# Debubo - USB-C SBU UART to USB with PD Injector / Analyzer

A 4-layer PCB with STM32G071CB microcontroller equipped with two USB Power Delivery interfaces, and CH342 dual UART to USB (CDC ACM class) converter.

![3D render of Debubo, front](imgs/debubo-front.jpg) ![3D render of Debubo, back](imgs/debubo-back.jpg)

STM32 can communicate via [Power Delivery protocol](https://www.usb.org/document-library/usb-power-delivery) over both USB-C plug and "DATA/PWR" USB-C receptacle,
which are directly connected to each other to pass power and USB 2.0 data through.

CH342 provides access to 3.3V UART on USB-C plug's SBU pins and to STM32 over "DBG/MCU" USB-C receptacle. This allows to access debug console on devices that only
expose it on SBU pins after entering an alt-mode or sending custom VDMs over PD, and to flash STM32 without additional tools.

Debubo can also be used as a Power Delivery sniffer / injector (as a man-in-the-middle).

## USB-C and Power Delivery

Debubo can send messages using any arbitrary Ordered Set, and receive all Ordered Sets defined by the PD standard, plus two additional user-defined ones.

It also gives you control over Rd / Rp resistors on both CC pins, allowing it to act as a Debug Accessory or to simulate plug orientation reversal.

## SBU

Debubo is meant to be used with devices that expose 3.3V UART on their USB-C receptacle's SBU pins.

You can still use Debubo with other devices if you pair it with [SBUB](https://gitlab.com/dos1/sbub). This way you can access other kinds of interfaces exposed on SBU pins as well,
such as I2C (as seen, for example, on [MacBooks](https://github.com/AsahiLinux/docs/wiki/HW:USB-PD)).

## Limitations

- there's no control over VBus or a way to sense its state, so make sure both sides always agree on the negotiated voltage!
- there's no way to send or pass Fast Role Swap signaling through (but it can be received)
- Debubo can neither source Vconn nor pass it through
- there's no protection from short-to-VBus events on CC lines, which are only 5V tolerant - take special care when working with higher voltages
- Debubo needs to be powered on in order to present itself as a Sink to either passthrough port (no "dead battery" mode)

## Input / Output

Debubo breaks a bunch of extra interfaces out as pin headers: USB-C plug's SBU lines, 5V and 3.3V power, SWD, I2C, UART to MCU, SPI, GPIO for custom use and MCU reset line.
There's also a LED and a push button for custom purposes. Pins of unused interfaces can be repurposed as GPIO or DAC/ADC where available.

Note that current drawn from 3.3V rail (including power drawn by STM32) should not exceed 10 mA - it's provided by CH342's integrated LDO.

USB-C plug's SBU lines are connected to CH342's UART0 (TX - SBU1, RX - SBU2), STM32's USART1 (TX - SBU1, RX - SBU2) and USART4 (TX - SBU2, RX - SBU1).

STM32's bootloader-capable USART2 is connected to CH342's UART1.

## Modifications

- two solder jumpers near the plug (JP1, JP2) allow you to bridge top and bottom D+/D- pairs on the USB-C plug together
- cutting the trace on the bottom solder jumper (JP3) allows you to provide your own Vio to CH342 (note that STM32 USART will still be 3.3V)

## Firmware

Debubo is meant to be a hardware platform that you can run your own firmware on.

STM32 can be reflashed via USB (second UART channel) with [stm32flash](https://sourceforge.net/p/stm32flash/wiki/Home/) after booting while holding BOOT button.

**NOTE**: STM32G0 MCUs have booting into UART bootloader by asserting BOOT0 pin disabled by default.
Make sure to [enable it](https://github.com/olikraus/stm32g031/tree/main/enable_boot0) in the first firmware you flash, as otherwise you will have to use a SWD probe to flash it again.

An example firmware with PD analyzer functionality and [Librem 5 UART](https://source.puri.sm/Librem5/community-wiki/-/wikis/Hardware/Serial-Console#thunderbolt-alt-mode-for-muxing-uart-onto-usb-c-sbu-pins)
negotiation will be provided soon.

## Manufacturing

Debubo has been designed around 1206 components to make it relatively easy to assemble at home.

![Photo of assembled Debubo plugged into a phone's USB-C port](imgs/debubo.jpg)

If you want to order assembly from JLCPCB instead, all components have their LCSC part numbers already filled. Take note that R1, R2 (5.1k resistors) and D1 (green LED)
aren't available as Basic parts in 1206 size - you may want to change their footprints to smaller ones to save money. There are no traces nor vias between the pads to make this easy,
and you can find alternative LCSC part numbers in component properties.  You can also find alternative part numbers for swapping J5 and J6 pin headers with pin sockets and vice versa there.

When ordering PCBs from JLCPCB, set "Impedance Control" to "Yes", "Layer Stackup" to "JLC04161H-3313" and "Remove Order Number" to "Specify a location".

Free samples of STM32G071CBT6 can be ordered in [ST Online Store](https://estore.st.com/en/stm32g071cbt6-cpn.html).

## Licensing

© Copyright 2024 [Sebastian Krzyszkowiak](https://dosowisko.net/) <dos@dosowisko.net>

The design is licensed under GNU GPLv3+. This does not apply to 3D models in debubo.3dshapes directory, which were converted from EasyEDA library.

Pangolin illustration drawn by [Agata Nawrot](https://agatanawrot.com/).
