1. Firmware Architecture Enabling Interactive Programming and Calling Convention Translation National Tsing Hua University Embedded Platform Lab Tong Kun Lai Directed by Prof. Pai H. Chou

2. Outline • Introduction • Related Work • Background • System Overview • Implementation • Evaluation • Conclusion

3. Outline • Introduction • Related Work • Background • System Overview • Implementation • Evaluation • Conclusion

4. Motivation • Smart Phone • iPhone, Android • Health • Body Sensor • Smart home • Environmental Monitoring Low-power Communication

5. Motivation • It stills hard to develop • Designated compiler, very expensive • Open source compiler,free

6. Contribution • We propose a firmware architecture to enabling interactive execution and wireless reprogramming • Interactive Execution Layer • Run code interactively • Compiler Binding Layer • User uses own compiler • Run code from flash memory

7. Outline • Introduction • Related Work • Background • System Overview • Implementation • Evaluation • Conclusion

8. WSNs communication protocol • ZigBee: • 2.4GHz RF • Smart Home, Health Care and, Industry Monitoring • ANT: • 2.4GHz RF • Sport(Nike, Adidas and Fitbit) • Z-Wave : • 900MHz RF • OnlyHome Automatic

9. WSNs communication protocol • Bluetooth Low Energy • 2.4 GHz • Compatibility with smart mobile ( No dongle ) • Health care, Smart Home, Proximity Tag… Designated Compiler: IAR

10. Mixing Compiler • Use a compiler binding file • Calling C from a python file: • #include “Python.h” • Use a middleware • CORBA – data marshaling and demarshaling

11. Interactive execution • EcoExec, Chih-Hsiang Hsueh, SECON 2010 • Use a script language • Generate native code and update wirelessly • Bertha, Joshua Lifton • Split the flash memory to 11 equalize size • Wireless update

12. Outline • Introduction • Related Work • Background • System Overview • Implementation • Evaluation • Conclusion

13. Banked Code Model • Traditional 8051: • 64 Kbytes • Code Banking: • up to 16 Mbytes

14. Bank switching • Callerrelayfunctionswitch bankcallee Bank 2 func() { … } Bank 1 Call to func() Lcall to relay func Root Bank Relay to func() prologue Lcall to func() 1 2

15. OSAL • Operation System Abstraction Layer(OSAL) • Communication protocol • Applications

16. BLE Protocol Stack • Generic Access Profile • Device role(master or slave) • Connection parameters • Attribute Protocol • Share data with other device • Generic Attribute Profile • Specific Profile structure

17. Outline • Introduction • Related Work • Background • System Overview • Implementation • Evaluation • Conclusion

18. System overview

19. Interactive Execution Layer • Execute code from RAM • Register or GPIO configuration I want to test my code Machine Code Device BLE Result

20. Compiler Binding Layer

21. Compiler Binding Layer Downcall: call the function of system firmware • HAL • Real Time Clock(RTC) • Triaxial accelerometer • UART, SPI, • OSAL • Timer • Memory allocate

22. Compiler Binding Layer • BLE protocol stack • Advertising data • Device name • Scan response data

23. Compiler Binding Layer Upcall: a function is called by system image • Event callback • Trigger by setting osal timer • e.g. osal_start_timerEx( SimpleTaskID, RTC_EVT, 500) • Profile callback • An attribute is changed Support 4 event callback and 3 profile callback functions.

24. Outline • Introduction • Related Work • System Overview • Implementation • Evaluation • Conclusion

25. Hardware Platform • EcoBT • MCU: TI CC2541 • Flash memory: 256KB • RAM: 8KB • Protocol stack: Bluetooth Low Energy (BLE)

26. Software Tools • IAR • Build the system firmware • SDCC • Generate user code

27. Interactive Execution Layer Enter RAM mode: 1. Set register • MEMCTR |=0x10 2. Jump to target address • LCALL 0x8000+RAM_address • Maximum Code size 512 bytes

28. CBL - Flash Memory Architecture IAR XLINK BANK6 BANKED CODE BANKED CODE

29. CBL BANK 0x68000 0x68800 Jump Table 0x69000 Flash Page: 2KB 0x69800 Callback functions 0x6A000 0x6A800 0x6B000 0x6B800 0x6C000 0x6C800 0x6D000 CBL Main function 0x6D800 0x6E000 0x6E800 0x6F000 0x6F800 0x6FFFF Bank 6

30. Call Conventions - IAR • Invoke function call • The others are passed on external stack • Return

31. Call Conventions - SDCC • Invoke function call • Bit parameter • Virtual register • The first parameter (no-bit) • DPL, DPH, B, A • The others are passed on internal stack • Return • DPL, DPH, B, A

32. Downcall SDCC rtcGetTime(uint8* hour, uint8* minute, uint8* second) high low DPH, DPL Internal stack IAR LCALL rtcGetTme::?relay low high R3:R2 R5:R4 External stack

33. Upcall • Upcall workflow CBL Bank 2 3 1

34. Upcall IAR SimpleProfileChangeCB(uint8 paramID) high low R1 Internal stack SDCC – Jumptable LCALL _SimpleProfileChangeCB DPL low high Internal stack

35. Outline • Introduction • Related Work • System Overview • Implementation • Evaluation • Conclusion

36. Evaluation • Global variable: • 256 bytes • Limitation: • No more attribute of Profile can be added • All global variables are decaled in __xdata static type

37. Code size overhead • System firmware:117311bytes • Overhead: 3.69%

38. Run-time overhead • 0.23% ~ 11.71%

39. Outline • Introduction • Related Work • System Overview • Implementation • Evaluation • Conclusion

40. Conclusion • We proposed a firmware architecture to enable execute cod from RAM and wireless reprogramming. • EcoExec GATT Profile • RAM Execution Layer • Compiler Binding Layer

41. Demo

42. Future Work • Extend to other compiler platform (MSP430) • Try add a new attribute of Profile • Try to modify SDCC to build a custom compiler • One master, multiple slaves

43. End