diff --git a/bin/bluetooth_tools/bt_intel_tool/BUILD.gn b/bin/bluetooth_tools/bt_intel_tool/BUILD.gn
index 5ab4b0f..7aad0fe 100644
--- a/bin/bluetooth_tools/bt_intel_tool/BUILD.gn
+++ b/bin/bluetooth_tools/bt_intel_tool/BUILD.gn
@@ -6,8 +6,12 @@
   output_name = "bt-intel-tool"
 
   sources = [
+    "command_channel.cc",
+    "command_channel.h",
     "commands.cc",
     "commands.h",
+    "intel_firmware_loader.cc",
+    "intel_firmware_loader.h",
     "main.cc",
   ]
 
diff --git a/bin/bluetooth_tools/bt_intel_tool/bt_intel.h b/bin/bluetooth_tools/bt_intel_tool/bt_intel.h
index 8b4db9d..260e33e 100644
--- a/bin/bluetooth_tools/bt_intel_tool/bt_intel.h
+++ b/bin/bluetooth_tools/bt_intel_tool/bt_intel.h
@@ -25,6 +25,9 @@
   uint8_t fw_patch_num;
 } __PACKED;
 
+constexpr bluetooth::hci::OpCode kSecureSend =
+    bluetooth::hci::VendorOpCode(0x0009);
+
 constexpr bluetooth::hci::OpCode kReadBootParams =
     bluetooth::hci::VendorOpCode(0x000D);
 
@@ -54,4 +57,32 @@
   uint8_t data[8];
 } __PACKED;
 
+constexpr bluetooth::hci::OpCode kMfgModeChange =
+    bluetooth::hci::VendorOpCode(0x0011);
+
+enum class MfgDisableMode : uint8_t {
+  kNoPatches = 0x00,
+  kPatchesDisabled = 0x01,
+  kPatchesEnabled = 0x02,
+};
+
+struct IntelMfgModeChangeCommandParams {
+  uint8_t enable;
+  MfgDisableMode disable_mode;
+} __PACKED;
+
+struct IntelSecureSendEventParams {
+    uint8_t vendor_event_code;
+    uint8_t result;
+    uint16_t opcode;
+    uint8_t status;
+} __PACKED;
+
+struct IntelBootloaderVendorEventParams {
+  FXL_DISALLOW_IMPLICIT_CONSTRUCTORS(IntelBootloaderVendorEventParams);
+
+  uint8_t vendor_event_code;
+  uint8_t vendor_params[];
+} __PACKED;
+
 }  // namespace bt_intel
diff --git a/bin/bluetooth_tools/bt_intel_tool/command_channel.cc b/bin/bluetooth_tools/bt_intel_tool/command_channel.cc
new file mode 100644
index 0000000..940d2a2
--- /dev/null
+++ b/bin/bluetooth_tools/bt_intel_tool/command_channel.cc
@@ -0,0 +1,240 @@
+// Copyright 2017 The Fuchsia Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "command_channel.h"
+
+#include <fcntl.h>
+
+#include <iostream>
+
+#include <async/default.h>
+#include <async/loop.h>
+#include <zircon/device/bt-hci.h>
+#include <zircon/status.h>
+#include <zx/event.h>
+#include <zx/time.h>
+#include <zx/timer.h>
+
+#include "garnet/drivers/bluetooth/lib/hci/slab_allocators.h"
+
+namespace {
+
+zx::channel GetCommandChannel(int fd) {
+  zx::channel channel;
+  ssize_t status =
+      ioctl_bt_hci_get_command_channel(fd, channel.reset_and_get_address());
+  if (status < 0) {
+    std::cerr << "hci: Failed to obtain command channel handle: "
+              << zx_status_get_string(status) << std::endl;
+    assert(!channel.is_valid());
+  }
+
+  return channel;
+}
+
+
+zx::channel GetAclChannel(int fd) {
+  zx::channel channel;
+  ssize_t status =
+      ioctl_bt_hci_get_acl_data_channel(fd, channel.reset_and_get_address());
+  if (status < 0) {
+    std::cerr << "hci: Failed to obtain ADL data channel handle: "
+              << zx_status_get_string(status) << std::endl;
+    assert(!channel.is_valid());
+  }
+
+  return channel;
+}
+
+}  // namespace
+
+CommandChannel::CommandChannel(std::string hcidev_path) {
+  hci_fd_.reset(open(hcidev_path.c_str(), O_RDWR));
+  if (!bool(hci_fd_)) {
+    return;
+  }
+  channel_ = GetCommandChannel(hci_fd_.get());
+  channel_wait_.set_object(channel_.get());
+  channel_wait_.set_trigger(ZX_CHANNEL_READABLE);
+  channel_wait_.set_handler(
+      fbl::BindMember(this, &CommandChannel::OnChannelReady));
+  zx_status_t status = channel_wait_.Begin(async_get_default());
+  if (status != ZX_OK) {
+    std::cerr << "CommandChannel: problem setting up HCI command channel: "
+              << zx_status_get_string(status) << std::endl;
+    return;
+  }
+
+  acl_channel_ = GetAclChannel(hci_fd_.get());
+  acl_channel_wait_.set_object(acl_channel_.get());
+  acl_channel_wait_.set_trigger(ZX_CHANNEL_READABLE);
+  acl_channel_wait_.set_handler(
+      fbl::BindMember(this, &CommandChannel::OnAclChannelReady));
+  status = acl_channel_wait_.Begin(async_get_default());
+  if (status != ZX_OK) {
+    std::cerr << "CommandChannel: problem setting up ACL data channel: "
+              << zx_status_get_string(status) << std::endl;
+  }
+}
+
+CommandChannel::~CommandChannel() {
+  SetEventCallback(nullptr);
+  channel_wait_.Cancel(async_get_default());
+  acl_channel_wait_.Cancel(async_get_default());
+}
+
+void CommandChannel::SetEventCallback(const EventCallback& callback) {
+  event_callback_ = callback;
+}
+
+void CommandChannel::SendCommand(
+    const bluetooth::common::PacketView<bluetooth::hci::CommandHeader>&
+        command) {
+  // TODO(jamuraa): handle this in a non-shitty way later.
+  // If this is a 0xfc09 packet (and we're in bootloader mode, which is what we
+  // boot to - it needs to, nonsensically, be sent down the bulk URB instead of
+  // the standard one, so send it via the ACL channel, because that will do the
+  // right thing, since the ACL channel uses the bulk endpoint always.
+  zx_status_t status;
+  if (command.header().opcode == 0xfc09) {
+    status = acl_channel_.write(0, command.data().data(), command.size(), nullptr, 0);
+  } else {
+    status = channel_.write(0, command.data().data(), command.size(), nullptr, 0);
+  }
+  if (status < 0) {
+    // TODO(jamuraa): Maybe return the zx_status_t in this case?
+    std::cerr << "CommandChannel: Failed to send command: "
+              << zx_status_get_string(status) << std::endl;
+  }
+}
+
+void CommandChannel::SendCommandSync(
+    const bluetooth::common::PacketView<bluetooth::hci::CommandHeader>& command,
+    const EventCallback& callback) {
+  zx::event received;
+  zx::event::create(0, &received);
+
+  auto cb = [this, &received, callback](const auto& event_packet) {
+    if (callback) {
+      callback(event_packet);
+    }
+    received.signal(0, ZX_USER_SIGNAL_0);
+  };
+
+  SetEventCallback(cb);
+
+  SendCommand(command);
+
+  // Spin here until we get a response..
+  zx_status_t status;
+  zx::timer timeout;
+  zx::timer::create(0, ZX_CLOCK_MONOTONIC, &timeout);
+  timeout.set(zx::deadline_after(ZX_MSEC(200)), ZX_MSEC(50));
+  for (;;) {
+    async_loop_run(async_get_default(), zx::deadline_after(ZX_MSEC(10)), true);
+    status = received.wait_one(ZX_USER_SIGNAL_0, 0u, nullptr);
+    if (status != ZX_ERR_TIMED_OUT) {
+      break;
+    }
+    status = timeout.wait_one(ZX_TIMER_SIGNALED, 0u, nullptr);
+    if (status != ZX_ERR_TIMED_OUT) {
+      status = ZX_ERR_TIMED_OUT;
+      break;
+    }
+  }
+
+  SetEventCallback(nullptr);
+
+  if (status == ZX_OK) {
+    return;
+  }
+
+  std::cerr << "CommandChannel: error waiting for event "
+            << zx_status_get_string(status) << std::endl;
+}
+
+async_wait_result_t CommandChannel::HandleChannelReady(
+    const zx::channel& channel,
+    async_t* async,
+    zx_status_t status,
+    const zx_packet_signal_t* signal) {
+  FXL_DCHECK(signal->observed & ZX_CHANNEL_READABLE);
+
+  if (status != ZX_OK) {
+    std::cerr << "CommandChannel: channel error: "
+              << zx_status_get_string(status) << std::endl;
+    return ASYNC_WAIT_FINISHED;
+  }
+
+  // Allocate a buffer for the event. Since we don't know the size
+  // beforehand we allocate the largest possible buffer.
+
+  for (size_t count = 0; count < signal->count; count++) {
+    uint32_t read_size;
+    auto packet = bluetooth::hci::EventPacket::New(
+        bluetooth::hci::slab_allocators::kLargeControlPayloadSize);
+    if (!packet) {
+      std::cerr << "CommandChannel: Failed to allocate event packet!"
+                << std::endl;
+      return ASYNC_WAIT_FINISHED;
+    }
+    auto packet_bytes = packet->mutable_view()->mutable_data();
+    zx_status_t read_status =
+        channel.read(0u, packet_bytes.mutable_data(), packet_bytes.size(),
+                      &read_size, nullptr, 0, nullptr);
+    if (read_status < 0) {
+      std::cerr << "CommandChannel: Failed to read event bytes: "
+                << zx_status_get_string(read_status) << std::endl;
+      // Clear the handler so that we stop receiving events from it.
+      return ASYNC_WAIT_FINISHED;
+    }
+
+    if (read_size < sizeof(bluetooth::hci::EventHeader)) {
+      std::cerr << "CommandChannel: Malformed event packet - "
+                << "expected at least " << sizeof(bluetooth::hci::EventHeader)
+                << " bytes, got " << read_size << std::endl;
+      continue;
+    }
+
+    // Compare the received payload size to what is in the header.
+    const size_t rx_payload_size =
+        read_size - sizeof(bluetooth::hci::EventHeader);
+    const size_t size_from_header =
+        packet->view().header().parameter_total_size;
+    if (size_from_header != rx_payload_size) {
+      std::cerr << "CommandChannel: Malformed event packet - "
+                << "payload size from header (" << size_from_header << ")"
+                << " does not match received payload size: " << rx_payload_size
+                << std::endl;
+      continue;
+    }
+
+    packet->InitializeFromBuffer();
+
+    if (event_callback_) {
+      event_callback_(*packet);
+    } else {
+      std::cerr << "CommandChannel: Event received with no handler:"
+                << packet->event_code() << std::endl;
+    }
+  }
+  return ASYNC_WAIT_AGAIN;
+}
+
+async_wait_result_t CommandChannel::OnChannelReady(
+    async_t* async,
+    zx_status_t status,
+    const zx_packet_signal_t* signal) {
+  // Just handle this.
+  return HandleChannelReady(channel_, async, status, signal);
+}
+
+async_wait_result_t CommandChannel::OnAclChannelReady(
+    async_t* async,
+    zx_status_t status,
+    const zx_packet_signal_t* signal) {
+  // This is probably a Command packet response from a Secure Send command.
+  std::cerr << "CommandChannel: ACL Data packet received, treating as a command packet.." << std::endl;
+  return HandleChannelReady(acl_channel_, async, status, signal);
+}
diff --git a/bin/bluetooth_tools/bt_intel_tool/command_channel.h b/bin/bluetooth_tools/bt_intel_tool/command_channel.h
new file mode 100644
index 0000000..0f190ce
--- /dev/null
+++ b/bin/bluetooth_tools/bt_intel_tool/command_channel.h
@@ -0,0 +1,67 @@
+// Copyright 2017 The Fuchsia Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#pragma once
+
+#include <fbl/unique_fd.h>
+#include <async/wait.h>
+#include <zircon/types.h>
+#include <zx/channel.h>
+
+#include "garnet/drivers/bluetooth/lib/hci/control_packets.h"
+
+// Sends and receives events from a command channel that it retrieves from a
+// Zircon Bluetooth HCI device.  It parses the incoming event packets, only
+// returning complete and valid event packets on to the event handler set.
+class CommandChannel {
+ public:
+  // |hcidev_path| is a path to the hci device (e.g. /dev/class/bt-hci/000)
+  CommandChannel(std::string hcidev_path);
+  ~CommandChannel();
+
+  // Indicates whether this channel is valid.  This should be checked after
+  // construction.
+  bool is_valid() { return channel_.is_valid(); }
+
+  using EventCallback =
+      std::function<void(const bluetooth::hci::EventPacket& event_packet)>;
+  // Sets the event callback to be called when an HCI Event arrives on the
+  // channel.
+  void SetEventCallback(const EventCallback& callback);
+
+  // Sends the command in |command| to the controller. The channel must
+  // be Ready when this is called.
+  void SendCommand(
+      const bluetooth::common::PacketView<bluetooth::hci::CommandHeader>&
+          command);
+
+  // Sends the command in |command| to the controller and waits for
+  // an Event, which is delivered to |callback| before this function
+  // returns.
+  void SendCommandSync(const bluetooth::common::PacketView<
+                           bluetooth::hci::CommandHeader>& command,
+                       const EventCallback& callback);
+
+ private:
+  // Common read handler for signalled channels
+  async_wait_result_t HandleChannelReady(const zx::channel& channel,
+                                         async_t* async,
+                                         zx_status_t status,
+                                         const zx_packet_signal_t* signal);
+
+  // Read ready handler for |channel_|
+  async_wait_result_t OnChannelReady(async_t* async,
+                                     zx_status_t status,
+                                     const zx_packet_signal_t* signal);
+
+  // Read ready handler for |acl_channel_|
+  async_wait_result_t OnAclChannelReady(async_t* async, zx_status_t status, const zx_packet_signal_t* signal);
+
+  EventCallback event_callback_;
+  fbl::unique_fd hci_fd_;
+  zx::channel channel_;
+  async::Wait channel_wait_;
+  zx::channel acl_channel_;
+  async::Wait acl_channel_wait_;
+};
diff --git a/bin/bluetooth_tools/bt_intel_tool/commands.cc b/bin/bluetooth_tools/bt_intel_tool/commands.cc
index 844d2fa..f74ee77 100644
--- a/bin/bluetooth_tools/bt_intel_tool/commands.cc
+++ b/bin/bluetooth_tools/bt_intel_tool/commands.cc
@@ -6,6 +6,7 @@
 
 #include <endian.h>
 
+#include <sys/mman.h>
 #include <cstring>
 #include <iostream>
 
@@ -20,6 +21,7 @@
 #include "lib/fxl/time/time_delta.h"
 
 #include "bt_intel.h"
+#include "intel_firmware_loader.h"
 
 using namespace bluetooth;
 
@@ -29,30 +31,45 @@
 namespace bt_intel {
 namespace {
 
-void StatusCallback(fxl::Closure complete_cb,
-                    bluetooth::hci::CommandChannel::TransactionId id,
-                    bluetooth::hci::Status status) {
-  std::cout << "  Command Status: " << fxl::StringPrintf("0x%02x", status)
-            << " (id=" << id << ")" << std::endl;
-  if (status != bluetooth::hci::Status::kSuccess)
-    complete_cb();
-}
+class MfgModeEnabler {
+ public:
+  MfgModeEnabler(CommandChannel* channel)
+      : channel_(channel), patch_reset_needed_(false) {
+    auto packet = MakeMfgModePacket(true);
+    channel_->SendCommand(packet->view());
+  }
 
-hci::CommandChannel::TransactionId SendCommand(
-    const CommandData* cmd_data,
-    std::unique_ptr<hci::CommandPacket> packet,
-    const hci::CommandChannel::CommandCompleteCallback& cb,
-    const fxl::Closure& complete_cb) {
-  return cmd_data->cmd_channel()->SendCommand(
-      std::move(packet), cmd_data->task_runner(), cb,
-      std::bind(&StatusCallback, complete_cb, _1, _2));
-}
+  ~MfgModeEnabler() {
+    MfgDisableMode disable_mode = MfgDisableMode::kNoPatches;
+    if (patch_reset_needed_)
+      disable_mode = MfgDisableMode::kPatchesEnabled;
 
-void LogCommandComplete(hci::Status status,
-                        hci::CommandChannel::TransactionId id) {
+    auto packet = MakeMfgModePacket(false, disable_mode);
+    channel_->SendCommand(packet->view());
+  }
+
+  void set_patch_reset(bool patch) { patch_reset_needed_ = patch; }
+
+ private:
+  CommandChannel* channel_;
+  bool patch_reset_needed_;
+
+  std::unique_ptr<hci::CommandPacket> MakeMfgModePacket(
+      bool enable,
+      MfgDisableMode disable_mode = MfgDisableMode::kNoPatches) {
+    auto packet = hci::CommandPacket::New(
+        kMfgModeChange, sizeof(IntelMfgModeChangeCommandParams));
+    auto params = packet->mutable_view()
+                      ->mutable_payload<IntelMfgModeChangeCommandParams>();
+    params->enable = enable ? 1 : 0;
+    params->disable_mode = disable_mode;
+    return packet;
+  }
+};
+
+void LogCommandComplete(hci::Status status) {
   std::cout << "  Command Complete - status: "
-            << fxl::StringPrintf("0x%02x", status) << " (id=" << id << ")"
-            << std::endl;
+            << fxl::StringPrintf("0x%02x", status) << std::endl;
 }
 
 // Prints a byte in decimal and hex forms
@@ -84,10 +101,9 @@
     return false;
   }
 
-  auto cb = [cmd_line, complete_cb](hci::CommandChannel::TransactionId id,
-                                    const hci::EventPacket& event) {
+  auto cb = [cmd_line, complete_cb](const hci::EventPacket& event) {
     auto params = event.return_params<IntelVersionReturnParams>();
-    LogCommandComplete(params->status, id);
+    LogCommandComplete(params->status);
 
     std::cout << fxl::StringPrintf(
         "  Firmware Summary: variant=%s - revision %u.%u build no: %u (week "
@@ -119,15 +135,15 @@
       std::cout << "    Firmware Patch No: " << PrintByte(params->fw_patch_num)
                 << std::endl;
     }
-
-    complete_cb();
   };
 
-  auto packet = hci::CommandPacket::New(kReadVersion);
-  auto id = SendCommand(cmd_data, std::move(packet), cb, complete_cb);
-  std::cout << "  Sent HCI Vendor (Intel) Read Version (id=" << id << ")"
-            << std::endl;
+  //cmd_data->cmd_channel()->SetEventCallback(cb);
 
+  auto packet = hci::CommandPacket::New(kReadVersion);
+  std::cout << "  Sending HCI Vendor (Intel) Read Version" << std::endl;
+  cmd_data->cmd_channel()->SendCommandSync(packet->view(), cb);
+
+  complete_cb();
   return true;
 }
 
@@ -139,10 +155,9 @@
     return false;
   }
 
-  auto cb = [cmd_line, complete_cb](hci::CommandChannel::TransactionId id,
-                                    const hci::EventPacket& event) {
+  auto cb = [cmd_line, complete_cb, cmd_data](const hci::EventPacket& event) {
     auto params = event.return_params<IntelReadBootParamsReturnParams>();
-    LogCommandComplete(params->status, id);
+    LogCommandComplete(params->status);
 
     std::cout << "  Intel Boot Parameters:" << std::endl;
     std::cout << "    Device Revision:  " << le16toh(params->dev_revid)
@@ -166,13 +181,14 @@
                                    2000 + params->min_fw_build_year)
               << std::endl;
 
+    cmd_data->cmd_channel()->SetEventCallback(nullptr);
     complete_cb();
   };
 
   auto packet = hci::CommandPacket::New(kReadBootParams);
-  auto id = SendCommand(cmd_data, std::move(packet), cb, complete_cb);
-  std::cout << "  Sent HCI Vendor (Intel) Read Boot Params (id=" << id << ")"
-            << std::endl;
+  cmd_data->cmd_channel()->SetEventCallback(cb);
+  cmd_data->cmd_channel()->SendCommand(packet->view());
+  std::cout << "  Sent HCI Vendor (Intel) Read Boot Params" << std::endl;
 
   return true;
 }
@@ -185,9 +201,6 @@
     return false;
   }
 
-  auto cb = [](hci::CommandChannel::TransactionId id,
-               const hci::EventPacket& event) {};
-
   auto packet =
       hci::CommandPacket::New(kReset, sizeof(IntelResetCommandParams));
   auto params =
@@ -201,18 +214,57 @@
   params->data[6] = 0x04;
   params->data[7] = 0x00;
 
-  auto id = SendCommand(cmd_data, std::move(packet), cb, complete_cb);
-  std::cout << "  Sent HCI Vendor (Intel) Reset (id=" << id << ")" << std::endl;
+  cmd_data->cmd_channel()->SendCommand(packet->view());
+  std::cout << "  Sent HCI Vendor (Intel) Rese" << std::endl;
 
   // Once the reset command is sent, the hardware will shut down and we won't be
   // able to get a response back. Just exit the tool.
-  // TODO(armansito): This needs to be implemented properly in the driver as
-  // part of the controller boot sequence. We cannot reboot the controller from
-  // userland since the hardware disappears so we'll never receive the
-  // vendor-specific HCI event.
-  cmd_data->task_runner()->PostDelayedTask(
-      complete_cb, fxl::TimeDelta::FromMilliseconds(250));
 
+  complete_cb();
+  return true;
+}
+
+bool HandleLoadBseq(const CommandData* cmd_data,
+                    const fxl::CommandLine& cmd_line,
+                    const fxl::Closure& complete_cb) {
+  if (cmd_line.positional_args().size() != 1) {
+    std::cout << "  Usage: load-bseq [--verbose] <filename>" << std::endl;
+    return false;
+  }
+
+  std::string firmware_fn = cmd_line.positional_args().front();
+
+  {
+    MfgModeEnabler enable(cmd_data->cmd_channel());
+
+    IntelFirmwareLoader loader(cmd_data->cmd_channel());
+
+    IntelFirmwareLoader::LoadStatus patched = loader.LoadBseq(firmware_fn);
+
+    if (patched == IntelFirmwareLoader::LoadStatus::kPatched) {
+      enable.set_patch_reset(true);
+    }
+  }
+
+  complete_cb();
+  return true;
+}
+
+bool HandleLoadSecure(const CommandData* cmd_data,
+                      const fxl::CommandLine& cmd_line,
+                      const fxl::Closure& complete_cb) {
+  if (cmd_line.positional_args().size() != 1) {
+    std::cout << "  Usage: load-sfi [--verbose] <filename>" << std::endl;
+    return false;
+  }
+
+  std::string firmware_fn = cmd_line.positional_args().front();
+
+  IntelFirmwareLoader loader(cmd_data->cmd_channel());
+
+  loader.LoadSfi(firmware_fn);
+
+  complete_cb();
   return true;
 }
 
@@ -229,6 +281,11 @@
   dispatcher->RegisterHandler("read-boot-params",
                               "Read hardware boot parameters",
                               BIND(HandleReadBootParams));
+  dispatcher->RegisterHandler("load-bseq", "Load bseq file onto device",
+                              BIND(HandleLoadBseq));
+  dispatcher->RegisterHandler("load-sfi", "Load Secure Firmware onto device",
+                              BIND(HandleLoadSecure));
+
   dispatcher->RegisterHandler("reset", "Reset firmware", BIND(HandleReset));
 
 #undef BIND
diff --git a/bin/bluetooth_tools/bt_intel_tool/commands.h b/bin/bluetooth_tools/bt_intel_tool/commands.h
index 57e8396..1c6850c 100644
--- a/bin/bluetooth_tools/bt_intel_tool/commands.h
+++ b/bin/bluetooth_tools/bt_intel_tool/commands.h
@@ -5,24 +5,21 @@
 #pragma once
 
 #include "garnet/bin/bluetooth_tools/lib/command_dispatcher.h"
-#include "garnet/drivers/bluetooth/lib/hci/command_channel.h"
 #include "lib/fxl/memory/ref_ptr.h"
 #include "lib/fxl/tasks/task_runner.h"
 
+#include "command_channel.h"
+
 namespace bt_intel {
 
 class CommandData final {
  public:
-  CommandData(bluetooth::hci::CommandChannel* cmd_channel,
-              fxl::RefPtr<fxl::TaskRunner> task_runner)
-      : cmd_channel_(cmd_channel), task_runner_(task_runner) {}
+  CommandData(CommandChannel* cmd_channel) : cmd_channel_(cmd_channel) {}
 
-  bluetooth::hci::CommandChannel* cmd_channel() const { return cmd_channel_; }
-  fxl::RefPtr<fxl::TaskRunner> task_runner() const { return task_runner_; }
+  CommandChannel* cmd_channel() const { return cmd_channel_; }
 
  private:
-  bluetooth::hci::CommandChannel* cmd_channel_;
-  fxl::RefPtr<fxl::TaskRunner> task_runner_;
+  CommandChannel* cmd_channel_;
 };
 
 void RegisterCommands(const CommandData* data,
diff --git a/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.cc b/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.cc
new file mode 100644
index 0000000..1a878e0
--- /dev/null
+++ b/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.cc
@@ -0,0 +1,251 @@
+// Copyright 2017 The Fuchsia Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "intel_firmware_loader.h"
+
+#include <fbl/string_printf.h>
+#include <fbl/unique_fd.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <zircon/status.h>
+#include <zx/event.h>
+#include <zx/time.h>
+
+#include <iostream>
+#include <limits>
+
+#include "bt_intel.h"
+
+namespace bt_intel {
+
+namespace {
+
+// A file mapped into memory that we can grab chunks from.
+class MemoryFile {
+ public:
+  MemoryFile(const std::string& filename)
+      : fd_(open(filename.c_str(), O_RDONLY)), mapped_(nullptr) {
+    if (!bool(fd_)) {
+      std::cerr << "Failed to open file " << filename << " : "
+                << strerror(errno) << std::endl;
+      return;
+    }
+
+    struct stat file_stats;
+    fstat(fd_.get(), &file_stats);
+    size_ = file_stats.st_size;
+    std::cerr << "Mapping " << size_ << " bytes of " << filename << std::endl;
+
+    mapped_ = mmap(nullptr, size_, PROT_READ, MAP_PRIVATE, fd_.get(), 0);
+    if (mapped_ == MAP_FAILED) {
+      std::cerr << "Failed to map file to memory: " << strerror(errno)
+                << std::endl;
+      mapped_ = nullptr;
+    }
+  };
+
+  ~MemoryFile() {
+    if (mapped_) {
+      munmap(mapped_, size_);
+    }
+  }
+
+  size_t size() const { return size_; }
+
+  bool is_valid() const { return mapped_ != nullptr; }
+
+  const uint8_t* at(size_t offset) const {
+    return static_cast<uint8_t*>(mapped_) + offset;
+  }
+
+  bluetooth::common::BufferView view(
+      size_t offset,
+      size_t length = std::numeric_limits<size_t>::max()) const {
+    if (!is_valid() || (offset > size_)) {
+      return bluetooth::common::BufferView();
+    }
+    if (length > (size_ - offset)) {
+      length = (size_ - offset);
+    }
+    return bluetooth::common::BufferView(mapped_, length);
+  }
+
+ private:
+  // The actual file descriptor.
+  fbl::unique_fd fd_;
+
+  // pointer to the file's space in memory
+  void* mapped_;
+
+  // Size of the file in memory
+  size_t size_;
+};
+
+void SecureSend(CommandChannel* channel,
+                uint8_t type,
+                const bluetooth::common::BufferView& bytes) {
+  size_t left = bytes.size();
+  while (left > 0) {
+    size_t frag_len = left > 252 ? 252 : left;
+    std::cout << "IntelFirmwareLoader: Secure Sending " << frag_len << " of " << left << " bytes" << std::endl;
+    auto cmd = bluetooth::hci::CommandPacket::New(kSecureSend, frag_len + 1);
+    auto data = cmd->mutable_view()->mutable_payload_data();
+    data[0] = type;
+    data.Write(bytes.view(bytes.size() - left, frag_len), 1);
+
+    channel->SendCommandSync(cmd->view(), [](const auto& event) {
+      std::cout << "IntelFirmwareLoader: Secure Send response: "
+                << std::to_string(event.event_code()) << std::endl;
+      if (event.event_code() == 0xff) {
+        const auto& params = event.view().template payload<IntelSecureSendEventParams>();
+        std::cout << "IntelFirmwareLoader: Secure Send result: (" << params.result
+                  << ", " << params.opcode << ", " << params.status << ")" << std::endl;
+      }
+    });
+    left -= frag_len;
+  }
+}
+
+}  // namespace
+
+IntelFirmwareLoader::LoadStatus IntelFirmwareLoader::LoadBseq(
+    const std::string& filename) {
+  MemoryFile file(filename);
+
+  if (!file.is_valid()) {
+    std::cerr << "Failed to open firmware file." << std::endl;
+    return LoadStatus::kError;
+  }
+
+  size_t ptr = 0;
+
+  // A bseq file consists of a sequence of:
+  // - [0x01] [command w/params]
+  // - [0x02] [expected event w/params]
+  while (file.size() - ptr > sizeof(bluetooth::hci::CommandHeader)) {
+    // Parse the next items
+    if (*file.at(ptr) != 0x01) {
+      std::cerr << "IntelFirmwareLoader: Error: malformed file, expected "
+                   "Command Packet marker"
+                << std::endl;
+      return LoadStatus::kError;
+    }
+    ptr++;
+    bluetooth::common::BufferView command_view = file.view(ptr);
+    bluetooth::common::PacketView<bluetooth::hci::CommandHeader> command(
+        &command_view);
+    command = bluetooth::common::PacketView<bluetooth::hci::CommandHeader>(
+        &command_view, command.header().parameter_total_size);
+    ptr += command.size();
+    if ((file.size() <= ptr) || (*file.at(ptr) != 0x02)) {
+      std::cerr << "IntelFirmwareLoader: Error: malformed file, expected Event "
+                   "Packet marker"
+                << std::endl;
+      return LoadStatus::kError;
+    }
+    std::deque<std::unique_ptr<bluetooth::hci::EventPacket>> events;
+    while ((file.size() <= ptr) || (*file.at(ptr) == 0x02)) {
+      ptr++;
+      // TODO(jamuraa): we should probably do this without copying,
+      // maybe make a way to initialize event packets backed by unowned
+      // memor
+      auto event = bluetooth::hci::EventPacket::New(0u);
+      memcpy(event->mutable_view()->mutable_header(), file.at(ptr),
+             sizeof(bluetooth::hci::EventHeader));
+      ptr += event->view().size();
+      event->InitializeFromBuffer();
+      memcpy(event->mutable_view()->mutable_payload_bytes(), file.at(ptr),
+             event->view().payload_size());
+      ptr += event->view().payload_size();
+      events.push_back(std::move(event));
+    }
+
+    if (!RunCommandAndExpect(command, std::move(events))) {
+      return LoadStatus::kError;
+    }
+  }
+
+  return LoadStatus::kComplete;
+}
+
+bool IntelFirmwareLoader::LoadSfi(const std::string& filename) {
+  MemoryFile file(filename);
+
+  if (file.size() < 644) {
+    std::cerr << "IntelFirmwareLoader: SFI file not long enough: "
+              << file.size() << " < 644" << std::endl;
+    return false;
+  }
+
+  size_t ptr = 0;
+  // SFI File format:
+  // [128 bytes CSS Header]
+  SecureSend(channel_, 0x00, file.view(ptr, 128));
+  //ptr += 128;
+  // [256 bytes PKI]
+  SecureSend(channel_, 0x03, file.view(ptr, 256));
+  ptr += 256;
+  // [256 bytes signature info]
+  SecureSend(channel_, 0x02, file.view(ptr, 256));
+  ptr += 256;
+  // [N bytes of data]
+  // Note: this is actually a bunch of Command Packets, padded with
+  // NOP commands so they sit on 4-byte boundaries, but we write it to
+  // Secure Send area anyway so I don't see the point in parsing them.
+  SecureSend(channel_, 0x01, file.view(ptr, file.size() - 644));
+
+  return true;
+}
+
+bool IntelFirmwareLoader::RunCommandAndExpect(
+    const bluetooth::common::PacketView<bluetooth::hci::CommandHeader>& command,
+    std::deque<std::unique_ptr<bluetooth::hci::EventPacket>>&& events) {
+  zx::event events_done;
+  zx::event::create(0, &events_done);
+
+  size_t events_received = 0;
+  auto event_cb = [&events_received, &events, &events_done](
+                      const bluetooth::hci::EventPacket& evt_packet) {
+    auto expected = std::move(events.front());
+    events.pop_front();
+    if (evt_packet.view().size() != expected->view().size()) {
+      events_done.signal(0, ZX_USER_SIGNAL_0);
+      return;
+    }
+    if (memcmp(evt_packet.view().data().data(), expected->view().data().data(),
+               expected->view().size()) != 0) {
+      events_done.signal(0, ZX_USER_SIGNAL_0);
+      return;
+    }
+    events_received++;
+  };
+
+  channel_->SetEventCallback(event_cb);
+
+  channel_->SendCommand(command);
+
+  zx_signals_t signalled;
+  zx_status_t status = events_done.wait_one(
+      ZX_USER_SIGNAL_0, zx::deadline_after(ZX_SEC(1)), &signalled);
+
+  channel_->SetEventCallback(nullptr);
+
+  if (status == ZX_OK) {
+    return true;
+  }
+
+  if (status == ZX_ERR_TIMED_OUT) {
+    std::cerr << "IntelFirmwareLoader: timed out waiting for events"
+              << std::endl;
+  } else {
+    std::cerr << "IntelFirmwareLoader: error waiting for events"
+              << zx_status_get_string(status) << std::endl;
+  }
+  return false;
+}
+
+}  // namespace bt_intel
diff --git a/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.h b/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.h
new file mode 100644
index 0000000..f2e930f
--- /dev/null
+++ b/bin/bluetooth_tools/bt_intel_tool/intel_firmware_loader.h
@@ -0,0 +1,60 @@
+// Copyright 2017 The Fuchsia Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#pragma once
+
+// A loader for Intel Bluetooth Firmware files.
+
+#include <deque>
+
+#include "garnet/drivers/bluetooth/lib/hci/control_packets.h"
+
+#include "command_channel.h"
+
+namespace bt_intel {
+
+class IntelFirmwareLoader {
+ public:
+  // |cmd_channel| is expected to outlive this object.
+  IntelFirmwareLoader(CommandChannel* cmd_channel) : channel_(cmd_channel) {}
+  ~IntelFirmwareLoader() = default;
+
+  enum class LoadStatus {
+    // Firmware is complete, no patch loaded, ready.
+    kComplete,
+    // Patch is loaded, reset the controller with patches enabled to continue
+    kPatched,
+    // An unexpected event was returned from the controller
+    kError,
+    // The file provided is in an invalid
+    kInvalidFile,
+  };
+
+  // Reads and loads a "bseq" file into the controller using the given command
+  // channel. Returns a LoadStatus indicating the result.
+  //  - Complete if the firmware was loaded successfully
+  //  - Patched if the firmware was loaded and a patch was added, meaning the
+  //  controller should be reset.
+  //  - Error otherwise.
+  LoadStatus LoadBseq(const std::string& filename);
+
+  // Reads and loads a "sfi" file into the controller using the given command
+  // channel. Returns true if the file was loaded, false otherwise
+  bool LoadSfi(const std::string& filename);
+
+ private:
+  bool ParseBseq();
+
+  // Sends the next command and waits for the next events.
+  // Returns true if the expected events got returned, false otherwise.
+  bool RunCommandAndExpect(
+      const bluetooth::common::PacketView<bluetooth::hci::CommandHeader>&
+          command,
+      std::deque<std::unique_ptr<bluetooth::hci::EventPacket>>&& events);
+
+  // The command channel to use
+  CommandChannel* channel_;
+};
+
+}  // namespace bt_intel
diff --git a/bin/bluetooth_tools/bt_intel_tool/main.cc b/bin/bluetooth_tools/bt_intel_tool/main.cc
index de3fe76..21afdc9 100644
--- a/bin/bluetooth_tools/bt_intel_tool/main.cc
+++ b/bin/bluetooth_tools/bt_intel_tool/main.cc
@@ -20,6 +20,7 @@
 #include "lib/fxl/log_settings_command_line.h"
 #include "lib/fxl/strings/string_printf.h"
 
+#include "command_channel.h"
 #include "commands.h"
 
 using namespace bluetooth;
@@ -62,21 +63,11 @@
     return EXIT_FAILURE;
   }
 
-  fxl::UniqueFD hci_dev_fd(open(hci_dev_path.c_str(), O_RDWR));
-  if (!hci_dev_fd.is_valid()) {
-    std::perror("Failed to open HCI device");
-    return EXIT_FAILURE;
-  }
-
-  auto hci_dev =
-      std::make_unique<hci::ZirconDeviceWrapper>(std::move(hci_dev_fd));
-  auto hci = hci::Transport::Create(std::move(hci_dev));
-  hci->Initialize();
   fsl::MessageLoop message_loop;
+  CommandChannel channel(hci_dev_path);
 
   tools::CommandDispatcher dispatcher;
-  bt_intel::CommandData cmd_data(hci->command_channel(),
-                                 message_loop.task_runner());
+  bt_intel::CommandData cmd_data(&channel);
   RegisterCommands(&cmd_data, &dispatcher);
 
   if (cl.positional_args().empty() || cl.positional_args()[0] == "help") {