Ubiquitous Successful Bus: Version 2

October 17, 2024 by Arya Voronova 52 Comments

I’ve talked a fair bit about USB-C before, explaining how it all works, from many different angles. That said, USB-C is just the physical connector standard, plus the PD part that takes care of voltages and altmodes – things like data transfer are still delegated to the two interfaces you invariably end up using on USB-C ports, USB 2, and USB 3.

You might think USB 2 and USB 3 are tightly related, but in many crucial ways, they couldn’t be more different. I have experience working with both, and, as you might guess, I want to share it all with you. You might be surprised to hear there’s plenty to learn about USB 2 in particular – after all, we’ve had it hang around for 30 years now. Well, let’s make sure you’re fully caught up!

The Ingredients

USB 2 is a point-to-point link – one side is “host” and another is “device”, with the host typically being a PC chipset or a single-board computer. USB 2 relies on a single pseudodifferential pair. It’s “pseudodifferential” because the wires don’t just do differential signaling – they also use digital logic levels and pullup/pulldown resistors to signal device presence, especially in the beginning when the USB link is still getting established. Indeed, you can imitate a USB device’s presence with just a resistor.
Continue reading “Ubiquitous Successful Bus: Version 2” →

Need High-Power Li-Ion Charging? How About 100 W

October 4, 2024 by Arya Voronova 21 Comments

Ever want a seriously powerful PCB for charging a Li-Ion pack? Whatever you want it for, [Redherring32] has got it — it’s a board bearing the TPS25750D and BQ25713 chips, that lets you push up to 100 W into your 1S Li-Ion pack through the magic of USB Power Delivery (USB-PD).

Why do you need so much power? Well, when you put together a large amount of Li-Ion cells, this is how you charge it all at once – an average laptop might charge the internal battery at 30 W, and it’s not uncommon for laptop batteries to be dwarfed by hackers’-built packs.

A 4-layer creation peppered with vias, this board’s a hefty one — it’s not often that you see a Li-Ion charger designed to push as much current as possible into a cell, and the chips are smart enough for that. As far as the onboard chips’ capabilities go, the board could handle pack configurations from 1S to 4S, and even act as a USB-PD source — check the IC configuration before you expect to use it for any specific purpose.

Want a simpler charger, even if it’s less powerful? Remember, you can use PPS-capable PD chargers for topping up Li-Ion packs, with barely any extra hardware required.

HP WebOS TouchPad Gets With The USB-C Times

October 1, 2024 by Arya Voronova 9 Comments

Despite HP shuttering their WebOS project some time ago, the operating system has kept a dedicated following. One device in particular, the HP TouchPad, was released just a month before webOS went under and is still a favorite among hackers — giving the device the kind of love that HP never could. [Alan Morford] from the pivotCE blog shares the kind of hack that helps this device exist in a modern-day world: a USB-C upgrade for charging and data transfer.

The inline micro USB port used is a perfect fit for a USB-C upgrade, with only small amounts of PCB and case cutting required. Just make sure to get a breakout that has the appropriate 5.1 K resistors onboard, and follow [Alan]’s tutorial closely. He shows all the points you need to tap to let your TouchPad charge and transfer data to your computer, whether for firmware flashing or for daily use.

This hack doesn’t preserve the USB-OTG feature, but that’s fixable with a single WUSB3801. Apart from that, this mod is perfect for keeping your webOS tablet alive and kicking in today’s increasingly USB-C dominated world. Once you’ve done it, you might want to take care of your PlayStation 4 controllers and Arduino Uno boards, too.

Design Review: USB-C PD Input For Yaesu FRG7700

May 23, 2024 by Arya Voronova 21 Comments

Today is another board from a friend, [treble], who wants to convert a Yaesu FRG7700 radio to USB-C PD power. It’s yet another review that I’ve done privately, and then realized I’ve made more than enough changes to it, to the point that others could learn from this review quite a bit. With our hacker’s consent, I’m now sharing these things with you all, so that we can improve our boards further and further.

This board’s idea is thought-out and executed well – it replaces a bespoke barrel jack assembly, and is mechanically designed to fit the screw holes and the free space inside the chassis. For USB-PD, it uses a CH32V003 coupled with FUSB302 – I definitely did help pick the latter! For mechanical reasons, this board is split into two parts – one has the USB-C port, whereas the other has the MCU and the PD PHY.

In short, this board is a PD trigger. Unlike the usual PD triggers, however, this one is fully configurable, since it has a 32-bit MCU with good software support, plus, the PD PHY is also well known and easily controllable. So, if you want special behavior like charger-power-dependent profile selection for powering a static resistance load, you can implement it easily – or, say, you can do PPS for variable voltage or even lithium ion battery charging! With a bit of extra code, you could even do EPR (28 V = 140 W power) with this board, instantly making it into a pretty advanced PD trigger, beyond the ones available on the market.

Also, the board has some PCB art, and a very handy filter to get some of the USB-C charger noise out. Let’s take a look at all of these!

Current Flow Improvements

Continue reading “Design Review: USB-C PD Input For Yaesu FRG7700” →

USB-C For Hackers: Program Your Own PSU

December 4, 2023 by Arya Voronova 20 Comments

Last time, I showed off a few ways you can convert an existing PSU to USB-C duty, and zoomed in on a particular way you can use to convert one of the ever-abundant 18 V – 20 V laptop PSUs to USB-C. All we have left is to write software for it, and I’ll explain how it works. There’s also that one cool USB-C secret I’ve found out, but you’ll have to read on to find out more.

From the last article, we have a board that has an RP2040 and FUSB302 combo on it, which takes a 20 V DC PSU input from a laptop brick, and can switch either 5 V, 20 V or 0 V to its USB-C socket using FETs. The USB-C communication firmware is simple enough, but there’s caveats, especially regarding safety. Let’s go through those!

The Code Logic

VBUS has to be non-powered by default – we only supply 5 V when the FUSB302 detects a 5.1 kΩ pulldown on one of the CC lines. After supplying 5 V, we send out PSU capability advertisements, of the kind that we’ve learned to parse in the Replying PD article – and whenever we get a Request, we have to switch to the requested profile, connecting the voltage rail requested to the FET. I opt to not do any current consumption control in this design, assuming a well-behaved device, but you theoretically should do that. It wouldn’t be hard to add a high-side current sensor, say, something from Analog Devices – I just don’t want to do that now, especially given that I’m already using two of the exposed ADC pins to do Lenovo/HP PSU capability detection instead, one is used up for VBUS measurement, and the fourth is used for VIN (20 V rail) measurement – that’s four ADCs, which is as much as the RP2040 has got. However, if I ever need more ADCs, I can add an analog mux like 4051 in the next version! Continue reading “USB-C For Hackers: Program Your Own PSU” →

USB-C For Hackers: Build Your Own PSU

October 12, 2023 by Arya Voronova 43 Comments

What if you wanted to build your own USB-C PSU? Good news – it’s easy enough! If you ever wanted to retrofit a decent DC PSU of yours to the USB-C standard, say, you got a Lenovo/HP/Dell 19V-20V charger brick and you’ve ever wished it were USB-C, today is the day when we do exactly that. To be fair, we will cheat a bit – but only a tiny bit, we won’t be deviating too much from the specification! And, to begin with, I’ll show you some exceptionally easy ways that you can turn your DC PSU into a USB-C compatible one, with a simple module or a few.

Turning a 20 V PSU into a USB-C PSU feels natural if you want to charge a laptop – those tend to request 20 V from a USB-C PSU anyway, so what’s the big deal? However, you can’t just put 20 V onto a USB-C connector – you have to add a fair bit of extra logic to make your newly christened USB-C PSU safe to use with 5 V devices, and this logic also requires you go through a few extra steps before 20 V appears on VBUS. Any USB-C PSU has to output 5 V first and foremost whenever a device is connected, up until a higher voltage is negotiated digitally, and the PSU may only switch to a higher voltage output when it’s requested to do so.

Now, for that, a PSU offers a list of profiles, and we looked into those profiles in the Replying PD article – each profile is four bytes that contain information about the profile voltage, maximum current that the device may draw at that voltage, and a few other details. For a PSU to be USB-C compliant, the USB-C specification says that, in addition to 5 V, you may also offer 9 V, 15 V, and 20 V.

Also, the specification says that if a PSU supports certain in-spec voltage like 15 V, it’s also required by the spec to offer all of the spec-defined voltages below the maximum one – for 15 V, that also requires supporting 9 V. Both of these are UX requirements, as opposed to technical requirements – it’s easier for device and PSU manufacturers to work with a small set of pre-defined voltages that majority of the chargers will support, but in reality, you can actually offer any voltage you want in the PSU advertisement; at worst, a device is going to refuse and contend with slowly charging from the 5 V output that you’re required to produce.

I’d like to walk you through how off-the-shelf USB-C PSUs work, all of the options you can use to to create one, and then, let’s build our own USB-C PSU from scratch! Continue reading “USB-C For Hackers: Build Your Own PSU” →

Showing the dock PCB with a Pi Zero attached and wired up onto it

Is Your USB-C Dock Out To Hack You?

March 26, 2023 by Arya Voronova 20 Comments

In today’s installment of Betteridge’s law enforcement, here’s an evil USB-C dock proof-of-concept by [Lachlan Davidson] from [Aura Division]. We’ve seen malicious USB devices aplenty, from cables and chargers to flash drives and even suspicious USB fans. But a dock, however, is new. The gist is simple — you take a stock dock, find a Pi Zero W and wire it up to a USB 2.0 port tapped somewhere inside the dock. Finding a Pi Zero is unquestionably the hardest part in this endeavor — on the software side, everything is ready for you, just flash an SD card with a pre-cooked malicious image and go!

On the surface level, this might seem like a cookie-cutter malicious USB attack. However, there’s a non-technical element to it; USB-C docks are becoming more and more popular, and with the unique level of convenience they provide, the “plug it in” temptation is much higher than with other devices. For instance, in shared workspaces, having a USB-C cable with charging and sometimes even a second monitor is becoming a norm. If you use USB-C day-to-day, the convenience of just plugging a USB-C cable into your laptop becomes too good to pass up on.

This hack doesn’t exactly use any USB-C specific technical features, like Power Delivery (PD) – it’s more about exploiting the convenience factor of USB-C that incentivizes you to plug a USB-C cable in, amplifying an old attack. Now, BadUSB with its keystroke injection is no longer the limit — with a Thunderbolt-capable USB-C dock, you can connect a PCIe device to it internally and even get access to a laptop’s RAM contents. Of course, fearing USB-C cables is not a viable approach, so perhaps it’s time for us to start protecting from BadUSB attacks on the software side.