SHIFT SHIFT6mq (shift-axolotl)

== Contributors ==
* Amartinz
* Caleb
* DylanVanAssche
== Users owning this device ==
== Boot modes ==
By holding various button combinations while booting the device can be made to boot into different modes.
Unplug from USB, power off the device and press and hold the below buttons to enter the specific boot mode.
Boot mode	 	 	
Fastboot 	Y	Y	N
Recovery 	Y	N	Y
EDL 	Y	Y	Y
== Bootloader ==
The bootloader (ABL) is supported by :Fwupd and can be upgraded.
=== Unlock bootloader ===
To unlock the bootloader, you need to allow unlocking it via enabling OEM unlocking within Android.
# Go to Settings within Android and select About
# Tap on Build number seven times to enable developer options
# Go back and select System, Advanced and scroll down to Developer options
# Enable Advanced restart and OEM unlocking
# Reboot into bootloader by long pressing the power button, selecting Restart and Bootloader
After it has successfully rebooted into Fastboot mode, initiate unlocking the bootloader using fastboot:
$ fastboot flashing unlock
Please follow the prompts on the screen to finish unlocking the bootloader.
=== Customization ===
==== Custom AVB key ====
The bootloader has support for setting an user provided AVB key to allow relocking the bootloader if an OS with proper support is flashed.
This is realized with exposing a virtual partition avb_custom_key where the custom user key can be flashed to:
$ fastboot flash avb_custom_key avb_key.bin
For more information please refer to the commit FastbootCmds: oem device-info: check if user public key is set.
==== Developer mode ====
Supported since version 3.9.20221006 and enabling it has the following effects:
* Ignore slot retry counter
** Disables marking slots as unbootable
* Switch active slots within the bootloader GUI
To enable developer mode:
$ fastboot oem enable-developer-mode
To disable developer mode:
$ fastboot oem disable-developer-mode
To check the current status of developer mode:
$ fastboot oem device-info
(bootloader) Developer mode enabled: true/false
==== Mainline optimization ====
Bootloaders since version 3.9.20221006 support additional fastboot oem commands to enable certain Quality of Life improvements when running mainline.
To enable mainline optimization:
$ fastboot oem enable-mainline-optimization
To disable mainline optimization:
$ fastboot oem disable-mainline-optimization
To check the current status of mainline support:
$ fastboot oem device-info
(bootloader) Mainline optimization enabled: true/false
== Fastbootd ==
Fastbootd is a userspace implementation of Fastboot.
For axolotl it is located within the recovery.
To access it, you can boot the recovery and select a menu option to enter fastbootd mode.
Optionally you can also enter it via ADB and Fastboot:
$ # Enter fastbootd via adb
$ adb reboot fastboot
$ # Enter fastbootd via fastboot
$ fastboot reboot fastboot
You can only access dynamic partitions within fastbootd.
== Installation ==
Follow the pmbootstrap instructions to build your own image, using shift as the vendor and axolotl as the codename but stop before following flashing instructions, as these are different for axolotl.
There are currently different ways to install postmarketOS (only select one).
=== UBports Installer ===
You can use UBports Installer to flash a prebuilt image of postmarketOS onto your SHIFT6mq. Just select postmarketOS in the OS selection and choose the desired UI and lean back!
=== Manual installation on userdata partition ===
Installation on userdata is the most generic and universally supported way, however it does not allow for dual boot or utilizing the full flash storage of the device.
Reboot into Fastboot mode and install postmarketOS:
$ # Flash rootfs to userdata partition
$ pmbootstrap flasher flash_rootfs --partition userdata
$ # Flash kernel to boot
$ pmbootstrap flasher flash_kernel
$ # Erase dtbo partition, as it conflicts with our mainline kernel
$ # Note: this operation takes some time to complete
$ fastboot erase dtbo
$ # Reboot into postmarketOS
$ fastboot reboot
=== Manual installation on super partition ===
First select a slot (a or b) you want to install postmarketOS on.
To install on super partition, a valid recovery with proper fastbootd implementation needs to be installed into the slot, which you want to install postmarketOS on.
You can download the stock recovery image, provided by the manufacturer and install it within Fastboot mode:
$ # Install recovery in "a" slot
$ fastboot flash recovery_a recovery_stock.img
Enter Fastbootd and ensure it is working as expected:
$ # Set "a" as active slot and reboot to fastbootd
$ fastboot --set-active=a
$ fastboot reboot fastboot
$ # Verify current slot is "a"
$ fastboot getvar current-slot
After you verified fastbootd works in the slot you have selected, you can install postmarketOS:
$ # Flash rootfs to system_a partition
$ pmbootstrap flasher flash_rootfs --partition system_a
$ # Flash kernel to boot
$ pmbootstrap flasher flash_kernel --partition boot_a
$ # Reboot to bootloader, as erasing dtbo is not working in fastbootd
$ fastboot reboot bootloader
$ # Erase dtbo_a partition, as it conflicts with our mainline kernel
$ # Note: this operation takes some time to complete
$ fastboot erase dtbo_a
$ # Reboot into postmarketOS
$ fastboot reboot
The phone will now always boot into postmarketOS until you switch slots with fastboot again:
$ fastboot --set-active=b
== Partition map ==
 beep:~$ sudo gdisk -l /dev/sda
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Warning! Main partition table overlaps the first partition by 6 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sda: 29765632 sectors, 113.5 GiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): A066299D-8C81-0394-2A42-780CDF59A84B
Partition table holds up to 32 entries
Main partition table begins at sector 2 and ends at sector 2
First usable sector is 6, last usable sector is 29765626
Partitions will be aligned on 2-sector boundaries
Total free space is 0 sectors (0 bytes)
Number Start (sector) End (sector) Size Code Name
 1 6 7 8.0 KiB A02C ssd
 2 8 8199 32.0 MiB A026 persist
 3 8200 8455 1024.0 KiB A01F misc
 4 8456 8583 512.0 KiB A02D keystore
 5 8584 8711 512.0 KiB FFFF oem
 6 8712 8839 512.0 KiB FFFF frp
 7 8840 3154567 12.0 GiB FFFF super
 8 3154568 3158663 16.0 MiB FFFF metadata
 9 3158664 29765626 101.5 GiB A03A userdata
beep:~$ sudo gdisk -l /dev/sdb
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/sdb: 1024 sectors, 4.0 MiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): F3CBB5D3-3124-BE05-2C19-1F43C179B3EC
Partition table holds up to 32 entries
Main partition table begins at sector 2 and ends at sector 2
First usable sector is 6, last usable sector is 1018
Partitions will be aligned on 2-sector boundaries
Total free space is 85 sectors (340.0 KiB)
Number Start (sector) End (sector) Size Code Name
 1 6 901 3.5 MiB A012 xbl_a
 2 902 933 128.0 KiB FFFF xbl_config_a
 3 934 1018 340.0 KiB FFFF last_parti
beep:~$ sudo gdisk -l /dev/sdc
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/sdc: 1024 sectors, 4.0 MiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): 30462848-044C-9159-BC91-584C52DE397A
Partition table holds up to 32 entries
Main partition table begins at sector 2 and ends at sector 2
First usable sector is 6, last usable sector is 1018
Partitions will be aligned on 2-sector boundaries
Total free space is 85 sectors (340.0 KiB)
Number Start (sector) End (sector) Size Code Name
 1 6 901 3.5 MiB A012 xbl_b
 2 902 933 128.0 KiB FFFF xbl_config_b
 3 934 1018 340.0 KiB FFFF last_parti
beep:~$ sudo gdisk -l /dev/sdd
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/sdd: 32768 sectors, 128.0 MiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): FDA3E752-75E6-C6AC-FF7A-14D41DA71B6B
Partition table holds up to 32 entries
Main partition table begins at sector 2 and ends at sector 2
First usable sector is 6, last usable sector is 32762
Partitions will be aligned on 2-sector boundaries
Total free space is 32443 sectors (126.7 MiB)
Number Start (sector) End (sector) Size Code Name
 1 6 31 104.0 KiB FFFF ALIGN_TO_128K_1
 2 32 63 128.0 KiB A01B cdt
 3 64 319 1024.0 KiB A01A ddr
 4 320 32762 126.7 MiB FFFF last_parti
beep:~$ sudo gdisk -l /dev/sde
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/sde: 1048576 sectors, 4.0 GiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): 405FB141-98DB-DAE5-BD7C-3CBD70D53BA7
Partition table holds up to 64 entries
Main partition table begins at sector 2 and ends at sector 3
First usable sector is 6, last usable sector is 1048570
Partitions will be aligned on 1-sector boundaries
Total free space is 799435 sectors (3.0 GiB)
Number Start (sector) End (sector) Size Code Name
 1 6 133 512.0 KiB FFFF aop_a
 2 134 645 2.0 MiB FFFF tz_a
 3 646 773 512.0 KiB A017 hyp_a
 4 774 31493 120.0 MiB 0700 modem_a
 5 31494 31749 1024.0 KiB FFFF bluetooth_a
 6 31750 32773 4.0 MiB FFFF mdtpsecapp_a
 7 32774 40965 32.0 MiB FFFF mdtp_a
 8 40966 41221 1024.0 KiB FFFF abl_a
 9 41222 49413 32.0 MiB FFFF dsp_a
 10 49414 49541 512.0 KiB FFFF keymaster_a
 11 49542 65925 64.0 MiB FFFF boot_a
 12 65926 66053 512.0 KiB FFFF cmnlib_a
 13 66054 66181 512.0 KiB FFFF cmnlib64_a
 14 66182 66213 128.0 KiB FFFF devcfg_a
 15 66214 66229 64.0 KiB FFFF qupfw_a
 16 66230 66245 64.0 KiB FFFF vbmeta_a
 17 66246 68293 8.0 MiB FFFF dtbo_a
 18 68294 68325 128.0 KiB FFFF storsec_a
 19 68326 68581 1024.0 KiB FFFF ImageFv_a
 20 68582 93157 96.0 MiB EF00 recovery_a
 21 93158 93173 64.0 KiB FFFF vbmeta_system_a
 22 93174 93189 64.0 KiB FFFF vbmeta_vendor_a
 23 93190 93317 512.0 KiB FFFF aop_b
 24 93318 93829 2.0 MiB A016 tz_b
 25 93830 93957 512.0 KiB FFFF hyp_b
 26 93958 124677 120.0 MiB FFFF modem_b
 27 124678 124933 1024.0 KiB FFFF bluetooth_b
 28 124934 125957 4.0 MiB FFFF mdtpsecapp_b
 29 125958 134149 32.0 MiB FFFF mdtp_b
 30 134150 134405 1024.0 KiB FFFF abl_b
 31 134406 142597 32.0 MiB FFFF dsp_b
 32 142598 142725 512.0 KiB FFFF keymaster_b
 33 142726 159109 64.0 MiB A036 boot_b
 34 159110 159237 512.0 KiB FFFF cmnlib_b
 35 159238 159365 512.0 KiB FFFF cmnlib64_b
 36 159366 159397 128.0 KiB FFFF devcfg_b
 37 159398 159413 64.0 KiB FFFF qupfw_b
 38 159414 159429 64.0 KiB FFFF vbmeta_b
 39 159430 161477 8.0 MiB FFFF dtbo_b
 40 161478 161509 128.0 KiB FFFF storsec_b
 41 161510 161765 1024.0 KiB FFFF ImageFv_b
 42 161766 186341 96.0 MiB FFFF recovery_b
 43 186342 186357 64.0 KiB FFFF vbmeta_system_b
 44 186358 186373 64.0 KiB FFFF vbmeta_vendor_b
 45 186374 186377 16.0 KiB A01D sec
 46 186378 186378 4.0 KiB A021 devinfo
 47 186379 186634 1024.0 KiB FFFF dip
 48 186635 186698 256.0 KiB A022 apdp
 49 186699 186762 256.0 KiB A023 msadp
 50 186763 188810 8.0 MiB FFFF spunvm
 51 188811 197166 32.6 MiB FFFF splash
 52 197167 197167 4.0 KiB A040 limits
 53 197168 197423 1024.0 KiB FFFF toolsfv
 54 197424 199471 8.0 MiB FFFF logfs
 55 199472 199983 2.0 MiB FFFF sti
 56 199984 232751 128.0 MiB A01C rawdump
 57 232752 249135 64.0 MiB FFFF logdump
 58 249136 1048570 3.0 GiB FFFF last_parti
beep:~$ sudo gdisk -l /dev/sdf
GPT fdisk (gdisk) version 1.0.10
Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/sdf: 393216 sectors, 1.5 GiB
Model: H28S8Q302CMR
Sector size (logical/physical): 4096/4096 bytes
Disk identifier (GUID): 8969EFAC-14F0-A607-B0D3-195CAFCF2A9D
Partition table holds up to 32 entries
Main partition table begins at sector 2 and ends at sector 2
First usable sector is 6, last usable sector is 393210
Partitions will be aligned on 2-sector boundaries
Total free space is 391611 sectors (1.5 GiB)
Number Start (sector) End (sector) Size Code Name
 1 6 31 104.0 KiB FFFF ALIGN_TO_128K_2
 2 32 543 2.0 MiB A027 modemst1
 3 544 1055 2.0 MiB A028 modemst2
 4 1056 1567 2.0 MiB A02A fsg
 5 1568 1599 128.0 KiB A029 fsc
 6 1600 393210 1.5 GiB FFFF last_parti
 axolotl:/ # df -h 
 Filesystem Size Used Avail Use% Mounted on
 tmpfs 3.7G 1.5M 3.7G 1% /dev
 tmpfs 3.7G 0 3.7G 0% /mnt
 /dev/block/sda8 11M 160K 11M 2% /metadata
 /dev/block/dm-1 1.2G 849M 476M 65% /
 /dev/block/dm-2 971M 489M 482M 51% /system_ext
 /dev/block/dm-0 1.8G 378M 1.4G 21% /product
 /dev/block/dm-3 732M 482M 250M 66% /vendor
 tmpfs 3.7G 8.0K 3.7G 1% /apex
 tmpfs 3.7G 524K 3.7G 1% /linkerconfig
 /dev/block/sda2 27M 0.9M 26M 4% /mnt/vendor/persist
 /dev/block/sde5 64M 704K 63M 2% /vendor/bt_firmware
 /dev/block/sde4 120M 115M 5.0M 96% /vendor/firmware_mnt
 /dev/block/sde9 27M 24M 3.1M 89% /vendor/dsp
 /dev/block/dm-8 101G 1.7G 100G 2% /data
 tmpfs 3.7G 0 3.7G 0% /data_mirror
 /data/media 101G 1.7G 100G 2% /mnt/runtime/default/emulated
 /dev/fuse 101G 1.7G 100G 2% /mnt/user/0/emulated
== UART ==
=== Requirements ===
* SHIFT6mq
* Screwdriver that came with your SHIFT6mq
** Alternatively any T4 Torx screwdriver should be suitable
* Wires to connect test points
* UART-TTL USB Adapter (I have used this one)
==== Optionally ====
Depending on whether you want to permanently have wires attached to your 6mq (which makes it less suitable as an actually usable phone) or just a temporary connection, you need:
* Soldering iron
** And a steady hand!
* Something to temporary hold the wires in place during your UART usage
=== Removing the case ===
First of all, properly shutdown your 6mq in case it is powered on!
Next remove the backcover, remove the battery and unscrew all 14 screws securing the housing of the 6mq.
Gently insert your fingernail (or any tool for this purpose) between display and the device frame to loosen their connection and remove the display.
You can also follow this iFixit guide until Step 5.
=== Removing the top PCB ===
Remove the connector (responsible for the POWER and VOLUME buttons) on the right side at the top PCB to expose another screw.
Then remove all 3 screws as shown in the picture.
Afterwards gently remove the top PCB.
After you have removed the top PCB, the test points we need are still covered by the SIM card tray.
=== Remove SIM card tray from top PCB ===
Gently pry off the SIM card tray - YouTube
=== Explanation of test points ===
After removing the SIM card tray, the test points we need for UART are exposed.
These are the test points together with the color of the wire used in this guide:
* TH - Thermal test point -> blue
* 1.8 (left) -> green
* 1.8 (right) -> yellow
** You can connect these two points while booting up to force boot into EDL mode
** Especially useful if you ever brick the bootloader, as it allows you to unbrick your device using QFIL
* T - Transmit -> orange
* R - Receive -> red
* G - Ground -> brown
File:SHIFT SHIFT6mq axolotl uart top pcb color coded.jpg|alt=Top PCB of the SHIFT6mq with color coded wires soldered
File:SHIFT SHIFT6mq axolotl uart top pcb color coded alternative.jpg|alt=A different angle of the top PCB with color codede wires
T, R and G are required for UART.
=== Extras for permanent connections ===
If you want to keep using the device's housing when having UART wires soldered, you may need to extend the SIM card tray opening to guide the wires through.
This is possible with soldering away the housing itself.
When putting the device together, be sure to carefully connect the fingerprint reader connector, as this is a bit tricky to connect.
=== Usage of UART ===
If you want to use UART for reading logs, connect as follows:
* T (orange) of the PCB to RXD of the USB adapter card
* G (brown) of the PCB to GND of the USB adapter card
Afterwards launch minicom (or any other program you prefer):
 sudo minicom -D /dev/ttyUSB0
== Camera ==
The state of the implementation of the camera is tracked on https://gitlab.com/sdm845-mainline/linux/-/issues/21
== Troubleshooting ==
If your 4G connection only shortly appears and then falls back to 2G/3G, your EPS initial bearer might be wrong.
You can check if the EPS bearer is wrong if there's no initial bearer path in the output of mmcli -m any under the 3GPP category.
For Telenet (Belgium), you need to clear username, password and APN of the initial bearer. There's no UI for it, but you can with mmcli:
 mmcli -m any --3gpp-set-initial-eps-bearer-settings="ip-type=ipv4,user=,password=,apn="
After that, disable and enable your modem in GNOME Settings.
== See also ==
* Initial merge request
* Mainline bringup
* 
* 
* OEM bootloader (edk2) sources
* Sources for generating axolotl's fwupd packages
__FORCETOC__
Category:Devices with known UART pinout