15 ms·

This is a much better experience than the previous Qualcomm debug experience, which was a hand-rolled set of read/write/execute primitives exposed over USB. It

This is a much better experience than the previous Qualcomm debug experience, which was a hand-rolled set of read/write/execute primitives exposed over USB. It was hilariously undersecured, allowing a few of us to continually get root on various Qualcomm models. In seriousness, these debug ports are seriously lacking in most mobile chipsets. MediaTek still has the old-style approach in many of their devices, requiring some incantations which expose serial over USB, but not in the way you think -- it's serial over USB pins! I've done tonnes of work with mobile chipsets and security and this seems like they've finally started down the road to making this functionality accessible. Don't be surprised if you don't see this supported out of the box in most places, though. Most OEMs will certainly disable this once they've adapted their bootloaders to it. The big G doesn't like debuggability in end user devices.

tripdout 1y ago
Is there any information on those old debug protocols?
deleted 1y ago
[deleted]
IAmLiterallyAB 1y ago
Google exposes serial Serial over the SBU pins on all the Pixel devices
- twojacobtwo 1y ago
  What are the effective implications of this?
  - bri3d 1y ago
    It's just a UART; you can use the UART to debug the device in various ways. On Pixel devices, the UART is not configured or brought up by default in locked production mode (as things should be), but by unlocking the device and then using `fastboot oem uart enable` you can flip the bits to turn it on. On early Pixel devices it was on the headphone jack and on newer ones it's on the SBU pins. By default I think it's still configured as the kernel console in the kernel command line, so once it's enabled it will show the kernel debug output and present a TTY. But of course you can subsequently configure it to do whatever you'd want a UART for: kgdb for kernel-debugging, earlier stuff in the bootloader, and so on. So, the implications are just: there's a convenient debugging interface available to you that turns on if you unlock the device and ask for it. On Chromebook devices there's a more complicated and fancy debugging system where the SBU pins can be muxed to the security processor's USB host interface by presenting a debug cable called a SuzyQ, which presents a whole suite of debugging facilities. This used to be used quite frequently for unbricking purposes.
    - Tharre 1y ago
      On the newer pixel phones (starting with the ones containing the titan chip) you can also mux the SBU pins to the security chip USB interface with "fastboot oem citadel suzyq". And BTW, the SuzyQ cable is nothing more then two pull up resistors and a USB hub connected to the normal usb D+/D- pins on one port and the SBU pins on the 2nd port. Nothing fancy about it, people have even made their own (minus the hub) by soldering some wires and resistors to a usb-c breakout board. Google has also published the schematics for it: https://www.chromium.org/chromium-os/ccd/951-00273-01_20180607_suzyqable_SCH_1.pdf https://www.chromium.org/chromium-os/ccd/951-00273-01_201806...
      - IAmLiterallyAB 1y ago
        Been wanting to play with the citadel interface. Last time I looked at it there was 0 public information, but that was years ago. And if there still isn't, then it'll be a good excuse to RE Also, the titan chip has been around since the Pixel 3 I believe, so "newer" might be a strong word :)
Veserv 1y ago
Most of those boards have a separate physical JTAG connector (at least in development kits, this article indicates JTAG over USB is disabled in production systems anyways so no difference there) which is what they are expecting you to use for low-level debugging. It only costs like 1,000 $ for a JTAG probe which is like 1 fully-burdened engineer-day of cost. Even fully featured probes enabling hardware trace and time-travel debugging only cost like 1 engineer-week.
- bri3d 1y ago
  > Most of those boards have a separate physical JTAG connector (at least in development kits, this article indicates JTAG over USB is disabled in production systems anyways so no difference there There's generally an entire phase of prototyping where engineers will be using production boards but still need JTAG, which is why it's fused and why these kinds of features exist. It's a lot easier to have your lower-level software team (drivers/BSP, perf, etc.) sitting with production-ready units provisioned with engineering keys and debug enabled than to have them having to use some kind of case-off JTAG header setup, cost aside.
- Hizonner 1y ago
  > this article indicates JTAG over USB is disabled in production systems anyways Well, should be. I bet there've been screwups now and then...
  - baybal2 1y ago
    [dead]
- AlotOfReading 1y ago
  The probes cost enough to exceed individual purchasing limits at hardware companies, which means you need to go through the requisition process. That takes long enough that you have to plan ahead and you don't order more as your needs increase. Then everyone's fighting for the limited probes right before a ship date and they get jealously guarded like priceless jewels. JTAG also isn't usually exposed through enclosures, so using the probe on a field unit might require destructive entry depending on the application.
userbinator 1y ago
MediaTek still has the old-style approach in many of their devices, requiring some incantations which expose serial over USB, but not in the way you think -- it's serial over USB pins! Wasn't that only in their old feature-phone (MT62xx) SoCs? All the smartphone ones AFAIK (at least since the MT657x days) use USB CDC in their BootROM and preloader.
rangestransform 1y ago
You bring me back to the olden days of QXDM in my adolescence, when I used it to save myself from bricking my phone, and again when I had my first internship working on an MDM9x50 device
mrheosuper 1y ago
at work we adapted to "usb c debug accessory mode", which should be a standard everyone should follow.
immibis 1y ago
You say "undersecured", I say "allows people to own the things they bought".
- jon-wood 1y ago
  Sadly these two things can be true at the same time. As a hacker I love devices which (maybe accidentally) expose a way for me to run arbitrary software on them. At the same time as a person carrying a computer in my pocket containing my entire life I'm not a fan if that allows anyone grabbing said computer to run arbitrary software on it. The ideal here is the standard approach where a user has to explicitly take some sort of action which can't be found accidentally and done without understanding the implications to activate debug mode. On Android that's tapping a specific item in the about menu way more times than you might think would be necessary. On iOS it's hooking up to a computer, then authorising the connection on the phone. Either way you get both the ability to run arbitrary(ish) software without someone picking up your device when left on a train being able to do so.
- mystified5016 1y ago
  Also there's "allow anything on the other side of this public 'charging port' own the things you bought"

tripdout 1y ago

Is there any information on those old debug protocols?

deleted 1y ago

[deleted]

IAmLiterallyAB 1y ago

Google exposes serial Serial over the SBU pins on all the Pixel devices

twojacobtwo 1y ago
What are the effective implications of this?
- bri3d 1y ago
  It's just a UART; you can use the UART to debug the device in various ways. On Pixel devices, the UART is not configured or brought up by default in locked production mode (as things should be), but by unlocking the device and then using `fastboot oem uart enable` you can flip the bits to turn it on. On early Pixel devices it was on the headphone jack and on newer ones it's on the SBU pins. By default I think it's still configured as the kernel console in the kernel command line, so once it's enabled it will show the kernel debug output and present a TTY. But of course you can subsequently configure it to do whatever you'd want a UART for: kgdb for kernel-debugging, earlier stuff in the bootloader, and so on. So, the implications are just: there's a convenient debugging interface available to you that turns on if you unlock the device and ask for it. On Chromebook devices there's a more complicated and fancy debugging system where the SBU pins can be muxed to the security processor's USB host interface by presenting a debug cable called a SuzyQ, which presents a whole suite of debugging facilities. This used to be used quite frequently for unbricking purposes.
  - Tharre 1y ago
    On the newer pixel phones (starting with the ones containing the titan chip) you can also mux the SBU pins to the security chip USB interface with "fastboot oem citadel suzyq". And BTW, the SuzyQ cable is nothing more then two pull up resistors and a USB hub connected to the normal usb D+/D- pins on one port and the SBU pins on the 2nd port. Nothing fancy about it, people have even made their own (minus the hub) by soldering some wires and resistors to a usb-c breakout board. Google has also published the schematics for it: https://www.chromium.org/chromium-os/ccd/951-00273-01_20180607_suzyqable_SCH_1.pdf https://www.chromium.org/chromium-os/ccd/951-00273-01_201806...
    - IAmLiterallyAB 1y ago
      Been wanting to play with the citadel interface. Last time I looked at it there was 0 public information, but that was years ago. And if there still isn't, then it'll be a good excuse to RE Also, the titan chip has been around since the Pixel 3 I believe, so "newer" might be a strong word :)

Veserv 1y ago

Most of those boards have a separate physical JTAG connector (at least in development kits, this article indicates JTAG over USB is disabled in production systems anyways so no difference there) which is what they are expecting you to use for low-level debugging. It only costs like 1,000 $ for a JTAG probe which is like 1 fully-burdened engineer-day of cost. Even fully featured probes enabling hardware trace and time-travel debugging only cost like 1 engineer-week.

bri3d 1y ago
> Most of those boards have a separate physical JTAG connector (at least in development kits, this article indicates JTAG over USB is disabled in production systems anyways so no difference there There's generally an entire phase of prototyping where engineers will be using production boards but still need JTAG, which is why it's fused and why these kinds of features exist. It's a lot easier to have your lower-level software team (drivers/BSP, perf, etc.) sitting with production-ready units provisioned with engineering keys and debug enabled than to have them having to use some kind of case-off JTAG header setup, cost aside.
Hizonner 1y ago
> this article indicates JTAG over USB is disabled in production systems anyways Well, should be. I bet there've been screwups now and then...
- baybal2 1y ago
  [dead]
AlotOfReading 1y ago
The probes cost enough to exceed individual purchasing limits at hardware companies, which means you need to go through the requisition process. That takes long enough that you have to plan ahead and you don't order more as your needs increase. Then everyone's fighting for the limited probes right before a ship date and they get jealously guarded like priceless jewels. JTAG also isn't usually exposed through enclosures, so using the probe on a field unit might require destructive entry depending on the application.

userbinator 1y ago

MediaTek still has the old-style approach in many of their devices, requiring some incantations which expose serial over USB, but not in the way you think -- it's serial over USB pins! Wasn't that only in their old feature-phone (MT62xx) SoCs? All the smartphone ones AFAIK (at least since the MT657x days) use USB CDC in their BootROM and preloader.

rangestransform 1y ago

You bring me back to the olden days of QXDM in my adolescence, when I used it to save myself from bricking my phone, and again when I had my first internship working on an MDM9x50 device

mrheosuper 1y ago

at work we adapted to "usb c debug accessory mode", which should be a standard everyone should follow.

immibis 1y ago

You say "undersecured", I say "allows people to own the things they bought".

jon-wood 1y ago
Sadly these two things can be true at the same time. As a hacker I love devices which (maybe accidentally) expose a way for me to run arbitrary software on them. At the same time as a person carrying a computer in my pocket containing my entire life I'm not a fan if that allows anyone grabbing said computer to run arbitrary software on it. The ideal here is the standard approach where a user has to explicitly take some sort of action which can't be found accidentally and done without understanding the implications to activate debug mode. On Android that's tapping a specific item in the about menu way more times than you might think would be necessary. On iOS it's hooking up to a computer, then authorising the connection on the phone. Either way you get both the ability to run arbitrary(ish) software without someone picking up your device when left on a train being able to do so.
mystified5016 1y ago
Also there's "allow anything on the other side of this public 'charging port' own the things you bought"