UF896 - Qualcomm MSM8916 LTE router ~384MiB RAM/2.4GiB flash, Android: OpenWrt?

I don't know the loader part, but I guess that's a Windows' thing, right?

I don't see an error tbh. Did it stop, or did you stop it? This command can easily take half an hour or so.

I have try with and without loader(s).. It's not showing any error but it stops immediately at transfer 0.. I download the emmc stock from there (uz801_v3.0_stock.zip): https://github.com/Mio-sha512/openstick-stuff/releases .. i have no idea what the problem could be :thinking:..

I think the problem is that you are not using the stock version of your stick. That might work if it would be the same board (3.0 vs. 3.2), but I remember having issues even then. I was never able to flash any other stock image on the stick than the native backup, sorry.

1 Like

omg you are right JoffeL!!! I found the UZ801_V3.2 Stock ROM and now its transfer it.. I will let you know if it works or not (after the transfer).. thanks again for your help.

all good, it's working again but it's not connecting to the sim anymore..

The sim should get recognized. No internet connection is expected behavior.

Unfortunately yes, sim recognized but not connecting to the internet.. :confused:

This happens because the modem is not/wrong configured. It can be configured, but you need a stock modem.bin file to do so.

so if I found the files you have describe above ( fsc.bin, fsg.bin, modemst1.bin, modemst2.bin) and flash them, it will work?

No, you need these AND the modem.bin

Create missing files

You have the complete stock image, right?
If you flash this onto the router you can create these files with:
edl rl folder/for/partition/files
But if there is not much disk space you can also just export the ones you need with edl r [...] I think.

if OpenWrt is currently installed you can activate edl with:
adb reboot bootloader and then `fastboot oem reboot-edl

fix flashing process

then place fsc.bin, fsg.bin, modemst1.bin, modemst2.bin in the OpenWrt flash folder and edit the flash file as said before.


then flash OpenWrt

configure the modem

  1. upload modem.bin to the stick: adb push modem.bin /
  2. mount the modem.bin : mount -o loop -t vfat modem.bin /mnt
  3. cd /mnt/image/
  4. copy conf files to destination: cp modem.* wcnss.* mba.mbn /lib/firmware/
  5. place in the correct config for your location:
    cp modem_pr/mcfg/configs/mcfg_sw/generic/{{ location }}/.../mcfg_sw.mbn /lib/firmware/
  6. reboot

Then it should work.

I have JZ02 V30 board.
I have flashed debian. I have backuped and restored modemst1, modemst2, fsc, fsg partitions.
Also, I've grabbed the contents of modem partition and copied contents of image folder (modem.b??, wcnss.b?? etc) to /lib/firmware.
The system boots, but modem part is not working.

  General  |              path: /org/freedesktop/ModemManager1/Modem/0
           |         device id: 19a29d2afc609815734fc43b76f51a42d8c82391
  Hardware |      manufacturer: QUALCOMM INCORPORATED
           |             model: 0
           | firmware revision: MPSS.DPM.1.0.c7-00193-M8916EAAAANVZM-1  1  [Sep 09 2015 10:00:00]
           |    carrier config: default
           |      h/w revision: 10000
           |         supported: gsm-umts, lte
           |           current: gsm-umts, lte
           |      equipment id: 86XXXXXXXXXXXXX
  System   |            device: qcom-soc
           |           drivers: qcom-q6v5-mss, bam-dmux
           |            plugin: qcom-soc
           |      primary port: wwan0qmi0
           |             ports: wwan0 (net), wwan0at0 (at), wwan0qmi0 (qmi), wwan1 (net),
           |                    wwan2 (net), wwan3 (net), wwan4 (net), wwan5 (net), wwan6 (net),
           |                    wwan7 (net)
  Status   |             state: failed
           |     failed reason: sim-missing
           |    signal quality: 0% (cached)

Could not find how to complete step 5:

cp modem_pr/mcfg/configs/mcfg_sw/generic/{{ location }}/.../mcfg_sw.mbn /lib/firmware/

Where is this modem_pr/mcfg ? I could not find mcfg_sw.mbn anywhere.
Any ideas, how to debug this?

Did you do step 3?
modem_pr should be located in /mnt/image

you can do an ls to check that.

But I never tried that with your board or debian. The steps are only tested for UZ801_v3.2 and OpenWrt.

Yes, my modem partition contained only image folder with this contents:

cmnlib.b00    keymaste.b02  modem.b03  modem.b13  modem.b21     playread.b01  wcnss.b04     widevine.b01
cmnlib.b01    keymaste.b03  modem.b04  modem.b15  modem.b24     playread.b02  wcnss.b06     widevine.b02
cmnlib.b02    keymaste.mdt  modem.b05  modem.b16  modem.b25     playread.b03  wcnss.b09     widevine.b03
cmnlib.b03    mba.mbn       modem.b06  modem.b17  modem.b26     playread.mdt  wcnss.b10     widevine.mdt
cmnlib.mdt    modem.b00     modem.b07  modem.b18  modem.b27     wcnss.b00     wcnss.b11
keymaste.b00  modem.b01     modem.b10  modem.b19  modem.mdt     wcnss.b01     wcnss.mdt
keymaste.b01  modem.b02     modem.b12  modem.b20  playread.b00  wcnss.b02     widevine.b00

No additional folders.
Stock firmware also contains persist partition with only file WCNSS_qcom_wlan_nv.bin, but I suppose it is related to WiFi part.

Probably this board has remapped GPIOs for SIM card and I need to figure out how to get proper map. Either from stock firmware or somewhere else.

I've dumped device tree data from android firmware, decompiled it and found following section:

                gpio-leds {
                        compatible = "gpio-leds";
                        status = "okay";
                        pinctrl-names = "default";
                        pinctrl-0 = <0x110>;

                        red {
                                gpios = <0x4f 0x08 0x00>;
                                label = "red";
                                linux,default-trigger = "timer";
                                default-state = "on";

                        green {
                                gpios = <0x4f 0x06 0x00>;
                                label = "green";
                                linux,default-trigger = "none";
                                default-state = "off";

                        blue {
                                gpios = <0x4f 0x07 0x00>;
                                label = "blue";
                                linux,default-trigger = "none";
                                default-state = "off";

                        sim1_switch_gpio {
                                gpios = <0x4f 0x16 0x00>;
                                label = "sim1_switch_gpio";
                                linux,default-trigger = "none";
                                default-state = "off";
                        sim2_switch_gpio {
                                gpios = <0x4f 0x17 0x00>;
                                label = "sim2_switch_gpio";
                                linux,default-trigger = "none";
                                default-state = "off";

                        sim3_switch_gpio {
                                gpios = <0x4f 0x01 0x00>;
                                label = "sim3_switch_gpio";
                                linux,default-trigger = "none";
                                default-state = "on";

                        sim_hotdet_gpio {
                                gpios = <0x4f 0x14 0x00>;
                                label = "sim_hotdet_gpio";
                                linux,default-trigger = "none";
                                default-state = "off";

I'll try to add dts file for this board to handsome mod. Do you know, do I need to give specific names to gpios for controlling sim so modem manager could pick them up automatically? Or it is better to control in userspace, fiddling with /sys/class/led/xxx GPIOs?

has anybody managed to fix a hungup boot when openwrt is already installed?
I accidentally made an infinite loop in an init script and adb and ssh are not accessible anymore

Were you able to get an LTE connection with a sim-card on your device with an esim?
Mine activates the eSIM instead of the SIM per default and switching the slot via an AT command, qmicli or mmcli works, but crashes the modem. A reboot to fix the modem then resets the slot..

Have you any idea how to fix that?

hey i just got a few questions, does changing imei in the web changes it permanently or can it restore back if factory reset?
how do i boot to edl im new to this
how to get to adb?
I also need schemati diagram for

The IMEI is usually written on the sticker above the SIM slot. So you can restore it by changing it again.
Usually changing the IMEI does not mean overwriting, but spoofing it. A factory reset of the stock firmware could do the trick.

adb and edl

flash process

But it seems like there are problems with devices that have an esim. So maybe check that first.

Which stores are you guys ordering from on aliexpress? Is the black one the right one?