USB D+ check in Qualcomm SBL1: the EDL entry point

The USB D+ check event in a Qualcomm SBL1 boot log (typically around t=800ms, near the end of SBL1's lifecycle) marks the point where the boot chain can pivot into EDL: Qualcomm's Emergency Download Mode.

If SBL1 detects a USB host on the D+ line at this exact moment, it hands control to the EDL loader instead of proceeding to APPSBL. In EDL mode the device presents itself to the host as USB VID/PID 05c6:9008 (Qualcomm HS-USB QDLoader) and accepts a Sahara / Firehose protocol dialog for reflashing every partition: including boot-critical images like APPSBL, QSEE, and RPM.

Vendor intent: EDL is the last-resort recovery path. A device with a corrupted boot chain still boots to the point where it can be reflashed over USB.

Adversarial reality: the same authentication model (Firehose programmers signed by an OEM key) has been the entry point for essentially every Qualcomm-jailbreak toolkit on the market: including the phone-repair-shop economy that unlocks bootloaders on retail Snapdragon devices. If a Firehose programmer signed with a leaked OEM key exists for your specific silicon, EDL is the door someone walks through with it.

What to check: if USB D+ check appears in your SBL1 log and boot proceeds normally, EDL is available on this device but wasn't triggered by whatever was (or wasn't) on the USB port at boot. That's normal on a shipped router where the USB port is unused. On a device where you can't afford EDL access, physically disabling the USB D+ trace (or the whole USB peripheral) is the only real mitigation: SBL1 itself always checks.