1e501bae0SMatthias Ringwald /* 2e501bae0SMatthias Ringwald * Copyright (C) 2018 BlueKitchen GmbH 3e501bae0SMatthias Ringwald * 4e501bae0SMatthias Ringwald * Redistribution and use in source and binary forms, with or without 5e501bae0SMatthias Ringwald * modification, are permitted provided that the following conditions 6e501bae0SMatthias Ringwald * are met: 7e501bae0SMatthias Ringwald * 8e501bae0SMatthias Ringwald * 1. Redistributions of source code must retain the above copyright 9e501bae0SMatthias Ringwald * notice, this list of conditions and the following disclaimer. 10e501bae0SMatthias Ringwald * 2. Redistributions in binary form must reproduce the above copyright 11e501bae0SMatthias Ringwald * notice, this list of conditions and the following disclaimer in the 12e501bae0SMatthias Ringwald * documentation and/or other materials provided with the distribution. 13e501bae0SMatthias Ringwald * 3. Neither the name of the copyright holders nor the names of 14e501bae0SMatthias Ringwald * contributors may be used to endorse or promote products derived 15e501bae0SMatthias Ringwald * from this software without specific prior written permission. 16e501bae0SMatthias Ringwald * 4. Any redistribution, use, or modification is done solely for 17e501bae0SMatthias Ringwald * personal benefit and not for any commercial purpose or for 18e501bae0SMatthias Ringwald * monetary gain. 19e501bae0SMatthias Ringwald * 20e501bae0SMatthias Ringwald * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS 21e501bae0SMatthias Ringwald * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22e501bae0SMatthias Ringwald * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 232fca4dadSMilanka Ringwald * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN 242fca4dadSMilanka Ringwald * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25e501bae0SMatthias Ringwald * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26e501bae0SMatthias Ringwald * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 27e501bae0SMatthias Ringwald * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 28e501bae0SMatthias Ringwald * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 29e501bae0SMatthias Ringwald * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF 30e501bae0SMatthias Ringwald * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31e501bae0SMatthias Ringwald * SUCH DAMAGE. 32e501bae0SMatthias Ringwald * 33e501bae0SMatthias Ringwald * Please inquire about commercial licensing options at 34e501bae0SMatthias Ringwald * [email protected] 35e501bae0SMatthias Ringwald * 36e501bae0SMatthias Ringwald */ 37e501bae0SMatthias Ringwald 38e501bae0SMatthias Ringwald #define BTSTACK_FILE__ "btstack_chipset_intel_firmware.c" 398174b66aSMatthias Ringwald 408174b66aSMatthias Ringwald #include <fcntl.h> 418174b66aSMatthias Ringwald #include <stdio.h> 428174b66aSMatthias Ringwald 438174b66aSMatthias Ringwald #include "btstack_chipset_intel_firmware.h" 447a4d61a3SMatthias Ringwald 458174b66aSMatthias Ringwald #include "bluetooth.h" 468174b66aSMatthias Ringwald #include "btstack_debug.h" 477a4d61a3SMatthias Ringwald #include "btstack_event.h" 488174b66aSMatthias Ringwald #include "btstack_run_loop.h" 497a4d61a3SMatthias Ringwald #include "btstack_util.h" 507a4d61a3SMatthias Ringwald #include "hci.h" 517a4d61a3SMatthias Ringwald #include "hci_cmd.h" 527a4d61a3SMatthias Ringwald #include "hci_dump.h" 537a4d61a3SMatthias Ringwald 54*ce9d10fbSMatthias Ringwald #ifdef _MSC_VER 55*ce9d10fbSMatthias Ringwald // ignore deprecated warning for fopen 56*ce9d10fbSMatthias Ringwald #pragma warning(disable : 4996) 57*ce9d10fbSMatthias Ringwald #endif 58*ce9d10fbSMatthias Ringwald 597a4d61a3SMatthias Ringwald // assert outgoing and incoming hci packet buffers can hold max hci command resp. event packet 607a4d61a3SMatthias Ringwald #if HCI_OUTGOING_PACKET_BUFFER_SIZE < (HCI_CMD_HEADER_SIZE + 255) 617a4d61a3SMatthias Ringwald #error "HCI_OUTGOING_PACKET_BUFFER_SIZE to small. Outgoing HCI packet buffer to small for largest HCI Command packet. Please set HCI_ACL_PAYLOAD_SIZE to 258 or higher." 627a4d61a3SMatthias Ringwald #endif 637a4d61a3SMatthias Ringwald #if HCI_INCOMING_PACKET_BUFFER_SIZE < (HCI_EVENT_HEADER_SIZE_HEADER_SIZE + 255) 647a4d61a3SMatthias Ringwald #error "HCI_INCOMING_PACKET_BUFFER_SIZE to small. Incoming HCI packet buffer to small for largest HCI Event packet. Please set HCI_ACL_PAYLOAD_SIZE to 257 or higher." 657a4d61a3SMatthias Ringwald #endif 668174b66aSMatthias Ringwald 678174b66aSMatthias Ringwald // Vendor specific structs 688174b66aSMatthias Ringwald 698174b66aSMatthias Ringwald typedef struct { 708174b66aSMatthias Ringwald uint8_t status; 718174b66aSMatthias Ringwald uint8_t hw_platform; 728174b66aSMatthias Ringwald uint8_t hw_variant; 738174b66aSMatthias Ringwald uint8_t hw_revision; 748174b66aSMatthias Ringwald uint8_t fw_variant; 758174b66aSMatthias Ringwald uint8_t fw_revision; 768174b66aSMatthias Ringwald uint8_t fw_build_num; 778174b66aSMatthias Ringwald uint8_t fw_build_ww; 788174b66aSMatthias Ringwald uint8_t fw_build_yy; 798174b66aSMatthias Ringwald uint8_t fw_patch_num; 808174b66aSMatthias Ringwald } intel_version_t; 818174b66aSMatthias Ringwald 828174b66aSMatthias Ringwald typedef struct { 838174b66aSMatthias Ringwald uint8_t status; 848174b66aSMatthias Ringwald uint8_t otp_format; 858174b66aSMatthias Ringwald uint8_t otp_content; 868174b66aSMatthias Ringwald uint8_t otp_patch; 878174b66aSMatthias Ringwald uint16_t dev_revid; 888174b66aSMatthias Ringwald uint8_t secure_boot; 898174b66aSMatthias Ringwald uint8_t key_from_hdr; 908174b66aSMatthias Ringwald uint8_t key_type; 918174b66aSMatthias Ringwald uint8_t otp_lock; 928174b66aSMatthias Ringwald uint8_t api_lock; 938174b66aSMatthias Ringwald uint8_t debug_lock; 948174b66aSMatthias Ringwald bd_addr_t otp_bdaddr; 958174b66aSMatthias Ringwald uint8_t min_fw_build_nn; 968174b66aSMatthias Ringwald uint8_t min_fw_build_cw; 978174b66aSMatthias Ringwald uint8_t min_fw_build_yy; 988174b66aSMatthias Ringwald uint8_t limited_cce; 998174b66aSMatthias Ringwald uint8_t unlocked_state; 1008174b66aSMatthias Ringwald } intel_boot_params_t; 1018174b66aSMatthias Ringwald 1028174b66aSMatthias Ringwald // Vendor sepcific commands 1038174b66aSMatthias Ringwald 1048174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_read_version = { 1058174b66aSMatthias Ringwald 0xfc05, "" 1068174b66aSMatthias Ringwald }; 1078174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_read_secure_boot_params = { 1088174b66aSMatthias Ringwald 0xfc0d, "" 1098174b66aSMatthias Ringwald }; 1108174b66aSMatthias Ringwald 1118174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_reset_param = { 1128174b66aSMatthias Ringwald 0xfc01, "11111111" 1138174b66aSMatthias Ringwald }; 1148174b66aSMatthias Ringwald 1158174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_set_event_mask = { 1168174b66aSMatthias Ringwald 0xfc52, "11111111" 1178174b66aSMatthias Ringwald }; 1188174b66aSMatthias Ringwald 1198174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_fc9f = { 1208174b66aSMatthias Ringwald 0xfc9f, "1" 1218174b66aSMatthias Ringwald }; 1228174b66aSMatthias Ringwald 1238174b66aSMatthias Ringwald // state 1248174b66aSMatthias Ringwald 12529c6772bSMatthias Ringwald const char * firmware_path = "."; 12629c6772bSMatthias Ringwald 1278174b66aSMatthias Ringwald const hci_transport_t * transport; 1288174b66aSMatthias Ringwald 1298174b66aSMatthias Ringwald static int state = 0; 1308174b66aSMatthias Ringwald 1318174b66aSMatthias Ringwald static uint8_t hci_outgoing[300]; 1328174b66aSMatthias Ringwald static uint8_t fw_buffer[300]; 1338174b66aSMatthias Ringwald 1348174b66aSMatthias Ringwald static uint8_t hw_variant; 1358174b66aSMatthias Ringwald static uint16_t dev_revid; 1368174b66aSMatthias Ringwald 1378174b66aSMatthias Ringwald static FILE * fw_file; 138*ce9d10fbSMatthias Ringwald static size_t fw_offset; 1398174b66aSMatthias Ringwald 1408174b66aSMatthias Ringwald static void (*done)(int result); 1418174b66aSMatthias Ringwald 1428174b66aSMatthias Ringwald // functions 1438174b66aSMatthias Ringwald 1448174b66aSMatthias Ringwald static int transport_send_packet(uint8_t packet_type, const uint8_t * packet, uint16_t size){ 1458174b66aSMatthias Ringwald hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, (uint8_t*) packet, size); 1468174b66aSMatthias Ringwald return transport->send_packet(packet_type, (uint8_t *) packet, size); 1478174b66aSMatthias Ringwald } 1488174b66aSMatthias Ringwald 1498174b66aSMatthias Ringwald static int transport_send_cmd_va_arg(const hci_cmd_t *cmd, va_list argptr){ 1508174b66aSMatthias Ringwald uint8_t * packet = hci_outgoing; 1518174b66aSMatthias Ringwald uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr); 1528174b66aSMatthias Ringwald return transport_send_packet(HCI_COMMAND_DATA_PACKET, packet, size); 1538174b66aSMatthias Ringwald } 1548174b66aSMatthias Ringwald 1558174b66aSMatthias Ringwald static int transport_send_cmd(const hci_cmd_t *cmd, ...){ 1568174b66aSMatthias Ringwald va_list argptr; 1578174b66aSMatthias Ringwald va_start(argptr, cmd); 1588174b66aSMatthias Ringwald int res = transport_send_cmd_va_arg(cmd, argptr); 1598174b66aSMatthias Ringwald va_end(argptr); 1608174b66aSMatthias Ringwald return res; 1618174b66aSMatthias Ringwald } 1628174b66aSMatthias Ringwald 163*ce9d10fbSMatthias Ringwald static int transport_send_intel_secure(uint8_t fragment_type, const uint8_t * data, uint8_t len){ 1648174b66aSMatthias Ringwald little_endian_store_16(hci_outgoing, 0, 0xfc09); 1658174b66aSMatthias Ringwald hci_outgoing[2] = 1 + len; 1668174b66aSMatthias Ringwald hci_outgoing[3] = fragment_type; 1678174b66aSMatthias Ringwald memcpy(&hci_outgoing[4], data, len); 1688174b66aSMatthias Ringwald uint16_t size = 3 + 1 + len; 1698174b66aSMatthias Ringwald return transport_send_packet(HCI_ACL_DATA_PACKET, hci_outgoing, size); 1708174b66aSMatthias Ringwald } 1718174b66aSMatthias Ringwald 172*ce9d10fbSMatthias Ringwald static int transport_send_intel_ddc(const uint8_t * data, uint8_t len){ 1738174b66aSMatthias Ringwald little_endian_store_16(hci_outgoing, 0, 0xfc8b); 1748174b66aSMatthias Ringwald hci_outgoing[2] = len; 1758174b66aSMatthias Ringwald memcpy(&hci_outgoing[3], data, len); 1768174b66aSMatthias Ringwald uint16_t size = 3 + len; 1778174b66aSMatthias Ringwald return transport_send_packet(HCI_COMMAND_DATA_PACKET, hci_outgoing, size); 1788174b66aSMatthias Ringwald } 1798174b66aSMatthias Ringwald 1808174b66aSMatthias Ringwald static void state_machine(uint8_t * packet); 1818174b66aSMatthias Ringwald 1828174b66aSMatthias Ringwald // read data from fw file and send it via intel_secure + update state 183*ce9d10fbSMatthias Ringwald static int intel_send_fragment(uint8_t fragment_type, uint8_t len){ 184*ce9d10fbSMatthias Ringwald size_t res = fread(fw_buffer, 1, len, fw_file); 1858174b66aSMatthias Ringwald log_info("offset %6u, read %3u -> res %d", fw_offset, len, res); 1868174b66aSMatthias Ringwald fw_offset += res; 1878174b66aSMatthias Ringwald state++; 1888174b66aSMatthias Ringwald return transport_send_intel_secure(fragment_type, fw_buffer, len); 1898174b66aSMatthias Ringwald } 1908174b66aSMatthias Ringwald 1918174b66aSMatthias Ringwald // read data from ddc file and send iva intel ddc command 1928174b66aSMatthias Ringwald // @returns -1 on eof 1938174b66aSMatthias Ringwald static int intel_send_ddc(void){ 194*ce9d10fbSMatthias Ringwald size_t res; 1958174b66aSMatthias Ringwald // read len 1968174b66aSMatthias Ringwald res = fread(fw_buffer, 1, 1, fw_file); 1978174b66aSMatthias Ringwald log_info("offset %6u, read 1 -> res %d", fw_offset, res); 1988174b66aSMatthias Ringwald if (res == 0) return -1; 1998174b66aSMatthias Ringwald uint8_t len = fw_buffer[0]; 2008174b66aSMatthias Ringwald fw_offset += 1; 2018174b66aSMatthias Ringwald res = fread(&fw_buffer[1], 1, len, fw_file); 2028174b66aSMatthias Ringwald log_info("offset %6u, read %u -> res %d", fw_offset, 1, res); 2038174b66aSMatthias Ringwald return transport_send_intel_ddc(fw_buffer, 1 + len); 2048174b66aSMatthias Ringwald } 2058174b66aSMatthias Ringwald 2068174b66aSMatthias Ringwald static void dump_intel_version(intel_version_t * version){ 2078174b66aSMatthias Ringwald log_info("status 0x%02x", version->status); 2088174b66aSMatthias Ringwald log_info("hw_platform 0x%02x", version->hw_platform); 2098174b66aSMatthias Ringwald log_info("hw_variant 0x%02x", version->hw_variant); 2108174b66aSMatthias Ringwald log_info("hw_revision 0x%02x", version->hw_revision); 2118174b66aSMatthias Ringwald log_info("fw_variant 0x%02x", version->fw_variant); 2128174b66aSMatthias Ringwald log_info("fw_revision 0x%02x", version->fw_revision); 2138174b66aSMatthias Ringwald log_info("fw_build_num 0x%02x", version->fw_build_num); 2148174b66aSMatthias Ringwald log_info("fw_build_ww 0x%02x", version->fw_build_ww); 2158174b66aSMatthias Ringwald log_info("fw_build_yy 0x%02x", version->fw_build_yy); 2168174b66aSMatthias Ringwald log_info("fw_patch_num 0x%02x", version->fw_patch_num); 2178174b66aSMatthias Ringwald } 2188174b66aSMatthias Ringwald 2198174b66aSMatthias Ringwald static void dump_intel_boot_params(intel_boot_params_t * boot_params){ 2208174b66aSMatthias Ringwald bd_addr_t addr; 2218174b66aSMatthias Ringwald reverse_bd_addr(boot_params->otp_bdaddr, addr); 2228174b66aSMatthias Ringwald log_info("Device revision: %u", dev_revid); 2238174b66aSMatthias Ringwald log_info("Secure Boot: %s", boot_params->secure_boot ? "enabled" : "disabled"); 2248174b66aSMatthias Ringwald log_info("OTP lock: %s", boot_params->otp_lock ? "enabled" : "disabled"); 2258174b66aSMatthias Ringwald log_info("API lock: %s", boot_params->api_lock ? "enabled" : "disabled"); 2268174b66aSMatthias Ringwald log_info("Debug lock: %s", boot_params->debug_lock ? "enabled" : "disabled"); 2278174b66aSMatthias Ringwald log_info("Minimum firmware build %u week %u %u", boot_params->min_fw_build_nn, boot_params->min_fw_build_cw, 2000 + boot_params->min_fw_build_yy); 2288174b66aSMatthias Ringwald log_info("OTC BD_ADDR: %s", bd_addr_to_str(addr)); 2298174b66aSMatthias Ringwald } 2308174b66aSMatthias Ringwald 2318174b66aSMatthias Ringwald static int vendor_firmware_complete_received; 2328174b66aSMatthias Ringwald static int waiting_for_command_complete; 2338174b66aSMatthias Ringwald 2348174b66aSMatthias Ringwald static void state_machine(uint8_t * packet){ 2358174b66aSMatthias Ringwald intel_version_t * version; 2368174b66aSMatthias Ringwald intel_boot_params_t * boot_params; 237*ce9d10fbSMatthias Ringwald size_t res; 238*ce9d10fbSMatthias Ringwald size_t buffer_offset; 2398174b66aSMatthias Ringwald bd_addr_t addr; 24029c6772bSMatthias Ringwald char fw_path[300]; 2418174b66aSMatthias Ringwald 2428174b66aSMatthias Ringwald if (packet){ 2438174b66aSMatthias Ringwald // firmware upload complete event? 2448174b66aSMatthias Ringwald if (packet[0] == 0xff && packet[2] == 0x06) { 2458174b66aSMatthias Ringwald vendor_firmware_complete_received = 1; 2468174b66aSMatthias Ringwald } 2478174b66aSMatthias Ringwald 2488174b66aSMatthias Ringwald // command complete 2498174b66aSMatthias Ringwald if (packet[0] == 0x0e){ 2508174b66aSMatthias Ringwald waiting_for_command_complete = 0; 2518174b66aSMatthias Ringwald } 2528174b66aSMatthias Ringwald } 2538174b66aSMatthias Ringwald 2548174b66aSMatthias Ringwald switch (state){ 2558174b66aSMatthias Ringwald case 0: 2568174b66aSMatthias Ringwald state++; 2578174b66aSMatthias Ringwald transport_send_cmd(&hci_reset); 2588174b66aSMatthias Ringwald break; 2598174b66aSMatthias Ringwald case 1: 26088362d5eSMatthias Ringwald // check if HCI Reset was supported 26188362d5eSMatthias Ringwald if (packet[0] == 0x0e && packet[1] == 0x04 && packet[3] == 0x03 && packet[4] == 0x0c && packet[5] == 0x00){ 26288362d5eSMatthias Ringwald log_info("HCI Reset was successful, no need for firmware upload / or not an Intel chipset"); 26388362d5eSMatthias Ringwald (*done)(0); 26488362d5eSMatthias Ringwald break; 26588362d5eSMatthias Ringwald } 26688362d5eSMatthias Ringwald 2678174b66aSMatthias Ringwald // Read Intel Version 2688174b66aSMatthias Ringwald state++; 2698174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_read_version); 2708174b66aSMatthias Ringwald break; 2718174b66aSMatthias Ringwald case 2: 2728174b66aSMatthias Ringwald version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet); 2738174b66aSMatthias Ringwald dump_intel_version(version); 2748174b66aSMatthias Ringwald 2758174b66aSMatthias Ringwald hw_variant = version->hw_variant; 2768174b66aSMatthias Ringwald 2778174b66aSMatthias Ringwald // fw_variant = 0x06 bootloader mode / 0x23 operational mode 2788174b66aSMatthias Ringwald if (version->fw_variant == 0x23) { 2798174b66aSMatthias Ringwald (*done)(0); 2808174b66aSMatthias Ringwald break; 2818174b66aSMatthias Ringwald } 2828174b66aSMatthias Ringwald 2838174b66aSMatthias Ringwald if (version->fw_variant != 0x06){ 2848174b66aSMatthias Ringwald log_error("unknown fw_variant 0x%02x", version->fw_variant); 2858174b66aSMatthias Ringwald break; 2868174b66aSMatthias Ringwald } 2878174b66aSMatthias Ringwald 2888174b66aSMatthias Ringwald // Read Intel Secure Boot Params 2898174b66aSMatthias Ringwald state++; 2908174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_read_secure_boot_params); 2918174b66aSMatthias Ringwald break; 2928174b66aSMatthias Ringwald case 3: 2938174b66aSMatthias Ringwald boot_params = (intel_boot_params_t *) hci_event_command_complete_get_return_parameters(packet); 2948174b66aSMatthias Ringwald dump_intel_boot_params(boot_params); 2958174b66aSMatthias Ringwald 2968174b66aSMatthias Ringwald reverse_bd_addr(boot_params->otp_bdaddr, addr); 2978174b66aSMatthias Ringwald dev_revid = little_endian_read_16((uint8_t*)&boot_params->dev_revid, 0); 2988174b66aSMatthias Ringwald 2998174b66aSMatthias Ringwald // assert commmand complete is required 3008174b66aSMatthias Ringwald if (boot_params->limited_cce != 0) break; 3018174b66aSMatthias Ringwald 3028174b66aSMatthias Ringwald // firmware file 30329c6772bSMatthias Ringwald snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.sfi", firmware_path, hw_variant, dev_revid); 30429c6772bSMatthias Ringwald log_info("Open firmware %s", fw_path); 30529c6772bSMatthias Ringwald printf("Firwmare %s\n", fw_path); 3068174b66aSMatthias Ringwald 3078174b66aSMatthias Ringwald // open firmware file 3088174b66aSMatthias Ringwald fw_offset = 0; 30929c6772bSMatthias Ringwald fw_file = fopen(fw_path, "rb"); 3108174b66aSMatthias Ringwald if (!fw_file){ 31129c6772bSMatthias Ringwald log_error("can't open file %s", fw_path); 3128174b66aSMatthias Ringwald (*done)(1); 3138174b66aSMatthias Ringwald return; 3148174b66aSMatthias Ringwald } 3158174b66aSMatthias Ringwald 3168174b66aSMatthias Ringwald vendor_firmware_complete_received = 0; 3178174b66aSMatthias Ringwald 3188174b66aSMatthias Ringwald // send CCS segment - offset 0 3198174b66aSMatthias Ringwald intel_send_fragment(0x00, 128); 3208174b66aSMatthias Ringwald break; 3218174b66aSMatthias Ringwald case 4: 3228174b66aSMatthias Ringwald // send public key / part 1 - offset 128 3238174b66aSMatthias Ringwald intel_send_fragment(0x03, 128); 3248174b66aSMatthias Ringwald break; 3258174b66aSMatthias Ringwald case 5: 3268174b66aSMatthias Ringwald // send public key / part 2 - offset 384 3278174b66aSMatthias Ringwald intel_send_fragment(0x03, 128); 3288174b66aSMatthias Ringwald break; 3298174b66aSMatthias Ringwald case 6: 3308174b66aSMatthias Ringwald // skip 4 bytes 3318174b66aSMatthias Ringwald res = fread(fw_buffer, 1, 4, fw_file); 3328174b66aSMatthias Ringwald log_info("read res %d", res); 3338174b66aSMatthias Ringwald fw_offset += res; 3348174b66aSMatthias Ringwald 3358174b66aSMatthias Ringwald // send signature / part 1 - offset 388 3368174b66aSMatthias Ringwald intel_send_fragment(0x02, 128); 3378174b66aSMatthias Ringwald break; 3388174b66aSMatthias Ringwald case 7: 3398174b66aSMatthias Ringwald // send signature / part 2 - offset 516 3408174b66aSMatthias Ringwald intel_send_fragment(0x02, 128); 3418174b66aSMatthias Ringwald break; 3428174b66aSMatthias Ringwald case 8: 3438174b66aSMatthias Ringwald // send firmware chunks - offset 644 3448174b66aSMatthias Ringwald // chunk len must be 4 byte aligned 3458174b66aSMatthias Ringwald // multiple commands can be combined 3468174b66aSMatthias Ringwald buffer_offset = 0; 3478174b66aSMatthias Ringwald do { 3488174b66aSMatthias Ringwald res = fread(&fw_buffer[buffer_offset], 1, 3, fw_file); 3498174b66aSMatthias Ringwald log_info("fw_offset %6u, buffer_offset %u, read %3u -> res %d", fw_offset, buffer_offset, 3, res); 3508174b66aSMatthias Ringwald fw_offset += res; 3518174b66aSMatthias Ringwald if (res == 0 ){ 3528174b66aSMatthias Ringwald // EOF 3538174b66aSMatthias Ringwald log_info("End of file"); 3548174b66aSMatthias Ringwald fclose(fw_file); 3558174b66aSMatthias Ringwald fw_file = NULL; 3568174b66aSMatthias Ringwald state++; 3578174b66aSMatthias Ringwald break; 3588174b66aSMatthias Ringwald } 3598174b66aSMatthias Ringwald int param_len = fw_buffer[buffer_offset + 2]; 3608174b66aSMatthias Ringwald buffer_offset += 3; 3618174b66aSMatthias Ringwald if (param_len){ 3628174b66aSMatthias Ringwald res = fread(&fw_buffer[buffer_offset], 1, param_len, fw_file); 3638174b66aSMatthias Ringwald fw_offset += res; 3648174b66aSMatthias Ringwald buffer_offset += res; 3658174b66aSMatthias Ringwald } 3668174b66aSMatthias Ringwald } while ((buffer_offset & 3) != 0); 3678174b66aSMatthias Ringwald 3688174b66aSMatthias Ringwald if (buffer_offset == 0) break; 3698174b66aSMatthias Ringwald 3708174b66aSMatthias Ringwald waiting_for_command_complete = 1; 371*ce9d10fbSMatthias Ringwald transport_send_intel_secure(0x01, fw_buffer, (uint8_t) buffer_offset); 3728174b66aSMatthias Ringwald break; 3738174b66aSMatthias Ringwald 3748174b66aSMatthias Ringwald case 9: 3758174b66aSMatthias Ringwald // expect Vendor Specific Event 0x06 3768174b66aSMatthias Ringwald if (!vendor_firmware_complete_received) break; 3778174b66aSMatthias Ringwald 3788174b66aSMatthias Ringwald printf("Firmware upload complete\n"); 3798174b66aSMatthias Ringwald log_info("Vendor Event 0x06 - firmware complete"); 3808174b66aSMatthias Ringwald 3818174b66aSMatthias Ringwald // Reset Params - constants from Windows Intel driver 3828174b66aSMatthias Ringwald state++; 3838174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_reset_param, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x04, 0x00); 3848174b66aSMatthias Ringwald break; 3858174b66aSMatthias Ringwald 3868174b66aSMatthias Ringwald case 10: 3878174b66aSMatthias Ringwald // expect Vendor Specific Event 0x02 3888174b66aSMatthias Ringwald if (packet[0] != 0xff) break; 3898174b66aSMatthias Ringwald if (packet[2] != 0x02) break; 3908174b66aSMatthias Ringwald 3918174b66aSMatthias Ringwald printf("Firmware operational\n"); 3928174b66aSMatthias Ringwald log_info("Vendor Event 0x02 - firmware operational"); 3938174b66aSMatthias Ringwald 3948174b66aSMatthias Ringwald // Read Intel Version 3958174b66aSMatthias Ringwald state++; 3968174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_read_version); 3978174b66aSMatthias Ringwald break; 3988174b66aSMatthias Ringwald 3998174b66aSMatthias Ringwald case 11: 4008174b66aSMatthias Ringwald version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet); 4018174b66aSMatthias Ringwald dump_intel_version(version); 4028174b66aSMatthias Ringwald 4038174b66aSMatthias Ringwald // ddc config 40429c6772bSMatthias Ringwald snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.ddc", firmware_path, hw_variant, dev_revid); 40529c6772bSMatthias Ringwald log_info("Open DDC %s", fw_path); 4068174b66aSMatthias Ringwald 4078174b66aSMatthias Ringwald // open ddc file 4088174b66aSMatthias Ringwald fw_offset = 0; 40929c6772bSMatthias Ringwald fw_file = fopen(fw_path, "rb"); 4108174b66aSMatthias Ringwald if (!fw_file){ 41129c6772bSMatthias Ringwald log_error("can't open file %s", fw_path); 4128174b66aSMatthias Ringwald 4138174b66aSMatthias Ringwald (*done)(1); 4148174b66aSMatthias Ringwald return; 4158174b66aSMatthias Ringwald } 4168174b66aSMatthias Ringwald 4178174b66aSMatthias Ringwald // load ddc 4188174b66aSMatthias Ringwald state++; 4198174b66aSMatthias Ringwald 4208174b66aSMatthias Ringwald /* fall through */ 4218174b66aSMatthias Ringwald 4228174b66aSMatthias Ringwald case 12: 4238174b66aSMatthias Ringwald res = intel_send_ddc(); 4248174b66aSMatthias Ringwald if (res == 0) break; 4258174b66aSMatthias Ringwald 4268174b66aSMatthias Ringwald // DDC download complete 4278174b66aSMatthias Ringwald state++; 4288174b66aSMatthias Ringwald log_info("Load DDC Complete"); 4298174b66aSMatthias Ringwald 4308174b66aSMatthias Ringwald 4318174b66aSMatthias Ringwald // Set Intel event mask 0xfc52 4328174b66aSMatthias Ringwald state++; 4338174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_set_event_mask, 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00); 4348174b66aSMatthias Ringwald break; 4358174b66aSMatthias Ringwald 4368174b66aSMatthias Ringwald case 13: 4378174b66aSMatthias Ringwald // 9F FC 01 00 4388174b66aSMatthias Ringwald state++; 4398174b66aSMatthias Ringwald transport_send_cmd(&hci_intel_fc9f, 0x00); 4408174b66aSMatthias Ringwald break; 4418174b66aSMatthias Ringwald 4428174b66aSMatthias Ringwald case 14: 4438174b66aSMatthias Ringwald (*done)(0); 4448174b66aSMatthias Ringwald break; 4458174b66aSMatthias Ringwald 4468174b66aSMatthias Ringwald default: 4478174b66aSMatthias Ringwald break; 4488174b66aSMatthias Ringwald } 4498174b66aSMatthias Ringwald } 4508174b66aSMatthias Ringwald 4518174b66aSMatthias Ringwald static void transport_packet_handler (uint8_t packet_type, uint8_t *packet, uint16_t size){ 4528174b66aSMatthias Ringwald UNUSED(packet_type); 4538174b66aSMatthias Ringwald // we also get events with packet_type ACL from the controller 4548174b66aSMatthias Ringwald hci_dump_packet(HCI_EVENT_PACKET, 1, packet, size); 4558174b66aSMatthias Ringwald switch (hci_event_packet_get_type(packet)){ 4568174b66aSMatthias Ringwald case HCI_EVENT_COMMAND_COMPLETE: 4578174b66aSMatthias Ringwald case HCI_EVENT_VENDOR_SPECIFIC: 4588174b66aSMatthias Ringwald state_machine(packet); 4598174b66aSMatthias Ringwald break; 4608174b66aSMatthias Ringwald default: 4618174b66aSMatthias Ringwald break; 4628174b66aSMatthias Ringwald } 4638174b66aSMatthias Ringwald } 4648174b66aSMatthias Ringwald 46529c6772bSMatthias Ringwald void btstack_chipset_intel_set_firmware_path(const char * path){ 46629c6772bSMatthias Ringwald firmware_path = path; 46729c6772bSMatthias Ringwald } 46829c6772bSMatthias Ringwald 4698174b66aSMatthias Ringwald void btstack_chipset_intel_download_firmware(const hci_transport_t * hci_transport, void (*callback)(int result)){ 4708174b66aSMatthias Ringwald 4718174b66aSMatthias Ringwald done = callback; 4728174b66aSMatthias Ringwald 4738174b66aSMatthias Ringwald transport = hci_transport;; 4748174b66aSMatthias Ringwald // transport->init(NULL); 4758174b66aSMatthias Ringwald transport->register_packet_handler(&transport_packet_handler); 4768174b66aSMatthias Ringwald transport->open(); 4778174b66aSMatthias Ringwald 4788174b66aSMatthias Ringwald // get started 4798174b66aSMatthias Ringwald state = 0; 4808174b66aSMatthias Ringwald state_machine(NULL); 4818174b66aSMatthias Ringwald } 482