Guide to Treble/GSI on the Palm Phone

Search This thread

Truelan

Member
Aug 25, 2021
19
1
I tested many gsi rom.
and found some infomation.
Well, stock kernel Version was 3.18...
Simple. Too low for android 10, 11.
so that, I gave up using android 10, 11 rom.
and tested PIE, OREO rom with magisk patched boot img.
in oreo, Lineage 15.1(not phh porting rom) worked.
in Pie, DotOS, ArrowOS, HavocOS, AOSIP worked.
 

lmore377

Member
Jul 2, 2016
35
8
For anyone curious, these are all the partitions and the order they're flashed in according to sugar's log file

N1AML0L0CV00.mbn - NON-HLOS C1AML0L0CV00.mbn - SBL1 W1AML0L0CV00.mbn - RPM T1AML0L0CV00.mbn - TZ J1AML0L0CV00.mbn - DEVCFG V1AML0L0CV00.mbn - ADSPSO s1amgfl0cv10.mbn - STUDY Erased - fsg Erased - MODEMST1 Erased - MODEMST2 q1amgfl0cv10.mbn - SPLASH L1AML0L0CV00.mbn - EMMC_APPSBOOT B1AML0L0CV00.mbn - BOOT R1AML0L0CV00.mbn - RECOVERY Y1AML0L0CV00.mbn - SYSTEM 21amgfl0cv10.mbn - VENDOR I1AML0L0CV00.mbn - CACHE Erased - devinfo Erased - misc Erased - config A1AML0L0CV00.mbn - MDTP 31AML0L0CV00.mbn - CMNLIB_30 / Flashed twice 41AML0L0CV00.mbn - CMNLIB64_30 / Flashed twice 51AML0L0CV00.mbn - KEYMASTER64 / Flashed twice Erased - fotadata U1AML0L0CV00.mbn - USERDATA O1AML0L0CV00.mbn - GPT_MAIN0 K1AML0L0CV00.mbn - GPT_BACKUP0 Z1AML0L0CV00.mbn - PATCH0 / I don't think this is an actual partition. Not exactly sure what happens here but there's a couple of lines that say "Patch: DISK, x, x, x" (where x is a random number) after this x1a0gf00cv10.mbn - SIMLOCK

There might be some stuff I missed
 
Last edited:

Truelan

Member
Aug 25, 2021
19
1
Anybody managed to get anything newer than Pie running on their phone?
A11 works. but could not use bluetooth, auto brightness.
A10 works. but could not use auto brightness.
A9 works. but could not use auto brightness.
if you want daily driving, choose A10 or A9
in A10, crdroid mod will be a good choice.
 

tgraneberg

Member
Jan 14, 2013
8
1
A11 works. but could not use bluetooth, auto brightness.
A10 works. but could not use auto brightness.
A9 works. but could not use auto brightness.
if you want daily driving, choose A10 or A9
in A10, crdroid mod will be a good choice.
Do you have a link for some that work?
I've tried Crdroid but after the boot animation it reboots.
 

Truelan

Member
Aug 25, 2021
19
1
Do you have a link for some that work?
I've tried Crdroid but after the boot animation it reboots.
 

xerootg

Member
Dec 17, 2006
43
1
I despise phone-size creep. I bought a palm a couple years ago and didn't like the stock firmware. Not sure many people do. I started hacking on mine a year ago, loading AndyY's Lineage GSI, but I got frusterated and went back to a full sized phone after a couple days.

I'm happy to report that I've been daily driving this phone for a couple weeks on Havoc 3.12. Some lessons learned:

rawprogram0.xml and patch0.xml is included in your update. Its the files beginning with P (rawprogram0.xml) and Z (patch0.xml).
WARNING: It is super easy to wipe your radio partitions if you blindly execute this. The `zeroout` tags are syntatically erase tags, so renaming those is a thing. DO NOT WIPE modemst1, modemst2, or fsg until you have a good backup. Infact, just do your self a favor, and dump the whole phone. This is possible with emmcdl. I dumped the gpt partition and used that as a guide for what to dump before I realized that rawprogram0.xml was included by Sugar in it's updates. My VZW phone does not have an IMEI and I cannot recover it with any of the usual tools cause the MSM8940 is not exactly a popular chip and never was. I also toasted one of my other phone's IMEI's, but was able to restore it by flashing the stock system and recovery.

Bricks are recoverable. I have 3 of these phones - 1 that I bought in 2019 directly from Palm, an unlocked verizon model, and an unlocked OEM model I got on EBay. Devices 2 and 3 do not have the sim eject mechanism, but that's okay cause I have been using them to hack on.

The firehose's available have a nice feature in that it where it logs to uart when executing a program tag, eventually leading to the programmer refusing to read more bytes from the uart till the log is flushed. I patched qdl to work with emmc based erase tags and was able to write anything because qdl does implement fixes for this 'bug'.

I put the stock aboot into ghidra and spend many weeks looking at the results to determine that while fastboot is compiled into the firmware, they left the "volume up/volume down + power" trigger in place to access the boot menu, and therefore we cannot do that. The reboot reason code also does not trigger the bootloader menu. No fastboot, period. Theoretically, we could use the EDL to execute arbitrary things, such as demonstrated by alephsecurity on other 'older' msm devices.

The devinfo partition 0x10 and 0x14 bits are read but do not allow for unsigned boot images.

The vendor partition is junk. TCL does not impress me as a phone manufacturer. I modded the vendor fstab to not encrypt the userdata partition so I could hack on this thing more easily. Idk if it has an impact on battery life. '[email protected]' is missing from /vendor/lib and /vendor/lib64. I'm not sure it's supposed to be there, but there's tons of binder failures in logcat without it. Fetch it from the oem system partition. The stock audio config is in the wrong folder. It's currently in /vendor/etc/audio/audio_policy_configuration.xml, and the one sitting in /vendor/etc/ is just plain wrong. Here's my patched audio_policy_configuration.xml, with edits to support in-call audio for android 10+

XML:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- Copyright (c) 2016-2017, The Linux Foundation. All rights reserved
     Not a Contribution.
-->
<!-- Copyright (C) 2015 The Android Open Source Project

     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
     You may obtain a copy of the License at

          http://www.apache.org/licenses/LICENSE-2.0

     Unless required by applicable law or agreed to in writing, software
     distributed under the License is distributed on an "AS IS" BASIS,
     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     See the License for the specific language governing permissions and
     limitations under the License.
-->

<audioPolicyConfiguration version="1.0" xmlns:xi="http://www.w3.org/2001/XInclude">
    <!-- version section contains a “version” tag in the form “major.minor” e.g version=”1.0” -->

    <!-- Global configuration Decalaration -->
    <globalConfiguration speaker_drc_enabled="true"/>


    <!-- Modules section:
        There is one section per audio HW module present on the platform.
        Each module section will contains two mandatory tags for audio HAL “halVersion” and “name”.
        The module names are the same as in current .conf file:
                “primary”, “A2DP”, “remote_submix”, “USB”
        Each module will contain the following sections:
        “devicePorts”: a list of device descriptors for all input and output devices accessible via this
        module.
        This contains both permanently attached devices and removable devices.
        “mixPorts”: listing all output and input streams exposed by the audio HAL
        “routes”: list of possible connections between input and output devices or between stream and
        devices.
            "route": is defined by an attribute:
                -"type": <mux|mix> means all sources are mutual exclusive (mux) or can be mixed (mix)
                -"sink": the sink involved in this route
                -"sources": all the sources than can be connected to the sink via vis route
        “attachedDevices”: permanently attached devices.
        The attachedDevices section is a list of devices names. The names correspond to device names
        defined in <devicePorts> section.
        “defaultOutputDevice”: device to be used by default when no policy rule applies
    -->
    <modules>
        <!-- Primary Audio HAL -->
        <module name="primary" halVersion="2.0">
            <attachedDevices>
                <item>Earpiece</item>
                <item>Speaker</item>
                <item>Telephony Tx</item>
                <item>Built-In Mic</item>
                <item>Built-In Back Mic</item>
                <item>FM Tuner</item>
                <item>Telephony Rx</item>
            </attachedDevices>
            <defaultOutputDevice>Speaker</defaultOutputDevice>
            <mixPorts>
                <mixPort name="primary output" role="source" flags="AUDIO_OUTPUT_FLAG_FAST|AUDIO_OUTPUT_FLAG_PRIMARY">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </mixPort>
                <mixPort name="raw" role="source"
                        flags="AUDIO_OUTPUT_FLAG_FAST|AUDIO_OUTPUT_FLAG_RAW">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </mixPort>
                <mixPort name="deep_buffer" role="source"
                        flags="AUDIO_OUTPUT_FLAG_DEEP_BUFFER">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </mixPort>
                <mixPort name="direct_pcm" role="source"
                        flags="AUDIO_OUTPUT_FLAG_DIRECT">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    <profile name="" format="AUDIO_FORMAT_PCM_8_24_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    <profile name="" format="AUDIO_FORMAT_PCM_24_BIT_PACKED"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                </mixPort>
                <mixPort name="compressed_offload" role="source"
                         flags="AUDIO_OUTPUT_FLAG_DIRECT|AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD|AUDIO_OUTPUT_FLAG_NON_BLOCKING">
                    <profile name="" format="AUDIO_FORMAT_MP3"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_FLAC"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_ALAC"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    <profile name="" format="AUDIO_FORMAT_APE"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_LC"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_HE_V1"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_HE_V2"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_WMA"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    <profile name="" format="AUDIO_FORMAT_WMA_PRO"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    <profile name="" format="AUDIO_FORMAT_VORBIS"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_ADTS_LC"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_ADTS_HE_V1"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    <profile name="" format="AUDIO_FORMAT_AAC_ADTS_HE_V2"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                             channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                </mixPort>
                <mixPort name="voice_tx" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                </mixPort>
                <mixPort name="voip_rx" role="source"
                         flags="AUDIO_OUTPUT_FLAG_DIRECT|AUDIO_OUTPUT_FLAG_VOIP_RX">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                </mixPort>

                <mixPort name="primary input" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                </mixPort>
                <mixPort name="surround_sound" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK,AUDIO_CHANNEL_INDEX_MASK_3,AUDIO_CHANNEL_INDEX_MASK_4,AUDIO_CHANNEL_IN_5POINT1,AUDIO_CHANNEL_INDEX_MASK_6"/>
                </mixPort>
                <mixPort name="voice_rx" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO"/>
                </mixPort>
            </mixPorts>

            <devicePorts>
                <!-- Output devices declaration, i.e. Sink DEVICE PORT -->
                <devicePort tagName="Earpiece" type="AUDIO_DEVICE_OUT_EARPIECE" role="sink">
                   <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                            samplingRates="48000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                </devicePort>
                <devicePort tagName="Speaker" role="sink" type="AUDIO_DEVICE_OUT_SPEAKER" address="">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>
                <devicePort tagName="Wired Headset" type="AUDIO_DEVICE_OUT_WIRED_HEADSET" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>
                <devicePort tagName="Wired Headphones" type="AUDIO_DEVICE_OUT_WIRED_HEADPHONE" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>
                <devicePort tagName="Line" type="AUDIO_DEVICE_OUT_LINE" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>
                <devicePort tagName="BT SCO" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                </devicePort>
                <devicePort tagName="BT SCO Headset" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                </devicePort>
                <devicePort tagName="BT SCO Car Kit" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000"
                             channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                </devicePort>
                <devicePort tagName="Telephony Tx" type="AUDIO_DEVICE_OUT_TELEPHONY_TX" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>
                <devicePort tagName="HDMI" type="AUDIO_DEVICE_OUT_AUX_DIGITAL" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,16000,22050,32000,44100,48000,64000,88200,96000,128000,176400,192000" channelMasks="dynamic"/>
                </devicePort>
                <devicePort tagName="Proxy" type="AUDIO_DEVICE_OUT_PROXY" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,16000,22050,32000,44100,48000,64000,88200,96000,128000,176400,192000" channelMasks="dynamic"/>
                </devicePort>
                <devicePort tagName="FM" type="AUDIO_DEVICE_OUT_FM" role="sink">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                </devicePort>

                <devicePort tagName="Built-In Mic" type="AUDIO_DEVICE_IN_BUILTIN_MIC" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                </devicePort>
                <devicePort tagName="Built-In Back Mic" type="AUDIO_DEVICE_IN_BACK_MIC" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                </devicePort>
                <devicePort tagName="FM Tuner" type="AUDIO_DEVICE_IN_FM_TUNER" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO"/>
                </devicePort>
                <devicePort tagName="Wired Headset Mic" type="AUDIO_DEVICE_IN_WIRED_HEADSET" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                             channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                </devicePort>
                <devicePort tagName="BT SCO Headset Mic" type="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                </devicePort>
                <devicePort tagName="Telephony Rx" type="AUDIO_DEVICE_IN_TELEPHONY_RX" role="source">
                    <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                             samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                </devicePort>
            </devicePorts>
            <!-- route declaration, i.e. list all available sources for a given sink -->
            <routes>
                <route type="mix" sink="Earpiece"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="Speaker"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="Wired Headset"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="Wired Headphones"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="Line"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="HDMI"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload"/>
                <route type="mix" sink="Proxy"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload"/>
                <route type="mix" sink="FM"
                       sources="primary output"/>
                <route type="mix" sink="BT SCO"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="BT SCO Headset"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="BT SCO Car Kit"
                       sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                <route type="mix" sink="Telephony Tx"
                       sources="voice_tx"/>
                <route type="mix" sink="primary input"
                       sources="Wired Headset Mic,BT SCO Headset Mic,FM Tuner,Telephony Rx"/>
                <route type="mix" sink="surround_sound"
                       sources="Built-In Mic,Built-In Back Mic"/>
                <route type="mix" sink="voice_rx"
                       sources="Telephony Rx"/>
            </routes>

        </module>

        <!-- A2dp Audio HAL -->
        <xi:include href="/vendor/etc/a2dp_audio_policy_configuration.xml"/>

        <!-- Usb Audio HAL -->
        <xi:include href="/vendor/etc/usb_audio_policy_configuration.xml"/>

        <!-- Remote Submix Audio HAL -->
        <xi:include href="/vendor/etc/r_submix_audio_policy_configuration.xml"/>

    </modules>
    <!-- End of Modules section -->

    <!-- Volume section -->

    <xi:include href="/vendor/etc/audio_policy_volumes.xml"/>
    <xi:include href="/vendor/etc/default_volume_tables.xml"/>

    <!-- End of Volume section -->

</audioPolicyConfiguration>

Also on the topic of broken stuff - BT crashes periodically. This same crash occasionally results in infinite boot screen. This is likely due to a missing permission for the com.android.bluetooth package for pbap. I added mine manually (via pm) and my battery life is _waaay_ better, probably cause the stack isn't constantly starting and crashing.

I am using some kernel tweaks, via the KTweak (tytydraco) magisk package, and I am running magisk 25.2. I had issues getting a valid magisk'd kernel with 25.2, so once I got a working version, I dumped it and that's what I flash now instead of a vanilla one. I think the winning combo was magisk 23, followed by dm-verity disable (the old zip) followed by magisk 25.2, all from TWRP. I could upload it if anyone cares.

I never got a working TWRP build, so if someone could shed light on how they managed to build TWRP, I'd love to mod it a bit to be more friendly to this platform, like enabling userdata decryption, modem flashing the safe way, etc.

I attempted to implement lk2nd so I could stop using firehose. Yeah, signature validation of /boot prevents us from doing this. Yay.

I attempted to flash the euro aboot with 0x10 = 01 and 0x14 in devinfo, leading me to get stuck in 900e mode. Presumably aboot must also be signed. I was able to coerce the phone into 9008 mode to re-flash aboot by shorting the top-most(top to bottom) center (left to right), small test point to the phone chassis. It's in the triangular cluster of test points. I can't be bothered to upload a picture, sorry. With the battery disconnected, usb unplugged, ground it out and and then plug the phone in. Give it a second, and then you can unshort it (I used a dupont wire, and just pretended I had more than 2 hands) and plug the battery back in.

I'll probably keep hacking away on this platform, I love it as my phone.

I dumped the PBL, but I have not spent very much time with it in ghidra to see what we can do with it.

Auto backlight is all that's missing, and I'm working on that.

I'll probably make my own vendor and if I can get it to compile, GSI, and upload it here for those of you who still care about this ancient, gutless, yet amazing platform. I'd like to run a newer android, but A-Only stuff is dead, and would probably require a kernel. I have enough sources to compile a kernel, but I can't test it since I can't boot unsigned stuff.

I'm not tech support, but I will keep publishing my results.
 
  • Like
Reactions: a.vandelay

codemaster256

Member
Apr 26, 2018
9
0
I modded the vendor fstab to not encrypt the userdata partition
I beg you, please help me get rid of encryption. I also modified this file, replacing forсencrypt=footer with enсryptable=footer, then I formatted the /data partition in TWRP and hoped that after that the system would not encrypt the user data partition. But unfortunately, after loading the phone and then rebooting into TWRP, I do not see the contents of the /data section.
I think the winning combo was magisk 23, followed by dm-verity disable (the old zip) followed by magisk 25.2, all from TWRP. I could upload it if anyone cares.
please share these files. I really want to disable dm-verity.



Thank you for the most interesting story about the research of this phone. I use it with pleasure, since this phone is very convenient to carry in a case that is attached to the arm (a place from the shoulder to the elbow). I would like a bigger battery, but by turning off everything unnecessary and reducing the performance of the processor and video card, you can achieve an increase in battery life)
 

xerootg

Member
Dec 17, 2006
43
1
I beg you, please help me get rid of encryption. I also modified this file, replacing forсencrypt=footer with enсryptable=footer, then I formatted the /data partition in TWRP and hoped that after that the system would not encrypt the user data partition. But unfortunately, after loading the phone and then rebooting into TWRP, I do not see the contents of the /data section.

please share these files. I really want to disable dm-verity.



Thank you for the most interesting story about the research of this phone. I use it with pleasure, since this phone is very convenient to carry in a case that is attached to the arm (a place from the shoulder to the elbow). I would like a bigger battery, but by turning off everything unnecessary and reducing the performance of the processor and video card, you can achieve an increase in battery life)
Are you mounting vendor in twrp? What is the full file path your editing? I change forceencrypt=footer to encryptable, not encryptable=footer. It results in a kernel message at boot about no such tag, so I suspect outright deleting the entire value would work. I've done quite a bit of massaging of the vendor partition on my desktop, its very much a thing to mount a vanilla vendor image on your machine, modify it, and then flash it with something like emmcdl or the patched version of qdl that I have on GitHub. https://github.com/xerootg/qdl (the pepito branch, I filed a PR against the original repo w/ no response from the owner)

kernel is here - https://drive.google.com/drive/folders/1pgZVMFX9Azzaknl9K22l7ekih9FKVjeZ

Flashing the kernel - do it from recovery:

adb push file.name.here /sdcard
adb shell dd if=/sdcard/file.name.here of=/dev/block/bootdevice/by-name/boot

or do it via qdl/emmcdl w/ this xml, but understand that it's on you to ensure that your GPT matches mine AND that you have a COMPLETE BACKUP. I have destroyed one phone with emmcdl, to the point that I cannot get the imei to register. It's a glorified 3.3" android tablet now. remember, the bootloader on this phone is jankey, see below.

<?xml version="1.0" ?>
<data>
<program SECTOR_SIZE_IN_BYTES="512" file_sector_offset="0" filename="boot.img.rooted" label="boot" num_partition_sectors="131072" physical_partition_number="0" start_sector="790528"/>
</data>

in other news:

I'm very green at the android build mess, but I'd like to get a device root together. This phone deserves so much more than the stock rom. I really really don't think that the stock bootloader is unlockable, atleast for the pvg100 sku, so we are stuck with the 3.18 kernel, and therefore android 10 max. I'm saying, temper your expectations, no matter what we achieve with the vendor partition and GSI images.

I've tried every single thing I can with the devinfo, misc, and config partitions to unlock the bootloader or attempt to modify the boot process. All of the usual tricks, with their addresses validated in the decompiled aboot dump, do not seem to circumvent kernel signature validation. It really seems like the aboot code was modified in such a way that it was compiled with fastboot and unlockability codepaths in the binary, but not reachable. Decompiled code is incredibly hard to follow, so its not like I can understand everything going on without the original code or another set of eyes on the decompiled mess. I've been using a build of lk2nd with a device tree I extracted from the stock kernel, and the phone reboots before the palm phone comes up, telling me that it fails to validate the boot image and reboots.

We can't replace aboot because the pbl validates aboot's signature. Aboot is what validates the kernel image, and it is not unlockable. this means the pbl needs to be breached (I'm not sure that's happened, I don't have the skills either), or we do tethered boot. There's some very interesting stuff for a xiaomi phone where the edl is used to patch aboot, which is then re-executed to enable kernel signature validation to be bypassed, but means that the entire boot process is only possible with a desktop to execute the whole mess. Not my idea of a small, convenient phone.

so, keep your eye out for a GitHub repo to hack on, I'll post it here.
 
Last edited:

braxtron

Member
Jun 1, 2010
7
1
Every time I install lineage os I get a boot loop with the message:

"Your device has loaded a different operating system"

I'm pretty sure the flash via sugar is working correctly because TWRP *is* installed and I can boot to it by holding the power button long enough. I've tried:

lineage-17.1-20210808-UNOFFICIAL-treble_arm64_avS
lineage-17.1-20210714-UNOFFICIAL-treble_arm64_avS
lineage-17.1-20200808-UNOFFICIAL-treble_arm64_avN
lineage-17.1-20200511-UNOFFICIAL-treble_arm64_avN

with a magisk patched boot image flashed from TWRP.

When I go to reboot or power off in TWRP it says "No OS Installed!" But I can't understand why...Is it just my boot.img that's messed up? If I let sugar run with the backup I took the first time I ran it, it boots the stock OS just fine.

In sugar I'm using "PVG100" as the device but I also noticed there is a PVG100E. I believe this is the Verizon no sim pop-out version.

Any help is appreciated!


EDIT: So it looks like the problem is most likely my patched boot image I'm flashing via TWRP. I've tried the automated Disable_Dm-Verity_ForceEncrypt_11.02.2020 script, as well as manually magisk patched boot images using different combinations of the 3 options, in parentheses are what I think the correct option is:

Prserve AVB 2.0/dm-verity (False)
Preserve force encryption (False)
Patch vbmet in boot image (True)


So the first post says the automated Disable_Dm-Verity_ForceEncrypt_11.02.2020 script has problems with AOSP 10, so I installed AOSP 9 and then ran that script and it results in a quick boot loop, about 1-2 seconds between reboots. I can still successfully flash stock OS and boot, I'm about losing my mind lol.


I tried magisk patching the boot image on a PVG100 and a Pixel 3, both result in same bootloop/No OS Installed message in TWRP
 
Last edited:

Gestalt73

Senior Member
Feb 3, 2007
50
18
Orange County, CA
Wow, so exciting to see anyone working on palm / pepito stuff...

Ok, here's my recipe:
  • snoopy's "twrp-3.3.1-pepito-nofirmwaremount.img"
  • andyyan's "lineage-17.1-20200808-UNOFFICIAL-treble_arm64_avN.img"
  • (TWRP > Wipe > Advanced > System > Resize then System > Repair)
  • "Disable_Dm-Verity_ForceEncrypt_03.04.2020.zip"
  • "open_gapps-arm64-10.0-nano-20220215.zip"
The gapps was a bit of a pain. If you try to install the zip as-is you'll get an error about an incorrect android version (10.0 vs 8.0). Editing install.sh in the zip to disable both version checks allows you to complete the install just fine. My guess is that earlier versions didn't do a version check, but later versions do and it trips up the install.

What's been working for you? I'd also be interested in your Android 10 and 11? recipes.

Alan
 
Last edited:

Gestalt73

Senior Member
Feb 3, 2007
50
18
Orange County, CA
Ok, here's my new favorite recipe:
The gapps was a bit of a pain. If you try to install the zip as-is you'll get an error about an incorrect android version (10.0 vs 8.0). Editing install.sh in the zip to disable both version checks allows you to complete the install just fine. My guess is that earlier versions didn't do a version check, but later versions do and it trips up the install.

What's been working for you? I'd also be interested in your Android 10 and 11? recipes.

Alan

Screenshot_20221004-203004_indistractable.png
Screenshot_20221004-203143_Settings.png


Screenshot_20221004-203101_indistractable.png
Screenshot_20221004-203419_indistractable.png
 
Last edited:
  • Like
Reactions: xerootg

xerootg

Member
Dec 17, 2006
43
1
I've got CAOS11 running, AND STABLE. I'm working on actually building a less-handrolled system partition, with the October patches (9033583/android-security-11.0.0_r60). I've been running r48 as my daily rom for two weeks on Friday, so there is still life to be had for us out of these phones. Still gonna be my patched magisk kernel and hand build vendor though... This phone rocks. Just to think I had almost given up after spending a couple weeks in ghidra to find the bootloader impossible to truly unlock.

EDIT: My current recipe is a super stripped-down vendor with my patches from above, the March release of CAOS11, and the magisk kernel I have on my google drive. The way I built that was with the magisk 23 zip from phh, followed by disable-dmverity, followed by magisk 25.2 as a zip, and only then reboot. The older disable-dmverity that works required a much older version of magisk to work, but I wanted a newer magisk. I extracted it after I got a good boot cause it was very finicky to get it to work.
 
Last edited:

xerootg

Member
Dec 17, 2006
43
1
In sugar I'm using "PVG100" as the device but I also noticed there is a PVG100E. I believe this is the Verizon no sim pop-out version.
The 'E' is the European variant. Different alot of things. Different keys (which are burned into ROM for all intents and purposes) for signing the kernel and bootloaders. The NON-HLOS partition is apparently worthwhile for some extra bands, but I've been focused on a modern version of android. Maybe once I have a stable, patched build of android 11 I'll look at the E variant's NON-HLOS.
 

braxtron

Member
Jun 1, 2010
7
1
The 'E' is the European variant. Different alot of things. Different keys (which are burned into ROM for all intents and purposes) for signing the kernel and bootloaders. The NON-HLOS partition is apparently worthwhile for some extra bands, but I've been focused on a modern version of android. Maybe once I have a stable, patched build of android 11 I'll look at the E variant's NON-HLOS.
Sounds interesting. I Mine is VZW version as I'm on VZW.
 

xerootg

Member
Dec 17, 2006
43
1
Is this the step I skipped that caused the entire thing to fail and report "No OS installed?" I'd kiss you on the mouth after wasting so many hours. That hasn't been a clear step from all the research I've done lol.
I'd add one more, I've had bad luck with any of the system partition provided mkfs.e2fs's. I make sure I am using the one from the recovery partition. Same with resize2fs. That might be why you get strangness when the rom resizes itself?
 

braxtron

Member
Jun 1, 2010
7
1
I'd add one more, I've had bad luck with any of the system partition provided mkfs.e2fs's. I make sure I am using the one from the recovery partition. Same with resize2fs. That might be why you get strangness when the rom resizes itself?
I'm not sure what you mean by all that. I've only used the snoopy recovery and my own magisk patched boot file. I've never done any resizing, which it sounds like was my main problem. But I have not manually used, nor do I know the difference between, mkfs.e2fs or resize2fs, or what they do/are.
 
  • Like
Reactions: xerootg

xerootg

Member
Dec 17, 2006
43
1
Sounds interesting. I Mine is VZW version as I'm on VZW.
Essentially, the vzw and non-vzw builds seem to differ in build.prop values only. the non-vzw vendor includes vzw specific apks. I'd say pick a kernel/vendor that is stable for your purposes and run with it. I think someone earlier in this thread had a very specific, 1 series kernel they liked for power consumption, but I use the latest 3 series builds cause it's one less thing to tweak with cause it just works.
I'm not sure what you mean by all that. I've only used the snoopy recovery and my own magisk patched boot file. I've never done any resizing, which it sounds like was my main problem. But I have not manually used, nor do I know the difference between, mkfs.e2fs or resize2fs, or what they do/are.

essentially, some roms, at first-boot, resize the system partition to the full size the phone reports it's got available. There's something about the snoopy provided versions of the tools that are used that works whereas the ones that are baked into some roms produce non-booting phones. I really wish I could build snoopy's recovery, cause I'd love to add to it a bit and use a newer kernel, but I have failed to build a bootable twrp build many times.
 

Top Liked Posts

  • 1
    I'd add one more, I've had bad luck with any of the system partition provided mkfs.e2fs's. I make sure I am using the one from the recovery partition. Same with resize2fs. That might be why you get strangness when the rom resizes itself?
    I'm not sure what you mean by all that. I've only used the snoopy recovery and my own magisk patched boot file. I've never done any resizing, which it sounds like was my main problem. But I have not manually used, nor do I know the difference between, mkfs.e2fs or resize2fs, or what they do/are.
  • 1
    I despise phone-size creep. I bought a palm a couple years ago and didn't like the stock firmware. Not sure many people do. I started hacking on mine a year ago, loading AndyY's Lineage GSI, but I got frusterated and went back to a full sized phone after a couple days.

    I'm happy to report that I've been daily driving this phone for a couple weeks on Havoc 3.12. Some lessons learned:

    rawprogram0.xml and patch0.xml is included in your update. Its the files beginning with P (rawprogram0.xml) and Z (patch0.xml).
    WARNING: It is super easy to wipe your radio partitions if you blindly execute this. The `zeroout` tags are syntatically erase tags, so renaming those is a thing. DO NOT WIPE modemst1, modemst2, or fsg until you have a good backup. Infact, just do your self a favor, and dump the whole phone. This is possible with emmcdl. I dumped the gpt partition and used that as a guide for what to dump before I realized that rawprogram0.xml was included by Sugar in it's updates. My VZW phone does not have an IMEI and I cannot recover it with any of the usual tools cause the MSM8940 is not exactly a popular chip and never was. I also toasted one of my other phone's IMEI's, but was able to restore it by flashing the stock system and recovery.

    Bricks are recoverable. I have 3 of these phones - 1 that I bought in 2019 directly from Palm, an unlocked verizon model, and an unlocked OEM model I got on EBay. Devices 2 and 3 do not have the sim eject mechanism, but that's okay cause I have been using them to hack on.

    The firehose's available have a nice feature in that it where it logs to uart when executing a program tag, eventually leading to the programmer refusing to read more bytes from the uart till the log is flushed. I patched qdl to work with emmc based erase tags and was able to write anything because qdl does implement fixes for this 'bug'.

    I put the stock aboot into ghidra and spend many weeks looking at the results to determine that while fastboot is compiled into the firmware, they left the "volume up/volume down + power" trigger in place to access the boot menu, and therefore we cannot do that. The reboot reason code also does not trigger the bootloader menu. No fastboot, period. Theoretically, we could use the EDL to execute arbitrary things, such as demonstrated by alephsecurity on other 'older' msm devices.

    The devinfo partition 0x10 and 0x14 bits are read but do not allow for unsigned boot images.

    The vendor partition is junk. TCL does not impress me as a phone manufacturer. I modded the vendor fstab to not encrypt the userdata partition so I could hack on this thing more easily. Idk if it has an impact on battery life. '[email protected]' is missing from /vendor/lib and /vendor/lib64. I'm not sure it's supposed to be there, but there's tons of binder failures in logcat without it. Fetch it from the oem system partition. The stock audio config is in the wrong folder. It's currently in /vendor/etc/audio/audio_policy_configuration.xml, and the one sitting in /vendor/etc/ is just plain wrong. Here's my patched audio_policy_configuration.xml, with edits to support in-call audio for android 10+

    XML:
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <!-- Copyright (c) 2016-2017, The Linux Foundation. All rights reserved
         Not a Contribution.
    -->
    <!-- Copyright (C) 2015 The Android Open Source Project
    
         Licensed under the Apache License, Version 2.0 (the "License");
         you may not use this file except in compliance with the License.
         You may obtain a copy of the License at
    
              http://www.apache.org/licenses/LICENSE-2.0
    
         Unless required by applicable law or agreed to in writing, software
         distributed under the License is distributed on an "AS IS" BASIS,
         WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
         See the License for the specific language governing permissions and
         limitations under the License.
    -->
    
    <audioPolicyConfiguration version="1.0" xmlns:xi="http://www.w3.org/2001/XInclude">
        <!-- version section contains a “version” tag in the form “major.minor” e.g version=”1.0” -->
    
        <!-- Global configuration Decalaration -->
        <globalConfiguration speaker_drc_enabled="true"/>
    
    
        <!-- Modules section:
            There is one section per audio HW module present on the platform.
            Each module section will contains two mandatory tags for audio HAL “halVersion” and “name”.
            The module names are the same as in current .conf file:
                    “primary”, “A2DP”, “remote_submix”, “USB”
            Each module will contain the following sections:
            “devicePorts”: a list of device descriptors for all input and output devices accessible via this
            module.
            This contains both permanently attached devices and removable devices.
            “mixPorts”: listing all output and input streams exposed by the audio HAL
            “routes”: list of possible connections between input and output devices or between stream and
            devices.
                "route": is defined by an attribute:
                    -"type": <mux|mix> means all sources are mutual exclusive (mux) or can be mixed (mix)
                    -"sink": the sink involved in this route
                    -"sources": all the sources than can be connected to the sink via vis route
            “attachedDevices”: permanently attached devices.
            The attachedDevices section is a list of devices names. The names correspond to device names
            defined in <devicePorts> section.
            “defaultOutputDevice”: device to be used by default when no policy rule applies
        -->
        <modules>
            <!-- Primary Audio HAL -->
            <module name="primary" halVersion="2.0">
                <attachedDevices>
                    <item>Earpiece</item>
                    <item>Speaker</item>
                    <item>Telephony Tx</item>
                    <item>Built-In Mic</item>
                    <item>Built-In Back Mic</item>
                    <item>FM Tuner</item>
                    <item>Telephony Rx</item>
                </attachedDevices>
                <defaultOutputDevice>Speaker</defaultOutputDevice>
                <mixPorts>
                    <mixPort name="primary output" role="source" flags="AUDIO_OUTPUT_FLAG_FAST|AUDIO_OUTPUT_FLAG_PRIMARY">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </mixPort>
                    <mixPort name="raw" role="source"
                            flags="AUDIO_OUTPUT_FLAG_FAST|AUDIO_OUTPUT_FLAG_RAW">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </mixPort>
                    <mixPort name="deep_buffer" role="source"
                            flags="AUDIO_OUTPUT_FLAG_DEEP_BUFFER">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </mixPort>
                    <mixPort name="direct_pcm" role="source"
                            flags="AUDIO_OUTPUT_FLAG_DIRECT">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                        <profile name="" format="AUDIO_FORMAT_PCM_8_24_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                        <profile name="" format="AUDIO_FORMAT_PCM_24_BIT_PACKED"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                    </mixPort>
                    <mixPort name="compressed_offload" role="source"
                             flags="AUDIO_OUTPUT_FLAG_DIRECT|AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD|AUDIO_OUTPUT_FLAG_NON_BLOCKING">
                        <profile name="" format="AUDIO_FORMAT_MP3"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_FLAC"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_ALAC"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                        <profile name="" format="AUDIO_FORMAT_APE"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_LC"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_HE_V1"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_HE_V2"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_WMA"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                        <profile name="" format="AUDIO_FORMAT_WMA_PRO"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_2POINT1,AUDIO_CHANNEL_OUT_QUAD,AUDIO_CHANNEL_OUT_PENTA,AUDIO_CHANNEL_OUT_5POINT1,AUDIO_CHANNEL_OUT_6POINT1,AUDIO_CHANNEL_OUT_7POINT1"/>
                        <profile name="" format="AUDIO_FORMAT_VORBIS"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000,128000,176400,192000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_ADTS_LC"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_ADTS_HE_V1"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                        <profile name="" format="AUDIO_FORMAT_AAC_ADTS_HE_V2"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000,64000,88200,96000"
                                 channelMasks="AUDIO_CHANNEL_OUT_STEREO,AUDIO_CHANNEL_OUT_MONO"/>
                    </mixPort>
                    <mixPort name="voice_tx" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                    </mixPort>
                    <mixPort name="voip_rx" role="source"
                             flags="AUDIO_OUTPUT_FLAG_DIRECT|AUDIO_OUTPUT_FLAG_VOIP_RX">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                    </mixPort>
    
                    <mixPort name="primary input" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                    </mixPort>
                    <mixPort name="surround_sound" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK,AUDIO_CHANNEL_INDEX_MASK_3,AUDIO_CHANNEL_INDEX_MASK_4,AUDIO_CHANNEL_IN_5POINT1,AUDIO_CHANNEL_INDEX_MASK_6"/>
                    </mixPort>
                    <mixPort name="voice_rx" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO"/>
                    </mixPort>
                </mixPorts>
    
                <devicePorts>
                    <!-- Output devices declaration, i.e. Sink DEVICE PORT -->
                    <devicePort tagName="Earpiece" type="AUDIO_DEVICE_OUT_EARPIECE" role="sink">
                       <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                samplingRates="48000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                    </devicePort>
                    <devicePort tagName="Speaker" role="sink" type="AUDIO_DEVICE_OUT_SPEAKER" address="">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
                    <devicePort tagName="Wired Headset" type="AUDIO_DEVICE_OUT_WIRED_HEADSET" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
                    <devicePort tagName="Wired Headphones" type="AUDIO_DEVICE_OUT_WIRED_HEADPHONE" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
                    <devicePort tagName="Line" type="AUDIO_DEVICE_OUT_LINE" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
                    <devicePort tagName="BT SCO" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                    </devicePort>
                    <devicePort tagName="BT SCO Headset" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_HEADSET" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                    </devicePort>
                    <devicePort tagName="BT SCO Car Kit" type="AUDIO_DEVICE_OUT_BLUETOOTH_SCO_CARKIT" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000"
                                 channelMasks="AUDIO_CHANNEL_OUT_MONO"/>
                    </devicePort>
                    <devicePort tagName="Telephony Tx" type="AUDIO_DEVICE_OUT_TELEPHONY_TX" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
                    <devicePort tagName="HDMI" type="AUDIO_DEVICE_OUT_AUX_DIGITAL" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,16000,22050,32000,44100,48000,64000,88200,96000,128000,176400,192000" channelMasks="dynamic"/>
                    </devicePort>
                    <devicePort tagName="Proxy" type="AUDIO_DEVICE_OUT_PROXY" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,16000,22050,32000,44100,48000,64000,88200,96000,128000,176400,192000" channelMasks="dynamic"/>
                    </devicePort>
                    <devicePort tagName="FM" type="AUDIO_DEVICE_OUT_FM" role="sink">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000" channelMasks="AUDIO_CHANNEL_OUT_MONO,AUDIO_CHANNEL_OUT_STEREO"/>
                    </devicePort>
    
                    <devicePort tagName="Built-In Mic" type="AUDIO_DEVICE_IN_BUILTIN_MIC" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                    </devicePort>
                    <devicePort tagName="Built-In Back Mic" type="AUDIO_DEVICE_IN_BACK_MIC" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                    </devicePort>
                    <devicePort tagName="FM Tuner" type="AUDIO_DEVICE_IN_FM_TUNER" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO"/>
                    </devicePort>
                    <devicePort tagName="Wired Headset Mic" type="AUDIO_DEVICE_IN_WIRED_HEADSET" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,11025,12000,16000,22050,24000,32000,44100,48000"
                                 channelMasks="AUDIO_CHANNEL_IN_MONO,AUDIO_CHANNEL_IN_STEREO,AUDIO_CHANNEL_IN_FRONT_BACK"/>
                    </devicePort>
                    <devicePort tagName="BT SCO Headset Mic" type="AUDIO_DEVICE_IN_BLUETOOTH_SCO_HEADSET" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                    </devicePort>
                    <devicePort tagName="Telephony Rx" type="AUDIO_DEVICE_IN_TELEPHONY_RX" role="source">
                        <profile name="" format="AUDIO_FORMAT_PCM_16_BIT"
                                 samplingRates="8000,16000,48000" channelMasks="AUDIO_CHANNEL_IN_MONO"/>
                    </devicePort>
                </devicePorts>
                <!-- route declaration, i.e. list all available sources for a given sink -->
                <routes>
                    <route type="mix" sink="Earpiece"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="Speaker"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="Wired Headset"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="Wired Headphones"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="Line"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="HDMI"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload"/>
                    <route type="mix" sink="Proxy"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload"/>
                    <route type="mix" sink="FM"
                           sources="primary output"/>
                    <route type="mix" sink="BT SCO"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="BT SCO Headset"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="BT SCO Car Kit"
                           sources="primary output,raw,deep_buffer,direct_pcm,compressed_offload,voip_rx"/>
                    <route type="mix" sink="Telephony Tx"
                           sources="voice_tx"/>
                    <route type="mix" sink="primary input"
                           sources="Wired Headset Mic,BT SCO Headset Mic,FM Tuner,Telephony Rx"/>
                    <route type="mix" sink="surround_sound"
                           sources="Built-In Mic,Built-In Back Mic"/>
                    <route type="mix" sink="voice_rx"
                           sources="Telephony Rx"/>
                </routes>
    
            </module>
    
            <!-- A2dp Audio HAL -->
            <xi:include href="/vendor/etc/a2dp_audio_policy_configuration.xml"/>
    
            <!-- Usb Audio HAL -->
            <xi:include href="/vendor/etc/usb_audio_policy_configuration.xml"/>
    
            <!-- Remote Submix Audio HAL -->
            <xi:include href="/vendor/etc/r_submix_audio_policy_configuration.xml"/>
    
        </modules>
        <!-- End of Modules section -->
    
        <!-- Volume section -->
    
        <xi:include href="/vendor/etc/audio_policy_volumes.xml"/>
        <xi:include href="/vendor/etc/default_volume_tables.xml"/>
    
        <!-- End of Volume section -->
    
    </audioPolicyConfiguration>

    Also on the topic of broken stuff - BT crashes periodically. This same crash occasionally results in infinite boot screen. This is likely due to a missing permission for the com.android.bluetooth package for pbap. I added mine manually (via pm) and my battery life is _waaay_ better, probably cause the stack isn't constantly starting and crashing.

    I am using some kernel tweaks, via the KTweak (tytydraco) magisk package, and I am running magisk 25.2. I had issues getting a valid magisk'd kernel with 25.2, so once I got a working version, I dumped it and that's what I flash now instead of a vanilla one. I think the winning combo was magisk 23, followed by dm-verity disable (the old zip) followed by magisk 25.2, all from TWRP. I could upload it if anyone cares.

    I never got a working TWRP build, so if someone could shed light on how they managed to build TWRP, I'd love to mod it a bit to be more friendly to this platform, like enabling userdata decryption, modem flashing the safe way, etc.

    I attempted to implement lk2nd so I could stop using firehose. Yeah, signature validation of /boot prevents us from doing this. Yay.

    I attempted to flash the euro aboot with 0x10 = 01 and 0x14 in devinfo, leading me to get stuck in 900e mode. Presumably aboot must also be signed. I was able to coerce the phone into 9008 mode to re-flash aboot by shorting the top-most(top to bottom) center (left to right), small test point to the phone chassis. It's in the triangular cluster of test points. I can't be bothered to upload a picture, sorry. With the battery disconnected, usb unplugged, ground it out and and then plug the phone in. Give it a second, and then you can unshort it (I used a dupont wire, and just pretended I had more than 2 hands) and plug the battery back in.

    I'll probably keep hacking away on this platform, I love it as my phone.

    I dumped the PBL, but I have not spent very much time with it in ghidra to see what we can do with it.

    Auto backlight is all that's missing, and I'm working on that.

    I'll probably make my own vendor and if I can get it to compile, GSI, and upload it here for those of you who still care about this ancient, gutless, yet amazing platform. I'd like to run a newer android, but A-Only stuff is dead, and would probably require a kernel. I have enough sources to compile a kernel, but I can't test it since I can't boot unsigned stuff.

    I'm not tech support, but I will keep publishing my results.
    1
    Ok, here's my new favorite recipe:
    The gapps was a bit of a pain. If you try to install the zip as-is you'll get an error about an incorrect android version (10.0 vs 8.0). Editing install.sh in the zip to disable both version checks allows you to complete the install just fine. My guess is that earlier versions didn't do a version check, but later versions do and it trips up the install.

    What's been working for you? I'd also be interested in your Android 10 and 11? recipes.

    Alan

    Screenshot_20221004-203004_indistractable.png
    Screenshot_20221004-203143_Settings.png


    Screenshot_20221004-203101_indistractable.png
    Screenshot_20221004-203419_indistractable.png
    1
    I'd add one more, I've had bad luck with any of the system partition provided mkfs.e2fs's. I make sure I am using the one from the recovery partition. Same with resize2fs. That might be why you get strangness when the rom resizes itself?
    I'm not sure what you mean by all that. I've only used the snoopy recovery and my own magisk patched boot file. I've never done any resizing, which it sounds like was my main problem. But I have not manually used, nor do I know the difference between, mkfs.e2fs or resize2fs, or what they do/are.
  • 5
    From this thread: https://forum.xda-developers.com/pr...velopment/aosp-10-0-quack-phh-treble-t3992559, the TrebleCheck app indicates we need an arm64 "a-only" ROM. The Palm Phone is running vendor version 8.1.

    Step 1: Download Sugar. This thread: https://forum.xda-developers.com/android/general/release-root-palm-phone-t4021201, has everything you need to know about Sugar. I ran the upgrade once to download the full stock ROM (make a backup as described). Warning, this erases all of your data.

    Step 2: Follow this guide: https://forum.xda-developers.com/android/general/guide-porting-twrp-source-t3843473, to build a TWRP for the Palm Phone without source. I used the latest TWRP for the Asus Nexus 7 2013 LTE as my base. From your Palm upgrade backup, the recovery image is the one that starts with 'R', about 36MB. Rename your new TWRP image to match the stock recovery and replace it similar to the rooting guide for replacing the boot image.

    Update: snoopy20 has shared his TWRP image here: https://forum.xda-developers.com/showpost.php?p=82654073&postcount=26

    Step 3: Extract the system image you downloaded and rename and replace the stock system image. It's the largest file in your Sugar device folder.

    Step 4: Re-run the upgrade in Sugar with your replaced images in place.

    Step 5: You're probably stuck in a boot loop. Press and hold the power button until you get into recovery, which is now TWRP. First, I formatted data. Then push or otherwise copy this zip to the device: https://forum.xda-developers.com/android/software/universal-dm-verity-forceencrypt-t3817389 and install it from TWRP. The stock configuration should be fine, i.e. don't worry about re-naming the zip. Note, do NOT use adb sideload, since that seems to wreck the zip installer's ability to use its own file name to configure itself.

    Update: The Universal dm-verity zip may not always work, in particular on AOSP Android 10 images. In this case, you can use another Android device and Magisk Manager to patch the Palm boot image. Push the boot image from your Palm backup (described in Step 1) to the other Android device. It's the mbn file that starts with 'B'. I chose to rename it to boot.img for easier use. Than use Magisk Manager to patch it. Push the modified boot image back to the Palm (in TWRP) and use TWRP to Install->Image it.

    Step 6: Reboot! Wipe data and cache for good measure, and you should be set!

    All credit goes to the folks from the links above for creating the Treble system image, TWRP guide, and dm-verity script. Thanks to snoopy20 for his TWRP image.

    Things that work so far:
    * Almost everything

    Doesn't work
    * Soft key requires an app, such as Key Mapper, to use
    * Screen auto brightness is missing
    4
    I've have spent well over 48 hours flashing my PVG100 from Verizon over the past few days, but I'd just like to point out a few things that I've noticed:
    • If you get stuck in EDL, hitting "Get Version" in Sugar might be an easier/faster way of getting out over holding the button.
    • There is a somewhat hidden option in Sugar to preserve the files in the install directory so that you don't have to copy a backup back in every time you restart it. Go to Options > Options and hit tab on your keyboard until you find "Keep User Data".
    • Regardless of what I use, be it the disable_dm-verity zip or a patched magisk boot image, no matter the ROM, my data partition becomes encrypted.
    • I've installed Lineage 16 and 17, as well as Phh AOSP 9 and 10, all of them have the same issue with VZW where it says "No SIM Card", but shows Verizon as the carrier, and correctly reports the IMEI. They receive phone calls, but cannot send them, or use data.
    • If you are having problems with LineageOS 17 not having root, there is an option in ADB settings that will allow you to use `adb root` to escalate permissions, there may be a way to get root via that, or at least do some other customizations if you don't need rooted apps.
    • I had an issue with LineageOS 17 after about an hour of using it where the screen went to the startup animation. I still had ADB access, so I tried firing a reboot. It came back, and when it loaded, the screen was black. Backlight would turn on and off when hitting the power button, still could use ADB, but it would not come back regardless of how many times I rebooted.
    • Phh AOSP 10 will not reboot for me. After the first reboot, I am stuck on the startup animation.
    • Phh AOSP 8.1 seems to be the best GSI for me on VZW at the moment. After setting the preferred network to include LTE, I am able to receive phone calls, send/receive texts, and use mobile 4G data. Still cannot send phone calls.
    • There are a few resources around for fixing VoLTE such as https://github.com/KhushrajRathod/VoLTE-Fix, but after doing the setprops required by it, either nothing will happen, the phone will become stuck on the loading screen, or it will sit at the loading screen for a minute before booting itself into recovery.
    • I also tested Havoc OS and LOSQ GSI's, both booted (and rebooted, in contrast to Phh AOSP 10). Both also lack any functioning telephony with a VZW sim, other than receiving calls.

    For the moment, being that I haven't found a reliable way to be able to make phone calls on this device, I'm going to be sticking with a slimmed-down stock ROM with Magisk. I have a feeling that the telephony issues are something fairly trivial and that somebody will crack it at some point, (possibly copying IMS files or something like that from stock ROM? VoLTE support seems absent on any GSI, and running this device on Verizon is "CDMA-less") but I have spent three days working on this phone and it's about time that I put it back into service. I'll keep an eye out here for any further developments, though ;)

    If it wouldn't be too much to ask, when we're talking about success and failure here, could you guys please specify whether you have the US or Euro version of the phone, as well as your carrier? Seems like some issues are specific to some phone/carrier combinations and I feel that it would be good to be able to put together some statistics on what works and what doesn't for a given combo.

    Many thanks to all of the people in this thread who have spent their time figuring this stuff out. I've read the entire thread at least three times over now, and although the bits and pieces of information are a bit scattered across the pages, I've gotten something useful from just about everyone here.

    ---- update
    I ended up bootlooping my device while trying to slim it down, so I did a bit more looking into VoLTE support. Looks like there is an overlay in Phh-treble (and derivatives which looks to be just about every GSI at this point) that enables CAF modem software or something like that. I'm not sure whether that's what would be needed to get the VoLTE issues fixed, or whether it's even compatible, but setting "persist.sys.phh.ims.caf=true" should enable the overlay. Any time that I put that into my build.prop, the phone becomes stuck on the loading screen. Removing it allows the phone to boot again. My best guess would be that we probably need to try to make and merge a preset to Phh-treble that'll get everything working, and probably before that, figure out what has to be done to the ROM to get it to work.

    As a side note, it looks like there's some stuff in /vendor having to do with IMS. I'm not sure if /vendor is used much if any in other ROMs (and if I remember correctly, only certain GSIs pull from /vendor, some of the GSI's I've loaded don't have the Verizon crap on them). It's also possible that the stuff in /vendor is conflicting with the overlay. Overlays might also explain why I can't boot Phh AOSP 10 more than once without formatting. /vendor is located at /dev/block/mmcblk0p28, by the way, and can be accessed in recovery with `mkdir /vendor; mount /dev/block/mmcblk0p28 /vendor`.

    Also, it would be cool if we could get our own forum for the Palm Phone instead of just having a tag :p
    3
    Anytime I got stuck, from TWRP I used
    Code:
     adb reboot edl
    then I used Sugar to reflash everything all over again.
    2
    Also tested

    GPS
    Battery life (tremendous compared to stock roms even when clean - most impressive!)

    New TWRP (modem firmware safe)

    https://www.androidfilehost.com/?w=files&flid=312806
    2
    I'm also on Lineage 16 now and consider it nigh on perfect. It's the first time I can disable screen/sound wake-up on USB power which is a huge plus for me being a dynamo hub bicycle rider.

    Also on the lineage you can add a sound shortcut to the notifications bar at the top so it's easy to get to the sound at any point. Another win is USB tethering is right there in the USB options.

    On test today it only dropped 10% over 5hrs on a cycle ride, as good if not better than the 8.1 ASOP. I am _very_ happy!

    Regarding having some Verizon, the vendor package isn't touched and gets installed on first boot so there is some minor work to do. I use the European package as my base so it's minimal.

    If you mess up as explained you can get into edl mode by using twrp, advanced, terminal and type 'reboot edl'.