1] ^= Tm ^ Tmp ; - Tm = (*state)[i][2] ^ (*state)[i][3] ; Tm = xtime(Tm); (*state)[i][2] ^= Tm ^ Tmp ; - Tm = (*state)[i][3] ^ t ; Tm = xtime(Tm); (*state)[i][3] ^= Tm ^ Tmp ; + t = (*state->state)[i][0]; + Tmp = (*state->state)[i][0] ^ (*state->state)[i][1] ^ (*state->state)[i][2] ^ (*state->state)[i][3] ; + Tm = (*state->state)[i][0] ^ (*state->state)[i][1] ; Tm = xtime(Tm); (*state->state)[i][0] ^= Tm ^ Tmp ; + Tm = (*state->state)[i][1] ^ (*state->state)[i][2] ; Tm = xtime(Tm); (*state->state)[i][1] ^= Tm ^ Tmp ; + Tm = (*state->state)[i][2] ^ (*state->state)[i][3] ; Tm = xtime(Tm); (*state->state)[i][2] ^= Tm ^ Tmp ; + Tm = (*state->state)[i][3] ^ t ; Tm = xtime(Tm); (*state->state)[i][3] ^= Tm ^ Tmp ; } }

@@ -321,117 +324,117 @@ static uint8_t Multiply(uint8_t x, uint8_t y) // MixColumns function mixes the columns of the state matrix. // The method used to multiply may be difficult to understand for the inexperienced. // Please use the references to gain more information. -static void InvMixColumns(void) +static void InvMixColumns(aes_state_t *state) { int i; uint8_t a,b,c,d; for(i=0;i<4;++i) { - a = (*state)[i][0]; - b = (*state)[i][1]; - c = (*state)[i][2]; - d = (*state)[i][3]; - - (*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09); - (*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d); - (*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b); - (*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e); + a = (*state->state)[i][0]; + b = (*state->state)[i][1]; + c = (*state->state)[i][2]; + d = (*state->state)[i][3]; + + (*state->state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09); + (*state->state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d); + (*state->state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b); + (*state->state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e); } }

// The SubBytes Function Substitutes the values in the // state matrix with values in an S-box. -static void InvSubBytes(void) +static void InvSubBytes(aes_state_t *state) { uint8_t i,j; for(i=0;i<4;++i) { for(j=0;j<4;++j) { - (*state)[j][i] = getSBoxInvert((*state)[j][i]); + (*state->state)[j][i] = getSBoxInvert((*state->state)[j][i]); } } }

-static void InvShiftRows(void) +static void InvShiftRows(aes_state_t *state) { uint8_t temp;

// Rotate first row 1 columns to right - temp=(*state)[3][1]; - (*state)[3][1]=(*state)[2][1]; - (*state)[2][1]=(*state)[1][1]; - (*state)[1][1]=(*state)[0][1]; - (*state)[0][1]=temp; + temp=(*state->state)[3][1]; + (*state->state)[3][1]=(*state->state)[2][1]; + (*state->state)[2][1]=(*state->state)[1][1]; + (*state->state)[1][1]=(*state->state)[0][1]; + (*state->state)[0][1]=temp;

// Rotate second row 2 columns to right - temp=(*state)[0][2]; - (*state)[0][2]=(*state)[2][2]; - (*state)[2][2]=temp; + temp=(*state->state)[0][2]; + (*state->state)[0][2]=(*state->state)[2][2]; + (*state->state)[2][2]=temp;

- temp=(*state)[1][2]; - (*state)[1][2]=(*state)[3][2]; - (*state)[3][2]=temp; + temp=(*state->state)[1][2]; + (*state->state)[1][2]=(*state->state)[3][2]; + (*state->state)[3][2]=temp;

// Rotate third row 3 columns to right - temp=(*state)[0][3]; - (*state)[0][3]=(*state)[1][3]; - (*state)[1][3]=(*state)[2][3]; - (*state)[2][3]=(*state)[3][3]; - (*state)[3][3]=temp; + temp=(*state->state)[0][3]; + (*state->state)[0][3]=(*state->state)[1][3]; + (*state->state)[1][3]=(*state->state)[2][3]; + (*state->state)[2][3]=(*state->state)[3][3]; + (*state->state)[3][3]=temp; }

// Cipher is the main function that encrypts the PlainText. -static void Cipher(void) +static void Cipher(aes_state_t *state) { uint8_t round = 0;

// Add the First round key to the state before starting the rounds. - AddRoundKey(0); + AddRoundKey(state, 0);

// There will be Nr rounds. // The first Nr-1 rounds are identical. // These Nr-1 rounds are executed in the loop below. for(round = 1; round < Nr; ++round) { - SubBytes(); - ShiftRows(); - MixColumns(); - AddRoundKey(round); + SubBytes(state); + ShiftRows(state); + MixColumns(state); + AddRoundKey(state, round); }

// The last round is given below. // The MixColumns function is not here in the last round. - SubBytes(); - ShiftRows(); - AddRoundKey(Nr); + SubBytes(state); + ShiftRows(state); + AddRoundKey(state, Nr); }

-static void InvCipher(void) +static void InvCipher(aes_state_t *state) { uint8_t round=0;

// Add the First round key to the state before starting the rounds. - AddRoundKey(Nr); + AddRoundKey(state, Nr);

// There will be Nr rounds. // The first Nr-1 rounds are identical. // These Nr-1 rounds are executed in the loop below. for(round=Nr-1;round>0;round--) { - InvShiftRows(); - InvSubBytes(); - AddRoundKey(round); - InvMixColumns(); + InvShiftRows(state); + InvSubBytes(state); + AddRoundKey(state, round); + InvMixColumns(state); }

// The last round is given below. // The MixColumns function is not here in the last round. - InvShiftRows(); - InvSubBytes(); - AddRoundKey(0); + InvShiftRows(state); + InvSubBytes(state); + AddRoundKey(state, 0); }

static void BlockCopy(uint8_t* output, uint8_t* input) @@ -453,28 +456,30 @@ static void BlockCopy(uint8_t* output, uint8_t* input)

void AES128_ECB_encrypt(uint8_t* input, const uint8_t* key, uint8_t* output) { + aes_state_t state; // Copy input to output, and work in-memory on output BlockCopy(output, input); - state = (state_t*)output; + state.state = (state_t*)output;

- Key = key; - KeyExpansion(); + state.Key = key; + KeyExpansion(&state);

// The next function call encrypts the PlainText with the Key using AES algorithm. - Cipher(); + Cipher(&state); }

void AES128_ECB_decrypt(uint8_t* input, const uint8_t* key, uint8_t *output) { + aes_state_t state; // Copy input to output, and work in-memory on output BlockCopy(output, input); - state = (state_t*)output; + state.state = (state_t*)output;

// The KeyExpansion routine must be called before encryption. - Key = key; - KeyExpansion(); + state.Key = key; + KeyExpansion(&state);

- InvCipher(); + InvCipher(&state); }

@@ -487,12 +492,12 @@ void AES128_ECB_decrypt(uint8_t* input, const uint8_t* key, uint8_t *output) #if defined(CBC) && CBC

-static void XorWithIv(uint8_t* buf) +static void XorWithIv(aes_state_t *state, uint8_t* buf) { uint8_t i; for(i = 0; i < KEYLEN; ++i) { - buf[i] ^= Iv[i]; + buf[i] ^= state->Iv[i]; } }

@@ -500,29 +505,30 @@ void AES128_CBC_encrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, { intptr_t i; uint8_t remainders = length % KEYLEN; /* Remaining bytes in the last non-full block */ + aes_state_t state;

BlockCopy(output, input); - state = (state_t*)output; + state.state = (state_t*)output;

// Skip the key expansion if key is passed as 0 if(0 != key) { - Key = key; - KeyExpansion(); + state.Key = key; + KeyExpansion(&state); }

if(iv != 0) { - Iv = (uint8_t*)iv; + state.Iv = (uint8_t*)iv; }

for(i = 0; i < length; i += KEYLEN) { - XorWithIv(input); + XorWithIv(&state, input); BlockCopy(output, input); - state = (state_t*)output; - Cipher(); - Iv = output; + state.state = (state_t*)output; + Cipher(&state); + state.Iv = output; input += KEYLEN; output += KEYLEN; } @@ -531,8 +537,8 @@ void AES128_CBC_encrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, { BlockCopy(output, input); memset(output + remainders, 0, KEYLEN - remainders); /* add 0-padding */ - state = (state_t*)output; - Cipher(); + state.state = (state_t*)output; + Cipher(&state); } }

@@ -540,30 +546,31 @@ void AES128_CBC_decrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, { intptr_t i; uint8_t remainders = length % KEYLEN; /* Remaining bytes in the last non-full block */ + aes_state_t state;

BlockCopy(output, input); - state = (state_t*)output; + state.state = (state_t*)output;

// Skip the key expansion if key is passed as 0 if(0 != key) { - Key = key; - KeyExpansion(); + state.Key = key; + KeyExpansion(&state); }

// If iv is passed as 0, we continue to encrypt without re-setting the Iv if(iv != 0) { - Iv = (uint8_t*)iv; + state.Iv = (uint8_t*)iv; }

for(i = 0; i < length; i += KEYLEN) { BlockCopy(output, input); - state = (state_t*)output; - InvCipher(); - XorWithIv(output); - Iv = input; + state.state = (state_t*)output; + InvCipher(&state); + XorWithIv(&state, output); + state.Iv = input; input += KEYLEN; output += KEYLEN; } @@ -572,8 +579,8 @@ void AES128_CBC_decrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, { BlockCopy(output, input); memset(output+remainders, 0, KEYLEN - remainders); /* add 0-padding */ - state = (state_t*)output; - InvCipher(); + state.state = (state_t*)output; + InvCipher(&state); } }

This code is inspired by JeanDo ostc-companion.

Reviewed-by: Jef Driesen jef@libdivecomputer.org Signed-off-by: Anton Lundin glance@acc.umu.se --- src/hw_ostc3.c | 136 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 136 insertions(+)

diff --git a/src/hw_ostc3.c b/src/hw_ostc3.c index b78702c..a4885d4 100644 --- a/src/hw_ostc3.c +++ b/src/hw_ostc3.c @@ -21,6 +21,7 @@

#include <string.h> // memcmp, memcpy #include <stdlib.h> // malloc, free +#include <stdio.h> // FILE, fopen

#include <libdivecomputer/hw_ostc3.h>

@@ -30,6 +31,7 @@ #include "checksum.h" #include "ringbuffer.h" #include "array.h" +#include "aes.h"

#define ISINSTANCE(device) dc_device_isinstance((device), &hw_ostc3_device_vtable)

@@ -43,6 +45,7 @@ #define SZ_VERSION (SZ_CUSTOMTEXT + 4) #define SZ_MEMORY 0x200000 #define SZ_CONFIG 4 +#define SZ_FIRMWARE 0x01E000 // 120KB

#define RB_LOGBOOK_SIZE 256 #define RB_LOGBOOK_COUNT 256 @@ -66,6 +69,21 @@ typedef struct hw_ostc3_device_t { unsigned char fingerprint[5]; } hw_ostc3_device_t;

+typedef struct hw_ostc3_firmware_t { + unsigned char data[SZ_FIRMWARE]; + unsigned int checksum; +} hw_ostc3_firmware_t; + +// This key is used both for the Ostc3 and its cousin, +// the Ostc Sport. +// The Frog uses a similar protocol, and with another key. +static const unsigned char ostc3_key[16] = { + 0xF1, 0xE9, 0xB0, 0x30, + 0x45, 0x6F, 0xBE, 0x55, + 0xFF, 0xE7, 0xF8, 0x31, + 0x13, 0x6C, 0xF2, 0xFE +}; + static dc_status_t hw_ostc3_device_set_fingerprint (dc_device_t *abstract, const unsigned char data[], unsigned int size); static dc_status_t hw_ostc3_device_foreach (dc_device_t *abstract, dc_dive_callback_t callback, void *userdata); static dc_status_t hw_ostc3_device_close (dc_device_t *abstract); @@ -622,3 +640,121 @@ hw_ostc3_device_config_reset (dc_device_t *abstract)

return DC_STATUS_SUCCESS; } + +// This is a variant of fletcher16 with 16 bit sum instead of 8bit +// and modulo 256 instead of 255 +static unsigned int hw_ostc3_firmware_checksum(hw_ostc3_firmware_t *firmware) +{ + unsigned short low = 0; + unsigned short high = 0; + for(unsigned int i = 0;i < SZ_FIRMWARE;i++) + { + low += firmware->data[i]; + high += low; + } + return (((unsigned int)high) << 16) + low; +} + +static dc_status_t +hw_ostc3_firmware_readline(FILE *fp, unsigned int addr, unsigned char data[], unsigned int size) +{ + unsigned char ascii[40]; + // 1 byte :, 6 bytes addr, X*2 bytes hex -> X bytes data. + const unsigned line_size = size * 2 + 1 + 6 + 1; + unsigned char faddr_byte[3]; + unsigned int faddr = 0; + if (line_size > sizeof(ascii)) + return DC_STATUS_INVALIDARGS; + if (fread (ascii, sizeof(char), line_size, fp) != line_size) + return DC_STATUS_IO; + if (ascii[0] != ':') + return DC_STATUS_DATAFORMAT; + // Is it a CRLF file? + // Read away that trailing LF + if (ascii[line_size] == '\r') + if (fread (ascii + line_size, sizeof(char), 1, fp) != 1) + return DC_STATUS_DATAFORMAT; + if (array_convert_hex2bin(ascii + 1, 6, faddr_byte, sizeof(faddr_byte)) != 0) { + return DC_STATUS_DATAFORMAT; + } + faddr = array_uint24_be (faddr_byte); + if (faddr != addr) + return DC_STATUS_DATAFORMAT; + if (array_convert_hex2bin (ascii + 1 + 6, size*2, data, size) != 0) + return DC_STATUS_DATAFORMAT; + + return DC_STATUS_SUCCESS; +} + + +static dc_status_t +hw_ostc3_firmware_readfile (hw_ostc3_firmware_t *firmware, dc_context_t *context, const char *filename) +{ + dc_status_t rc = DC_STATUS_SUCCESS; + FILE *fp; + unsigned char iv[16] = {0}; + unsigned char tmpbuf[16] = {0}; + unsigned char encrypted[16] = {0}; + unsigned int bytes = 0, addr = 0, faddr = 0; + unsigned char checksum[4]; + + if (firmware == NULL) { + ERROR (context, "Invalid arguments."); + return DC_STATUS_INVALIDARGS; + } + + // Initialize the buffers. + memset (firmware->data, 0xFF, sizeof (firmware->data)); + firmware->checksum = 0; + + fp = fopen (filename, "rb"); + if (fp == NULL) { + ERROR (context, "Failed to open the file."); + return DC_STATUS_IO; + } + + rc = hw_ostc3_firmware_readline(fp, 0, iv, sizeof(iv)); + if (rc != DC_STATUS_SUCCESS) { + fclose (fp); + ERROR (context, "Failed to parse header."); + return rc; + } + bytes += 16; + + // Load the iv for AES-FCB-mode + AES128_ECB_encrypt(iv, ostc3_key, tmpbuf); + + for(addr = 0; addr < SZ_FIRMWARE; addr += 16, bytes += 16) { + rc = hw_ostc3_firmware_readline(fp, bytes, encrypted, sizeof(encrypted)); + if (rc != DC_STATUS_SUCCESS) { + fclose (fp); + ERROR (context, "Failed to parse file data."); + return rc; + } + + // Decrypt AES-FCB data + for(int i=0;i < 16;i++) + firmware->data[addr + i] = encrypted[i] ^ tmpbuf[i]; + + // Run the next round of encryption + AES128_ECB_encrypt(encrypted, ostc3_key, tmpbuf); + } + + // This file format contains a tail with the checksum in + rc = hw_ostc3_firmware_readline(fp, bytes, checksum, sizeof(checksum)); + if (rc != DC_STATUS_SUCCESS) { + fclose (fp); + ERROR (context, "Failed to parse file tail."); + return rc; + } + fclose(fp); + + firmware->checksum = array_uint32_le(checksum); + + if (firmware->checksum != hw_ostc3_firmware_checksum(firmware)) { + ERROR (context, "Failed to verify file checksum."); + return DC_STATUS_IO; + } + + return DC_STATUS_SUCCESS; +}

This code is inspired by JeanDo ostc-companion.

Reviewed-by: Jef Driesen jef@libdivecomputer.org Signed-off-by: Anton Lundin glance@acc.umu.se --- src/hw_ostc3.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 48 insertions(+), 2 deletions(-)

diff --git a/src/hw_ostc3.c b/src/hw_ostc3.c index 79f5945..f777cee 100644 --- a/src/hw_ostc3.c +++ b/src/hw_ostc3.c @@ -50,6 +50,7 @@ #define RB_LOGBOOK_SIZE 256 #define RB_LOGBOOK_COUNT 256

+#define S_READY 0x4C #define READY 0x4D #define HEADER 0x61 #define CLOCK 0x62 @@ -66,6 +67,7 @@ typedef enum hw_ostc3_state_t { OPEN, DOWNLOAD, + SERVICE, } hw_ostc3_state_t;

typedef struct hw_ostc3_device_t { @@ -205,6 +207,7 @@ hw_ostc3_transfer (hw_ostc3_device_t *device, if (cmd != EXIT) { // Read the ready byte. unsigned char ready[1] = {0}; + unsigned char expected = (device->state == SERVICE ? S_READY : READY); n = serial_read (device->port, ready, sizeof (ready)); if (n != sizeof (ready)) { ERROR (abstract->context, "Failed to receive the ready byte."); @@ -212,7 +215,7 @@ hw_ostc3_transfer (hw_ostc3_device_t *device, }

// Verify the ready byte. - if (ready[0] != READY) { + if (ready[0] != expected) { ERROR (abstract->context, "Unexpected ready byte."); return DC_STATUS_PROTOCOL; } @@ -307,7 +310,7 @@ hw_ostc3_check_state_or_init(dc_device_t *abstract) rc = hw_ostc3_device_init_download(abstract); if (rc != DC_STATUS_SUCCESS) return rc; - } else if (device->state != DOWNLOAD) { + } else if (device->state != DOWNLOAD && device->state != SERVICE) { return DC_STATUS_INVALIDARGS; } return DC_STATUS_SUCCESS; @@ -827,3 +830,46 @@ hw_ostc3_firmware_readfile (hw_ostc3_firmware_t *firmware, dc_context_t *context

return DC_STATUS_SUCCESS; } + + +static dc_status_t +hw_ostc3_device_init_service (dc_device_t *abstract) +{ + hw_ostc3_device_t *device = (hw_ostc3_device_t *) abstract; + unsigned char command[] = {0xAA, 0xAB, 0xCD, 0xEF}; + unsigned char output[5]; + dc_status_t rc = DC_STATUS_SUCCESS; + int n; + + if (device->state != OPEN) + return DC_STATUS_INVALIDARGS; + + // We cant use hw_ostc3_transfer here, due to the different echos + n = serial_write (device->port, command, sizeof (command)); + if (n != sizeof (command)) { + ERROR (abstract->context, "Failed to send the command."); + return EXITCODE (n); + } + + // Give the device some time to enter service mode + serial_sleep (device->port, 100); + + // Read the response + n = serial_read (device->port, output, sizeof (output)); + if (n != sizeof (output)) { + ERROR (abstract->context, "Failed to receive the echo."); + return EXITCODE (n); + } + + // Verify the response to service mode + if (output[0] != 0x4B || output[1] != 0xAB || + output[2] != 0xCD || output[3] != 0xEF || + output[4] != S_READY) { + ERROR (abstract->context, "Failed to verify echo."); + return DC_STATUS_IO; + } + + device->state = SERVICE; + + return DC_STATUS_SUCCESS; +}

This is the fist step in the firmware upgrade process.

This code is inspired by JeanDo ostc-companion.

Reviewed-by: Jef Driesen jef@libdivecomputer.org Signed-off-by: Anton Lundin glance@acc.umu.se --- src/hw_ostc3.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)

diff --git a/src/hw_ostc3.c b/src/hw_ostc3.c index f777cee..71f56a1 100644 --- a/src/hw_ostc3.c +++ b/src/hw_ostc3.c @@ -46,10 +46,13 @@ #define SZ_MEMORY 0x200000 #define SZ_CONFIG 4 #define SZ_FIRMWARE 0x01E000 // 120KB +#define SZ_FIRMWARE_BLOCK 0x1000 // 4KB +#define FIRMWARE_AREA 0x3E0000

#define RB_LOGBOOK_SIZE 256 #define RB_LOGBOOK_COUNT 256

+#define S_ERASE 0x42 #define S_READY 0x4C #define READY 0x4D #define HEADER 0x61 @@ -873,3 +876,18 @@ hw_ostc3_device_init_service (dc_device_t *abstract)

return DC_STATUS_SUCCESS; } + +static dc_status_t +hw_ostc3_firmware_erase (hw_ostc3_device_t *device, unsigned int addr, unsigned int size) +{ + dc_status_t rc = DC_STATUS_SUCCESS; + // Convert size to number of pages, rounded up. + unsigned char blocks = ((size + SZ_FIRMWARE_BLOCK - 1) / SZ_FIRMWARE_BLOCK); + + // Erase just the needed pages. + unsigned char buffer[4]; + array_uint24_be_set(buffer, addr); + buffer[3] = blocks; + + return hw_ostc3_transfer (device, NULL, S_ERASE, buffer, sizeof(buffer), NULL, 0); +}

This is how you transfer a new firmware to the OSTC3.

This code is inspired by JeanDo ostc-companion.

Reviewed-by: Jef Driesen jef@libdivecomputer.org Signed-off-by: Anton Lundin glance@acc.umu.se --- src/hw_ostc3.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)

diff --git a/src/hw_ostc3.c b/src/hw_ostc3.c index 5584f31..35df0c7 100644 --- a/src/hw_ostc3.c +++ b/src/hw_ostc3.c @@ -53,6 +53,7 @@ #define RB_LOGBOOK_COUNT 256

#define S_BLOCK_READ 0x20 +#define S_BLOCK_WRITE 0x30 #define S_ERASE 0x42 #define S_READY 0x4C #define READY 0x4D @@ -902,3 +903,17 @@ hw_ostc3_firmware_block_read (hw_ostc3_device_t *device, unsigned int addr, unsi

return hw_ostc3_transfer (device, NULL, S_BLOCK_READ, buffer, sizeof(buffer), block, block_size); } + +static dc_status_t +hw_ostc3_firmware_block_write (hw_ostc3_device_t *device, unsigned int addr, unsigned char block[], unsigned int block_size) +{ + unsigned char buffer[3 + SZ_FIRMWARE_BLOCK]; + // We currenty only support writing SZ_FIRMWARE_BLOCK sized blocks. + if (block_size > SZ_FIRMWARE_BLOCK) + return DC_STATUS_INVALIDARGS; + + array_uint24_be_set(buffer, addr); + memcpy(buffer + 3, block, block_size); + + return hw_ostc3_transfer (device, NULL, S_BLOCK_WRITE, buffer, sizeof(buffer), NULL, 0); +}

This teaches the example firmware upgrader about how to upgrade the OSTC3's.

Signed-off-by: Anton Lundin glance@acc.umu.se --- examples/hw_ostc_fwupdate.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/examples/hw_ostc_fwupdate.c b/examples/hw_ostc_fwupdate.c index a9e7fde..7ce1347 100644 --- a/examples/hw_ostc_fwupdate.c +++ b/examples/hw_ostc_fwupdate.c @@ -19,10 +19,10 @@ * MA 02110-1301 USA */

-#include <stdio.h> // fopen, fwrite, fclose -#include <stdlib.h> +#include <string.h>

#include <libdivecomputer/hw_ostc.h> +#include <libdivecomputer/hw_ostc3.h>

#include "utils.h" #include "common.h" @@ -44,17 +44,23 @@ event_cb (dc_device_t *device, dc_event_type_t event, const void *data, void *us }

static dc_status_t -fwupdate (const char *name, const char *hexfile) +fwupdate (const char *name, const char *hexfile, int ostc3) { dc_context_t *context = NULL; dc_device_t *device = NULL; + dc_status_t rc = DC_EVENT_PROGRESS;

dc_context_new (&context); dc_context_set_loglevel (context, DC_LOGLEVEL_ALL); dc_context_set_logfunc (context, logfunc, NULL);

- message ("hw_ostc_device_open\n"); - dc_status_t rc = hw_ostc_device_open (&device, context, name); + if (ostc3) { + message ("hw_ostc3_device_open\n"); + rc = hw_ostc3_device_open (&device, context, name); + } else { + message ("hw_ostc_device_open\n"); + rc = hw_ostc_device_open (&device, context, name); + } if (rc != DC_STATUS_SUCCESS) { WARNING ("Error opening serial port."); dc_context_free (context); @@ -70,8 +76,13 @@ fwupdate (const char *name, const char *hexfile) return rc; }

- message ("hw_ostc_device_fwupdate\n"); - rc = hw_ostc_device_fwupdate (device, hexfile); + if (ostc3) { + message ("hw_ostc3_device_fwupdate\n"); + rc = hw_ostc3_device_fwupdate (device, hexfile); + } else { + message ("hw_ostc_device_fwupdate\n"); + rc = hw_ostc_device_fwupdate (device, hexfile); + } if (rc != DC_STATUS_SUCCESS) { WARNING ("Error flashing firmware."); dc_device_close (device); @@ -103,6 +114,7 @@ int main(int argc, char *argv[]) const char* name = "/dev/ttyUSB0"; #endif const char *hexfile = NULL; + int ostc3 = 0;

if (argc > 1) { name = argv[1]; @@ -110,11 +122,18 @@ int main(int argc, char *argv[]) if (argc > 2) { hexfile = argv[2]; } + if (argc > 3) { + if (strcmp(argv[3], "-3") == 0) { + ostc3 = 1; + } else { + ostc3 = 0; + } + }

message ("DEVICE=%s\n", name); message ("HEXFILE=%s\n", hexfile);

- dc_status_t a = fwupdate (name, hexfile); + dc_status_t a = fwupdate (name, hexfile, ostc3);

message ("SUMMARY\n"); message ("-------\n");

Signed-off-by: Anton Lundin glance@acc.umu.se --- src/hw_ostc3.c | 2 -- 1 file changed, 2 deletions(-)

diff --git a/src/hw_ostc3.c b/src/hw_ostc3.c index 0851daa..28cc1f8 100644 --- a/src/hw_ostc3.c +++ b/src/hw_ostc3.c @@ -29,8 +29,6 @@ #include "context-private.h" #include "device-private.h" #include "serial.h" -#include "checksum.h" -#include "ringbuffer.h" #include "array.h" #include "aes.h"