How to find "hw_soc_version" for a QCom SOC?

[Yahoo Mike]

I have an Android device with a QComm SDM680 SOC. The QCom part# of the SOC is SM6225.

How do I find the "hw_soc_version" and "soc_version" of the SDM680/SM6225 ?

I've found some general scripts that collate this type of info, like this one. But the SDM680 is not in any of those lists.

I've searched on the rooted device, grepped the kernel logs and the kernel opensource. fastboot getvar all doesn't expose this info either.

Does anybody know how to find these values?

 

[Renate]

Oh, that's easy. You just run an EDL client, they always ask the HWID.
You don't even need to have a loader for it.
On my EDL client just:

C:\>edl /l
Found EDL 9008
Serial: 12345678
HWID: 000cc0e100000000, QC: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09

You can also attach a UART while booting.

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.4-00246-S660LZB-1
S - IMAGE_VARIANT_STRING=Sdm660LA
S - OEM_IMAGE_VERSION_STRING=cibuild
S - Boot Interface: Unknown
S - Secure Boot: Off
S - Boot Config @ 0x00786070 = 0x000001c1
S - JTAG ID @ 0x00786130 = 0x000cc0e1

Note that even though this is a SDM636 the log speaks of 660, but the "JTAG ID" is the correct HWID.

Usually the certs in xbl/abl has the HW_ID in it.
Also:

Teletex string 11 3007 0000 0000 0000 0000 0000 0000 0000 0000 0000 SOC_VERS

(I've never run into this soc_version before.)

Also, AFAIK, your friendly Firehose loader repository doesn't have a loader for this.

Edit: Oh, you're not looking for the HWID?

 

[Yahoo Mike]

Oh, that's easy. You just run an EDL client, they always ask the HWID.
You don't even need to have a loader for it.
On my EDL client just:

C:\>edl /l
Found EDL 9008
Serial: 12345678
HWID: 000cc0e100000000, QC: 000cc0e1, OEM: 0000, Model: 0000
Hash: 7be49b72f9e43372-23ccb84d6eccca4e-61ce16e3602ac200-8cb18b75babe6d09

...
Edit: Oh, you're not looking for the HWID?

Thanks for the tip. I checked the SAHARA output. It seems that this HWID consists of the MSM_ID+OEM+MODEL. For the SDM680 I got: HW_ID: 0x001b80e100000000 (MSM_ID=0x001b80e1 OEM_ID=0x0000 MODEL_ID=0x0000).

Looking at bkerler's qualcomm_config.py, it seems that the hw_soc_version and hwid are two different things. For example for the SDM660, the msmid entry is 0x08C0E1, with a comment that the soc_hw_version is different:

0x08C0E1: "SDM660",  # 0x30060000 soc_hw_version

Usually the certs in xbl/abl has the HW_ID in it.

Even though it's about the hwid, I looked into this too. It seems that around 2016, the HWID was stored in OU fields in the certificiates in the XBL file (see pages 10-11). But after 2019, it is now stored in the metadata of the MBN image (see page 9) within the XBL file. I only mention it because I thought it might prove useful for you.

Curiously, the HWID wasn't in the certs or metadata in my stock ROM's xbl.elf. Strange.

 

[Renate]

For the SDM680 I got: HW_ID: 0x001b80e100000000...

The good news for you is that it's not stamped OEM/model.
There's some chance that this is not SecureBoot.
Which means that any loader that's compatible with your SoC will work.

What does this say: fastboot getvar secure
What does this say: cat /proc/cpuinfo (Just the name line.)
You can also look in the DTB, either decoded or raw, it's at the beginning.

Then there's the other wrinkle that Qualcomm has SDM numbers, MSM numbers and code names for SoCs.
Maybe that cpuinfo will tell you a codename.

 

[Yahoo Mike]

The good news for you is that it's not stamped OEM/model.
There's some chance that this is not SecureBoot.
Which means that any loader that's compatible with your SoC will work.

What does this say: fastboot getvar secure

I think SecureBoot is on. I've had to do a test-points recovery a few times - after I tried to run with a patched (and incorrectly signed) ABL.

In fastbootd & bootloader menus, it says SecureBoot is on. And (as you suggested) fastboot utility agrees:

C:\>fastboot getvar secure
secure: yes
Finished. Total time: 0.001s

What does this say: cat /proc/cpuinfo (Just the name line.)
You can also look in the DTB, either decoded or raw, it's at the beginning.

Then there's the other wrinkle that Qualcomm has SDM numbers, MSM numbers and code names for SoCs.
Maybe that cpuinfo will tell you a codename.

The codename is khaje.

TB128FU:/ # cat /proc/cpuinfo
Processor       : AArch64 Processor rev 4 (aarch64)

...<info about 8 processors>...

Hardware        : Qualcomm Technologies, Inc KHAJE

That agrees with the run-time /sys/devices/soc0/soc_id value of 518, which is "khaje" according to the stock ROM's /vendor/bin/init.qti.display_boot.sh and /vendor/bin/init.qcom.post_boot.sh.

Curiously, at the beginning of the DTB it says it's "Bengal":

00 00 00 03 00 00 00 33 00 00 00 00 51 75 61 6C    .......3....Qual
63 6F 6D 6D 20 54 65 63 68 6E 6F 6C 6F 67 69 65    comm Technologie
73 2C 20 49 6E 63 2E 20 42 65 6E 67 61 6C 20 31    s, Inc. Bengal 1
47 62 20 44 44 52 20 48 44 2B 20 53 6F 43 00 00    Gb DDR HD+ SoC..

But at offset 0x2A62D0 it changes its name:

00 00 00 00 00 03 00 00 00 26 00 00 00 00 51 75    .........&....Qu 
61 6C 63 6F 6D 6D 20 54 65 63 68 6E 6F 6C 6F 67    alcomm Technolog
69 65 73 2C 20 49 6E 63 2E 20 4B 68 61 6A 65 20    ies, Inc. Khaje 
53 6F 43 00 00 00 00 00 00 03 00 00 00 0B 00 00    SoC.............

I can't believe how many different numbers/strings QCom has to describe a SoC: soc_id, codename, hwid, msm_id ... and the ever-elusive hw_soc_version.

Anyway, I'll load up this SoC's firehose program to bkerler's edl. I'll slip in a question about how to query the hw_soc_version. I'll post back any reply.

 

[Renate]

The codename is khaje.

Khajeh is a city in Iran: https://en.wikipedia.org/wiki/Khajeh,_Iran

Curiously, at the beginning of the DTB it says...

That's because you are probably looking at multiple DTBs.
You can simply grep/scan for "Qualcomm Technologies".
I don't know why they do that.
The abl scans through them and find the one that best matches.