After OTA update Ikea E1524/E1810 can't be bound to group - how to downgrade?

[andreypolyak]

What happened

1. I upgraded Ikea E1524/E1810 remote to the latest version using Zigbee2mqtt — 2.3.075
2. Deleted remote and readded it back (this was not related to OTA update so not sure how important is it to reproduce the issue)
3. Tried to setup the binding between the remote and light group as I previously had. It doesn't work

I read about the same issue in ZHA related issue: home-assistant/core#43969 (comment). So looks like the problem is reproducable.

What did you expect to happen

Is there any way to downgrade the firmware? I have bunch of E1524/E1810 remotes that are on 2.3.014 firmware and they are working great.

How to reproduce it (minimal and precise)

Debug info

Zigbee2MQTT version: 1.19.1
Adapter hardware: CC2652
Adapter firmware version:

[strobel1x]

I'm having the same issue also with the updated (to version 2.3.075) IKEA E1743 remote switches.

[antsund]

Same problem for me, after updating E1743 to 2.3.075, build date 20210526. Force removed the remote, readded it and interview is complete, but after that no messages from clicks/actions are coming.

Since I was using the test server I learned a lesson not to. :)

Edit: After restarting the addon in HA I get this error, suppose it has to do with the change to default group id 0:

Zigbee2MQTT:error 2021-06-07 12:10:57: Failed to configure 'button_onoff', attempt 1 (Error: Bind 0x14b457fffe7e8b2d/1 genOnOff from '901' failed (AREQ - ZDO - bindRsp after 10000ms)
at Timeout._onTimeout (/app/node_modules/zigbee-herdsman/dist/utils/waitress.js:46:35)
at listOnTimeout (internal/timers.js:554:17)
at processTimers (internal/timers.js:497:7))

[siklosi]

Same here group id 0 after update. Tried removing and pairing again but can not bind to group. Otherwise works and I temporarily until resolved made script that toggles lights using from domoticz instead directly.

[MattWestb]

deCONZ and ZHA can doing firmware downgrading of but need to knowing how to do it.

And do not using the test feed for production systems then all firmware is not certified !!

[supercharley]

Same problem with the E1812!

[martin131]

I have same problem on my E1812. No actions from button are recognized by Z2M in Home Assistant.

[MattWestb]

Updated IKEA remotes is still sending all commands with unicast to 0x0000 = the coordinator if the coordinator is listen to the commands you is getting them (sniffed with wireshark).

Do one firmware downgrading with deCONZ or ZHA and you is getting the group functionality back or waiting some days and IKEA is very likely (but not 110% sure) putting one fixed firmware in the test feed.

[ruttromp]

Have the same problem with the E1812 remote. Keeping an eye on this issue

[MattWestb]

If some like downgrading with local file (possible with deCONZ and patched ZHA) is the 5 buttom remote and 2 button in the zip file attached.
remotes.zip

[shirou93]

Same issue IKEA E1812. Pairing but no click always none

[AlexKay88]

Maybe too easy, but did you press a button on remote to wake it up during (re-)configuration?
Any error messages? Timeout?
Checked if legacy: false for remote?

[shirou93]

Maybe too easy, but did you press a button on remote to wake it up during (re-)configuration?
Any error messages? Timeout?
Checked if legacy: false for remote?

Repair not solve issue. Reconfigure also.

[heggink]

I noticed that, of my 5 IKEA remotes, only 1 is still bound to a group and working. All others are unbound (report group 0) even though I only upgraded 1 remote to the latest firmware. Whatever I try, I cannot even bind the previously working remotes to the original groups even though nothing changed in the firmware. It almost seems as if something changed in z2m rather than the firmware update causing it. My E1524 should be always bound to 901 and now that also reports group 0 :-(. No idea where I am going wrong.

[MattWestb]

Request the cluster attributes "sw_build_id (id: 0x4000)" and you is getting the "real version" not what Z2M is "thinking".

With the updated firmware is not possible for Z2m to changing the group to 901 and the remote is not sending commands to gropes only to the device with address 0x0000 = coordinator in your system.

Downgrading the firmware and you is getting the function back.

[shirou93]

After upgrade firmware switch don't pair with oryginal IKEA gateway. This firmware is broken

[brhahlen]

Yeah, I have the same problem here. After upgrade, no clicks are being registered anymore.

[MattWestb]

@shirou93 Do you knowing if one original IKEA GW is supporting software downgrading ?
If you have it running with IKEA test firmware is very likely can do that but i dont knowing how to doing that.

deCONZ and ZHA with "puddly patch" can doing selecting downgrading if like going back to stable firmware.

[heggink]

Request the cluster attributes "sw_build_id (id: 0x4000)" and you is getting the "real version" not what Z2M is "thinking".

With the updated firmware is not possible for Z2m to changing the group to 901 and the remote is not sending commands to gropes only to the device with address 0x0000 = coordinator in your system.

Downgrading the firmware and you is getting the function back.

Bizarrely, I only upgraded one device but now find that I have 2 on old FW and 3 actually on new. I never upgraded them myself. Does z2m upgrade FW itself?

Also, any advice on how to easiest downgrade the FW?

[shirou93]

@shirou93 Do you knowing if one original IKEA GW is supporting software downgrading ?
If you have it running with IKEA test firmware is very likely can do that but i dont knowing how to doing that.

deCONZ and ZHA with "puddly patch" can doing selecting downgrading if like going back to stable firmware.

I dont have ikea gateway. I tested in shop and employe change this switch for another new one.

[MattWestb]

@shirou93 If you is family member you can always do that without any reason and infinity time in most country and after that i can baying it for 3€ in the recycle hub :-))

Dont forgetting disabling the test feed until its reported being stable !!!!

[shirou93]

@shirou93 If you is family member you can always do that without any reason and infinity time in most country and after that i can baying it for 3€ in the recycle hub :-))

Dont forgetting disabling the test feed until its reported being stable !!!!

:) I disabled IKEA test server in config. In stable server no ota update info.

[MattWestb]

deCONZ only picking the old file in the file dialogue and upgrading and waking the remote so it can getting the command.

ZHA OTA-Device-Firmware-Updates.

Z2M putt one future request for implanting it.

@shirou93 Then you was getting one with updated firmware so no need updating it and you can putting your groups back in it :-)))

[heggink]

@MattWestb Thx!. The one thing I don;t get is that the E1524 no longer works even though the FW is not updated.

[MattWestb]

@heggink I think its upgraded butt Z2M is not reporting it OK.
Perhaps restart Z2M and doing one new attribute report request and see is its updated or not.

[heggink]

@MattWestb that's what I thought as well but then z2m would have updated it without my involvement. After restarting z2m, it still reports as FW 2.3.014 which is, according to the normal ikea FW site, the current version:

{
"fw_binary_url": "http://fw.ota.homesmart.ikea.net/global/GW1.0/01.14.024/bin/159699-5.1-TRADFRI-remote-control-2.3.014.ota.ota.signed",
"fw_file_version_LSB": 17969,
"fw_file_version_MSB": 8961,
"fw_filesize": 182590,
"fw_image_type": 4545,
"fw_manufacturer_id": 4476,
"fw_type": 2
},

[MattWestb]

Then i think the best is deleting it in Z2M and resetting the remote and doing one new pairing.

If messing up the binding its normally not possible getting it back OK without repairing /resetting the device.

[Giancky79]

i'm try to bind with lamp and working, with ota we don't need pairing with a group? i have a E1743

[MattWestb]

The E1743 is one dimmer switch = shall sending command to groups of lights and need doing it with broadcast (=Zigbee groups).
Before it was not possible binding the remote to one light only groups and I have not testing if its possible with the test version.
The test version is sending all commands to 0x0000 = the coordinator in you mesh.

[forsb]

Happy news! All buttons are now successfully downgraded, even the "dead" ones 🥳
The solution was:

1. Dump the area 0 from a working remote: (gdb) dump memory XYZ17.bin 0x00000000 0x00040000
2. Convert the bin to elf: > arm-none-eabi-objcopy --input-target binary --output-target elf32-little XYZ17.bin XYZ17.elf
3. Upload the good elf to the bad device area 0: (gdb) load XYZ17.elf 0x0

Virtual hugs to you @MattWestb!

[MattWestb]

Brave user !!!

Great you was getting it working only little strange you have 3/4 not working and most other users have all working.
I can being that IKEA have making some changes also to the bootloader (normally not done with OTA on production devices but is possible doing) and it was not OK written in the OTA update.

Thanks and back 2 you :-))

[nolimitdk]

Confessed: I haven’t read all messages in this thread, but can’t you just bind each bulb instead of the groups. A little more work I confess but it takes away the hassle of downgrading.

This works for me on the test switches, and I will start the binding now on the the rest so I can the the annoying update-available messages away.

[sjorge]

For a single bulb/blind this works fine, but for a group of 8 for example they will no longer turn on at the exact same time.

For me thats very distracting.

[MattWestb]

With the last not working (wrong meta data in the file header) OTA update of Styrbar is also loosing the group binding so its being very hard getting one good light controller :((((

[Dinth]

For me the biggest problem is that not always all the bulbs receive the command from the switch. With 6 bulbs and one switch, it happens at least every 2-3 days that one of them gets out of sync. And because the switch sends toggle command, then its not possible to get them back in sync without logging it to HA on a computer.

[MattWestb]

@Dinth Long pressing the toggle is making the remote sending on reset / sync sequence to bonded group / devices and all devices is starting with On and the came color and the first scene stored in the lights.

[dmak]

Dear all,
My remote control E1524/E1810 reports firmware version 2.3.014, but still uses group 901 after attempt to bind it to another group 65289. Any idea if that is a firmware issue? As far as I can see from #4901, the group 901 is "special" and cannot be removed, so I am confused with the steps how to bind a remote to a group 🤔
Logs:

debug 2023-04-30 23:46:05: Received MQTT message on 'zigbee2mqtt/bridge/request/device/bind' with data '{"from": "remote_control", "to": "65289"}'
debug 2023-04-30 23:46:05: binding cluster 'genOnOff' from 'remote_control' to 'Lamp group'
info  2023-04-30 23:46:13: Successfully bound cluster 'genOnOff' from 'remote_control' to 'Lamp group'
info  2023-04-30 23:46:13: MQTT publish: topic 'zigbee2mqtt/bridge/log', payload '{"message":{"cluster":"genOnOff","from":"remote_control","to":"Lamp group"},"type":"device_bind"}'
debug 2023-04-30 23:46:13: binding cluster 'genLevelCtrl' from 'remote_control' to 'Lamp group'
info  2023-04-30 23:46:16: Successfully bound cluster 'genLevelCtrl' from 'remote_control' to 'Lamp group'
info  2023-04-30 23:46:16: MQTT publish: topic 'zigbee2mqtt/bridge/log', payload '{"message":{"cluster":"genLevelCtrl","from":"remote_control","to":"Lamp group"},"type":"device_bind"}'
info  2023-04-30 23:46:16: MQTT publish: topic 'zigbee2mqtt/bridge/response/device/bind', payload '{"data":{"clusters":["genOnOff","genLevelCtrl"],"failed":[],"from":"remote_control","to":"65289"},"status":"ok"}'
debug 2023-04-30 23:46:48: Received Zigbee message from 'remote_control', type 'commandToggle', cluster 'genOnOff', data '{}' from endpoint 1 with groupID 901
info  2023-04-30 23:46:48: MQTT publish: topic 'zigbee2mqtt/remote_control', payload '{"action":"toggle","battery":60,"linkquality":105,"update":{"installed_version":587286065,"latest_version":587286065,"state":"idle"},"update_available":false}'

[Jellyfrog]

Does anyone know if this is still a problem with 2.3.079 or 24.4.5? Still rocking 2.3.014 :)

[sjorge]

It looks like binding to a group is gone for good for these on newer firmware :(

[diagonali]

Since this is a real problem for many including myself particularly because it removed crucial functionality (pairing one switch to 14 bulbs in my case isn't either practical or idea and in fact quite buggy), I wonder if it's possible to downgrade the firmware using z2m itself? Is the proprietary IKEA index file the main issue? Has anyone tried this?

Otherwise, are there any step by step guides to downgrading in the way that @forsb and @MattWestb have apprently done?

I've read this entire thread and it seems to constitute the fairly common thing of people declaring success "Hey guys! it's ok, I've fixed it!" but no explanation of how.

[MattWestb]

@diagonali I have trying forcing firmware downgrading some IKEA controller for over one wear ago but they was blocked in the firmware so no luck. Also if reading the Zigbee certificate papers IKEA have marking that is blocked so its more then likely done i all controllers (Lights was was not for one year ago).
Do the only way is flashing one OTA file that is unpacked a´with one SWD probe its little tricky and the round remote is very good glued and can brake if having bad luck.

I have firmware for flashing posted in the ZHA discussing of IKEA OTA files and also some more technical information and feedback from users.

If you only using OnOff and dimmer by some new RODRET OnOff Dimmers they can do both unicsat and broadcast (group) binding in current production version and looks working very well as long IKEA is not messing with the OTA updates in the future.

[Dinth]

Are Styrbar remotes also affected by the same issue? Im thinking about the upgrade.

[MattWestb]

If i remember right have the STYRBAR also loosing the broadcast (group binding) in the last OTA updates but im not 110% sure so must testing if its working or not plus its have not 100% working battery reporting that need being fixed in the firmware from IKEA.

[diagonali]

@MattWestb Thanks for reply. Shame IKEA decided to actively block people from putting different firmware on these switches. Without the ability to bind to groups now, they are much less useful than before. The RODRET look very interesting although they are much larger than the E1743 than I have many of. I suppose our use case is so rare and nice that we can't really complain too much. It does look like it's literally impossible to downgrade the E1743 after it's been OTA updated. Thanks again for your suggestions.

[MattWestb]

I think IKEA is not aware of the lost group binding then then they is using them in ZLL mode in there TF system and Dirigera is only binding to coordinator and the hos system is doing the group sending = not working if the hub is offline.

If you have one ESP8266 or other that can doing SWD / J-Link flashing you can easy flashing the E1743 and its not destructive like the 5 button remote and is made in 3 minutes.

[diagonali]

I think IKEA is not aware of the lost group binding then then they is using them in ZLL mode in there TF system and Dirigera is only binding to coordinator and the hos system is doing the group sending = not working if the hub is offline.

If you have one ESP8266 or other that can doing SWD / J-Link flashing you can easy flashing the E1743 and its not destructive like the 5 button remote and is made in 3 minutes.

@MattWestb Yeah it's strange that IKEA have broken the group binding since it benefits them also with their official system. Maybe one day they'll fix it!? I don't have a ESP8266 at the moment and I'm not familiar with SWD / J-Link flashing so I think I'll just accept that it's stuck at the moment depending on how difficult it is. Does it require soldering? Is there a guide on doing this online? I think I'd need the 2.2.010 firmware for the E1743 also and I can't find that either.

[tim-devel]

I have reflashed about a dozen of these using @MattWestb guide. The first one took an hour or so but once you've got the hang of it they take less than 5 mins each.

You pop open the case, rough solder four Dupont cables to the debug pads, run a couple of commands to upload firmware, desolder cables and pop case back together. My soldering is very crude and I have limited hardware should but managed to do them quite easily.

You will also need a blue or black pill usb debug tool but they are only £5 on ebay

[diagonali]

I have reflashed about a dozen of these using @MattWestb guide. The first one took an hour or so but once you've got the hang of it they take less than 5 mins each.

You pop open the case, rough solder four Dupont cables to the debug pads, run a couple of commands to upload firmware, desolder cables and pop case back together. My soldering is very crude and I have limited hardware should but managed to do them quite easily.

You will also need a blue or black pill usb debug tool but they are only £5 on ebay

@tim-devel I just found out that the "updated" firmware on the E1743 when paired to bulbs individually has also disabled/broken the dimming functionality. I'm seriously considering downgrading the firmware and having a go at soldering again (I've done it once before - badly!). I seem to have missed the @MattWestb guide though, is it in this thread?

[MattWestb]

You dont need soldering if having one long pin DuPont that you can adjusting to 2.0 mm and holding it with one finger like this:

Then its 3 minuter work but then i have done some of them before also soldering some for testing different firmware updates.

[MattWestb]

Its in the ZHA discussion for IKEA OTA zigpy/zigpy#660

[cian]

EDIT - This does not work as the E1743 notices that the firmware is older and then does not install it. This approach may work for some older bulbs only...

If you want to downgrade using zigbee2mqtt, you can do it as follows:

1. In ikea.js, find the E1743 and change ota: ota.tradfri to ota: ota.zigbeeOTA
2. Now you can use an ota override file (which is only supported by ZigbeeOTA), eg. ota_override.json:

[
    {
        "fileVersion": 570492465,
        "fileSize": 179838,
        "manufacturerCode": 4476,
        "imageType": 4549,
        "sha512": "0bd5c2ea4af7f43f4de3083feb0e9f07c157b982a63db3438ca4c2cc9d1e2016be7d38bcb0256327541e47de4b0cc810e8b95262b3f0ae3f24b60457df1f5f9b",
        "url": "http://fw.ota.homesmart.ikea.net/Tradfri_OTA_release_signed_2019_12_20_142226/bin/10005778-10.1-TRADFRI-onoff-shortcut-control-2.2.010.ota.ota.signed",
        "force": true
    }
]

3. In your configuration.yaml, specify: zigbee_ota_override_index_location: ota_override.json
4. Restart zigbee2mqtt
5. In the web UI, under OTA, click "Check for new updates", and you should be offered a downgrade to the old version.

[MattWestb]

I have not testing the last 24.X versions but all older firmware was blocked for OTA downgrade and also the Zigbee certification IKEA have making it as so for all there controllers but pleas testing if can getting it working.

[cian]

Yes, you're correct. Downgrade is indeed blocked, so the above works only for re-install not OTA downgrade.

[MattWestb]

IKEA lights is (/ was) not blocked and works great in ZHA to downgrading then and then letting the normal OTA doing one upgrade and the device is restoring thees "IKEA scenes" that is working with there remotes if doing it OK with the "magic group".

[dmak]

1. In ikea.js, find the E1743 and change ota: ota.tradfri to ota: ota.zigbeeOTA

Would you be so kin and explain if ota.zigbeeOTA has a special meaning? Is it a pre-defined constant?

2. Now you can use an ota override file (which is only supported by ZigbeeOTA), eg. ota_override.json:

Would be great if you could explain in a bit more details how to generate this file? For example if I go to http://fw.ota.homesmart.ikea.net/ I got "Access Denied". Would be great to have an instruction about how to pick a particular version from that site and generate a corresponding ota_override.json. Thanks in advance!

[cian]

@dmak - Ignore my comment above. This approach does not work for E1743. To answer your questions for posterity:

1. ota.zigbeeOTA is a constant. It is the OTA upgrade mechanism used for most other manufacturers.

2. You cannot browse http://fw.ota.homesmart.ikea.net/ but you can use archive.org to look at old version of http://fw.ota.homesmart.ikea.net/feed/version_info.json to find the relevant URLs.

Ultimately, to fix this issue I ended up installing blackmagic-espif on an ESP8266, and loading the .s37 file supplied my @MattWestb here using the GDB with the instructions he wrote.

I think this is the best discussion on downgrading so far.

NOTE: That the E1743 (and similar designs) do have small test holes above the Serial TX & RX on the board. So, I think it might also be possible to connect to these and use the serial bootloader to do a downgrade without full disassembly, however I have not tested this approach myself as I had already disassembled my switch before I noticed that the holes lined up.

[MattWestb]

The device dont have serial (x-modem) bootloader its have one application bootloader that can only doing OTA updates not over serial port.
The pads is possible using with long dupoing pins that is little tweaks (2 mm space normal is 2.5) on some devices but the round one is not easy best doing some fast soldering on the module and its going faster.

[MattWestb]

TF file sever have one json file that is pointing to all production OTA firmware also Dirigera have one but its have problems with private certificate but ZHA have fixing it.
Read more here zigpy/zigpy#660