turns out Qualcomm dropped the sources for talking to their Embedded USB Debug (EUD) peripheral, and it works on the OnePlus 6!

This means we get JTAG access directly via the USB port, yes seriously! There is also a UART peripheral which we can hook up (so far untested).

Basically you write 1 to a magic register (usually from the Linux driver) and all of a sudden a 7-port USB hub appears on your PC (in addition to whatever USB gadget you had set up) with a single device which is the EUD control interface.

Now that the code to talk to it is public (and functional with this openocd fork https://github.com/linux-msm/openocd) you can get JTAG access to the device for easier debugging of the kernel or U-Boot!

It seems like this works "by accident" on the OnePlus 6, likely the same debug policy misconfiguration that causes the device to go to crashdump instead of just rebooting (so it's unlikely to work on say, the PocoPhone F1, but maybe worth a try!).

There seem to be protections in place so you can escalate to EL2 or EL3, when in EL2 all registers read as 0