xref: /btstack/chipset/intel/btstack_chipset_intel_firmware.c (revision 5c04b7338dd9e0d0629df30e599d516247baac82)
1 /*
2  * Copyright (C) 2018 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "btstack_chipset_intel_firmware.c"
39 
40 #include <fcntl.h>
41 #include <stdio.h>
42 #include <inttypes.h>
43 
44 #include "btstack_chipset_intel_firmware.h"
45 
46 #include "bluetooth.h"
47 #include "btstack_debug.h"
48 #include "btstack_event.h"
49 #include "btstack_run_loop.h"
50 #include "btstack_util.h"
51 #include "hci.h"
52 #include "hci_cmd.h"
53 #include "hci_dump.h"
54 
55 #ifdef _MSC_VER
56  // ignore deprecated warning for fopen
57 #pragma warning(disable : 4996)
58 #endif
59 
60 // assert outgoing and incoming hci packet buffers can hold max hci command resp. event packet
61 #if HCI_OUTGOING_PACKET_BUFFER_SIZE < (HCI_CMD_HEADER_SIZE + 255)
62 #error "HCI_OUTGOING_PACKET_BUFFER_SIZE to small. Outgoing HCI packet buffer to small for largest HCI Command packet. Please set HCI_ACL_PAYLOAD_SIZE to 258 or higher."
63 #endif
64 #if HCI_INCOMING_PACKET_BUFFER_SIZE < (HCI_EVENT_HEADER_SIZE_HEADER_SIZE + 255)
65 #error "HCI_INCOMING_PACKET_BUFFER_SIZE to small. Incoming HCI packet buffer to small for largest HCI Event packet. Please set HCI_ACL_PAYLOAD_SIZE to 257 or higher."
66 #endif
67 
68 // Vendor specific structs
69 
70 typedef struct {
71     uint8_t status;
72     uint8_t hw_platform;
73     uint8_t hw_variant;
74     uint8_t hw_revision;
75     uint8_t fw_variant;
76     uint8_t fw_revision;
77     uint8_t fw_build_num;
78     uint8_t fw_build_ww;
79     uint8_t fw_build_yy;
80     uint8_t fw_patch_num;
81 } intel_version_t;
82 
83 typedef struct {
84     uint8_t     status;
85     uint8_t     otp_format;
86     uint8_t     otp_content;
87     uint8_t     otp_patch;
88     uint16_t    dev_revid;
89     uint8_t     secure_boot;
90     uint8_t     key_from_hdr;
91     uint8_t     key_type;
92     uint8_t     otp_lock;
93     uint8_t     api_lock;
94     uint8_t     debug_lock;
95     bd_addr_t   otp_bdaddr;
96     uint8_t     min_fw_build_nn;
97     uint8_t     min_fw_build_cw;
98     uint8_t     min_fw_build_yy;
99     uint8_t     limited_cce;
100     uint8_t     unlocked_state;
101 } intel_boot_params_t;
102 
103 typedef enum {
104     INTEL_CONTROLLER_LEGACY,
105     INTEL_CONTROLLER_TLV,
106 } intel_controller_mode_t;
107 
108 // Vendor specific commands
109 
110 static const hci_cmd_t hci_intel_read_version = {
111     0xfc05, "1"
112 };
113 static const hci_cmd_t hci_intel_read_secure_boot_params = {
114     0xfc0d, ""
115 };
116 
117 static const hci_cmd_t hci_intel_reset_param = {
118     0xfc01, "11111111"
119 };
120 
121 static const hci_cmd_t hci_intel_set_event_mask = {
122     0xfc52, "11111111"
123 };
124 
125 // state
126 
127 const char * firmware_path = ".";
128 
129 static intel_controller_mode_t controller_mode;
130 
131 const hci_transport_t * transport;
132 
133 typedef enum {
134     STATE_INITIAL = 0,
135     STATE_HANDLE_HCI_RESET = 1,
136     STATE_HANDLE_READ_VERSION_1 = 2,
137     STATE_HANDLE_READ_SECURE_BOOT_PARAMS = 3,
138     STATE_SEND_PUBLIC_KEY_1 = 4,
139     STATE_SEND_PUBLIC_KEY_2 = 5,
140     STATE_SEND_SIGNATURE_PART_1 = 6,
141     STATE_SEND_SIGNATURE_PART_2 = 7,
142     STATE_SEND_FIRMWARE_CHUNK = 8,
143     STATE_HANDLE_FIRMWARE_CHUNKS_SENT = 9,
144     STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02 = 10,
145     STATE_HANDLE_READ_VERSION_2 = 11,
146     STATE_SEND_DDC = 12,
147     STATE_DONE = 15
148 } state_t;
149 
150 static state_t state;
151 
152 static uint8_t hci_outgoing[300];
153 static uint8_t fw_buffer[300];
154 
155 static uint8_t  hw_variant;
156 static uint16_t dev_revid;
157 
158 static FILE *   fw_file;
159 static size_t   fw_offset;
160 
161 static void (*done)(int result);
162 
163 // functions
164 
165 static int transport_send_packet(uint8_t packet_type, const uint8_t * packet, uint16_t size){
166     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, (uint8_t*) packet, size);
167     return transport->send_packet(packet_type, (uint8_t *) packet, size);
168 }
169 
170 static int transport_send_cmd_va_arg(const hci_cmd_t *cmd, va_list argptr){
171     uint8_t * packet = hci_outgoing;
172     uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr);
173     return transport_send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
174 }
175 
176 static int transport_send_cmd(const hci_cmd_t *cmd, ...){
177     va_list argptr;
178     va_start(argptr, cmd);
179     int res = transport_send_cmd_va_arg(cmd, argptr);
180     va_end(argptr);
181     return res;
182 }
183 
184 static int transport_send_intel_secure(uint8_t fragment_type, const uint8_t * data, uint8_t len){
185     little_endian_store_16(hci_outgoing, 0, 0xfc09);
186     hci_outgoing[2] = 1 + len;
187     hci_outgoing[3] = fragment_type;
188     memcpy(&hci_outgoing[4], data, len);
189     uint16_t size = 3 +  1 + len;
190     return transport_send_packet(HCI_ACL_DATA_PACKET, hci_outgoing, size);
191 }
192 
193 static int transport_send_intel_ddc(const uint8_t * data, uint8_t len){
194     little_endian_store_16(hci_outgoing, 0, 0xfc8b);
195     hci_outgoing[2] = len;
196     memcpy(&hci_outgoing[3], data, len);
197     uint16_t size = 3 +  len;
198     return transport_send_packet(HCI_COMMAND_DATA_PACKET, hci_outgoing, size);
199 }
200 
201 static void state_machine(uint8_t *packet, uint16_t size);
202 
203 // read data from fw file and send it via intel_secure + update state
204 static int intel_send_fragment(uint8_t fragment_type, uint8_t len){
205     size_t res = fread(fw_buffer, 1, len, fw_file);
206     log_info("offset %6" PRId32 ", read %3u -> res %" PRId32 "", (int32_t)fw_offset, len, (int32_t)res);
207     fw_offset += res;
208     return transport_send_intel_secure(fragment_type, fw_buffer, len);
209 }
210 
211 // read data from  ddc file and send iva intel ddc command
212 // @returns -1 on eof
213 static int intel_send_ddc(void){
214     size_t res;
215     // read len
216     res = fread(fw_buffer, 1, 1, fw_file);
217     log_info("offset %6" PRId32 ", read 1 -> res %" PRId32 "", (int32_t)fw_offset, (int32_t)res);
218     if (res == 0) return -1;
219     uint8_t len = fw_buffer[0];
220     fw_offset += 1;
221     res = fread(&fw_buffer[1], 1, len, fw_file);
222     log_info("offset %6" PRId32 ", read %u -> res %" PRId32 "", (int32_t)fw_offset, 1, (int32_t)res);
223     return transport_send_intel_ddc(fw_buffer, 1 + len);
224 }
225 
226 static void dump_intel_version(intel_version_t     * version){
227     log_info("status       0x%02x", version->status);
228     log_info("hw_platform  0x%02x", version->hw_platform);
229     log_info("hw_variant   0x%02x", version->hw_variant);
230     log_info("hw_revision  0x%02x", version->hw_revision);
231     log_info("fw_variant   0x%02x", version->fw_variant);
232     log_info("fw_revision  0x%02x", version->fw_revision);
233     log_info("fw_build_num 0x%02x", version->fw_build_num);
234     log_info("fw_build_ww  0x%02x", version->fw_build_ww);
235     log_info("fw_build_yy  0x%02x", version->fw_build_yy);
236     log_info("fw_patch_num 0x%02x", version->fw_patch_num);
237 }
238 
239 static void dump_intel_boot_params(intel_boot_params_t * boot_params){
240     bd_addr_t addr;
241     reverse_bd_addr(boot_params->otp_bdaddr, addr);
242     log_info("Device revision: %u", dev_revid);
243     log_info("Secure Boot:  %s", boot_params->secure_boot ? "enabled" : "disabled");
244     log_info("OTP lock:     %s", boot_params->otp_lock    ? "enabled" : "disabled");
245     log_info("API lock:     %s", boot_params->api_lock    ? "enabled" : "disabled");
246     log_info("Debug lock:   %s", boot_params->debug_lock  ? "enabled" : "disabled");
247     log_info("Minimum firmware build %u week %u %u", boot_params->min_fw_build_nn, boot_params->min_fw_build_cw, 2000 + boot_params->min_fw_build_yy);
248     log_info("OTC BD_ADDR:  %s", bd_addr_to_str(addr));
249 }
250 
251 static int vendor_firmware_complete_received;
252 static int waiting_for_command_complete;
253 
254 static void state_machine(uint8_t *packet, uint16_t size) {
255     intel_version_t     * version;
256     intel_boot_params_t * boot_params;
257     size_t res;
258     size_t buffer_offset;
259     bd_addr_t addr;
260     char    fw_path[300];
261 
262     if (packet){
263         // firmware upload complete event?
264         if (packet[0] == 0xff && packet[2] == 0x06) {
265             vendor_firmware_complete_received = 1;
266         }
267 
268         // command complete
269         if (packet[0] == 0x0e){
270             waiting_for_command_complete = 0;
271         }
272     }
273 
274     switch (state){
275         case STATE_INITIAL:
276             controller_mode = INTEL_CONTROLLER_LEGACY;
277             state = STATE_HANDLE_HCI_RESET;
278             transport_send_cmd(&hci_reset);
279             break;
280         case STATE_HANDLE_HCI_RESET:
281             // check if HCI Reset was supported
282             if (packet[0] == 0x0e && packet[1] == 0x04 && packet[3] == 0x03 && packet[4] == 0x0c && packet[5] == 0x00){
283                 log_info("HCI Reset was successful, no need for firmware upload / or not an Intel chipset");
284                 (*done)(0);
285                 break;
286             }
287 
288             // Read Intel Version
289             state = STATE_HANDLE_READ_VERSION_1;
290             transport_send_cmd(&hci_intel_read_version, 0xff);
291             break;
292         case STATE_HANDLE_READ_VERSION_1:
293             // detect legacy vs. new TLV mode based on Read Version response
294             if ((size == sizeof(intel_version_t)) || (packet[1] != 0x037)){
295                 controller_mode = INTEL_CONTROLLER_TLV;
296                 printf("\nERROR: Intel Controller uses new TLV mode. TLV mode is not supported yet\n");
297                 printf("Details: https://github.com/torvalds/linux/blob/master/drivers/bluetooth/btintel.c\n\n");
298                 log_error("TLV mode not supported");
299                 (*done)(1);
300                 break;
301             }
302 
303             // legacy mode
304             version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
305             dump_intel_version(version);
306 
307             hw_variant = version->hw_variant;
308 
309             // fw_variant = 0x06 bootloader mode / 0x23 operational mode
310             if (version->fw_variant == 0x23) {
311                 (*done)(0);
312                 break;
313             }
314 
315             if (version->fw_variant != 0x06){
316                 log_error("unknown fw_variant 0x%02x", version->fw_variant);
317                 break;
318             }
319 
320             // Read Intel Secure Boot Params
321             state = STATE_HANDLE_READ_SECURE_BOOT_PARAMS;
322             transport_send_cmd(&hci_intel_read_secure_boot_params);
323             break;
324         case STATE_HANDLE_READ_SECURE_BOOT_PARAMS:
325             boot_params = (intel_boot_params_t *) hci_event_command_complete_get_return_parameters(packet);
326             dump_intel_boot_params(boot_params);
327 
328             reverse_bd_addr(boot_params->otp_bdaddr, addr);
329             dev_revid = little_endian_read_16((uint8_t*)&boot_params->dev_revid, 0);
330 
331             // assert command complete is required
332             if (boot_params->limited_cce != 0) break;
333 
334             // firmware file
335             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.sfi", firmware_path, hw_variant, dev_revid);
336             log_info("Open firmware %s", fw_path);
337             printf("Firmware %s\n", fw_path);
338 
339             // open firmware file
340             fw_offset = 0;
341             fw_file = fopen(fw_path, "rb");
342             if (!fw_file){
343                 log_error("can't open file %s", fw_path);
344                 (*done)(1);
345                 return;
346             }
347 
348             vendor_firmware_complete_received = 0;
349 
350             // send CCS segment - offset 0
351             state = STATE_SEND_PUBLIC_KEY_1;
352             intel_send_fragment(0x00, 128);
353             break;
354         case STATE_SEND_PUBLIC_KEY_1:
355             // send public key / part 1 - offset 128
356             state = STATE_SEND_PUBLIC_KEY_2;
357             intel_send_fragment(0x03, 128);
358             break;
359         case STATE_SEND_PUBLIC_KEY_2:
360             // send public key / part 2 - offset 384
361             state = STATE_SEND_SIGNATURE_PART_1;
362             intel_send_fragment(0x03, 128);
363             break;
364         case STATE_SEND_SIGNATURE_PART_1:
365             // skip 4 bytes
366             res = fread(fw_buffer, 1, 4, fw_file);
367             log_info("read res %d", (int)res);
368             fw_offset += res;
369 
370             // send signature / part 1 - offset 388
371             state = STATE_SEND_SIGNATURE_PART_2;
372             intel_send_fragment(0x02, 128);
373             break;
374         case STATE_SEND_SIGNATURE_PART_2:
375             // send signature / part 2 - offset 516
376             state = STATE_SEND_FIRMWARE_CHUNK;
377             intel_send_fragment(0x02, 128);
378             break;
379         case STATE_SEND_FIRMWARE_CHUNK:
380             // send firmware chunks - offset 644
381             // chunk len must be 4 byte aligned
382             // multiple commands can be combined
383             buffer_offset = 0;
384             do {
385                 res = fread(&fw_buffer[buffer_offset], 1, 3, fw_file);
386                 log_info("fw_offset %6" PRId32 ", buffer_offset %" PRId32 ", read %3u -> res %" PRId32 "", (int32_t)fw_offset, (int32_t)buffer_offset, 3, (int32_t)res);
387                 fw_offset += res;
388                 if (res == 0 ){
389                     // EOF
390                     log_info("End of file");
391                     fclose(fw_file);
392                     fw_file = NULL;
393                     state = STATE_HANDLE_FIRMWARE_CHUNKS_SENT;
394                     break;
395                 }
396                 int param_len = fw_buffer[buffer_offset + 2];
397                 buffer_offset += 3;
398                 if (param_len){
399                     res = fread(&fw_buffer[buffer_offset], 1, param_len, fw_file);
400                     fw_offset     += res;
401                     buffer_offset += res;
402                 }
403             } while ((buffer_offset & 3) != 0);
404 
405             if (buffer_offset == 0) break;
406 
407             waiting_for_command_complete = 1;
408             transport_send_intel_secure(0x01, fw_buffer, (uint8_t) buffer_offset);
409             break;
410 
411         case STATE_HANDLE_FIRMWARE_CHUNKS_SENT:
412             // expect Vendor Specific Event 0x06
413             if (!vendor_firmware_complete_received) break;
414 
415             printf("Firmware upload complete\n");
416             log_info("Vendor Event 0x06 - firmware complete");
417 
418             // Reset Params - constants from Windows Intel driver
419             state = STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02;
420             transport_send_cmd(&hci_intel_reset_param, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x04, 0x00);
421             break;
422 
423         case STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02:
424             // expect Vendor Specific Event 0x02
425             if (packet[0] != 0xff) break;
426             if (packet[2] != 0x02) break;
427 
428             printf("Firmware operational\n");
429             log_info("Vendor Event 0x02 - firmware operational");
430 
431             // Read Intel Version
432             state = STATE_HANDLE_READ_VERSION_2;
433             transport_send_cmd(&hci_intel_read_version);
434             break;
435 
436         case STATE_HANDLE_READ_VERSION_2:
437             version = (intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
438             dump_intel_version(version);
439 
440             // ddc config
441             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.ddc", firmware_path, hw_variant, dev_revid);
442             log_info("Open DDC %s", fw_path);
443 
444             // open ddc file
445             fw_offset = 0;
446             fw_file = fopen(fw_path, "rb");
447             if (!fw_file){
448                 log_error("can't open file %s", fw_path);
449 
450                 (*done)(1);
451                 return;
452             }
453 
454             // load ddc
455             state = STATE_SEND_DDC;
456 
457             /* fall through */
458 
459         case STATE_SEND_DDC:
460             res = intel_send_ddc();
461             if (res == 0) break;
462 
463             // DDC download complete
464             log_info("Load DDC Complete");
465 
466             // TODO: check if we need to wait for HCI Command Complete, resp. add another state here
467 
468             // Set Intel event mask 0xfc52
469             state = STATE_DONE;
470             transport_send_cmd(&hci_intel_set_event_mask, 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
471             break;
472 
473         case STATE_DONE:
474             (*done)(0);
475             break;
476 
477         default:
478             break;
479     }
480 }
481 
482 static void transport_packet_handler (uint8_t packet_type, uint8_t *packet, uint16_t size){
483     UNUSED(packet_type);
484     // we also get events with packet_type ACL from the controller
485     hci_dump_packet(HCI_EVENT_PACKET, 1, packet, size);
486     switch (hci_event_packet_get_type(packet)){
487         case HCI_EVENT_COMMAND_COMPLETE:
488         case HCI_EVENT_VENDOR_SPECIFIC:
489             state_machine(packet, size);
490             break;
491         default:
492             break;
493     }
494 }
495 
496 void btstack_chipset_intel_set_firmware_path(const char * path){
497     firmware_path = path;
498 }
499 
500 void btstack_chipset_intel_download_firmware(const hci_transport_t * hci_transport, void (*callback)(int result)){
501 
502     done = callback;
503 
504 	transport = hci_transport;;
505     transport->register_packet_handler(&transport_packet_handler);
506     transport->open();
507 
508     // get started
509     state = STATE_INITIAL;
510     state_machine(NULL, 0);
511 }
512