xref: /btstack/chipset/intel/btstack_chipset_intel_firmware.c (revision bca4e2d9179abaf29113005346370bbd5b91090b)
1 /*
2  * Copyright (C) 2018 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "btstack_chipset_intel_firmware.c"
39 
40 #include <fcntl.h>
41 #include <stdio.h>
42 #include <inttypes.h>
43 
44 #include "btstack_chipset_intel_firmware.h"
45 
46 #include "bluetooth.h"
47 #include "btstack_debug.h"
48 #include "btstack_event.h"
49 #include "btstack_run_loop.h"
50 #include "btstack_util.h"
51 #include "hci.h"
52 #include "hci_cmd.h"
53 #include "hci_dump.h"
54 
55 #ifdef _MSC_VER
56  // ignore deprecated warning for fopen
57 #pragma warning(disable : 4996)
58 #endif
59 
60 // assert outgoing and incoming hci packet buffers can hold max hci command resp. event packet
61 #if HCI_OUTGOING_PACKET_BUFFER_SIZE < (HCI_CMD_HEADER_SIZE + 255)
62 #error "HCI_OUTGOING_PACKET_BUFFER_SIZE to small. Outgoing HCI packet buffer to small for largest HCI Command packet. Please set HCI_ACL_PAYLOAD_SIZE to 258 or higher."
63 #endif
64 #if HCI_INCOMING_PACKET_BUFFER_SIZE < (HCI_EVENT_HEADER_SIZE_HEADER_SIZE + 255)
65 #error "HCI_INCOMING_PACKET_BUFFER_SIZE to small. Incoming HCI packet buffer to small for largest HCI Event packet. Please set HCI_ACL_PAYLOAD_SIZE to 257 or higher."
66 #endif
67 
68 // Vendor specific structs
69 
70 typedef struct {
71     uint8_t status;
72     uint8_t hw_platform;
73     uint8_t hw_variant;
74     uint8_t hw_revision;
75     uint8_t fw_variant;
76     uint8_t fw_revision;
77     uint8_t fw_build_num;
78     uint8_t fw_build_ww;
79     uint8_t fw_build_yy;
80     uint8_t fw_patch_num;
81 } intel_version_t;
82 
83 typedef struct {
84     uint8_t     status;
85     uint8_t     otp_format;
86     uint8_t     otp_content;
87     uint8_t     otp_patch;
88     uint16_t    dev_revid;
89     uint8_t     secure_boot;
90     uint8_t     key_from_hdr;
91     uint8_t     key_type;
92     uint8_t     otp_lock;
93     uint8_t     api_lock;
94     uint8_t     debug_lock;
95     bd_addr_t   otp_bdaddr;
96     uint8_t     min_fw_build_nn;
97     uint8_t     min_fw_build_cw;
98     uint8_t     min_fw_build_yy;
99     uint8_t     limited_cce;
100     uint8_t     unlocked_state;
101 } intel_boot_params_t;
102 
103 typedef enum {
104     INTEL_CONTROLLER_LEGACY,
105     INTEL_CONTROLLER_TLV,
106 } intel_controller_mode_t;
107 
108 typedef enum {
109     STATE_INITIAL = 0,
110     STATE_HANDLE_HCI_RESET = 1,
111     STATE_HANDLE_READ_VERSION_1 = 2,
112     STATE_HANDLE_READ_SECURE_BOOT_PARAMS = 3,
113     STATE_SEND_PUBLIC_KEY_1 = 4,
114     STATE_SEND_PUBLIC_KEY_2 = 5,
115     STATE_SEND_SIGNATURE_PART_1 = 6,
116     STATE_SEND_SIGNATURE_PART_2 = 7,
117     STATE_SEND_FIRMWARE_CHUNK = 8,
118     STATE_HANDLE_FIRMWARE_CHUNKS_SENT = 9,
119     STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02 = 10,
120     STATE_HANDLE_READ_VERSION_2 = 11,
121     STATE_SEND_DDC = 12,
122     STATE_DONE = 15
123 } state_t;
124 
125 // Vendor specific commands
126 
127 static const hci_cmd_t hci_intel_read_version = {
128     0xfc05, "1"
129 };
130 static const hci_cmd_t hci_intel_read_secure_boot_params = {
131     0xfc0d, ""
132 };
133 
134 static const hci_cmd_t hci_intel_reset_param = {
135     0xfc01, "11111111"
136 };
137 
138 static const hci_cmd_t hci_intel_set_event_mask = {
139     0xfc52, "11111111"
140 };
141 
142 // state
143 
144 const char * firmware_folder_path = ".";
145 
146 static intel_version_t     intel_version;
147 static intel_boot_params_t intel_boot_params;
148 
149 static intel_controller_mode_t controller_mode;
150 
151 const hci_transport_t * transport;
152 
153 static state_t state;
154 
155 static int vendor_firmware_complete_received;
156 static int waiting_for_command_complete;
157 
158 static uint8_t hci_outgoing[300];
159 static uint8_t fw_buffer[300];
160 
161 static uint8_t  hw_variant;
162 static uint16_t dev_revid;
163 
164 static FILE *   fw_file;
165 static size_t   fw_offset;
166 
167 static void (*done)(int result);
168 
169 // functions
170 
171 static int transport_send_packet(uint8_t packet_type, const uint8_t * packet, uint16_t size){
172     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, (uint8_t*) packet, size);
173     return transport->send_packet(packet_type, (uint8_t *) packet, size);
174 }
175 
176 static int transport_send_cmd_va_arg(const hci_cmd_t *cmd, va_list argptr){
177     uint8_t * packet = hci_outgoing;
178     uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr);
179     return transport_send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
180 }
181 
182 static int transport_send_cmd(const hci_cmd_t *cmd, ...){
183     va_list argptr;
184     va_start(argptr, cmd);
185     int res = transport_send_cmd_va_arg(cmd, argptr);
186     va_end(argptr);
187     return res;
188 }
189 
190 static int transport_send_intel_secure(uint8_t fragment_type, const uint8_t * data, uint8_t len){
191     little_endian_store_16(hci_outgoing, 0, 0xfc09);
192     hci_outgoing[2] = 1 + len;
193     hci_outgoing[3] = fragment_type;
194     memcpy(&hci_outgoing[4], data, len);
195     uint16_t size = 3 +  1 + len;
196     return transport_send_packet(HCI_ACL_DATA_PACKET, hci_outgoing, size);
197 }
198 
199 static int transport_send_intel_ddc(const uint8_t * data, uint8_t len){
200     little_endian_store_16(hci_outgoing, 0, 0xfc8b);
201     hci_outgoing[2] = len;
202     memcpy(&hci_outgoing[3], data, len);
203     uint16_t size = 3 +  len;
204     return transport_send_packet(HCI_COMMAND_DATA_PACKET, hci_outgoing, size);
205 }
206 
207 static void state_machine(uint8_t *packet, uint16_t size);
208 
209 // read data from fw file and send it via intel_secure + update state
210 static int intel_send_fragment(uint8_t fragment_type, uint8_t len){
211     size_t res = fread(fw_buffer, 1, len, fw_file);
212     log_info("offset %6" PRId32 ", read %3u -> res %" PRId32 "", (int32_t)fw_offset, len, (int32_t)res);
213     fw_offset += res;
214     return transport_send_intel_secure(fragment_type, fw_buffer, len);
215 }
216 
217 // read data from  ddc file and send iva intel ddc command
218 // @returns -1 on eof
219 static int intel_send_ddc(void){
220     size_t res;
221     // read len
222     res = fread(fw_buffer, 1, 1, fw_file);
223     log_info("offset %6" PRId32 ", read 1 -> res %" PRId32 "", (int32_t)fw_offset, (int32_t)res);
224     if (res == 0) return -1;
225     uint8_t len = fw_buffer[0];
226     fw_offset += 1;
227     res = fread(&fw_buffer[1], 1, len, fw_file);
228     log_info("offset %6" PRId32 ", read %u -> res %" PRId32 "", (int32_t)fw_offset, 1, (int32_t)res);
229     return transport_send_intel_ddc(fw_buffer, 1 + len);
230 }
231 
232 static void dump_intel_version(intel_version_t     * version){
233     log_info("status       0x%02x", version->status);
234     log_info("hw_platform  0x%02x", version->hw_platform);
235     log_info("hw_variant   0x%02x", version->hw_variant);
236     log_info("hw_revision  0x%02x", version->hw_revision);
237     log_info("fw_variant   0x%02x", version->fw_variant);
238     log_info("fw_revision  0x%02x", version->fw_revision);
239     log_info("fw_build_num 0x%02x", version->fw_build_num);
240     log_info("fw_build_ww  0x%02x", version->fw_build_ww);
241     log_info("fw_build_yy  0x%02x", version->fw_build_yy);
242     log_info("fw_patch_num 0x%02x", version->fw_patch_num);
243 }
244 
245 static void dump_intel_boot_params(intel_boot_params_t * boot_params){
246     bd_addr_t addr;
247     reverse_bd_addr(boot_params->otp_bdaddr, addr);
248     log_info("Device revision: %u", dev_revid);
249     log_info("Secure Boot:  %s", boot_params->secure_boot ? "enabled" : "disabled");
250     log_info("OTP lock:     %s", boot_params->otp_lock    ? "enabled" : "disabled");
251     log_info("API lock:     %s", boot_params->api_lock    ? "enabled" : "disabled");
252     log_info("Debug lock:   %s", boot_params->debug_lock  ? "enabled" : "disabled");
253     log_info("Minimum firmware build %u week %u %u", boot_params->min_fw_build_nn, boot_params->min_fw_build_cw, 2000 + boot_params->min_fw_build_yy);
254     log_info("OTC BD_ADDR:  %s", bd_addr_to_str(addr));
255 }
256 
257 static void state_machine(uint8_t *packet, uint16_t size) {
258     size_t res;
259     size_t buffer_offset;
260     bd_addr_t addr;
261     char    fw_path[300];
262 
263     if (packet){
264         // firmware upload complete event?
265         if (packet[0] == 0xff && packet[2] == 0x06) {
266             vendor_firmware_complete_received = 1;
267         }
268 
269         // command complete
270         if (packet[0] == 0x0e){
271             waiting_for_command_complete = 0;
272         }
273     }
274 
275     switch (state){
276         case STATE_INITIAL:
277             controller_mode = INTEL_CONTROLLER_LEGACY;
278             state = STATE_HANDLE_HCI_RESET;
279             transport_send_cmd(&hci_reset);
280             break;
281         case STATE_HANDLE_HCI_RESET:
282             // check if HCI Reset was supported
283             if (packet[0] == 0x0e && packet[1] == 0x04 && packet[3] == 0x03 && packet[4] == 0x0c && packet[5] == 0x00){
284                 log_info("HCI Reset was successful, no need for firmware upload / or not an Intel chipset");
285                 (*done)(0);
286                 break;
287             }
288 
289             // Read Intel Version
290             state = STATE_HANDLE_READ_VERSION_1;
291             transport_send_cmd(&hci_intel_read_version, 0xff);
292             break;
293         case STATE_HANDLE_READ_VERSION_1:
294             // detect legacy vs. new TLV mode based on Read Version response
295             if ((size == sizeof(intel_version_t)) || (packet[1] != 0x037)){
296                 controller_mode = INTEL_CONTROLLER_TLV;
297                 printf("\nERROR: Intel Controller uses new TLV mode. TLV mode is not supported yet\n");
298                 printf("Details: https://github.com/torvalds/linux/blob/master/drivers/bluetooth/btintel.c\n\n");
299                 log_error("TLV mode not supported");
300                 (*done)(1);
301                 break;
302             }
303 
304             // legacy mode
305             intel_version =  *(intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
306             dump_intel_version(&intel_version);
307 
308             hw_variant = intel_version.hw_variant;
309 
310             // fw_variant = 0x06 bootloader mode / 0x23 operational mode
311             if (intel_version.fw_variant == 0x23) {
312                 (*done)(0);
313                 break;
314             }
315 
316             if (intel_version.fw_variant != 0x06){
317                 log_error("unknown fw_variant 0x%02x", intel_version.fw_variant);
318                 break;
319             }
320 
321             // Read Intel Secure Boot Params
322             state = STATE_HANDLE_READ_SECURE_BOOT_PARAMS;
323             transport_send_cmd(&hci_intel_read_secure_boot_params);
324             break;
325         case STATE_HANDLE_READ_SECURE_BOOT_PARAMS:
326             intel_boot_params = *(intel_boot_params_t *) hci_event_command_complete_get_return_parameters(packet);
327             dump_intel_boot_params(&intel_boot_params);
328 
329             reverse_bd_addr(intel_boot_params.otp_bdaddr, addr);
330             dev_revid = little_endian_read_16((uint8_t*)&intel_boot_params.dev_revid, 0);
331 
332             // assert command complete is required
333             if (intel_boot_params.limited_cce != 0) break;
334 
335             // firmware file
336             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.sfi", firmware_folder_path, hw_variant, dev_revid);
337             log_info("Open firmware %s", fw_path);
338             printf("Firmware %s\n", fw_path);
339 
340             // open firmware file
341             fw_offset = 0;
342             fw_file = fopen(fw_path, "rb");
343             if (!fw_file){
344                 log_error("can't open file %s", fw_path);
345                 (*done)(1);
346                 return;
347             }
348 
349             vendor_firmware_complete_received = 0;
350 
351             // send CCS segment - offset 0
352             state = STATE_SEND_PUBLIC_KEY_1;
353             intel_send_fragment(0x00, 128);
354             break;
355         case STATE_SEND_PUBLIC_KEY_1:
356             // send public key / part 1 - offset 128
357             state = STATE_SEND_PUBLIC_KEY_2;
358             intel_send_fragment(0x03, 128);
359             break;
360         case STATE_SEND_PUBLIC_KEY_2:
361             // send public key / part 2 - offset 384
362             state = STATE_SEND_SIGNATURE_PART_1;
363             intel_send_fragment(0x03, 128);
364             break;
365         case STATE_SEND_SIGNATURE_PART_1:
366             // skip 4 bytes
367             res = fread(fw_buffer, 1, 4, fw_file);
368             log_info("read res %d", (int)res);
369             fw_offset += res;
370 
371             // send signature / part 1 - offset 388
372             state = STATE_SEND_SIGNATURE_PART_2;
373             intel_send_fragment(0x02, 128);
374             break;
375         case STATE_SEND_SIGNATURE_PART_2:
376             // send signature / part 2 - offset 516
377             state = STATE_SEND_FIRMWARE_CHUNK;
378             intel_send_fragment(0x02, 128);
379             break;
380         case STATE_SEND_FIRMWARE_CHUNK:
381             // send firmware chunks - offset 644
382             // chunk len must be 4 byte aligned
383             // multiple commands can be combined
384             buffer_offset = 0;
385             do {
386                 res = fread(&fw_buffer[buffer_offset], 1, 3, fw_file);
387                 log_info("fw_offset %6" PRId32 ", buffer_offset %" PRId32 ", read %3u -> res %" PRId32 "", (int32_t)fw_offset, (int32_t)buffer_offset, 3, (int32_t)res);
388                 fw_offset += res;
389                 if (res == 0 ){
390                     // EOF
391                     log_info("End of file");
392                     fclose(fw_file);
393                     fw_file = NULL;
394                     state = STATE_HANDLE_FIRMWARE_CHUNKS_SENT;
395                     break;
396                 }
397                 int param_len = fw_buffer[buffer_offset + 2];
398                 buffer_offset += 3;
399                 if (param_len){
400                     res = fread(&fw_buffer[buffer_offset], 1, param_len, fw_file);
401                     fw_offset     += res;
402                     buffer_offset += res;
403                 }
404             } while ((buffer_offset & 3) != 0);
405 
406             if (buffer_offset == 0) break;
407 
408             waiting_for_command_complete = 1;
409             transport_send_intel_secure(0x01, fw_buffer, (uint8_t) buffer_offset);
410             break;
411 
412         case STATE_HANDLE_FIRMWARE_CHUNKS_SENT:
413             // expect Vendor Specific Event 0x06
414             if (!vendor_firmware_complete_received) break;
415 
416             printf("Firmware upload complete\n");
417             log_info("Vendor Event 0x06 - firmware complete");
418 
419             // Reset Params - constants from Windows Intel driver
420             state = STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02;
421             transport_send_cmd(&hci_intel_reset_param, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x04, 0x00);
422             break;
423 
424         case STATE_HANDLE_VENDOR_SPECIFIC_EVENT_02:
425             // expect Vendor Specific Event 0x02
426             if (packet[0] != 0xff) break;
427             if (packet[2] != 0x02) break;
428 
429             printf("Firmware operational\n");
430             log_info("Vendor Event 0x02 - firmware operational");
431 
432             // Read Intel Version
433             state = STATE_HANDLE_READ_VERSION_2;
434             transport_send_cmd(&hci_intel_read_version);
435             break;
436 
437         case STATE_HANDLE_READ_VERSION_2:
438             intel_version = *(intel_version_t*) hci_event_command_complete_get_return_parameters(packet);
439             dump_intel_version(&intel_version);
440 
441             // ddc config
442             snprintf(fw_path, sizeof(fw_path), "%s/ibt-%u-%u.ddc", firmware_folder_path, hw_variant, dev_revid);
443             log_info("Open DDC %s", fw_path);
444 
445             // open ddc file
446             fw_offset = 0;
447             fw_file = fopen(fw_path, "rb");
448             if (!fw_file){
449                 log_error("can't open file %s", fw_path);
450 
451                 (*done)(1);
452                 return;
453             }
454 
455             // load ddc
456             state = STATE_SEND_DDC;
457 
458             /* fall through */
459 
460         case STATE_SEND_DDC:
461             res = intel_send_ddc();
462             if (res == 0) break;
463 
464             // DDC download complete
465             log_info("Load DDC Complete");
466 
467             // TODO: check if we need to wait for HCI Command Complete, resp. add another state here
468 
469             // Set Intel event mask 0xfc52
470             state = STATE_DONE;
471             transport_send_cmd(&hci_intel_set_event_mask, 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);
472             break;
473 
474         case STATE_DONE:
475             (*done)(0);
476             break;
477 
478         default:
479             break;
480     }
481 }
482 
483 static void transport_packet_handler (uint8_t packet_type, uint8_t *packet, uint16_t size){
484     UNUSED(packet_type);
485     // we also get events with packet_type ACL from the controller
486     hci_dump_packet(HCI_EVENT_PACKET, 1, packet, size);
487     switch (hci_event_packet_get_type(packet)){
488         case HCI_EVENT_COMMAND_COMPLETE:
489         case HCI_EVENT_VENDOR_SPECIFIC:
490             state_machine(packet, size);
491             break;
492         default:
493             break;
494     }
495 }
496 
497 void btstack_chipset_intel_set_firmware_path(const char * path){
498     firmware_folder_path = path;
499 }
500 
501 void btstack_chipset_intel_download_firmware(const hci_transport_t * hci_transport, void (*callback)(int result)){
502 
503     done = callback;
504 
505 	transport = hci_transport;;
506     transport->register_packet_handler(&transport_packet_handler);
507     transport->open();
508 
509     // get started
510     state = STATE_INITIAL;
511     state_machine(NULL, 0);
512 }
513