UF896 - Qualcomm MSM8916 LTE router ~384MiB RAM/2.4GiB flash, Android: OpenWrt?

Just FYI, I got my UF896_V1.1 bricked just by flashing the openstick generic image and leaving it running for a couple of hours. I'm not sure what happened, I didn't even open it up. I tried to get it to boot into edl mode by various tricks mentioned in the forums, but it looks like the stick is dead for good.

Thanks for the detailed guide, i did it, but the stick still boots directly to EDL.
I have no idea how to exit from EDL or how to force the normal boot.

I am currently trying to build from the repository of @kirdes.

I also want to include USB host support, not only USB gadget support, in order to be able to connect via a mechanical adapter other USB devices.

  • What is the host controller driver I should select for the device? The generic OHCI/UHCI and EHCI (kmod-usb-ohci/kmod-usb-uhci, kmod-usb2 (EHCI)), or some other?
  • Will this work "out of the box" that the devices uses USB host or USB gadget role, depending on what is connected to the USB port, or is some configuration needed? (And if so, is a "default to gadget mode" possible to define?)
  • Are conflicts to be expected?

Regards!

Ahoj,

I have compiled an image for UF896 from the repository of @kirdes, but I feel like a stupid one because I have no idea how I can flash the thing to the device. (I have no experience with fastboot or edl.)

I can boot the device into fastboot mode or edl mode (adb reboot bootloader or adb reboot edl, respectively, when the stick has came up to the stock firmware's android).

So, how have you flashed the resulting images?

I have the *-ext4-boot.img, *-ext4-system.img, *-squashfs-boot.img, *-squashfs-system.img and squashfs-sysupgrade.bin here as output of the HandsomeMod build.

Hi.
I buy UF1601-EU modem, it is defined as Qualcomm HS-USB QDLoader 9008.
Can you do something with it?
The reset button does not respond.
How to restart it in normal mode?

Photo

p.s. I am from Ukraine, please help. The modem is essential. Thank you.

Got mine today, will play wirh it later, this look verynice for travel router plus tiny nas. Did someone test micro sd speads? Have 200gb.micro sd sandisk card and i'm curiuos about it

thanks for mentioning that.

I have included it in my README.

But I run into another problem:

At the step
fastboot erase rootfs
I get the failure

Erasing 'rootfs'                                   FAILED (remote: 'Partition table doesn't exist
')
fastboot: error: Command failed

Seems that there is no partition called rootfs on my device.

I can confirm that I have a system, userdata and a cache partition (just by trial and error, now they have been formated), I don't know if there are more.

I tried flashing to system:

fastboot flash system handsomemod-uf896-21.03-attila-snapshot-r0-4d2642e-msm89xx-msm8916-openstick_uf896-squashfs-system.img

but after a reboot the device just reboots to fastboot again.

Does anyone know how to find out the partition names on my device? And how to rename them correctly, or other things I need to change so that I can get a device working that does not have a partition called rootfs?

(Note: I already erased and formatted the system, userdata and cache partitions and flashed the boot partition, and the device does not boot anymore into the vendor's operating system, just to fastboot.)

Another thing: Are there objections against using f2fs instead of ext4?

I see that people talk about "lk2nd" here. I have no idea what it is, but what I read from here is that it should be installed at some stage.

How to install it?

The
fastboot flash boot handsomemod-msm89xx-msm8916-openstick_uf896-squashfs-boot.img
seemed not to have installed it, since the fastboot oem <command> commands mentioned → here do not work after the succesful execution of that command.

Regards!

From your own Howto : Target Profile: Openstick UF896
you need to install openstick on your UF896_v1.1 first
then you will have a rootfs partition.

1 Like

Ah OK, that was never clear to me in any documentation (which I copied from @kirdes). I thought that the naming "Target Profile: Openstick UF896" means that the device was nicknamed Openstick. Since I had no reason to assume that hardware target profiles actually imply some software which is installed on the device (and will be removed anyway after flashing).


Btw., I tried to install lk2nd-msm8916.img from the OpenStick repository (fastboot flash boot lk2nd-msm8916.img), and I do not get the fastboot oem [*] commands mentioned here.

Maybe that is interesting for anyone:

I tried with the lk2nd-msm8916.img from the OpenStick repository an installation to an aboot partition (not knowing what aboot is, but just curious) instead of boot partition:

fastboot flash aboot lk2nd-msm8916.img

and now the device registeres as a mass storage device with 27 partitions.

Partition 1 I can mount as vfat partition, and it seems to contain a lot of modem data.

I dump it's content here for anyone who might be interested:
→ uf896_partition-01.tar.zst (25 MiB).

Further details:

"Partition layout (output of `fdisk -l`) (*click* to see):
Disk /dev/sdc: 3.64 GiB, 3909091328 bytes, 7634944 sectors
Disk model: MMC Storage     
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 98101B32-BBE2-4BF2-A06E-2BB33D000C20

Device       Start     End Sectors  Size Type
/dev/sdc1   131072  262143  131072   64M Microsoft basic data
/dev/sdc2   262144  263167    1024  512K unknown
/dev/sdc3   263168  264191    1024  512K Microsoft basic data
/dev/sdc4   264192  266239    2048    1M unknown
/dev/sdc5   266240  268287    2048    1M Microsoft basic data
/dev/sdc6   268288  269311    1024  512K unknown
/dev/sdc7   269312  270335    1024  512K Microsoft basic data
/dev/sdc8   270336  271359    1024  512K unknown
/dev/sdc9   271360  272383    1024  512K Microsoft basic data
/dev/sdc10  272384  273407    1024  512K unknown
/dev/sdc11  273408  274431    1024  512K Microsoft basic data
/dev/sdc12  274432  276479    2048    1M Microsoft basic data
/dev/sdc13  276480  279551    3072  1.5M unknown
/dev/sdc14  279552  282623    3072  1.5M unknown
/dev/sdc15  282624  284671    2048    1M unknown
/dev/sdc16  284672  284673       2    1K unknown
/dev/sdc17  284674  284689      16    8K unknown
/dev/sdc18  284690  305169   20480   10M unknown
/dev/sdc19  393216  393279      64   32K unknown
/dev/sdc20  393280  396351    3072  1.5M unknown
/dev/sdc21  396352  396383      32   16K unknown
/dev/sdc22  396384  429151   32768   16M unknown
/dev/sdc23  429152 2067551 1638400  800M Microsoft basic data
/dev/sdc24 2067552 2133087   65536   32M Microsoft basic data
/dev/sdc25 2133088 2395231  262144  128M Microsoft basic data
/dev/sdc26 2395232 2427999   32768   16M unknown
/dev/sdc27 2428000 7634910 5206911  2.5G Microsoft basic data
"Partition types (`file` on each `dd`-ed storage dump) (*click* to see):
storage_dump.img:              DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last)
storage_dump.partition-01.img: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "MSDOS5.0", sectors/cluster 32, root entries 512, Media descriptor 0xf8, sectors/FAT 17, sectors/track 63, heads 255, sectors 131072 (volumes > 32 MB), reserved 0x1, serial number 0xbc614e, unlabeled, FAT (16 bit)
storage_dump.partition-02.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-03.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-04.img: Android bootimg, kernel, page size: 2048, cmdline (lk2nd)
storage_dump.partition-05.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-06.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-07.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-08.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-09.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-10.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-11.img: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, no section header
storage_dump.partition-12.img: data
storage_dump.partition-13.img: Sony PlayStation PSX image, 24-Bit, Pixel at (616,49780) Size=2/3*65024x13
storage_dump.partition-14.img: data
storage_dump.partition-15.img: data
storage_dump.partition-16.img: data
storage_dump.partition-17.img: data
storage_dump.partition-18.img: data
storage_dump.partition-19.img: data
storage_dump.partition-20.img: Matlab v4 mat-file (little endian) (\367\001, numeric, rows 3, columns 472
storage_dump.partition-21.img: data
storage_dump.partition-22.img: data
storage_dump.partition-23.img: Squashfs filesystem, little endian, version 4.0, xz compressed, 71382002 bytes, 9104 inodes, blocksize: 262144 bytes, created: Thu Sep 29 20:58:39 2022
storage_dump.partition-24.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (needs journal recovery) (extents) (large files)
storage_dump.partition-25.img: Linux rev 1.0 ext4 filesystem data, UUID=ce6674ce-20c9-453f-bc47-91a24e471809 (needs journal recovery) (extents) (64bit) (large files) (huge files)
storage_dump.partition-26.img: Android bootimg, kernel, ramdisk, page size: 2048, cmdline (ra=r2020a androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci and)
storage_dump.partition-27.img: Linux rev 1.0 ext4 filesystem data, UUID=2699a72f-0593-40fc-bdab-38e4c54cc96b (needs journal recovery) (extents) (64bit) (large files) (huge files)
"Directory listing of 1st partition (*click* to see):
image/cmnlib.b00
image/cmnlib.b01
image/cmnlib.b02
image/cmnlib.b03
image/cmnlib.mdt
image/isdbtmm.b00
image/isdbtmm.b01
image/isdbtmm.b02
image/isdbtmm.b03
image/isdbtmm.mdt
image/keymaste.b00
image/keymaste.b01
image/keymaste.b02
image/keymaste.b03
image/keymaste.mdt
image/modem.b00
image/modem.b01
image/modem.b02
image/modem.b03
image/modem.b04
image/modem.b05
image/modem.b06
image/modem.b07
image/modem.b08
image/modem.b10
image/modem.b11
image/modem.b13
image/modem.b14
image/modem.b15
image/modem.b16
image/modem.b17
image/modem.b18
image/modem.b19
image/modem.b20
image/modem.b21
image/modem.b22
image/modem.b23
image/modem.b24
image/modem.b25
image/modem.b26
image/modem.b27
image/modem.b28
image/modem.mdt
image/playread.b00
image/playread.b01
image/playread.b02
image/playread.b03
image/playread.mdt
image/wcnss.b00
image/wcnss.b01
image/wcnss.b02
image/wcnss.b04
image/wcnss.b06
image/wcnss.b09
image/wcnss.b10
image/wcnss.b11
image/wcnss.mdt
image/widevine.b00
image/widevine.b01
image/widevine.b02
image/widevine.b03
image/widevine.mdt
image/mba.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/apac/airtel/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/apac/dcm/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/apac/kddi/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/apac/reliance/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/apac/sbm/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/lab_conf/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/dsds/lab_nsio/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/ss/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/3csfb/ss/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/com_atta/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/lab_conf/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/dsds/lab_nsio/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/ss/com_atta/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/ss/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/csfb/ss/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/dsda/com_atta/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/dsda/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/dsda/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/dsda/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/ss/com_atta/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/ss/comb_att/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cmcc/sglte/ss/eps_only/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/3g/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/cg/dsda/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/cg/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srlte/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srlte/dsds/test/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srlte/dsds/test_eps/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srlte/dsds/test_no_/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srlte/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/srte/dsds/cta/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/svlte/dsda/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/svlte/dsda/test/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/svlte/dsda/test_eps/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/svlte/dsda/test_no_/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/ct/svlte/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cu/csfb/drds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cu/csfb/dsda/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cu/csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/china/cu/csfb/ss/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/eu/ee/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/amx/non_volt/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/att/3g/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/att/volte/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/sprint/ecsfb/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/tmo/nov_comm/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/tmo/volte_co/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/verizon/1xsrlte/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/verizon/svlte/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/na/verizon/hvolte/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/sa/brazil/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/common/default/csfb/dsds/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/common/default/default/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/common/row/gen_3gpp/mcfg_sw.mbn
image/modem_pr/mcfg63b80d4fe35fb4ca338b2cf3e8f526aa/configs/mcfg_sw/generic/common/us_cellu/commerci/mcfg_sw.mbn
image/modem_pr/mcfg/configs/mcfg_sw/generic/common/w_one/commerci/mcfg_sw.mbn

→ Dumps of all partitions.

1 Like

OK I think I now completely bricked my device.

The switch I soldered to the pads to force the device into EDL mode just came of while I pressed it and it ripped off the corresponding solder pads.

Bootloader is currently not-working at all (after some playing around), when I connect the device now to USB no USB device at all is registered, and since I ripped off the solder pads I also see no way to get into EDL mode anymore. So I have to wait for a new one to arrive.

Any way to know what to look for with micro sd slot? Mine dosen't have one sadly

Any way to know what to look for with micro sd slot? Mine dosen't have one sadly

According to aliexpress, this one has (it is advertised. If it does not have, you can heldtry to hold the seller responsible via aliexpress dispute.)

I don't know what the device will be in the end, I have ordered it.

Ahoj @PatEvry,
I am not sure if you mean me but I assume from the context you have given. To make things more clear, it would be helpful if next time you make proper citations (you can mark the text you want to cite, then a "Quote"-popup will come at the marked text, which you can click to quote the corresponding text).

In case you are refering to me:

Which error messages?

I did compile from → my fork of → @kirdes's repository where I have fixed some issues I encountered. Unfortunately, @kirdes has closed it's own issue reporting system so I cannot refer anymore to the issues I had there, but → here you can see the differences.

→ This is the .config I used, → this the feeds.conf. (Note that there were also some issues with some packages from the packages feed, I just disabled the offending packages and reported the issues at the corresponding HandsomeMod's repositories.)

Can you compile my fork with this .config and this feeds.conf? If not, what are the errors?

See → here.

Does this help you?

DISCLAIMER: I could not test any of this yet.

A remark: For easier readability and copy-paste-ability, can you attach that stuff in the future not as images but copy-paste the text, included in a code block, like:

```
[Here your code/ compile log snippet/ ...]
[...]
```

I see gcc failing with a "Segmentation fault". That seems to be some other problem, more related to your build infrastructure?

I am not familiar with C code, linking, and gcc. But it seems that it errors out by already building your toolchain, so your host system's compiler or libs might have problems.

Can you set up a clean OpenWrt build environment → as described here? If your problems continue or you have struggles with setting up the build environment, that would be a topic for a new thread, it does not belong into this thread.

Hi Again, thanks for your answer,.
This is a fresh new Debian install I installed to get on with this stick.
Anyhow, the dongle is dead. No sign of live anymore. No trace of it in lsusb or UsbDkController
It didn't appreciate the multiple reboots I did. It is inexpensive but the quality is not important either.
I am waiting for a new one.
NB : However, before its end I was able to flash it with your binaries.

Anyhow, the dongle is dead. No sign of live anymore. No trace
of it in lsusb or UsbDkController It didn't appreciate the multiple
reboots I did.
[...]
However, before its end I was able to flash it with your binaries.

After you flashed with "my" binaries, did it come up after a reboot at
least once/ was visible via lsusb and dmesg when attaching?

Or was it just "dead" after flashing? -- If so, it could be that my
binaries are flawed.

Can you get it into EDL mode by shorteing the two pins as described in
→ this post?

Yep it booted at least once. So your binaries are OK.
I will try to get it into EDL shorteing the two pins indeed and also I will try to see if I can get something out of the UART.