By :

Fagun Pathak [12MECE34]

(M.Tech Sem.- IV E.C.[Embedded Systems] )

Intro: Bluetooth Firmware Development Department
BR/EDR
Controller
LE
Controller
Firmware
Development
Abstract
Develop Firmware Classic Bluetooth Low Energy
(LE) controllers.
Automation Tool Development
Embedded Applications.
Bluetooth Hardware
Firmware Bluetooth Controller.
Project : Divided into Two Sub categories
Automation Tool
Development
Automate Patch
Functionality
Verification


Automate Sanity
Test cases to
Verify BLE
FW(Firmware)
Functionality
Bugs Resolution and
Development of Embedded
Application

Verification and Bug
Analysis of USB HID
Emulation (UHE)
App
Performance Tuning of
AT Commands Based
Embedded App that
Emulates Serial Port

Part - I

Automate Patch Functionality
Verification
To Create an Automation Tool that solves the
problem of for each
and every Broadcom Bluetooth chipsets. It also
. So that chips tape-out process
becomes fast.

Abstract of Part - I
Created a Automation tool (Script in Perl - Language) that
- Automates the variables of Patching .
- Directly generates Configuration File across any chipsets,
depending upon Memory size and Patch Config Parameters.
- Verifies Patch Functionality.
Abstract of Project What I have Done in this Part - I ?
Part - II

Automate Sanity Test cases to Verify
BLE Firmware Functionality
Abstract of Part - II
To Automate Sanity Test cases which verifies
Behavior under
different scenarios.
The Problem of Manually running of only one
test case at a time by using Bluetool was solved by Creating a
Single Script which runs All test cases in a single shot or
Specified test case.
Created a Automation tool (Script in Perl - Language) that
- Verifies Functionality of Device Under Test(DUT) under different
Test case Scenario.
- Verifies Dual Mode Operation (BR/EDR and LE) of DUT.
- Verifies LE and Host Connection with Bluetooth Enable Device.
- Runs all Test cases or Specific Test case.
- Generates Log File which contains Result of Each Test case .

Abstract of Project What I have Done in this Part - II ?
Part - III

Verification and Bug Analysis of
USB HID Emulation (UHE)
Part III Outlines
Bluetooth HID : Human Interface Devices
How Bluetooth HID Profile works ?
UHE : USB HID Emulation and How UHE App works ?
UHE Data Flow
Pairing Procedure for BT KB & MS
Hardware : BT HIDs and UHE Dongle
Use of PuTTY and Git commands
Verify UHE FW Functionality using BT HIDs : Part - I to III
Verification of UHE FW using Broadcom KB & MS HID Board
Issues faced and its procedure for solutions
UHE Debug traces added in Function
Found the cause and solution of NVRAM corruption issue
Future Scope
References

Abstract of Part- III

Studied USB HID Emulation (UHE)
Application to
by adding seen on newer
ASIC+FPGA Platforms and them.

Abstract of Project What I have Done in this Part - III ?
Learnt Commands
, and of UHE Firmware(FW) Code.
Verified of UHE FW on DUT (FPGA & ASIC Boards) using
both KB & MS and BT HID Boards.
Learnt HID Control Tester Tool for Testing FW.
Did of KB and MS with DUT and learn its procedure.
Found the causes of bugs by adding UART .
Made a (In Perl language ): Add and Delete HIDs as
per given Iteration. (Finding the cause - corruption)
the bugs.
Bluetooth HID : Human Interface Devices
BT Scanner
Multimedia
Remote Control
BT Mouse
BT KB
BT Gamepad
BT Watch
How Bluetooth HID Profile works ?
Describes use of the USB/UART HID protocol to a HID class device
and how a BT enabled device can support HID services using the L2CAP
layer.
HID Devices
USB/UART
Host (PC) in Boot Mode
BT HIDs
What will happen in this case ?

What is the solution of this problem?
UHE : USB HID Emulation
An embedded app that allows BT HIDs to be functional,
when there is no BT stack on the host side.
( Like Boot Mode, Windows Safe Mode, DOS )
Host (PC) in Boot Mode
BT HIDs
UHE BT Dongle
Use case :- Accessing BT HIDs using UHE App while PC is in Boot Mode
How UHE App works ?
Translate : OTA (Over The Air) HID data USB/UART HID data.
[HID Profile uses the definition of a HID device]


Can UHE FW handle OTA data ?
o Yes !! Internally there is condensed version of the BT profile and stack.

Provides support : One associated and one associated to
function where USB/UART HID drivers are supported.
UHE Data Flow
USB/UART HW
USB/UART HID
and Driver
Application
Framework
BT Controller
L2CAP
HID Host
Profile
UHE Application
UHE
Dongle
BT Controller
L2CAP
HID Device Profile
HID Device Application (KB,MC)
HID
USB/UART
Data
Host PC
Pairing Procedure for BT KB and MS
UHE Dongle : Start
Press button on KB and MS
UHE Dongle : Identify KB and MS according to COD
Make connection
Start Auto pairing

Start connection
- RNR
- Pairing (First time connection)
- Authentication (Re-connection)

(HID and PNP) record information and stored it into NVRAM.
KB and MS .


Hardware : BT HIDs and UHE Dongle
Use of PuTTY and Git Commands
: Client Program for the Secure SHell(SSH) Protocol
o : To run commands on the remote computer, transfer files, etc.

: Free and open source, distributed version control system designed to
handle everything from small to very large projects with speed and efficiency.

o repo sync
o git branch
o git checkout brach_name
o git add p
o git status
o make BLD=BRCM Chip_name
o git commit, -- amend
o git diff
o git log
o git stash
Verify UHE FW Functionality using BT HIDs : Part - I & II
Configure , Build & Compile the Code
o Configure the FW specific to BRCM chipset requirements like
UHE debug enable
Select USB/UART transport
Serial flash configuration
App specific configuration
o Build and Compile the Code (ARM CC Compiler)

Download Config file and FW of UHE





Verify UHE FW Functionality using BT HIDs : Part - III
Open HID Control Tester
Tool
Open device Transport and
Issue Action :
Get Short Feature
Make BT enabled KB & MS
Discoverable
Issue Action :
Recover Device
Issue Action :
Get Boot HID Device list
Gives Current status of DUT
(Any device paired or not )
Response
Result
KB and MS are
Automatically Connected.
Received
Response with Paired
device Address
Verified UHE FW
Functionality
[ FW Verification
using HID Control Tester Tool ]
Flow of KB and MS Provisioned
Radio Start
Up Mode
UHE Mode
Search Bit
Auto pair
Bit

Search+
Auto pair
Both KB &
MS
Provisioned
According to
Dongle Status
Byte
Verification of UHE FW using Broadcom KB & MS HID Board
DUT contains
UHE FW
KB HID
Board
MS HID
Board
USB/UART
Cable
Host PC
Connected
wires
Pencom 8 - Channel
Relay Box
Relay Configuration
1 DUT Power
2 MS Power
3 MS Connect
4 MS Input
5 KB Power
6 KB Connect
7 KB Input-1
8 KB Input-2
Issues faced and Its Procedure for Solutions

- Discovery fails
- Stuck in searching and auto-pairing stage
- KB and MS data not captured
- PNP/SDP record corruption/failure
- NVRAM corruption

- Understand the issue clearly

- Reproduce the issue with 100% probability
- Add debug traces and find the causes of the issues
- Solve the issues

UHE Debug Traces in Tera Term
Found the cause and solution of NVRAM corruption issue
Bluetool Log : Add and Delete BT HIDs
MS HID
Solution:- required
Future Work/ Scope
Analyze the UHE FW Code and solved issues seen
over FW code which helps me to clear understanding
and .
References of Part - III
Broadcom Specification for UHE for Bluetooth Transceivers for PCs
Broadcom UHE Training Presentation
HID Profile in Bluetooth Development Portal Website :
https://developer.bluetooth.org/TechnologyOverview/Pages/HID.aspx
HID Profile in Palo wireless Bluetooth Resource Center :
http://www.palowireless.com/infotooth/tutorial/n7_hid.asp

Part - IV

Performance Tuning of AT Commands
Based Embedded Application that
Emulates Serial Port
Part IV Outlines
Providing solutions to fulfill client requirements
AT commands for Bluetooth and its stack
Complete hardware setup: client - server architecture
Procedure to make RFCOMM connection using AT commands
Issue : FW hangs at higher data rate & BT chip becomes unresponsive
Use parallel flash and multi launcher tool for debugging
Found causes and provide solutions of the issue
UART hardware flow control enabled in FW
Problem: data throughput reduced by some percentage
Performance improvement
Final outcome/ result
Future work/ Scope
References
Abstract of Part- IV

Provided
and
based on clients requirement, for based
Embedded Application.
Main goal is stabilize the FW as per clients
use cases and provide minimal or zero data loss.

Abstract of Project What I have Done in this Part - IV ?
Created RFCOMM connection between client and server and do the
.
at all baud rates.
Used debugger for finding the of issue. (Mainly UART driver issue)
Ran the successfully with the changes more than 18 hours.
Did for the changes.
Analyzed the HW flow control mechanism, number of packets drops by
connecting RTS and RX pin of UART (Client) to .
Provided to client.
Providing Solutions to Fulfill Client Requirements







Use any suitable technology

Provide solution:



- Make a
- Create
- Transfer data at
(2 Mbps)
AT Commands for Bluetooth
Similar to the industry standard Hayes (ATtention) used in
telephony modems and to control modems.

Every command starts with AT or at.

Two main function:
o To Make and Break
o To Query or Set values of Status Register

Other ancillary functions:
o Inquiry
o Pairing

Bluetooth Protocol Stack for AT Application
RFCOMM ( adio requency unication) Protocol:
o Transport protocol: User data, modem control signals and configuration
commands.
o Providing
(Up to simultaneous connections between two BT device at a time)
o Used by many telephony related profiles as a .
Complete Hardware Setup: Client - Server Architecture
Client Server
Evaluation Board/Kit
Power
Power
Power
Request
Response
Tera Term: Receive Data
at Server side
Procedure to make RFCOMM Connection using AT Cmds
BR
BR
CN
CN
CS
CS
CS
CS
Start RFCOMM Connection



Data received from Kit
Data received from Client
After Connection
Issue : FW Hangs at Higher Data Rate & BT Chip Becomes Unresponsive
at after sometime.
Reproduced this issue at
becomes : Response is not coming when typed .
Use Parallel Flash and Multi Launcher Tool For Debugging
IDE
Found Causes of the Issue
having a Priority and having

o Exhausted limited available buffer by Transport

Use of buffer allocation
o if buffer not available

happened because of one wasnt enabled!
(UART Driver Issue)
o Free the buffer queue pointer in the middle of the function code.
o Used by someone and the pointer.
o Not able to free the actual buffer for Transport.

Solutions of the Issue
the that removes data pointer corruption
o First free the buffer and then free the pointer of it.

Added logic for (In UART Driver File)
o If buffers available for Transport are more than , then only
allocate buffer.
o the and on buffer
allocation failure.

Adjusted having
o Solved .



Did for these !!
UART Hardware Flow Control enabled in FW


TX RX
RTS CTS
Hardware
FIFO Buffer
Drop the Packets
Timer timeout
Problem: Data Throughput Reduced by Some %
Were from UART HW FIFO Buffer.

Speed of the Data to Buffer the Data from it !!!

when buffer is not available.
Performance Improvement
Used instead of
o Checking the buffer availability again when
timeout (Fixed time interval) happens.
o When idle thread (Lowest Priority)will get chance to run, it should
automatically checks the buffer availability.

processor .
o Reading from UART HW FIFO would become faster.




Final outcome/ Result
Fulfill the requirement of client
FW hangs at higher data transfer rate
and BT chip becomes unresponsive.

Minimize the data loss.
Future Work/ Scope
In future, we can provide more performance
tuning by
That will reduce the data loss efficiently.
References of Part - IV
Document of Bluetooth Connectivity Solution for Client. (Broadcom
Confidential)
Document for reproducing the issue provided by Client. (Broadcom
Confidential)
Bluetooth Protocol Stack for AT Application:
http://srohit.tripod.com/bluetooth_sec.pdf
RFCOMM Protocol: http://en.wikipedia.org/wiki/Bluetooth_protocols and
http://authors.phptr.com/bluetooth/bray/pdf/cr_ch10.pdf



Thank You !!