+
+
+尚未設定管理密碼
請連接插座的 CommandKit-Setup 設定熱點，開啟 http://192.168.1.254/ 完成初始設定。
電壓—V
交流有效值
+
電流—A
交流有效值
+
累積用電—kWh
功率估算 · 約 30 秒保存一次
+
+裝置資訊
+
+
訪客可以查看狀態。登入後可調整燈號、配對、更新韌體與重設設定。
韌體更新
讓插座保持更新，原有設定與配對會保留。
-使用已下載的更新包
更新會暫停控制並重新啟動插座，請保持供電。
可檢查新版本，或使用已下載的更新包。
-
-
-
diff --git a/firmware/matter/src/update/update.js b/firmware/matter/src/update/update.js
index d94a8ac..47ff187 100644
--- a/firmware/matter/src/update/update.js
+++ b/firmware/matter/src/update/update.js
@@ -19,10 +19,15 @@ function sha256(input) {
const out=new Uint8Array(32), dv=new DataView(out.buffer);h.forEach((v,i)=>dv.setUint32(i*4,v));return out;
}
const hex = bytes => Array.from(bytes,b=>b.toString(16).padStart(2,'0')).join('');
+function hmac256(key,input) {
+ const inner=new Uint8Array(64+input.length),outer=new Uint8Array(96);
+ for(let i=0;i<64;i++){inner[i]=(key[i]||0)^0x36;outer[i]=(key[i]||0)^0x5c;}
+ inner.set(input,64);outer.set(sha256(inner),64);return sha256(outer);
+}
function meterView(data) {
const reading=(n,max,digits)=>Number.isInteger(n)&&n>=0&&n<=max?(n/1000).toFixed(digits):'—';
const live=!!(data&&data.available===true&&Number.isInteger(data.sample_age_ms)&&data.sample_age_ms>=0&&data.sample_age_ms<=5000);
- const d=live?data:{};
+ const d=live?data:{energy_mwh:data?.saved_energy_mwh};
let energy='—';
if(typeof d.energy_mwh==='string'&&/^(0|[1-9][0-9]{0,18})$/.test(d.energy_mwh)&&
(d.energy_mwh.length<19||d.energy_mwh<='4611686018427387904')){
@@ -34,45 +39,203 @@ function meterView(data) {
state:complete?'量測資料正常':live?'部分讀值尚未就緒':'暫無即時資料',
note:live?'讀值於 '+new Date().toLocaleTimeString('zh-TW',{hour12:false})+' 更新':'等待裝置提供新的量測資料'};
}
-if (typeof module !== 'undefined') module.exports={sha256,hex,meterView};
-if (typeof document !== 'undefined') (async () => {
- const $=id=>document.getElementById(id), message=text=>{$('message').textContent=text;};
- let status=null, latest=null, busy=false;
- function drawMeter(data,offline=false){const view=meterView(data);
- for(const [id,value] of [['voltage',view.voltage],['current-amps',view.current],['power',view.power],['energy',view.energy],['relay',view.relay],['meter-updated',view.note]])$(id).textContent=value;
- $('meter-state').textContent=offline?'連線中斷，正在重試':view.state;
- $('meter-state').dataset.state=offline?'offline':view.complete?'live':'waiting';}
- async function monitor(){
- if(!busy&&!document.hidden){const controller=new AbortController(),timeout=setTimeout(()=>controller.abort(),4000);
- try{const r=await fetch('/measurements',{cache:'no-store',signal:controller.signal});if(!r.ok)throw Error('measurements');const data=await r.json();if(!busy&&!document.hidden)drawMeter(data);}
- catch{if(!busy&&!document.hidden)drawMeter(null,true);}finally{clearTimeout(timeout);}}
- setTimeout(monitor,2000);
+/* Watts for the gauge and trend; null whenever meterView would show a dash. */
+function powerWatts(data){const v=meterView(data);return v.live&&v.power!=='—'?Number(v.power):null;}
+/* Logarithmic 0–2 kW arc so a phone charger and a heater are both visible. */
+const gaugeFraction=w=>Math.min(1,Math.max(0,Math.log10(1+w)/Math.log10(2001)));
+/* Same compatibility rules every earlier release used to read the catalog. */
+function newestUpdate(updates,current){
+ return updates.filter(x=>x&&x.model==='CMNDKT-004'&&x.variant==='matter'&&Number.isSafeInteger(x.software_version)&&x.software_version>current).sort((a,b)=>b.software_version-a.software_version)[0]||null;
+}
+/* SVG paths for the trend chart; samples are [ms, watts] pairs. */
+function trendPaths(samples,now,span=120000,width=300,height=120){
+ const points=samples.filter(([t])=>now-t<=span);if(points.length<2)return null;
+ const values=points.map(p=>p[1]),max=Math.max(...values),min=Math.min(...values),top=Math.max(max*1.15,5);
+ const xy=points.map(([t,w])=>[(width*(1-(now-t)/span)).toFixed(1),(height-6-(height-12)*w/top).toFixed(1)]);
+ const line='M'+xy.map(p=>p.join(' ')).join('L');
+ return {line,area:line+'L'+xy[xy.length-1][0]+' '+height+'L'+xy[0][0]+' '+height+'Z',min,max,top,avg:values.reduce((a,b)=>a+b,0)/values.length};
+}
+if (typeof module !== 'undefined') module.exports={sha256,hex,hmac256,meterView,powerWatts,gaugeFraction,newestUpdate,trendPaths};
+if(typeof document!=='undefined')(async()=>{
+ const $=id=>document.getElementById(id),enc=s=>new TextEncoder().encode(s),sleep=ms=>new Promise(r=>setTimeout(r,ms));
+ let auth={authenticated:false},csrf='',status=null,protocol=null,busy=false,latest=null,catalog={state:'idle',error:''},installing=false,
+ protocolDirty=false,ledDirty=false,current='overview',pending=null,toastTimer=0;
+ const samples=[],fmtW=w=>w>=1000?(w/1000).toFixed(2)+' kW':w.toFixed(1)+' W';
+ $('device-address').textContent=location.hostname;
+ document.querySelectorAll('input[name=protocol]').forEach(input=>input.onchange=()=>{protocolDirty=true;});
+ function toast(text,kind='info'){const box=$('toast');$('toast-text').textContent=text;box.dataset.kind=kind;
+ $('toast-icon').setAttribute('href',kind==='error'?'#i-alert':kind==='success'?'#i-check':'#i-info');
+ box.hidden=false;clearTimeout(toastTimer);toastTimer=setTimeout(()=>{box.hidden=true;},kind==='error'?8000:5000);}
+ function show(name){current=name;if(catalog.state==='available')$('update-banner').hidden=name==='update'||installing;document.querySelectorAll('.view').forEach(s=>s.hidden=s.id!=='view-'+name);
+ document.querySelectorAll('.tabs button').forEach(b=>b.setAttribute('aria-current',b.dataset.view===name?'page':'false'));}
+ function view(name){if(name!=='overview'&&!auth.authenticated){pending=name;openLogin();return;}
+ show(name);window.scrollTo(0,0);if(name!=='overview')settingsRefresh().catch(()=>{});}
+ document.querySelectorAll('.tabs button').forEach(b=>b.onclick=()=>view(b.dataset.view));
+ $('update-banner').onclick=()=>view('update');
+ function openLogin(note=''){if(auth.configured===false){toast('尚未設定管理密碼，請先完成初始設定','error');return;}
+ const n=$('login-note');n.textContent=note;n.dataset.tone='';if(!$('login-box').open)$('login-box').showModal();$('login-password').focus();}
+ $('login-open').onclick=()=>openLogin();
+ $('login-cancel').onclick=()=>{pending=null;$('login-box').close();};
+ $('login-box').addEventListener('close',()=>{$('login-password').value='';});
+ function drawAuth(data){auth=data;csrf=data.csrf||'';const admin=!!data.authenticated;
+ document.body.classList.toggle('is-admin',admin);$('login-open').hidden=admin;$('account').hidden=!admin;$('guest-note').hidden=admin;
+ $('setup-notice').hidden=data.configured!==false;$('login-open').disabled=data.configured===false;
+ if(!admin&¤t!=='overview')show('overview');drawUpdate();}
+ async function authRefresh(){const r=await fetch('/auth/session',{cache:'no-store'});if(!r.ok)throw Error('管理服務尚未就緒');const data=await r.json();
+ if(data.storage_ready===false){$('login-open').disabled=true;$('login-open').title='管理設定準備中';return;}$('login-open').title='';drawAuth(data);}
+ async function api(path,body='',digest=null){
+ const headers={'Content-Type':'text/plain','X-CK-CSRF':csrf};if(digest)headers['X-CK-SHA256']=digest;
+ const r=await fetch(path,{method:'POST',credentials:'same-origin',headers,body});
+ const data=await r.json().catch(()=>({}));
+ if(!r.ok){if(r.status===401){drawAuth({authenticated:false,configured:true});openLogin('登入已逾時，請重新登入後再操作');throw Error('請先登入，或重新登入後操作');}
+ throw Error(r.status===409?'裝置正在處理其他操作，請稍候再試':r.status===503?'裝置或儲存尚未準備好，請稍候再試':'操作遭拒絕，請確認輸入與更新檔案');}return data;
}
+ function ask(text,title='確認操作',yes='確認'){return new Promise(resolve=>{const dialog=$('confirm-box');$('confirm-title').textContent=title;$('confirm-text').textContent=text;$('confirm-yes').textContent=yes;
+ $('confirm-yes').onclick=()=>{dialog.close();resolve(true);};$('confirm-no').onclick=()=>{dialog.close();resolve(false);};
+ dialog.oncancel=()=>resolve(false);dialog.showModal();});}
+ function setBusy(value){busy=value;if(value)drawMeter(null);document.querySelectorAll('.admin-view button').forEach(b=>b.disabled=value);}
+ async function run(job,button){if(busy)return;setBusy(true);button?.classList.add('loading');try{await job();}catch(e){toast(e.message,'error');}finally{button?.classList.remove('loading');setBusy(false);}}
+ document.querySelectorAll('.pw-toggle').forEach(b=>b.onclick=()=>{const input=$(b.dataset.for),reveal=input.type==='password';input.type=reveal?'text':'password';
+ b.setAttribute('aria-label',reveal?'隱藏密碼':'顯示密碼');b.setAttribute('aria-pressed',String(reveal));});
+ $('logout').onclick=async()=>{try{await api('/auth/logout');drawAuth({authenticated:false,configured:true});toast('已登出');}catch(e){toast(e.message,'error');}};
+ $('login-form').onsubmit=async event=>{event.preventDefault();const button=$('login-submit'),note=$('login-note');button.disabled=true;button.classList.add('loading');
+ note.dataset.tone='';note.textContent='正在驗證密碼，約需數秒…';
+ try{const r=await fetch('/auth/challenge',{cache:'no-store'});if(!r.ok)throw Error('請先完成初始管理密碼設定');const c=await r.json();
+ if(!/^[a-f0-9]{64}$/.test(c.nonce))throw Error('驗證資料無效');
+ const keyText=await CKPassword.derive($('login-password').value,c.salt,c.iterations);$('login-password').value='';
+ const key=Uint8Array.from(keyText.match(/../g),x=>parseInt(x,16));const proof=c.nonce+':'+hex(hmac256(key,enc('ck-admin-login-v1\n'+c.nonce)));key.fill(0);
+ const login=await fetch('/auth/login',{method:'POST',headers:{'X-CK-Login':proof},body:''});
+ if(!login.ok)throw Error(login.status===429?'嘗試次數較多，請稍候再登入':'密碼不正確，或驗證已逾時');
+ drawAuth({...await login.json(),configured:true});note.textContent='';$('login-box').close();toast('已登入管理員','success');
+ const next=pending;pending=null;if(next)view(next);else settingsRefresh().catch(()=>{});
+ }catch(e){note.dataset.tone='error';note.textContent=e.message;}finally{button.disabled=false;button.classList.remove('loading');}};
+ function drawTrend(){const t=trendPaths(samples,Date.now());$('trend-empty').style.display=t?'none':'';
+ $('trend-line').setAttribute('d',t?t.line:'');$('trend-area').setAttribute('d',t?t.area:'');
+ for(const [id,k]of[['trend-avg','avg'],['trend-max','max'],['trend-min','min']])$(id).textContent=t?fmtW(t[k]):'—';
+ $('trend-range').textContent=t?'0 – '+fmtW(t.top):'';}
+ function drawMeter(data,offline=false){const v=meterView(data),pill=$('live-state'),fine=v.energy!=='—';
+ for(const [id,value]of[['voltage',v.voltage],['current-amps',v.current],['power',v.power],['relay-text',v.relay],['meter-updated',v.note]])$(id).textContent=value;
+ $('energy').textContent=fine?v.energy.slice(0,-3):v.energy;$('energy-fine').textContent=fine?v.energy.slice(-3):'';
+ $('relay').dataset.on=v.relay==='插座已開啟'?'true':v.relay==='插座已關閉'?'false':'';
+ $('meter-state').textContent=offline?'連線中斷，正在重試':v.state;
+ const w=offline?null:powerWatts(data);$('gauge-arc').style.strokeDasharray=(w===null?0:395.84*gaugeFraction(w)).toFixed(2)+' 527.79';
+ if(w!==null){const now=Date.now();samples.push([now,w]);while(samples.length&&now-samples[0][0]>120000)samples.shift();}drawTrend();
+ pill.dataset.state=offline?'offline':v.complete?'live':'waiting';pill.lastElementChild.textContent=offline?'連線中斷':v.complete?'即時連線':'等待量測';
+ if(protocol?.active==='homekit'){$('meter-state').textContent='HomeKit 模式';$('meter-updated').textContent='自訂即時量測及 kWh 累計暫停；顯示已保存的用電紀錄';if(!offline){pill.lastElementChild.textContent='管理連線正常';pill.dataset.state='live';}}}
+ const protocolName=p=>p==='homekit'?'HomeKit':p==='matter'?'Matter':'維修模式';
+ async function refresh(){const r=await fetch('/status',{cache:'no-store'});if(!r.ok)throw Error('裝置尚未準備好');status=await r.json();
+ $('current').textContent=status.version;$('version-big').textContent=status.version||'—';const health=$('health-chip');
+ health.textContent=status.rescue?'維修模式':status.healthy?'運作正常 · 軟體版本 '+status.software_version:'正在確認啟動狀態';health.dataset.tone=status.rescue?'warn':status.healthy?'ok':'';
+ const p=await fetch('/protocol',{cache:'no-store'});if(p.ok){const previous=protocol?.selected;protocol=await p.json();const name=protocolName(protocol.active);
+ $('active-protocol').textContent=name;$('protocol-status').textContent='目前：'+name+(protocol.restart_pending?' · 等待重啟':'');
+ const choice=document.querySelector('input[name="protocol"][value="'+protocol.selected+'"]');if(choice&&!protocolDirty&&previous!==protocol.selected)choice.checked=true;
+ $('matter-onboarding').hidden=protocol.active!=='matter';$('commissioning-open').hidden=protocol.active!=='matter';}}
+ const ledReasons={normal:'依平常模式顯示',night:'夜間熄燈中',pairing:'等待家庭配對',joining:'正在連接 Wi-Fi',setup:'等待初次設定',error:'服務或 MCU 通訊異常',identify:'尋找插座中'};
+ const ledMinutes=s=>{if(!/^\d{2}:\d{2}$/.test(s))return NaN;const [h,m]=s.split(':').map(Number);return h<24&&m<60?h*60+m:NaN;};
+ const ledTime=m=>String(Math.floor(m/60)).padStart(2,'0')+':'+String(m%60).padStart(2,'0');
+ function drawTimeline(){const start=ledMinutes($('led-start').value),end=ledMinutes($('led-end').value),on=$('led-schedule').checked;
+ const seg=(el,a,b)=>{el.hidden=!(on&&b>a);el.style.left=a/14.4+'%';el.style.width=(b-a)/14.4+'%';};
+ const valid=Number.isInteger(start)&&Number.isInteger(end)&&start!==end;
+ seg($('night-a'),valid?start:0,valid?(start
end?end:0);$('led-timeline').style.opacity=on?1:.5;}
+ async function ledRefresh(){if(!auth.authenticated)return;const r=await fetch('/admin/led',{cache:'no-store'});if(!r.ok){$('led-status').textContent='燈號設定尚未就緒，請稍候再試';return;}const d=await r.json();
+ $('led-status').textContent=d.service_ready?(ledReasons[d.reason]||'正在讀取狀態'):'指示燈服務正在準備中';$('led-lamp').classList.toggle('lit',d.on===true);
+ $('led-clock').textContent=d.time_valid?'時間已校準 · '+(d.time_source==='ntp'?'時間伺服器':'手機時間')+(d.night?' · 目前為熄燈時段':''):'排程等待校時，可在「時區與校時」用手機時間校準';
+ const now=$('night-now');now.hidden=!d.time_valid;if(d.time_valid)now.style.left=((Math.floor(d.utc_s/60)+d.utc_offset)%1440+1440)%1440/14.4+'%';
+ if(!ledDirty){const mode=document.querySelector('input[name="led-mode"][value="'+d.mode+'"]');if(mode)mode.checked=true;
+ $('led-schedule').checked=d.schedule;$('led-start').value=ledTime(d.start);$('led-end').value=ledTime(d.end);$('led-offset').value=d.utc_offset/60;$('led-ntp').value=d.ntp;}
+ drawTimeline();}
+ $('led-settings').addEventListener('input',()=>{ledDirty=true;drawTimeline();});
+ $('led-settings').onsubmit=e=>{e.preventDefault();run(async()=>{const mode=document.querySelector('input[name="led-mode"]:checked')?.value||'smart',
+ start=ledMinutes($('led-start').value),end=ledMinutes($('led-end').value),offset=Number($('led-offset').value)*60,ntp=$('led-ntp').value.trim();
+ if(!Number.isInteger(start)||!Number.isInteger(end)||start===end||!Number.isInteger(offset)||offset<-720||offset>840||offset%15||!/^([A-Za-z0-9][A-Za-z0-9.-]{0,126})$/.test(ntp)||/[.-]$/.test(ntp))throw Error('請檢查熄燈時間、UTC 時差及時間伺服器');
+ await api('/admin/led','CKLED1 '+mode+' '+Number($('led-schedule').checked)+' '+start+' '+end+' '+offset+' '+ntp+'\n');ledDirty=false;toast('燈號設定已保存，會立即套用。','success');await ledRefresh();},$('led-save'));};
+ $('led-find').onclick=()=>run(async()=>{await api('/admin/led-find');toast('插座將閃燈 15 秒，之後恢復原本燈號。','success');},$('led-find'));
+ $('led-phone-time').onclick=()=>run(async()=>{await api('/admin/led-time',String(Math.floor(Date.now()/1000)));toast('已送出手機時間，本次開機的排程可離線繼續計時。','success');await ledRefresh();},$('led-phone-time'));
+ const formatCode=c=>/^\d{11}$/.test(c)?c.slice(0,4)+'-'+c.slice(4,7)+'-'+c.slice(7):c;
+ async function settingsRefresh(){if(!auth.authenticated)return;const r=await fetch('/admin/state',{cache:'no-store'});if(r.status===401){await authRefresh();return;}if(!r.ok)return;
+ const m=(await r.json()).matter,line=$('pairing-state');
+ if(protocol?.active==='homekit'){$('pairing-text').textContent='HomeKit 模式：請使用插座原廠標籤上的配對碼。';line.dataset.tone='ok';}
+ else if(m){$('pairing-text').textContent='已配對 '+m.fabrics+' 個家庭 · '+(m.window_open?'配對視窗開啟中':'配對視窗已關閉');line.dataset.tone=m.window_open?'open':m.fabrics?'ok':'';}
+ else{$('pairing-text').textContent='Matter 正在準備中';line.dataset.tone='';}
+ const onboarding=await fetch('/admin/onboarding',{cache:'no-store'});if(onboarding.ok){const d=await onboarding.json();$('matter-code').textContent=d.manual_code?formatCode(d.manual_code):'尚未就緒';$('matter-code').dataset.raw=d.manual_code||'';}
+ await ledRefresh();}
+ $('code-copy').onclick=async()=>{const code=$('matter-code'),text=code.dataset.raw;if(!text)return;
+ try{await navigator.clipboard.writeText(text);}catch{const range=document.createRange(),selection=getSelection();range.selectNodeContents(code);selection.removeAllRanges();selection.addRange(range);
+ const copied=document.execCommand('copy');selection.removeAllRanges();if(!copied){toast('無法自動複製，請手動抄寫設定碼','error');return;}}
+ toast('已複製 Matter 設定碼','success');};
+ async function waitReceipt(id){const until=Date.now()+60000;while(Date.now()run(async()=>{const mode=document.querySelector('input[name="protocol"]:checked').value;const data=await api('/protocol',mode);protocolDirty=false;
+ if(data.status==='unchanged'){toast('目前已使用此協議。');return;}restarting('協議選擇已保存，正在重新啟動');},$('protocol-save'));
+ $('energy-reset').onclick=()=>run(async()=>{if(!await ask('累積用電會歸零並立即保存，之後從零重新累計。此動作無法復原。','將累積用電歸零？','歸零'))return;
+ const result=await api('/admin/energy-reset');if(result.request_id)await waitReceipt(result.request_id);toast('累積用電已歸零並保存。','success');samples.length=0;drawMeter(null);await settingsRefresh();},$('energy-reset'));
+ $('commissioning-open').onclick=()=>run(async()=>{const r=await api('/admin/open-commissioning');await waitReceipt(r.request_id);toast('Matter 配對視窗已重新開啟。','success');await settingsRefresh();},$('commissioning-open'));
+ $('pairing-reset').onclick=()=>run(async()=>{if(!await ask('目前協議的家庭配對會被清除，Wi-Fi、管理密碼和累積用電會保留。','清除家庭配對？','清除配對'))return;
+ const r=await api('/admin/pairing-reset');if(r.status==='restarting')restarting('正在重設配對並重新啟動');else toast('正在重設配對，請稍候再查看狀態。');},$('pairing-reset'));
+ $('reboot').onclick=()=>run(async()=>{await api('/admin/reboot');restarting('正在重新啟動');},$('reboot'));
+ $('factory-reset').onclick=()=>run(async()=>{if(!await ask('會清除管理密碼、Wi-Fi、HomeKit／Matter 配對與全部累積用電，之後需要重新設定。','恢復出廠設定？','清除並恢復出廠'))return;
+ await api('/admin/factory-reset');toast('正在恢復出廠。重啟後請連接 CommandKit-Setup 設定熱點重新設定。','success');drawAuth({authenticated:false,configured:false});},$('factory-reset'));
+ $('wifi-settings').onsubmit=event=>{event.preventDefault();run(async()=>{const ssid=enc($('wifi-ssid').value),password=enc($('wifi-password').value);
+ if(ssid.length<1||ssid.length>32||password.length<8||password.length>64||password.some(v=>v<32||v>126))throw Error('請檢查 Wi-Fi 名稱與密碼長度');
+ const b=new Uint8Array(104);b.set(enc('CKW1'));b[4]=ssid.length;b[5]=password.length;b[6]=1;b.set(ssid,8);b.set(password,40);
+ await api('/admin/wifi',hex(b));b.fill(0);$('wifi-password').value='';toast('已送出 Wi-Fi 設定。請切回相同網路，並用插座的新 IP 開啟管理頁。','success');},event.submitter);};
+ $('password-settings').onsubmit=event=>{event.preventDefault();run(async()=>{const password=$('new-password').value;if(password!==$('confirm-password').value)throw Error('兩次密碼不相同');
+ const salt=CKPassword.salt(),key=await CKPassword.derive(password,salt);
+ await api('/auth/password',CKPassword.record(salt,key));$('new-password').value='';$('confirm-password').value='';drawAuth({authenticated:false,configured:true});openLogin('密碼已更新，請使用新密碼登入。');},event.submitter);};
+ function drawUpdate(){const s=catalog.state,newer=s==='available'&&latest,tone={checking:'busy',available:'new',current:'ok',error:'warn'}[s]||'';
+ $('update-state').dataset.tone=tone;$('update-icon').firstElementChild.setAttribute('href',newer?'#i-download':s==='current'?'#i-check':s==='error'?'#i-alert':'#i-update');
+ $('update-title').textContent=s==='checking'?'正在檢查線上版本…':newer?'有新版本 '+latest.version:s==='current'?'目前已是最新版本':s==='error'?'無法檢查線上版本':'尚未檢查線上版本';
+ $('message').textContent=s==='checking'?'正在連線到更新來源':newer?'軟體版本 '+latest.software_version+(Number.isFinite(latest.size)?' · '+(latest.size/1048576).toFixed(1)+' MB':'')+' · 驗證簽章後安裝':
+ s==='current'?'已安裝 '+(status?.version||'')+' · '+catalog.at.toLocaleTimeString('zh-TW',{hour12:false})+' 檢查':s==='error'?catalog.error+'。仍可使用手動更新。':'開啟頁面時會自動檢查一次';
+ const chip=$('update-chip');chip.dataset.tone=newer?'new':tone==='busy'?'':tone;chip.textContent=s==='checking'?'檢查中…':newer?'有新版本':s==='current'?'已是最新':s==='error'?'無法檢查':'尚未檢查';
+ $('update-banner').hidden=!newer||installing||current==='update';$('update-dot').hidden=!newer;$('online').hidden=!newer||!auth.authenticated;
+ if(newer){$('banner-title').textContent='有新版本 '+latest.version+' 可以安裝';$('banner-text').textContent=auth.authenticated?'前往更新頁面安裝，更新時請保持供電':'登入管理員後即可更新';$('online-label').textContent='下載並更新至 '+latest.version;}}
+ async function checkUpdates(manual=false){if(!status||catalog.state==='checking')return;catalog={state:'checking',error:''};drawUpdate();
+ try{const r=await fetch(CK_CATALOG_URL,{cache:'no-store'});if(!r.ok)throw Error('更新來源尚未發布');const c=await r.json();if(c.format!=='commandkit-catalog-v1'||!Array.isArray(c.updates))throw Error('更新索引格式不符');
+ latest=newestUpdate(c.updates,status.software_version);catalog={state:latest?'available':'current',error:'',at:new Date()};
+ if(manual)toast(latest?'有新版本 '+latest.version:'目前已是最新版本',latest?'info':'success');
+ }catch(e){latest=null;catalog={state:'error',error:e instanceof TypeError?'無法連線到更新來源':e.message};if(manual)toast('無法檢查線上版本：'+catalog.error,'error');}
+ drawUpdate();}
+ $('check').onclick=()=>run(()=>checkUpdates(true),$('check'));
+ function steps(active,online){const order=['download','upload','apply','reboot','done'],at=order.indexOf(active);
+ document.querySelectorAll('#install-steps li').forEach((li,i)=>{li.dataset.state=!online&&!i?'skip':active==='done'||isize)throw Error('下載不完整');out.set(value,at);at+=value.length;
+ const p=Math.floor(at*100/size);if(p!==shown){shown=p;progress(p);}}
+ return at===size?out:out.subarray(0,at);}
+ $('online').onclick=()=>run(()=>installJob(async()=>{const item=latest;if(!item?.url.startsWith('https://')||!Number.isSafeInteger(item.size)||item.size<256||item.size>16777216)throw Error('更新來源不符');
+ $('install-note').textContent='正在下載 '+item.version+'…';const r=await fetch(item.url,{cache:'no-store'});if(!r.ok)throw Error('下載失敗');
+ const b=await readAll(r,item.size,p=>{$('install-note').textContent='正在下載 '+item.version+' · '+p+'%';});
+ if(b.length!==item.size||hex(sha256(b))!==item.sha256)throw Error('下載不完整');return [b,item.software_version];},true),$('online'));
+ function drawPackage(){const f=$('package').files[0];$('package-name').textContent=f?f.name:'點選或拖放 .ota 更新包';
+ $('package-info').textContent=f?(f.size/1048576).toFixed(2)+' MB · 按「驗證並更新」開始':'只接受本專案簽章的 matter.ota';}
+ $('package').onchange=drawPackage;const drop=$('drop');
+ ['dragenter','dragover'].forEach(n=>drop.addEventListener(n,e=>{e.preventDefault();drop.classList.add('over');}));
+ ['dragleave','drop'].forEach(n=>drop.addEventListener(n,e=>{e.preventDefault();drop.classList.remove('over');}));
+ drop.addEventListener('drop',e=>{if(e.dataTransfer?.files?.length){$('package').files=e.dataTransfer.files;drawPackage();}});
+ $('manual').onclick=()=>{const file=$('package').files[0];if(!file){toast('請先選擇 .ota 更新包','error');return;}
+ run(()=>installJob(async()=>{const b=new Uint8Array(await file.arrayBuffer());if(b.length<256)throw Error('更新檔案不完整');return [b,new DataView(b.buffer).getUint32(20)];},false),$('manual'));};
+ async function monitor(){if(!document.hidden&&!busy){const controller=new AbortController(),timer=setTimeout(()=>controller.abort(),4000);try{
+ const r=await fetch('/measurements',{cache:'no-store',signal:controller.signal});if(!r.ok)throw Error();drawMeter(await r.json());
+ }catch{drawMeter(null,true);}finally{clearTimeout(timer);}}
+ setTimeout(monitor,2000);}
+ async function statePoll(){if(!document.hidden&&!busy){try{await refresh();await authRefresh();await settingsRefresh();if(catalog.state==='idle')checkUpdates();}catch{}}setTimeout(statePoll,10000);}
document.addEventListener('visibilitychange',()=>{if(document.hidden)drawMeter(null);});
- monitor();
- async function refresh(){const r=await fetch('/status');if(!r.ok)throw Error('裝置尚未準備好');status=await r.json();$('current').textContent=status.version;
- if(status.rescue)message('裝置目前在維修模式，可安裝較新的修正版。');}
- async function post(path,bytes,imageHash=null){const digest=imageHash||hex(sha256(bytes));
- const response=await fetch(path,{method:'POST',headers:{'Content-Type':'application/octet-stream','X-CK-SHA256':digest},body:bytes});
- if(!response.ok){const problem=await response.json();throw Error(problem.error==='busy_or_low_memory'?'插座正在更新或記憶體不足，請稍候再試':'更新遭拒絕：請確認機型、版本與簽章，或下載完整檔案後重試');}
- return response.json();}
- async function install(bytes,expected){if(busy)return;busy=true;document.querySelectorAll('button').forEach(b=>b.disabled=true);
- drawMeter(null);$('meter-state').textContent='更新期間暫停量測';
- try{if(bytes.length!==status.max_size)throw Error('請選擇 .ota 更新包；8 MiB 燒錄映像不適用');
- message('正在驗證並上傳，請保持此頁開啟…');await post('/upload',bytes);
- message('簽章驗證完成，正在安裝。請保持插座供電…');await post('/apply',new Uint8Array(),hex(sha256(bytes)));
- const until=Date.now()+240000;let found=false;
- while(Date.now()setTimeout(r,4000));try{await refresh();if(status.software_version===expected){if(status.rescue||status.healthy){found=true;message(status.rescue?'新版已啟動，但進入維修模式，請安裝修正版。':'更新完成，Matter 與裝置控制已就緒。原有設定與配對已保留。');break;}message('新版已啟動，正在驗證網路與裝置控制…');}}catch{}}
- if(!found)message('尚未收到新版回應。請稍候，並確認插座的網路位址；勿重複上傳。');
- }catch(e){message(e.message);}finally{busy=false;document.querySelectorAll('button').forEach(b=>b.disabled=false);}}
- $('manual').onclick=async()=>{try{const f=$('package').files[0];if(!f)throw Error('請選擇 .ota 更新包');const b=new Uint8Array(await f.arrayBuffer());if(b.length<256)throw Error('檔案不完整');await install(b,new DataView(b.buffer).getUint32(20));}catch(e){message(e.message);}};
- $('check').onclick=async()=>{try{message('正在檢查新版本…');const response=await fetch(CK_CATALOG_URL,{cache:'no-store'});if(!response.ok)throw Error('更新來源尚未發布');const catalog=await response.json();
- if(catalog.format!=='commandkit-catalog-v1'||!Array.isArray(catalog.updates))throw Error('更新索引格式不符');
- const name=status.variant===1?'matter':'exec-test';latest=catalog.updates.filter(x=>x.model==='CMNDKT-004'&&x.variant===name&&Number.isSafeInteger(x.software_version)&&x.software_version>status.software_version).sort((a,b)=>b.software_version-a.software_version)[0];
- $('online').hidden=!latest;message(latest?'有新版本 '+latest.version+'，可按「下載並更新」。':'目前已是最新版本。');
- }catch(e){message('無法檢查線上版本：'+e.message+'。仍可使用下方手動更新。');}};
- $('online').onclick=async()=>{try{if(!latest||!latest.url.startsWith('https://'))throw Error('更新來源不符');message('正在下載 '+latest.version+'…');const r=await fetch(latest.url,{cache:'no-store'});if(!r.ok)throw Error('下載失敗');
- const b=new Uint8Array(await r.arrayBuffer());if(b.length!==latest.size||hex(sha256(b))!==latest.sha256)throw Error('下載不完整');await install(b,latest.software_version);
- }catch(e){message(e.message+'。可改用手動更新，或電腦上的 update.py。');}};
- try{await refresh();}catch(e){message(e.message);}
+ try{await refresh();await authRefresh();}catch{const pill=$('live-state');pill.dataset.state='offline';pill.lastElementChild.textContent='連線中斷';}
+ monitor();statePoll();checkUpdates();setInterval(()=>{if(!busy&&!installing)checkUpdates();},6*3600000);
})();
diff --git a/firmware/matter/src/update/update_page.h b/firmware/matter/src/update/update_page.h
index f18dd95..8e005fe 100644
--- a/firmware/matter/src/update/update_page.h
+++ b/firmware/matter/src/update/update_page.h
@@ -1,2 +1,2 @@
/* Generated by tools/generate_update.py. */
-static const char ck_update_page[] = "\n\nCommandKit 插座用電與更新\n\n\n\n\n正在連線…插座狀態讀取中
\n\n\n\n\n\n
\n\n\n韌體更新
讓插座保持更新，原有設定與配對會保留。
\n使用已下載的更新包
更新會暫停控制並重新啟動插座，請保持供電。
可檢查新版本，或使用已下載的更新包。
\n\n\n\n";
+static const char ck_update_page[] = "\n\nCommandKit 插座管理\n\n\n\n\n
\n
\n尚未設定管理密碼
請連接插座的 CommandKit-Setup 設定熱點，開啟 http://192.168.1.254/ 完成初始設定。
電壓—V
交流有效值\n
電流—A
交流有效值\n
累積用電—kWh
功率估算 · 約 30 秒保存一次 \n\n裝置資訊
\n
\n
訪客可以查看狀態。登入後可調整燈號、配對、更新韌體與重設設定。
指示燈
HomeKit 與 Matter 共用同一組燈號設定
智慧家庭與配對
一次啟用一種協議，管理後台兩種模式都能使用
智慧家庭協議
\n
\n
切換會重新啟動，保留 Wi-Fi、配對、管理密碼與累積用電。HomeKit 使用插座原廠配對碼；此模式暫停自訂網頁即時量測與 kWh 累計。
\n
家庭配對
\n
正在讀取配對狀態…
\n
在 Apple 家庭、Google Home 或 Home Assistant 選擇「加入配件」，輸入此設定碼。
\n
清除配對會保留 Wi-Fi、管理密碼及累積用電。
手動更新
沒有網際網路時，可先在電腦下載 Release 的 matter.ota，再從這裡上傳。
\n
\n
正在更新
\n
- 下載
- 上傳驗證
- 安裝
- 重新啟動
- 完成
請保持插座供電，不要關閉此頁。
Wi-Fi 連線
支援 2.4 GHz WPA2 個人網路。儲存後插座可能換 IP，請讓手機與插座使用同一網路。
\n
\n
管理密碼
變更後需要用新密碼重新登入。至少 8 個字元。
\n
維護
\n
重新啟動插座不清除任何設定，約一分鐘後恢復連線
危險區
\n
累積用電歸零立即保存，之後從零重新累計，無法復原
\n
恢復出廠設定清除管理密碼、Wi-Fi、兩套配對與用電紀錄，重新開啟設定熱點
\n\n";
diff --git a/firmware/matter/tests/relay_engine_tests.cpp b/firmware/matter/tests/relay_engine_tests.cpp
index 7373ad8..eb89c16 100644
--- a/firmware/matter/tests/relay_engine_tests.cpp
+++ b/firmware/matter/tests/relay_engine_tests.cpp
@@ -58,7 +58,7 @@ int main() {
power(e,6,65000); power(e,6,70000); check(e.LoadBlink(70003),"load reentry");
state(e,true,84000); check(!e.LoadBlink(85002),"stale metering stops blink");
uint8_t reset[]={0xaa,0xff,0,0x55,0xaa,0xff,0xff,0x55};for(auto b:reset)e.Feed(b,86000);
- check(e.Snapshot().resetEvents==2,"reset events recorded without erasing");
+ check(e.Snapshot().resetEvents==1,"only confirmed long press dispatches factory reset");
check(e.Request(203,false,87000),"disconnect command");e.Disconnect();
check(e.Snapshot().completedId==203&&e.Snapshot().result==RelayResult::TransportError&&!e.Snapshot().known,"transport failure never succeeds");
RelayEngine late; check(late.Request(1,false,0),"late fixture");late.NextTx(0,tx);late.NextTx(100,tx);state(late,false,3000);late.NextTx(3000,tx);
diff --git a/firmware/matter/tests/test_device_portal.py b/firmware/matter/tests/test_device_portal.py
index 5a5cb87..e38abbb 100644
--- a/firmware/matter/tests/test_device_portal.py
+++ b/firmware/matter/tests/test_device_portal.py
@@ -9,6 +9,7 @@ def call(port,method,path,body=None,headers=None):
def main():
parser=argparse.ArgumentParser();parser.add_argument('--output-tag',choices=['softap-device-code'],default='softap-device-code');options=parser.parse_args();ART=OUT/'artifacts'/options.output_tag;EV=OUT/'evidence'/options.output_tag
name='incipio-softap-http-test';checks=[]
+ ram=OUT/'private/device-test-A';(ram/'ck-admin-state').write_text('0');(ram/'ck-admin-enroll-ok').unlink(missing_ok=True)
p=subprocess.Popen(['docker','run','--rm','--name',name,'-p','127.0.0.1:18082:18082',
'-p','127.0.0.1:18083:18083/udp','-p','127.0.0.1:18084:18084','-v',f'{OUT}:/work:ro',
'-v',f'{OUT}/private/device-test-A:/var/run',
@@ -32,10 +33,29 @@ def main():
assert s==302 and hs['Location']=='http://127.0.0.1:18082/';checks.append('captive HTTP probe redirect')
assert call(18084,'POST','/enter-setup')[0]==403;checks.append('unauthenticated setup rejected')
key=bytes.fromhex((OUT/'private/diag.key').read_text().strip())
+ download_headers={'Content-Type':'application/x-www-form-urlencoded'}
+ assert b'id="admin-password"' in page and b'download-management-key' not in page
+ assert call(18082,'POST','/management-key','token='+token,download_headers)[0]==403
+ assert key.hex().encode() not in page
+ state=json.loads(call(18082,'GET','/admin/status')[1]);assert state['ready'] and not state['configured']
+ valid_wifi=urllib.parse.urlencode({'ssid':'Lab Network','password':'ExamplePass42','security':'wpa2','token':token})
+ assert call(18082,'POST','/wifi',valid_wifi,download_headers)[0]==403
+ credential=(b'CKAUTH1\n'+struct.pack('>I',600000)+bytes(range(16))+bytes(range(32))).hex()
+ assert call(18082,'POST','/admin/enroll','token='+'0'*64+'&credential='+credential,download_headers)[0]==403
+ # This qemu-user portal has no journal/backend helper. Actual enrollment
+ # commits are covered by test_updates; the portal must not claim success.
+ assert call(18082,'POST','/admin/enroll','token='+token+'&credential='+credential,download_headers)[0]==409
+ assert not (ram/'ck-admin-enroll').exists()
+ (ram/'ck-admin-state').write_text('1');(ram/'ck-admin-enroll-ok').write_text('1')
+ checks.append('password inputs replace key export; valid setup token required; enrollment failure never permits Wi-Fi; journal success is a separate fixture')
def proof(scope):
_,nonce,_=call(18084,'GET','/challenge');return nonce.decode()+':'+hmac.new(key,scope.encode()+nonce,hashlib.sha256).hexdigest()
header={'X-Setup-Proof':proof('GET /state\n')};s,b,_=call(18084,'GET','/state',headers=header)
assert s==200 and b'state=setup' in b;assert call(18084,'GET','/state',headers=header)[0]==403;checks.append('HMAC state and replay rejection')
+ for action in ['reset-matter','open-commissioning','enter-setup','ram-probe']:
+ assert call(18084,'POST','/'+action,headers={'X-Setup-Proof':proof('POST /'+action+'\n')})[0]==403
+ assert not (ram/'ck-matter-request').exists()
+ checks.append('legacy diagnostic HMAC cannot bypass password login for mutations')
qname=b''.join(bytes([len(x)])+x.encode() for x in 'captive.apple.com'.split('.'))+b'\0'
sock=socket.socket(socket.AF_INET,socket.SOCK_DGRAM);sock.settimeout(3)
for ty in [1,28]:
@@ -94,7 +114,7 @@ def scan(h=None,body=scan_body):
if options.output_tag in ('softap-device-code',):
assert manual in confirmation and b"src='/matter-qr'" in confirmation
checks.append('Wi-Fi submission confirmation retains same manual code and QR')
- assert post(v)==409;time.sleep(4)
+ assert post(v)==403;time.sleep(4)
s,b,_=call(18084,'GET','/state',headers={'X-Setup-Proof':proof('GET /state\n')})
assert s==200 and b'state=online' in b;checks.append('duplicate guard and fixture transition')
r={'status':'pass','checks':checks,'binary_sha256':hashlib.sha256((ART/'ck-setupd').read_bytes()).hexdigest(),
diff --git a/firmware/matter/tools/build_matter_device_fixture.py b/firmware/matter/tools/build_matter_device_fixture.py
index 717b919..8de0204 100644
--- a/firmware/matter/tools/build_matter_device_fixture.py
+++ b/firmware/matter/tools/build_matter_device_fixture.py
@@ -23,6 +23,9 @@ def entry(name,data=b'',mode=stat.S_IFREG|0o755,rdev=(0,0)):
entry('dev/ttyS1',mode=stat.S_IFCHR|0o600,rdev=(4,65));entry('tmp/gpio',b' '*32,mode=stat.S_IFREG|0o600)
entry('etc/matter-device.key',(OUT/'private/device-identity.key').read_bytes(),mode=stat.S_IFREG|0o600)
if persistent:
+ salt=bytes(range(16));key=hashlib.pbkdf2_hmac('sha256',b'FixtureAdmin42',salt,600000,32)
+ entry('test-admin.bin',b'CKAUTH1\n'+struct.pack('>I',600000)+salt+key,mode=stat.S_IFREG|0o600)
+ entry('bin/ck-setupd',(OUT/'artifacts/softap-device-code/ck-setupd').read_bytes())
entry('bin/ck-updated',(OUT/'artifacts/update-test/ck-updated').read_bytes())
entry('dev/ttyS0',mode=stat.S_IFCHR|0o600,rdev=(4,64))
entry('etc/ck-update.pub',(Path('/repo/third_party/ota-signing.pub')).read_bytes(),mode=stat.S_IFREG|0o444)
diff --git a/firmware/matter/tools/build_updates.sh b/firmware/matter/tools/build_updates.sh
index d93724c..b0dc2bc 100644
--- a/firmware/matter/tools/build_updates.sh
+++ b/firmware/matter/tools/build_updates.sh
@@ -8,15 +8,17 @@ if [ "${CK_TESTING:-0}" = 1 ]; then dest=artifacts/update-test; fi
mkdir -p "$dest"
flags='-static -Os -std=c11 -Wall -Wextra -Werror -Wno-misleading-indentation -Wno-unused-function -mno-llsc -mno-load-store-pairs -mmemcpy -fno-builtin-memcpy -fno-builtin-memmove -ffunction-sections -fdata-sections -Wl,--gc-sections'
if [ "${CK_TESTING:-0}" = 1 ]; then flags="$flags -DCK_TESTING"; fi
-common='src/update/ck_common.c src/update/ck_flash.c src/update/ck_store.c src/update/ck_ota.c src/vendor/monocypher/monocypher.c src/vendor/monocypher/monocypher-ed25519.c'
+common='src/update/ck_common.c src/update/ck_flash.c src/update/ck_store.c src/update/ck_energy.c src/update/ck_led.c src/update/ck_ota.c src/vendor/monocypher/monocypher.c src/vendor/monocypher/monocypher-ed25519.c'
${cross}gcc $flags $common src/update/ck_updater.c -o "$dest/ck-updater"
${cross}gcc $flags $common src/update/ck_meter.c src/update/ck_updated.c -o "$dest/ck-updated"
+${cross}gcc $flags src/setup/boot_guard.c -o "$dest/ck-boot-guard"
if [ "${CK_TESTING:-0}" = 1 ]; then
${cross}gcc $flags -DCK_TEST_PID1 $common src/update/ck_updater.c -o "$dest/ck-updater-vm"
${cross}strip "$dest/ck-updater-vm"
fi
${cross}strip "$dest/ck-updater" "$dest/ck-updated"
-${cross}objdump -d "$dest/ck-updater" "$dest/ck-updated" > "$dest/disassembly.txt"
+${cross}strip "$dest/ck-boot-guard"
+${cross}objdump -d "$dest/ck-updater" "$dest/ck-updated" "$dest/ck-boot-guard" > "$dest/disassembly.txt"
CK_BUILD_DEST="$dest" python3 - <<'PY'
import re,os
from pathlib import Path
diff --git a/reverse/tools/audit_wifi_startup.py b/reverse/tools/audit_wifi_startup.py
new file mode 100644
index 0000000..b3775fd
--- /dev/null
+++ b/reverse/tools/audit_wifi_startup.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""Replay extracted startup scripts with injected faults; no device/network I/O.
+
+Run inside a disposable Linux container with --network none. The actual image's
+BusyBox ash is emulated; updater, identity helper and network commands are mocks.
+Only temporary regular files are modified. A DHCP marker means its launch was
+reached, not that a real DHCP transaction succeeded.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import resource
+import shlex
+import signal
+import subprocess
+import tempfile
+import time
+
+
+def digest(path):
+ return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def wait_for(predicate, timeout=3):
+ deadline = time.monotonic() + timeout
+ while time.monotonic() < deadline:
+ if predicate():
+ return True
+ time.sleep(.01)
+ return bool(predicate())
+
+
+def run_case(tree, runner, scenario, public=True):
+ with tempfile.TemporaryDirectory(prefix='ck-wifi-audit-') as name:
+ root = Path(name)
+ for folder in ('etc', 'bin', 'var/log', 'var/run', 'var/lib/ck-state'):
+ (root / folder).mkdir(parents=True, exist_ok=True)
+ events = root / 'events'
+ processes = []
+ logs = []
+
+ def executable(name, body):
+ path = root / 'bin' / name
+ path.write_text('#!/bin/sh\n' + body + '\n')
+ path.chmod(0o700)
+ return path
+
+ def record(event):
+ return 'echo ' + shlex.quote(event) + ' >> ' + shlex.quote(str(events)) + '\n'
+
+ def rewrite(path, output):
+ # Preserve shell logic; redirect absolute device paths into fixtures.
+ text = path.read_text()
+ text = re.sub(r'/(?:bin|var|etc)/', lambda m: str(root) + m[0], text)
+ output.write_text(text)
+ return output
+
+ def launch(script, *args):
+ log = (root / ('process-%d.log' % len(processes))).open('wb')
+ logs.append(log)
+ p = subprocess.Popen(runner + [str(script), *args], stdout=log,
+ stderr=log, start_new_session=True,
+ env={**os.environ, 'PATH': str(root / 'bin') + ':/usr/bin:/bin'})
+ processes.append(p)
+ return p
+
+ if public:
+ (root / 'etc/ck-identity-policy').write_text('auto-v1\n')
+ else:
+ (root / 'etc/matter-device.key').write_bytes(b'D' * 32)
+ (root / 'etc/matter-diag.key').write_bytes(b'12' * 32 + b'\n')
+ (root / 'etc/ck-update.pub').write_bytes(b'P' * 32)
+ executable('sleep', 'exec /bin/sleep .02')
+ executable('ck-updated', 'exec /bin/sleep 30')
+ executable('killall', 'exit 0')
+ executable('ifconfig', record('ifconfig-called') + 'exit 0')
+ executable('udhcpc', record('dhcp-launch-reached') + 'exec /bin/sleep 30')
+ updater = record('updater-$1').replace("'updater-$1'", '"updater-$1"')
+ updater += 'if [ "$1" != --import ]; then exit 0; fi\n'
+ updater += 'echo "$PPID" > ' + shlex.quote(str(root / 'initializer.pid')) + '\n'
+ if scenario in ('import_hang', 'initializer_killed'):
+ updater += 'exec /bin/sleep 30\n'
+ elif scenario == 'import_crash':
+ updater += 'kill -SEGV $$\n'
+ elif scenario == 'import_error':
+ updater += 'exit 1\n'
+ else:
+ updater += 'printf %s DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD > ' + shlex.quote(str(root / 'var/lib/ck-state/device.key')) + '\n'
+ executable('ck-updater', updater)
+ identity = record('identity-helper-called')
+ if scenario == 'identity_crash':
+ identity += 'kill -SEGV $$\n'
+ else:
+ identity += 'test -f ' + shlex.quote(str(root / 'var/lib/ck-state/device.key')) + ' || exit 5\n'
+ identity += 'printf 12345678901 > ' + shlex.quote(str(root / 'var/run/matter-manual-code')) + '\n'
+ executable('matterd-test', identity)
+ executable('ck-wificfg', 'exit 9' if scenario == 'mib_error' else 'echo configured=1')
+ backend = rewrite(tree / 'bin/ck-setup-backend', root / 'backend.sh')
+ controller = record('setup-controller-called')
+ if scenario == 'controller_reject':
+ controller += 'exit 11\n'
+ else:
+ controller += '/bin/sh ' + shlex.quote(str(backend)) + ' resume\nexec /bin/sleep 30\n'
+ executable('ck-setupd', controller)
+ ota_script = rewrite(tree / 'bin/ck-ota-start', root / 'ota-start.sh')
+ setup_script = rewrite(tree / 'bin/ck-setup-start', root / 'setup-start.sh')
+ pending = root / 'var/run/ck-identity-pending'
+
+ def reached(event):
+ return events.exists() and event in events.read_text().splitlines()
+
+ try:
+ ota = launch(ota_script)
+ assert wait_for(lambda: (root / 'initializer.pid').exists()), 'import not started'
+ if scenario == 'initializer_killed':
+ initializer = int((root / 'initializer.pid').read_text())
+ # In the public branch the initializer is a background ash.
+ assert initializer != ota.pid, 'expected independent background initializer'
+ os.kill(initializer, signal.SIGKILL)
+ setup = launch(setup_script)
+ expected_dhcp = scenario == 'success' or (not public and scenario == 'import_error')
+ blocked = scenario in ('import_hang', 'initializer_killed')
+ if expected_dhcp:
+ assert wait_for(lambda: reached('dhcp-launch-reached')), 'DHCP launch not reached'
+ elif blocked:
+ # Accelerated sleep allows many poll iterations, with no cleanup.
+ time.sleep(.4)
+ assert pending.exists() and setup.poll() is None, 'pending gate did not persist'
+ assert not reached('identity-helper-called'), 'identity unexpectedly started'
+ else:
+ assert wait_for(lambda: setup.poll() is not None), 'setup wrapper did not exit'
+ assert setup.returncode != 0, 'fault did not propagate'
+ assert reached('dhcp-launch-reached') == expected_dhcp
+ return {
+ 'scenario': scenario, 'public_image': public,
+ 'expected_observation_confirmed': True,
+ 'identity_pending': pending.exists(),
+ 'rescue_marker': (root / 'var/run/ck-rescue').exists(),
+ 'identity_helper_reached': reached('identity-helper-called'),
+ 'controller_reached': reached('setup-controller-called'),
+ 'dhcp_launch_reached': reached('dhcp-launch-reached'),
+ 'setup_exit_status': setup.poll(),
+ }
+ finally:
+ for p in processes:
+ try:
+ os.killpg(p.pid, signal.SIGKILL)
+ except ProcessLookupError:
+ pass
+ for p in processes:
+ p.wait(timeout=3)
+ for log in logs:
+ log.close()
+
+
+def main():
+ parser = argparse.ArgumentParser(description=__doc__)
+ parser.add_argument('--tree', required=True, type=Path)
+ parser.add_argument('--old-tree', type=Path)
+ parser.add_argument('--output', required=True, type=Path)
+ args = parser.parse_args()
+ resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
+ runner = ['qemu-mips', '-L', str(args.tree), str(args.tree / 'bin/busybox'), 'sh']
+ cases = [run_case(args.tree, runner, name) for name in (
+ 'success', 'import_error', 'import_crash', 'import_hang',
+ 'initializer_killed', 'identity_crash', 'controller_reject', 'mib_error')]
+ if args.old_tree:
+ cases.append(run_case(args.old_tree, runner, 'import_error', public=False))
+ report = {
+ 'status': 'pass', 'environment': 'actual v0.2.6 BusyBox ash under qemu-user in offline Linux container',
+ 'actual_scripts_with_fixture_path_rewrites': True,
+ 'mocks': ['updater', 'identity helper', 'Wi-Fi MIB helper', 'setup controller', 'network commands'],
+ 'no_physical_device_or_network_access': True,
+ 'limitation': 'Injected faults establish startup consequences, not which fault occurred on hardware. DHCP launch marker is not a DHCP exchange.',
+ 'sha256': {path: digest(args.tree / path) for path in (
+ 'bin/busybox', 'bin/ck-ota-start', 'bin/ck-setup-start', 'bin/ck-setup-backend')},
+ 'cases': cases,
+ }
+ args.output.write_text(json.dumps(report, indent=2) + '\n')
+ print(json.dumps(report, indent=2))
+
+
+if __name__ == '__main__':
+ main()
diff --git a/reverse/tools/verify_boa_factory.py b/reverse/tools/verify_boa_factory.py
new file mode 100644
index 0000000..739e44e
--- /dev/null
+++ b/reverse/tools/verify_boa_factory.py
@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+"""Execute original Boa MIPS validation/planning in Unicorn, without an OS.
+
+Requires unicorn==2.1.4. Every external operation is a stub; MTD writes are
+represented only by a plan, then applied to an in-memory bytearray.
+"""
+import argparse
+import hashlib
+import json
+import lzma
+import struct
+import sys
+from pathlib import Path
+from unicorn import Uc, UC_ARCH_MIPS, UC_MODE_MIPS32, UC_MODE_BIG_ENDIAN, UC_HOOK_CODE
+from unicorn.mips_const import (UC_MIPS_REG_A0, UC_MIPS_REG_A1, UC_MIPS_REG_A2,
+ UC_MIPS_REG_A3, UC_MIPS_REG_V0, UC_MIPS_REG_RA, UC_MIPS_REG_SP, UC_MIPS_REG_PC,
+ UC_MIPS_REG_T9)
+from analyze_elf import dynsym
+
+ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(ROOT/'tools'))
+from factory_image import inspect, CANONICAL_MARK, journal_initializer
+from fwlib import sha
+
+
+def boot_checks(loader, flash):
+ """Run the vendor selector/checksums with only SPI copy/console/poll stubbed."""
+ u = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 | UC_MODE_BIG_ENDIAN)
+ u.mem_map(0,0x1000000)
+ u.mem_map(0x1d000000,0x800000)
+ u.mem_write(0x400000,loader)
+ u.mem_write(0x1d000000,bytes(flash))
+ def stub(name):
+ def hook(u,address,size,data):
+ if name == 'spi_copy':
+ dest,offset,n=[u.reg_read(r) for r in (UC_MIPS_REG_A0,UC_MIPS_REG_A1,UC_MIPS_REG_A2)]
+ assert offset+n <= len(flash)
+ u.mem_write(dest & 0x1fffffff,bytes(flash[offset:offset+n]))
+ u.reg_write(UC_MIPS_REG_V0,0)
+ u.reg_write(UC_MIPS_REG_PC,u.reg_read(UC_MIPS_REG_RA))
+ return hook
+ for address,name in [(0x80404a94,'spi_copy'),(0x804079cc,'console'),
+ (0x804077a4,'console'),(0x80407de0,'poll')]:
+ u.hook_add(UC_HOOK_CODE,stub(name),begin=address,end=address)
+ u.hook_add(UC_HOOK_CODE,lambda u,a,n,d:u.emu_stop(),begin=0x80900000,end=0x80900000)
+ u.reg_write(UC_MIPS_REG_SP,0x808ff000)
+ u.reg_write(UC_MIPS_REG_RA,0x80900000)
+ u.reg_write(UC_MIPS_REG_A0,1)
+ u.emu_start(0x804086b0,0x80900004,timeout=30_000_000,count=150_000_000)
+ assert u.reg_read(UC_MIPS_REG_V0) != 0
+ return struct.unpack('>I',u.mem_read(0x40fdb0,4))[0]
+
+
+class Boa:
+ def __init__(self, binary, flash, image, dual=True):
+ self.u = Uc(UC_ARCH_MIPS, UC_MODE_MIPS32 | UC_MODE_BIG_ENDIAN)
+ self.flash, self.image, self.dual = flash, image, dual
+ self.messages, self.lines, self.fds = [], [], {}
+ self.redirect, self.exited, self.next_fd = None, False, 20
+ self.alloc_next = 0x1800000
+ symbols, deps, ph, tags = dynsym(binary)
+ self.u.mem_map(0x400000, 0x400000)
+ for t, o, v, _, fs, ms, _, _ in ph:
+ if t == 1:
+ self.u.mem_write(v, binary[o:o+fs])
+ self.u.mem_map(0x1000000, 0x1000000)
+ self.u.mem_map(0x3000000, 0x1000)
+ self.u.mem_map(0x70000000, 0x100000)
+ # Dynamic imports in the vendor image are pointers to its MIPS stubs.
+ imports = json.loads(args.imports.read_text())['imports']
+ for row in imports:
+ if 'plt' in row and row.get('type') == 'FUNC':
+ self.hook(row['plt'], row['name'])
+ for address, name in [(0x4132b4, 'req_get_cstream_var'),
+ (0x412160, 'req_format_write'), (0x40e6f0, 'send_redirect_perm'),
+ (0x441988, 'page_header'), (0x41e0ec, 'write_line_to_file'),
+ (0x41f66c, 'kill_processes'), (0x40b4d0, 'clear_fwupload_shm')]:
+ self.hook(address, name)
+ self.u.hook_add(UC_HOOK_CODE, lambda u, a, n, d: u.emu_stop(), begin=0x3000000, end=0x3000000)
+ self.request, self.upload = 0x1000000, 0x1100000
+ prefix = b'Content-Disposition: form-data; name="binary"; filename="first-install.bin"\r\n'
+ prefix += b'X-Padding: ' + b'a' * (256-len(prefix)-11-4-42)
+ prefix += b'\r\nContent-Type: application/octet-stream\r\n\r\n'
+ # Keep the uploaded kernel aligned for the original MIPS FirmwareUpgrade.
+ if len(prefix) % 4:
+ prefix = b'X:' + b'a' * ((-len(prefix)-4) % 4) + b'\r\n' + prefix
+ assert len(prefix) % 4 == 0
+ self.body = prefix + image + b'\r\n--end--\r\n'
+ self.u.mem_write(self.upload, self.body)
+ self.put(self.request+0x98, self.upload)
+ self.put(self.request+0x9c, len(self.body))
+ self.offset = len(prefix)
+
+ def hook(self, address, name):
+ self.u.hook_add(UC_HOOK_CODE, lambda u, a, n, d: self.external(name), begin=address, end=address)
+
+ def read(self, p, n): return bytes(self.u.mem_read(p, n))
+ def string(self, p):
+ if not p: return ''
+ b = bytearray()
+ while len(b) < 20000:
+ c = self.read(p+len(b), 1)
+ if c == b'\0': return b.decode('latin1')
+ b += c
+ raise ValueError('unterminated string')
+ def put(self, p, n): self.u.mem_write(p, struct.pack('>I', n & 0xffffffff))
+ def alloc(self, data):
+ p = self.alloc_next
+ self.u.mem_write(p, data+b'\0'); self.alloc_next += (len(data)+16) & ~7
+ return p
+ def external(self, name):
+ u = self.u
+ a, b, c, d = [u.reg_read(r) for r in [UC_MIPS_REG_A0, UC_MIPS_REG_A1, UC_MIPS_REG_A2, UC_MIPS_REG_A3]]
+ result = 0
+ if name == 'memcmp': result = (self.read(a,c) > self.read(b,c)) - (self.read(a,c) < self.read(b,c))
+ elif name == 'strcmp': result = (self.string(a) > self.string(b)) - (self.string(a) < self.string(b))
+ elif name in ('strcpy', 'memcpy', 'memmove'):
+ data = self.string(b).encode('latin1')+b'\0' if name == 'strcpy' else self.read(b,c)
+ u.mem_write(a,data); result = a
+ elif name == 'memset': u.mem_write(a, bytes([b & 255])*c); result = a
+ elif name == 'strlen': result = len(self.string(a))
+ elif name == 'strstr':
+ pos = self.string(a).find(self.string(b)); result = a+pos if pos >= 0 else 0
+ elif name == 'strchr':
+ pos = self.string(a).find(chr(b)); result = a+pos if pos >= 0 else 0
+ elif name == 'req_get_cstream_var': result = self.alloc(b'/upload.htm')
+ elif name == 'req_format_write': self.messages.append(self.string(b)); result = 1
+ elif name == 'send_redirect_perm': self.redirect = self.string(b)
+ elif name == 'sprintf':
+ fmt = self.string(b)
+ # The planner formats decimal offsets, lengths and shm IDs only.
+ if fmt == '%d': text = str(c if c < 2**31 else c-2**32)
+ elif fmt == '%d\n': text = str(c)+'\n'
+ else: text = fmt.replace('%d',str(c),1).replace('%x',format(c,'x'),1)
+ u.mem_write(a,text.encode()+b'\0'); result = len(text)
+ elif name in ('printf','puts','fprintf'): result = 1
+ elif name == 'apmib_get':
+ assert a == 0x514
+ self.put(b, int(self.dual)); result = 1
+ elif name == 'fopen':
+ assert self.string(a) == '/proc/bootbank'
+ result = 9
+ elif name == 'fgets': u.mem_write(a,b'2\0'); result = a
+ elif name in ('fclose','page_header','clear_fwupload_shm','kill_processes','system','sleep','usleep','sync'): pass
+ elif name == 'open':
+ path = self.string(a)
+ assert path in ('/dev/mtdblock0','/dev/mtdblock1','/dev/mtdblock3','/dev/mtdblock4'), path
+ result = self.next_fd; self.next_fd += 1; self.fds[result] = [path,0]
+ elif name == 'lseek': self.fds[a][1] = b; result = b
+ elif name == 'read':
+ path, offset = self.fds[a]
+ base = {'/dev/mtdblock0':0,'/dev/mtdblock1':0x130000,'/dev/mtdblock3':0x400000,'/dev/mtdblock4':0x530000}[path]
+ u.mem_write(b,self.flash[base+offset:base+offset+c]); self.fds[a][1] += c; result = c
+ elif name == 'close': pass
+ elif name == 'write_line_to_file':
+ path, text = self.string(a), self.string(c)
+ if path == '/var/fwd.conf':
+ if b == 1: self.lines = []
+ self.lines.append(text)
+ else: assert path == '/var/fwd.ready', path
+ result = 1
+ elif name == 'exit': self.exited = True; u.emu_stop(); return
+ else: raise RuntimeError('unstubbed external: '+name)
+ u.reg_write(UC_MIPS_REG_V0, result & 0xffffffff)
+ u.reg_write(UC_MIPS_REG_PC, u.reg_read(UC_MIPS_REG_RA))
+
+ def call(self, address, values):
+ self.u.reg_write(UC_MIPS_REG_SP, 0x700ff000)
+ self.u.reg_write(UC_MIPS_REG_RA, 0x3000000)
+ self.u.reg_write(UC_MIPS_REG_T9, address)
+ for r,v in zip([UC_MIPS_REG_A0,UC_MIPS_REG_A1,UC_MIPS_REG_A2,UC_MIPS_REG_A3],values): self.u.reg_write(r,v)
+ self.u.emu_start(address, 0x3000004, timeout=30_000_000, count=100_000_000)
+
+ def validate(self):
+ self.call(0x442f14,[self.request])
+ return self.redirect == '/countDownPage.htm'
+
+ def plan(self):
+ self.call(0x4438f8,[self.upload,len(self.body),0,0x1700000])
+ assert self.exited and len(self.lines) == 8, self.lines
+ plans = []
+ for i in range(0,len(self.lines),4):
+ path, seek, length, offset = self.lines[i:i+4]
+ seek,length,offset = map(int,(seek,length,offset))
+ plans.append({'device':path,'seek':seek,'length':length,'upload_offset':offset})
+ return plans
+
+
+def main():
+ global args
+ p = argparse.ArgumentParser(description=__doc__)
+ p.add_argument('--boa',type=Path,required=True)
+ p.add_argument('--imports',type=Path,required=True)
+ p.add_argument('--reference',type=Path,required=True)
+ p.add_argument('--image',type=Path,required=True)
+ p.add_argument('--output',type=Path,required=True)
+ p.add_argument('--bootloader',type=Path)
+ args = p.parse_args()
+ binary, flash, image = args.boa.read_bytes(), args.reference.read_bytes(), args.image.read_bytes()
+ assert sha(binary) in ('2e4b024ca170468c58ace898807f0364c8b23adc6ef234ebc64f9589a464a65a',
+ '175c66efa68eabda38c8ca6990e824ddcc41dfec0219bc739bce7b8ffe0a587a')
+ inspect(image)
+ boa = Boa(binary,flash,image)
+ assert boa.validate(), boa.messages
+ plans = boa.plan()
+ assert [(p['device'],p['seek'],p['length']) for p in plans] == [
+ ('/dev/mtdblock0',0x10000,0x120000),('/dev/mtdblock1',0,0x2b0000)], plans
+ result = bytearray(flash)
+ for item in plans:
+ base = 0 if item['device'] == '/dev/mtdblock0' else 0x130000
+ n = item['length']; offset = item['upload_offset']
+ result[base+item['seek']:base+item['seek']+n] = boa.read(boa.upload+offset,n)
+ assert result[:0x10000] == flash[:0x10000] and result[0x3e0000:] == flash[0x3e0000:]
+ assert result[0x3c0000:0x3e0000] in (journal_initializer(False),journal_initializer(True))
+ # The compressed kernel and embedded loader stay byte-for-byte intact.
+ original_n=struct.unpack_from('>I',flash,0x41000c)[0]
+ assert result[0x10010:0x10010+original_n] == flash[0x410010:0x410010+original_n]
+ original_decoder=lzma.LZMADecompressor(format=lzma.FORMAT_ALONE)
+ original_kernel=original_decoder.decompress(flash[0x412818:0x410010+original_n])
+ factory_decoder=lzma.LZMADecompressor(format=lzma.FORMAT_ALONE)
+ factory_kernel=factory_decoder.decompress(result[0x12818:0x130000])
+ assert original_decoder.eof and factory_decoder.eof
+ assert original_kernel == factory_kernel
+ active_mark = struct.unpack_from('>I',flash,0x410008)[0]
+ mark = struct.unpack_from('>I',result,0x10008)[0]
+ assert mark == active_mark+1 and mark > active_mark
+ normalized = bytearray(result[0x10000:0x130000]);struct.pack_into('>I',normalized,8,CANONICAL_MARK)
+ for offset in (32,0x120000+16+100,-16):
+ damaged = bytearray(image);damaged[offset] ^= 1
+ assert not Boa(binary,flash,bytes(damaged)).validate(), offset
+ report = {'status':'pass','method':'original MIPS Boa executed in Unicorn 2.1.4; every external operation stubbed',
+ 'boa_sha256':sha(binary),'image_sha256':sha(image),'physical_flash_access':False,
+ 'actual_mtd_driver_tested':False,'factory_boot_tested':False,
+ 'stock_bootbank':2,'dual_firmware':True,'writes':plans,
+ 'kernel_bankmark':hex(mark),'canonical_factory_kernel_sha256':sha(normalized),
+ 'preserved_ranges':[[0,0x10000],[0x3e0000,0x800000]],
+ 'journal_initializer':'auto-v1' if result[0x3d0000:0x3d000f] == b'CKAUTOINIT-V1\r\n' else 'erased',
+ 'damaged_kernel_rootfs_trailer_rejected':True}
+ report['decompressed_kernel_unchanged']=True
+ report['decompressed_kernel_sha256']=sha(factory_kernel)
+ if args.bootloader:
+ loader=args.bootloader.read_bytes()
+ assert boot_checks(loader,result) == 1
+ broken=bytearray(result);broken[0x130100]^=1
+ assert boot_checks(loader,broken) == 2
+ report.update({'bootloader_sha256':sha(loader),
+ 'original_boot_selector_and_checksums_passed':True,
+ 'corrupt_bank1_rootfs_selects_bank2_in_emulator':True})
+ args.output.parent.mkdir(parents=True,exist_ok=True)
+ args.output.write_text(json.dumps(report,indent=2)+'\n')
+ print(json.dumps(report,indent=2))
+
+
+if __name__ == '__main__': main()
diff --git a/reverse/tools/verify_protocol_release.py b/reverse/tools/verify_protocol_release.py
new file mode 100644
index 0000000..ea3a8cb
--- /dev/null
+++ b/reverse/tools/verify_protocol_release.py
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+"""Inspect the actual signed-payload filesystem; never access an outlet."""
+import argparse
+import hashlib
+import json
+import re
+import sys
+from pathlib import Path
+
+ROOT=Path(__file__).resolve().parents[2]
+sys.path.insert(0,str(ROOT/'tools'))
+from fwlib import read_file,file_inventory,rootfs_check
+
+def digest(data):return hashlib.sha256(data).hexdigest()
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__)
+ p.add_argument('--release-dir',type=Path,required=True)
+ p.add_argument('--test-logs',type=Path)
+ p.add_argument('--output',type=Path,required=True)
+ a=p.parse_args()
+ package=(a.release_dir/'matter.ota').read_bytes();root=package[256:]
+ assert package[:8]==b'CKOTA1\r\n' and int.from_bytes(package[20:24],'big')>=10
+ version=int.from_bytes(package[20:24],"big")
+ hap=read_file(root,'bin/homekitserver');original=bytearray(hap)
+ for offset,command in ((0x1ae5b8,b'flash default-sw\0'),(0x1ae5e0,b'homekitserver -c\0')):
+ action=b'/bin/ck-reset' if version>=11 and offset==0x1ae5b8 else b'true'
+ replacement=action.ljust(len(command)-1,b' ')+b'\0'
+ assert original[offset:offset+len(command)]==replacement
+ original[offset:offset+len(command)]=command
+ if version>=11:
+ assert original[0x1b8e4:0x1b8e8]==bytes.fromhex("24040000")
+ original[0x1b8e4:0x1b8e8]=bytes.fromhex("24040001")
+ if version>=13:
+ from homekit_led import restore
+ original=bytearray(restore(original,json.loads(read_file(root,"etc/ck-homekit-led.json"))))
+ else:assert len(hap)==2116412
+ assert digest(original)=='2d50339436759f3d602c150fb4f1a42f0fdf122fc18e9a4f54f6e6b07d7a0c62'
+ inv=file_inventory(root)
+ for lib in ['libgcc_s.so.1','libapmib.so','libpthread.so.0','libdl.so.0','librt.so.0','libm.so.0','libc.so.0','ld-uClibc.so.0']:
+ assert 'lib/'+lib in inv
+ assert 'bin/boa' not in inv and not any(n.startswith('web/') for n in inv)
+ rc=read_file(root,'etc/init.d/rcS');inittab=read_file(root,'etc/inittab')
+ assert inittab.count(b'::respawn:/bin/ck-protocol-start\n')==1
+ for old in (b'\nhomekitserver\n',b'/bin/matter-test-start &',b'\nboa\n'):assert old not in rc
+ sources={'bin/ck-updater':'firmware/matter/artifacts/update/ck-updater',
+ 'bin/ck-updated':'firmware/matter/artifacts/update/ck-updated',
+ 'bin/ck-boot-guard':'firmware/matter/artifacts/update/ck-boot-guard',
+ 'bin/matterd-test':'firmware/matter/artifacts/softap-device-code/matterd-test',
+ 'bin/ck-setupd':'firmware/matter/artifacts/softap-device-code/ck-setupd',
+ 'bin/ck-protocol-start':'firmware/matter/src/setup/ck-protocol-start',
+ 'bin/matter-test-start':'firmware/matter/src/setup/matter-relay-start',
+ 'bin/ck-ota-start':'firmware/matter/src/update/ck-ota-start'}
+ if version>=11:
+ assert inittab.count(b"::respawn:/bin/ck-management-start\n")==1
+ assert read_file(root,"etc/ck-admin-policy")==b"password-v1\n"
+ for n in ("ck-management-start","ck-reset"):sources["bin/"+n]="firmware/matter/src/setup/"+n
+ hashes={}
+ for dest,source in sources.items():
+ data=read_file(root,dest);assert data==(ROOT/source).read_bytes(),dest
+ hashes[dest]=digest(data)
+ report={'status':'pass','version':read_file(root,'etc/ck-version').decode().strip(),
+ 'software_version':int.from_bytes(package[20:24],'big'),'real_outlet':False,
+ 'checks':['exact production binaries and scripts match payload',
+ 'one supervised protocol owner; no direct rcS protocol launch',
+ 'HomeKit original segments restored byte-for-byte; reset patches and LED observer verified',
+ 'original HAP shared libraries retained; unused Boa/router GUI removed',
+ 'version 13: hash-bound LED observer segment and exact reversible patch manifest' if version>=13 else 'legacy HAP layout'],
+ 'rootfs':rootfs_check(root),'ota_sha256':digest(package),
+ 'original_homekit_sha256':digest(original),'homekit_sha256':digest(hap),
+ 'homekit_elf_bytes':len(hap),'production_sha256':hashes,
+ 'limitations':['No physical HomeKit/MFi, RF or iPhone pairing validation',
+ 'HomeKit pauses custom web measurements and kWh accumulation; saved checkpoints remain',
+ 'HomeKit daemon lifecycle tests use a fixture',
+ 'Network VM uses 64 MiB/Linux 4.19 and MIB/import fixtures, not actual 32 MiB hardware',
+ 'No CH341A write, live reset/switch, git push or publication performed']}
+ report['rootfs_free_bytes']=0x290000-report['rootfs']['checksum_extent']
+ if a.test_logs:
+ if version>=11:
+ names=['led-v0.2.11/full-combined.log','led-v0.2.11/deployment.log'] if version>=13 else ['v0.2.10-recovery-update-tests.log','v0.2.10-recovery-deployment-tests.log'] if version>=12 else ['v0.2.9-update-tests.log','v0.2.9-deployment-tests.log','v0.2.9-portal-tests.log','v0.2.9-password-tests.log']
+ count=55 if version>=13 else 50 if version>=12 else 48
+ log=(a.test_logs/names[0]).read_text()
+ assert len(re.findall(r'Ran '+str(count)+r' tests[^\n]*\n\nOK',log))==2
+ deploy=(a.test_logs/names[1]).read_text()
+ assert re.search(r'Ran 13 tests[^\n]*\n\nOK \(skipped=1\)',deploy)
+ report['tests']={'native_storage_ota_http_admin_protocol':count,'mips_storage_ota_http_admin_protocol':count,
+ 'deployment_and_hap_layout_passed':12,'diagnostic_variant_not_shipped_skipped':1}
+ else:
+ names=['v0.2.8-update-tests.log','v0.2.8-deployment-tests.log','v0.2.8-portal-tests.log']
+ log=(a.test_logs/names[0]).read_text()
+ assert len(re.findall(r'Ran 39 tests[^\n]*\n\nOK',log))==2
+ deploy=(a.test_logs/names[1]).read_text();assert re.search(r'Ran 13 tests[^\n]*\n\nOK',deploy)
+ report['tests']={'native_storage_ota_http_protocol':39,'mips_storage_ota_http_protocol':39,'deployment_and_hap_layout':13}
+ report['tests']['test_log_sha256']={name:digest((a.test_logs/name).read_bytes()) for name in names}
+ a.output.write_text(json.dumps(report,ensure_ascii=False,indent=2)+'\n')
+ print(json.dumps({k:report[k] for k in ('status','ota_sha256','rootfs_free_bytes')},indent=2))
+
+if __name__=='__main__':main()
diff --git a/tests/hardware_fallback_init.c b/tests/hardware_fallback_init.c
index ddce6dd..a328726 100644
--- a/tests/hardware_fallback_init.c
+++ b/tests/hardware_fallback_init.c
@@ -16,6 +16,8 @@ int main(void) {
mount("ramfs", "/var", "ramfs", 0, NULL);
mkdir("/var/run", 0700);
mkdir("/var/log", 0700);
+ int pending = open("/var/run/ck-identity-pending", O_WRONLY | O_CREAT, 0600);
+ if (pending >= 0) close(pending);
puts("MCU_ONLY_VM_READY_NO_IDENTITY");
sleep(2);
int phase = 0;
@@ -32,7 +34,7 @@ int main(void) {
_exit(127);
}
int control = open("/dev/ttyS0", O_RDONLY | O_NONBLOCK), status = -1;
- for (unsigned tick = 0; tick < 200; tick++) {
+ for (unsigned tick = 0; tick < 400; tick++) {
if (waitpid(child, &status, WNOHANG) == child) break;
char command[64] = {0};
if (control >= 0 && read(control, command, sizeof(command)-1) > 0 && strstr(command, "stop")) {
diff --git a/tests/network_boot_init.c b/tests/network_boot_init.c
new file mode 100644
index 0000000..25d0b83
--- /dev/null
+++ b/tests/network_boot_init.c
@@ -0,0 +1,32 @@
+/* Offline Malta fixture: real vendor BusyBox PID1 + real DHCP, no MTD/RF. */
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+static int module(const char *path) {
+ int fd=open(path,O_RDONLY); if(fd<0)return -1;
+ int n=lseek(fd,0,SEEK_END);lseek(fd,0,SEEK_SET);
+ void *data=malloc(n);if(!data)return -1;
+ int result=read(fd,data,n)==n && !syscall(SYS_init_module,data,n,"");
+ free(data);close(fd);return result?0:-1;
+}
+int main(void) {
+ mount("proc","/proc","proc",0,NULL);mount("ramfs","/var","ramfs",0,NULL);
+ for(const char **p=(const char*[]){"/var/run","/var/log","/var/lock","/var/lib","/var/lib/ck-state",NULL};*p;p++)mkdir(*p,0700);
+ if(module("/mii.ko")||module("/pcnet32.ko"))return 3;
+ int fd=socket(AF_INET,SOCK_DGRAM,0);struct ifreq r;
+ memset(&r,0,sizeof(r));strcpy(r.ifr_name,"eth0");strcpy(r.ifr_newname,"br0");
+ if(ioctl(fd,SIOCSIFNAME,&r))return 4;
+ memset(&r,0,sizeof(r));strcpy(r.ifr_name,"br0");
+ ioctl(fd,SIOCGIFFLAGS,&r);r.ifr_flags|=IFF_UP;
+ if(ioctl(fd,SIOCSIFFLAGS,&r))return 5;
+ close(fd);setenv("PATH","/bin",1);
+ execl("/bin/busybox","busybox","init",NULL);return 127;
+}
diff --git a/tests/serve_admin_fixture.py b/tests/serve_admin_fixture.py
new file mode 100644
index 0000000..a714e3e
--- /dev/null
+++ b/tests/serve_admin_fixture.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Disposable browser fixture using the real C HTTP service and file-only NOR."""
+import hashlib,json,os,signal,socket,socketserver,struct,subprocess,sys,threading,time
+from pathlib import Path
+from test_updates import Updates
+Updates.setUpClass();fixture=Updates('test_persistence_and_noop_wear');fixture.setUp()
+salt=bytes(range(16));key=hashlib.pbkdf2_hmac('sha256',b'FixtureAdmin42',salt,600000,32)
+record=b'CKAUTH1\n'+(600000).to_bytes(4,'big')+salt+key
+assert fixture.put('admin/credential',record)==0
+assert fixture.lib.ck_energy_save(1234567,0)==0
+(fixture.work/'etc/ck-version').write_text('0.2.11-preview\n')
+initial=os.environ.get('CK_FIXTURE_PROTOCOL','matter');assert initial in ('matter','homekit')
+assert fixture.put('config/protocol',initial.encode())==0
+(fixture.work/'var/run/ck-protocol-active').write_text(initial)
+(fixture.work/'var/run/matter-manual-code').write_text('12345678901')
+fixture.port=18983
+def start_server():return subprocess.Popen([str(fixture.server_binary),'18983','lo'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+server=start_server()
+led=None
+if os.environ.get('CK_FIXTURE_LED')=='1':
+ for path in ['proc/wlan0','var/log']:(fixture.work/path).mkdir(parents=True,exist_ok=True)
+ (fixture.work/'proc/wlan0/gpio_ctrl').write_bytes(b' '*32)
+ (fixture.work/'var/run/ck-setup-state').write_text('state=online\n')
+ led=subprocess.Popen([str(fixture.updater),'--run-led'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+
+class Proxy(socketserver.BaseRequestHandler):
+ def handle(self):
+ remote=socket.create_connection(('127.0.0.1',18983),timeout=5)
+ def transfer(source,dest):
+ try:
+ while True:
+ data=source.recv(65536)
+ if not data:break
+ dest.sendall(data)
+ except OSError:pass
+ try:dest.shutdown(socket.SHUT_WR)
+ except OSError:pass
+ thread=threading.Thread(target=transfer,args=(self.request,remote),daemon=True);thread.start();transfer(remote,self.request);remote.close()
+class TCP(socketserver.ThreadingTCPServer):allow_reuse_address=True;daemon_threads=True
+proxy=TCP((socket.gethostbyname(socket.gethostname()),18983),Proxy)
+threading.Thread(target=proxy.serve_forever,daemon=True).start()
+try:
+ print('ADMIN_FIXTURE_READY port=18983; synthetic credentials and NOR only',flush=True)
+ while True:
+ pending=fixture.work/'var/run/ck-protocol-pending'
+ if pending.exists():
+ mode=pending.read_text()
+ if mode in ('matter','homekit'):
+ # Simulate only the RAM/service restart; no HAP, network or real reboot.
+ server.terminate();server.wait(timeout=5)
+ (fixture.work/'var/run/ck-protocol-active').write_text(mode)
+ pending.unlink();(fixture.work/'var/run/ck-matter-request.lock').rmdir()
+ server=start_server()
+ if led:
+ now=int(time.monotonic()*1000);mode=(fixture.work/'var/run/ck-protocol-active').read_text()
+ (fixture.work/('var/run/ck-led-'+mode+'.bin')).write_bytes(b'CKLEDHW1'+struct.pack('>QQQQIIII',now,now,now,0,6000,31,now//5000,0))
+ if (fixture.work/'var/run/ck-protocol-active').read_text()=='matter':fixture.meter_snapshot()
+ else:(fixture.work/'var/run/ck-meter.bin').unlink(missing_ok=True)
+ (fixture.work/'var/run/ck-matter-state.json').write_text(json.dumps({'updated_s':int(time.monotonic()),'fabrics':1,'window_open':False,'result':'idle','request_id':''},separators=(',',':')))
+ time.sleep(1)
+finally:
+ if led:led.terminate();led.wait()
+ proxy.shutdown();server.terminate();server.wait();fixture.tearDown();Updates.tearDownClass()
diff --git a/tests/test_boot_guard.py b/tests/test_boot_guard.py
new file mode 100644
index 0000000..6fe5e12
--- /dev/null
+++ b/tests/test_boot_guard.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""Fixed-job watchdog faults in regular-file fixtures; no RF/MTD access."""
+import os
+from pathlib import Path
+import shlex
+import signal
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+
+if sys.platform.startswith('linux'):
+ import resource
+ resource.setrlimit(resource.RLIMIT_CORE,(0,0))
+
+ROOT=Path(__file__).resolve().parents[1]
+
+
+@unittest.skipUnless(sys.platform.startswith('linux'),'Linux prctl/process groups')
+class BootGuard(unittest.TestCase):
+ @classmethod
+ def setUpClass(cls):
+ cls.build=tempfile.TemporaryDirectory(prefix='ck-boot-guard-build-')
+ cls.binary=Path(os.environ.get('CK_BOOT_BIN',str(Path(cls.build.name)/'guard')))
+ cls.runner=shlex.split(os.environ.get('CK_BOOT_RUNNER',''))
+ if not cls.runner:
+ subprocess.run(['cc','-DCK_TESTING','-O2','-Wall','-Wextra','-Werror',
+ str(ROOT/'firmware/matter/src/setup/boot_guard.c'),'-o',str(cls.binary)],check=True)
+
+ @classmethod
+ def tearDownClass(cls):cls.build.cleanup()
+
+ def setUp(self):
+ self.temp=tempfile.TemporaryDirectory(prefix='ck-boot-guard-test-')
+ self.root=Path(self.temp.name)
+ for folder in ['bin','var/run','var/log','var/lib/ck-state']:(self.root/folder).mkdir(parents=True)
+ self.env={**os.environ,'CK_BOOT_TEST_ROOT':str(self.root),'CK_BOOT_TEST_SECONDS':'1'}
+
+ def tearDown(self):self.temp.cleanup()
+
+ def stub(self,name,body):
+ p=self.root/'bin'/name;p.write_text('#!/bin/sh\n'+body+'\n');p.chmod(0o700)
+
+ def command(self,mode):return [*self.runner,str(self.binary),mode]
+
+ def run_guard(self,mode,**kwargs):
+ return subprocess.run(self.command(mode),capture_output=True,env=self.env,timeout=6,**kwargs)
+
+ def test_fixed_modes_and_child_exit(self):
+ self.stub('ck-wificfg','echo configured=1; exit 0')
+ self.assertEqual(self.run_guard('--mib').stdout,b'configured=1\n')
+ self.stub('matterd-test','test "$1" = --init-identity && test "$2" = wlan0; exit 7')
+ self.assertEqual(self.run_guard('--identity').returncode,7)
+ self.assertEqual(self.run_guard('/bin/sh').returncode,2)
+
+ def test_crash_is_reported(self):
+ self.stub('ck-updater','kill -SEGV $$')
+ self.assertEqual(self.run_guard('--import').returncode,139)
+
+ def test_hanging_import_is_killed_and_can_retry(self):
+ self.stub('ck-updater','exec /bin/sleep 30')
+ result=self.run_guard('--import')
+ self.assertEqual(result.returncode,124)
+ self.assertIn(b'timeout',result.stderr)
+ self.stub('ck-updater','exit 0')
+ self.assertEqual(self.run_guard('--import').returncode,0)
+
+ def test_setup_requires_fresh_heartbeat(self):
+ self.stub('ck-setupd','exec /bin/sleep 30')
+ self.assertEqual(self.run_guard('--setup').returncode,124)
+ self.env['CK_BOOT_TEST_SECONDS']='2'
+ heartbeat=shlex.quote(str(self.root/'var/run/ck-setup-heartbeat'))
+ self.stub('ck-setupd','while :; do read up rest < /proc/uptime; echo "${up%%.*}" > '+heartbeat+'; sleep .1; done')
+ with tempfile.TemporaryFile() as output:
+ p=subprocess.Popen(self.command('--setup'),env=self.env,stdout=output,stderr=output)
+ try:
+ time.sleep(3)
+ self.assertIsNone(p.poll())
+ p.terminate();self.assertEqual(p.wait(timeout=4),143)
+ finally:
+ if p.poll() is None:p.kill();p.wait()
+
+ def test_dhcp_log_is_capped_and_retains_tail(self):
+ data=bytes(range(256))*100
+ self.assertEqual(self.run_guard('--dhcp-log',input=data).returncode,0)
+ self.assertEqual((self.root/'var/log/ck-dhcp.log').read_bytes(),data[-8192:])
+
+ def test_partial_heartbeat_keeps_last_valid_sample(self):
+ self.env['CK_BOOT_TEST_SECONDS']='3'
+ heartbeat=shlex.quote(str(self.root/'var/run/ck-setup-heartbeat'))
+ self.stub('ck-setupd','i=0; while [ "$i" -lt 20 ]; do '
+ 'read up rest < /proc/uptime; echo "${up%%.*}" > '+heartbeat+'; '
+ 'sleep .1; i=$((i+1)); done; : > '+heartbeat+'; exec sleep 30')
+ with tempfile.TemporaryFile() as output:
+ p=subprocess.Popen(self.command('--setup'),env=self.env,stdout=output,stderr=output)
+ try:
+ time.sleep(3.5)
+ self.assertIsNone(p.poll())
+ p.terminate();self.assertEqual(p.wait(timeout=4),143)
+ finally:
+ if p.poll() is None:p.kill();p.wait()
+
+
+if __name__=='__main__':unittest.main(verbosity=2)
diff --git a/tests/test_deployment.py b/tests/test_deployment.py
index 4d064e9..85afc74 100644
--- a/tests/test_deployment.py
+++ b/tests/test_deployment.py
@@ -76,6 +76,37 @@ def test_protected_bytes_and_stable_keys(self):
self.assertEqual((self.profile / "diag.key").stat().st_mode & 0o777, 0o600)
self.assertEqual(self.output.stat().st_mode & 0o777, 0o600)
+ def test_homekit_patch_preserves_original_elf_and_one_boot_owner(self):
+ root=self.release.read_bytes()[fw.START:fw.END]
+ meta=fw.read_file(root,'etc/ck-update.meta')
+ if struct.unpack('>III',meta)[2]<10:self.skipTest('protocol selection requires software version 10')
+ hap=fw.read_file(root,'bin/homekitserver')
+ original=bytearray(hap)
+ for offset,command in ((0x1ae5b8,b'flash default-sw\0'),(0x1ae5e0,b'homekitserver -c\0')):
+ action=b'/bin/ck-reset' if struct.unpack('>III',meta)[2]>=11 and command.startswith(b'flash') else b'true'
+ replacement=action.ljust(len(command)-1,b' ')+b'\0'
+ self.assertEqual(original[offset:offset+len(command)],replacement)
+ original[offset:offset+len(command)]=command
+ if struct.unpack('>III',meta)[2]>=11:
+ self.assertEqual(original[0x1b8e4:0x1b8e8],bytes.fromhex('24040000'))
+ original[0x1b8e4:0x1b8e8]=bytes.fromhex('24040001')
+ if struct.unpack('>III',meta)[2]>=13:
+ from homekit_led import restore
+ record=json.loads(fw.read_file(root,'etc/ck-homekit-led.json'))
+ original=restore(original,record)
+ self.assertEqual(fw.read_file(root,'etc/inittab').count(b'::respawn:/bin/ck-led-start\n'),1)
+ self.assertEqual(hashlib.sha256(original).hexdigest(),'2d50339436759f3d602c150fb4f1a42f0fdf122fc18e9a4f54f6e6b07d7a0c62')
+ inventory=fw.file_inventory(root)
+ self.assertNotIn('bin/boa',inventory)
+ self.assertFalse(any(n.startswith('web/') for n in inventory))
+ for name in ['libgcc_s.so.1','libapmib.so','libpthread.so.0','libdl.so.0','librt.so.0','libm.so.0','libc.so.0','ld-uClibc.so.0']:
+ self.assertIn('lib/'+name,inventory)
+ inittab=fw.read_file(root,'etc/inittab')
+ self.assertEqual(inittab.count(b'::respawn:/bin/ck-protocol-start\n'),1)
+ rc=fw.read_file(root,'etc/init.d/rcS')
+ for old in [b'\nhomekitserver\n',b'/bin/matter-test-start &',b'\nboa\n']:
+ self.assertNotIn(old,rc)
+
def test_different_devices_get_different_keys(self):
self.prepare()
other = bytearray(self.before)
@@ -99,6 +130,7 @@ def test_lost_profile_key_not_silently_rotated(self):
def test_diagnostic_profile_uses_private_wpa2_credentials(self):
release = Path(os.environ["CK_RELEASE_DIR"])
image = release / "exec-test-8m-region.bin"
+ if not image.exists():self.skipTest("本版只交付 HomeKit／Matter 韌體")
meta = json.loads((release / "exec-test-8m-region.json").read_text())
meta["compatibility"] = fw.compatibility(self.before)
manifest = self.work / "exec.json"
diff --git a/tests/test_factory_host_compat.py b/tests/test_factory_host_compat.py
new file mode 100644
index 0000000..b8a6830
--- /dev/null
+++ b/tests/test_factory_host_compat.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Strict host recovery checks for the known Boa kernel wrapper; no hardware."""
+import argparse,json,struct,sys
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'tools'))
+from fwlib import START,compatible,compatibility,image_checks,sha
+from factory_image import factory_kernel,identities
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__)
+ p.add_argument('--reference',type=Path,required=True)
+ p.add_argument('--output',type=Path,required=True)
+ a=p.parse_args();legacy=a.reference.read_bytes()
+ expected=json.loads((ROOT/'third_party/platform.json').read_text());compatible(legacy,expected)
+ wrapped=bytearray(legacy);kernel=bytearray(factory_kernel(legacy,expected));struct.pack_into('>I',kernel,8,0x8000004d)
+ wrapped[0x10000:START]=kernel
+ assert compatibility(wrapped)['bank1_kernel_sha256']==identities()['FACTORY']
+ accepted=0;rejected=0
+ for mark in [0x8000004d,0x80000050,0xfffffff0]:
+ changed=bytearray(wrapped);struct.pack_into('>I',changed,0x10008,mark)
+ before=bytes(changed);compatible(changed,expected);assert changed==before;accepted+=1
+ for offset in [0x10004,0x1000c,0x10010,0x120000,0x12ffff,0x410010,0x530100]:
+ changed=bytearray(wrapped);changed[offset]^=1
+ before=bytes(changed)
+ try:compatible(changed,expected)
+ except ValueError:rejected+=1
+ else:raise AssertionError('accepted a modified executable/header/padding')
+ assert changed==before
+ for mark in [0,0x10000,0x80000001]:
+ changed=bytearray(wrapped);struct.pack_into('>I',changed,0x10008,mark)
+ try:compatible(changed,expected)
+ except ValueError:rejected+=1
+ else:raise AssertionError('accepted an invalid boot mark')
+ # A malicious kernel with a freshly repaired checksum must still fail hash matching.
+ changed=bytearray(wrapped);changed[0x10080]^=1;changed[START-2:START]=b'\0\0'
+ total=sum(x[0] for x in struct.iter_unpack('>H',changed[0x10010:START]))
+ struct.pack_into('>H',changed,START-2,(-total)&65535);image_checks(changed)
+ try:compatible(changed,expected)
+ except ValueError:rejected+=1
+ else:raise AssertionError('accepted modified code with a valid checksum')
+ report={'status':'pass','physical_device_access':False,'accepted_known_wrapper_marks':accepted,
+ 'rejected_code_header_padding_bank2_or_invalid_mark':rejected,
+ 'legacy_kernel_sha256':identities()['LEGACY'],'factory_kernel_sha256':identities()['FACTORY'],
+ 'input_preserved':True,'checks':['same strict kernel alternative as production OTA verifier','only bank mark normalized; full code/padding/checksum hashed','Bank 2 identity retained','mutated code rejected even with repaired checksum']}
+ a.output.write_text(json.dumps(report,indent=2)+'\n');print(json.dumps(report,indent=2))
+if __name__=='__main__':main()
diff --git a/tests/test_factory_upgrade.py b/tests/test_factory_upgrade.py
new file mode 100644
index 0000000..0769997
--- /dev/null
+++ b/tests/test_factory_upgrade.py
@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Test a private factory image -> signed OTA using the actual MIPS updater.
+
+Only regular files inside a temporary Docker fixture are written. The next
+version is a synthetic test package, signed with a fresh throwaway key.
+"""
+import argparse
+import json
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives import serialization
+
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'tools'))
+from factory_image import inspect, CANONICAL_MARK, KERNEL_SIZE
+from fwlib import read_file, sha, START, END, file_inventory
+
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__)
+ p.add_argument('--image',type=Path,required=True)
+ p.add_argument('--reference',type=Path,required=True)
+ p.add_argument('--release-dir',type=Path,required=True)
+ p.add_argument('--output',type=Path,required=True)
+ a=p.parse_args()
+ image=a.image.read_bytes();root=inspect(image);reference=a.reference.read_bytes()
+ flash=bytearray(reference)
+ kernel=bytearray(image[:KERNEL_SIZE]);struct.pack_into('>I',kernel,8,CANONICAL_MARK)
+ flash[0x10000:START]=kernel;flash[START:0x3e0000]=image[KERNEL_SIZE+16:-16]
+ next_package=bytearray((a.release_dir/'matter.ota').read_bytes())
+ with tempfile.TemporaryDirectory(prefix='ck-factory-ota-') as name:
+ work=Path(name);os.chmod(work,0o700)
+ for path in ['etc','var/lock','var/lib/ck-state','var/run/ck-ota']:(work/path).mkdir(parents=True,exist_ok=True)
+ inventory=file_inventory(root)
+ public_image='etc/matter-device.key' not in inventory
+ paths=['etc/ck-update.meta']+[path for path in ['etc/matter-device.key','etc/matter-diag.key','etc/ck-identity-policy'] if path in inventory]
+ for path in paths:
+ (work/path).write_bytes(read_file(root,path));(work/path).chmod(0o600)
+ # Test identity and trust are local; the production signing key is never read.
+ key=Ed25519PrivateKey.generate()
+ public=key.public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
+ (work/'etc/ck-update.pub').write_bytes(public)
+ next_version=struct.unpack_from('>I',next_package,20)[0]+1
+ struct.pack_into('>I',next_package,20,next_version)
+ next_package[128:160]=public;next_package[192:256]=key.sign(bytes(next_package[:192]))
+ (work/'next.ota').write_bytes(next_package)
+ (work/'seed.bin').write_bytes(os.urandom(32))
+ target=work/'flash.bin';target.write_bytes(flash);target.chmod(0o600)
+ prefix=['docker','run','--rm','--network','none','-e','CK_TEST_ROOT=/fixture',
+ '-e','CK_TEST_SEED_FILE=/fixture/seed.bin',
+ '-e','CK_FLASH_FILE=/fixture/flash.bin','-v',str(work)+':/fixture',
+ '-v',str(ROOT)+':/repo:ro','incipio-public-build:v0.1.0-preview',
+ 'qemu-mips','/repo/firmware/matter/artifacts/update-test/ck-updater']
+ def run(*args,success=True):
+ cp=subprocess.run(prefix+list(args),capture_output=True,timeout=30)
+ assert (cp.returncode==0)==success,(args,cp.returncode,cp.stderr[-500:])
+ run('--import');run('--boot');run('--confirm');run('--verify','/fixture/next.ota')
+ if public_image:
+ assert (work/'var/run/ck-first-setup').exists()
+ run('--onboarded');run('--import')
+ assert not (work/'var/run/ck-first-setup').exists()
+ (work/'seed.bin').unlink()
+ def onboarding():
+ command=['docker','run','--rm','--mac-address','02:11:22:33:44:55',
+ '-v',str(work/'etc/ck-update.meta')+':/etc/ck-update.meta:ro',
+ '-v',str(work/'var/lib/ck-state')+':/var/lib/ck-state:ro',
+ '-v',str(work/'var/run')+':/var/run',
+ '-v',str(ROOT)+':/repo:ro','incipio-public-build:v0.1.0-preview',
+ 'qemu-mips','/repo/firmware/matter/artifacts/softap-device-code/matterd-test',
+ '--init-identity','eth0']
+ subprocess.run(command,capture_output=True,check=True,timeout=30)
+ return {name:(work/'var/run'/name).read_bytes() for name in ['matter-device-identity','matter-manual-code','matter-qr.svg']}
+ codes=onboarding()
+ assert len(codes['matter-manual-code'])==11 and b'I',changed,0x10008,mark);target.write_bytes(changed)
+ run('--verify','/fixture/next.ota')
+ for offset in (0x10010,0x120000,0x12ffff,0x410010,0x530100):
+ changed=bytearray(first_state);changed[offset]^=1;target.write_bytes(changed)
+ run('--verify','/fixture/next.ota',success=False)
+ assert target.read_bytes()==changed
+ target.write_bytes(first_state)
+ run('--stage','/fixture/next.ota');run('--simulate')
+ after=target.read_bytes()
+ assert after[START:END]==bytes(next_package[256:])
+ assert after[:START]==first_state[:START] and after[END:]==first_state[END:]
+ for path,data in state_files.items():assert (work/'var/lib/ck-state'/path).read_bytes()==data
+ run('--import');assert onboarding()==codes
+ if not public_image:
+ for name,path in [('device.key','etc/matter-device.key'),('diag.key','etc/matter-diag.key')]:
+ assert (work/'var/lib/ck-state'/name).read_bytes()==read_file(root,path)
+ report={'status':'pass','environment':'actual MIPS test updater under qemu-user; temporary regular-file NOR fixture',
+ 'image_sha256':sha(image),'updater_sha256':sha((ROOT/'firmware/matter/artifacts/update-test/ck-updater').read_bytes()),
+ 'checks':['first import into erased journal','boot and version confirmation',
+ 'signed next-version OTA accepted on factory kernel','vendor boot-mark changes accepted',
+ 'changed code/padding/Bank 2 rejected without writes','OTA rootfs write/readback',
+ 'persistent identity and trust preserved across OTA','all ranges outside OTA rootfs preserved'],
+ 'public_image_without_preset_keys':public_image,
+ 'actual_mips_manual_and_qr_stable_across_reboot_and_ota':True,
+ 'physical_device_access':False,'factory_boot_tested':False}
+ a.output.write_text(json.dumps(report,indent=2)+'\n');print(json.dumps(report,indent=2))
+
+
+if __name__=='__main__':main()
diff --git a/tests/test_hardware_fallback.py b/tests/test_hardware_fallback.py
index 6cb23df..c9a0959 100644
--- a/tests/test_hardware_fallback.py
+++ b/tests/test_hardware_fallback.py
@@ -20,6 +20,7 @@ def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('--deps', type=Path, required=True)
parser.add_argument('--toolchains', type=Path, required=True)
+ parser.add_argument('--memory', type=int, choices=(32,64), default=64, help='Linux 4.19 Malta fixture needs 64 MiB; daemon remains capped at 8 MiB')
args = parser.parse_args()
binary = ROOT / 'firmware/matter/artifacts/softap-device-code/matterd-test'
with tempfile.TemporaryDirectory(prefix='ck-mcu-only-vm-') as name:
@@ -59,7 +60,7 @@ def entry(path, data=b'', mode=stat.S_IFREG | 0o755, device=(0, 0)):
'-p', '127.0.0.1:15551:15551', '-v', str(directory) + ':/fixture:ro',
'-v', str(args.deps.resolve()) + ':/deps:ro',
'incipio-public-build:v0.1.0-preview', 'qemu-system-mips',
- '-M', 'malta', '-cpu', '24Kc', '-m', '32', '-vga', 'none', '-display', 'none',
+ '-M', 'malta', '-cpu', '24Kc', '-m', str(args.memory), '-vga', 'none', '-display', 'none',
'-monitor', 'none', '-no-reboot', '-serial', 'stdio',
'-serial', 'tcp:0.0.0.0:15551,server=on,wait=off',
'-kernel', '/deps/downloads/vmlinux-4.19.0-21-4kc-malta',
@@ -86,6 +87,7 @@ def wait_for(predicate, start=0, timeout=20):
worker.start()
for phase in range(2):
wait_for(lambda text: 'MCU_VM_PHASE=' + str(phase) in text)
+ phase_started=time.monotonic()
text = console.read_text(errors='replace')
start = text.index('MCU_VM_PHASE=' + str(phase))
wait_for(lambda text: 'cold_off_confirmed=1' in text, start=start)
@@ -97,6 +99,14 @@ def wait_for(predicate, start=0, timeout=20):
mcu.event(on)
expected = 'relay_known=1 relay_on=' + str(int(on))
wait_for(lambda text: expected in text, start=at)
+ if phase == 0:
+ while time.monotonic()-phase_started < 62:time.sleep(.1)
+ self_start=console.stat().st_size
+ mcu.event(True)
+ wait_for(lambda text:'relay_known=1 relay_on=1' in text,start=self_start)
+ self_start=console.stat().st_size
+ mcu.event(False)
+ wait_for(lambda text:'relay_known=1 relay_on=0' in text,start=self_start)
process.stdin.write(b'stop\n')
process.stdin.flush()
wait_for(lambda text: 'MCU_VM_PHASE_' + str(phase) + '_WAIT=0' in text)
@@ -105,9 +115,10 @@ def wait_for(predicate, start=0, timeout=20):
print(json.dumps({'status': 'pass', 'binary_sha256': hashlib.sha256(binary.read_bytes()).hexdigest(),
'identity_missing': True, 'cold_off_confirmed': True,
'startup_identity_wait_and_mcu_only_mode': True,
- 'simulated_button_state_changes': 8, 'continued_mcu_polling': True,
+ 'simulated_button_state_changes': 10, 'continued_mcu_polling': True,
+ 'identity_pending_over_60_seconds_keeps_buttons_active': True,
'flash_devices_present': False, 'virtual_nic_present': False,
- 'original_hardware_test': False, 'address_space_limit': 8*1024*1024}))
+ 'original_hardware_test': False, 'vm_memory_mib': args.memory, 'address_space_limit': 8*1024*1024}))
finally:
mcu.done = True
subprocess.run(['docker', 'stop', '-t', '1', 'incipio-mcu-only-vm'],
diff --git a/tests/test_homekit_factory.py b/tests/test_homekit_factory.py
new file mode 100644
index 0000000..a1a9dd9
--- /dev/null
+++ b/tests/test_homekit_factory.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Run patched stock HAP reset in qemu-user, with synthetic MIB/NOR only."""
+import argparse,hashlib,json,os,subprocess,sys,tempfile
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[1]
+sys.path.insert(0,str(ROOT/'tools'))
+from fwlib import read_file
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__)
+ p.add_argument('--toolchains',type=Path,required=True);p.add_argument('--deps',type=Path,required=True)
+ p.add_argument('--output',type=Path,required=True);p.add_argument('--release-dir',type=Path);a=p.parse_args()
+ rootfs=(ROOT/'artifacts/update-base/matter-8m-region.bin').read_bytes()[0x130000:0x3c0000]
+ # The pinned public template stores the vendor rootfs in Bank 1.
+ original=read_file(rootfs,'bin/homekitserver')
+ assert hashlib.sha256(original).hexdigest()=='2d50339436759f3d602c150fb4f1a42f0fdf122fc18e9a4f54f6e6b07d7a0c62'
+ patched=bytearray(original)
+ for off,old,new in [(0x1ae5b8,b'flash default-sw\0',b'/bin/ck-reset'),(0x1ae5e0,b'homekitserver -c\0',b'true')]:
+ assert patched[off:off+len(old)]==old;patched[off:off+len(old)]=new.ljust(len(old)-1,b' ')+b'\0'
+ assert patched[0x1b8e4:0x1b8e8]==bytes.fromhex('24040001');patched[0x1b8e4:0x1b8e8]=bytes.fromhex('24040000')
+ if a.release_dir:
+ package=(a.release_dir/'matter.ota').read_bytes();patched=read_file(package[256:],'bin/homekitserver')
+ with tempfile.TemporaryDirectory(prefix='ck-hap-reset-') as td:
+ fixture=Path(td);r=fixture/'root'
+ for name in ['lib','bin','dev','var/run','tmp']: (r/name).mkdir(parents=True,exist_ok=True)
+ for name in ['libgcc_s.so.1','libpthread.so.0','libdl.so.0','librt.so.0','libm.so.0','libc.so.0','ld-uClibc.so.0']:
+ (r/'lib'/name).write_bytes(read_file(rootfs,'lib/'+name))
+ (r/'bin/homekitserver').write_bytes(patched);(r/'bin/homekitserver').chmod(0o755)
+ before=bytes((i*31+7)%256 for i in range(0x20000));flash=r/'dev/mtdblock2';flash.write_bytes(before)
+ # Any MIB write or default-reset call exits with 89: the CLI patch must avoid it.
+ (fixture/'mib.c').write_text('''
+static void forbidden(void){register long n __asm__("$2")=4001;register long v __asm__("$4")=89;__asm__ volatile("syscall" : "+r"(n):"r"(v):"memory");for(;;){}}
+int apmib_init(void){return 1;}
+int apmib_get(int id,void *out){if(id==23){unsigned char *p=out;for(int i=0;i<6;i++)p[i]=(unsigned char)(i+16);}else *(int *)out=id==688?1:0;return 1;}
+int apmib_set(int id,void *p){forbidden();return 0;}
+int apmib_update(int x){forbidden();return 0;}
+int apmib_updateDef(void){forbidden();return 0;}
+''')
+ docker=['docker','run','--rm','--network','none','-v',str(fixture)+':/fixture','-v',str(a.toolchains.resolve())+':/work/toolchains:ro','-v',str(a.deps.resolve())+':/work/deps:ro','incipio-public-build:v0.1.0-preview']
+ subprocess.run([*docker,'/work/toolchains/uclibc/bin/mips-linux-uclibc-gcc','-shared','-nostdlib','-Os','-fPIC','-mno-llsc','-Wl,--hash-style=sysv','-Wl,-soname,libapmib.so','/fixture/mib.c','-o','/fixture/root/lib/libapmib.so'],check=True)
+ result=subprocess.run([*docker,'qemu-mips','-L','/fixture/root','/fixture/root/bin/homekitserver','-c'],capture_output=True,timeout=15)
+ assert result.returncode==0,('HAP reset failed',result.returncode,result.stderr[-1000:])
+ after=flash.read_bytes();assert len(after)==len(before)
+ assert after[:4]==b'PHRX' and after[4:0xa5d]==b'\0'*(0xa5d-4),after[:20].hex()
+ assert after[0xa5d:]==before[0xa5d:],'factory/calibration tail changed'
+ report={'status':'pass','real_outlet':False,'environment':'original MIPS HAP ELF and vendor uClibc under qemu-user; synthetic apmib and regular NOR file; no RF/MFi/hardware',
+ 'checks':['patched stock -c resets HAP pairing header and entire pairing area','MIB set/update/default calls forbidden; none executed','all bytes after 0xa5d, including factory PIN/calibration tail, unchanged'],
+ 'original_sha256':hashlib.sha256(original).hexdigest(),'patched_sha256':hashlib.sha256(patched).hexdigest(),'length':len(patched),'changed_bytes':sum(x!=y for x,y in zip(before,after))}
+ a.output.write_text(json.dumps(report,indent=2)+'\n');print(json.dumps(report,indent=2))
+if __name__=='__main__':main()
diff --git a/tests/test_homekit_led.py b/tests/test_homekit_led.py
new file mode 100644
index 0000000..ea17675
--- /dev/null
+++ b/tests/test_homekit_led.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Run the exact HAP observer under qemu, without UART, GPIO or physical NOR."""
+import argparse,hashlib,json,struct,subprocess,sys,tempfile
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[1];sys.path.insert(0,str(ROOT/'tools'))
+from fwlib import read_file
+from homekit_led import build_payload,patch,restore,ORIGINAL_SHA
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__);p.add_argument('--output',type=Path,required=True);a=p.parse_args()
+ base=(ROOT/'artifacts/update-base/matter-8m-region.bin').read_bytes()[0x130000:0x3c0000];original=read_file(base,'bin/homekitserver')
+ assert hashlib.sha256(original).hexdigest()==ORIGINAL_SHA
+ with tempfile.TemporaryDirectory(prefix='ck-hap-led-') as td:
+ t=Path(td);r=t/'root'
+ for name in ['lib','bin','tmp','var/run']:(r/name).mkdir(parents=True,exist_ok=True)
+ for name in ['libapmib.so','libgcc_s.so.1','libpthread.so.0','libdl.so.0','librt.so.0','libm.so.0','libc.so.0','ld-uClibc.so.0']:(r/'lib'/name).write_bytes(read_file(base,'lib/'+name))
+ payload,symbols=build_payload(t/'build',test=True);patched,record=patch(original,payload,symbols,test=True)
+ assert restore(patched,record)==original
+ (r/'bin/homekitserver').write_bytes(patched);(r/'bin/homekitserver').chmod(0o755)
+ (r/'tmp/ck-led-test-input').write_bytes(bytes.fromhex('fe313156ff060055'))
+ # Run qemu inside an isolated chroot: both rename paths use actual RAM
+ # fixture files, with no qemu prefix rewriting or host device access.
+ for path in ['ck-led-homekit.bin','ck-led-homekit.bin.tmp','ck-led-homekit-identify','ck-led-homekit-identify.tmp']:(r/'var/run'/path).write_bytes(b'')
+ driver="""
+import os,pathlib,re,shutil,subprocess
+root=pathlib.Path('/fixture/root')
+paths=['/usr/bin/qemu-mips']+re.findall(r'/[^ ()\\n]+',subprocess.check_output(['ldd','/usr/bin/qemu-mips'],text=True))
+for name in paths:
+ dest=root/name.lstrip('/');dest.parent.mkdir(parents=True,exist_ok=True);shutil.copy2(name,dest)
+os.execvp('chroot',['chroot',str(root),'/usr/bin/qemu-mips','-strace','/bin/homekitserver'])
+"""
+ run=subprocess.run(['docker','run','--rm','--network','none','-v',str(t)+':/fixture','incipio-public-build:v0.1.0-preview','python3','-c',driver],capture_output=True,timeout=15)
+ if run.returncode:a.output.with_suffix('.trace.log').write_bytes(run.stderr)
+ assert run.returncode==0,(run.returncode,run.stdout.decode(errors='replace'),run.stderr.decode(errors='replace')[-3000:])
+ b=(r/'var/run/ck-led-homekit.bin').read_bytes();assert len(b)==56 and b[:8]==b'CKLEDHW1'
+ now,relay,power,identify,mw,flags,seq,reserved=struct.unpack('>QQQQIIII',b[8:]);assert relay>0 and power>=relay and now>=power and mw==6000 and flags&7==7 and seq==1 and reserved==0
+ until=int.from_bytes((r/'var/run/ck-led-homekit-identify').read_bytes(),'big');assert 14900<=until-now<=15500
+ report={'status':'pass','real_outlet':False,'original_sha256':ORIGINAL_SHA,'test_payload_sha256':hashlib.sha256(payload).hexdigest(),'checks':['original libc read bridge including lazy GP binding','confirmed relay response observed','power response observed and fresh timestamps published','bounded identify deadline and no GPIO writes','patch restoration exactly recovers original ELF'],'limitations':['qemu-user does not validate physical MCU timing, MFi or LED polarity']}
+ a.output.parent.mkdir(parents=True,exist_ok=True);a.output.write_text(json.dumps(report,indent=2)+'\n');print(json.dumps(report,indent=2))
+if __name__=='__main__':main()
diff --git a/tests/test_matter_reset_vm.py b/tests/test_matter_reset_vm.py
new file mode 100644
index 0000000..a83b21d
--- /dev/null
+++ b/tests/test_matter_reset_vm.py
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+"""Actual SDK/MIPS commissioning reset with a serial MCU and NOR file fixture."""
+import hashlib
+import hmac
+import http.client
+import json
+import os
+from pathlib import Path
+import re
+import socket
+import struct
+import subprocess
+import sys
+import threading
+import time
+
+ROOT=Path(__file__).resolve().parents[1]
+WORK=ROOT/'firmware/matter'
+sys.path.insert(0,str(WORK/'tools'))
+sys.path.insert(0,str(ROOT/'tools'))
+from test_device_vm import Mcu
+from setup_control import control
+
+def main():
+ name='incipio-matter-reset-vm'
+ deps=Path(os.environ['CK_SDK_DIR'])
+ private=ROOT/'private'/('matter-reset-vm-'+str(int(time.time())))
+ private.mkdir(mode=0o700)
+ console=private/'console.txt'
+ binary=Path(json.loads((WORK/'evidence/chip-tool-macos/build.json').read_text())['binary'])
+ pin=struct.unpack_from('>I',(WORK/'private/device-test-VM/matter-device-identity').read_bytes(),12)[0]
+ report={'status':'failed','environment':'actual MIPS SDK, 64 MiB Malta VM, daemon limited to 8 MiB AS, serial MCU and NOR file fixtures',
+ 'real_outlet':False,'binary_sha256':hashlib.sha256((WORK/'artifacts/update-matter-test/matterd-test').read_bytes()).hexdigest(),'checks':[]}
+ args=['docker','run','-i','--rm','--name',name,'-p','127.0.0.1:55640:55640/udp',
+ '-p','127.0.0.1:15551:15551','-p','127.0.0.1:18184:18184','-p','127.0.0.1:18185:18185',
+ '-p','127.0.0.1:18186:18186','-v',str(WORK)+':/work:ro','-v',str(deps)+':/work/deps:ro',
+ 'incipio-public-build:v0.1.0-preview','qemu-system-mips','-M','malta','-cpu','24Kc','-m','64',
+ '-vga','none','-display','none','-monitor','none','-no-reboot','-serial','stdio',
+ '-serial','tcp:0.0.0.0:15551,server=on,wait=off','-kernel','/work/deps/downloads/vmlinux-4.19.0-21-4kc-malta',
+ '-initrd','/work/artifacts/update-matter-test/vm.cpio','-append','console=ttyS0 rdinit=/init panic=1',
+ '-netdev','user,id=n,restrict=off,hostfwd=udp:0.0.0.0:55640-10.0.2.15:5540,'
+ 'hostfwd=tcp:0.0.0.0:18184-10.0.2.15:18082,hostfwd=tcp:0.0.0.0:18185-10.0.2.15:18081,'
+ 'hostfwd=tcp:0.0.0.0:18186-10.0.2.15:18083','-device','pcnet,netdev=n,romfile=,mac=52:54:00:12:34:56']
+ mcu=Mcu();stop=threading.Event();proxies=[];nodes=set()
+ def proxy():
+ while not stop.wait(.1):
+ for node in re.findall(r'(?:Advertising|Advertise) operational node ([0-9A-Fa-f]{16}-[0-9A-Fa-f]{16})',console.read_text(errors='replace')):
+ if node in nodes:continue
+ nodes.add(node);proxies.append(subprocess.Popen(['dns-sd','-P',node,'_matter._tcp','local.','55640',
+ 'incipio-reset-vm.local','127.0.0.1','SII=500','SAI=300','T=0'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL))
+ def wait(predicate,timeout=45):
+ end=time.monotonic()+timeout
+ while time.monotonic()850
+ tool('existing-fabric-retained',['onoff','off','12344321','1'])
+ report['checks'].append('authenticated open-window retains completed fabric and encrypted CASE control')
+ pair('incomplete-pase','controller-pase',True)
+ wait(lambda:status()['failsafe_armed'])
+ opened=operate('open-commissioning')
+ assert opened['fabrics']==1 and not opened['failsafe_armed'] and opened['window_open']
+ report['checks'].append('open-window expires incomplete PASE fail-safe and reopens while retaining completed fabric')
+ mcu.event(True);time.sleep(.3);mcu.event(False);time.sleep(.5)
+ assert status()['fabrics']==1
+ wait(lambda:(lambda x:x['available'] and x['energy_mwh'] and int(x['energy_mwh'])>0)(json.loads(web())),40)
+ before=json.loads(web());assert int(before['energy_mwh'])>0
+ mcu.power=0;wait(lambda:json.loads(web())['power_mw']==0)
+ operate('energy-reset')
+ wait(lambda:json.loads(web())['energy_mwh']=='0')
+ time.sleep(32)
+ assert json.loads(web())['energy_mwh']=='0','old RAM counter restored after reset'
+ report['checks'].append('password-authenticated kWh reset commits zero in actual SDK owner and stays zero after next 30-second save')
+ mcu.power=500
+ before=json.loads(web());reset=operate('reset-matter')
+ assert reset['fabrics']==0 and reset['window_open'] and not reset['failsafe_armed']
+ wait(lambda:json.loads(web())['available'])
+ assert int(json.loads(web())['energy_mwh'])>=int(before['energy_mwh'])
+ assert hashlib.sha256(web('/matter-qr',18186)).hexdigest()==qr
+ tool('old-controller-denied',['onoff','off','12344321','1'],expected=1)
+ pair('new-controller-pair','controller-b')
+ tool('new-controller-case',['onoff','off','12344321','1'],'controller-b')
+ report['checks'].append('remote reset removes old controller, opens 900-second window, retains QR/admin password/network/cumulative energy and permits fresh full commissioning')
+ mcu.socket.sendall(bytes.fromhex('aaff0055'))
+ time.sleep(2)
+ assert status()['fabrics']==1 and 'FACTORY_RESET_REQUESTED:' not in console.read_text(errors='replace')
+ mcu.socket.sendall(bytes.fromhex('aaffff55'))
+ wait(lambda:'FACTORY_RESET_REQUESTED:' in console.read_text(errors='replace'))
+ wait(lambda:'FACTORY_INTENT_DURABLE=1' in console.read_text(errors='replace'))
+ assert not mcu.bad
+ report['checks'].append('reset-arm frame alone keeps pairing; confirmed physical long press commits durable factory intent and shuts down protocol owner')
+ report['status']='pass'
+ except Exception as error:report['failure']=str(error)
+ finally:
+ stop.set();mcu.done=True
+ subprocess.run(['docker','stop','-t','1',name],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+ vm.communicate(timeout=10);thread.join(timeout=1);mdns.join(timeout=1)
+ for child in proxies:child.terminate();child.wait(timeout=5)
+ (ROOT/'verification/admin-matter-vm-results.json').write_text(json.dumps(report,indent=2)+'\n')
+ print(json.dumps(report,indent=2))
+ return 0 if report['status']=='pass' else 1
+
+if __name__=='__main__':raise SystemExit(main())
diff --git a/tests/test_monitor.js b/tests/test_monitor.js
index 77b3f94..524347a 100644
--- a/tests/test_monitor.js
+++ b/tests/test_monitor.js
@@ -1,5 +1,10 @@
const assert=require('node:assert/strict');
-const {meterView}=require('../firmware/matter/src/update/update.js');
+const {meterView,hmac256,hex}=require('../firmware/matter/src/update/update.js');
+const crypto=require('node:crypto');
+for(const message of ['Hi There','commandkit/protocol/v1\n'+'ab'.repeat(32)+'\nhomekit']){
+ const key=Uint8Array.from({length:32},(_,i)=>i),data=new TextEncoder().encode(message);
+ assert.equal(hex(hmac256(key,data)),crypto.createHmac('sha256',key).update(data).digest('hex'));
+}
const sample={available:true,sample_age_ms:100,voltage_mv:122313,current_ma:12,power_mw:0,energy_mwh:'1234567',relay_on:false};
let v=meterView(sample);
assert.deepEqual([v.voltage,v.current,v.power,v.energy],['122.31','0.012','0.0','1.234567']);
diff --git a/tests/test_network_boot_vm.py b/tests/test_network_boot_vm.py
new file mode 100644
index 0000000..ed35219
--- /dev/null
+++ b/tests/test_network_boot_vm.py
@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""Real BusyBox PID1/DHCP and production setup controller in a MIPS VM.
+
+MTD, Wi-Fi MIB and the Matter identity helper are synthetic fixtures. No real
+outlet, Flash device or RF access. All credentials below are fresh throwaways.
+"""
+import argparse
+import hashlib
+import hmac
+import http.client
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+
+ROOT=Path(__file__).resolve().parents[1]
+SOURCE=ROOT/'firmware/matter/src'
+sys.path.insert(0,str(ROOT/'tools'))
+from fwlib import read_file
+
+
+def main():
+ parser=argparse.ArgumentParser(description=__doc__)
+ parser.add_argument('--deps',type=Path,required=True)
+ parser.add_argument('--toolchains',type=Path,required=True)
+ parser.add_argument('--vendor-ota',type=Path,required=True)
+ parser.add_argument('--output',type=Path,required=True)
+ args=parser.parse_args()
+ run=ROOT/'private'/('network-boot-vm-'+str(int(time.time())))
+ run.mkdir(mode=0o700);console=run/'console.log'
+ container='incipio-'+run.name
+ compile=['docker','run','--rm','--network','none','-v',str(ROOT)+':/repo:ro',
+ '-v',str(run)+':/fixture','-v',str(args.deps.resolve())+':/work/deps:ro',
+ '-v',str(args.toolchains.resolve())+':/work/toolchains:ro','incipio-public-build:v0.1.0-preview',
+ '/work/toolchains/uclibc/bin/mips-linux-uclibc-gcc','-static','-Os','-mno-llsc','-mno-load-store-pairs','-mmemcpy',
+ '/repo/tests/network_boot_init.c','-o','/fixture/init']
+ subprocess.run(compile,check=True)
+ entries=[]
+ def entry(path,data=b'',mode=stat.S_IFREG|0o755,device=(0,0)):
+ name=path.encode()+b'\0';fields=[len(entries)+1,mode,0,0,1,0,len(data),0,0,*device,len(name),0]
+ blob=b'070701'+b''.join(f'{v:08x}'.encode() for v in fields)+name
+ blob+=b'\0'*(-len(blob)%4);blob+=data;blob+=b'\0'*(-len(data)%4);entries.append(blob)
+ for folder in ['bin','lib','dev','etc','proc','var','tmp']:
+ entry(folder,mode=stat.S_IFDIR|0o755)
+ for name,device in [('console',(5,1)),('null',(1,3)),('urandom',(1,9)),('ttyS0',(4,64))]:
+ entry('dev/'+name,mode=stat.S_IFCHR|0o600,device=device)
+ vendor=args.vendor_ota.read_bytes()[256:]
+ for path in ['bin/busybox','bin/udhcpd','lib/ld-uClibc.so.0','lib/libc.so.0','lib/libgcc_s.so.1']:
+ entry(path,read_file(vendor,path))
+ entry('bin/udhcpc',b'udhcpd',mode=stat.S_IFLNK|0o777)
+ for applet in ['sh','sleep','mkdir','rm','cp','cat','killall','ifconfig','route','ps']:
+ entry('bin/'+applet,b'busybox',mode=stat.S_IFLNK|0o777)
+ for name in ['mii.ko','pcnet32.ko']:entry(name,(args.deps/'downloads'/name).read_bytes())
+ entry('init',(run/'init').read_bytes())
+ entry('bin/ck-boot-guard',(ROOT/'firmware/matter/artifacts/update/ck-boot-guard').read_bytes())
+ for binary in ['ck-setupd','ck-lease']:
+ entry('bin/'+binary,(ROOT/'firmware/matter/artifacts/softap-device-code'/binary).read_bytes())
+ for binary,source in [('ck-identity-start','update/ck-identity-start'),('ck-ota-start','update/ck-ota-start'),
+ ('ck-onboarding-start','setup/ck-onboarding-start'),('ck-management-start','setup/ck-management-start'),('ck-setup-start','setup/ck-setup-device-start'),
+ ('ck-setup-backend','setup/ck-setup-device-backend'),('ck-udhcpc','setup/ck-udhcpc-fixed')]:
+ entry('bin/'+binary,(SOURCE/source).read_bytes())
+ entry('etc/ck-variant',b'matter\n');entry('test-device.key',os.urandom(32),mode=stat.S_IFREG|0o600)
+ key=os.urandom(32);entry('test-diag.key',key.hex().encode()+b'\n',mode=stat.S_IFREG|0o600)
+ def script(name,body):entry('bin/'+name,('#!/bin/sh\n'+body+'\n').encode())
+ script('ck-wificfg','if [ "$1" = status ]; then echo configured=1; else : > /var/run/unexpected-mib-write; exit 1; fi')
+ script('ck-updater','''case "$1" in
+--import|--import-wait)
+ [ -f /var/run/allow-identity ] || exit 1
+ cp /test-device.key /var/lib/ck-state/device.key
+ cp /test-diag.key /var/lib/ck-state/diag.key ;;
+--boot) echo boot >> /var/run/boot-count ;;
+--protocol-boot) printf matter > /var/run/ck-protocol-active ;;
+--admin-state) printf '!' > /var/run/ck-admin-state ;;
+*) : > /var/run/unexpected-mib-write; exit 1 ;;
+esac''')
+ entry('bin/ck-updated',(ROOT/'firmware/matter/artifacts/update/ck-updated').read_bytes())
+ entry('etc/ck-version',b'0.2.9-preview\n',mode=stat.S_IFREG|0o444)
+ entry('etc/ck-update.meta',__import__('struct').pack('>III',0x434b0004,1,11),mode=stat.S_IFREG|0o444)
+ script('matterd-test','test "$1" = --init-identity && test "$2" = wlan0 || exit 2\n'
+ 'test -f /var/lib/ck-state/device.key || exit 5\nprintf 12345678901 > /var/run/matter-manual-code\n')
+ entry('bin/ck-ota-start-v6',read_file(vendor,'bin/ck-ota-start'))
+ script('test-rcS','/bin/ck-ota-start-v6\nprintf "V6_STARTUP_EXIT=%s\\n" "$?"\n/bin/ck-ota-start\necho NETWORK_BOOT_VM_READY')
+ inittab='::sysinit:/bin/test-rcS\n::respawn:/bin/sh\n'
+ for name in ['ck-identity-start','ck-onboarding-start','ck-setup-start','ck-management-start']:
+ inittab+='::respawn:/bin/'+name+'\n'
+ entry('etc/inittab',inittab.encode(),mode=stat.S_IFREG|0o644)
+ entry('TRAILER!!!',mode=0);(run/'vm.cpio').write_bytes(b''.join(entries))
+ command=['docker','run','--rm','-i','--name',container,
+ '-p','127.0.0.1:18190:18190','-p','127.0.0.1:18191:18191','-p','127.0.0.1:18192:18192','-v',str(run)+':/fixture:ro',
+ '-v',str(args.deps.resolve())+':/deps:ro','incipio-public-build:v0.1.0-preview',
+ 'qemu-system-mips','-M','malta','-cpu','24Kc','-m','64','-vga','none','-display','none',
+ '-monitor','none','-serial','stdio','-no-reboot','-kernel','/deps/downloads/vmlinux-4.19.0-21-4kc-malta',
+ '-initrd','/fixture/vm.cpio','-append','console=ttyS0 rdinit=/init panic=1',
+ '-netdev','user,id=n,restrict=off,hostfwd=tcp:0.0.0.0:18190-10.0.2.15:18081,hostfwd=tcp:0.0.0.0:18191-10.0.2.15:18082,hostfwd=tcp:0.0.0.0:18192-10.0.2.15:80',
+ '-device','pcnet,netdev=n,romfile=,mac=52:54:00:12:34:56']
+ report={'status':'failed','real_outlet':False,'environment':'64 MiB Malta/Linux 4.19; actual vendor BusyBox init, production guard/setupd/backend/DHCP/lease publisher',
+ 'memory_limitation':'This Debian test kernel does not boot with -m 32 even without an initrd. This is not a physical 32 MiB outlet memory validation.',
+ 'fixtures':['MIB status/write rejection','identity importer','Matter identity helper'],
+ 'checks':[],'sha256':{name:hashlib.sha256((ROOT/path).read_bytes()).hexdigest() for name,path in {
+ 'guard':'firmware/matter/artifacts/update/ck-boot-guard','setupd':'firmware/matter/artifacts/softap-device-code/ck-setupd'}.items()}}
+ def request(path,headers=None):
+ c=http.client.HTTPConnection('127.0.0.1',18190,timeout=2)
+ c.request('GET',path,headers=headers or {});r=c.getresponse();data=r.read();c.close();return r.status,data
+ def wait(check,timeout=55):
+ end=time.monotonic()+timeout
+ while time.monotonic() /var/run/allow-identity')
+ wait(lambda:request('/challenge')[0]==200,timeout=35)
+ assert state()[0]==200 and b'state=online' in state()[1]
+ report['checks'].append('identity/management become ready after network is already online, without reboot')
+ old_dhcp=pid('cat /var/run/ck-udhcpc.pid');assert old_dhcp
+ serial('kill '+str(old_dhcp))
+ wait(lambda:(lambda current:current and current!=old_dhcp)(pid('cat /var/run/ck-udhcpc.pid')),timeout=50)
+ wait(lambda:state()[0]==200 and b'state=online' in state()[1])
+ report['checks'].append('DHCP client death is detected and a new client completes DHCP')
+ final=serial('cat /var/run/ck-wifi-bound; cat /var/run/boot-count; '
+ 'if [ -f /var/run/unexpected-mib-write ]; then echo MIB_WRITE_FAILURE; else echo MIB_UNCHANGED; fi; '
+ 'echo FINAL_END')
+ assert not re.search(r'(?m)^MIB_WRITE_FAILURE\r?$',final)
+ assert re.search(r'(?m)^MIB_UNCHANGED\r?$',final)
+ report['checks'].append('saved station reconnection never writes MIB or onboarded state')
+ report['status']='pass'
+ finally:
+ subprocess.run(['docker','stop','-t','1',container],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
+ vm.wait(timeout=10)
+ args.output.write_text(json.dumps(report,indent=2)+'\n')
+ print(json.dumps(report,indent=2))
+
+
+if __name__=='__main__':main()
diff --git a/tests/test_password_crypto.js b/tests/test_password_crypto.js
new file mode 100644
index 0000000..a3b1d64
--- /dev/null
+++ b/tests/test_password_crypto.js
@@ -0,0 +1,18 @@
+const assert=require('node:assert/strict');
+const crypto=require('node:crypto');
+const {pbkdf2,hex,hmac256}=require('../firmware/matter/src/update/password.js');
+for(const [password,iterations]of [['fixture password',1],['fixture password',2],['中文密碼123',4096],['x'.repeat(100),4096],['fixture password',600000]]){
+ const salt=Buffer.from('00112233445566778899aabbccddeeff','hex'),bytes=Buffer.from(password);
+ assert.equal(hex(pbkdf2(bytes,salt,iterations)),crypto.pbkdf2Sync(bytes,salt,iterations,32,'sha256').toString('hex'));
+}
+for(const iterations of [0,600001,-1])assert.throws(()=>pbkdf2(Buffer.from('password'),Buffer.alloc(16),iterations));
+const key=crypto.randomBytes(32),message=Buffer.from('ck-admin-login-v1\n'+'a'.repeat(64));
+assert.equal(hex(hmac256(key,message)),crypto.createHmac('sha256',key).update(message).digest('hex'));
+console.log('Password worker PBKDF2/HMAC agrees with independent Node crypto, including 600,000 rounds.');
+
+// Load both scripts in one browser global: names must not collide.
+const vm=require("node:vm"),fs=require("node:fs"),context=vm.createContext({window:{},console});
+vm.runInContext(fs.readFileSync(require.resolve("../firmware/matter/src/update/password.js"),"utf8"),context);
+vm.runInContext(fs.readFileSync(require.resolve("../firmware/matter/src/update/update.js"),"utf8"),context);
+assert.equal(typeof context.window.CKPassword.derive,"function");
+console.log("Password and dashboard scripts coexist in one browser global.");
diff --git a/tests/test_public_management.py b/tests/test_public_management.py
new file mode 100644
index 0000000..8b3d285
--- /dev/null
+++ b/tests/test_public_management.py
@@ -0,0 +1,24 @@
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'tools'))
+from check_public import public_paths, audit
+
+
+class PublicManagement(unittest.TestCase):
+ def test_downloaded_profile_is_excluded_from_source_archive(self):
+ with tempfile.TemporaryDirectory() as name:
+ path=Path(name)/'commandkit-management.json'
+ path.write_text(json.dumps({'format':'commandkit-management-v1','diag_key':'01'*32}))
+ self.assertEqual(public_paths(name),[])
+ def test_renamed_profile_is_rejected_before_publication(self):
+ with tempfile.TemporaryDirectory() as name:
+ path=Path(name)/'renamed.json'
+ path.write_text(json.dumps({'format':'commandkit-management-v1','diag_key':'01'*32}))
+ with self.assertRaisesRegex(ValueError,'公開包含管理金鑰'):
+ audit(name,Path(name)/'unused-release')
+
+
+if __name__=='__main__':unittest.main()
diff --git a/tests/test_setup_control.py b/tests/test_setup_control.py
new file mode 100644
index 0000000..a46da39
--- /dev/null
+++ b/tests/test_setup_control.py
@@ -0,0 +1,68 @@
+import hashlib
+import hmac
+import json
+import io
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'tools'))
+from setup_control import control,main
+from fwlib import profile_diag_key
+
+
+class SetupControl(unittest.TestCase):
+ def test_downloaded_management_profile(self):
+ with tempfile.TemporaryDirectory() as name:
+ path=Path(name)/'commandkit-management.json';key=bytes(range(32))
+ path.write_text(json.dumps({'format':'commandkit-management-v1','diag_key':key.hex()}))
+ self.assertEqual(profile_diag_key(path),key)
+ path.write_text(json.dumps({'format':'other','diag_key':key.hex()}))
+ with self.assertRaises(ValueError):profile_diag_key(path)
+ path.write_text('[]')
+ with self.assertRaises(ValueError):profile_diag_key(path)
+ def test_scope_and_nonce_are_bound_and_key_not_sent(self):
+ for action,method,path in [('status','GET','/state'),('enter-setup','POST','/enter-setup'),
+ ('matter-status','GET','/matter-state'),('reset-matter','POST','/reset-matter'),
+ ('open-commissioning','POST','/open-commissioning')]:
+ with self.subTest(action=action),tempfile.TemporaryDirectory() as name:
+ key=bytes(range(32));nonce=b'1'*64
+ (Path(name)/'diag.key').write_bytes(key.hex().encode()+b'\n')
+ with patch('setup_control.http.client.HTTPConnection') as constructor:
+ connection=constructor.return_value
+ challenge=unittest.mock.Mock(status=200);challenge.read.return_value=nonce
+ response=unittest.mock.Mock(status=202);response.read.return_value=b'accepted\n'
+ connection.getresponse.side_effect=[challenge,response]
+ self.assertEqual(control('192.168.1.20',name,action),'accepted\n')
+ call=connection.request.call_args_list[1]
+ self.assertEqual(call.args,(method,path))
+ expect=hmac.new(key,(method+' '+path+'\n').encode()+nonce,hashlib.sha256).hexdigest()
+ self.assertEqual(call.kwargs['headers'],{'X-Setup-Proof':nonce.decode()+':'+expect})
+ self.assertNotIn(key.hex(),str(connection.request.call_args_list))
+ def test_invalid_challenge_sends_no_mutation(self):
+ with tempfile.TemporaryDirectory() as name:
+ (Path(name)/'diag.key').write_text('01'*32+'\n')
+ with patch('setup_control.http.client.HTTPConnection') as constructor:
+ response=constructor.return_value.getresponse.return_value
+ response.status=200;response.read.return_value=b'invalid'
+ with self.assertRaises(ValueError):control('192.168.1.20',name,'enter-setup')
+ constructor.return_value.request.assert_called_once_with('GET','/challenge',body=None,headers={})
+ def test_wait_ignores_previous_completed_request(self):
+ previous={'request_id':'old','result':'complete','window_open':True,'fabrics':0}
+ completed={**previous,'request_id':'new'}
+ with patch('sys.argv',['setup_control.py','reset-matter','--host','192.168.1.20','--profile','profile','--wait']), \
+ patch('setup_control.control',side_effect=[json.dumps({'request_id':'new'}),json.dumps(previous),json.dumps(completed)]) as api, \
+ patch('setup_control.time.sleep'),patch('sys.stdout',new_callable=io.StringIO) as output:
+ main()
+ self.assertEqual(json.loads(output.getvalue()),completed)
+ self.assertEqual(api.call_count,3)
+ def test_wait_does_not_report_reset_success_with_fabrics_remaining(self):
+ state={'request_id':'new','result':'complete','window_open':True,'fabrics':1}
+ with patch('sys.argv',['setup_control.py','reset-matter','--host','192.168.1.20','--profile','profile','--wait']), \
+ patch('setup_control.control',side_effect=[json.dumps({'request_id':'new'}),json.dumps(state)]), \
+ patch('setup_control.time.sleep'):
+ with self.assertRaisesRegex(ValueError,'尚未清除'):main()
+
+
+if __name__=='__main__':unittest.main()
diff --git a/tests/test_startup_recovery.py b/tests/test_startup_recovery.py
index 450f26c..b06e5d6 100644
--- a/tests/test_startup_recovery.py
+++ b/tests/test_startup_recovery.py
@@ -6,6 +6,8 @@
import re
import tempfile
import unittest
+import time
+import signal
ROOT = Path(__file__).resolve().parents[1]
SOURCE = ROOT / 'firmware/matter/src'
@@ -34,20 +36,21 @@ def run_script(self, source):
environment = {**os.environ, 'PATH': str(self.work / 'bin') + os.pathsep + os.environ['PATH']}
return subprocess.run(['sh', str(script)], capture_output=True, timeout=5, env=environment)
- def test_setup_uses_interface_present_on_original_hardware(self):
- # Captured original /proc/net/dev has wlan0, with no wl0 interface.
- interfaces = self.work / 'interfaces'
- (interfaces / 'wlan0').mkdir(parents=True)
+ def test_setup_starts_with_missing_identity_and_stale_pending(self):
+ (self.work/'var/run/ck-identity-pending').touch()
self.executable('sleep', 'exit 0\n')
- self.executable('matterd-test',
- 'test "$1" = --init-identity || exit 2\n'
- 'test -d "' + str(interfaces) + '/$2" || exit 5\n')
- self.executable('ck-wificfg', 'echo configured=0\n')
- self.executable('ck-setupd', 'echo setup_started\n')
+ self.executable('ck-boot-guard', 'case "$1" in --mib) echo configured=1 ;; --setup) echo setup_started ;; *) exit 9 ;; esac\n')
result = self.run_script('setup/ck-setup-device-start')
- self.assertEqual(result.returncode, 0)
- self.assertIn(b'setup_started', result.stdout)
- self.assertEqual((self.work / 'var/run/ck-setup-boot').read_text(), 'unconfigured')
+ self.assertEqual(result.returncode, 1) # PID1 respawns the supervisor.
+ self.assertIn('setup_started', (self.work/'var/log/ck-setupd.log').read_text())
+ self.assertEqual((self.work / 'var/run/ck-setup-boot').read_text(), 'configured')
+
+ def test_failed_mib_read_preserves_station_mode(self):
+ self.executable('sleep','exit 0\n')
+ self.executable('ck-boot-guard','case "$1" in --mib) exit 9 ;; --setup) echo setup_started ;; esac\n')
+ result=self.run_script('setup/ck-setup-device-start')
+ self.assertIn('setup_started',(self.work/'var/log/ck-setupd.log').read_text())
+ self.assertEqual((self.work/'var/run/ck-setup-boot').read_text(),'configured')
def test_failed_import_keeps_bootstrap_for_setup_and_diagnostics(self):
self.executable('ck-updater', 'echo import_failed\nexit 1\n')
@@ -66,8 +69,65 @@ def test_failed_import_keeps_bootstrap_for_setup_and_diagnostics(self):
self.assertEqual(output.stat().st_mode & 0o777, 0o600)
self.assertFalse((self.work / 'var/run/ck-update-healthy').exists())
+ def test_first_generated_identity_forces_setup_even_with_old_wifi(self):
+ (self.work/'var/run/ck-first-setup').touch()
+ self.executable('sleep','exit 0\n')
+ self.executable('ck-boot-guard','case "$1" in --mib) exit 9 ;; --setup) echo setup_started ;; esac\n')
+ result=self.run_script('setup/ck-setup-device-start')
+ self.assertEqual(result.returncode,1)
+ self.assertIn('setup_started',(self.work/'var/log/ck-setupd.log').read_text())
+ self.assertEqual((self.work/'var/run/ck-setup-boot').read_text(),'unconfigured')
+
+ def test_public_entropy_wait_does_not_block_vendor_startup(self):
+ (self.work/'etc/ck-identity-policy').write_text('auto-v1\n')
+ ready=self.work/'entropy-ready'
+ self.executable('ck-updater',
+ 'case "$1" in --import) exit 75 ;; --import-wait)\n'
+ 'while [ ! -f "'+str(ready)+'" ]; do /bin/sleep 0.1; done ;; esac\nexit 0\n')
+ self.executable('ck-updated','exit 0\n')
+ text=(SOURCE/'update/ck-ota-start').read_text()
+ text=re.sub(r'/(?:bin|var|etc)/',lambda m:str(self.work)+m[0],text)
+ script=self.work/'startup.sh';script.write_text(text)
+ with (self.work/'output.log').open('wb') as log:
+ process=subprocess.Popen(['sh',str(script)],stdout=log,stderr=log,start_new_session=True)
+ try:
+ self.assertEqual(process.wait(timeout=2),0)
+ until=time.monotonic()+2
+ pending=self.work/'var/run/ck-identity-pending'
+ while not pending.exists() and time.monotonic()> "'+str(self.work/'boots')+'" ;; esac\nexit 0\n')
+ self.executable('ck-updated','exit 0\n')
+ self.executable('ck-updater','exit 0\n')
+ self.executable('sleep','exit 0\n')
+ for _ in range(2):
+ result=self.run_script('update/ck-identity-start')
+ self.assertEqual(result.returncode,0)
+ self.assertEqual(key.read_bytes(),original)
+ self.assertEqual((self.work/'boots').read_text().splitlines(),['booted'])
+ self.assertFalse((self.work/'var/run/ck-identity-pending').exists())
+ self.assertEqual((self.work/'var/run/ck-identity-state').read_text(),'phase=ready\n')
+
def relay_script(self, rescue=False, conflict=False):
- self.executable('pidof', 'echo homekitserver\n' if conflict else 'exit 1\n')
+ self.executable('ps', 'echo homekitserver\n' if conflict else 'exit 0\n')
+ self.executable('grep','exec /usr/bin/grep "$@"\n')
calls = self.work / 'calls'
self.executable('matter-diag',
'if [ "$1" = --log ]; then exec cat; fi\n'
diff --git a/tests/test_update_feed.py b/tests/test_update_feed.py
index 4f161f1..47f137b 100644
--- a/tests/test_update_feed.py
+++ b/tests/test_update_feed.py
@@ -9,6 +9,7 @@
from unittest.mock import patch
sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'tools'))
import setup_github_updates as setup
+from ota import validate_catalog_upgrade
class PagesEnvironment(unittest.TestCase):
def configure(self,policy,rules,missing=False):
@@ -43,4 +44,15 @@ def test_new_environment_keeps_main_and_adds_release_tags(self):
posts=[json.loads(k['input']) for a,k in calls if a[:3]==['api','--method','POST']]
self.assertEqual(posts,[{'name':'main','type':'branch'},{'name':'v*','type':'tag'}])
+class CatalogUpgrade(unittest.TestCase):
+ def catalog(self,**versions):return {'updates':[{'variant':v,'software_version':n} for v,n in versions.items()]}
+ def test_legacy_diagnostic_can_retire_while_matter_advances(self):
+ validate_catalog_upgrade(self.catalog(matter=5,**{'exec-test':5}),self.catalog(matter=13))
+ def test_supported_channel_cannot_disappear_or_downgrade(self):
+ for incoming in [self.catalog(matter=4),self.catalog(**{'exec-test':13}),self.catalog()]:
+ with self.assertRaises(ValueError):validate_catalog_upgrade(self.catalog(matter=5),incoming)
+ with self.assertRaises(ValueError):validate_catalog_upgrade(self.catalog(matter=5,other=5),self.catalog(matter=13))
+ def test_retained_diagnostic_cannot_downgrade(self):
+ with self.assertRaises(ValueError):validate_catalog_upgrade(self.catalog(matter=5,**{'exec-test':5}),self.catalog(matter=13,**{'exec-test':4}))
+
if __name__=='__main__':unittest.main(verbosity=2)
diff --git a/tests/test_update_pid1.py b/tests/test_update_pid1.py
index 8f8afc1..28a951d 100644
--- a/tests/test_update_pid1.py
+++ b/tests/test_update_pid1.py
@@ -32,7 +32,7 @@ def main():
for args in [['--import'],['--stage','/fixture/update.ota']]:
subprocess.run([*docker,'incipio-public-build:v0.1.0-preview','qemu-mips',binary,*args],check=True,timeout=30)
before=(work/'flash.bin').read_bytes()
- sources=['ck_common.c','ck_flash.c','ck_store.c','ck_ota.c','ck_updater.c']
+ sources=['ck_common.c','ck_flash.c','ck_store.c','ck_energy.c','ck_led.c','ck_ota.c','ck_updater.c']
common=['/repo/firmware/matter/src/update/'+p for p in sources]
common += ['/repo/firmware/matter/src/vendor/monocypher/'+p for p in ['monocypher.c','monocypher-ed25519.c']]
subprocess.run([*docker,'incipio-public-build:v0.1.0-preview','cc','-static','-O2','-DCK_TESTING','-DCK_TEST_PID1',*common,'-o','/fixture/apply-native'],check=True,timeout=60)
diff --git a/tests/test_updates.py b/tests/test_updates.py
index b5d4927..311237e 100644
--- a/tests/test_updates.py
+++ b/tests/test_updates.py
@@ -6,15 +6,19 @@
import ctypes
import hashlib
import http.client
+import hmac
import json
import os
import socket
+import signal
+import fcntl
import shlex
import struct
import subprocess
import sys
import tempfile
import time
+import threading
import unittest
from pathlib import Path
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
@@ -41,7 +45,7 @@ class Updates(unittest.TestCase):
@classmethod
def setUpClass(cls):
cls.build=tempfile.TemporaryDirectory(prefix='ck-update-build-');cls.bin=Path(cls.build.name)
- common=[str(SOURCE/'update'/p) for p in ['ck_common.c','ck_flash.c','ck_store.c','ck_energy.c','ck_ota.c','ck_meter.c']]
+ common=[str(SOURCE/'update'/p) for p in ['ck_common.c','ck_flash.c','ck_store.c','ck_energy.c','ck_ota.c','ck_meter.c','ck_led.c']]
common += [str(SOURCE/'vendor/monocypher'/p) for p in ['monocypher.c','monocypher-ed25519.c']]
flags=['cc','-DCK_TESTING','-std=c11','-O2','-g','-Wall','-Wextra','-Werror','-Wno-misleading-indentation','-Wno-unused-function']
subprocess.run(flags+['-shared','-fPIC',*common,'-o',str(cls.bin/'state.so')],check=True)
@@ -71,13 +75,18 @@ def setUp(self):
self.flash=self.work/'flash.bin';self.flash.write_bytes(self.image)
os.environ['CK_FLASH_FILE']=str(self.flash);os.environ['CK_TEST_ROOT']=str(self.work)
os.environ.pop('CK_FAIL_STORE',None);os.environ.pop('CK_FAIL_OTA_AFTER',None);os.environ.pop('CK_FAIL_ENERGY',None)
+ os.environ.pop('CK_TEST_SEED_FILE',None);os.environ.pop('CK_FAIL_INIT_RETIRE',None)
self.assertEqual(self.lib.ck_store_import(),0)
self.ota=self.work/'update.ota';self.ota.write_bytes(package(self.key,self.image))
- self.server=None
+ self.server=None;self.cookie='';self.csrf=''
+ self.admin_salt=os.urandom(16);self.admin_key=os.urandom(32)
+ self.admin_record=b'CKAUTH1\n'+struct.pack('>I',600000)+self.admin_salt+self.admin_key
+ self.assertEqual(self.put('admin/credential',self.admin_record),0)
def tearDown(self):
if self.server:
self.server.terminate();self.server.wait(timeout=5);self.server.stdout.close();self.server.stderr.close()
- os.environ.pop('CK_FAIL_STORE',None);os.environ.pop('CK_FAIL_OTA_AFTER',None);os.environ.pop('CK_FAIL_ENERGY',None);self.tmp.cleanup()
+ for key in ('CK_FAIL_STORE','CK_FAIL_OTA_AFTER','CK_FAIL_ENERGY','CK_TEST_SEED_FILE','CK_FAIL_INIT_RETIRE'):os.environ.pop(key,None)
+ self.tmp.cleanup()
def get(self,key):
b=ctypes.create_string_buffer(65536);n=ctypes.c_size_t(len(b));r=self.lib.ck_store_get(key.encode(),b,ctypes.byref(n));return r,b.raw[:n.value]
def put(self,key,value):return self.lib.ck_store_set(key.encode(),value,len(value))
@@ -124,6 +133,29 @@ def test_persistence_and_noop_wear(self):
code='import ctypes,os;from pathlib import Path;lib=ctypes.CDLL(os.environ["LIB"]);b=ctypes.create_string_buffer(100);n=ctypes.c_size_t(100);assert lib.ck_store_get(b"matter/fabric",b,ctypes.byref(n))==0;assert b.raw[:n.value]==b"paired fabric secret"'
subprocess.run([sys.executable,'-c',code],check=True,env={**os.environ,'LIB':str(self.bin/'state.so')})
self.assertEqual(self.lib.ck_store_delete(b'matter/fabric'),0);self.assertEqual(self.get('matter/fabric')[0],1)
+ def test_matter_reset_is_atomic_and_keeps_identity_wifi_ota_and_energy(self):
+ kept={k:self.get(k) for k in ['identity/device','identity/diag','identity/update']}
+ for key,value in {'platform/chip_config.ini':b'[DEFAULT]\nunique-id=stable\ncountry-code=TW\n',
+ 'platform/chip_factory.ini':b'factory data', 'platform/chip_counters.ini':b'counters',
+ 'wifi/fixture':b'unchanged network', 'ota/floor':b'\0\0\0\x08'}.items():
+ self.assertEqual(self.put(key,value),0);kept[key]=(0,value)
+ for key in ['matter/f/1/n','matter/g/fs/c','matter/acl','platform/chip_kvs']:
+ self.assertEqual(self.put(key,b'operational secret'),0)
+ self.assertEqual(self.lib.ck_energy_save(987654,123),0)
+ before=self.flash.read_bytes();request=b'a'*64
+ for point in ['after-erase','before-commit']:
+ os.environ['CK_FAIL_STORE']=point
+ self.assertNotEqual(self.lib.ck_store_reset_matter(request),0)
+ os.environ.pop('CK_FAIL_STORE')
+ self.assertEqual(self.get('matter/f/1/n'),(0,b'operational secret'))
+ self.assertEqual(self.get('control/matter-reset')[0],1)
+ self.assertEqual(self.lib.ck_store_reset_matter(request),0)
+ for key in ['matter/f/1/n','matter/g/fs/c','matter/acl','platform/chip_kvs']:self.assertEqual(self.get(key)[0],1)
+ for key,value in kept.items():self.assertEqual(self.get(key),value)
+ self.assertEqual(self.get('control/matter-reset'),(0,request));self.assertEqual(self.energy(),(0,987654,123))
+ after=self.flash.read_bytes()
+ for start,end in [(0,JOURNAL),(0x3cf000,0x3d0000),(0x3df000,0x800000)]:self.assertEqual(before[start:end],after[start:end])
+ for bad in [b'',b'A'*64,b'a'*65]:self.assertNotEqual(self.lib.ck_store_reset_matter(bad),0)
def test_torn_journal_and_corrupt_new_slot(self):
self.assertEqual(self.put('matter/test',b'old'),0)
for point in ['after-erase','before-commit']:
@@ -149,6 +181,24 @@ def test_verification_rejects_wrong_or_damaged_images(self):
for value in bad:
self.ota.write_bytes(value);self.assertNotEqual(self.run_updater('--verify',self.ota).returncode,0)
self.assertEqual(self.flash.read_bytes(),before)
+ def test_factory_kernel_hash_covers_code_padding_and_checks_header(self):
+ kernel=bytearray(b'\xa5'*0x120000)
+ struct.pack_into('>4sIII',kernel,0,b'cr6c',0x80500000,0x8000004d,0x11fff0)
+ expected=hashlib.sha256(kernel).digest()
+ path=self.work/'kernel.bin';out=ctypes.create_string_buffer(32)
+ for mark in (0x8000004d,0x80000051,0xfffffff0):
+ struct.pack_into('>I',kernel,8,mark);path.write_bytes(kernel)
+ with path.open('rb') as fd:self.assertEqual(self.lib.ck_hash_factory_kernel(fd.fileno(),0,out),0)
+ self.assertEqual(out.raw,expected)
+ for at in (20,0x110000,0x11ffff):
+ changed=bytearray(kernel);changed[at]^=1;path.write_bytes(changed)
+ with path.open('rb') as fd:self.assertEqual(self.lib.ck_hash_factory_kernel(fd.fileno(),0,out),0)
+ self.assertNotEqual(out.raw,expected)
+ for at in (0,4,12):
+ changed=bytearray(kernel);changed[at]^=1;path.write_bytes(changed)
+ with path.open('rb') as fd:self.assertNotEqual(self.lib.ck_hash_factory_kernel(fd.fileno(),0,out),0)
+ path.write_bytes(kernel[:-1])
+ with path.open('rb') as fd:self.assertNotEqual(self.lib.ck_hash_factory_kernel(fd.fileno(),0,out),0)
def test_rootfs_write_and_preservation(self):
self.assertEqual(self.put('matter/fabric',b'paired'),0)
self.assertEqual(self.lib.ck_energy_save(1234567,17),0)
@@ -169,6 +219,84 @@ def test_interrupted_initial_import_can_retry_with_bootstrap(self):
self.flash.write_bytes(self.image)
os.environ['CK_FAIL_STORE']='before-commit';self.assertNotEqual(self.lib.ck_store_import(),0)
os.environ.pop('CK_FAIL_STORE');self.assertEqual(self.lib.ck_store_import(),0)
+ def fresh_auto(self,seed=None):
+ sys.path.insert(0,str(ROOT/'tools'))
+ from factory_image import journal_initializer
+ image=bytearray(self.image);image[JOURNAL:JOURNAL+0x20000]=journal_initializer(True)
+ self.flash.write_bytes(image)
+ (self.work/'etc/ck-identity-policy').write_bytes(b'auto-v1\n')
+ for path in ('etc/matter-device.key','etc/matter-diag.key','var/run/ck-first-setup'):
+ (self.work/path).unlink(missing_ok=True)
+ for path in (self.work/'var/lib/ck-state').iterdir():path.unlink()
+ path=self.work/'seed.bin';path.write_bytes(os.urandom(32) if seed is None else seed)
+ os.environ['CK_TEST_SEED_FILE']=str(path)
+ return path
+ def test_auto_identity_generated_once_and_onboarding_persists(self):
+ seed=os.urandom(32);path=self.fresh_auto(seed)
+ self.assertEqual(self.run_updater('--import').returncode,0)
+ state=self.work/'var/lib/ck-state'
+ self.assertEqual((state/'device.key').read_bytes(),hmac.new(seed,b'commandkit/device/v1',hashlib.sha256).digest())
+ diag=hmac.new(seed,b'commandkit/diagnostics/v1',hashlib.sha256).hexdigest().encode()+b'\n'
+ self.assertEqual((state/'diag.key').read_bytes(),diag)
+ self.assertNotEqual((state/'device.key').read_bytes(),bytes.fromhex(diag.decode().strip()))
+ before=self.flash.read_bytes();path.unlink()
+ self.assertEqual(self.run_updater('--import').returncode,0)
+ self.assertEqual(before,self.flash.read_bytes())
+ self.assertTrue((self.work/'var/run/ck-first-setup').exists())
+ self.assertEqual(self.run_updater('--onboarded').returncode,0)
+ self.assertFalse((self.work/'var/run/ck-first-setup').exists())
+ self.assertEqual(self.run_updater('--import').returncode,0)
+ self.assertFalse((self.work/'var/run/ck-first-setup').exists())
+ for name in ('device.key','diag.key','update.pub'):self.assertEqual((state/name).stat().st_mode&0o777,0o600)
+ def test_auto_identity_two_devices_get_different_keys(self):
+ keys=[]
+ for _ in range(2):
+ self.fresh_auto();self.assertEqual(self.run_updater('--import').returncode,0)
+ keys.append([(self.work/'var/lib/ck-state'/name).read_bytes() for name in ('device.key','diag.key')])
+ self.assertNotEqual(keys[0][0],keys[1][0]);self.assertNotEqual(keys[0][1],keys[1][1])
+ def test_auto_identity_entropy_pending_makes_no_flash_or_identity(self):
+ for seed in (b'',os.urandom(17)):
+ self.fresh_auto(seed);before=self.flash.read_bytes()
+ self.assertEqual(self.run_updater('--import').returncode,75)
+ self.assertEqual(before,self.flash.read_bytes())
+ self.assertEqual(list((self.work/'var/lib/ck-state').iterdir()),[])
+ def test_auto_identity_wait_accumulates_partial_seed_without_blocking_startup(self):
+ seed=os.urandom(32);path=self.fresh_auto(seed[:9])
+ proc=subprocess.Popen([*self.runner,str(self.updater),'--import-wait'],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+ try:
+ time.sleep(.4);self.assertIsNone(proc.poll())
+ self.assertFalse((self.work/'var/lib/ck-state/device.key').exists())
+ with path.open('ab') as stream:stream.write(seed[9:])
+ output=proc.communicate(timeout=10);self.assertEqual(proc.returncode,0,output)
+ self.assertEqual((self.work/'var/lib/ck-state/device.key').read_bytes(),hmac.new(seed,b'commandkit/device/v1',hashlib.sha256).digest())
+ finally:
+ if proc.poll() is None:proc.kill();proc.communicate()
+ def test_auto_identity_interrupted_first_write_and_retire_recover_before_export(self):
+ for point in ('after-erase','before-commit','retire'):
+ first=os.urandom(32);path=self.fresh_auto(first)
+ variable='CK_FAIL_INIT_RETIRE' if point=='retire' else 'CK_FAIL_STORE'
+ os.environ[variable]=point
+ self.assertNotEqual(self.run_updater('--import').returncode,0)
+ self.assertEqual(list((self.work/'var/lib/ck-state').iterdir()),[])
+ os.environ.pop(variable);second=os.urandom(32);path.write_bytes(second)
+ self.assertEqual(self.run_updater('--import').returncode,0)
+ expected=first if point=='retire' else second
+ self.assertEqual((self.work/'var/lib/ck-state/device.key').read_bytes(),hmac.new(expected,b'commandkit/device/v1',hashlib.sha256).digest())
+ def test_auto_identity_unknown_or_later_corrupt_state_is_never_rekeyed(self):
+ self.fresh_auto();self.assertEqual(self.run_updater('--import').returncode,0)
+ changed=bytearray(self.flash.read_bytes());changed[JOURNAL]^=1;self.flash.write_bytes(changed)
+ self.assertNotEqual(self.run_updater('--import').returncode,0);self.assertEqual(self.flash.read_bytes(),changed)
+ self.fresh_auto();changed=bytearray(self.flash.read_bytes());changed[JOURNAL+0x10000]^=1;self.flash.write_bytes(changed)
+ self.assertNotEqual(self.run_updater('--import').returncode,0);self.assertEqual(self.flash.read_bytes(),changed)
+ def test_auto_policy_keeps_existing_legacy_identity_without_entropy(self):
+ before=self.flash.read_bytes();state=self.work/'var/lib/ck-state'
+ original={p.name:p.read_bytes() for p in state.iterdir()}
+ (self.work/'etc/ck-identity-policy').write_bytes(b'auto-v1\n')
+ (self.work/'etc/matter-device.key').unlink();(self.work/'etc/matter-diag.key').unlink()
+ os.environ['CK_TEST_SEED_FILE']=str(self.work/'absent')
+ self.assertEqual(self.run_updater('--import').returncode,0)
+ self.assertEqual(before,self.flash.read_bytes());self.assertFalse((self.work/'var/run/ck-first-setup').exists())
+ for name,value in original.items():self.assertEqual((state/name).read_bytes(),value)
def test_exec_variant_and_profile_recovery(self):
self.flash.write_bytes(self.image)
(self.work/'etc/ck-update.meta').write_bytes(struct.pack('>III',0x434b0004,2,1))
@@ -182,17 +310,426 @@ def test_exec_variant_and_profile_recovery(self):
injected=fwlib.profile_keys(profile,self.flash.read_bytes(),'exec-test',values)
self.assertEqual(injected['etc/matter-diag.key'][0],self.diag.hex().encode()+b'\n')
self.assertEqual(injected['etc/ck-setup-ap.bin'][0],credential)
- def start_server(self):
+ def start_server(self,login=True):
sock=socket.socket();sock.bind(('127.0.0.1',0));self.port=sock.getsockname()[1];sock.close()
self.server=subprocess.Popen([*self.runner,str(self.server_binary),str(self.port),'lo'],stdout=subprocess.PIPE,stderr=subprocess.PIPE)
for _ in range(50):
- try:self.request('GET','/status');return
+ try:
+ self.request('GET','/status')
+ if login:self.login()
+ return
except OSError:time.sleep(.03)
raise RuntimeError('server did not start')
- def request(self,method,path,body=None,headers=None):
- c=http.client.HTTPConnection('127.0.0.1',self.port,timeout=10);c.request(method,path,body=body,headers=headers or {});r=c.getresponse();result=(r.status,r.read());c.close();return result
+ def login(self,key=None):
+ status,body=self.request('GET','/auth/challenge',authenticated=False);self.assertEqual(status,200)
+ nonce=json.loads(body)['nonce'];proof=nonce+':'+hmac.new(key or self.admin_key,('ck-admin-login-v1\n'+nonce).encode(),hashlib.sha256).hexdigest()
+ c=http.client.HTTPConnection('127.0.0.1',self.port,timeout=10)
+ c.request('POST','/auth/login',body=b'',headers={'X-CK-Login':proof});r=c.getresponse();data=json.loads(r.read())
+ if r.status==200:
+ self.cookie=r.getheader('Set-Cookie').split(';',1)[0];self.csrf=data['csrf']
+ code=r.status;c.close();return code,proof
+ def request(self,method,path,body=None,headers=None,authenticated=True):
+ h={}
+ if authenticated and self.cookie:h={'Cookie':self.cookie,'X-CK-CSRF':self.csrf}
+ h.update(headers or {})
+ c=http.client.HTTPConnection('127.0.0.1',self.port,timeout=10);c.request(method,path,body=body,headers=h);r=c.getresponse();result=(r.status,r.read());c.close();return result
def request_headers(self,data,image_hash=None):
return {'X-CK-SHA256':image_hash or hashlib.sha256(data).hexdigest(),'Content-Type':'application/octet-stream'}
+ def protocol_proof(self,mode,key=None):
+ return {'X-CK-CSRF':self.csrf if key is None else '0'*64,'Content-Type':'text/plain'}
+ def protocol_reboot(self):
+ for name in ['ck-protocol-active','ck-protocol-pending']:(self.work/'var/run'/name).unlink(missing_ok=True)
+ lock=self.work/'var/run/ck-matter-request.lock'
+ if lock.exists():lock.rmdir()
+ self.assertEqual(self.run_updater('--protocol-boot').returncode,0)
+ def test_led_admin_auth_validation_persistence_noop_and_preservation(self):
+ for key,value in [('identity/factory',b'unique'),('matter/fabric',b'paired'),('config/wifi',b'saved')]:self.assertEqual(self.put(key,value),0)
+ self.assertEqual(self.lib.ck_energy_save(1234567,0),0)
+ self.start_server()
+ self.assertEqual(self.request('GET','/admin/led',authenticated=False)[0],401)
+ config=b'CKLED1 inverse 1 1380 420 480 pool.ntp.org\n'
+ self.assertEqual(self.request('POST','/admin/led',config,authenticated=False)[0],401)
+ self.assertEqual(self.request('POST','/admin/led',config,headers={'X-CK-CSRF':'0'*64})[0],401)
+ for bad in [b'CKLED1 unknown 0 1380 420 480 pool.ntp.org',b'CKLED1 smart 2 1380 420 480 pool.ntp.org',b'CKLED1 smart 4294967296 1380 420 480 pool.ntp.org',b'CKLED1 smart 1 420 420 480 pool.ntp.org',b'CKLED1 smart 0 1380 420 481 pool.ntp.org',b'CKLED1 smart 0 1380 420 480 evil;cmd',b'CKLED1 smart 0 1380 420 480 server"',b'CKLED1 smart 0 1380 420 480 ntp extra']:
+ self.assertEqual(self.request('POST','/admin/led',bad)[0],400,bad)
+ self.assertEqual(self.request('POST','/admin/led',config)[0],200)
+ before=self.flash.read_bytes();self.assertEqual(self.request('POST','/admin/led',config)[0],200)
+ self.assertEqual(self.flash.read_bytes(),before)
+ d=json.loads(self.request('GET','/admin/led')[1]);self.assertEqual((d['mode'],d['schedule'],d['start'],d['end'],d['utc_offset']),('inverse',True,1380,420,480))
+ self.assertEqual(self.lib.ck_store_import(),0);self.assertEqual(self.get('config/led'),(0,config))
+ for key,value in [('identity/factory',b'unique'),('matter/fabric',b'paired'),('config/wifi',b'saved')]:self.assertEqual(self.get(key),(0,value))
+ self.assertEqual(self.energy()[1],1234567)
+ self.assertEqual(self.lib.ck_store_factory_clear(),0);self.assertEqual(self.get('config/led')[0],1)
+
+ def test_led_modes_priority_patterns_and_cross_midnight(self):
+ class Config(ctypes.Structure):_fields_=[('mode',ctypes.c_int),('schedule',ctypes.c_int),('start',ctypes.c_int),('end',ctypes.c_int),('offset',ctypes.c_int),('ntp',ctypes.c_char*128)]
+ class Input(ctypes.Structure):_fields_=[(n,ctypes.c_int) for n in ['known','on','load','setup','joining','pairing','error','identify','time_valid']]+[('utc_s',ctypes.c_uint64),('now_ms',ctypes.c_uint64)]
+ class Output(ctypes.Structure):_fields_=[('on',ctypes.c_int),('reason',ctypes.c_int),('night',ctypes.c_int)]
+ self.lib.ck_led_evaluate.argtypes=[ctypes.POINTER(Config),ctypes.POINTER(Input)];self.lib.ck_led_evaluate.restype=Output
+ c=Config(0,0,1380,420,480,b'pool.ntp.org');i=Input();i.known=i.on=i.load=1;i.now_ms=0
+ evaluate=lambda:self.lib.ck_led_evaluate(ctypes.byref(c),ctypes.byref(i))
+ for mode,expected in enumerate([1,1,0,1,1,0]):c.mode=mode;self.assertEqual(evaluate().on,expected)
+ c.mode=0;i.setup=i.joining=i.pairing=i.error=i.identify=1;self.assertEqual(evaluate().reason,6)
+ i.identify=0;self.assertEqual(evaluate().reason,5);i.error=0;self.assertEqual(evaluate().reason,4)
+ i.setup=0;self.assertEqual(evaluate().reason,3);i.joining=0;self.assertEqual(evaluate().reason,2)
+ for reason,field,expected in [(2,'pairing',[1,0,1,0,0]),(5,'error',[1,0,1,0,1])]:
+ i.pairing=0;setattr(i,field,1)
+ for t,want in zip([0,100,200,300,400],expected):i.now_ms=t;self.assertEqual(evaluate().on,want)
+ setattr(i,field,0)
+ c.schedule=1;i.time_valid=1
+ for minute,night in [(22*60+59,0),(23*60,1),(0,1),(6*60+59,1),(7*60,0)]:
+ i.utc_s=1704067200+((minute-480)%1440)*60;self.assertEqual(evaluate().night,night)
+ i.utc_s=1704067200;i.time_valid=0;self.assertEqual(evaluate().night,0)
+ c.mode=5;i.error=1;i.now_ms=0;self.assertEqual((evaluate().reason,evaluate().on),(5,1))
+ c.mode=1;self.assertEqual(evaluate().reason,0)
+ i.known=0;c.mode=2;self.assertEqual(evaluate().on,0)
+
+ def test_led_find_and_phone_time_are_ram_only_and_bounded(self):
+ self.start_server();before=self.flash.read_bytes()
+ self.assertEqual(self.request('POST','/admin/led-find')[0],200)
+ deadline=int.from_bytes((self.work/'var/run/ck-led-find').read_bytes(),'big')
+ self.assertTrue(14000<=deadline-int(time.monotonic()*1000)<=15000)
+ for bad in [b'0',b'-1',b'99999999999',b'1704067200oops',b'1704067200 ']:self.assertEqual(self.request('POST','/admin/led-time',bad)[0],400)
+ self.assertEqual(self.request('POST','/admin/led-time',b'1792512000')[0],200)
+ b=(self.work/'var/run/ck-led-clock').read_bytes();self.assertEqual(b[:8],b'CKLEDT1\n');self.assertEqual(int.from_bytes(b[16:24],'big'),1792512000)
+ self.assertEqual(self.flash.read_bytes(),before)
+
+ def test_led_ntp_validates_peer_nonce_stratum_and_keeps_system_clock(self):
+ udp=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+ try:udp.bind(('127.0.0.1',123))
+ except PermissionError:udp.close();self.skipTest('UDP 123 fixture requires a permitted local bind')
+ udp.settimeout(8);errors=[]
+ def reply():
+ try:
+ for valid in (False,True):
+ q,peer=udp.recvfrom(256);self.assertEqual(len(q),48)
+ r=bytearray(48);r[0]=0x24;r[1]=2 if valid else 0;r[24:32]=q[40:48]
+ struct.pack_into('>I',r,40,(int(time.time())+2208988800)&0xffffffff);udp.sendto(r,peer)
+ except Exception as e:errors.append(e)
+ thread=threading.Thread(target=reply);thread.start();before=self.flash.read_bytes();wall=time.time();mono=time.monotonic()
+ try:
+ self.assertNotEqual(self.run_updater('--led-ntp','127.0.0.1').returncode,0)
+ self.assertFalse((self.work/'var/run/ck-led-clock').exists())
+ self.assertEqual(self.run_updater('--led-ntp','127.0.0.1').returncode,0)
+ clock=(self.work/'var/run/ck-led-clock').read_bytes();self.assertEqual(int.from_bytes(clock[24:28],'big'),1)
+ self.assertLess(abs(int.from_bytes(clock[16:24],'big')-time.time()),3)
+ self.assertLess(abs((time.time()-wall)-(time.monotonic()-mono)),1)
+ self.assertEqual(self.flash.read_bytes(),before)
+ finally:thread.join(timeout=9);udp.close()
+ self.assertFalse(thread.is_alive());self.assertEqual(errors,[])
+ # No responder: the isolated worker must terminate within its deadline.
+ begun=time.monotonic();self.assertNotEqual(self.run_updater('--led-ntp','127.0.0.1').returncode,0);self.assertLess(time.monotonic()-begun,13)
+
+ def test_led_worker_relay_load_stale_identify_and_ota_latch(self):
+ for path in ['proc/wlan0','var/log']:(self.work/path).mkdir(parents=True,exist_ok=True)
+ gpio=self.work/'proc/wlan0/gpio_ctrl';gpio.write_bytes(b' '*32)
+ (self.work/'var/run/ck-protocol-active').write_text('homekit');(self.work/'var/run/ck-setup-state').write_text('state=online\n')
+ self.assertEqual(self.put('config/led',b'CKLED1 relay 1 1380 420 480 ntp.invalid\n'),0)
+ # A deliberately slow DNS/NTP child must not stop the GPIO/control loop.
+ (self.work/'bin/ck-updater').write_text('#!/bin/sh\n: >"$CK_TEST_ROOT/var/run/ck-led-ntp-started"\nsleep 4\nexit 1\n')
+ (self.work/'bin/ck-updater').chmod(0o755)
+ def sample(seq=1,age=0,power=6000,on=True):
+ now=int(time.monotonic()*1000)
+ data=b'CKLEDHW1'+struct.pack('>QQQQIIII',now,now-age,now-age,0,power,1|4|8|16|(2 if on else 0),seq,0)
+ (self.work/'var/run/ck-led-homekit.bin').write_bytes(data)
+ def state():
+ b=(self.work/'var/run/ck-led-state').read_bytes();return b[16],b[17],b[18],b[19]
+ def until(check,seconds=4):
+ end=time.monotonic()+seconds
+ while time.monotonic()Q',deadline))
+ until(lambda:state()[1]==6);until(lambda:state()[1]==0)
+ (self.work/'var/run/ck-ota/queued').write_bytes(b'1');latched=gpio.read_bytes()
+ (self.work/'var/run/ck-led-homekit-identify').write_bytes(struct.pack('>Q',int(time.monotonic()*1000)+15000));time.sleep(.7)
+ self.assertEqual(gpio.read_bytes(),latched);self.assertIsNone(worker.poll())
+ finally:worker.terminate();worker.wait(timeout=5);worker.stdout.close();worker.stderr.close()
+
+ def test_protocol_switch_keeps_identity_fabrics_wifi_hap_and_kwh(self):
+ self.assertEqual(self.run_updater('--protocol-boot').returncode,0)
+ original={k:self.get(k) for k in ['identity/device','identity/diag','identity/update']}
+ for key,value in {'matter/fabric':b'paired','platform/chip_kvs':b'paired cache','wifi/fixture':b'saved wifi','config/led':b'CKLED1 off 1 1380 420 480 ntp.invalid\n'}.items():
+ self.assertEqual(self.put(key,value),0);original[key]=(0,value)
+ self.assertEqual(self.lib.ck_energy_save(987654321,123),0)
+ before=self.flash.read_bytes();self.start_server()
+ self.assertEqual(json.loads(self.request('GET','/protocol')[1]),{'selected':'matter','active':'matter','restart_pending':False})
+ for mode in ['homekit','matter']:
+ self.assertEqual(self.request('POST','/protocol',mode,self.protocol_proof(mode))[0],200)
+ self.assertEqual(self.get('config/protocol'),(0,mode.encode()))
+ state=json.loads(self.request('GET','/protocol')[1]);self.assertTrue(state['restart_pending'])
+ self.assertNotEqual(state['active'],mode)
+ # The snapshot is immutable through server restarts and repeated calls.
+ self.assertEqual(self.run_updater('--protocol-boot').returncode,0)
+ self.assertEqual(json.loads(self.request('GET','/protocol')[1])['active'],state['active'])
+ self.assertEqual(self.request('POST','/protocol',mode,self.protocol_proof(mode))[0],409)
+ self.protocol_reboot()
+ self.assertEqual(json.loads(self.request('GET','/protocol')[1]),{'selected':mode,'active':mode,'restart_pending':False})
+ for key,value in original.items():self.assertEqual(self.get(key),value)
+ self.assertEqual(self.energy(),(0,987654321,123))
+ after=self.flash.read_bytes()
+ for a,b in [(0,JOURNAL),(0x3cf000,0x3d0000),(0x3df000,0x800000)]:self.assertEqual(before[a:b],after[a:b])
+ before=after
+ self.assertEqual(json.loads(self.request('POST','/protocol','matter',self.protocol_proof('matter'))[1])['status'],'unchanged')
+ self.assertEqual(before,self.flash.read_bytes())
+ def test_protocol_requires_session_csrf_and_same_origin(self):
+ self.start_server();before=self.flash.read_bytes()
+ self.assertEqual(self.request('POST','/protocol','homekit',authenticated=False)[0],401)
+ self.assertEqual(self.request('POST','/protocol','homekit',self.protocol_proof('homekit',b'0'*32))[0],401)
+ proof=self.protocol_proof('homekit')
+ self.assertEqual(self.request('POST','/protocol','homekit',{**proof,'Origin':'http://evil.example'})[0],403)
+ self.assertEqual(self.request('POST','/protocol','homekit\0',proof)[0],400)
+ self.assertEqual(self.request('POST','/protocol','HOMEKIT',proof)[0],400)
+ self.assertEqual(before,self.flash.read_bytes())
+ self.assertEqual(self.request('POST','/protocol','homekit',proof)[0],200)
+ self.assertEqual(self.request('POST','/protocol','homekit',proof)[0],409)
+ def test_protocol_flash_failure_has_no_success_or_pending_handoff(self):
+ os.environ['CK_FAIL_STORE']='before-commit';self.start_server()
+ self.assertEqual(self.request('POST','/protocol','homekit',self.protocol_proof('homekit'))[0],503)
+ self.assertEqual(self.get('config/protocol')[0],1)
+ self.assertFalse((self.work/'var/run/ck-protocol-pending').exists())
+ self.assertFalse((self.work/'var/run/ck-matter-request.lock').exists())
+ def test_protocol_invalid_preferences_fail_closed_and_operations_exclude_each_other(self):
+ self.assertEqual(self.put('config/protocol',b'matter\0'),0)
+ self.assertEqual(self.run_updater('--protocol-boot').returncode,0)
+ self.assertEqual((self.work/'var/run/ck-protocol-active').read_text(),'unavailable')
+ self.start_server()
+ self.assertEqual(json.loads(self.request('GET','/protocol')[1])['selected'],'unavailable')
+ operation=self.work/'var/run/ck-matter-request.lock';operation.mkdir()
+ before=self.flash.read_bytes()
+ self.assertEqual(self.request('POST','/protocol','homekit',self.protocol_proof('homekit'))[0],409)
+ self.assertEqual(before,self.flash.read_bytes());operation.rmdir()
+ self.assertEqual(self.run_updater('--stage',self.ota).returncode,0)
+ self.assertEqual(self.request('POST','/protocol','homekit',self.protocol_proof('homekit'))[0],200)
+ self.assertNotEqual(self.run_updater('--queue').returncode,0)
+ self.assertEqual(self.request('POST','/upload',self.ota.read_bytes(),self.request_headers(self.ota.read_bytes()))[0],409)
+ def test_protocol_owner_retains_lock_in_forked_homekit_daemon(self):
+ self.assertEqual(self.put('config/protocol',b'homekit'),0)
+ (self.work/'dev').mkdir();(self.work/'dev/ttyACM0').touch()
+ # Saved Wi-Fi without association/DHCP must not block MCU ownership.
+ (self.work/'var/run/ck-setup-boot').write_text('configured')
+ (self.work/'var/run/ck-setup-state').write_text('state=reconnecting\nerror=0\n')
+ hap=self.work/'bin/homekitserver'
+ hap.write_text('#!/usr/bin/python3\nimport os,time\nfrom pathlib import Path\n'
+ 'root=Path(os.environ["CK_TEST_ROOT"])\n'
+ '(root/"hap-launches").open("a").write("homekit\\n")\n'
+ 'pid=os.fork()\n'
+ 'if pid:\n'
+ ' while not (root/"proc"/str(pid)/"status").exists():time.sleep(.01)\n'
+ ' (root/"var/run/homekitserver.pid").write_text(str(pid))\n os._exit(0)\n'
+ 'p=root/"proc"/str(os.getpid());p.mkdir(parents=True)\n'
+ '(p/"status").write_text("Name:\\thomekitserver\\n")\n'
+ 'while True:time.sleep(1)\n');hap.chmod(0o700)
+ matter=self.work/'bin/matter-test-start';matter.write_text('#!/bin/sh\necho unexpected > "'+str(self.work/'unexpected-matter')+'"\n');matter.chmod(0o700)
+ process=subprocess.Popen([*self.runner,str(self.updater),'--run-protocol'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,start_new_session=True)
+ try:
+ until=time.monotonic()+5
+ while not (self.work/'var/run/homekitserver.pid').exists() and time.monotonic() "'+str(self.work/'unexpected-matter')+'"')]:
+ p=self.work/'bin'/name;p.write_text('#!/bin/sh\n'+body+'\n');p.chmod(0o700)
+ process=subprocess.Popen([*self.runner,str(self.updater),'--run-protocol'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,start_new_session=True)
+ try:
+ until=time.monotonic()+3
+ while not (self.work/'var/run/ck-rescue').exists() and time.monotonic()I',600000)+os.urandom(16)+new_key
+ self.assertEqual(self.request('POST','/auth/password',record.hex())[0],200)
+ self.assertEqual(self.get('admin/credential'),(0,record))
+ self.assertEqual(self.request('GET','/admin/state')[0],401)
+ self.assertEqual(self.login()[0],403)
+ self.admin_key=new_key;self.assertEqual(self.login()[0],200)
+ self.assertTrue(json.loads(self.request('GET','/auth/session')[1])['authenticated'])
+ def test_dashboard_remains_responsive_while_identity_import_holds_flash_lock(self):
+ self.start_server();lock=(self.work/'var/lock/ck-flash.lock').open('a+')
+ fcntl.flock(lock,fcntl.LOCK_EX)
+ try:
+ at=time.monotonic()
+ for path in ['/','/status','/measurements','/protocol','/auth/session']:
+ self.assertEqual(self.request('GET',path)[0],200)
+ self.assertLess(time.monotonic()-at,2)
+ self.assertFalse(json.loads(self.request('GET','/auth/session')[1])['storage_ready'])
+ finally:lock.close()
+ self.assertTrue(json.loads(self.request('GET','/auth/session')[1])['authenticated'])
+ def test_password_enrollment_is_local_setup_only_and_cannot_overwrite_account(self):
+ self.assertEqual(self.lib.ck_store_delete(b'admin/credential'),0)
+ record=self.admin_record;request=self.work/'var/run/ck-admin-enroll'
+ request.write_bytes(record)
+ self.assertNotEqual(self.run_updater('--enroll-admin').returncode,0)
+ self.assertEqual(self.get('admin/credential')[0],1)
+ (self.work/'var/run/ck-setup-state').write_text('state=setup\n')
+ request.write_bytes(record)
+ self.assertEqual(self.run_updater('--enroll-admin').returncode,0)
+ self.assertEqual(self.get('admin/credential'),(0,record))
+ self.assertTrue((self.work/'var/run/ck-admin-enroll-ok').exists())
+ request.write_bytes(record[:-1]+b'X')
+ self.assertNotEqual(self.run_updater('--enroll-admin').returncode,0)
+ self.assertEqual(self.get('admin/credential'),(0,record))
+ def test_explicit_energy_reset_is_atomic_and_allows_a_new_accumulation(self):
+ self.assertEqual(self.lib.ck_energy_save(5000000,123),0)
+ kept=self.get('admin/credential');before=self.flash.read_bytes()
+ os.environ['CK_FAIL_ENERGY']='before-commit'
+ self.assertNotEqual(self.lib.ck_energy_reset(),0)
+ os.environ.pop('CK_FAIL_ENERGY');self.assertEqual(self.energy(),(0,5000000,123))
+ self.assertEqual(self.lib.ck_energy_reset(),0);self.assertEqual(self.energy(),(0,0,0))
+ self.assertEqual(self.lib.ck_energy_save(17,19),0);self.assertEqual(self.energy(),(0,17,19))
+ self.assertEqual(self.get('admin/credential'),kept)
+ after=self.flash.read_bytes()
+ for a,b in [(0,0x3cf000),(0x3d0000,0x3df000),(0x3e0000,0x800000)]:self.assertEqual(before[a:b],after[a:b])
+ (self.work/'var/run/ck-protocol-active').write_text('homekit');self.start_server()
+ self.assertEqual(self.request('POST','/admin/energy-reset','')[0],200)
+ self.assertEqual(self.energy(),(0,0,0))
+ saved=json.loads(self.request('GET','/measurements')[1]);self.assertFalse(saved['available']);self.assertEqual(saved['saved_energy_mwh'],'0')
+ def test_matter_energy_reset_queues_to_owner_without_stale_writer_race(self):
+ self.assertEqual(self.lib.ck_energy_save(1234567,0),0)
+ (self.work/'var/run/ck-protocol-active').write_text('matter');self.start_server()
+ self.assertEqual(self.request('POST','/admin/energy-reset','')[0],503)
+ stamp=time.monotonic_ns()//1000000000
+ (self.work/'var/run/ck-matter-state.json').write_text(json.dumps({'updated_s':stamp,'fabrics':1},separators=(',',':')))
+ code,body=self.request('POST','/admin/energy-reset','');self.assertEqual(code,202)
+ request=json.loads(body)['request_id']
+ self.assertEqual((self.work/'var/run/ck-matter-request').read_text(),'E '+request+'\n')
+ self.assertEqual(self.request('POST','/protocol','homekit')[0],409)
+ self.assertEqual(self.energy(),(0,1234567,0))
+ def test_factory_clear_preserves_only_hardware_identity_and_ota_trust(self):
+ kept={k:self.get(k) for k in ['identity/device','identity/diag','identity/update']}
+ self.assertEqual(self.put('ota/floor',b'\0\0\0\x0b'),0);kept['ota/floor']=(0,b'\0\0\0\x0b')
+ for k in ['identity/onboarded','matter/fabric','platform/chip_kvs','wifi/fixture','config/protocol']:
+ self.assertEqual(self.put(k,b'old setting'),0)
+ self.assertEqual(self.run_updater('--factory-reset').returncode,0)
+ os.environ['CK_FAIL_STORE']='before-commit'
+ self.assertNotEqual(self.lib.ck_store_factory_clear(),0)
+ os.environ.pop('CK_FAIL_STORE');self.assertEqual(self.get('matter/fabric'),(0,b'old setting'))
+ self.assertEqual(self.get('control/factory-reset'),(0,b'CKRESET1'))
+ self.assertEqual(self.lib.ck_store_factory_clear(),0)
+ for k in ['admin/credential','identity/onboarded','matter/fabric','platform/chip_kvs','wifi/fixture','config/protocol','control/factory-reset']:
+ self.assertEqual(self.get(k)[0],1,k)
+ for k,v in kept.items():self.assertEqual(self.get(k),v)
+ self.assertEqual(self.get('config/needs-setup'),(0,b'\x01'))
+ def test_newer_programmer_recovery_adopts_pending_version_without_reset(self):
+ self.assertEqual(self.put('ota/floor',struct.pack('>I',6)),0)
+ self.assertEqual(self.put('ota/pending',struct.pack('>I',8)),0)
+ self.assertEqual(self.put('ota/attempts',struct.pack('>I',3)),0)
+ self.assertEqual(self.put('matter/fabric',b'keep paired'),0)
+ self.assertEqual(self.lib.ck_energy_save(7654321,123),0)
+ kept={k:self.get(k) for k in ['identity/device','identity/diag','identity/update','admin/credential','matter/fabric']}
+ (self.work/'etc/ck-update.meta').write_bytes(struct.pack('>III',0x434b0004,1,12))
+ before=self.flash.read_bytes()
+ self.assertEqual(self.run_updater('--boot').returncode,0)
+ self.assertEqual(self.get('ota/pending'),(0,struct.pack('>I',12)))
+ self.assertEqual(self.get('ota/attempts'),(0,struct.pack('>I',1)))
+ self.assertEqual(self.get('ota/floor'),(0,struct.pack('>I',6)))
+ for k,v in kept.items():self.assertEqual(self.get(k),v)
+ self.assertEqual(self.energy(),(0,7654321,123))
+ self.assertEqual(self.flash.read_bytes()[0x3e0000:],before[0x3e0000:])
+ self.assertEqual(self.run_updater('--confirm').returncode,0)
+ self.assertEqual(self.get('ota/floor'),(0,struct.pack('>I',12)))
+ self.assertEqual(self.get('ota/pending')[0],1)
+ def test_recovery_adoption_commit_failure_retries_without_erasing_configuration(self):
+ self.assertEqual(self.put('ota/pending',struct.pack('>I',8)),0)
+ self.assertEqual(self.put('matter/fabric',b'keep paired'),0)
+ (self.work/'etc/ck-update.meta').write_bytes(struct.pack('>III',0x434b0004,1,12))
+ os.environ['CK_FAIL_STORE']='before-commit'
+ self.assertNotEqual(self.run_updater('--boot').returncode,0)
+ os.environ.pop('CK_FAIL_STORE')
+ self.assertEqual(self.get('ota/pending'),(0,struct.pack('>I',8)))
+ self.assertEqual(self.get('matter/fabric'),(0,b'keep paired'))
+ self.assertEqual(self.run_updater('--boot').returncode,0)
+ self.assertEqual(self.get('ota/pending'),(0,struct.pack('>I',12)))
+ self.assertEqual(self.get('ota/attempts'),(0,struct.pack('>I',1)))
+ self.assertEqual(self.get('matter/fabric'),(0,b'keep paired'))
+ def test_factory_boot_resumes_after_wifi_or_final_commit_failure(self):
+ kept=self.get('identity/device');self.assertEqual(self.put('matter/fabric',b'paired'),0)
+ self.assertEqual(self.lib.ck_energy_save(9000000,12),0)
+ hap=self.work/'bin/homekitserver'
+ hap.write_text('#!/usr/bin/python3\nimport os\nwith open(os.environ["CK_FLASH_FILE"],"r+b") as f:\n f.seek(0x3e0000);f.write(b"PHRX"+bytes(0xa5d-4))\n')
+ hap.chmod(0o700)
+ fail=self.work/'wifi-fail';fail.touch()
+ wifi=self.work/'bin/ck-wificfg'
+ wifi.write_text('#!/bin/sh\ntest "$1" = unconfigure || exit 2\n[ ! -f "'+str(fail)+'" ] || exit 1\nprintf cleared > "'+str(self.work/'wifi-state')+'"\n')
+ wifi.chmod(0o700)
+ self.assertEqual(self.run_updater('--factory-reset').returncode,0)
+ self.assertNotEqual(self.run_updater('--protocol-boot').returncode,0)
+ self.assertEqual(self.energy(),(0,9000000,12));self.assertEqual(self.get('control/factory-reset'),(0,b'CKRESET1'))
+ self.assertEqual(self.get('matter/fabric'),(0,b'paired'))
+ fail.unlink();os.environ['CK_FAIL_STORE']='before-commit'
+ self.assertNotEqual(self.run_updater('--protocol-boot').returncode,0)
+ os.environ.pop('CK_FAIL_STORE');self.assertEqual(self.energy(),(0,0,0))
+ self.assertEqual(self.get('admin/credential'),(0,self.admin_record))
+ self.assertEqual(self.get('control/factory-reset'),(0,b'CKRESET1'))
+ self.assertEqual(self.run_updater('--protocol-boot').returncode,0)
+ for k in ['admin/credential','control/factory-reset','matter/fabric']:self.assertEqual(self.get(k)[0],1)
+ self.assertEqual(self.get('identity/device'),kept)
+ self.assertEqual((self.work/'var/run/ck-protocol-active').read_text(),'matter')
+ after=self.flash.read_bytes()
+ self.assertEqual(after[0x3e0000:0x3e0a5d],b'PHRX'+bytes(0xa5d-4))
+ self.assertEqual(after[0x3e0a5d:],self.image[0x3e0a5d:])
+ def test_wifi_change_excludes_protocol_reset_and_ota_until_completion(self):
+ self.start_server();request=b'CKW1'+bytes([7,8,1,0])+b'Fixture'+bytes(25)+b'password'+bytes(56)
+ self.assertEqual(len(request),104)
+ self.assertEqual(self.request('POST','/admin/wifi',request.hex())[0],202)
+ marker=self.work/'var/run/ck-network-changing';self.assertTrue(marker.exists())
+ # setupd has consumed the mailbox but is still joining/committing.
+ (self.work/'var/run/ck-admin-wifi').unlink()
+ self.assertEqual(self.request('POST','/protocol','homekit')[0],409)
+ self.assertEqual(self.request('POST','/admin/factory-reset','')[0],409)
+ self.assertNotEqual(self.run_updater('--stage',self.ota).returncode,0)
+ self.assertEqual(self.request('GET','/status')[0],200)
+ marker.unlink();self.assertEqual(self.run_updater('--stage',self.ota).returncode,0)
+ operation=self.work/'var/run/ck-matter-request.lock';operation.mkdir()
+ self.assertNotEqual(self.run_updater('--queue').returncode,0)
+ self.assertNotEqual(self.run_updater('--factory-reset').returncode,0)
+ operation.rmdir()
+ self.assertEqual(self.run_updater('--queue').returncode,0)
def meter_snapshot(self,**overrides):
now=time.monotonic_ns()//1000000
s=dict(published=now,flags=63,voltage=122313,current=12,power=0,
@@ -293,7 +830,7 @@ def test_http_partial_and_digest_mismatch_leave_no_staged_image(self):
self.assertEqual(self.request('POST','/upload',bytes(changed),headers)[0],422)
self.assertFalse((self.work/'var/run/ck-ota/image.ota').exists())
headers=self.request_headers(data);c=socket.create_connection(('127.0.0.1',self.port))
- request=f'POST /upload HTTP/1.1\r\nHost: 127.0.0.1:{self.port}\r\nContent-Length: {len(data)}\r\nX-CK-SHA256: {headers["X-CK-SHA256"]}\r\n\r\n'.encode()+data[:300]
+ request=f'POST /upload HTTP/1.1\r\nHost: 127.0.0.1:{self.port}\r\nContent-Length: {len(data)}\r\nX-CK-SHA256: {headers["X-CK-SHA256"]}\r\nCookie: {self.cookie}\r\nX-CK-CSRF: {self.csrf}\r\n\r\n'.encode()+data[:300]
c.sendall(request);c.shutdown(socket.SHUT_WR);c.recv(4096);c.close()
self.assertFalse((self.work/'var/run/ck-ota/image.ota').exists());self.assertFalse((self.work/'var/run/ck-ota/upload.ota').exists())
diff --git a/tools/admin_session.py b/tools/admin_session.py
new file mode 100644
index 0000000..59f1e99
--- /dev/null
+++ b/tools/admin_session.py
@@ -0,0 +1,32 @@
+"""Password login shared by local maintenance clients. No credential files."""
+import hashlib
+import hmac
+import http.cookiejar
+import json
+import re
+import urllib.request
+
+class AdminSession:
+ def __init__(self,base):
+ self.base=base;self.csrf=''
+ self.opener=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()))
+
+ def login(self,password):
+ with self.opener.open(self.base+'/auth/challenge',timeout=10) as r:challenge=json.load(r)
+ nonce=challenge.get('nonce','');salt=challenge.get('salt','')
+ if not re.fullmatch('[0-9a-f]{64}',nonce) or not re.fullmatch('[0-9a-f]{32}',salt) or challenge.get('iterations')!=600000:
+ raise ValueError('裝置的密碼驗證格式不符')
+ key=hashlib.pbkdf2_hmac('sha256',password.encode(),bytes.fromhex(salt),600000,32)
+ proof=nonce+':'+hmac.new(key,('ck-admin-login-v1\n'+nonce).encode(),hashlib.sha256).hexdigest()
+ request=urllib.request.Request(self.base+'/auth/login',data=b'',method='POST',headers={'X-CK-Login':proof})
+ with self.opener.open(request,timeout=15) as r:data=json.load(r)
+ if not data.get('authenticated') or not re.fullmatch('[0-9a-f]{64}',data.get('csrf','')):
+ raise ValueError('管理員登入失敗')
+ self.csrf=data['csrf']
+
+ def post(self,path,data,headers=None):
+ request=urllib.request.Request(self.base+path,data=data,method='POST',headers={**(headers or {}),'X-CK-CSRF':self.csrf})
+ with self.opener.open(request,timeout=120) as r:return json.load(r)
+
+ def get(self,path):
+ with self.opener.open(self.base+path,timeout=15) as r:return json.load(r)
diff --git a/tools/build.py b/tools/build.py
index 180ea4a..3a5a72a 100644
--- a/tools/build.py
+++ b/tools/build.py
@@ -113,8 +113,15 @@ def add(dest, data, mode=0o755):
("matter-test-start", "setup/matter-relay-start"),
("ck-setup-start", "setup/ck-setup-device-start"),
("ck-setup-backend", "setup/ck-setup-device-backend"),
+ ("ck-onboarding-start", "setup/ck-onboarding-start"),
+ ("ck-protocol-start", "setup/ck-protocol-start"),
+ ("ck-management-start", "setup/ck-management-start"),
+ ("ck-led-start", "setup/ck-led-start"),
+ ("ck-reset", "setup/ck-reset"),
+ ("ck-identity-start", "update/ck-identity-start"),
("ck-udhcpc", "setup/ck-udhcpc-fixed")):
add("bin/" + dest, (source / filename).read_bytes())
+ add("bin/ck-boot-guard", (REPO / "firmware/matter/artifacts/update/ck-boot-guard").read_bytes())
else:
rc = rc.replace("\n/bin/matter-diag-start &", "").replace("\n/bin/matter-test-start &", "")
rc += "\n/bin/exec-diag-start &\n/bin/exec-test-start &\n"
@@ -138,25 +145,59 @@ def add(dest, data, mode=0o755):
add("etc/ck-update.meta", struct.pack(">III", 0x434B0004, 1 if variant=="matter" else 2, version["software_version"]), 0o444)
add("etc/ck-version", (version["version"] + "\n").encode(), 0o444)
add("etc/ck-variant", (variant+"\n").encode(), 0o444)
+ if variant == "matter":
+ add("etc/ck-identity-policy", b"auto-v1\n", 0o444)
+ add("etc/ck-admin-policy", b"password-v1\n",0o444)
inittab = read_file(vendor_root, "etc/inittab").decode()
require("::restart:" not in inittab, "已有 PID1 restart action，拒絕覆寫")
+ if variant == "matter":
+ for script in ("ck-setup-start", "matter-diag-start", "matter-test-start"):
+ rc = rc.replace("/bin/" + script + " &", "# Supervised by PID1: " + script)
+ for script in ("ck-identity-start", "ck-onboarding-start", "ck-setup-start", "matter-diag-start", "ck-protocol-start", "ck-management-start", "ck-led-start"):
+ inittab += "\n::respawn:/bin/" + script
add("etc/inittab", (inittab + "\n::restart:/var/run/ck-ota/apply --pid1\n").encode(), 0o644)
# Import journal before diagnostics, identity generation, or Matter startup.
rc = rc.replace("# Start system script", "/bin/ck-ota-start\n\n# Start system script", 1)
require(rc.count("/bin/ck-ota-start\n") == 1, "OTA startup injection 不符")
+ # Replace the unused router GUI with our setup/update services. Keep all
+ # Wi-Fi, MFi and HAP dependencies and the original journal boundaries.
+ unused = set()
+ if variant == "matter":
+ unused = {p for p in file_inventory(vendor_root) if p == "bin/boa" or p == "web" or p.startswith("web/")}
+ rc = rc.replace("\nboa\n", "\n# Management: ck-setupd / ck-updated\n").replace("\ncd /web\n", "\n")
+ hap = read_file(vendor_root,"bin/homekitserver")
+ from homekit_led import build_payload,patch
+ payload,symbols=build_payload(binaries/"homekit-led")
+ hap,led_patch=patch(hap,payload,symbols)
+ add("etc/ck-homekit-led.json",(json.dumps(led_patch,separators=(",",":"))+"\n").encode(),0o444)
+ # The stock reset also changes a MIB MAC/accessory identifier. A long
+ # press now requests the shared durable factory reset. The CLI reset
+ # below clears pairing without changing the factory MAC/identity.
+ original_size = len(hap)
+ for command in (b"flash default-sw\0",b"homekitserver -c\0"):
+ require(hap.count(command) == 1,"HomeKit long-press reset command mismatch")
+ action=b"/bin/ck-reset" if command.startswith(b"flash") else b"true"
+ hap = hap.replace(command, action.ljust(len(command)-1,b" ")+b"\0")
+ # CLI -c runs only before protocols start, under a durable reset intent.
+ # Disable HMInitFlash's MIB/MAC randomization, retaining factory identity.
+ require(hap[0x1b8e4:0x1b8e8] == bytes.fromhex("24040001"),"HomeKit reset argument mismatch")
+ hap=hap[:0x1b8e4]+bytes.fromhex("24040000")+hap[0x1b8e8:]
+ hap = hap.replace(b"/home/" + b"al" + b"fred/", b"/home/vendor/")
+ require(len(hap) == original_size,"HomeKit patch changed ELF size")
+ add("bin/homekitserver",hap)
additions["etc/init.d/rcS"] = (rc.encode(), 0o755)
add("etc/ck-udhcpd.conf", (source / "setup/ck-udhcpd.conf").read_bytes(), 0o644)
# Equal-length debug-path substitutions preserve ELF layout and addresses.
for name, line in file_inventory(vendor_root).items():
fields = line.split()
- if len(fields) > 3 and fields[1] == "R" and name not in additions and name != "bin/upgfw":
+ if len(fields) > 3 and fields[1] == "R" and name not in additions and name not in unused and name != "bin/upgfw":
data = read_file(vendor_root, name)
clean = data.replace(b"/home/" + b"al" + b"fred/", b"/home/vendor/")
if clean != data:
require(len(clean) == len(data), "ELF 字串替换改變長度")
add(name, clean, int(fields[3], 8))
stale = {"bin/matterd-test", "bin/matter-diag", "bin/matter-test-start", "bin/matter-diag-start"} if variant=="exec-test" else set()
- root = repack(vendor_root, additions, remove=SECRET_FILES | {"bin/upgfw"} | stale)
+ root = repack(vendor_root, additions, remove=SECRET_FILES | {"bin/upgfw"} | stale | unused)
image = b"\xff" * START + root + b"\xff" * (SIZE - END)
atomic_write(output, image, mode=0o644)
write_json(output.with_suffix(".json"), {"format": "commandkit-region-v1", "variant": variant,
diff --git a/tools/check_public.py b/tools/check_public.py
index 12e3611..27d73cf 100644
--- a/tools/check_public.py
+++ b/tools/check_public.py
@@ -18,6 +18,7 @@ def public_paths(repository):
return sorted(p for p in repository.rglob("*")
if (p.is_file() or p.is_symlink()) and
not EXCLUDED & set(p.relative_to(repository).parts) and
+ not (p.name.startswith('commandkit-management') and p.suffix == '.json') and
p.name != ".DS_Store" and not p.name.endswith(".pyc"))
@@ -37,6 +38,11 @@ def audit(repository, release):
require(not PERSONAL.search(data),
"仍有可識別路径／歷史裝置名稱：" + rel)
require(path.suffix not in (".key", ".pseudo", ".cpio", ".sqsh"), "公開包含私人格式：" + rel)
+ if path.suffix == '.json':
+ try: record = json.loads(data)
+ except (ValueError, UnicodeDecodeError): record = None
+ require(not isinstance(record,dict) or record.get('format') != 'commandkit-management-v1',
+ '公開包含管理金鑰：' + rel)
if path.suffix == ".md":
text = data.decode()
for link in re.findall(r"(?4sIII', kernel)
+ require(signature == b'cr6c' and entry == 0x80500000 and mark == CANONICAL_MARK and
+ n == 0xfd002 and sum16(kernel[16:16+n]) == 0, 'kernel header／checksum 不符')
+ # A full-span kernel write replaces old kernel padding deterministically.
+ # The embedded loader and original compressed kernel bytes stay intact.
+ struct.pack_into('>II', kernel, 8, CANONICAL_MARK, KERNEL_SIZE - 16)
+ kernel[-2:] = b'\0\0'
+ struct.pack_into('>H', kernel, KERNEL_SIZE - 2, (-sum16(kernel[16:])) & 65535)
+ require(sha(kernel) == hashes['FACTORY'], '首次安裝 kernel 不符')
+ # +8 is a partition-relative seek in the upload container. Boa replaces it
+ # with the new boot mark after seeking, before handing the buffer to fwd.
+ struct.pack_into('>I', kernel, 8, 0x10000)
+ return bytes(kernel)
+
+
+def root_image(root, public=False):
+ require(len(root) == BUDGET, 'rootfs budget 不符')
+ checked = rootfs_check(root)
+ require(checked['checksum_extent'] <= BUDGET - 2, 'rootfs 沒有外層 checksum 空間')
+ payload = bytearray(root + journal_initializer(public))
+ # Keep the entire new persistent journal erased. Put the independent Boa
+ # checksum in unused filesystem padding, outside SquashFS/boot checksum.
+ payload[BUDGET-2:BUDGET] = b'\0\0'
+ struct.pack_into('>H', payload, BUDGET-2, (-sum16(payload)) & 65535)
+ require(sum16(payload) == 0 and payload[BUDGET:] == journal_initializer(public),
+ '首次安裝 journal／checksum 不符')
+ rootfs_check(payload)
+ return struct.pack('>4sIII', b'r6cr', 0, 0, len(payload)) + payload
+
+
+def inspect(data):
+ require(len(data) == KERNEL_SIZE + 16 + PART_SIZE + 16, '首次安裝檔案大小不符')
+ require(data[:4] == b'cr6c' and struct.unpack_from('>III', data, 4) ==
+ (0x80500000, 0x10000, KERNEL_SIZE-16), 'kernel 上傳 header 不符')
+ require(sum16(data[16:KERNEL_SIZE]) == 0, 'kernel checksum 不符')
+ canonical = bytearray(data[:KERNEL_SIZE])
+ struct.pack_into('>I', canonical, 8, CANONICAL_MARK)
+ require(sha(canonical) == identities()['FACTORY'], 'kernel 內容不符')
+ signature, _, burn, n = struct.unpack_from('>4sIII', data, KERNEL_SIZE)
+ require(signature == b'r6cr' and burn == 0 and n == PART_SIZE, 'rootfs 上傳 header 不符')
+ payload = data[KERNEL_SIZE+16:KERNEL_SIZE+16+n]
+ require(sum16(payload) == 0, 'rootfs 上傳 checksum 不符')
+ rootfs_check(payload)
+ require(payload[BUDGET:] in (journal_initializer(False), journal_initializer(True)),
+ '首次安裝 journal 不符')
+ require(data[-16:] == b'dual' + bytes(12), 'dual trailer 不符')
+ return payload[:BUDGET]
+
+
+def prepare(reference, release, manifest, profile, output, public=False, factory_template=None):
+ output = Path(output)
+ require(not output.exists() and not output.with_suffix('.json').exists(), '輸出已存在')
+ root, meta = load_release(release, manifest)
+ require(meta['variant'] == 'matter', '首次安裝只支援 Matter 版')
+ version = struct.unpack('>III', read_file(root, 'etc/ck-update.meta'))[2]
+ require(version >= 6, '首次安裝需使用含 factory OTA 相容性支援的 v0.2.4 以上')
+ require((reference is None) != (factory_template is None), '請指定一種 kernel 來源')
+ if factory_template is not None:
+ require(meta['compatibility'] == json.loads((ROOT/'third_party/platform.json').read_text()),
+ '公開模板的平台不相容')
+ template = Path(factory_template).read_bytes()
+ inspect(template)
+ kernel = template[:KERNEL_SIZE]
+ else:
+ kernel = factory_kernel(Path(reference).read_bytes(), meta['compatibility'])
+ if public:
+ require(profile is None and version >= 7, '公開版需 v0.2.5 以上且不指定 profile')
+ require(read_file(root,'etc/ck-identity-policy') == b'auto-v1\n', '映像未支援自動產生身分')
+ data = kernel + root_image(root, True) + b'dual' + bytes(12)
+ packed = inspect(data)
+ require(not {'etc/matter-device.key','etc/matter-diag.key','etc/ck-setup-ap.bin'} &
+ set(file_inventory(packed)), '公開首次安裝檔不可含裝置金鑰')
+ else:
+ require(profile is not None, '私人安裝需指定 profile')
+ with profile_lock(profile) as folder:
+ require(set(p.name for p in folder.iterdir()) == {'.lock'}, '首次安裝請使用新的專用 profile')
+ diag = secrets.token_hex(32).encode() + b'\n'
+ device = secrets.token_bytes(32)
+ atomic_write(folder/'diag.key', diag)
+ atomic_write(folder/'device-identity.key', device)
+ write_json(folder/'factory-profile.json', {
+ 'format': 'commandkit-factory-profile-v1', 'installation_id': secrets.token_hex(16),
+ 'model': 'CMNDKT-004', 'version': meta['release'],
+ 'single_outlet_only': True, 'hardware_binding': 'not_read_from_target'})
+ personalized = repack(root, {'etc/matter-diag.key': (diag, 0o600),
+ 'etc/matter-device.key': (device, 0o600)})
+ data = kernel + root_image(personalized) + b'dual' + bytes(12)
+ packed_root = inspect(data)
+ require(read_file(packed_root, 'etc/matter-diag.key') == diag and
+ read_file(packed_root, 'etc/matter-device.key') == device,
+ '私人身分重打包不一致')
+ require(len(data) < 0x400000, '上傳檔案超過 4 MiB')
+ atomic_write(output, data, mode=0o644 if public else 0o600)
+ write_json(output.with_suffix('.json'), {
+ 'format': 'commandkit-boa-first-install-v1', 'model': 'CMNDKT-004',
+ 'release': meta['release'], 'software_version': version,
+ 'size': len(data), 'sha256': sha(data),
+ 'upload_endpoint': '/boafrm/formUpload', 'file_field': 'binary',
+ 'required_stock_version': '10219', 'required_active_bank': 2,
+ 'required_dual_firmware': True, 'target_bank': 1,
+ 'write_ranges': [[0x10000, START], [START, 0x3e0000]],
+ 'journal_initialized': [END, 0x3e0000],
+ 'identity_initialization': 'first_boot_credited_randomness' if public else 'private_bootstrap',
+ 'preserved_ranges': [[0, 0x10000], [0x3e0000, SIZE]],
+ 'private_single_outlet_image': not public,
+ 'device_credentials_included': not public,
+ 'rootfs_source_sha256': meta['sha256'],
+ 'physical_factory_install_test': 'not_performed',
+ 'target_compatibility_checked_online': False})
+ return output
+
+
+def main():
+ p = argparse.ArgumentParser(description=__doc__)
+ sources = p.add_mutually_exclusive_group(required=True)
+ sources.add_argument('--reference', type=Path, help='已驗證的本機平台參考映像')
+ sources.add_argument('--factory-template', type=Path, help='已驗證的公開首次安裝 BIN，只取 kernel')
+ p.add_argument('--release', type=Path, required=True)
+ p.add_argument('--manifest', type=Path, required=True)
+ group = p.add_mutually_exclusive_group(required=True)
+ group.add_argument('--profile', type=Path)
+ group.add_argument('--public', action='store_true', help='公開共用；首次開機自行產生身分')
+ p.add_argument('--output', type=Path, required=True)
+ a = p.parse_args()
+ path = prepare(a.reference, a.release, a.manifest, a.profile, a.output, a.public, a.factory_template)
+ print(('公開' if a.public else '私人') + '首次安裝檔已產生；未連線或寫入插座：' + str(path))
+
+
+if __name__ == '__main__':
+ main()
diff --git a/tools/fwlib.py b/tools/fwlib.py
index ae78be7..110d2e4 100644
--- a/tools/fwlib.py
+++ b/tools/fwlib.py
@@ -65,6 +65,23 @@ def write_json(path, value, overwrite=False):
overwrite=overwrite)
+def profile_diag_key(profile):
+ """Accept a legacy profile directory/key or the setup page's private JSON."""
+ path = Path(profile)
+ if path.is_dir():
+ path = path / 'diag.key'
+ require(path.is_file() and path.stat().st_size <= 4096, '管理金鑰檔案不符')
+ raw = path.read_bytes()
+ if path.suffix == '.json':
+ record = json.loads(raw)
+ require(isinstance(record, dict) and record.get('format') == 'commandkit-management-v1' and
+ isinstance(record.get('diag_key'), str) and
+ re.fullmatch(r'[0-9a-f]{64}', record['diag_key']), '管理金鑰 JSON 格式不符')
+ return bytes.fromhex(record['diag_key'])
+ require(re.fullmatch(b'[0-9a-f]{64}\n',raw), '管理金鑰格式不符')
+ return bytes.fromhex(raw.decode().strip())
+
+
def rootfs_check(data, budget=BUDGET):
require(len(data) >= 96 and data[:4] == b"hsqs", "rootfs magic 不符")
extent = struct.unpack_from(">I", data, 8)[0] + 0x282
@@ -94,7 +111,23 @@ def compatibility(image):
def compatible(image, expected):
require(len(image) == SIZE, "備份大小不是 8 MiB")
- require(compatibility(image) == expected, "kernel／Bank 2 不相容；拒絕寫入")
+ actual = compatibility(image)
+ matches = actual == expected
+ if not matches and actual["bank2_executable_sha256"] == expected.get("bank2_executable_sha256"):
+ # Match the same strict alternative accepted by ck_ota.c. Boa's
+ # first-install container wraps the verified kernel in a full-span
+ # length/checksum; only its mutable bank mark is canonicalized.
+ text = (Path(__file__).resolve().parents[1] /
+ "firmware/matter/src/update/ck_factory.h").read_text()
+ hashes = dict(re.findall(r'#define CK_(LEGACY|FACTORY)_KERNEL_SHA256 "([0-9a-f]{64})"', text))
+ kernel = bytearray(image[0x10000:START])
+ magic, entry, mark, length = struct.unpack_from(">4sIII", kernel)
+ if (expected.get("bank1_kernel_sha256") == hashes.get("LEGACY") and
+ magic == b"cr6c" and entry == 0x80500000 and
+ mark >= 0x80000002 and length == 0x11fff0):
+ struct.pack_into(">I", kernel, 8, 0x8000004d)
+ matches = sha(kernel) == hashes.get("FACTORY")
+ require(matches, "kernel／Bank 2 不相容；拒絕寫入")
image_checks(image)
diff --git a/tools/generate_update.py b/tools/generate_update.py
index 5e43b33..4c31b14 100644
--- a/tools/generate_update.py
+++ b/tools/generate_update.py
@@ -14,6 +14,8 @@ def main():
if not re.fullmatch(r'[A-Za-z0-9.-]{1,31}',label):raise ValueError('version')
if not config['catalog_url'].startswith('https://'):raise ValueError('catalog_url')
source=ROOT/'firmware/matter/src'
+ password=(source/'update/password.js').read_text()
+ write_if_changed(source/'update/password_script.h','/* Generated public password worker. */\nstatic const char ck_password_script[] = '+json.dumps(password,ensure_ascii=False)+';\n')
write_if_changed(source/'matter-app-device/Version.h','#pragma once\n#define CK_SOFTWARE_VERSION '+str(version)+'\n#define CK_VERSION_STRING '+json.dumps(label)+'\n')
page=(source/'update/update.html').read_text().replace('{{CATALOG_URL}}',json.dumps(config['catalog_url'])).replace('{{SCRIPT}}',(source/'update/update.js').read_text())
write_if_changed(source/'update/update_page.h','/* Generated by tools/generate_update.py. */\nstatic const char ck_update_page[] = '+json.dumps(page,ensure_ascii=False)+';\n')
diff --git a/tools/homekit_led.py b/tools/homekit_led.py
new file mode 100644
index 0000000..5d3511e
--- /dev/null
+++ b/tools/homekit_led.py
@@ -0,0 +1,59 @@
+"""Reproducible, hash-bound 10219 LED observer patch. Never accesses an outlet."""
+import hashlib,json,struct,subprocess
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[1]
+ORIGINAL_SHA='2d50339436759f3d602c150fb4f1a42f0fdf122fc18e9a4f54f6e6b07d7a0c62'
+VADDR=0x630000
+# Every site is an original read() call, with its delay slot preserved.
+READS={0x43335c:'ck_hap_read_relay',0x433cd0:'ck_hap_read_power',0x434528:'ck_hap_read_relay'}
+def sha(b):return hashlib.sha256(b).hexdigest()
+def build_payload(dest,test=False):
+ from build import llvm_tool,FLAGS
+ dest=Path(dest);dest.mkdir(parents=True,exist_ok=True);src=ROOT/'firmware/homekit-led/src'
+ objects=[]
+ for name,path in [('hook',src/'hook.c'),('bridge',src/'bridge.S'),('syscall',ROOT/'firmware/matter/src/linux_o32.S')]:
+ obj=dest/(name+'.o');subprocess.run([llvm_tool('clang'),*FLAGS,*( ['-DCK_LED_HOOK_TEST'] if test else []),'-c',str(path),'-o',str(obj)],check=True);objects.append(obj)
+ elf=dest/'hook.elf'
+ subprocess.run([llvm_tool('ld.lld'),'-m','elf32btsmip','--gc-sections',*[v for name in ['ck_hap_read_relay','ck_hap_read_power','ck_hap_identify','ck_hap_identify_start']+(['ck_hap_test_entry'] if test else []) for v in ['-u',name]],'--no-undefined','--build-id=none','-T',str(src/'payload.ld'),*map(str,objects),'-o',str(elf)],check=True)
+ symbols={}
+ for line in subprocess.check_output([llvm_tool('llvm-nm'),'-n',str(elf)],text=True).splitlines():
+ v=line.split()
+ if len(v)==3:symbols[v[2]]=int(v[0],16)
+ raw=dest/'hook.bin';subprocess.run([llvm_tool('llvm-objcopy'),'-O','binary',str(elf),str(raw)],check=True)
+ asm=subprocess.check_output([llvm_tool('llvm-objdump'),'-d',str(elf)],text=True)
+ import re
+ # Probe-only assembly sections are discarded by the linker below or must
+ # be excluded: this payload never calls LL/SC/TLS CPU probes.
+ if re.search(r'\s(?:ll|sc|sync|rdhwr|lwl|lwr|swl|swr|lwc1|swc1|ldc1|sdc1|pref)\s',asm):raise ValueError('unsupported hook ISA')
+ (dest/'symbols.json').write_text(json.dumps(symbols,indent=2)+'\n')
+ return raw.read_bytes(),symbols
+
+def patch(original,payload,symbols,test=False):
+ if sha(original)!=ORIGINAL_SHA:raise ValueError('HomeKit LED: original 10219 hash mismatch')
+ b=bytearray(original);edits=[]
+ def edit(off,old,new):
+ if b[off:off+len(old)]!=old:raise ValueError('HomeKit LED patch site mismatch: '+hex(off))
+ b[off:off+len(old)]=new;edits.append({'offset':off,'old':old.hex(),'new':new.hex()})
+ def jump(addr,target,old,link=False):edit(addr-0x400000,old,struct.pack('>I',(0x0c000000 if link else 0x08000000)|(target>>2)))
+ for addr,name in READS.items():jump(addr,symbols[name],bytes.fromhex('0320f809'),True)
+ # Identify_LEDSetup is also called during GPIO initialization. All LED
+ # levels belong to ck-led; suppress this legacy low-level entry entirely.
+ edit(0x432d24-0x400000,original[0x32d24:0x32d30],bytes.fromhex('03e000080000102100000000'))
+ for addr,name in [(0x432ea4,'ck_hap_identify'),(0x43247c,'ck_hap_identify_start')]:
+ jump(addr,symbols[name],original[addr-0x400000:addr-0x400000+4]);edit(addr-0x400000+4,original[addr-0x400000+4:addr-0x400000+8],b'\0'*4)
+ edit(0x33048,bytes.fromhex('0320f80924060006'),b'\0'*8) # only GPIO6 configuration; retain GPIO0/5
+ # Reuse the reserved PT_NULL slot, keeping the mapped PHDR table and all
+ # original load segments/addresses unchanged. BSS comes from p_memsz.
+ ph=52+7*32;old=bytes(b[ph:ph+32]);assert struct.unpack('>8I',old)==(0,0,0,0,0,0,0,4)
+ at=(len(b)+65535)&~65535;end=symbols['__payload_end'];assert VADDR+len(payload)<=end8I',1,at,VADDR,VADDR,len(payload),end-VADDR,7,65536))
+ if test:edit(24,original[24:28],struct.pack('>I',symbols['ck_hap_test_entry']))
+ b.extend(b'\0'*(at-len(b)));b.extend(payload)
+ record={'original_sha256':sha(original),'original_size':len(original),'payload_offset':at,'payload_size':len(payload),'payload_memsize':end-VADDR,'edits':edits,'patched_sha256':sha(b)}
+ return bytes(b),record
+
+def restore(patched,record):
+ b=bytearray(patched)
+ for e in record['edits']:
+ off=e['offset'];new=bytes.fromhex(e['new']);assert b[off:off+len(new)]==new;b[off:off+len(new)]=bytes.fromhex(e['old'])
+ b=b[:record['original_size']];assert sha(b)==ORIGINAL_SHA;return bytes(b)
diff --git a/tools/ota.py b/tools/ota.py
index 87740ea..496d491 100644
--- a/tools/ota.py
+++ b/tools/ota.py
@@ -89,6 +89,19 @@ def catalog(packages, base_url, output):
write_json(output, {"format": "commandkit-catalog-v1", "updates": entries})
+def validate_catalog_upgrade(previous, incoming):
+ """Keep supported channels monotonic; retire the legacy exec-test channel."""
+ updates=incoming.get('updates',[])
+ versions={item['variant']:item['software_version'] for item in updates}
+ require('matter' in versions and len(versions)==len(updates), 'Missing or duplicate Matter update channel')
+ for item in previous.get('updates',[]):
+ variant=item['variant']
+ if variant not in versions:
+ require(variant=='exec-test','Refusing to remove a supported update channel')
+ else:
+ require(versions[variant]>=item['software_version'],'Refusing to replace the feed with an older release')
+
+
def main():
p = argparse.ArgumentParser(description=__doc__)
commands = p.add_subparsers(dest="command", required=True)
diff --git a/tools/release.py b/tools/release.py
index eccc62a..26925e7 100644
--- a/tools/release.py
+++ b/tools/release.py
@@ -20,8 +20,10 @@ def main():
p.add_argument('--output',type=Path,required=True)
p.add_argument('--template',type=Path,help='已下載的固定公開基底 BIN')
p.add_argument('--sdk',type=Path,default=WORK/'deps/connectedhomeip')
+ p.add_argument('--include-exec-test',action='store_true',help='只供重建 v0.2.8 或更早的歷史診斷版')
p.add_argument('--skip-compile',action='store_true',help='使用剛完成的本機建置產物')
a=p.parse_args();config=json.loads((ROOT/'version.json').read_text());lock=json.loads((ROOT/'third_party/release-base.json').read_text())
+ require(not a.include_exec_test or config['software_version']<=10,'診斷版尚未遷移密碼設定，不得發行新版診斷 OTA')
out=a.output.resolve();require(not out.exists(),'輸出已存在，請使用新的版本目錄');out.mkdir(parents=True)
base=ROOT/'artifacts/update-base';base.mkdir(parents=True,exist_ok=True)
image=a.template or base/'matter-8m-region.bin';manifest=image.with_suffix('.json')
@@ -41,22 +43,25 @@ def main():
for script in ('build_updates.sh','build_uclibc_matter_device.sh','build_setup_device.sh','build_setup_legacy.sh'):
call([*docker,'sh','tools/'+script])
call(['python3',ROOT/'tools/build.py','matter','--binaries',WORK/'artifacts/softap-device-code','--base',image,'--template-manifest',manifest,'--output',out/'matter-8m-region.bin'])
- exec_binaries=ROOT/'firmware/exec-test/artifacts'
- exec_binaries.mkdir(parents=True,exist_ok=True)
- for name,source in [('ck-wificfg',WORK/'artifacts/softap/ck-wificfg'),
- ('ck-wifiscan',WORK/'artifacts/softap-device-code/ck-wifiscan'),
- ('ck-lease',WORK/'artifacts/softap-device-code/ck-lease')]:
- require(source.exists(),'缺少共用服務：'+str(source));shutil.copy2(source,exec_binaries/name)
- call(['python3',ROOT/'tools/build.py','exec-test','--binaries',exec_binaries,'--base',image,'--template-manifest',manifest,'--output',out/'exec-test-8m-region.bin'])
package=out/'matter.ota'
pack(out/'matter-8m-region.bin',out/'matter-8m-region.json',a.private,config['software_version'],config['version'],package)
- exec_package=out/'exec-test.ota'
- pack(out/'exec-test-8m-region.bin',out/'exec-test-8m-region.json',a.private,config['software_version'],config['version'],exec_package)
+ packages=[package]
+ if a.include_exec_test:
+ exec_binaries=ROOT/'firmware/exec-test/artifacts'
+ exec_binaries.mkdir(parents=True,exist_ok=True)
+ for name,source in [('ck-wificfg',WORK/'artifacts/softap/ck-wificfg'),
+ ('ck-wifiscan',WORK/'artifacts/softap-device-code/ck-wifiscan'),
+ ('ck-lease',WORK/'artifacts/softap-device-code/ck-lease')]:
+ require(source.exists(),'缺少共用服務：'+str(source));shutil.copy2(source,exec_binaries/name)
+ call(['python3',ROOT/'tools/build.py','exec-test','--binaries',exec_binaries,'--base',image,'--template-manifest',manifest,'--output',out/'exec-test-8m-region.bin'])
+ exec_package=out/'exec-test.ota'
+ pack(out/'exec-test-8m-region.bin',out/'exec-test-8m-region.json',a.private,config['software_version'],config['version'],exec_package)
+ packages.append(exec_package)
tool=a.sdk/'src/app/ota_image_tool.py'
require(tool.exists(),'缺少固定版本 Matter SDK，無法產生 Matter OTA 容器')
if tool.exists():
call(['python3',tool,'create','-v','0xFFF1','-p','0x8000','-vn',config['software_version'],'-vs',config['version'],'-da','sha256',package,out/'matter-matter-ota.bin'])
- catalog([package,exec_package],config['catalog_url'].rsplit('/',1)[0],out/'index.json')
+ catalog(packages,config['catalog_url'].rsplit('/',1)[0],out/'index.json')
files=sorted(p for p in out.iterdir() if p.is_file());(out/'SHA256SUMS').write_text(''.join(hashlib.sha256(p.read_bytes()).hexdigest()+' '+p.name+'\n' for p in files))
print('公開更新包完成：'+str(out))
diff --git a/tools/setup_control.py b/tools/setup_control.py
new file mode 100644
index 0000000..1cc9982
--- /dev/null
+++ b/tools/setup_control.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Authenticated Wi-Fi setup and Matter pairing controls using the admin password (legacy profile optional)."""
+import argparse
+import getpass
+import ipaddress
+import socket
+from admin_session import AdminSession
+import hashlib
+import hmac
+import http.client
+import re
+import json
+import time
+from pathlib import Path
+from fwlib import require, profile_diag_key
+
+
+def control(host, profile, action='status', port=18081):
+ routes={'status':('GET','/state'),'enter-setup':('POST','/enter-setup'),
+ 'matter-status':('GET','/matter-state'),'reset-matter':('POST','/reset-matter'),
+ 'open-commissioning':('POST','/open-commissioning')}
+ require(action in routes, '不支援的操作')
+ key=profile_diag_key(profile)
+ def request(method,path,headers=None):
+ client=http.client.HTTPConnection(host,port,timeout=15)
+ try:
+ client.request(method,path,body=b'' if method=='POST' else None,headers=headers or {})
+ response=client.getresponse();body=response.read(4097)
+ require(len(body)<=4096, '回應過長')
+ require(response.status in (200,202), 'HTTP '+str(response.status))
+ return body
+ finally:client.close()
+ nonce=request('GET','/challenge')
+ require(re.fullmatch(b'[0-9a-f]{64}',nonce), 'challenge 格式不符')
+ method,path=routes[action]
+ signature=hmac.new(key,
+ (method+' '+path+'\n').encode()+nonce,hashlib.sha256).hexdigest()
+ return request(method,path,{'X-Setup-Proof':nonce.decode()+':'+signature}).decode('utf-8')
+
+
+def main():
+ p=argparse.ArgumentParser(description=__doc__)
+ p.add_argument('action',choices=('status','enter-setup','matter-status','reset-matter','open-commissioning'))
+ p.add_argument('--host',required=True)
+ p.add_argument('--profile',type=Path,help='僅舊版 HMAC 介面使用')
+ p.add_argument('--wait',action='store_true',help='等待這次 Matter 操作完成並驗證結果')
+ a=p.parse_args()
+ require(not a.wait or a.action in ('reset-matter','open-commissioning'),'--wait 僅適用於 Matter 操作')
+ if a.profile:
+ invoke=lambda action:control(a.host,a.profile,action)
+ else:
+ require(a.action!='enter-setup','新版請登入管理網頁修改 Wi-Fi，或實體長按恢復出廠')
+ address=ipaddress.IPv4Address(socket.gethostbyname(a.host))
+ require(address.is_private and not address.is_multicast and not address.is_unspecified,'請指定區網 IPv4 位址')
+ session=AdminSession('http://'+str(address)+':18082')
+ if a.action!='status':session.login(getpass.getpass('管理密碼：'))
+ def invoke(action):
+ if action=='status':data=session.get('/status')
+ elif action=='matter-status':data=session.get('/admin/state')['matter']
+ else:
+ require(session.get('/protocol').get('active')=='matter','目前不是 Matter 模式，請到管理後台選擇協議')
+ data=session.post({'reset-matter':'/admin/pairing-reset','open-commissioning':'/admin/open-commissioning'}[action],b'')
+ return json.dumps(data,ensure_ascii=False)+'\n'
+ result=invoke(a.action)
+ if a.wait:
+ request_id=json.loads(result)['request_id'];deadline=time.monotonic()+90
+ while time.monotonic()