How to Use I/O Triggers and Breakpoints to Debug USB Firmware Bugs in Real Time
There are many powerful ways to use a Beagle USB Protocol Analyzer — from sniffing and analyzing USB traffic for mass storage, HID, and other device classes to debugging USB-to-Ethernet devices, decoding IP-layer traffic, and exporting captured data into Wireshark for deeper analysis.
Embedded systems security expert, Colin O'Flynn, published an independent review of the Beagle™ USB 480 Protocol Analyzer, highlighting how it can streamline USB debugging and protocol analysis workflows.
If you're looking to get the most out of a Beagle analyzer, below is a summary of Colin O'Flynn’s review and key takeaways for efficient USB debugging.
Triggering USB Packets Makes USB Debugging More Efficient
This is important for all firmware developers. When debugging USB, you cannot pause an embedded target: it will stop responding to USB requests, which then kills the connection. To debug USB errors, seeing the error isn't enough; you need to see where in the code the error originates.
To locate errors, breakpoints need to be set up quickly (e.g.: pause target, dump a value, and continue running before USB errors out), or need it needs to be selected where breakpoints happen.
In the Total Phase Data Center Software, advanced data matching features, such as matching specific packet types (including corrupted) or even specific data, all in real time, enable you to trigger your breakpoints with detailed data matching.
This trigger can be fed into the emulator to cause a BREAK condition. This can be done by adding an interrupt into your system with a breakpoint in it. The results: a breakpoint occurs when some data goes over the bus to see what's happening. For example - is memcpy() overwriting a buffer before the system completes sending the data?
Monitoring Status in a Running System
The Beagle USB 480 Protocol Analyzer provides a good variety of inputs. You can toggle IO pins from inside the firmware when specific tasks start and end. For example, assign 1 pin to the low-level USB task, 1 pin to the higher-level class, and 1 pin to the user software. By monitoring the status of the pin toggles in the Data Center software, it's easy to see if task stops running properly, or if there's a bug.
With this technique, you will see what USB code is doing when it needs to pass messages between multiple tasks. For example, the scheduler is not calling the final task that actually processes the data, which causes the system to run out of buffers faster than estimated or designed.
Synchronizing Other Equipment to the USB Capture
Synchronization can be a critical, important factor in USB capture. For example, you need to reverse-engineer a USB device. You can set up the hardware to trigger when it sees a specific output condition, such as a sequence of packets. This trigger can be used to synchronize to the actual USB data on the bus. This setup help determine exactly what messages are being passed.
Here is Colin's video of debugging a controller:
For more information, including more examples of using Total Phase products, please refer to the following documents:
- Data Center Software User Manual
- Beagle Protocol User Manual
- Total Phase Videos
- Knowledge Base Articles
- Beagle USB Analyzer Guide
We hope this answers your question. If you have other questions about our software, host adapters, protocol analyzers or other Total Phase products, feel free to email us at sales@totalphase.com or submit a demo request.