usb-drivers/elksmart-comm.c

/*
 * elksmart-comm.c: ELK Smart infrared dongle tool (for EKX4S and EKX5S-T)
 *
 * Copyright (c) 2024, Přemysl Eric Janouch <p@janouch.name>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

#include "config.h"
#undef PROGRAM_NAME
#define PROGRAM_NAME "elksmart-comm"
#include "liberty/liberty.c"

#include <libusb.h>

// --- Utilities ---------------------------------------------------------------

/// Search for a device with given vendor and product ID.
/// This is quite similar to libusb_open_device_with_vid_pid().
static libusb_device_handle *
find_device(int vendor, int product, int *error)
{
	libusb_device **list = NULL;
	libusb_device_handle *handle = NULL;
	int result = 0;

	ssize_t len = libusb_get_device_list(NULL, &list);
	if (len < 0) {
		result = len;
		goto out;
	}

	for (ssize_t i = 0; i < len; i++) {
		libusb_device *device = list[i];
		struct libusb_device_descriptor desc = {};
		if ((result = libusb_get_device_descriptor(device, &desc)))
			print_debug("%s", libusb_strerror(result));
		else if (desc.idVendor != vendor || desc.idProduct != product)
			continue;
		else if (!(result = libusb_open(device, &handle)))
			break;
	}

	libusb_free_device_list(list, true);
out:
	if (error != NULL && result != 0)
		*error = result;
	return handle;
}

static void
wait_ms(long ms)
{
	struct timespec ts = {ms / 1000, (ms % 1000) * 1000 * 1000};
	nanosleep(&ts, NULL);
}

static void
dump_hex(const unsigned char *buf, size_t len)
{
	for (size_t i = 0; i < len; i++)
		printf("%02x", buf[i]);
	printf("\n");
}

static bool
read_hex(const char *string, struct str *out)
{
	static const char *alphabet = "0123456789abcdef";
	str_reset(out);
	while (true) {
		while (*string && strchr(" \t\n\r\v\f", *string))
			string++;
		if (!*string)
			return true;

		const char *hi, *lo;
		if (!(hi = strchr(alphabet, tolower_ascii(*string++))) || !*string ||
			!(lo = strchr(alphabet, tolower_ascii(*string++))))
			return false;

		str_pack_u8(out, (hi - alphabet) << 4 | (lo - alphabet));
	}
}

// --- Coding ------------------------------------------------------------------

// Values are in microseconds.
struct pulse {
	unsigned on, off;
};

static bool
pulse_equal(struct pulse a, struct pulse b)
{
	return a.on == b.on && a.off == b.off;
}

static size_t
decode_learned_direct(const uint8_t *b, size_t b_len, struct pulse *pulses)
{
	size_t pulses_len = 0;
	for (size_t i = 0; i < b_len;) {
		struct pulse *pulse = &pulses[pulses_len++];
		while (b[i] == 0xff) {
			pulse->on += 4080;
			if (++i == b_len)
				return 0;
		}
		pulse->on += b[i++] * 16;

		// Who cares, presumably it stays off.
		if (i == b_len)
			break;

		while (b[i] == 0xff) {
			pulse->off += 4080;
			if (++i == b_len)
				return 0;
		}
		pulse->off += b[i++] * 16;
	}
	return pulses_len;
}

static struct pulse *
decode_learned(const struct str *code, size_t *len, struct error **e)
{
	// This conveniently has an upper bound.
	struct pulse *pulses = xcalloc(code->len, sizeof *pulses);
	if (!(*len = decode_learned_direct(
			(const uint8_t *) code->str, code->len, pulses))) {
		error_set(e, "code ends unexpectedly");
		free(pulses);
		return NULL;
	}
	return pulses;
}

static struct pulse *
encode_nec_byte(struct pulse *p, uint8_t byte)
{
	for (int i = 7; i >= 0; i--)
		*p++ = (struct pulse)
			{.on = 550, .off = ((byte >> i) & 1) ? 1650 : 550};
	return p;
}

static struct pulse *
encode_nec(const struct str *code, size_t *len, struct error **e)
{
	if (code->len % 2) {
		error_set(e, "NEC transmission format requires pairs");
		return NULL;
	}

	// The timings seem to be rather tolerant.
	*len = code->len / 2 * (1 /* leader */ + 32 + 1 /* stop */);
	struct pulse *pulses = xcalloc(*len, sizeof *pulses), *p = pulses;
	for (size_t i = 0; i < code->len; i += 2) {
		*p++ = (struct pulse) {.on = 8500, .off = 4250};
		p = encode_nec_byte(p, code->str[i + 0]);
		p = encode_nec_byte(p, ~code->str[i + 0]);
		p = encode_nec_byte(p, code->str[i + 1]);
		p = encode_nec_byte(p, ~code->str[i + 1]);
		*p++ = (struct pulse) {.on = 550, .off = 25000};
	}
	return pulses;
}

static void
compress_value(unsigned value, struct str *encoded)
{
	if (value <= 2032) {
		// We fix a minor problem in the original Ocrustar algorithm.
		uint8_t v = value / 16. + .5;
		str_pack_u8(encoded, MAX(2, v));
	} else {
		do {
			uint8_t v = value & 0x7f;
			if ((value >>= 7))
				v |= 0x80;
			str_pack_u8(encoded, v);
		} while (value);
	}
}

static void
compress_pulses (const struct pulse *pulses, size_t len, struct str *encoded)
{
	unsigned counts[len];
	memset(counts, 0, sizeof counts);
	for (size_t i = 0; i < len; i++)
		for (size_t k = 0; k < len; k++)
			if (pulse_equal(pulses[i], pulses[k]))
				counts[i]++;

	struct pulse p1 = {}, p2 = {};
	size_t top1 = 0, top2 = 0;
	for (size_t i = 0; i < len; i++)
		if (counts[i] > counts[top1])
			p1 = pulses[top1 = i];
	for (size_t i = 0; i < len; i++)
		if (counts[i] < counts[top1] &&
			counts[i] > counts[top2])
			p2 = pulses[top2 = i];
		else if (counts[top2] == counts[top1])
			p2 = pulses[top2 = i];

	// Although I haven't really tried it, something tells me that
	// this will work even in the degenerated case of len <= 2.
	// XXX: The receiver might not like multibyte values here,
	//   Ocrustar also oddly replaces 0xff with 0xfe for these fields.
	compress_value(p2.on, encoded);
	compress_value(p2.off, encoded);
	compress_value(p1.on, encoded);
	compress_value(p1.off, encoded);
	str_pack_u8(encoded, -1);
	str_pack_u8(encoded, -1);
	str_pack_u8(encoded, -1);

	for (size_t i = 0; i < len; i++) {
		if (pulse_equal(pulses[i], p1)) {
			str_pack_u8(encoded, 0);
		} else if (pulse_equal(pulses[i], p2)) {
			str_pack_u8(encoded, 1);
		} else {
			compress_value(pulses[i].on, encoded);
			compress_value(pulses[i].off, encoded);
		}
	}
}

// --- Device interaction ------------------------------------------------------

enum {
	USB_VENDOR_SMTCTL = 0x045c,

	// 0x134 (EKX5S ~ 5s, 5th generation remote)
	// 0x195 (EKX4S ~ 4s, 4th generation remote)
	// 0x184 (EKX5S-T, international edition)
	USB_PRODUCT_SMTCTL_SMART_EKX4S = 0x0195,
	USB_PRODUCT_SMTCTL_SMART_EKX5S_T = 0x0184,

	// There should only ever be one interface.
	USB_INTERFACE = 0,
};

static uint8_t
	c_transmit[] = {-1, -1, -1, -1},
	c_learn[]    = {-2, -2, -2, -2},
	c_stop[]     = {-3, -3, -3, -3},
	c_identify[] = {-4, -4, -4, -4};

static struct {
	unsigned char endpoint_out;         ///< Outgoing endpoint
	unsigned char endpoint_in;          ///< Incoming endpoint
} g;

static bool
init_device_from_desc(struct libusb_config_descriptor *desc, struct error **e)
{
	// We're not being particuarly strict in here.
	if (desc->bNumInterfaces != 1)
		return error_set(e, "unexpected USB interface count");
	if (desc->interface->num_altsetting != 1)
		return error_set(e, "unexpected alternate setting count");

	const struct libusb_interface_descriptor *asd = desc->interface->altsetting;
	if (asd->bInterfaceClass != LIBUSB_CLASS_COMM)
		return error_set(e, "unexpected USB interface class");
	if (asd->bNumEndpoints != 2)
		return error_set(e, "unexpected endpoint count");

	bool have_out = false, have_in = false;
	for (uint8_t i = 0; i < asd->bNumEndpoints; i++) {
		const struct libusb_endpoint_descriptor *epd = asd->endpoint + i;
		if ((epd->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK) !=
			LIBUSB_ENDPOINT_TRANSFER_TYPE_BULK)
			return error_set(e, "unexpected endpoint transfer type");

		switch ((epd->bEndpointAddress & LIBUSB_ENDPOINT_DIR_MASK)) {
		break; case LIBUSB_ENDPOINT_OUT:
			have_out = true;
			g.endpoint_out = epd->bEndpointAddress;
		break; case LIBUSB_ENDPOINT_IN:
			have_in = true;
			g.endpoint_in = epd->bEndpointAddress;
		}
	}
	if (!have_out || !have_in)
		return error_set(e, "USB interface is not bidirectional");
	return true;
}

static bool
init_device(libusb_device_handle *device, struct error **e)
{
	struct libusb_config_descriptor *desc = NULL;
	int result =
		libusb_get_active_config_descriptor(libusb_get_device(device), &desc);
	if (result)
		return error_set(e, "%s", libusb_strerror(result));

	bool ok = true;
	if ((result = libusb_kernel_driver_active(device, USB_INTERFACE)) == 1)
		ok = error_set(e, "device is claimed by a kernel driver");
	else if (result)
		ok = error_set(e, "%s", libusb_strerror(result));
	else
		ok = init_device_from_desc(desc, e);

	libusb_free_config_descriptor(desc);
	return ok;
}

// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

static uint8_t
mangle(uint8_t value)
{
	uint8_t reversed = 0;
	for (int i = 0; i < 8; i++) {
		reversed = (reversed << 1) | (value & 1);
		value >>= 1;
	}
	return ~reversed;
}

static uint8_t
checksum(const uint8_t *b, size_t len)
{
	uint32_t sum = 0;
	for (size_t i = 0; i < len; i++)
		sum += b[i];
	return mangle((sum & 0xF0) | ((sum >> 8) & 0x0F));
}

static bool
send_transmit(libusb_device_handle *device, unsigned long frequency,
	const struct pulse *pulses, size_t pulses_len, struct error **e)
{
	if (g_debug_mode)
		for (size_t i = 0; i < pulses_len;) {
			printf("%u,%u", pulses[i].on, pulses[i].off);
			putchar(++i == pulses_len ? '\n' : ',');
		}

	struct str compressed = str_make();
	compress_pulses(pulses, pulses_len, &compressed);

	struct str message = str_make();
	str_append_data(&message, c_transmit, sizeof c_transmit);
	frequency += 0x7ffff;
	str_pack_u8(&message, mangle(frequency >> 8));
	str_pack_u8(&message, mangle(frequency >> 16));
	str_pack_u8(&message, mangle(frequency));
	str_pack_u8(&message, mangle(compressed.len >> 8));
	str_pack_u8(&message, mangle(compressed.len));
	str_append_str(&message, &compressed);
	str_free(&compressed);

	size_t i = 0;
	uint8_t buffer[64];
	bool ok = true;
	while (i != message.len) {
		size_t chunk = MIN(62, message.len - i);
		memcpy(buffer, message.str + i, chunk);
		i += chunk;
		if (chunk == 62) {
			buffer[chunk] = checksum(buffer, chunk);
			chunk++;
		}

		int result = 0, len = 0;
		if ((result = libusb_bulk_transfer(
				device, g.endpoint_out, buffer, chunk, &len, 100))) {
			ok = error_set(e, "send: %s", libusb_strerror(result));
			break;
		}
		wait_ms(2);
	}
	str_free(&message);
	return ok;
}

// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

static bool
pulse_is_likely_leader(const struct pulse *p)
{
	return p->on >= 2048 && p->off >= 2048;
}

static void
try_to_depulse(const struct str *code)
{
	size_t len = 0;
	struct pulse *pulses = decode_learned(code, &len, NULL);
	if (!pulses)
		return;

	struct pulse *p = pulses, *end = p + len;
	while (p != end && pulse_is_likely_leader(p)) {
		p++;
		printf("Attempted pulse decode:\n");

		uint8_t bits = 0, nibble = 0;
		for (; p != end && !pulse_is_likely_leader(p); p++) {
			nibble = nibble << 1 | (p->off > 2 * p->on);
			if (++bits == 4) {
				putchar("0123456789abcdef"[nibble]);
				bits = nibble = 0;
			}
		}
		putchar('\n');
	}
	free(pulses);
}

static bool
recv_learn(libusb_device_handle *device, struct str *data, struct error **e)
{
	uint8_t buffer[64] = {};
	int result = 0, len = 0;
	while ((result = libusb_bulk_transfer(
				device, g.endpoint_in, buffer, sizeof buffer, &len, 100))) {
		if (result != LIBUSB_ERROR_TIMEOUT)
			return error_set(e, "learn/recv: %s", libusb_strerror(result));
		print_debug("learn/recv: %s", libusb_strerror(result));
	}
	if (len < 6 || memcmp(buffer, c_learn, sizeof c_learn))
		return error_set(e, "learn/recv: %s", "unexpected response");

	// This field might only make sense for a later device,
	// because it doesn't always correspond with how much data we receive.
	// Nonetheless, it does match exactly often enough.
	size_t size = buffer[4] << 8 | buffer[5];
	print_debug("learn: code size: %zu", size);

	str_append_data(data, buffer + 6, len - 6);
	dump_hex((const unsigned char *) data->str, data->len);
	while (data->len < size) {
		if (!(result = libusb_bulk_transfer(
				device, g.endpoint_in, buffer, sizeof buffer, &len, 100))) {
			dump_hex(buffer, len);

			str_append_data(data, buffer, len);
			print_debug(
				"learn: received %d (have %zu of %zu)", len, data->len, size);
			continue;
		}
		if (result != LIBUSB_ERROR_TIMEOUT)
			return error_set(e, "learn/recv: %s", libusb_strerror(result));

		// The device seems to queue up its output with pauses.
		print_debug("learn/recv: %s", libusb_strerror(result));
	}

	// As far as I know, this doesn't do anything,
	// and the device doesn't accept it while scanning infrared codes either.
	if ((result = libusb_bulk_transfer(
			device, g.endpoint_out, c_stop, sizeof c_stop, &len, 100)))
		return error_set(e, "learn/send: %s", libusb_strerror(result));
	return true;
}

static bool
send_learn(libusb_device_handle *device, struct error **e)
{
	int result = 0, len = 0;
	if ((result = libusb_bulk_transfer(
			device, g.endpoint_out, c_learn, sizeof c_learn, &len, 100)))
		return error_set(e, "learn/send: %s", libusb_strerror(result));

	printf("Reading remote control codes.\n");
	printf("Press a remote control button from less than a centimeter.\n");
	printf("The dongle may be unusable until it returns some data.\n");
	// ... Resetting the device using libusb_reset_device() doesn't help then.
	printf("If the code fails to replay, retry the capture.\n");

	struct str data = str_make();
	bool ok = recv_learn(device, &data, e);
	if (ok) {
		printf("Full command:\n");
		dump_hex((const unsigned char *) data.str, data.len);
		try_to_depulse(&data);
	}

	str_free(&data);
	return ok;
}

// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

static bool
send_identify(libusb_device_handle *device, struct error **e)
{
	uint8_t buffer[64] = {};
	int result = 0, len = 0;
	while (!(result = libusb_bulk_transfer(
			device, g.endpoint_in, buffer, sizeof buffer, &len, 10)))
		/* Flush buffers. */;

	if ((result = libusb_bulk_transfer(
			device, g.endpoint_out, c_identify, sizeof c_identify, &len, 100)))
		return error_set(e, "identify/send: %s", libusb_strerror(result));
	if ((result = libusb_bulk_transfer(
			device, g.endpoint_in, buffer, sizeof buffer, &len, 100)))
		return error_set(e, "identify/recv: %s", libusb_strerror(result));

	// XXX: Sometimes, the device doesn't send any identification values.
	if (len != 6 || memcmp(buffer, c_identify, sizeof c_identify) ||
		buffer[4] != 0x70 || buffer[5] != 0x01)
		return error_set(e, "device busy or not supported");

#if 0
	// The EKX4S does not respond to this request.
	static uint8_t c_serial[] = { -5, -5, -5, -5 };
	if ((result = libusb_bulk_transfer (device, g.endpoint_out,
		c_serial, sizeof c_serial, &len, 100)))
		return error_set (e, "serial/send: %s", libusb_strerror (result));
	if ((result = libusb_bulk_transfer (device, g.endpoint_in,
		buffer, sizeof buffer, &len, 100)))
		return error_set (e, "serial/recv: %s", libusb_strerror (result));
	if (len < (int) sizeof c_serial ||
		memcmp (buffer, c_serial, sizeof c_serial))
		return error_set (e, "serial retrieval failed");
#endif
	return true;
}

static bool
run(libusb_device_handle *device, unsigned long frequency, bool nec,
	char **codes, size_t codes_len, struct error **e)
{
	if (!send_identify(device, e))
		return false;
	if (!codes_len)
		return send_learn(device, e);

	struct str code = str_make();
	bool ok = true;
	for (size_t i = 0; i < codes_len; i++) {
		if (!read_hex(codes[i], &code)) {
			ok = error_set(e, "invalid hex string");
			break;
		}

		size_t pulses_len = 0;
		struct pulse *pulses = nec
			? encode_nec(&code, &pulses_len, e)
			: decode_learned(&code, &pulses_len, e);

		ok = pulses && send_transmit(device, frequency, pulses, pulses_len, e);
		free(pulses);
		if (!ok)
			break;

		wait_ms(100);
	}
	str_free(&code);
	return ok;
}

// --- Main --------------------------------------------------------------------

int
main(int argc, char *argv[])
{
	unsigned long frequency = 38000;
	bool nec = false;
	static const struct opt opts[] = {
		{'d', "debug", NULL, 0, "run in debug mode"},
		{'f', "frequency", "HZ", 0, "frequency (38000 Hz by default)"},
		{'n', "nec", NULL, 0, "use the NEC transmission format"},
		{'h', "help", NULL, 0, "display this help and exit"},
		{'V', "version", NULL, 0, "output version information and exit"},
		{0, NULL, NULL, 0, NULL}};

	struct opt_handler oh = opt_handler_make(argc, argv, opts, "[COMMAND...]",
		"Transmit or receive infrared commands.");

	int c;
	while ((c = opt_handler_get(&oh)) != -1)
	switch (c) {
	case 'd':
		g_debug_mode = true;
		break;
	case 'f':
		if (!xstrtoul(&frequency, optarg, 10) || !frequency)
			exit_fatal("invalid frequency");
		break;
	case 'n':
		nec = true;
		break;
	case 'h':
		opt_handler_usage(&oh, stdout);
		exit(EXIT_SUCCESS);
	case 'V':
		printf(PROGRAM_NAME " " PROGRAM_VERSION "\n");
		exit(EXIT_SUCCESS);
	default:
		print_error("wrong options");
		opt_handler_usage(&oh, stderr);
		exit(EXIT_FAILURE);
	}

	argc -= optind;
	argv += optind;

	opt_handler_free(&oh);

// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

#if LIBUSB_API_VERSION >= 0x0100010A
	const struct libusb_init_option option = {
		.option = LIBUSB_OPTION_LOG_LEVEL,
		.value.ival = LIBUSB_LOG_LEVEL_DEBUG,
	};
	int result = libusb_init_context(NULL, &option, g_debug_mode);
#else
	int result = libusb_init(NULL);
#endif
	if (result)
		exit_fatal("libusb: %s", libusb_strerror(result));

	libusb_device_handle *device = NULL;
	if (!device && !result)
		device = find_device(
			USB_VENDOR_SMTCTL, USB_PRODUCT_SMTCTL_SMART_EKX4S, &result);
	if (!device && !result)
		device = find_device(
			USB_VENDOR_SMTCTL, USB_PRODUCT_SMTCTL_SMART_EKX5S_T, &result);

	if (result)
		exit_fatal("couldn't open device: %s", libusb_strerror(result));
	else if (!device)
		exit_fatal("no suitable device found");

	struct error *e = NULL;
	if (!init_device(device, &e))
		exit_fatal("%s", e->message);
	if ((result = libusb_claim_interface(device, USB_INTERFACE)) == 1)
		exit_fatal("couldn't claim interface: %s", libusb_strerror(result));

	if (!run(device, frequency, nec, argv, argc, &e)) {
		print_error("%s", e->message);
		error_free(e);
	}

	if ((result = libusb_release_interface(device, USB_INTERFACE)) == 1)
		exit_fatal("couldn't release interface: %s", libusb_strerror(result));

	libusb_close(device);
	libusb_exit(NULL);
	return 0;
}