Jump to content

Volla Phone 22 (volla-mimameid)/Hacking

From postmarketOS Wiki

Hacking on the Volla Phone 22

mtkclient infodump

Preloader - 	CPU:			MT6768/MT6769(Helio P65/G85 k68v1)
Preloader - 	HW version:		0x0
Preloader - 	WDT:			0x10007000
Preloader - 	Uart:			0x11002000
Preloader - 	Brom payload addr:	0x100a00
Preloader - 	DA payload addr:	0x201000
Preloader - 	CQ_DMA addr:		0x10212000
Preloader - 	Var1:			0x25
Preloader - Disabling Watchdog...
Preloader - HW code:			0x707
Preloader - Target config:		0x0
Preloader - 	SBC enabled:		False
Preloader - 	SLA enabled:		False
Preloader - 	DAA enabled:		False
Preloader - 	SWJTAG enabled:		False
Preloader - 	EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT:	False
Preloader - 	Root cert required:	False
Preloader - 	Mem read auth:		False
Preloader - 	Mem write auth:		False
Preloader - 	Cmd 0xC8 blocked:	False
Preloader - Get Target info
Preloader - 	HW subcode:		0x8a00
Preloader - 	HW Ver:			0xca00
Preloader - 	SW Ver:			0x0
DA_handler - Device is unprotected.

Disassembling the device

Remove the back casing which simply snaps off starting from the bottom right corner (device face up). Then remove the battery, disconnect the fingerprint sensor connector, remove the 7 screws holding down the top plastic casing and pull it up from the sides (even fingernails work ok) to release it from the small plastic clips.

Plastic top casing covering the Volla Phone 22 motherboard UART TX and GND pads

Motherboard UART pins

There are a few candidates for GND, but here's what I ended up using successfully:
UART TX and GND pads on the Volla Phone 22 motherboard

Note NOTE: To avoid disconnecting e.g. the side buttons from the motherboard underside (spring connector) please screw back the middle screws in both top and left sides to keep the board in place after removing the top plastic casing!

UART logs before kernel boots

# picocom /dev/ttyUSB0 -b 921600 -l

Minimal mainline DTBO

The lk bootloader (as seen on Android 11) on MT6769Z appears to force a requirement on at least a gpio_init_default overlay node among others to exist on devices that have a dtbo partition, so in this case of Volla Phone 22 the following is enough to boot:

$ cat minimal-dtbo.dts

Note NOTE: On your mainline kernel DTS side you'll need the following for the bootloader to successfully merge (flatten) the DTBO over kernel DTB:
/ {
	/* The following are required by stock lk bootloader to merge with minimal DTBO */
	dtbo-dummy {
		dtbo-dummy;
	};
	__symbols__ {
		gpio = "/dtbo-dummy";
		pio = "/dtbo-dummy";
		lcm_power_gpio = "/dtbo-dummy";
		mtkfb = "/dtbo-dummy";
		keypad = "/dtbo-dummy";
	};
};

Building the DTB itself is already integrated in mtk-mainline/mt6768/linux.

To use the minimal DTBO simply setup dtc and mkdtboimg and run the following:

dtc minimal-dtbo.dts -qo minimal-dtbo.dtb
mkdtboimg create minimal-dtbo.img minimal-dtbo.dtb

I suggest you take a backup of the stock dtbo partitions using mtkclient for example just in case they'll come in handy:

mtk r dtbo_a stock-dtbo_a.img
mtk r dtbo_b stock-dtbo_b.img

Then you can write this to the device using either fastboot flash dtbo minimal-dtbo.img or e.g. mtk w dtbo_a minimal-dtbo.img.