Stage 6A Baseband Provisioning
Our 32-bit C provisioner backs up modem state over /dev/diag and writes 405B qp_ims_reg_config (dynamic PCO) + 789B IPV4V6 profile4.
BLACKBERRY PASSPORT · LINEAGEOS 18.1 · MSM8974
Bring native 4G VoLTE to
Passport on Android 11.
With 2G/3G networks sunsetting, BlackBerry Passports flashed to LineageOS 18.1 keep LTE data but lose voice calls. This open-source stack bridges both layers—Stage 6A Snapdragon 801 modem EFS provisioning and a clean-room Android 11 ImsService—using the stock Dialer with working Caller ID and hands-free boot recovery.
Current release: v1.0.0-r1 (includes PassportVolteIms v2.3 + PassportVolteManager v1.0.0). Read the Setup Guide
01
No Magisk RequiredUses LineageOS Rooted Debugging over USB
02
Stock Dialer + Caller IDFixes 3GPP CLIP→OIR polarity & TOA=145
03
Compare vs Reference Project
Pre-Backup & Full RollbackRestores all 54 modem EFS items on demand
01 / HOW IT WORKSWhy flipping a single NV byte is not enough on Snapdragon 801 + Android 11.
Modem EFS + Android 11 IMS,
built end to end.
Qualcomm ended Snapdragon 801 (MSM8974) support at Android 6.0. Making VoLTE work on LineageOS 18.1 requires solving both the Hexagon baseband config and the missing Android 11 framework bridge.
PassportVolteIms Bridge
Runs in UID 1001 with zero <uses-permission> declarations, applies persistent CarrierConfig, and drives MO/MT call sessions.
Stock Dialer 4G HD Voice
No VoIP apps or background daemons. Survives USB unplugging and normal reboots while staying on 4G LTE during active calls.
Locked to wolverine + CRC-16
Verifies ro.product.device=wolverine, SELinux=Enforcing, and SIM readiness before running; every DIAG EFS packet checks CCITT CRC-16.
Protects 120 Phone Permissions
Declaring extra permissions in a runtime-installed android.uid.phone APK breaks telephony on Android 11; bytecode gates enforce zero manifest permissions.
Provision Once, Unplug USB
Uses 3-argument persistent overrideConfig(..., true) and boot broadcasts so VoLTE comes up automatically on every reboot without a PC.
02 / FOUR USAGE METHODSPick the workflow that matches your setup—desktop USB, Magisk on-device, CLI, or ROM build.
Four ways to deploy,
one verified stack.
Most users should pick Method 1 (Windows EXE)—no Magisk installation or boot.img patching required.
METHOD 01 · WINDOWS X64Recommended · No Magisk
Standalone Windows Desktop Activator
passport-android11-volte-1.0.0-r1-windows-x64.exe
Single-file GUI bundling Python/Tk, official adb.exe, and all signed phone payloads—zero external tools required.
- Simply enable USB debugging + Rooted debugging in LineageOS Developer Options
- Saves pre-deployment EFS snapshots to
%LOCALAPPDATA%\passport-android11-volte\backups\ - Automates backup, Stage 6A provisioning, APK install, normal reboot, and health verification
METHOD 02 · ON-DEVICE APKFor Magisk Users
Android Companion Manager App
PassportVolteManager-1.0.0-r1.apk (org.passport.voltemanager)
Standalone user-space app (signed with its own key so it never collides with UID 1001) embedding SHA-256-verified payloads.
- Inspect live IMS service &
QMI_IMSAstatus right on the phone even without root - If Magisk (
su) is installed, provision Stage 6A, upgrade the bridge APK, or roll back modem EFS directly on the device
METHOD 03 · PORTABLE CLI & GUImacOS / Linux / Power Users
Cross-Platform Portable Bundle
passport-android11-volte-1.0.0-r1-portable.zip
Zero-dependency Python 3 CLI and Tkinter GUI paired with prebuilt ARM32 binaries and signed APKs for macOS, Linux, and Windows.
python3 cli/volte_ctl.py status— Read-only live telemetrypython3 cli/volte_ctl.py deploy/upgrade-apk/rollbackpython3 cli/gui.py— Cross-platform desktop GUI
METHOD 04 · ROM & MSM8974 PORTINGROM Maintainers
LineageOS 18.1 Source Kit & Porting Guide
rom-integration/Android.bp + device-passport-volte.mk
Drop-in Soong build rules to bake PassportVolteIms into /system/priv-app/, plus architectural documentation for fellow Snapdragon 801 devices.
- Integrates cleanly into
device/blackberry/wolverine - Includes porting roadmap for OnePlus One, Xperia Z2/Z3, Galaxy S5, Mi 4, LG G3, and HTC One M8
03 / TECHNICAL COMPARISONCode-level & live-hardware audit vs ikimi615/qualcomm-volte-enabler.
How this differs from
qualcomm-volte-enabler.
ikimi615/qualcomm-volte-enabler inspired our initial /dev/diag exploration on BlackBerry KEY2 (SDM660 Android 8.1), but bridging MSM8974 on Android 11 required solving five fundamental gaps.
| Dimension | qualcomm-volte-enabler (KEY2 Reference) | passport-android11-volte (This Project) |
|---|---|---|
| SoC, ABI & OS | Snapdragon 660 (arm64-v8a), stock Android 8.1 already ships Qualcomm’s modern ims.apk stack. |
Snapdragon 801 (MSM8974, 32-bit armeabi-v7a), LineageOS 18.1 (Android 11) has zero ImsService. |
/dev/diag Contract |
Ships prebuilt 64-bit efs_Write binary; pointer-style ioctl returns EINVAL (-22) on MSM8974 kernel, and MEMORY_DEVICE_MODE blocks EFS ops. |
Open-source 32-bit C pp_regconfig_provision_v6 (549 unit assertions) using scalar ioctl, sequence16+errno32 headers, and CCITT CRC-16. |
| Baseband EFS Scope | Writes 1 byte (IMS_enable=01). Live-tested on Passport (1.61/1.62/1.81): still fails with CAUSE_CODE 54 READ_FAILED & NOT_REGISTERED. |
Decompressed 11.7MB Q6ZIP Hexagon firmware to build Stage 6A: 54 coordinated EFS/DS items (405B qp_ims_reg_config + 789B IPV4V6 profile4 + standalone DCM). |
| Android Stack & Caller ID | Zero Android app code (README mentions of qcril.db and boot scripts are unimplemented in its 4 shell scripts). |
Full PassportVolteIms.apk v2.3 (rild_ims0 protobuf engine, persistent CarrierConfig, 3GPP CLIP→OIR + TOA=145 Caller ID fix). |
| Root & Rollback Safety | Requires Magisk; auto_enable_volte.sh performs no backup, writes even after read failure, and has no rollback tool. |
No Magisk required (works over LineageOS Rooted Debugging + optional Magisk app), mandatory pre-backup, and verified --rollback-all. |
Full source-by-source audit and live device evidence are published in the repository.
Read Full Comparison Document
04 / COMPATIBILITY & LEGACY 4G PHONESVerified Passport scope, SIM swapping, and fellow 2014–2015 Snapdragon 801 flagships.
Supported hardware, SIMs,
and fellow 4G classics.
Live-verified hardware and experimental community scope are documented transparently.
SQW100Live Verified
BlackBerry Passport (Android 11)
Built for BlackBerry Passport (SQW100-1 / SQW100-3 / SQW100-4, codename wolverine) running LineageOS 18.1-UNOFFICIAL-wseries (API 30).
- Live-Verified Carrier
- China Unicom 460-01 (MO/MT calls, two-way audio, Caller ID, LTE retention, reboot & USB-unplug survival)
- Other VoLTE Carriers
- Stage 6A uses standard
imsAPN and dynamic PCO (mode=0, no hardcoded P-CSCF IP); China Mobile, China Telecom, and global VoLTE SIMs are open for testing
MSM8974Porting Reference
2014–2015 Snapdragon 801 Flagships
OnePlus One (bacon), Sony Xperia Z2/Z3, Samsung Galaxy S5 (klte), Xiaomi Mi 4 / Note (cancro), LG G3, and HTC One M8 face the exact same Android 11 IMS gap.
- Directly Reusable
- Scalar
/dev/diagEFS codec, Q6ZIP baseband analysis workflow, Android 11ImsServiceengine, andCLIP→OIRCaller ID state machine - Requires Device Adaptation
- Adjusting device guard, modem PDP profile slot index, and vendor RIL IMS socket framing
BB10 OSSister Project
Stock BlackBerry 10 OS Users
Still running stock BlackBerry 10 OS 10.3.3.3216 (QNX microkernel) on your Passport, Classic (Q20), Q10, or Porsche Design P’9983?
- Project
- BB10 VoLTE (Desktop bootstrap + native on-device BAR app)
05 / DOWNLOADDirect Cloudflare R2 edge downloads + GitHub Releases mirror with identical SHA-256 checksums.
Pick your package,
verify its checksum, and start.
Current Release
v1.0.0-r1 · Open Source
METHOD 01 · RECOMMENDED
Windows Desktop
Windows 10 / 11 · x64No Magisk · Bundled Python/ADB
Double-click to launch. Connect your Passport with USB Debugging + Rooted Debugging enabled to inspect status, back up EFS, activate VoLTE, or restore factory modem state.
Unsigned independent open-source binary; verify the SHA-256 hash before running if Windows SmartScreen prompts.METHOD 02 · ON-DEVICE COMPANION
Android Companion
PassportVolteManager.apkAndroid 11 ARM32 · Magisk Optional
Install directly on your Passport: inspect IMS & QMI_IMSA status anytime without root, or activate/upgrade/rollback on-device if Magisk (su) is installed.
PassportVolteIms.apk v2.3 and pp_regconfig_provision_v6.
macOS / Linux / ROM Maintainers: Portable CLI/GUI bundle, platform-signed bridge APK, and clean open-source archive.
Served directly via Cloudflare R2 (passport-downloads.octoooo.com). Identical files and checksums are also mirrored on GitHub Releases:
GitHub Windows EXE · GitHub Companion APK · GitHub Portable ZIP · GitHub Bridge APK · GitHub SHA-256
06 / OPEN SOURCE100% auditable source code—zero closed-source phone binaries.
Keeping classic hardware alive?
Star the project on GitHub.
Every line of C, Java, and Python—from Q6ZIP baseband findings to the Android 11 ImsService—is published under Apache-2.0. Carrier test reports and Snapdragon 801 ports are welcome.
Apache-2.0 License
699+ Automated Host C/Java Assertions
100% Offline, Zero Telemetry, PII-Redacted Logs
Browse Source Code
07 / FAQKey questions before you begin.
Common questions
& safety boundaries.
Follow the complete step-by-step guide for Rooted Debugging setup, activation, SIM swaps, and factory rollback.
Open Complete GuideDo I need to install Magisk?
No! LineageOS 18.1 includes built-in “Rooted debugging” under Developer Options, allowing our Windows EXE or cross-platform CLI to run adb root over USB once. After activation, unplug USB and reboot freely. If you already use Magisk, you can also manage everything on-device with PassportVolteManager.apk.
Does incoming Caller ID work properly?
Yes. PassportVolteIms v2.3 translates 3GPP CLIP presentation values into Android’s ImsCallProfile.OIR_* constants, normalizes TOA=145 international numbers, and pushes callSessionUpdated so incoming numbers match Contacts cleanly.
Can I completely revert my modem EFS back to factory state?
Yes. Every deployment saves a local pre-activation snapshot first, and “Restore Factory Modem EFS & Uninstall” (or volte_ctl.py rollback) restores all 54 EFS items, runs EFS_SYNC, uninstalls the APK, and reboots cleanly.
Can I rely on this for emergency calls (911/112/110)?
No. This is an experimental community hardware-preservation project and has not undergone emergency services certification (E911 / IMS Emergency PDN). Do not rely on modified legacy devices as your sole emergency phone.