Jump to content

Zhihe series LTE dongles (generic-zhihe): Difference between revisions

From postmarketOS Wiki
Tags: mobile edit mobile web edit
document how to switch SIM card
 
(15 intermediate revisions by 9 users not shown)
Line 4: Line 4:
| codename = generic-zhihe <!-- e.g. htc-bravo -->
| codename = generic-zhihe <!-- e.g. htc-bravo -->
| image = File:Uz801_screenshot.png
| image = File:Uz801_screenshot.png
| imagecaption = ssh with <source>neofetch</source>
| imagecaption = ssh with <syntaxhighlight lang="bash" inline>neofetch</syntaxhighlight>
| releaseyear = 2019-2023
| releaseyear = 2019-2023
| originalsoftware = Android 4.3 <!-- e.g. Android 2.1 -->
| originalsoftware = Android
| originalversion = 4.3
| chipset = Qualcomm Snapdragon 410 (MSM8916) <!-- e.g. Qualcomm Snapdragon S1 (QSD8250) - see "Chipset names" section in Help:Device Page -->
| chipset = Qualcomm Snapdragon 410 (MSM8916) <!-- e.g. Qualcomm Snapdragon S1 (QSD8250) - see "Chipset names" section in Help:Device Page -->
| cpu = 4x 1.0 GHz Cortex-A53 <!-- e.g. 1.0 GHz Scorpion -->
| cpu = 4x 1.0 GHz Cortex-A53 <!-- e.g. 1.0 GHz Scorpion -->
Line 33: Line 34:
| status_calls = <!-- Talking to other people over the cellular network. -->
| status_calls = <!-- Talking to other people over the cellular network. -->
| status = <!-- Text displayed in the "not booting" table on the Devices page , e.g "kernel compiles, doesn't boot" -->
| status = <!-- Text displayed in the "not booting" table on the Devices page , e.g "kernel compiles, doesn't boot" -->
| status_otg = Y <!-- USB-OTG adapters work, e.g. to connect an USB flash drive to the device -->
| status_otg = P <!-- USB-OTG adapters work, e.g. to connect an USB flash drive to the device -->
| status_nfc = - <!-- Near-Field Communication (NFC) works -->
| status_nfc = - <!-- Near-Field Communication (NFC) works -->
| status_usba = - <!-- Full-sized USB-A port works (Usually applicable to SBCs and laptops) -->
| status_usba = - <!-- Full-sized USB-A port works (Usually applicable to SBCs and laptops) -->
Line 56: Line 57:
| status_fossbootloader = Y <!-- Device has a free and open source bootloader -->
| status_fossbootloader = Y <!-- Device has a free and open source bootloader -->
| booting = yes <!-- The device is booting at all, can be yes/no *IMPORTANT* -->
| booting = yes <!-- The device is booting at all, can be yes/no *IMPORTANT* -->
| type=generic
| hidefeatures=no


<!-- you can also use these lines if you need to:
<!-- you can also use these lines if you need to:
Line 82: Line 85:
== How to enter flash mode ==
== How to enter flash mode ==


<source lang="shell-session">
<syntaxhighlight lang="shell-session">
$ adb reboot edl # Qualcomm EDL, or
$ adb reboot edl # Qualcomm EDL, or
$ adb reboot bootloader # fastboot.
$ adb reboot bootloader # fastboot.
</source>
</syntaxhighlight>
Note: only applies to stock Android system.
Note: only applies to stock Android system.
=== UFI-001C and many more with xinxun brand ===
=== UFI-001C and many more with xinxun brand ===
By default, we get only <source>shell</source> permission with <source>adb shell</source>. However, you don't have to install SuperSU or Magisk for temporary root access. The following instruction is much easier for temporary root access(need to redo after reboot):
By default, we get only shell permission with adb shell. However, you don't have to install SuperSU or Magisk for temporary root access. The following instruction is much easier for temporary root access:
<source lang="shell-session">
<syntaxhighlight lang="shell-session">
$ adb shell
$ adb shell
$ # Now you are in adb
$ # Now you are in adb
Line 96: Line 99:
$ adb shell
$ adb shell
$ # Now you get the root permission!
$ # Now you get the root permission!
</source>
</syntaxhighlight>


=== UZ801 V3.0 ===
=== UZ801 V3.0 ===
Line 102: Line 105:
To enable adb access and root permission, plug this device into your PC and use browser to access this URL: http://192.168.100.1/usb_debug.html, and then reboot your device(replug it). You'll find an adb device and get root permission with adb shell.<br>
To enable adb access and root permission, plug this device into your PC and use browser to access this URL: http://192.168.100.1/usb_debug.html, and then reboot your device(replug it). You'll find an adb device and get root permission with adb shell.<br>
See the section below if your device bricks.
See the section below if your device bricks.
=== UZ801 V3.2 ===
Similar to UZ801 V3.0, but the URL for enabling adb is http://192.168.100.1/usbdebug.html and no re-plugging is required.


== Debug UART pin and test pins ==
== Debug UART pin and test pins ==
Line 114: Line 120:


Note: voltage: 3.3V
Note: voltage: 3.3V
IDK is it UFI003, because label on board is "UF003..."
[[File:UF003S MB V03-gpio-top-v0.jpg|frameless|Top view]]
[[File:UF003S MB V03-gpio-bottom-v1.jpg|frameless|Bottom view]]
== Partition layout ==
<pre>
lrwxrwxrwx root    root              1970-01-01 08:28 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root    root              1970-01-01 08:28 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root    root              1970-01-01 08:28 sbl1bak -> /dev/block/mmcblk0p3
lrwxrwxrwx root    root              1970-01-01 08:28 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root    root              1970-01-01 08:28 abootbak -> /dev/block/mmcblk0p5
lrwxrwxrwx root    root              1970-01-01 08:28 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root    root              1970-01-01 08:28 rpmbak -> /dev/block/mmcblk0p7
lrwxrwxrwx root    root              1970-01-01 08:28 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root    root              1970-01-01 08:28 tzbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root    root              1970-01-01 08:28 hyp -> /dev/block/mmcblk0p10
lrwxrwxrwx root    root              1970-01-01 08:28 hypbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root    root              1970-01-01 08:28 pad -> /dev/block/mmcblk0p12
lrwxrwxrwx root    root              1970-01-01 08:28 modemst1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root    root              1970-01-01 08:28 modemst2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root    root              1970-01-01 08:28 misc -> /dev/block/mmcblk0p15
lrwxrwxrwx root    root              1970-01-01 08:28 fsc -> /dev/block/mmcblk0p16
lrwxrwxrwx root    root              1970-01-01 08:28 ssd -> /dev/block/mmcblk0p17
lrwxrwxrwx root    root              1970-01-01 08:28 splash -> /dev/block/mmcblk0p18
lrwxrwxrwx root    root              1970-01-01 08:28 DDR -> /dev/block/mmcblk0p19
lrwxrwxrwx root    root              1970-01-01 08:28 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root    root              1970-01-01 08:28 sec -> /dev/block/mmcblk0p21
lrwxrwxrwx root    root              1970-01-01 08:28 boot -> /dev/block/mmcblk0p22
lrwxrwxrwx root    root              1970-01-01 08:28 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root    root              1970-01-01 08:28 persist -> /dev/block/mmcblk0p24
lrwxrwxrwx root    root              1970-01-01 08:28 cache -> /dev/block/mmcblk0p25
lrwxrwxrwx root    root              1970-01-01 08:28 recovery -> /dev/block/mmcblk0p26
lrwxrwxrwx root    root              1970-01-01 08:28 userdata -> /dev/block/mmcblk0p27
</pre>


== Preparation ==
== Preparation ==
It is recommended to backup the eMMC before flashing. Refer to [https://github.com/bkerler/EDL EDL].<br>
{{Hint|It is recommended to backup the eMMC before flashing. Refer to [https://github.com/bkerler/EDL EDL] <syntaxhighlight lang="bash">edl rl backup </syntaxhighlight>}}
 
The original Android image contains too old firmware to boot mainline kernel, use firmwares from Dragon Board 410c as replacement. Also, you may need qhypstub as well as lk1st (lk2nd is not recommended since vendor aboot firmwares vary and have different strange quirks which causes a lot of trouble).<br>
The original Android image contains too old firmware to boot mainline kernel, use firmwares from Dragon Board 410c as replacement. Also, you may need qhypstub as well as lk1st (lk2nd is not recommended since vendor aboot firmwares vary and have different strange quirks which causes a lot of trouble).<br>
<source lang="shell-session">
<syntaxhighlight lang="shell-session">
$ # Please do NOT use a later release from linaro, the tz firmware becomes too large to flash to tz partition. Just use the link below.
$ # Please do NOT use a later release from linaro, the tz firmware becomes too large to flash to tz partition. Just use the link below.
$ wget https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
$ wget https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
Line 124: Line 167:
$ # put your device into EDL mode or fastboot mode, flash sbl1(only required for uz801) and tz with the corresponding files extracted.
$ # put your device into EDL mode or fastboot mode, flash sbl1(only required for uz801) and tz with the corresponding files extracted.
$ # That is, the minimum firmwares needed to be replaced are: for uz801, both sbl1 and tz; for other models, only tz.
$ # That is, the minimum firmwares needed to be replaced are: for uz801, both sbl1 and tz; for other models, only tz.
$ # It is also required to flash hyp(see below). qhypstub is strongly recommended as a replacement instead of the hyp frimware from db410c because it supports booting Linux in EL2 so that KVM can be enabled. With hyp downloaded from linaro, linux can only boot in EL1 so KVM is not accessible. Although qhypstub is unofficial and not qualified by Qualcomm or Linaro so it's up to you using qhypstub or the official hyp firmware extracted from db410c.
$ # It is also required to flash hyp(see below). qhypstub is strongly recommended as a replacement instead of the hyp firmware from db410c because it supports booting Linux in EL2 so that KVM can be enabled. With hyp downloaded from linaro, linux can only boot in EL1 so KVM is not accessible. Although qhypstub is unofficial and not qualified by Qualcomm or Linaro so it's up to you using qhypstub or the official hyp firmware extracted from db410c.
$ # Either one of them is okay and enough to boot mainline Linux kernel. However, mixing the use of tz from linaro and stock hyp is not supported and causes device brick. Don't reboot the device unless both hyp and tz are replaced!
$ # Note: Flashing other images such as rpm/sbl1 is not recommended anymore. It is causing problems for some other models, better to keep them untouched.
$ # Note: Flashing other images such as rpm/sbl1 is not recommended anymore. It is causing problems for some other models, better to keep them untouched.
</source>
</syntaxhighlight>
For qhypstub and lk1st:
For qhypstub and lk1st:
<source lang="shell-session">
<syntaxhighlight lang="shell-session">
$ git clone https://github.com/msm8916-mainline/qhypstub.git
$ git clone https://github.com/msm8916-mainline/qhypstub.git
$ cd qhypstub; git clone https://github.com/msm8916-mainline/qtestsign.git
$ cd qhypstub; git clone https://github.com/msm8916-mainline/qtestsign.git
Line 143: Line 187:
$
$
$ # Now flash them to hyp and aboot partitions with EDL or fastboot.
$ # Now flash them to hyp and aboot partitions with EDL or fastboot.
</source>
</syntaxhighlight>
Sadly, with the modifications above, it's impossible to boot original Android system anymore if you do not restore the original firmwares back. Say goodbye to the stock Android system, and do what you think necessary before proceeding, like modifying IMEI, switching SIM card slot and so on, since it's difficult to perform the tasks in postmarketOS.
Sadly, with the modifications above, it's impossible to boot original Android system anymore if you do not restore the original firmwares back. Say goodbye to the stock Android system, and do what you think necessary before proceeding, like modifying IMEI, switching SIM card slot and so on, since it's difficult to perform the tasks in postmarketOS.
<!-- Expand this with the commands needed for flashing, add --sdcard to install if it makes sense etc. -->
<!-- Expand this with the commands needed for flashing, add --sdcard to install if it makes sense etc. -->
Line 150: Line 194:


== Installation ==
== Installation ==
See [[Qualcomm_Snapdragon_410/412_(MSM8916)#Installation]].
See [[Qualcomm_Snapdragon_410/412_(MSM8916)#Installation_using_pmbootstrap]].
=== partition usage strategy ===
=== partition usage strategy ===
There are several strategies to make full use of the limited eMMC storage. They are listed below, feel free to add more.
There are several strategies to make full use of the limited eMMC storage. They are listed below, feel free to add more.
Line 156: Line 200:
==== Some common recommendations ====
==== Some common recommendations ====
# use btrfs for rootfs
# use btrfs for rootfs
#: <source lang="text">$ pmbootstrap install --filesystem btrfs </source>
#: <syntaxhighlight lang="shell-session">$ pmbootstrap install --filesystem btrfs </syntaxhighlight>
# reduce the size of /boot partition to 128 MB or even smaller (64MB should be enough to hold the contents, but a slightly larger size is recommended)
# reduce the size of /boot partition to 128 MB or even smaller (64MB should be enough to hold the contents, but a slightly larger size is recommended)
#: <source lang="text">$ pmbootstrap config boot_size 128</source>
#: <syntaxhighlight lang="shell-session">$ pmbootstrap config boot_size 128</syntaxhighlight>


==== Examples ====
==== Examples ====
# Flash the rootfs and /boot to system partition (not recommended)
# Flash the rootfs and /boot to system partition (not recommended)
#: <source lang="text">$ pmbootstrap flasher flash_rootfs</source>
#: <syntaxhighlight lang="shell-session">$ pmbootstrap flasher flash_rootfs</syntaxhighlight>
#: The volume of system partiton is too low to hold a rootfs. It works, but the free space is very low, making it painful to use.
#: The volume of system partiton is too low to hold a rootfs. It works, but the free space is very low, making it painful to use.
# Flash the rootfs and /boot to userdata partition (the easiest)
# Flash the rootfs and /boot to userdata partition (the easiest)
#: <source lang="text">$ pmbootstrap flasher flash_rootfs --partition userdata</source>
#: <syntaxhighlight lang="shell-session">$ pmbootstrap flasher flash_rootfs --partition userdata</syntaxhighlight>
#: This one is the easiest, and the volume of userdata partition should be sufficient for common uses. The drawback is that a large amount of storage space is not used.
#: This one is the easiest, and the volume of userdata partition should be sufficient for common uses. The drawback is that a large amount of storage space is not used.
# split /boot and rootfs, and flash them to different partitions.
# split /boot and rootfs, and flash them to different partitions.
#: <source lang="shell-session">
#: <syntaxhighlight lang="shell-session">
$ pmbootstrap install --split
$ pmbootstrap install --split
$ pmbootstrap export
$ pmbootstrap export
Line 176: Line 220:
$ fastboot flash cache *-boot.img
$ fastboot flash cache *-boot.img
$ fastboot flash system root.simg # or userdata
$ fastboot flash system root.simg # or userdata
</source>
</syntaxhighlight>
#: The operation is a bit complex, but you can make use of 2 different partitions, which reduces space wasting. It is recommended to flash /boot partition to cache partition and flash rootfs to system or userdata.
#: The operation is a bit complex, but you can make use of 2 different partitions, which reduces space wasting. It is recommended to flash /boot partition to cache partition and flash rootfs to system or userdata.
#: Drawback: not officially supported.
#: Drawback: not officially supported.
Line 187: Line 231:
## gptfdisk
## gptfdisk
##: This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.<br>
##: This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.<br>
##: Doing this in pmOS may be dangerous and sometimes impossible(the rootfs is mounted and active), so you can try do it from [[Debug shell]] / [[netboot]] or [[https://github.com/dreemurrs-embedded/Jumpdrive/pull/84 MSM8916 fork of Jumpdrive]].
Note: persist partition sits between system and userdata, and unfortunally WCNSS nv items file is stored in it, which need to be loaded during runtime for functionality of WCN36xx(WiFi). You have to backup and relocate persist partition before deleting it, or if you like, extract WCNSS_qcom_nv_items.bin and place it at /lib/firmware.
Note: persist partition sits between system and userdata, and unfortunally WCNSS nv items file is stored in it, which need to be loaded during runtime for functionality of WCN36xx(WiFi). You have to backup and relocate persist partition before deleting it, or if you like, extract WCNSS_qcom_nv_items.bin and place it at /lib/firmware.
== Tips ==
=== Switch SIM card slot ===
Almost all of the devices here support multiple SIM cards. But can not use them simultaneously(i.e. only one can active at the same time)
==== UF(I)xxx devices ====
This series is using a more hardware-based way to control which card slot is in use. Steps:
# Try to get the GPIO number for sim_sel, esim1_sel, esim2_sel, sim_en. (from dts) For UFI001c, they are 2, 0, 3, 1 respectively.
# install gpiod-tools or use GPIO sysfs interface. Learn how to use them.
# <syntaxhighlight lang="shell-session">
$ # deactivate all slots
$ gpioset 1=1
$ # select the desired slot (eSIM1 for example)
$ gpioset 2=0 0=1 3=0
$ # activate it
$ gpioset 1=0
$ # Some delay might be essential. Recommend to add some delay commands in between if you are writing script
$ # You are recommended to run gpiod in background and acquire these pins permanently to avoid it being used by other programs
</syntaxhighlight>
==== UZ801 ====
This series use a more software-based way. Most things are done in modem firmware. You only have to issue a custom AT command to the modem.
'''TBD'''
<!-- I'm not very willing to finish this part-->


== See also ==
== See also ==

Latest revision as of 18:40, 15 February 2025

Generic Zhihe-series LTE dongles
ssh with neofetch
ssh with neofetch
Manufacturer Generic
Name Zhihe-series LTE dongles
Codename generic-zhihe
Released 2019-2023
Type generic
Hardware
Chipset Qualcomm Snapdragon 410 (MSM8916)
CPU 4x 1.0 GHz Cortex-A53
GPU Adreno 305
Display none
Storage 4GB(common)/8GB(rare) eMMC
Memory 512MB
Architecture aarch64
Software
Original software Android
Original version 4.3
FOSS bootloader yes
postmarketOS
Category testing
Pre-built images no
Mainline yes
Features
Flashing
Works
USB Networking
Works
Internal storage
No data
SD card
No data
Multimedia
3D Acceleration
No data
Connectivity
WiFi
Works
Bluetooth
No data
GPS
Works
Modem
Calls
No data
SMS
No data
Mobile data
Works
Miscellaneous
USB OTG
Partial

Contributors

  • notfound405

Users owning this device


Naming

The name zhihe comes from an early online shop selling these devices. The shop had been gone for a long time but the name is widely used to refer to these devices now. It's spelled in Chinese "芷荷", also usually misspelled as "纸盒", both pronounced in pinyin "zhihe".

How to enter flash mode

$ adb reboot edl # Qualcomm EDL, or
$ adb reboot bootloader # fastboot.

Note: only applies to stock Android system.

UFI-001C and many more with xinxun brand

By default, we get only shell permission with adb shell. However, you don't have to install SuperSU or Magisk for temporary root access. The following instruction is much easier for temporary root access:

$ adb shell
$ # Now you are in adb
$ setprop service.adb.root 1; busybox killall adbd
$ # wait for a few seconds
$ adb shell
$ # Now you get the root permission!

UZ801 V3.0

adb interface is not enabled by default.
To enable adb access and root permission, plug this device into your PC and use browser to access this URL: http://192.168.100.1/usb_debug.html, and then reboot your device(replug it). You'll find an adb device and get root permission with adb shell.
See the section below if your device bricks.

UZ801 V3.2

Similar to UZ801 V3.0, but the URL for enabling adb is http://192.168.100.1/usbdebug.html and no re-plugging is required.

Debug UART pin and test pins

UZ801 V3.0

Note: voltage: 1.8V

UFI103S, UFI001C(B), UFI003 etc.

They are clearly labeled on the board, the only button is the EDL button.

Note: voltage: 3.3V

IDK is it UFI003, because label on board is "UF003..."

Top view Bottom view

Partition layout

lrwxrwxrwx root     root              1970-01-01 08:28 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root     root              1970-01-01 08:28 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root     root              1970-01-01 08:28 sbl1bak -> /dev/block/mmcblk0p3
lrwxrwxrwx root     root              1970-01-01 08:28 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root     root              1970-01-01 08:28 abootbak -> /dev/block/mmcblk0p5
lrwxrwxrwx root     root              1970-01-01 08:28 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root     root              1970-01-01 08:28 rpmbak -> /dev/block/mmcblk0p7
lrwxrwxrwx root     root              1970-01-01 08:28 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root     root              1970-01-01 08:28 tzbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root     root              1970-01-01 08:28 hyp -> /dev/block/mmcblk0p10
lrwxrwxrwx root     root              1970-01-01 08:28 hypbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root     root              1970-01-01 08:28 pad -> /dev/block/mmcblk0p12
lrwxrwxrwx root     root              1970-01-01 08:28 modemst1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root     root              1970-01-01 08:28 modemst2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root     root              1970-01-01 08:28 misc -> /dev/block/mmcblk0p15
lrwxrwxrwx root     root              1970-01-01 08:28 fsc -> /dev/block/mmcblk0p16
lrwxrwxrwx root     root              1970-01-01 08:28 ssd -> /dev/block/mmcblk0p17
lrwxrwxrwx root     root              1970-01-01 08:28 splash -> /dev/block/mmcblk0p18
lrwxrwxrwx root     root              1970-01-01 08:28 DDR -> /dev/block/mmcblk0p19
lrwxrwxrwx root     root              1970-01-01 08:28 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root     root              1970-01-01 08:28 sec -> /dev/block/mmcblk0p21
lrwxrwxrwx root     root              1970-01-01 08:28 boot -> /dev/block/mmcblk0p22
lrwxrwxrwx root     root              1970-01-01 08:28 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root     root              1970-01-01 08:28 persist -> /dev/block/mmcblk0p24
lrwxrwxrwx root     root              1970-01-01 08:28 cache -> /dev/block/mmcblk0p25
lrwxrwxrwx root     root              1970-01-01 08:28 recovery -> /dev/block/mmcblk0p26
lrwxrwxrwx root     root              1970-01-01 08:28 userdata -> /dev/block/mmcblk0p27

Preparation

Hint It is recommended to backup the eMMC before flashing. Refer to EDL
edl rl backup

The original Android image contains too old firmware to boot mainline kernel, use firmwares from Dragon Board 410c as replacement. Also, you may need qhypstub as well as lk1st (lk2nd is not recommended since vendor aboot firmwares vary and have different strange quirks which causes a lot of trouble).

$ # Please do NOT use a later release from linaro, the tz firmware becomes too large to flash to tz partition. Just use the link below.
$ wget https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
$ unzip dragonboard410c_bootloader_emmc_android-88.zip
$ # put your device into EDL mode or fastboot mode, flash sbl1(only required for uz801) and tz with the corresponding files extracted.
$ # That is, the minimum firmwares needed to be replaced are: for uz801, both sbl1 and tz; for other models, only tz.
$ # It is also required to flash hyp(see below). qhypstub is strongly recommended as a replacement instead of the hyp firmware from db410c because it supports booting Linux in EL2 so that KVM can be enabled. With hyp downloaded from linaro, linux can only boot in EL1 so KVM is not accessible. Although qhypstub is unofficial and not qualified by Qualcomm or Linaro so it's up to you using qhypstub or the official hyp firmware extracted from db410c.
$ # Either one of them is okay and enough to boot mainline Linux kernel. However, mixing the use of tz from linaro and stock hyp is not supported and causes device brick. Don't reboot the device unless both hyp and tz are replaced!
$ # Note: Flashing other images such as rpm/sbl1 is not recommended anymore. It is causing problems for some other models, better to keep them untouched.

For qhypstub and lk1st:

$ git clone https://github.com/msm8916-mainline/qhypstub.git
$ cd qhypstub; git clone https://github.com/msm8916-mainline/qtestsign.git
$ make CROSS_COMPILE=aarch64-linux-gnu-
$ # get the generated qhypstub-test-signed.mbn and store it somewhere
$
$ cd ..; git clone https://github.com/msm8916-mainline/lk2nd.git
$ # The command below assumes Ubuntu as the host OS and UZ801 as the device.
$ # You may also need to install some additional packages with a package manager.
$ # Refer to the README.md of the repository for detailed instructions. 
$ cd lk2nd; make LK1ST_DTB=msm8916-512mb-mtp LK1ST_COMPATIBLE=zhihe,uz801-v3 TOOLCHAIN_PREFIX=arm-none-eabi- lk1st-msm8916
$ ../qhypstub/qtestsign/qtestsign.py aboot build-lk1st-msm8916/emmc_appsboot.mbn
$ # get build-lk1st-msm8916/emmc_appsboot-test-signed.mbn and store it somewhere
$
$ # Now flash them to hyp and aboot partitions with EDL or fastboot.

Sadly, with the modifications above, it's impossible to boot original Android system anymore if you do not restore the original firmwares back. Say goodbye to the stock Android system, and do what you think necessary before proceeding, like modifying IMEI, switching SIM card slot and so on, since it's difficult to perform the tasks in postmarketOS.


Installation

See Qualcomm_Snapdragon_410/412_(MSM8916)#Installation_using_pmbootstrap.

partition usage strategy

There are several strategies to make full use of the limited eMMC storage. They are listed below, feel free to add more.

Some common recommendations

  1. use btrfs for rootfs
    $ pmbootstrap install --filesystem btrfs
    
  2. reduce the size of /boot partition to 128 MB or even smaller (64MB should be enough to hold the contents, but a slightly larger size is recommended)
    $ pmbootstrap config boot_size 128
    

Examples

  1. Flash the rootfs and /boot to system partition (not recommended)
    $ pmbootstrap flasher flash_rootfs
    
    The volume of system partiton is too low to hold a rootfs. It works, but the free space is very low, making it painful to use.
  2. Flash the rootfs and /boot to userdata partition (the easiest)
    $ pmbootstrap flasher flash_rootfs --partition userdata
    
    This one is the easiest, and the volume of userdata partition should be sufficient for common uses. The drawback is that a large amount of storage space is not used.
  3. split /boot and rootfs, and flash them to different partitions.
    $ pmbootstrap install --split
    $ pmbootstrap export
    $ cd /tmp/postmarketOS-export/
    $ img2simg *-root.img root.simg
    $ # Put your device into fastboot mode
    $ fastboot flash cache *-boot.img
    $ fastboot flash system root.simg # or userdata
    
    The operation is a bit complex, but you can make use of 2 different partitions, which reduces space wasting. It is recommended to flash /boot partition to cache partition and flash rootfs to system or userdata.
    Drawback: not officially supported.
    Note: you may mount the other partition (usually system or userdata, if you flash /boot to cache partition) to, e.g. /var/lib/docker with /etc/fstab and localmount, so that every large partitions can be used.
  4. repartition
    There are two major choices, one is to replace the entire partition table and use your custom one, the other is to do minor modification with gptfdisk, leaving most partitions untouched.
    1. replace the entire partition table
      You can do it with (s)gdisk in linux, fastboot flash partition in fastboot or edl tool in Qualcomm EDL mode.
      No technical support here. It's dangerous and may brick your device, think twice before proceeding and be prepared to recovery your device in Qualcomm EDL mode.
    2. gptfdisk
      This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.
      Doing this in pmOS may be dangerous and sometimes impossible(the rootfs is mounted and active), so you can try do it from Debug shell / netboot or [MSM8916 fork of Jumpdrive].

Note: persist partition sits between system and userdata, and unfortunally WCNSS nv items file is stored in it, which need to be loaded during runtime for functionality of WCN36xx(WiFi). You have to backup and relocate persist partition before deleting it, or if you like, extract WCNSS_qcom_nv_items.bin and place it at /lib/firmware.

Tips

Switch SIM card slot

Almost all of the devices here support multiple SIM cards. But can not use them simultaneously(i.e. only one can active at the same time)

UF(I)xxx devices

This series is using a more hardware-based way to control which card slot is in use. Steps:

  1. Try to get the GPIO number for sim_sel, esim1_sel, esim2_sel, sim_en. (from dts) For UFI001c, they are 2, 0, 3, 1 respectively.
  2. install gpiod-tools or use GPIO sysfs interface. Learn how to use them.
  3. $ # deactivate all slots
    $ gpioset 1=1
    $ # select the desired slot (eSIM1 for example)
    $ gpioset 2=0 0=1 3=0
    $ # activate it
    $ gpioset 1=0
    $ # Some delay might be essential. Recommend to add some delay commands in between if you are writing script
    $ # You are recommended to run gpiod in background and acquire these pins permanently to avoid it being used by other programs
    

UZ801

This series use a more software-based way. Most things are done in modem firmware. You only have to issue a custom AT command to the modem.

TBD

See also