The Debug Bench

Advanced11 min read

Assumes: 0.1 Anatomy of an SoC, 5.1 Platform Overview

Module Progress0/6 pages mastered

Prerequisites: All previous modules — this is the capstone. What you’ll learn: Debug bench setup, boot and debug modes, UART/JTAG/trace interfaces, software debug toolkit, board bring-up checklist, debug decision tree.

TL;DR

A debug bench is your window into every layer of the SoC. UART shows boot logs and OS consoles. JTAG/SWD gives CPU-level halt/step/inspect. USB routes ADB, fastboot, and EDL. Ethernet carries SOME/IP and gRPC for OTA. Power control enables reproducible boot testing. Knowing what each connector does — and which ones your bench actually has — determines which debug techniques are available to you. Before you chase a software bug, inventory your bench.

You flash with QFIL, shell in with ADB, and grep SOME/IP traces over Ethernet — but the physical bench is what makes any of that possible. Self-learners often inherit a board and cables without knowing why power sequencing matters or why fastboot and EDL appear on different USB ports than ADB. This page maps the hardware in front of you to the debug modes you can reach. A SoC on a board, surrounded by cables that look like a cyberpunk art installation.

Anatomy of a Qualcomm ADP Board

Qualcomm ADP (Application Development Platform) boards — sa8155p-adp, sa8295p-adp — are the reference benches most cockpit teams start with. They expose every debug interface the BSP can enable. Production carrier boards often hide or omit connectors; the ADP is deliberately generous.

flowchart TB
    subgraph power ["Power & Boot Control"]
        PWR["12V Power Connector\n(bench supply / automotive harness)"]
        SW["DIP Switches / Jumpers\n(boot mode, force EDL)"]
        TP["EDL Test Points\n(manual short to GND)"]
    end

    subgraph debug ["Debug Interfaces"]
        UART["Debug UART Header\n3.3V TTL, 115200n8"]
        JTAG["JTAG / SWD Header\n20-pin ARM standard"]
    end

    subgraph data ["Data & Display"]
        USBC["USB-C Device Port\n(EDL / fastboot / ADB)"]
        USBA["USB-A Host Ports\n(peripherals, storage)"]
        ETH["Ethernet RJ45\n(1000BASE-T)"]
        HDMI["HDMI / DisplayPort\n(display verification)"]
        SD["SD Card Slot\n(alternate boot / recovery)"]
    end

    subgraph soc ["SA8155P / SA8295P SoC"]
        PBL["PBL (ROM)"]
        XBL["XBL"]
        QHEE["QHEE Hypervisor"]
        QNX["QNX VM"]
        AAOS["AAOS VM"]
    end

    PWR --> PBL
    SW --> PBL
    TP --> PBL
    UART --> PBL
    UART --> XBL
    UART --> QNX
    UART --> AAOS
    JTAG --> PBL
    USBC --> PBL
    USBC --> XBL
    USBC --> AAOS
    USBA --> QNX
    ETH --> QNX
    ETH --> AAOS
    HDMI --> QNX
    SD --> XBL

Memorization aid: Power and boot control sit left of the chain — they decide where boot starts. Debug interfaces sit parallel to every stage — UART spans all of them. USB is stage-dependent — different protocol at PBL vs XBL vs HLOS.

ADP Variant	Typical Use	Key Difference from Phone Dev Kits
SA8155P ADP	Gen 2 cockpit bring-up	Automotive PMIC (PMM8155AU), multi-VM USB mux, no battery
SA8295P ADP	Gen 3 premium cockpit	Additional display outputs, dual Hexagon, expanded Ethernet
Carrier / OEM board	Program-specific	Connectors may be test pads only; debug policy from production BSP

Reference: Qualcomm SA8155P/SA8295P ADP Hardware User Guide (board schematics, connector pinouts). Your Tier-1 may ship a carrier-specific “bench setup” doc — treat that as authoritative over generic ADP diagrams.

Think About It

You inherit a debug bench with 3 USB cables, a UART cable, and a power supply. You have no documentation. How do you figure out what connects where?

Reveal Answer

Start with UART — connect your FTDI adapter to every unlabeled 3-pin header at 115200n8, power-cycle, and watch for a PBL banner within two seconds. For the three USB cables, plug each into the USB-C device port one at a time and run lsusb after power-on to map QDLoader 9008 (EDL), fastboot, or ADB to each physical port. Read board silkscreen labels (DEBUG, IVI, FASTBOOT) and match visible part numbers against Qualcomm ADP reference schematics — silkscreen is usually right even when the cable drawer is a mess.

Connector-to-Debug-Mode Map

This table is the cheat sheet. Print it. Tape it to your bench.

Connector	Protocol	What It Enables	Works In Which Modes	Daily Use
Debug UART header	Serial 115200 8N1 (3.3V TTL)	PBL/XBL/ABL logs, QNX slog2 console, AAOS early printk, crash dumps	All modes including EDL (limited output in EDL)	First connection every session — proves the board is alive
JTAG / SWD header	ARM JTAG or SWD	CPU halt, single-step, register/memory inspect, on-chip trace (ETM if wired)	Normal HLOS when fuse + BSP allow; blocked on fuse-closed production units	Kernel/driver bring-up, dead-boot investigation below OS
USB-C device port	USB 2.0/3.0 device	EDL (QDLoader 9008), fastboot, ADB (via hypervisor passthrough to AAOS)	EDL, fastboot, normal HLOS	QFIL flash, fastboot flash, adb shell — check port routing first
USB-A host ports	USB host	Keyboard, storage, Ethernet dongle, CAN adapters	Normal HLOS only (typically QNX-assigned)	Mount update packages, test USB peripherals on QNX side
Ethernet RJ45	1000BASE-T, TCP/IP	SOME/IP service discovery, gRPC OTA agent, ssh, tcpdump, DoIP (if enabled)	Normal HLOS only	OTA bench testing, network packet capture, inter-VM traffic
HDMI / DP	Display output	Verify display pipeline, multi-display routing, splash screens	Normal HLOS after display init	Confirm QNX cluster + AAOS IVI on correct physical outputs
SD card slot	SDIO / alternate boot	Recovery images, XBL fallback boot path (platform-dependent)	Boot selection via straps	Emergency boot when UFS is corrupt (rare on automotive; more common on dev)
DIP switches / jumpers	Boot strap GPIO	Force EDL, select boot media, disable secure boot (debug fuse boards only)	Applied before power-on	Enter EDL without test-point tweezers; document switch positions
EDL test points	Hardware strap	Manual EDL entry (short specific pad to GND during power-on)	EDL	QFIL recovery when software reboot edl is unavailable
Power connector	12V DC (automotive rail)	Controlled power delivery via bench supply	All modes	Sequenced power-on/off for reproducible boot tests

UART: The One Connector That Never Lies

If you get nothing on UART at 115200n8 after power-on, one of these is wrong:

Symptom	Likely Cause	Fix
No characters at all	Wrong cable (null modem vs straight), wrong header pinout	Use board schematic; FTDI 3.3V TTL, TX→RX crossover
Garbage characters	Baud mismatch (921600 vs 115200)	Check BSP stdout-path and early boot stage; start at 115200
Output stops after XBL	stdout-path not carried to kernel console	BSP device tree: verify chosen node and QNX/AAOS console config
Works on ADP, not carrier	Production BSP disables debug UART	Flash debug BSP variant or request OEM debug build

UART is available from the first instruction out of PBL ROM. No driver stack required. That is why every bench ritual starts here.

JTAG: Powerful, Fragile, Fuse-Gated

JTAG access depends on eFuse state and BSP debug policy (Page 5.6). Fuse-open debug boards allow the Debug Access Port (DAP). Fuse-closed production units block it permanently — no software workaround.

JTAG Capability	Requires
Halt / resume CPU	Open fuse + debug BSP
Load symbols via debugger	Running or halted guest with debug symbols
Trace (ETM)	Additional trace header + Lauterbach TRACE32 license

Power Sequencing: Why You Can’t Just Yank the Cable

Automotive SoCs use a PMIC (Power Management IC) — PMM8155AU on SA8155P ADP — to sequence dozens of voltage rails before the application processor runs. Yanking 12V mid-write corrupts UFS metadata. Random power cycles are the silent killer of “it worked yesterday” filesystem bugs.

PMIC Startup Sequence

When 12V hits the board:

1. PMIC receives power — always-on domain wakes first
2. PMIC_RESIN / PON — power-on trigger (button, bench supply enable, or ignition signal simulation)
3. Regulator rails sequence — S1–S10 switching regulators and LDOs ramp in hardware-defined order
4. Brownout detectors — each rail monitored; failure halts sequence (board appears dead)
5. PBL starts — only after core rails (CX, MX, etc.) are stable
6. UFS controller init — XBL trains DDR and mounts storage; improper prior shutdown risks incomplete flush

sequenceDiagram
    participant PS as Bench Power Supply
    participant PMIC as PMM8155AU
    participant SOC as SA8155P SoC
    participant UFS as UFS Storage

    PS->>PMIC: 12V applied (controlled ramp)
    PMIC->>PMIC: Always-on domain stable
    PS->>PMIC: PMIC_RESIN / PON trigger
    PMIC->>PMIC: S1–S10 rails sequence
    PMIC->>PMIC: LDOs enable (I/O, retention)
    PMIC->>SOC: CX / MX core rails stable
    PMIC->>SOC: PON_OK release
    SOC->>SOC: PBL (ROM) executes
    SOC->>UFS: XBL initializes UFS controller
    UFS-->>SOC: Boot images loaded
    SOC->>SOC: XBL → TZ → QHEE → ABL → HLOS

Controlled vs Uncontrolled Power Cycles

Power Cycle Type	Filesystem Risk	When to Use
Software reboot (reboot, fastboot reboot)	Low — OS flushes caches, unmounts	Normal iteration
PMIC reset (reset button, fastboot reboot-bootloader)	Low–medium — bootloader-aware	Boot mode testing
Bench supply off/on with 500ms dwell	Medium — may interrupt UFS write	Hard reset testing (document it)
Instant cable yank under load	High — UFS metadata corruption, A/B slot damage	Never during flash or OTA

Bench tip: Use a programmable bench supply (Keysight, Rigol, or automotive-grade equivalent) with sequenced enable and current monitoring. A spike to 8A during boot failure often indicates a shorted rail — cheaper than replacing an ADP.

Deep Dive

UFS flush and sudden power loss: UFS handles sudden power loss better than raw eMMC, but metadata commits are not magic. During QFIL flash or OTA slot writes, power loss mid-sector can brick the inactive slot. Bench procedure: never cut power during Firehose activity (QFIL log showing “Programming…”) or UpdateEngine “INSTALLING” state. If you must test abrupt power loss, use a dedicated soak test with known-good recovery images and both slots validated.

USB Routing on Hypervisor Boards

On multi-VM ADP boards, one physical USB-C port does not serve all guests. A USB mux/switch (controlled by boot stage firmware or QNX host policy) routes the USB PHY to different consumers:

Boot Stage	USB Role	Enumerates As	Tool
PBL / EDL	USB device	QDLoader 9008	QFIL / QPST
XBL / ABL fastboot	USB device	Android fastboot	fastboot flash, fastboot boot
HLOS QNX	USB host (default)	Host controller — peripherals	USB storage, dongles
HLOS AAOS	USB device via passthrough	ADB device	adb shell, adb logcat

sequenceDiagram
    participant PC as Host PC
    participant MUX as USB Mux / Switch
    participant PBL as PBL (ROM)
    participant XBL as XBL / ABL
    participant QNX as QNX VM (Host)
    participant AAOS as AAOS VM (Guest)

    Note over PC,AAOS: Power-on → PBL stage
    PC->>MUX: USB-C connected
    MUX->>PBL: Route to ROM USB device
    PBL-->>PC: QDLoader 9008 (EDL)

    Note over PC,AAOS: Valid boot chain → XBL fastboot (optional)
    MUX->>XBL: Route to bootloader USB
    XBL-->>PC: Fastboot device

    Note over PC,AAOS: HLOS running — hypervisor policy applies
    MUX->>QNX: Default: USB host mode
    QNX-->>QNX: USB-A ports active for peripherals

    Note over PC,AAOS: AAOS debug session
    MUX->>AAOS: Passthrough USB device to guest
    AAOS-->>PC: ADB device (Android)

Forcing USB to the Right Target

Goal	Typical Method
Enter EDL	EDL test point + power cycle, or adb reboot edl / boot strap switches
Reach fastboot	adb reboot bootloader or hold boot combo during power-on
ADB to AAOS	USB-C port documented for AAOS passthrough (often labeled on ADP silkscreen)
USB host on QNX	Default on USB-A; verify QNX usb stack and device tree dr_mode = "host"

Check your ADP silkscreen and schematic net names (USB_SW_SEL, HS_USB_MUX). Tier-1 carrier boards may label ports DEBUG, IVI, and FASTBOOT — treat labels literally.

Mental Model

Think of the debug bench like a hospital bed. UART is the heart monitor — always streaming vitals, non-invasive, works even when the patient is unconscious (EDL). JTAG is the surgeon’s tools — invasive but precise; you don’t connect them casually mid-procedure. USB is the IV line — nutrients in (flash images), samples out (ADB logs), but it must go into the correct vein (VM routing). The power supply is life support — controlled, sequenced, never just pulled. Pull life support during surgery and you create a new patient (corrupted flash).

Your debug bench is your operating room. UART = patient monitor. JTAG = MRI. USB = IV drip. Power supply = life support.

Common Gotcha

If you plug your ADB cable into the wrong USB port, adb devices shows empty and you’ll waste an hour checking udev rules. On hypervisor boards, USB-C port 1 might route to QNX host mode, port 2 to AAOS ADB passthrough, and a micro-USB or dedicated header to fastboot/EDL. The most common bench debug failure is wrong port selection, not broken software.

Bench Safety

Debug benches combine 12V automotive power, 3.3V logic, and expensive unfused silicon. Treat them accordingly.

Hazard	Prevention	Consequence If Ignored
ESD	Wrist strap to bench ground, anti-static mat	Latent gate oxide damage — random failures weeks later
JTAG hot-plug	Power off before connecting/disconnecting JTAG header	DAP damage, debugger sees “target not detected” permanently
Shorted test points	Use insulated tweezers; know pinout before touching	Short 12V to 3.3V — destroyed PMIC or SoC
Reverse polarity	Verify bench supply polarity; use keyed connectors	Instant board death
USB-C confusion	Confirm port function before connecting	Wrong-mode enumeration, accidental EDL entry

Rules that survive every program:

1. Ground yourself before touching the board.
2. Never connect or disconnect JTAG with power on.
3. Power off → wire → power on for any new cable or probe.
4. One change at a time — if you moved a jumper and a USB cable, you won’t know which fix worked.

Platform Comparison: Debug Capabilities at a Glance

Qualcomm ADP is your primary bench. Know the alternatives for context when reading cross-vendor docs or joining a multi-SoC program.

Capability	Qualcomm ADP (SA8155P/8295P)	TI Jacinto EVM (J721E/J784S4)	NXP S32G RDB (S32G2/G3)
Primary flash/recovery	QFIL via EDL (USB 9008)	UART XMODEM / OSPI / ETH boot	Lauterbach / SD / U-Boot tftp
Serial console	Debug UART 115200n8 (QUP)	MCU UART + main UART	LINFlex UART
JTAG	20-pin ARM header (fuse-gated)	14-pin TI XDS	20-pin ARM + Nexus
USB debug	EDL / fastboot / ADB (muxed)	USB gadget (platform-dependent)	Limited — often ETH-focused
Network debug	Ethernet (SOME/IP, gRPC OTA)	CPSW Ethernet	Gbit Ethernet (TSN-capable)
Multi-OS	QNX + AAOS hypervisor	Linux + RTOS (FreeRTOS/SafeRTOS)	Linux + Classic AUTOSAR
Typical debugger	Trace32, Lauterbach, QNX Momentics	CCS, Lauterbach	Lauterbach, S32DS
Power	12V automotive via PMIC seq	12V / 5V bench	12V bench

Depth note: Jacinto and S32G benches excel at MCU + MPU heterogeneous debug (TI PRU, NXP M7 cores). Qualcomm ADP excels at hypervisor multi-OS and factory flash (QFIL) workflows. Your daily cockpit stack lives in the first column.

Where You'll See This

Bench setup checklist before a debug session:

1. Power off board — supply disable, not cable yank under load.
2. Connect UART cable — start terminal at 115200 8N1, no flow control.
3. Connect USB to correct port for your target (EDL / fastboot / ADB) — verify silkscreen.
4. Connect Ethernet if OTA or SOME/IP testing — note static IP or DHCP from QNX/AAOS.
5. Power on — watch UART for PBL → XBL → ABL → kernel banner.
6. Verify tool connection — adb devices, fastboot devices, or QFIL QDLoader 9008 as expected.

If no UART output: check cable (TX/RX crossover), baud rate (115200 first), and that your BSP enables debug UART (status = "okay", stdout-path — Page 5.6). If no USB device: check port routing and boot stage (you cannot get ADB in EDL). If no Ethernet: verify link LEDs and that the VM owning the MAC is booted.

Connect the Dots

Page 5.1 (SoC blocks) names the CPU, GPU, DSP, and modem IP you’re connecting to at the bench. Page 5.6 (BSP) explains how device tree and debug BSP variants enable UART, JTAG, and USB in software. Page 8.2 (QFIL) walks the EDL + Firehose flow you’ll trigger via test point or boot strap. Page 10.2 (boot modes) catalogs which modes are reachable from each connector on this bench. Page 10.3 (debug interfaces) goes deeper on UART wiring, JTAG setup, and Trace32/Momentics configuration.

• Module 10.5 (Board Bring-Up): Before software debugging starts, the hardware bring-up checklist verifies power rails, clocks, and boot mode configuration.

What to Remember

1. Inventory your connectors first — UART for vitals, USB for flash/ADB, Ethernet for OTA/SOME/IP, JTAG for CPU-level work.
2. UART works in every boot stage — if it’s silent, fix hardware or BSP before chasing software.
3. USB port selection is VM- and stage-aware — wrong port is the #1 bench time sink.
4. Power sequencing protects UFS — controlled reboots for testing; never yank power during flash or OTA.
5. JTAG: power off to connect — fuse state and BSP variant determine whether it works at all.

Check Your Understanding

1. Which connector provides visibility during all boot stages, including EDL?

Recall

A. USB-A host portB. Debug UART header at 115200 8N1C. HDMI display outputD. Ethernet RJ45

2. Why should you never hot-plug the JTAG header?

Recall

A. JTAG cables are too expensive to replaceB. The host PC USB controller cannot enumerate JTAG adapters liveC. Hot-plugging can damage the Debug Access Port (DAP) on the SoCD. JTAG automatically triggers a factory reset on connection

3. On a hypervisor ADP board, what primarily determines which VM receives USB device mode (e.g., ADB)?

Applied

A. The SD card partition tableB. The Ethernet MAC address assigned at factoryC. The baud rate configured on the UART headerD. The USB mux/switch routing controlled by boot stage and hypervisor host policy

4. QFIL is actively programming UFS when the bench supply loses power. What is the most likely consequence?

Applied

A. Secure boot fuse state is permanently altered by the unexpected power lossB. UFS metadata or inactive A/B slot may be corrupted, possibly needing EDLC. Only the UART console ring buffer is cleared — boot continues normallyD. The board automatically reboots into Android recovery mode for repair

5. At PBL stage, USB enumerates as QDLoader 9008. After a valid boot chain, you need ADB on AAOS. What must change between these two states?

Applied

A. Boot stage advances and USB mux routes PHY from PBL to AAOS guest pathB. UART baud rate must switch from 115200 to 921600C. JTAG must be connected before ADB can enumerateD. Ethernet must be connected first to initialize the USB stack

6. A new carrier board shows no UART output despite a known-good debug BSP. Steady-state VDD_CX reads 0.82V but scopes show a 180mV dip during the first 50ms of power-on. What cross-domain diagnosis fits best?

Synthesis

Connects to: Module 0 — Power Architecture

A. Reflash boot.img — AVB is blocking early printkB. Hypervisor QHEE guest load order is reversed causing silent boot failureC. PMIC sequencing or bypass cap issue — verify rails before BSP console debugD. Wrong SOME/IP service ID prevents UART driver init

Further Reading

• Lauterbach TRACE32 — Industry-standard JTAG/trace debugger for ARM automotive SoCs; the probe and host software most cockpit teams use for CPU halt, step, and post-crash SDI analysis.
• SEGGER J-Link Debug Probes — Widely used SWD/JTAG probe family with open-toolchain support; useful as a lower-cost alternative to TRACE32 for basic DAP attach on bring-up benches.
• Keysight Oscilloscopes — Official product hub for bench oscilloscopes used to verify PMIC rail sequencing, ripple, and clock signals before trusting any boot log.
• Tektronix Logic Analyzers — Logic analyzer documentation and product overview for capturing multi-signal timing on SPMI, I2C, and boot-strap GPIO during hardware bring-up.
• FTDI USB-UART Adapters — Reference for 3.3V TTL USB-serial adapters (FT232RL class) that connect the debug UART header to your host terminal at 115200n8.
• Qualcomm Developer Network — Portal for ADP board documentation, QFIL/QPST tools, and platform-specific debug resources referenced throughout Qualcomm cockpit bring-up.
• Rigol Programmable Power Supplies — Bench power supply product line suitable for controlled 12V automotive rail simulation with current monitoring during PMIC sequencing tests.
• ARM Debug and Trace — ARM CoreSight architecture overview explaining the JTAG DAP, trace components, and debug topology behind the connectors on your ADP board.