 Let's start. Welcome to my talk on USB on embedded Linux systems deep dive I'm Marcel Cisvillar. I joined Toradex in 2011. I spearheaded there the embedded Linux adoption and We are doing upstream first At times we're top 10 contributors as Tim confirmed again. We're still there and We're also doing industrial embedded Linux Platform called Torizon based fully on mainline technology What are we covering today? I gonna quickly introduce the USB specification and then we dive right in how that stuff is used Oh man embedded systems. We're gonna look at the USB recovery mode USB new boot in the Linux kernel what you can do in user space Then I also quickly gonna look at some USB tooling. We're gonna have a look at the USB role switching and then I gonna show some Tricks how you can do USB debugging and at the end I also brought some hardware here, of course, and I can show you quickly A live demonstration Okay, the USB specification most of you probably know the whole Connector disaster that kind of a converge to USB see now once ice fits all right Then of course we have all the different speeds From the good old days low speed high speed full speed super speed and now All the faster whatever super speed I think 40 gigabit is the fastest stuff that can be done nowadays with USB 3.2 generation whatever it is not every year something new and How does it actually work? So the USB protocol we have the device is basically the entity that is connected to the bus Then of course There is a configuration which is about the state of the device Starting at the initialization Standby active That this is basically a bundling of a bunch of interfaces What are the interfaces interfaces are basically logical? Devices in USB and each interface Encapsulates a single high-level function So for example if you have a webcam it could have multiple functions because it can stream video could stream audio and Some of them also have some buttons stuff like that And Basically for every of these interfaces, you then will need a driver that handles it Then there is also a concept of alternate settings That's basically that each USB interface may have different parameter sets so for example for different bandwidth requirements stuff like that and Usually the Initial state is always the first setting number zero And then such alternate settings are often then used for example for is a Kronos endpoints That then have quality of service bandwidth requirements So those endpoints are then the unidirectional communication pipe where the data actually is flowing There is always a control endpoint for configuration to get information send commands or to retrieve status information It's it's only, you know, suitable for simple small data transfers And I can say that every device has such a control endpoint and point zero and USB protocol basically guarantees that this Endpoint that the data transfers they will always have enough bandwidth that they can go through Then another type of endpoint are interrupt endpoints. Those are basically Small transfers with a fixed rate So it guarantees as a reserved bandwidth That is good for devices requiring the guaranteed response time Such as for example human interface HID devices like mice and keyboards Note however that Interrupt in this context here is not quite the same like like interrupts You know, we have some SOC's or stuff like that So it's not hardware interrupts in that sense because everything on on the USB bus is anyway It has to be constantly pulled basically by the host It's not like that that the device could really do an interrupt in that sense not then another Kind of endpoints are bulk endpoints. Those are for large sporadic data transfers And they basically use up all the remaining available bandwidth that you have on the on the cable However, there is no guarantee on what that bandwidth or latency would be It's basically the only guarantee you get is that no data gets lost. Everything will get communicated That is typically used where where you don't have any quality of service requirements. For example for Network Ethernet adapters print the storage devices like like the regular USB sticks stuff like that And then where it gets really interesting are the is a chrono the endpoints. That's now Very you can do also larger transfers, but with guaranteed speed so Basically, you do it periodically often not necessarily as fast as possible because you allocate a Certain amount of bandwidth However, there is no guarantee that all the data will make it through so it's used to usually buy real-time data transfer stuff such as Audio or video devices But how does tight I really get Transferred on USB. There are the so-called USB request blocks your bees and that's basically how the communication between the host and devices done Asynchronously using such your bees it's basically similar to packets on a Network and every endpoint can handle cues of such your bees and every Your bee will have a completion handler. So in the stack. That's how it's it's basically done and then a driver may allocate many your bees for a single endpoint or It can have a different strategy to basically reuse the same your bee even for different endpoint and you can have a look in the current documentation in the kernel sources about the further details and then of course such your bees they also have a Scheduling interval how they then go on the cable and for interrupt is a Cronus transfers the in low and full speed devices this interval was one The unit was one frame so millisecond and on on high speed devices this got then Lower to so-called micro frames. It's a 1 8 of a millisecond So how can us be now be used in embedded systems Most modern SSC's feature at least the USB port and often also of course the companion phi and As for the signals, there are usually the dedicated differential pairs So the D plus minus for USB to low low full or high speed and on the super speed There are separate receive and transmit diff pairs Then there are also some supporting signals that go with that and they may be Dedicated signals or often on modern SSC's just regular GP is are used for that So there is a for example an ID pin usually low for host or and not connected respectively pulled up when it's a device There might be an overcurrent signal. So when you draw too much current on the V bus that can Basically signal that The V bus usually this is done through a special chip like like it's shown here So the so-called USB power switch chip And then the V bus itself. It's usually an input in device mode so that basically influences then your connection or or also suspense state and such V bus signals on the SSC's are often not five volt tolerant because the IO voltage usually nowadays is not five volt Not and then of course you will have to have some kind of a voltage divided something like that and Then there is also the V bus enabled basically Corresponding to do when you're in a host role that because then you have to drive the V bus So basically to power the USB device and again that usually goes through such a USB power switch as we see here So we see here the the enable signal basically That could be for example driven by a GP IO and this filled be output here That would have it actually trigger when you will draw too much power and in this case here They basically use a resistor with the you know resistance here you can actually kind of configure how much that Current is here for example with that 15k it's configured for one amp and Then of course here the voltage comes in and it switches it and it comes out on the other side then What else can be there can also be external hub and or for the five chips and Often also there are some further designed in the USB chips like USB to isn't it Bridges or USB to serial adapter stuff like that Then of course a good question. How about USB see USB see usually takes some special Companion chips that take care of this new fancy USB see signaling That's shown here On the USB see you have the CC one CC two signals there where you can basically do all this fancy You know saying what what exact cable is connected stuff like that and Usually that so there are now chips that basically do that for you And one way to do that is is that you basically have a chip that just Goes back to the legacy signaling that that's this this one shown here So you at the end just get an ID output and you get the V pass There are also More advanced such chips that then will use some out of band signaling I square C or SPI that of course You will then in Linux need a driver for that that will then like that You know you can configure further things or it it will Signal what what is connected? And another topic of course is the whole power delivery stuff I did not cover that here for today We have a blog posts and the webinar away will actually from my colleague Peter Lischer is a hardware guy Who intensely worked on that topic and can tell you all about it? I have some links in the references and now You have two examples here is for example from a TI M62 C Dara chip you see here It has two instances of of USB controllers and you on the top here It's the basically to the V bus enable signals in this case. They they call that drive V bus So you are that dedicated the signals in this case and then this is the V bus basically the Input signal that you have when you're in a device role You can see here that the second instance is Basically hardcoded to to be a host port so there that that signal just is hardcoded pulled up And then of course the diff pairs and usually for the whole analog stage You also have some kind of a calibration resistors. You see here. Also, you have usually various power rails Then the second example is actually from idodemic say them plus Which is a SOC that also is a USB 3.0 super speed capable You can see how that looks then again. This one has two instances and the Accompanion signals in this case are just GPIOs so for the USB enabling over current and also For the ID stuff that it just uses a regular GPIOs while there is actually ID pin here, but If you're carefully reading nxp spec that is a kind of a lie that pin doesn't exist Don't use it. We tried that doesn't work It's not there fake Anyway, you see here the diff pairs for the USB kind of the legacy stuff and then the two transmit receive diff pairs again They use some kind of a tune resistor and the VBUS signal again in the host case It's just pulled up Okay, now what can we do with that stuff? One thing that is very interesting is a USB recovery mode as most SOCs They have different boot modes and one of them can be that it boots via USB So it's usually selected either by some strapping or fusing the on in production And then the functionality of course It's kind of built in into the bootrom or what what we usually call the initial program loader IPL and Then once such an initial state is loaded executed Of course further stages may use whatever other mechanisms not so you can have some for example an SPL That that you load like that and then you can also use other mechanisms like We will see later D a few or fast boot or something like that So again as an example nxp idota mix 6 7 or 8 or 5 bit they support the so-called USB serial download protocol STP It's basically the former serial you are the download protocol encapsulated in USB and There actually exist to implementation there of there is the kind of the older I mix loader or I mix USB one and then there is this manufacturing tool Mfg tools Rio later fancy one also known under the name on your universal update utility you you you Another example for example to TI now aim 6 to sitara It actually supports natively in the bootrom directly this so-called D a few device firmware upgrade Which is an official USB device class? It's relatively low speed Unfortunately for for transferring large files because it's just using The end point zero for this transfers as we have learned that one is usually meant for kind of smaller transfers not really to transfer big data anyway on the whole side the implementation is called if you you deal and of course Either using the nxp or ti usually for convenience further scripting configuration may be required to to kind of achieve You know if you don't want to kind of mentally loads single binders stuff like that So Also what actual vendor or product ID you want to act upon and and stuff like that So and then like I said these different stages you probably load some SPL first Which then initializes the RAM and and you go on loads the ubu proper stuff like that and one Thing that uses that is the Toradex is installed it uses the mechanism It is kind of use big recovery mode to allow loading a full-fledged Installer Qt based linux application Okay Now once you're in a boot loader in the uboop for example So how does USB work there that the device side? Also known sketch it Basically anyway new boot anything USB has to be started manually So in a regular boot usually it does not initialize us be at all and For the gadget side you can basically say whether which functionality or not do like TfU fast boot or UMS so in the TfU case device firmware upgrade is config TfU Config command TfU plus you will also need some kind of a back end for example Config TfU RAM We usually only use the RAM one because like I said with our installer Which is to load that into RAM and then that the installer in linux will will do All the nitty-gritty details of how you flash stuff to do whatever kind of storage you have Then for TfU also do you have some invariant variable? It's called this TfU alt info and then the last thing will say what back end it is And it is case RAM and you basically configure here what pieces you have and that what addresses those go and then Once you have said that you basically start the whole thing with with the TfU command and you give it the instance number of of your USB controller Another one is Android fast boot pretty common the nice thing about that is as we learned before TfU is not quite the performant and Fast boot is much faster to load bigger images I guess especially on on the on the actual Android phones where you can have gigabyte big Images you don't want to do that with TfU not would take hours Anyway, you can see here what the configuration stuff is to do that and then one note is that it will require a bigger buffer So you have to configure this fast boot buffer address and fast boot buffer size for it to work There are also further configuration possible like for Partitional ISS or partition descriptors and such stuff or you can overwrite some of the regular variables via fast boot and then you just Started with the fast boot command again, you give it USB and the instance number Another one is the USB mouse storage class the UMS Gadget it basically Allows sharing a regular block device via USB So you see here the configurations again for that of course it depends also on the config BLK so the block device stuff and the command is just UMS again You give it the device instance of the USB side and then you give it what interface the block devices and the device number and or partition number of your block device and then it basically Will go on and just share that block device and on the PC side when you plug it in It's just like a USB memory stick basically one note here. I've got to list that on the Slide here is that When you have an emmc with hardware kind of partitions There is no way you can share those via UMS. So that's for example a limitation that that It won't work with UMS if you want to update those kind of cool partitions Then on the host side if you want to use USB devices in USB So that's config command USB and of course it depends also on the on actual HCD and Again USB is not automatically started during startup because also Another reason is that it could potentially interfere that kind of initialized USB stuff once and Linux boots Therefore you should manually start it USB start and also it gets stopped again before it ends over later to Linux Also the enumeration is rather slow as it is using timeout stuff like that And and as you might know you boot is not like a multi-threaded operating system or something like that One useful command there is USB 3 that will then show you what what kind of device it found on the bus It supports keyboard storage USB is a net adapter and all this kind of stuff How about in the Linux kernel? there is the USB core basically implements the USB bus specification and this is a architecture independent the subsystem and Then of course you need a specific USB host controller driver that is depends on your architecture and platform There are different ones available OHCA UHCA EHCA and then for USB 3 This XHCA stuff And then for the actual device you will need a USB device driver That is again platform independent, but specific to the actual peripheral used on the USB bus Then on the device side you need a USB device controller UDC So this is architecture platform dependent again So depending for example on your SOC what what implementation you have there and then The actual functionality that you will do as the USB device is the so-called catcher driver again this one is platform independent and There are different drivers for example for Ethernet serial or storage such stuff How does it work in user space? There is the the Brock bus USB devices where you can see what what the Bus is actually doing the one nice utility is the USB utils So it has for example LS USB that lists you all the details about All your devices. There is also a three-light view available with minus t respectively dash dash 3 and There is also one Called USB dash devices which brings all the USB device details And there is also a utility called USB hit dump that allows you to dump for for the human interface Devices the actual report descriptors and streams and a nice Graphical one that basically shows all this information is the USB view application Which is a GTK plus 3x graphical application, which I also show here a screenshot Another interesting thing from user space is basically if you have an application that wants to actually You know do stuff on USB transfer things or so you can use Lib USB. It's very commonly used It's a cross-platform library. So it's even available on like Windows or Mac or stuff like that. So it You can Yeah, create very generic applications for for USB communication it's basically see library that provides generic access and It's facilitates the production of such a USB applications Very portable like I said and it's it's really running in user mode and doesn't require any other privileges or anything But depending on the OS, of course, it needs some kind of a low-layer thing to be installed before that works in user space Another interesting tool is the you have control. It's basically for USB hop Per port power control that can be very useful also in embedded devices It's basically the standardized way how you could on a hop Every single port separately power on and off But of course it will require a hop which actually implements this so this is not You know that the USB spec and not enforce that that it does that so you have to Find out whether your particular hop does that or not the ones we have on our carrier boards They usually are capable of doing that Then a quick word on USB tooling So also a lot of useful full tools can be actually hooked up to your notebook or workstation via USB Of course most common thing is the serial adapters not Nowadays who has a real serial port mostly. It's just a USB to serial adapter another thing is kind of Yeah, because USB is Sometimes a little tricky and you might want to know what is going on There are also analyzers to analyze USB that are connected by USB. Of course. How else would you connect it? so one of the kind of Upquisher used one is the so-called Beagle and Another thing I found which I thought would be interesting to mention it here is the Syntion it was formerly called Luna. It's basically an open source open hardware project that is Basically multi-tool for building analyzing and hacking USB devices. I heard some rumor that the next month they will ship it was kind of a A project on some of these Sites not and the first ones should seep next month Then another Thing that often is used is can analyzers. They can be like the two peak or stuff can be connected by USB There are also USB logic analyzers. Very interesting Maybe the guys that were in marx call yesterday. He also talked a little bit about that not One that is often used is Sallea logic I personally actually Using the dream source lab one. It's a very nice one. Also the whole software is fully open source. It's basically sick rock-based Software and the same goes for there are also oscilloscopes that you can connect like that Okay, now we have a quick look at the USB role switching because that is something that is often You have been embedded devices, so you basically have a port that can be either device or host One way to configure that is of course in the device tree you can hard-code it There is the DR mode property as you can see here on the right you can just For example for a host only port you basically set the DR mode to host and then it's just host But you could also set it to to devise then or actually it's per if core peripheral And then it will be a peripheral only port Another way to do it like we saw in the whole pin stuff is that you have an ID pin And one way to do that is using the XCOM framework We do that for example for the Colibri I mix 6 and 7 upstream. It's documented here It's basically a virtual device that is used to to generate those USB cable events or states and In the device tree it uses this compatible and then you can set either ID GPIO and or the VBOS GPIO You have again an example here. So you have this XCOM thing Where you have an ID GPIO set of course the pin control for it that that Configures it for a GPIO and then in the actual USB note You have to reference it you say XCOM and you have here two values. The first one would be the VBOS Which we don't have and the second one is then the ID pin Please note that this XCOM stuff is considered obsolete. So I guess Once we have time we might also convert our Colibri stuff to use the new fancy stuff called USB connector subsystem another subsystem So we use that for example on the on the 8m plus Again, it's documented in this YAML file and it uses a GPIO to basically have a connection detection and There is also Similar to the ID. There is also a VBOS one Which is done in this kind of a fi driver and the compatible for it is shown here and Yeah Basically also it has an ID GPIO and or a VBOS GPIO and you can also give it the VBOS supply so for when it's a in the host role that It uses this regulator to to drive the VBOS the full Device 3 you see here basically in the USB node You have this connector node where you give that compatible the GPIO and all the other stuff Okay Then how does it work with USB device functionality? This is basically the kernel configuration It's the USB gadget function nowadays configurable through the config FS What is this config fs thing this basically is a user space driven kernel object configuration So it's a RAM based file system that provides Basically the converse to surface functionality So where the surface is basically five system view on kernel objects config FS Allows you to actually instantiate kernel objects from user space not So there are two types of config FS attributes the normal ones which are just small asking text files and they can also be binary attributes and The USB gadget config FS is basically an interface to allow defining arbitrary functions and configurations to define such application specific USB composite devices I quickly show here how that is done make sure it's mounted to your config FS and then you basically when The USB gadgets config FS is supported that it will automatically already have this USB gadget folder there And then you can create G1 directory and you can that creates a new gadget thing you write your product IDs and your strings as is shown here and then You can create such a function instance in this case. So you create a configuration and then You in this case, it's called win NCM. So this network Closing and Then you hook that up via a link to your actual USB UDC instance And now if you were wondering what the hell do I do have to do that like manually? Of course, there is also a way to do that programmatically. It's called USB Libby USB GX Then for the host functionality And now the more interesting stuff about the debugging so to debug on Linux It's called the USB mon. It's a kernel facility that allows you to collect races of IO on the USB bus and then Probably on to visualize that there is for example the virtual USB analyzer Unfortunately, I think that is up and don't obsolete project. But yeah, you can just use wire shark And I show here how you can do it on a embedded device Of course, usually you don't want to run the whole wire shark on the embedded device But you can just SSH in and these CP dump has Actually the functionality to do the tracing of USB mon things and then pipe that Through the standard out in the standard in and wire shark will then display that that looks like that and I can now also quickly show that on a live device So I have here a board available a power it on so it is running some kind of halfway new stuff and We can for example mode probe the USB mon stuff and Once you do that you can At least what DCP don't now knows about that I can also plug for example a USB stick in here So you see that it goes on the bus to here. That's the number Here that it shows not and so I can then Let's see Have another terminal so on the host side I now just SSH in and then we'll forward that to Wire shark there you go. We can stop it here and we actually see here I mean, this is a USB memory stick so you can see here It does some SCSI transactions and then do you see here? Oh, that's just bulk transfers on the USB bus Okay Very good. That was it for my talk Let's get back We have maybe a minute. There are any questions anybody So on one of the first slides there was a list with the speed supported and I think there's a small mistake because high speed is 480 megabits and Full speed is 12 megabits. Yeah, exactly Thanks, I can also correct that in the slide and update it. Thank you. Any other questions? Yeah, go ahead Mm-hmm. I know something about config fs because I converted most of the functions USB functions to use config fs so Maybe people got an impression that you create arbitrary functions with config fs Which is not exactly the case you can select out of Available repertoire there are about 20 USB functions. Of course. Yeah, various flavors of Ethernet audio human interface Master and so on exactly you need to have that of course configured It will not just magically win any NCM. I mean it needs to need the driver to be somewhere that knows what to do Yes, yes, but but if you really want your custom completely custom function Which does not belong to any USB class you can use a fun another function, which is called function fs which exposes a File system interface to user space and then you implement your custom USB function in user space by reading writing or pulling Files in that that's kind of like fuse or something like that. Exactly. Yeah. Thank you very much. Okay We're out of time. Thank you very much