Jump to content

Volla Phone (volla-yggdrasil)/Hacking

From postmarketOS Wiki

Hacking on the Volla Phone

mtkclient infodump

Preloader - 	CPU:			MT6763(Helio P23)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x7f
Preloader - Disabling Watchdog...
Preloader - HW code:			0x690
Preloader - Target config:		0x0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca01
Preloader - 	SW Ver:			0x1
DA_handler - Device is unprotected.

Disassembling the device

For a full video on disassembling the phone you can see this YouTube video for example with interesting parts around 0:20–4:00.

Motherboard UART pins

There are a few candidates for GND, but here's what I ended up using successfully:
UART TX and GND pads on the Volla Phone motherboard

UART logs before kernel boots

$ cat bootloader-uart.log

Minimal mainline DTBO

The lk bootloader (as seen on Android 9) on MT6763 appears to force a requirement on at least a gpio_init_default overlay node to exist on devices that have a dtbo partition, so in this case of Volla Phone the following is enough to boot:

$ cat minimal-dtbo.dts

Note NOTE: On your mainline kernel DTS side you'll need the following for the bootloader to successfully merge (flatten) the DTBO over kernel DTB:
/ {
	/* Required by bootloader to merge with minimal DTBO */
	gpio@10005000 {
		compatible = "mediatek,gpio";
		linux,phandle = <0xdead>;
		phandle = <0xdead>;
	};
	__symbols__ {
		gpio = "/gpio@10005000";
	};
};

(the phandle values don't really matter, as long as they don't conflict with other nodes)

Building the DTB itself is already integrated in mtk-mainline/mt6763/linux.

To use the minimal DTBO simply setup dtc and mkdtboimg and run the following:

dtc minimal-dtbo.dts -qo minimal-dtbo.dtb
mkdtboimg create minimal-dtbo.img minimal-dtbo.dtb

I suggest you take a backup of the stock dtbo partition using mtkclient for example just in case it'll come in handy:

mtk r dtbo stock-dtbo.img

Then you can write this to the device using either fastboot flash dtbo minimal-dtbo.img or mtk w dtbo minimal-dtbo.img.