PowerPoint Presentation

By :Fagun Pathak [12MECE34](M.Tech Sem.- IV E.C.[Embedded Systems] )

Connectivity Firmware Development and Test Automation

Institute of Technology,Nirma University , Ahmedabad.Internal Guide:DR. N.P. Gajjar

External Guide:Mr. Joby Paily A.

Broadcom India Research Pvt. Ltd.,Bangalore.

Intro: Bluetooth Firmware Development Department

BR/EDR ControllerLE Controller

FirmwareDevelopment2

Abstract

To Develop Firmware for Classic Bluetooth and Low Energy (LE) controllers. Hardware: Automation Tool Development for Verifying Hardware Components.Firmware: Analyze, Debug, Provide the solutions of bugs and Develop Different Embedded Applications. Understand the Bluetooth technology, Hardware and the Firmware components in the Bluetooth Controller.3

Project : Divided into Two Sub categories

Part - I

Automate Patch Functionality Verification

To Create an Automation Tool that solves the problem of Manual generation of Configuration for each and every Broadcom Bluetooth chipsets. It also Verifies Patch Functionality. So that chips tape-out process becomes fast.

Abstract of Part - I6Created a Automation tool (Script in Perl - Language) that - Automates the variables of Patching . - Directly generates Configuration File across any chipsets, depending upon Memory size and Patch Config Parameters. - Verifies Patch Functionality.Abstract of Project

What I have Done in this Part - I ?

Part - II

Automate Sanity Test cases to Verify BLE Firmware Functionality

Abstract of Part - II To Automate Sanity Test cases which verifies BLE (Bluetooth Low Energy) Firmware Behavior under different scenarios. The Problem of Manually running of only one test case at a time by using Bluetool was solved by Creating a Single Script which runs All test cases in a single shot or Specified test case.9Created a Automation tool (Script in Perl - Language) that - Verifies Functionality of Device Under Test(DUT) under different Test case Scenario. - Verifies Dual Mode Operation (BR/EDR and LE) of DUT. - Verifies LE and Host Connection with Bluetooth Enable Device. - Runs all Test cases or Specific Test case. - Generates Log File which contains Result of Each Test case .

Abstract of Project

What I have Done in this Part - II ?

Part - III

Verification and Bug Analysis of USB HID Emulation (UHE)

Part III OutlinesBluetooth HID : Human Interface DevicesHow Bluetooth HID Profile works ?UHE : USB HID Emulation and How UHE App works ?UHE Data FlowPairing Procedure for BT KB & MSHardware : BT HIDs and UHE DongleUse of PuTTY and Git commands Verify UHE FW Functionality using BT HIDs : Part - I to IIIVerification of UHE FW using Broadcom KB & MS HID Board Issues faced and its procedure for solutionsUHE Debug traces added in FunctionFound the cause and solution of NVRAM corruption issueFuture ScopeReferences

Abstract of Part- III Studied USB HID Emulation (UHE) Application to Verify, Analyze and Debug the issues by adding UART debug prints seen on newer ASIC+FPGA Platforms and Resolved them.

13Abstract of Project

What I have Done in this Part - III ?Learnt Git CommandsCompile, Debug and Bug Analysis of UHE Firmware(FW) Code.Verified Functionality of UHE FW on DUT (FPGA & ASIC Boards) using both KB & MS and BT HID Boards.Learnt HID Control Tester Tool for Testing FW.Did Pairing of KB and MS with DUT and learn its procedure.Found the causes of bugs by adding UART debug traces.Made a Stress Test Script (In Perl language ): Add and Delete HIDs as per given Iteration. (Finding the cause - NVRAM corruption)Solved the bugs.

Bluetooth HID : Human Interface Devices

BT ScannerMultimedia Remote ControlBT MouseBT KBBT Gamepad

BT Watch15

How Bluetooth HID Profile works ?Describes use of the USB/UART HID protocol to discover a HID class device and how aBTenabled device can support HID services using the L2CAP layer.HID DevicesUSB/UART

16

Host (PC) in Boot ModeBT HIDsWhat will happen in this case ?PC will not understand this BT HIDs Data !!

PC has No BT Stack resides in Boot Mode.

What is the solution of this problem?UHE !!! 17

UHE : USB HID EmulationAn embedded app that allows BT HIDs to be functional, when there is no BT stack on the host side. ( Like Boot Mode, Windows Safe Mode, DOS )Host (PC) in Boot ModeBT HIDs

UHE BT DongleUse case :- Accessing BT HIDs using UHE App while PC is in Boot Mode 18

How UHE App works ?Translate : OTA (Over The Air) HID data USB/UART HID data. [HID Profile uses the USB/UART definition of a HID device]

Can UHE FW handle OTA data ? Yes !! Internally there is condensed version of the BT profile and stack.

Provides support : One associated KB and one associated MS to function where USB/UART HID drivers are supported.19

UHE Data FlowUHE Application

UHE Dongle

HIDOTA DataUSB/UART DataHost PC20

Pairing Procedure for BT KB and MSUHE Dongle : Start inquiryPress Discovery button on KB and MS UHE Dongle : Identify KB and MS according to CODMake ACL connectionStart Auto pairing

Start HID connection - RNR - Pairing (First time connection) - Authentication (Re-connection)

SDP (HID and PNP) record information and stored it into NVRAM.KB and MS Provisioned.

21

Hardware : BT HIDs and UHE Dongle

22

Use of PuTTY and Git Commands

PuTTY : Client Program for the Secure SHell(SSH) ProtocolUse : To run commands on theremote computer, transfer files, etc.

GIT : Free and open source, distributed version control system designed to handle everything from small to very large projects with speed and efficiency.

Git Commandsrepo syncgit branchgit checkout brach_namegit add pgit statusmake BLD=BRCM Chip_namegit commit, -- amendgit diffgit loggit stash

23

Verify UHE FW Functionality using BT HIDs : Part - I & IIPart :I Configure , Build & Compile the Code Configure the FW specific to BRCM chipset requirements like UHE debug enableSelect USB/UART transport Serial flash configurationApp specific configuration Build and Compile the Code (ARM CC Compiler)

Part :II Download Config file and FW of UHE

24

Verify UHE FW Functionality using BT HIDs : Part - IIIOpen HID Control Tester ToolOpen device Transport and Issue Action : Get Short FeatureMake BT enabled KB & MS DiscoverableIssue Action : Recover DeviceIssue Action : Get Boot HID Device listGives Current status of DUT (Any device paired or not )ResponseResultKB and MS are Automatically Connected.ReceivedResponse with Paired device AddressVerified UHE FW Functionality [ Part :III FW Verification using HID Control Tester Tool ]

25

Flow of KB and MS Provisioned According to Dongle Status Byte26

Verification of UHE FW using Broadcom KB & MS HID Board FPGA/ASIC Platform: DUT contains UHE FW KB HID BoardMS HID Board

USB/UART CableHost PC

Connected wiresPencom 8 - Channel Relay BoxComplete SetupRelay Configuration1DUT Power2MS Power3MS Connect4MS Input5KB Power6KB Connect7KB Input-18KB Input-227

Issues faced and Its Procedure for SolutionsIssues faced: - Discovery fails - Stuck in searching and auto-pairing stage - KB and MS data not captured - PNP/SDP record corruption/failure - NVRAM corruption

Procedure for Solution/Verification: - Understand the issue clearly - Reproduce the issue with 100% probability - Add debug traces and find the causes of the issues - Solve the issues 28

UHE Debug Traces in Tera Term

29

Found the cause and solution of NVRAM corruption issue

Made Stress Test Script In Perl : Add & Delete BT HIDs to find the cause30

Bluetool Log : Add and Delete BT HIDs

MS HIDSolution:- NVRAM Consolidation required31

Future Work/ Scope Analyze the UHE FW Code and solved issues seen over FW code which helps me to clear understanding UHE Application and BT HID Testing scenarios.32

References of Part - IIIBroadcom Specification for UHE for Bluetooth Transceivers for PCs Broadcom UHE Training PresentationHID Profile in Bluetooth Development Portal Website : https://developer.bluetooth.org/TechnologyOverview/Pages/HID.aspx HID Profile in Palo wireless Bluetooth Resource Center : http://www.palowireless.com/infotooth/tutorial/n7_hid.asp

33

Part - IV

Performance Tuning of AT Commands Based Embedded Application that Emulates Serial Port

Part IV OutlinesProviding solutions to fulfill client requirementsAT commands for Bluetooth and its stackComplete hardware setup: client - server architecture Procedure to make RFCOMM connection using AT commands Issue : FW hangs at higher data rate & BT chip becomes unresponsiveUse parallel flash and multi launcher tool for debuggingFound causes and provide solutions of the issueUART hardware flow control enabled in FW Problem: data throughput reduced by some percentagePerformance improvementFinal outcome/ resultFuture work/ ScopeReferences

Abstract of Part- IV Provided solution for the firmware(FW) hanging issue and improved performance of the FW, based on clients requirement, for AT Commands based Embedded Application. Main goal is stabilize the FW as per clients use cases and provide minimal or zero data loss.

36Abstract of Project

What I have Done in this Part - IV ?Created RFCOMM connection between client and server and do the data transfer.Reproduced the issue at all baud rates.Used debugger for finding the causes of issue. (Mainly UART driver issue)Ran the stress test successfully with the changes more than 18 hours.Did patching for the changes.Analyzed the HW flow control mechanism, number of packets drops by connecting RTS and RX pin of UART (Client) to USB based analyzer.Provided performance tuning to client.

Providing Solutions to Fulfill Client Requirements Use any suitable Wireless technology

Provide solution:

Bluetooth AT Command based Technology !!

- Cost Effective - Speed SupportedDevice- I Device- II - Make a Connection- Create Data pipe- Transfer data at high Data rate (2 Mbps)38

AT Commands for BluetoothSimilar to the industry standard Hayes AT protocol (ATtention) used in telephony modems and to control modems.

Every command starts with AT or at.

Two main function:To Make and Break RFCOMM ConnectionTo Query or Set values of Status Register

Other ancillary functions:InquiryPairing

39

Bluetooth Protocol Stack for AT Application

RFCOMM (Radio Frequency COMMunication) Protocol:Transport protocol: User data, modem control signals and configuration commands.Providing Emulated RS-232 serial ports. (Up to 60 simultaneous connections between two BT device at a time)Used by many telephony related profiles as a carrier for AT commands.40

Complete Hardware Setup: Client - Server Architecture

ClientServerEvaluation Board/Kit

PowerPower

Power

TXDRXDUART JumperRequestResponseRFCOMM Connection

DebuggerUSBee ZX

Tera Term: Receive Data at Server side41

Procedure to make RFCOMM Connection using AT Cmds

BRBRCNCNCSCSCSCSStart RFCOMM ConnectionFor Server :AT + CN = 1For Client :AT + CN = 2, ,

CS : Connection Status (Paired and Connect)Basic AT Command:AT Set Baud rate to 2Mbps:AT + BR = 2000000 Data received from KitData received from ClientAfter Connection42

Issue : FW Hangs at Higher Data Rate & BT Chip Becomes Unresponsive

Data stops at server side after sometime.Reproduced this issue at all baud rates.Client becomes unresponsive : Response is not coming when typed AT.43

Use Parallel Flash and Multi Launcher Tool For Debugging

IDE

44

Found Causes of the IssueTransport Thread having a Highest Priority and Controller having Lowest Exhausted limited available buffer by Transport

Use of buffer allocation With Suspend Wait For Ever if buffer not available

Data Pointer Corruption happened because of one FIX wasnt enabled! (UART Driver Issue)Free the buffer queue pointer in the middle of the function code.Used by someone and corrupt the pointer.Not able to free the actual buffer for Transport.

45

Solutions of the IssueEnabled the FIX that removes data pointer corruption First free the buffer and then free the pointer of it.

Added logic for transport buffer availability ! (In UART Driver File)If buffers available for Transport are more than THRESOLD LIMIT, then only allocate buffer.Enabled the UART HW Flow Control and Start the timer on buffer allocation failure.

Adjusted Controller having buffer count !Solved buffer starvation problem.

Did Patching for these changes !!46

UART Hardware Flow Control enabled in FW Kit ClientTXRXRTSCTS

RTS High:- Not have Hardware FIFO Buffer - Not able to RX DataDrop the PacketsTimer timeout47

Problem: Data Throughput Reduced by Some % WHY ??

Were not reading the data Faster from UART HW FIFO Buffer.

Speed of Filling the Data to Buffer != Reading the Data from it !!!

Start the timer of 10ms when buffer is not available. (Large !!!)48

Performance ImprovementUsed Idle register call back instead of start the timer.

Remove this dependency: Checking the buffer availability again when timeout (Fixed time interval) happens.When idle thread (Lowest Priority)will get chance to run, it should automatically checks the buffer availability.

Increased processor clock frequency.Reading from UART HW FIFO would become faster.

49

Final outcome/ ResultFulfill the requirement of client

Solved the issue: FW hangs at higher data transfer rate and BT chip becomes unresponsive.

Improve the performance: Minimize the data loss. 50

Future Work/ Scope In future, we can provide more performance tuning by Increasing the size of available buffer pool. That will reduce the data loss efficiently. 51

References of Part - IVDocument of Bluetooth Connectivity Solution for Client. (Broadcom Confidential)Document for reproducing the issue provided by Client. (Broadcom Confidential)Bluetooth Protocol Stack for AT Application: http://srohit.tripod.com/bluetooth_sec.pdfRFCOMM Protocol: http://en.wikipedia.org/wiki/Bluetooth_protocols and http://authors.phptr.com/bluetooth/bray/pdf/cr_ch10.pdf

52

Thank You !!53