UF896 - Qualcomm MSM8916 LTE router ~384MiB RAM/2.4GiB flash, Android: OpenWrt?

Thanks for the firmware dump - I had bricked my UF896_V1.1 boot partition through an errant erase and now its working again.

1 Like

Sorry for a possibly silly question (I can dump firmware but not much use at more than that!):

With the progress being made by users, will this possibly lead to a functioning OpenWrt image (with SIM support) for this device or is it unlikely?

Im trying to compile Handsomemod version buts a whack-a-mole with errors, but im very new to this kind of stuff

I've added support for the UF896 based on the Handsome repo.

OpenWrt works so far, but the modem isn't working and I'm still struggling to get sysupgrade working.

Maybe I can push the fork later this week.

1 Like

Would be great because I have the UF896 im flashing the 1c version(the version from the chinese link works om my UF896, just no modem) right now lets see how it goes.

EDIT:
it boots, but a few problems with luci, no adb dont know why.

Like this?

And what do i do in EDL mode?

1 Like

Hey! Thanks for the inspiration and blog post! Yes, I think that's trick. If you plug in the device with those pins shorted, hold for 5 seconds and release, you should see the device appear as some Qualcomm device like so:

Bus 001 Device 006: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

This will allow you to use edl-tools (https://github.com/bkerler/edl) to do things like:

  • wipe the boot partition
  • restore from a stock EDL dump (available earlier in this thread)

Both of those are useful in case you mess up userspace and lock yourself out. The build of lk1st available in the OpenStick repos does not properly wire up the reset button, and so there are scenarios where getting into EDL and doing a full recovery is required. It's suspected that this EDL trigger is in the Boot ROM so it should be a very reliable failsafe.

(I did wind up doing this so that I could extract all of the firmware files, which sadly, are spread across multiple Android partitions, including userdata. It was very easy to get the EDL tools setup, though do make sure you clone the git submodules first!)

1 Like

I've pushed my handsome OpenWrt fork to:

This is pretty much WIP.
I've added some installation instructions to the WIP commit.

Feel free to test this and report back.

The LTE modem isn't working though, maybe someone has an idea how to fix this:

[   15.950834] remoteproc remoteproc0: powering up 4080000.remoteproc
[   15.991772] remoteproc remoteproc0: Booting fw image mba.mbn, size 229898
[   16.017704] qcom-wcnss-pil a204000.remoteproc: unexpected response to sysmon event
[   16.047035] qcom-q6v5-mss 4080000.remoteproc: PBL returned unexpected status -284557052
[   16.047924] remoteproc remoteproc0: can't start rproc 4080000.remoteproc: -22
[   16.048093] qcom-wcnss-pil a204000.remoteproc: unexpected response to sysmon event
[   16.048149] remoteproc remoteproc0: Boot failed: -22
3 Likes

UPDATE:

I fixed the modem.

First issue was the extracted sparse modem images. They were somehow corrupt.

I've forked the handsome qcom-firmware repo, added the firmware for the uf896 and updated the qcom-firmware package.

Second issue is, the mmcblk0 partition doesn't contain partlabels, though they are required by eudev to create the /dev/disk/by-partlabel nodes. Those are in turn required by rmtfs.

To fix that, just use gdisk for example and do a fake name change (gdisk "c", use the same name) for one of the partitions (mmcblk0p7 for example, "modemst1")
Then write the partition table with "w", this rewrites the entire partition table incl. partlabels.

Restart eudev (/etc/init.d/udev restart) and check if there are nodes created (ls /dev/disk/by-partlabel)

If so, reboot and rmtfs should now able to start the remoteproc and create the wwan interfaces)

Then edit the wwan network interface in LuCI and add the APN and PAP/CHAP credentials if required.

wwan connection should then work.

I've pushed the changes to my repo.

7 Likes

I'm compiling your repo right now thanks!

I did notice something wonky with the firmware, I was applying the new firmware files and it suddenly connected using mmcl around file .23 and when it finished uploading the files it stopped working, I was going to post but saw your post so even better, glad someone noticed/fixed this.

Now how do I make adbd/usb tethering start on boot using the handsomefeed, i compiled it on and the package are there, but it doesn't start when I boot the device.

adb and usb tethering should work if package openstick-tweaks is selected (that is a default package, so every dependency should already selected)

Both works for me out of the box.

2 Likes

I'd like to use the stick to provide tailscale vpn access to an alternative operating system which doesn't support ts yet, so it would look like this

[ AP ] --)))))-- [ OpenStick running TS ] --)))))) -- [ Laptop ]

Can the OpenStick act as a client and an AP in the same time? If not, can i set it up as a usb-network device to route TailScale'd wlan to the USB heder?

Don't know why, but for me doesnt work (the modem).
Is there any problem for you to share a full emmc backup/build so I can test to see if it works,
Because now the modem dont show up on mmcli, and the backup availabe on this thread dont work on mine even if is UF896 (can only access adb, no wifi), I might have a different version even if it says UF896_V1.1 on the mb.

1 Like

Hi, where can i find your repo or firmware for uf896? Thanks!

1 Like

Do the following:

/etc/init.d/rmtfs stop
rmtfs -P -r -s -v

And post the output of the second command.

root@HandsomeMod:~# rmtfs -P -r -s -v
registering services
[RMTFS] packet; from: 0:4
[RMTFS] open /boot/modem_fs1 => 0 (0:0)
[RMTFS] packet; from: 0:5
[RMTFS] open /boot/modem_fs2 => 1 (0:0)
[RMTFS] packet; from: 0:6
[RMTFS] open /boot/modem_fsg => 2 (0:0)
[RMTFS] packet; from: 0:7
[RMTFS] open /boot/modem_fsc => 3 (0:0)
[RMTFS] packet; from: 0:7
[RMTFS] alloc 0, 917504 => 0x86700000 (0:0)
[RMTFS] packet; from: 0:7
[RMTFS] iovec 0, not forced => (0:0)
[RMTFS]       read 1:1 0x86700200
[RMTFS] packet; from: 0:7
[RMTFS] iovec 1, not forced => (0:0)
[RMTFS]       read 1:1 0x86700200
[RMTFS] packet; from: 0:7
[RMTFS] iovec 2, not forced => (0:0)
[RMTFS]       read 0:1792 0x86700000

dmesg last lines

[   78.017358] remoteproc remoteproc0: stopped remote processor 4080000.remoteproc
[   86.517558] remoteproc remoteproc0: powering up 4080000.remoteproc
[   86.518228] remoteproc remoteproc0: Booting fw image mba.mbn, size 230272
[   86.519044] qcom-wcnss-pil a204000.remoteproc: unexpected response to sysmon event
[   86.578207] qcom-q6v5-mss 4080000.remoteproc: MBA booted without debug policy, loading mpss
[   87.129346] remoteproc remoteproc0: remote processor 4080000.remoteproc is now up
[   89.718328]  remoteproc0:smd-edge: remote side did not enter opening state
[   89.718397] rpmsg rpmsg1: failed to open DATA4
[   90.838450]  remoteproc0:smd-edge: remote side did not enter opening state
[   90.838477] rpmsg rpmsg0: failed to open DATA5_CNTL
[   92.671779] bam-dmux wwan: Channel already open: 0
[   92.671807] bam-dmux wwan: Channel already open: 1
[   92.671819] bam-dmux wwan: Channel already open: 2
[   92.671829] bam-dmux wwan: Channel already open: 3
[   92.671840] bam-dmux wwan: Channel already open: 4
[   92.671849] bam-dmux wwan: Channel already open: 5
[   92.671858] bam-dmux wwan: Channel already open: 6
[   92.671870] bam-dmux wwan: Channel already open: 7

That looks good so far.

I just find a minor issue regarding sysupgrade. Unfortunately the kernel wasn't part of the sysupgrade.

So it maybe possible you are running not the current kernel, can you pull the latest commit, build a new sysupgrade and flash that?

1 Like

I managed to install openwrt on my ufi003 using the image from the above linked by extrowerk, modem work out of the box, the speed on the wifi is worse than in thetering mode. the modem speed is quite good

I also have the one labeled as sp970, it doesn't support modem as ufi003. Also I found Miko is easier to use for flashing and dumping image compared to edl tool. always get error on windows when using edl.

2 Likes

Hi,

i was able to flash the dump to my UF896_V1.1 like:

edl qfil rawprogram0.xml -- <dir_where_the_extracted_images_located>

Technically i supposed to use patch.xml instead of --, but there is no file like that, and it bails out if i omit it from the command line, so i decided to add it.
So using this command i was able to flash everything, i see the progress bars. No error at all.
But after disconnecting and reconnecting the device it boots always in 9008 / edl mode.

What am i doing wrong? Any hints?