xref: /btstack/chipset/intel/btstack_chipset_intel_firmware.c (revision ce9d10fbb0a43fc498568be19fc6d9b179adad9a)
1e501bae0SMatthias Ringwald /*
2e501bae0SMatthias Ringwald  * Copyright (C) 2018 BlueKitchen GmbH
3e501bae0SMatthias Ringwald  *
4e501bae0SMatthias Ringwald  * Redistribution and use in source and binary forms, with or without
5e501bae0SMatthias Ringwald  * modification, are permitted provided that the following conditions
6e501bae0SMatthias Ringwald  * are met:
7e501bae0SMatthias Ringwald  *
8e501bae0SMatthias Ringwald  * 1. Redistributions of source code must retain the above copyright
9e501bae0SMatthias Ringwald  *    notice, this list of conditions and the following disclaimer.
10e501bae0SMatthias Ringwald  * 2. Redistributions in binary form must reproduce the above copyright
11e501bae0SMatthias Ringwald  *    notice, this list of conditions and the following disclaimer in the
12e501bae0SMatthias Ringwald  *    documentation and/or other materials provided with the distribution.
13e501bae0SMatthias Ringwald  * 3. Neither the name of the copyright holders nor the names of
14e501bae0SMatthias Ringwald  *    contributors may be used to endorse or promote products derived
15e501bae0SMatthias Ringwald  *    from this software without specific prior written permission.
16e501bae0SMatthias Ringwald  * 4. Any redistribution, use, or modification is done solely for
17e501bae0SMatthias Ringwald  *    personal benefit and not for any commercial purpose or for
18e501bae0SMatthias Ringwald  *    monetary gain.
19e501bae0SMatthias Ringwald  *
20e501bae0SMatthias Ringwald  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21e501bae0SMatthias Ringwald  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22e501bae0SMatthias Ringwald  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
232fca4dadSMilanka Ringwald  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
242fca4dadSMilanka Ringwald  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25e501bae0SMatthias Ringwald  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26e501bae0SMatthias Ringwald  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27e501bae0SMatthias Ringwald  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28e501bae0SMatthias Ringwald  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29e501bae0SMatthias Ringwald  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30e501bae0SMatthias Ringwald  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31e501bae0SMatthias Ringwald  * SUCH DAMAGE.
32e501bae0SMatthias Ringwald  *
33e501bae0SMatthias Ringwald  * Please inquire about commercial licensing options at
34e501bae0SMatthias Ringwald  * [email protected]
35e501bae0SMatthias Ringwald  *
36e501bae0SMatthias Ringwald  */
37e501bae0SMatthias Ringwald 
38e501bae0SMatthias Ringwald #define BTSTACK_FILE__ "btstack_chipset_intel_firmware.c"
398174b66aSMatthias Ringwald 
408174b66aSMatthias Ringwald #include <fcntl.h>
418174b66aSMatthias Ringwald #include <stdio.h>
428174b66aSMatthias Ringwald 
438174b66aSMatthias Ringwald #include "btstack_chipset_intel_firmware.h"
447a4d61a3SMatthias Ringwald 
458174b66aSMatthias Ringwald #include "bluetooth.h"
468174b66aSMatthias Ringwald #include "btstack_debug.h"
477a4d61a3SMatthias Ringwald #include "btstack_event.h"
488174b66aSMatthias Ringwald #include "btstack_run_loop.h"
497a4d61a3SMatthias Ringwald #include "btstack_util.h"
507a4d61a3SMatthias Ringwald #include "hci.h"
517a4d61a3SMatthias Ringwald #include "hci_cmd.h"
527a4d61a3SMatthias Ringwald #include "hci_dump.h"
537a4d61a3SMatthias Ringwald 
54*ce9d10fbSMatthias Ringwald #ifdef _MSC_VER
55*ce9d10fbSMatthias Ringwald  // ignore deprecated warning for fopen
56*ce9d10fbSMatthias Ringwald #pragma warning(disable : 4996)
57*ce9d10fbSMatthias Ringwald #endif
58*ce9d10fbSMatthias Ringwald 
597a4d61a3SMatthias Ringwald // assert outgoing and incoming hci packet buffers can hold max hci command resp. event packet
607a4d61a3SMatthias Ringwald #if HCI_OUTGOING_PACKET_BUFFER_SIZE < (HCI_CMD_HEADER_SIZE + 255)
617a4d61a3SMatthias Ringwald #error "HCI_OUTGOING_PACKET_BUFFER_SIZE to small. Outgoing HCI packet buffer to small for largest HCI Command packet. Please set HCI_ACL_PAYLOAD_SIZE to 258 or higher."
627a4d61a3SMatthias Ringwald #endif
637a4d61a3SMatthias Ringwald #if HCI_INCOMING_PACKET_BUFFER_SIZE < (HCI_EVENT_HEADER_SIZE_HEADER_SIZE + 255)
647a4d61a3SMatthias Ringwald #error "HCI_INCOMING_PACKET_BUFFER_SIZE to small. Incoming HCI packet buffer to small for largest HCI Event packet. Please set HCI_ACL_PAYLOAD_SIZE to 257 or higher."
657a4d61a3SMatthias Ringwald #endif
668174b66aSMatthias Ringwald 
678174b66aSMatthias Ringwald // Vendor specific structs
688174b66aSMatthias Ringwald 
698174b66aSMatthias Ringwald typedef struct {
708174b66aSMatthias Ringwald     uint8_t status;
718174b66aSMatthias Ringwald     uint8_t hw_platform;
728174b66aSMatthias Ringwald     uint8_t hw_variant;
738174b66aSMatthias Ringwald     uint8_t hw_revision;
748174b66aSMatthias Ringwald     uint8_t fw_variant;
758174b66aSMatthias Ringwald     uint8_t fw_revision;
768174b66aSMatthias Ringwald     uint8_t fw_build_num;
778174b66aSMatthias Ringwald     uint8_t fw_build_ww;
788174b66aSMatthias Ringwald     uint8_t fw_build_yy;
798174b66aSMatthias Ringwald     uint8_t fw_patch_num;
808174b66aSMatthias Ringwald } intel_version_t;
818174b66aSMatthias Ringwald 
828174b66aSMatthias Ringwald typedef struct {
838174b66aSMatthias Ringwald     uint8_t     status;
848174b66aSMatthias Ringwald     uint8_t     otp_format;
858174b66aSMatthias Ringwald     uint8_t     otp_content;
868174b66aSMatthias Ringwald     uint8_t     otp_patch;
878174b66aSMatthias Ringwald     uint16_t    dev_revid;
888174b66aSMatthias Ringwald     uint8_t     secure_boot;
898174b66aSMatthias Ringwald     uint8_t     key_from_hdr;
908174b66aSMatthias Ringwald     uint8_t     key_type;
918174b66aSMatthias Ringwald     uint8_t     otp_lock;
928174b66aSMatthias Ringwald     uint8_t     api_lock;
938174b66aSMatthias Ringwald     uint8_t     debug_lock;
948174b66aSMatthias Ringwald     bd_addr_t   otp_bdaddr;
958174b66aSMatthias Ringwald     uint8_t     min_fw_build_nn;
968174b66aSMatthias Ringwald     uint8_t     min_fw_build_cw;
978174b66aSMatthias Ringwald     uint8_t     min_fw_build_yy;
988174b66aSMatthias Ringwald     uint8_t     limited_cce;
998174b66aSMatthias Ringwald     uint8_t     unlocked_state;
1008174b66aSMatthias Ringwald } intel_boot_params_t;
1018174b66aSMatthias Ringwald 
1028174b66aSMatthias Ringwald // Vendor sepcific commands
1038174b66aSMatthias Ringwald 
1048174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_read_version = {
1058174b66aSMatthias Ringwald     0xfc05, ""
1068174b66aSMatthias Ringwald };
1078174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_read_secure_boot_params = {
1088174b66aSMatthias Ringwald     0xfc0d, ""
1098174b66aSMatthias Ringwald };
1108174b66aSMatthias Ringwald 
1118174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_reset_param = {
1128174b66aSMatthias Ringwald     0xfc01, "11111111"
1138174b66aSMatthias Ringwald };
1148174b66aSMatthias Ringwald 
1158174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_set_event_mask = {
1168174b66aSMatthias Ringwald     0xfc52, "11111111"
1178174b66aSMatthias Ringwald };
1188174b66aSMatthias Ringwald 
1198174b66aSMatthias Ringwald static const hci_cmd_t hci_intel_fc9f = {
1208174b66aSMatthias Ringwald     0xfc9f, "1"
1218174b66aSMatthias Ringwald };
1228174b66aSMatthias Ringwald 
1238174b66aSMatthias Ringwald // state
1248174b66aSMatthias Ringwald 
12529c6772bSMatthias Ringwald const char * firmware_path = ".";
12629c6772bSMatthias Ringwald 
1278174b66aSMatthias Ringwald const hci_transport_t * transport;
1288174b66aSMatthias Ringwald 
1298174b66aSMatthias Ringwald static int state = 0;
1308174b66aSMatthias Ringwald 
1318174b66aSMatthias Ringwald static uint8_t hci_outgoing[300];
1328174b66aSMatthias Ringwald static uint8_t fw_buffer[300];
1338174b66aSMatthias Ringwald 
1348174b66aSMatthias Ringwald static uint8_t  hw_variant;
1358174b66aSMatthias Ringwald static uint16_t dev_revid;
1368174b66aSMatthias Ringwald 
1378174b66aSMatthias Ringwald static FILE *   fw_file;
138*ce9d10fbSMatthias Ringwald static size_t   fw_offset;
1398174b66aSMatthias Ringwald 
1408174b66aSMatthias Ringwald static void (*done)(int result);
1418174b66aSMatthias Ringwald 
1428174b66aSMatthias Ringwald // functions
1438174b66aSMatthias Ringwald 
1448174b66aSMatthias Ringwald static int transport_send_packet(uint8_t packet_type, const uint8_t * packet, uint16_t size){
1458174b66aSMatthias Ringwald     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, (uint8_t*) packet, size);
1468174b66aSMatthias Ringwald     return transport->send_packet(packet_type, (uint8_t *) packet, size);
1478174b66aSMatthias Ringwald }
1488174b66aSMatthias Ringwald 
1498174b66aSMatthias Ringwald static int transport_send_cmd_va_arg(const hci_cmd_t *cmd, va_list argptr){
1508174b66aSMatthias Ringwald     uint8_t * packet = hci_outgoing;
1518174b66aSMatthias Ringwald     uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr);
1528174b66aSMatthias Ringwald     return transport_send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
1538174b66aSMatthias Ringwald }
1548174b66aSMatthias Ringwald 
1558174b66aSMatthias Ringwald static int transport_send_cmd(const hci_cmd_t *cmd, ...){
1568174b66aSMatthias Ringwald     va_list argptr;
1578174b66aSMatthias Ringwald     va_start(argptr, cmd);
1588174b66aSMatthias Ringwald     int res = transport_send_cmd_va_arg(cmd, argptr);
1598174b66aSMatthias Ringwald     va_end(argptr);
1608174b66aSMatthias Ringwald     return res;
1618174b66aSMatthias Ringwald }
1628174b66aSMatthias Ringwald 
163*ce9d10fbSMatthias Ringwald static int transport_send_intel_secure(uint8_t fragment_type, const uint8_t * data, uint8_t len){
1648174b66aSMatthias Ringwald     little_endian_store_16(hci_outgoing, 0, 0xfc09);
1658174b66aSMatthias Ringwald     hci_outgoing[2] = 1 + len;
1668174b66aSMatthias Ringwald     hci_outgoing[3] = fragment_type;
1678174b66aSMatthias Ringwald     memcpy(&hci_outgoing[4], data, len);
1688174b66aSMatthias Ringwald     uint16_t size = 3 +  1 + len;
1698174b66aSMatthias Ringwald     return transport_send_packet(HCI_ACL_DATA_PACKET, hci_outgoing, size);
1708174b66aSMatthias Ringwald }
1718174b66aSMatthias Ringwald 
172*ce9d10fbSMatthias Ringwald static int transport_send_intel_ddc(const uint8_t * data, uint8_t len){
1738174b66aSMatthias Ringwald     little_endian_store_16(hci_outgoing, 0, 0xfc8b);
1748174b66aSMatthias Ringwald     hci_outgoing[2] = len;
1758174b66aSMatthias Ringwald     memcpy(&hci_outgoing[3], data, len);
1768174b66aSMatthias Ringwald     uint16_t size = 3 +  len;
1778174b66aSMatthias Ringwald     return transport_send_packet(HCI_COMMAND_DATA_PACKET, hci_outgoing, size);
1788174b66aSMatthias Ringwald }
1798174b66aSMatthias Ringwald 
1808174b66aSMatthias Ringwald static void state_machine(uint8_t * packet);
1818174b66aSMatthias Ringwald 
1828174b66aSMatthias Ringwald // read data from fw file and send it via intel_secure + update state
183*ce9d10fbSMatthias Ringwald static int intel_send_fragment(uint8_t fragment_type, uint8_t len){
184*ce9d10fbSMatthias Ringwald     size_t res = fread(fw_buffer, 1, len, fw_file);
1858174b66aSMatthias Ringwald     log_info("offset %6u, read %3u -> res %d", fw_offset, len, res);
1868174b66aSMatthias Ringwald     fw_offset += res;
1878174b66aSMatthias Ringwald     state++;
1888174b66aSMatthias Ringwald     return transport_send_intel_secure(fragment_type, fw_buffer, len);
1898174b66aSMatthias Ringwald }
1908174b66aSMatthias Ringwald 
1918174b66aSMatthias Ringwald // read data from  ddc file and send iva intel ddc command
1928174b66aSMatthias Ringwald // @returns -1 on eof
1938174b66aSMatthias Ringwald static int intel_send_ddc(void){
194*ce9d10fbSMatthias Ringwald     size_t res;
1958174b66aSMatthias Ringwald     // read len
1968174b66aSMatthias Ringwald     res = fread(fw_buffer, 1, 1, fw_file);
1978174b66aSMatthias Ringwald     log_info("offset %6u, read 1 -> res %d", fw_offset, res);
1988174b66aSMatthias Ringwald     if (res == 0) return -1;
1998174b66aSMatthias Ringwald     uint8_t len = fw_buffer[0];
2008174b66aSMatthias Ringwald     fw_offset += 1;
2018174b66aSMatthias Ringwald     res = fread(&fw_buffer[1], 1, len, fw_file);
2028174b66aSMatthias Ringwald     log_info("offset %6u, read %u -> res %d", fw_offset, 1, res);
2038174b66aSMatthias Ringwald     return transport_send_intel_ddc(fw_buffer, 1 + len);
2048174b66aSMatthias Ringwald }
2058174b66aSMatthias Ringwald 
2068174b66aSMatthias Ringwald static void dump_intel_version(intel_version_t     * version){
2078174b66aSMatthias Ringwald     log_info("status       0x%02x", version->status);
2088174b66aSMatthias Ringwald     log_info("hw_platform  0x%02x", version->hw_platform);
2098174b66aSMatthias Ringwald     log_info("hw_variant   0x%02x", version->hw_variant);
2108174b66aSMatthias Ringwald     log_info("hw_revision  0x%02x", version->hw_revision);
2118174b66aSMatthias Ringwald     log_info("fw_variant   0x%02x", version->fw_variant);
2128174b66aSMatthias Ringwald     log_info("fw_revision  0x%02x", version->fw_revision);
2138174b66aSMatthias Ringwald     log_info("fw_build_num 0x%02x", version->fw_build_num);
2148174b66aSMatthias Ringwald     log_info("fw_build_ww  0x%02x", version->fw_build_ww);
2158174b66aSMatthias Ringwald     log_info("fw_build_yy  0x%02x", version->fw_build_yy);
2168174b66aSMatthias Ringwald     log_info("fw_patch_num 0x%02x", version->fw_patch_num);
2178174b66aSMatthias Ringwald }
2188174b66aSMatthias Ringwald 
2198174b66aSMatthias Ringwald static void dump_intel_boot_params(intel_boot_params_t * boot_params){
2208174b66aSMatthias Ringwald     bd_addr_t addr;
2218174b66aSMatthias Ringwald     reverse_bd_addr(boot_params->otp_bdaddr, addr);
2228174b66aSMatthias Ringwald     log_info("Device revision: %u", dev_revid);
2238174b66aSMatthias Ringwald     log_info("Secure Boot:  %s", boot_params->secure_boot ? "enabled" : "disabled");
2248174b66aSMatthias Ringwald     log_info("OTP lock:     %s", boot_params->otp_lock    ? "enabled" : "disabled");
2258174b66aSMatthias Ringwald     log_info("API lock:     %s", boot_params->api_lock    ? "enabled" : "disabled");
2268174b66aSMatthias Ringwald     log_info("Debug lock:   %s", boot_params->debug_lock  ? "enabled" : "disabled");
2278174b66aSMatthias Ringwald     log_info("Minimum firmware build %u week %u %u", boot_params->min_fw_build_nn, boot_params->min_fw_build_cw, 2000 + boot_params->min_fw_build_yy);
2288174b66aSMatthias Ringwald     log_info("OTC BD_ADDR:  %s", bd_addr_to_str(addr));
2298174b66aSMatthias Ringwald }
2308174b66aSMatthias Ringwald 
2318174b66aSMatthias Ringwald static int vendor_firmware_complete_received;
2328174b66aSMatthias Ringwald static int waiting_for_command_complete;
2338174b66aSMatthias Ringwald 
2348174b66aSMatthias Ringwald static void state_machine(uint8_t * packet){
2358174b66aSMatthias Ringwald     intel_version_t     * version;
2368174b66aSMatthias Ringwald     intel_boot_params_t * boot_params;
237*ce9d10fbSMatthias Ringwald     size_t res;
238*ce9d10fbSMatthias Ringwald     size_t buffer_offset;
2398174b66aSMatthias Ringwald     bd_addr_t addr;
24029c6772bSMatthias Ringwald     char    fw_path[300];
2418174b66aSMatthias Ringwald 
2428174b66aSMatthias Ringwald     if (packet){
2438174b66aSMatthias Ringwald         // firmware upload complete event?
2448174b66aSMatthias Ringwald         if (packet[0] == 0xff && packet[2] == 0x06) {
2458174b66aSMatthias Ringwald             vendor_firmware_complete_received = 1;
2468174b66aSMatthias Ringwald         }
2478174b66aSMatthias Ringwald 
2488174b66aSMatthias Ringwald         // command complete
2498174b66aSMatthias Ringwald         if (packet[0] == 0x0e){
2508174b66aSMatthias Ringwald             waiting_for_command_complete = 0;
2518174b66aSMatthias Ringwald         }
2528174b66aSMatthias Ringwald     }
2538174b66aSMatthias Ringwald 
2548174b66aSMatthias Ringwald     switch (state){
2558174b66aSMatthias Ringwald         case 0:
2568174b66aSMatthias Ringwald             state++;
2578174b66aSMatthias Ringwald             transport_send_cmd(&hci_reset);
2588174b66aSMatthias Ringwald             break;
2598174b66aSMatthias Ringwald         case 1:
26088362d5eSMatthias Ringwald             // check if HCI Reset was supported
26188362d5eSMatthias Ringwald             if (packet[0] == 0x0e && packet[1] == 0x04 && packet[3] == 0x03 && packet[4] == 0x0c && packet[5] == 0x00){
26288362d5eSMatthias Ringwald                 log_info("HCI Reset was successful, no need for firmware upload / or not an Intel chipset");
26388362d5eSMatthias Ringwald                 (*done)(0);
26488362d5eSMatthias Ringwald                 break;
26588362d5eSMatthias Ringwald             }
26688362d5eSMatthias Ringwald 
2678174b66aSMatthias Ringwald             // Read Intel Version
2688174b66aSMatthias Ringwald             state++;
2698174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_read_version);
2708174b66aSMatthias Ringwald             break;
2718174b66aSMatthias Ringwald         case 2:
2728174b66aSMatthias Ringwald             version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
2738174b66aSMatthias Ringwald             dump_intel_version(version);
2748174b66aSMatthias Ringwald 
2758174b66aSMatthias Ringwald             hw_variant = version->hw_variant;
2768174b66aSMatthias Ringwald 
2778174b66aSMatthias Ringwald             // fw_variant = 0x06 bootloader mode / 0x23 operational mode
2788174b66aSMatthias Ringwald             if (version->fw_variant == 0x23) {
2798174b66aSMatthias Ringwald                 (*done)(0);
2808174b66aSMatthias Ringwald                 break;
2818174b66aSMatthias Ringwald             }
2828174b66aSMatthias Ringwald 
2838174b66aSMatthias Ringwald             if (version->fw_variant != 0x06){
2848174b66aSMatthias Ringwald                 log_error("unknown fw_variant 0x%02x", version->fw_variant);
2858174b66aSMatthias Ringwald                 break;
2868174b66aSMatthias Ringwald             }
2878174b66aSMatthias Ringwald 
2888174b66aSMatthias Ringwald             // Read Intel Secure Boot Params
2898174b66aSMatthias Ringwald             state++;
2908174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_read_secure_boot_params);
2918174b66aSMatthias Ringwald             break;
2928174b66aSMatthias Ringwald         case 3:
2938174b66aSMatthias Ringwald             boot_params = (intel_boot_params_t *) hci_event_command_complete_get_return_parameters(packet);
2948174b66aSMatthias Ringwald             dump_intel_boot_params(boot_params);
2958174b66aSMatthias Ringwald 
2968174b66aSMatthias Ringwald             reverse_bd_addr(boot_params->otp_bdaddr, addr);
2978174b66aSMatthias Ringwald             dev_revid = little_endian_read_16((uint8_t*)&boot_params->dev_revid, 0);
2988174b66aSMatthias Ringwald 
2998174b66aSMatthias Ringwald             // assert commmand complete is required
3008174b66aSMatthias Ringwald             if (boot_params->limited_cce != 0) break;
3018174b66aSMatthias Ringwald 
3028174b66aSMatthias Ringwald             // firmware file
30329c6772bSMatthias Ringwald             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.sfi", firmware_path, hw_variant, dev_revid);
30429c6772bSMatthias Ringwald             log_info("Open firmware %s", fw_path);
30529c6772bSMatthias Ringwald             printf("Firwmare %s\n", fw_path);
3068174b66aSMatthias Ringwald 
3078174b66aSMatthias Ringwald             // open firmware file
3088174b66aSMatthias Ringwald             fw_offset = 0;
30929c6772bSMatthias Ringwald             fw_file = fopen(fw_path, "rb");
3108174b66aSMatthias Ringwald             if (!fw_file){
31129c6772bSMatthias Ringwald                 log_error("can't open file %s", fw_path);
3128174b66aSMatthias Ringwald                 (*done)(1);
3138174b66aSMatthias Ringwald                 return;
3148174b66aSMatthias Ringwald             }
3158174b66aSMatthias Ringwald 
3168174b66aSMatthias Ringwald             vendor_firmware_complete_received = 0;
3178174b66aSMatthias Ringwald 
3188174b66aSMatthias Ringwald             // send CCS segment - offset 0
3198174b66aSMatthias Ringwald             intel_send_fragment(0x00, 128);
3208174b66aSMatthias Ringwald             break;
3218174b66aSMatthias Ringwald         case 4:
3228174b66aSMatthias Ringwald             // send public key / part 1 - offset 128
3238174b66aSMatthias Ringwald             intel_send_fragment(0x03, 128);
3248174b66aSMatthias Ringwald             break;
3258174b66aSMatthias Ringwald         case 5:
3268174b66aSMatthias Ringwald             // send public key / part 2 - offset 384
3278174b66aSMatthias Ringwald             intel_send_fragment(0x03, 128);
3288174b66aSMatthias Ringwald             break;
3298174b66aSMatthias Ringwald         case 6:
3308174b66aSMatthias Ringwald             // skip 4 bytes
3318174b66aSMatthias Ringwald             res = fread(fw_buffer, 1, 4, fw_file);
3328174b66aSMatthias Ringwald             log_info("read res %d", res);
3338174b66aSMatthias Ringwald             fw_offset += res;
3348174b66aSMatthias Ringwald 
3358174b66aSMatthias Ringwald             // send signature / part 1 - offset 388
3368174b66aSMatthias Ringwald             intel_send_fragment(0x02, 128);
3378174b66aSMatthias Ringwald             break;
3388174b66aSMatthias Ringwald         case 7:
3398174b66aSMatthias Ringwald             // send signature / part 2 - offset 516
3408174b66aSMatthias Ringwald             intel_send_fragment(0x02, 128);
3418174b66aSMatthias Ringwald             break;
3428174b66aSMatthias Ringwald         case 8:
3438174b66aSMatthias Ringwald             // send firmware chunks - offset 644
3448174b66aSMatthias Ringwald             // chunk len must be 4 byte aligned
3458174b66aSMatthias Ringwald             // multiple commands can be combined
3468174b66aSMatthias Ringwald             buffer_offset = 0;
3478174b66aSMatthias Ringwald             do {
3488174b66aSMatthias Ringwald                 res = fread(&fw_buffer[buffer_offset], 1, 3, fw_file);
3498174b66aSMatthias Ringwald                 log_info("fw_offset %6u, buffer_offset %u, read %3u -> res %d", fw_offset, buffer_offset, 3, res);
3508174b66aSMatthias Ringwald                 fw_offset += res;
3518174b66aSMatthias Ringwald                 if (res == 0 ){
3528174b66aSMatthias Ringwald                     // EOF
3538174b66aSMatthias Ringwald                     log_info("End of file");
3548174b66aSMatthias Ringwald                     fclose(fw_file);
3558174b66aSMatthias Ringwald                     fw_file = NULL;
3568174b66aSMatthias Ringwald                     state++;
3578174b66aSMatthias Ringwald                     break;
3588174b66aSMatthias Ringwald                 }
3598174b66aSMatthias Ringwald                 int param_len = fw_buffer[buffer_offset + 2];
3608174b66aSMatthias Ringwald                 buffer_offset += 3;
3618174b66aSMatthias Ringwald                 if (param_len){
3628174b66aSMatthias Ringwald                     res = fread(&fw_buffer[buffer_offset], 1, param_len, fw_file);
3638174b66aSMatthias Ringwald                     fw_offset     += res;
3648174b66aSMatthias Ringwald                     buffer_offset += res;
3658174b66aSMatthias Ringwald                 }
3668174b66aSMatthias Ringwald             } while ((buffer_offset & 3) != 0);
3678174b66aSMatthias Ringwald 
3688174b66aSMatthias Ringwald             if (buffer_offset == 0) break;
3698174b66aSMatthias Ringwald 
3708174b66aSMatthias Ringwald             waiting_for_command_complete = 1;
371*ce9d10fbSMatthias Ringwald             transport_send_intel_secure(0x01, fw_buffer, (uint8_t) buffer_offset);
3728174b66aSMatthias Ringwald             break;
3738174b66aSMatthias Ringwald 
3748174b66aSMatthias Ringwald         case 9:
3758174b66aSMatthias Ringwald             // expect Vendor Specific Event 0x06
3768174b66aSMatthias Ringwald             if (!vendor_firmware_complete_received) break;
3778174b66aSMatthias Ringwald 
3788174b66aSMatthias Ringwald             printf("Firmware upload complete\n");
3798174b66aSMatthias Ringwald             log_info("Vendor Event 0x06 - firmware complete");
3808174b66aSMatthias Ringwald 
3818174b66aSMatthias Ringwald             // Reset Params - constants from Windows Intel driver
3828174b66aSMatthias Ringwald             state++;
3838174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_reset_param, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x04, 0x00);
3848174b66aSMatthias Ringwald             break;
3858174b66aSMatthias Ringwald 
3868174b66aSMatthias Ringwald         case 10:
3878174b66aSMatthias Ringwald             // expect Vendor Specific Event 0x02
3888174b66aSMatthias Ringwald             if (packet[0] != 0xff) break;
3898174b66aSMatthias Ringwald             if (packet[2] != 0x02) break;
3908174b66aSMatthias Ringwald 
3918174b66aSMatthias Ringwald             printf("Firmware operational\n");
3928174b66aSMatthias Ringwald             log_info("Vendor Event 0x02 - firmware operational");
3938174b66aSMatthias Ringwald 
3948174b66aSMatthias Ringwald             // Read Intel Version
3958174b66aSMatthias Ringwald             state++;
3968174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_read_version);
3978174b66aSMatthias Ringwald             break;
3988174b66aSMatthias Ringwald 
3998174b66aSMatthias Ringwald         case 11:
4008174b66aSMatthias Ringwald             version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
4018174b66aSMatthias Ringwald             dump_intel_version(version);
4028174b66aSMatthias Ringwald 
4038174b66aSMatthias Ringwald             // ddc config
40429c6772bSMatthias Ringwald             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.ddc", firmware_path, hw_variant, dev_revid);
40529c6772bSMatthias Ringwald             log_info("Open DDC %s", fw_path);
4068174b66aSMatthias Ringwald 
4078174b66aSMatthias Ringwald             // open ddc file
4088174b66aSMatthias Ringwald             fw_offset = 0;
40929c6772bSMatthias Ringwald             fw_file = fopen(fw_path, "rb");
4108174b66aSMatthias Ringwald             if (!fw_file){
41129c6772bSMatthias Ringwald                 log_error("can't open file %s", fw_path);
4128174b66aSMatthias Ringwald 
4138174b66aSMatthias Ringwald                 (*done)(1);
4148174b66aSMatthias Ringwald                 return;
4158174b66aSMatthias Ringwald             }
4168174b66aSMatthias Ringwald 
4178174b66aSMatthias Ringwald             // load ddc
4188174b66aSMatthias Ringwald             state++;
4198174b66aSMatthias Ringwald 
4208174b66aSMatthias Ringwald             /* fall through */
4218174b66aSMatthias Ringwald 
4228174b66aSMatthias Ringwald         case 12:
4238174b66aSMatthias Ringwald             res = intel_send_ddc();
4248174b66aSMatthias Ringwald             if (res == 0) break;
4258174b66aSMatthias Ringwald 
4268174b66aSMatthias Ringwald             // DDC download complete
4278174b66aSMatthias Ringwald             state++;
4288174b66aSMatthias Ringwald             log_info("Load DDC Complete");
4298174b66aSMatthias Ringwald 
4308174b66aSMatthias Ringwald 
4318174b66aSMatthias Ringwald             // Set Intel event mask 0xfc52
4328174b66aSMatthias Ringwald             state++;
4338174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_set_event_mask, 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
4348174b66aSMatthias Ringwald             break;
4358174b66aSMatthias Ringwald 
4368174b66aSMatthias Ringwald         case 13:
4378174b66aSMatthias Ringwald             // 9F FC 01 00
4388174b66aSMatthias Ringwald             state++;
4398174b66aSMatthias Ringwald             transport_send_cmd(&hci_intel_fc9f, 0x00);
4408174b66aSMatthias Ringwald             break;
4418174b66aSMatthias Ringwald 
4428174b66aSMatthias Ringwald         case 14:
4438174b66aSMatthias Ringwald             (*done)(0);
4448174b66aSMatthias Ringwald             break;
4458174b66aSMatthias Ringwald 
4468174b66aSMatthias Ringwald         default:
4478174b66aSMatthias Ringwald             break;
4488174b66aSMatthias Ringwald     }
4498174b66aSMatthias Ringwald }
4508174b66aSMatthias Ringwald 
4518174b66aSMatthias Ringwald static void transport_packet_handler (uint8_t packet_type, uint8_t *packet, uint16_t size){
4528174b66aSMatthias Ringwald     UNUSED(packet_type);
4538174b66aSMatthias Ringwald     // we also get events with packet_type ACL from the controller
4548174b66aSMatthias Ringwald     hci_dump_packet(HCI_EVENT_PACKET, 1, packet, size);
4558174b66aSMatthias Ringwald     switch (hci_event_packet_get_type(packet)){
4568174b66aSMatthias Ringwald         case HCI_EVENT_COMMAND_COMPLETE:
4578174b66aSMatthias Ringwald         case HCI_EVENT_VENDOR_SPECIFIC:
4588174b66aSMatthias Ringwald             state_machine(packet);
4598174b66aSMatthias Ringwald             break;
4608174b66aSMatthias Ringwald         default:
4618174b66aSMatthias Ringwald             break;
4628174b66aSMatthias Ringwald     }
4638174b66aSMatthias Ringwald }
4648174b66aSMatthias Ringwald 
46529c6772bSMatthias Ringwald void btstack_chipset_intel_set_firmware_path(const char * path){
46629c6772bSMatthias Ringwald     firmware_path = path;
46729c6772bSMatthias Ringwald }
46829c6772bSMatthias Ringwald 
4698174b66aSMatthias Ringwald void btstack_chipset_intel_download_firmware(const hci_transport_t * hci_transport, void (*callback)(int result)){
4708174b66aSMatthias Ringwald 
4718174b66aSMatthias Ringwald     done = callback;
4728174b66aSMatthias Ringwald 
4738174b66aSMatthias Ringwald 	transport = hci_transport;;
4748174b66aSMatthias Ringwald     // transport->init(NULL);
4758174b66aSMatthias Ringwald     transport->register_packet_handler(&transport_packet_handler);
4768174b66aSMatthias Ringwald     transport->open();
4778174b66aSMatthias Ringwald 
4788174b66aSMatthias Ringwald     // get started
4798174b66aSMatthias Ringwald     state = 0;
4808174b66aSMatthias Ringwald     state_machine(NULL);
4818174b66aSMatthias Ringwald }
482