Zhihe series LTE dongles (generic-zhihe)

== Contributors ==
* notfound405
== Users owning this device ==
== Naming ==
The name zhihe comes from an early online shop selling these devices. The shop had been gone for a long time but the name is widely used to refer to these devices now. It's spelled in Chinese "芷荷", also usually misspelled as "纸盒", both pronounced in pinyin "zhihe".
== How to enter flash mode ==
$ adb reboot edl # Qualcomm EDL, or
$ adb reboot bootloader # fastboot.
Note: only applies to stock Android system.
=== UFI-001C and many more with xinxun brand ===
By default, we get only shell permission with adb shell. However, you don't have to install SuperSU or Magisk for temporary root access. The following instruction is much easier for temporary root access:
$ adb shell
$ # Now you are in adb
$ setprop service.adb.root 1; busybox killall adbd
$ # wait for a few seconds
$ adb shell
$ # Now you get the root permission!
=== UZ801 V3.0 ===
adb interface is not enabled by default.
To enable adb access and root permission, plug this device into your PC and use browser to access this URL: http://192.168.100.1/usb_debug.html, and then reboot your device(replug it). You'll find an adb device and get root permission with adb shell.
See the section below if your device bricks.
=== UZ801 V3.2 ===
Similar to UZ801 V3.0, but the URL for enabling adb is http://192.168.100.1/usbdebug.html and no re-plugging is required.
== Debug UART pin and test pins ==
=== UZ801 V3.0 ===
Note: voltage: 1.8V
=== UFI103S, UFI001C(B), UFI003 etc. ===
They are clearly labeled on the board, the only button is the EDL button.
Note: voltage: 3.3V
IDK is it UFI003, because label on board is "UF003..."
== Partition layout ==
lrwxrwxrwx root root 1970-01-01 08:28 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-01 08:28 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-01 08:28 sbl1bak -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-01 08:28 aboot -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-01 08:28 abootbak -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-01 08:28 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-01 08:28 rpmbak -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-01 08:28 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-01 08:28 tzbak -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-01 08:28 hyp -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-01 08:28 hypbak -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-01 08:28 pad -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-01 08:28 modemst1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-01 08:28 modemst2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-01-01 08:28 misc -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-01 08:28 fsc -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-01 08:28 ssd -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-01-01 08:28 splash -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-01 08:28 DDR -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-01 08:28 fsg -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-01 08:28 sec -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-01 08:28 boot -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-01-01 08:28 system -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-01 08:28 persist -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-01-01 08:28 cache -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-01-01 08:28 recovery -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-01-01 08:28 userdata -> /dev/block/mmcblk0p27
== Preparation ==
The original Android image contains too old firmware to boot mainline kernel, use firmwares from Dragon Board 410c as replacement. Also, you may need qhypstub as well as lk1st (lk2nd is not recommended since vendor aboot firmwares vary and have different strange quirks which causes a lot of trouble).
$ # Please do NOT use a later release from linaro, the tz firmware becomes too large to flash to tz partition. Just use the link below.
$ wget https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
$ unzip dragonboard410c_bootloader_emmc_android-88.zip
$ # put your device into EDL mode or fastboot mode, flash sbl1(only required for uz801) and tz with the corresponding files extracted.
$ # That is, the minimum firmwares needed to be replaced are: for uz801, both sbl1 and tz; for other models, only tz.
$ # It is also required to flash hyp(see below). qhypstub is strongly recommended as a replacement instead of the hyp firmware from db410c because it supports booting Linux in EL2 so that KVM can be enabled. With hyp downloaded from linaro, linux can only boot in EL1 so KVM is not accessible. Although qhypstub is unofficial and not qualified by Qualcomm or Linaro so it's up to you using qhypstub or the official hyp firmware extracted from db410c.
$ # Either one of them is okay and enough to boot mainline Linux kernel. However, mixing the use of tz from linaro and stock hyp is not supported and causes device brick. Don't reboot the device unless both hyp and tz are replaced!
$ # Note: Flashing other images such as rpm/sbl1 is not recommended anymore. It is causing problems for some other models, better to keep them untouched.
For qhypstub and lk1st:
$ git clone https://github.com/msm8916-mainline/qhypstub.git
$ cd qhypstub; git clone https://github.com/msm8916-mainline/qtestsign.git
$ make CROSS_COMPILE=aarch64-linux-gnu-
$ # get the generated qhypstub-test-signed.mbn and store it somewhere
$
$ cd ..; git clone https://github.com/msm8916-mainline/lk2nd.git
$ # The command below assumes Ubuntu as the host OS and UZ801 as the device.
$ # You may also need to install some additional packages with a package manager.
$ # Refer to the README.md of the repository for detailed instructions. 
$ cd lk2nd; make LK1ST_DTB=msm8916-512mb-mtp LK1ST_COMPATIBLE=zhihe,uz801-v3 TOOLCHAIN_PREFIX=arm-none-eabi- lk1st-msm8916
$ ../qhypstub/qtestsign/qtestsign.py aboot build-lk1st-msm8916/emmc_appsboot.mbn
$ # get build-lk1st-msm8916/emmc_appsboot-test-signed.mbn and store it somewhere
$
$ # Now flash them to hyp and aboot partitions with EDL or fastboot.
Sadly, with the modifications above, it's impossible to boot original Android system anymore if you do not restore the original firmwares back. Say goodbye to the stock Android system, and do what you think necessary before proceeding, like modifying IMEI, switching SIM card slot and so on, since it's difficult to perform the tasks in postmarketOS.
== Installation ==
See Qualcomm_Snapdragon_410/412_(MSM8916)#Installation_using_pmbootstrap.
=== partition usage strategy ===
There are several strategies to make full use of the limited eMMC storage. They are listed below, feel free to add more.
==== Some common recommendations ====
# use btrfs for rootfs
#: $ pmbootstrap install --filesystem btrfs 
# reduce the size of /boot partition to 128 MB or even smaller (64MB should be enough to hold the contents, but a slightly larger size is recommended)
#: $ pmbootstrap config boot_size 128
==== Examples ====
# Flash the rootfs and /boot to system partition (not recommended)
#: $ pmbootstrap flasher flash_rootfs
#: The volume of system partiton is too low to hold a rootfs. It works, but the free space is very low, making it painful to use.
# Flash the rootfs and /boot to userdata partition (the easiest)
#: $ pmbootstrap flasher flash_rootfs --partition userdata
#: This one is the easiest, and the volume of userdata partition should be sufficient for common uses. The drawback is that a large amount of storage space is not used.
# split /boot and rootfs, and flash them to different partitions.
#: 
$ pmbootstrap install --split
$ pmbootstrap export
$ cd /tmp/postmarketOS-export/
$ img2simg *-root.img root.simg
$ # Put your device into fastboot mode
$ fastboot flash cache *-boot.img
$ fastboot flash system root.simg # or userdata
#: The operation is a bit complex, but you can make use of 2 different partitions, which reduces space wasting. It is recommended to flash /boot partition to cache partition and flash rootfs to system or userdata.
#: Drawback: not officially supported.
#: Note: you may mount the other partition (usually system or userdata, if you flash /boot to cache partition) to, e.g. /var/lib/docker with /etc/fstab and localmount, so that every large partitions can be used.
# repartition
#: There are two major choices, one is to replace the entire partition table and use your custom one, the other is to do minor modification with gptfdisk, leaving most partitions untouched.
## replace the entire partition table
##: You can do it with (s)gdisk in linux, fastboot flash partition in fastboot or edl tool in Qualcomm EDL mode.
##: No technical support here. It's dangerous and may brick your device, think twice before proceeding and be prepared to recovery your device in Qualcomm EDL mode.
## gptfdisk
##: This method is much safer than the previous one and probably will at least let the device boot to fastboot mode if you did something wrong. Generally, the easiest solution would be combining system and userdata together. You can do it with gdisk, sgdisk or any tools you like. Just delete all partitions after system and extend system to maximum.
##: Doing this in pmOS may be dangerous and sometimes impossible(the rootfs is mounted and active), so you can try do it from Debug shell / netboot or [MSM8916 fork of Jumpdrive].
Note: persist partition sits between system and userdata, and unfortunally WCNSS nv items file is stored in it, which need to be loaded during runtime for functionality of WCN36xx(WiFi). You have to backup and relocate persist partition before deleting it, or if you like, extract WCNSS_qcom_nv_items.bin and place it at /lib/firmware.
== Tips ==
=== Switch SIM card slot ===
Almost all of the devices here support multiple SIM cards. But can not use them simultaneously(i.e. only one can active at the same time)
==== UF(I)xxx devices ====
This series is using a more hardware-based way to control which card slot is in use. Steps:
# Try to get the GPIO number for sim_sel, esim1_sel, esim2_sel, sim_en. (from dts) For UFI001c, they are 2, 0, 3, 1 respectively.
# install gpiod-tools or use GPIO sysfs interface. Learn how to use them.
# 
$ # deactivate all slots
$ gpioset 1=1
$ # select the desired slot (eSIM1 for example)
$ gpioset 2=0 0=1 3=0
$ # activate it
$ gpioset 1=0
$ # Some delay might be essential. Recommend to add some delay commands in between if you are writing script
$ # You are recommended to run gpiod in background and acquire these pins permanently to avoid it being used by other programs
==== UZ801 ====
This series use a more software-based way. Most things are done in modem firmware. You only have to issue a custom AT command to the modem.
TBD
== See also ==
* Initial merge request
* 
*