Zhihe series LTE dongles (generic-zhihe)
![]() ssh with neofetch | |
Manufacturer | Generic |
---|---|
Name | Zhihe-series LTE dongles |
Codename | generic-zhihe |
Released | 2019-2023 |
Type | generic |
Hardware | |
Chipset | Qualcomm Snapdragon 410 (MSM8916) |
CPU | 4x 1.0 GHz Cortex-A53 |
GPU | Adreno 305 |
Display | none |
Storage | 4GB(common)/8GB(rare) eMMC |
Memory | 512MB |
Architecture | aarch64 |
Software | |
Original software The software and version the device was shipped with. |
Android 4.3 |
Extended version The most recent supported version from the manufacturer. |
Android |
FOSS bootloader | yes |
postmarketOS | |
Category | testing |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
yes |
Device package |
![]() |
Kernel package |
![]() |
Flashing It is possible to flash the device with pmbootstrap flasher . |
Works
|
---|---|
USB Networking After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system). |
Works
|
Multimedia | |
3D Acceleration |
Untested
|
Connectivity | |
WiFi |
Works
|
Bluetooth |
Untested
|
GPS |
Works
|
Modem | |
Calls |
Untested
|
SMS |
Works
|
Mobile data |
Works
|
Miscellaneous | |
USB OTG USB On-The-Go or USB-C Role switching |
Partial
|
Contributors
- notfound405
Users owning this device
- Adomerle (Notes: UF896, died)
- Adrian (Notes: UZ801 V3.2)
- CodeDaraW (Notes: UFI003_MB_V02 & UFI103S_V05)
- Craftyguy (Notes: UZ801 v3.0)
- Domi UwU (Notes: UZ801 V3.2, purchased together with Medusa)
- Ellyqw (Notes: UZ801 V3.2)
- JIaxyga (Notes: FY_UZ801_V3.2 4Gb)
- NekoCWD (Notes: UF003S_MB_V03. Lab rat, running PostmarketOS)
- Notfound405 (Notes: UZ801 v3.0 & UFI001C_MB_V01 & UFI003_MB_V02)
- Taijigong (Notes: UF896 V 1.1)
- TipzTeam (Notes: JZ0145 & 2 SP970)
- TravMurav (Notes: uf896)
- TryzenAlpensky (Notes: working)
- Vipaol (Notes: PMOS, UFI003S-V01))
- WeirdTreeThing (Notes: UZ801 V3.2)
Naming
The name zhihe comes from an early online shop selling these devices. The shop had been gone for a long time but the name is widely used to refer to these devices now. It's spelled in Chinese "芷荷", also usually misspelled as "纸盒", both pronounced in pinyin "zhihe".
How to enter flash mode
$ adb reboot edl # Qualcomm EDL, or
$ adb reboot bootloader # fastboot.
Note: only applies to stock Android system.
UFI-001C and many more with xinxun brand
By default, we get only shell permission with adb shell. However, you don't have to install SuperSU or Magisk for temporary root access. The following instruction is much easier for temporary root access:
$ adb shell
$ # Now you are in adb
$ setprop service.adb.root 1; busybox killall adbd
$ # wait for a few seconds
$ adb shell
$ # Now you get the root permission!
UZ801 V3.0
adb interface is not enabled by default.
To enable adb access and root permission, plug this device into your PC and use browser to access this URL: http://192.168.100.1/usb_debug.html, and then reboot your device(replug it). You'll find an adb device and get root permission with adb shell.
See the section below if your device bricks.
UZ801 V3.2
Similar to UZ801 V3.0, but the URL for enabling adb is http://192.168.100.1/usbdebug.html and no re-plugging is required.
Debug UART pin and test pins
UZ801 V3.0
Note: voltage: 1.8V
UFI103S, UFI001C(B), UFI003 etc.
They are clearly labeled on the board, the only button is the EDL button.
Note: voltage: 3.3V
UF003S_MB_V03
Partition layout
lrwxrwxrwx root root 1970-01-01 08:28 modem -> /dev/block/mmcblk0p1 lrwxrwxrwx root root 1970-01-01 08:28 sbl1 -> /dev/block/mmcblk0p2 lrwxrwxrwx root root 1970-01-01 08:28 sbl1bak -> /dev/block/mmcblk0p3 lrwxrwxrwx root root 1970-01-01 08:28 aboot -> /dev/block/mmcblk0p4 lrwxrwxrwx root root 1970-01-01 08:28 abootbak -> /dev/block/mmcblk0p5 lrwxrwxrwx root root 1970-01-01 08:28 rpm -> /dev/block/mmcblk0p6 lrwxrwxrwx root root 1970-01-01 08:28 rpmbak -> /dev/block/mmcblk0p7 lrwxrwxrwx root root 1970-01-01 08:28 tz -> /dev/block/mmcblk0p8 lrwxrwxrwx root root 1970-01-01 08:28 tzbak -> /dev/block/mmcblk0p9 lrwxrwxrwx root root 1970-01-01 08:28 hyp -> /dev/block/mmcblk0p10 lrwxrwxrwx root root 1970-01-01 08:28 hypbak -> /dev/block/mmcblk0p11 lrwxrwxrwx root root 1970-01-01 08:28 pad -> /dev/block/mmcblk0p12 lrwxrwxrwx root root 1970-01-01 08:28 modemst1 -> /dev/block/mmcblk0p13 lrwxrwxrwx root root 1970-01-01 08:28 modemst2 -> /dev/block/mmcblk0p14 lrwxrwxrwx root root 1970-01-01 08:28 misc -> /dev/block/mmcblk0p15 lrwxrwxrwx root root 1970-01-01 08:28 fsc -> /dev/block/mmcblk0p16 lrwxrwxrwx root root 1970-01-01 08:28 ssd -> /dev/block/mmcblk0p17 lrwxrwxrwx root root 1970-01-01 08:28 splash -> /dev/block/mmcblk0p18 lrwxrwxrwx root root 1970-01-01 08:28 DDR -> /dev/block/mmcblk0p19 lrwxrwxrwx root root 1970-01-01 08:28 fsg -> /dev/block/mmcblk0p20 lrwxrwxrwx root root 1970-01-01 08:28 sec -> /dev/block/mmcblk0p21 lrwxrwxrwx root root 1970-01-01 08:28 boot -> /dev/block/mmcblk0p22 lrwxrwxrwx root root 1970-01-01 08:28 system -> /dev/block/mmcblk0p23 lrwxrwxrwx root root 1970-01-01 08:28 persist -> /dev/block/mmcblk0p24 lrwxrwxrwx root root 1970-01-01 08:28 cache -> /dev/block/mmcblk0p25 lrwxrwxrwx root root 1970-01-01 08:28 recovery -> /dev/block/mmcblk0p26 lrwxrwxrwx root root 1970-01-01 08:28 userdata -> /dev/block/mmcblk0p27
Preparation
It is recommended to backup the eMMC before flashing. Refer to EDL edl rl backup
|
The original Android image contains too old firmware to boot mainline kernel, use firmwares from Dragon Board 410c as replacement. Also, you may need qhypstub as well as lk1st (lk2nd is not recommended since vendor aboot firmwares vary and have different strange quirks which causes a lot of trouble).
$ # Please do NOT use a later release from linaro, the tz firmware becomes too large to flash to tz partition. Just use the link below.
$ wget https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
$ unzip dragonboard410c_bootloader_emmc_android-88.zip
$ # put your device into EDL mode or fastboot mode, flash sbl1(only required for uz801) and tz with the corresponding files extracted.
$ # That is, the minimum firmwares needed to be replaced are: for uz801, both sbl1 and tz; for other models, only tz.
$ # It is also required to flash hyp(see below). qhypstub is strongly recommended as a replacement instead of the hyp firmware from db410c because it supports booting Linux in EL2 so that KVM can be enabled. With hyp downloaded from linaro, linux can only boot in EL1 so KVM is not accessible. Although qhypstub is unofficial and not qualified by Qualcomm or Linaro so it's up to you using qhypstub or the official hyp firmware extracted from db410c.
$ # Either one of them is okay and enough to boot mainline Linux kernel. However, mixing the use of tz from linaro and stock hyp is not supported and causes device brick. Don't reboot the device unless both hyp and tz are replaced!
$ # Note: Flashing other images such as rpm/sbl1 is not recommended anymore. It is causing problems for some other models, better to keep them untouched.
For qhypstub and lk1st:
$ git clone https://github.com/msm8916-mainline/qhypstub.git
$ cd qhypstub; git clone https://github.com/msm8916-mainline/qtestsign.git
$ make CROSS_COMPILE=aarch64-linux-gnu-
$ # get the generated qhypstub-test-signed.mbn and store it somewhere
$
$ cd ..; git clone https://github.com/msm8916-mainline/lk2nd.git
$ # The command below assumes Ubuntu as the host OS and UZ801 as the device.
$ # You may also need to install some additional packages with a package manager.
$ # Refer to the README.md of the repository for detailed instructions.
$ cd lk2nd; make LK1ST_DTB=msm8916-512mb-mtp LK1ST_COMPATIBLE=zhihe,uz801-v3 TOOLCHAIN_PREFIX=arm-none-eabi- lk1st-msm8916
$ ../qhypstub/qtestsign/qtestsign.py aboot build-lk1st-msm8916/emmc_appsboot.mbn
$ # get build-lk1st-msm8916/emmc_appsboot-test-signed.mbn and store it somewhere
$
$ # Now flash them to hyp and aboot partitions with EDL or fastboot.
Sadly, with the modifications above, it's impossible to boot original Android system anymore if you do not restore the original firmwares back. Say goodbye to the stock Android system, and do what you think necessary before proceeding, like modifying IMEI, switching SIM card slot and so on, since it's difficult to perform the tasks in postmarketOS.
Installation
See Qualcomm_Snapdragon_410/412_(MSM8916)#Installation_using_pmbootstrap.
partition usage strategy
There are several strategies to make full use of the limited eMMC storage. They are listed below, feel free to add more.
Some common recommendations
- use btrfs for rootfs
$ pmbootstrap install --filesystem btrfs
- reduce the size of /boot partition to 128 MB or even smaller (64MB should be enough to hold the contents, but a slightly larger size is recommended)
$ pmbootstrap config boot_size 128
Examples
- Flash the rootfs and /boot to system partition (not recommended)
$ pmbootstrap flasher flash_rootfs
- The volume of system partiton is too low to hold a rootfs. It works, but the free space is very low, making it painful to use.
- Flash the rootfs and /boot to userdata partition (the easiest)
$ pmbootstrap flasher flash_rootfs --partition userdata
- This one is the easiest, and the volume of userdata partition should be sufficient for common uses. The drawback is that a large amount of storage space is not used.
- split /boot and rootfs, and flash them to different partitions.
$ pmbootstrap install --split $ pmbootstrap export $ cd /tmp/postmarketOS-export/ $ img2simg *-root.img root.simg $ # Put your device into fastboot mode $ fastboot flash cache *-boot.img $ fastboot flash system root.simg # or userdata
- The operation is a bit complex, but you can make use of 2 different partitions, which reduces space wasting. It is recommended to flash /boot partition to cache partition and flash rootfs to system or userdata.
- Drawback: not officially supported.
- Note: you may mount the other partition (usually system or userdata, if you flash /boot to cache partition) to, e.g. /var/lib/docker with /etc/fstab and localmount, so that every large partitions can be used.
- repartition
- There are two major choices, one is to replace the entire partition table and use your custom one, the other is to do minor modification with gptfdisk, leaving most partitions untouched.
- replace the entire partition table
- You can do it with (s)gdisk in linux,
fastboot flash partition
in fastboot or edl tool in Qualcomm EDL mode. - No technical support here. It's dangerous and may brick your device, think twice before proceeding and be prepared to recovery your device in Qualcomm EDL mode.
- You can do it with (s)gdisk in linux,
- gptfdisk
- This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.
- Doing this in pmOS may be dangerous and sometimes impossible(the rootfs is mounted and active), so you can try do it from Debug shell / netboot or [MSM8916 fork of Jumpdrive].
- This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.
Note: persist partition sits between system and userdata, and unfortunally WCNSS nv items file is stored in it, which need to be loaded during runtime for functionality of WCN36xx(WiFi). You have to backup and relocate persist partition before deleting it, or if you like, extract WCNSS_qcom_nv_items.bin and place it at /lib/firmware.
Tips
Switch SIM card slot
Almost all of the devices here support multiple SIM cards. But can not use them simultaneously(i.e. only one can active at the same time)
UF(I)xxx devices
This series is using a more hardware-based way to control which card slot is in use. Steps:
- Try to get the GPIO number for sim_sel, esim1_sel, esim2_sel, sim_en. (from dts) For UFI001c, they are 2, 0, 3, 1 respectively.
- install gpiod-tools or use GPIO sysfs interface. Learn how to use them.
$ # deactivate all slots $ gpioset 1=1 $ # select the desired slot (eSIM1 for example) $ gpioset 2=0 0=1 3=0 $ # activate it $ gpioset 1=0 $ # Some delay might be essential. Recommend to add some delay commands in between if you are writing script $ # You are recommended to run gpiod in background and acquire these pins permanently to avoid it being used by other programs
UZ801
This series use a more software-based way. Most things are done in modem firmware. You only have to issue a custom AT command to the modem.
TBD
Starting the network through qmicli
On my UZ801 V3.2, the process of getting a fresh pmOS image to connect to LTE was rather painful. The internet lists some misleading instructions (qmi-network
script does not work out of the box here), and in other cases suggests setting sysctl keys which do not exist. This device also does not work with ModemManager, nor ofono, straight up crashing the latter. Hence, all of this has been determined through manual trial and error.
alias q='qmicli -d /dev/wwan0qmi0' # much less painful than writing this every time
q --wds-reset
q --dms-set-operating-mode=online
# wait for this to say `registered`
q --nas-get-serving-system
# you can also try adding a new profile
# profile 3 is APN internet, PDP ipv4, no auth. seems to be added on boot.
q --device-open-net='net-raw-ip|net-no-qos-header' --wds-start-network=3gpp-profile=3 --device-open-proxy --wds-follow-network
# IN A SEPARATE TERM:
q --wds-get-current-settings # note the IPs, replace the ones below.
ip a a 10.200.204.206/30 dev wwan0
ip r a default via 10.200.204.205
# Witamy w sieci Internet
iptables -A FORWARD -j ACCEPT
iptables -t nat -A POSTROUTING -o wwan0 -j MASQUERADE
sysctl net.ipv4.ip_forward=1
# at this point you can use static IPs, or configure dnsmasq
If your phone carrier supports IPv6, you need to set the PDP to IPV6 or IPV4V6:
q --wds-create-profile=3gpp,apn=internet.v6.telekom,username=telekom,password=telekom,auth=both,pdp-type=IPV4V6
This will return a profile ID (list all with q --wds-get-profile-list=3gpp
), which you can use with --wds-start-network
. You need to run q --wds-get-current-settings
before any sort of autoconfig takes place. For IPv4 I wasn't able to get autoconfig working at all, but this is likely carrier-dependent.
When debugging connectivity, running q --wds-get-packet-service-status
in a separate shell will be very useful. If other commands are unexpectedly returning OutOfCall, your modem has likely disconnected, or failed to connect in the first place.
Device-specific quirks
- Setting the data format through
q --wda-set-data-format=raw-ip
does not seem to work. It falsely returns success, but--wda-set-data-format
says 802-3 still. Instead, append--device-open-net='net-raw-ip|net-no-qos-header'
to the wds-start-network call --client-cid=...
is evil and will hand qmicli. Of note, it doesn't hang the modem, just causes it to never respond, and qmicli is bad at handling timeouts--wds-go-dormant
/--wds-go-active
doesn't do anything. Generally my version seems to be quite cut down, even--wds-get-supported-messages
fails--client-no-release-cid
fails, use--wds-follow-network
instead. This will lock up your shell, however. To disconnect, first ^C so qmicli sends a disconnection request to the modem, then ^Z, thenkillall -9 qmicli
(otherwise it'll hang forever)- qmicli seems to be randomly unable to receive status back from the modem. This will result in "error: operation failed: Transaction timed out". This Is Fine™
See also
- pmaports!3988 Initial merge request