3.8. USB transport — the DWC3 controller behind every off-device path

Every way of talking to this device from a host over the USB-C port — EDL / Sahara + Firehose, fastboot, ADB/MTP, the EUD debugger, and OTG host — uses a single USB controller: the Synopsys DWC3 in its Qualcomm wrapper. This page documents that controller and its PHYs as hardware, and how one dual-role port is shared across the boot modes. The mode-entry logic and the EUD/charger specifics already live elsewhere and are cross-referenced, not repeated: EDL / 9008 entry and the deep-flash cable (EUD, DDI, charger→EDL), Firehose fuse read and secure-boot confirmation, Fastboot handler internals (FastbootLib), PMIC reset timers, charging and reachability (SMB5 charger / Type-C).

3.8.1. Controller

ssusb@a600000 — qcom,dwc-usb3-msm (the Qualcomm wrapper), core_base ``0xa600000`` size 0x200000, wrapping the IP core:

dwc3@a600000 — snps,dwc3, reg 0xa600000 size 0xe000, IRQ 0x85.

Key properties:

  • ``dr_mode = “drd”`` — dual-role: the same port acts as USB device (gadget) for EDL/fastboot/ADB or as host for OTG, chosen at runtime from Type-C role detection (below).

  • ``maximum-speed = “super-speed”`` (USB 3, with usb3-u1u2-disable and the DWC3 LPM erratum quirks set).

  • Power/isolation: USB3_GDSC power domain; DMA goes through the apps-SMMU stream <0x17 0x540> (Base kernel device tree (the SoC boot contract)); qcom,iommu-dma = "atomic".

  • Wake-up: qcom,use-pdc-interrupts with dp_hs_phy_irq / dm_hs_phy_irq / ss_phy_irq / pwr_event_irq — the PHY wake lines are routed through the PDC, i.e. armed by the AOP for wake-from-suspend (AOP — the Always-On Processor (RPMh / power back-end)).

  • Accelerated pipes: qcom,usbbam@a704000 (qcom,usb-bam-msm, USB BAM), FIFO base 0x146a6000 (in the on-chip IMEM band, Base kernel device tree (the SoC boot contract)).

  • Clocks from GCC (core/iface/bus_aggr/utmi/sleep) plus the XO; core-clk-rate 0x7f28155 (≈133 MHz).

3.8.2. PHYs

Two PHYs sit under the controller — one per USB speed, the SuperSpeed one shared with DisplayPort:

PHY

Base

Notes

qusb@88e3000 (qcom,qusb2phy-v2)

0x88e3000

High-Speed (USB2, UTMI). Register tuning qusb-phy-init-seq; PHY trim efuse_addr = 0x780268 (3 bits @ pos 0x19). Also exposes eud_enable_reg at 0x88e2000 — the hook the EUD debugger uses to take over the D+/D- lines (EDL / 9008 entry and the deep-flash cable).

ssphy@88e8000 (qcom,usb-ssphy-qmp-dp-combo)

0x88e8000

SuperSpeed QMP PHY, combined with DisplayPort — the SS lanes carry USB3 or DP alt-mode over the Type-C connector.

The HS PHY is what a host sees first (USB2 enumeration is what EDL/Sahara, fastboot and charger APSD all use); the SS PHY only comes up for USB3/DP.

3.8.3. Role and attach detection

Because the controller is drd, something must tell it device-vs-host and when a cable is present. That comes from the PMIC over an extcon link:

3.8.4. One controller, many boot roles

The same DWC3 gadget is re-used by each stage; only the software on top differs:

Role

Owner / stage

Reference

EDL — Sahara + Firehose

PBL / XBL (9008 gadget)

EDL / 9008 entry and the deep-flash cable, Firehose fuse read and secure-boot confirmation

fastboot

ABL (gadget)

Fastboot handler internals (FastbootLib)

ADB / MTP

kernel + userspace gadget

(userspace; out of scope)

EUD (T32 debug)

XBL/DXE + msm-eud@88e0000

EDL / 9008 entry and the deep-flash cable

OTG host

kernel host stack

dr_mode = "drd" above

So a bootloader replacement that needs a host link (its own fastboot-like loader, or to be flashed) inherits exactly this hardware: bring up the QUSB2 HS PHY, drive the DWC3 core as a gadget, and rely on the Type-C/charger block for attach — the PHYs are already trained by XBL at hand-off (Below UEFI — execution state and hardware register surface), and EDL remains the PBL-level fallback independent of all of it.

3.8.5. Provenance

Source:

artifacts/boot_a/board.dts — ssusb@a600000 / dwc3@a600000 / qcom,usbbam@a704000 (controller, dr_mode, speed, SMMU/GDSC/PDC, BAM), qusb@88e3000 and ssphy@88e8000 (PHYs, EUD-enable and efuse regs), and the PMIC usb@1300 / typec@1500 nodes.

Method:

Device-tree node reading; addresses/IRQs/register-names quoted directly. No code executed.

Cross-refs:

EDL / 9008 entry and the deep-flash cable (EUD/DDI/charger→EDL), Firehose fuse read and secure-boot confirmation (Sahara/Firehose over this gadget), Fastboot handler internals (FastbootLib) (fastboot gadget), PMIC reset timers, charging and reachability (SMB5 charger / Type-C), Base kernel device tree (the SoC boot contract) (apps-SMMU), Below UEFI — execution state and hardware register surface (PHY state at hand-off), AOP — the Always-On Processor (RPMh / power back-end) (PDC USB wake).