Tech News
← Back to articles

The hidden JTAG in your Qualcomm/Snapdragon device’s USB port

read original related products more articles

Back in February of this year, Qualcomm quietly published the source code for interacting with EUD. This is perhaps one of the most exciting things they’ve done lately - especially if you spend a lot of time debugging the kernel or U-Boot - let’s talk about it.

EUD stands for Embedded USB Debug: essentially, this is a debug interface built right into almost every Qualcomm SoC since ~2018. Internally it hooks deep into the SoC, providing debug facilities for not just the CPUs but also the myriad of Hexagon co-processor/DSPs; many of the exciting details can be found in this patent from way back in 2014.

In practise, for a non-production device (like a dev board, though some production devices seem to work too), EUD can be enabled by writing a few registers and then starting up the USB phy (though the details vary by generation). Instead of whatever typical gadget you might expect, what appears on your PC is a 7-port USB hub, with 1 port populated by the “EUD control interface”.

With the right USB commands, a second device will appear, this one exposes an SWD interface! Yes! SWD right over the USB cable, no external tools, no soldering, and no expensive debuggers. Closed case debug that (almost) puts Google’s Suzy-Q to shame!

For those unfamiliar: JTAG and SWD are both mechanisms for debugging the CPU cores inside a device, just like you can use GDB to debug programs on your computer (or your IDEs integrated debugger). They let you set breakpoints, halt execution, inspect the registers, single step instructions and all sorts of other useful things.

The code drop

For quite a while there has been a tantalising fork of openOCD published by Qualcomm on CodeLinaro, promising EUD integration. However, it relied on an at-the-time proprietary EUD library, which was only available to Qualcomm employees and their OEM partners.

The device-side part of this (enabling the EUD interface so it shows up on your PC) has been somewhat supported in upstream Linux for a while. Back in August last year there was an attempt to extend this support for some newer platforms which have additional requirements. This sparked some discussion over the kernel policy: is it acceptable to have drivers in Linux that are only usable by some internal software, gatekept for Qualcomm and their paying partners? The answer appeared to be no, and this seemed to be enough to push Qualcomm in the right direction as after 8 months of silence, here we are!

The code has finally dropped (here’s the link again), and they even updated their openOCD branch to point to the now open library, awesome!

Let’s try to use it…

... continue reading