[extrowerk] tells us about a new hacker-friendly device – a $20 LTE modem stick with a quadcore CPU and WiFi, capable of running fully-featured Linux distributions. This discovery hinges on a mountain of work by a Chinese hacker [HandsomeYingYan], who’s figured out this stick runs Android, hacked its bootloader, tweaked a Linux kernel for it and created a Debian distribution for the stick – calling this the OpenStick project. [extrowerk]’s writeup translates the [HandsomeYingYan]’s tutorial for us and makes a few more useful notes. With this writeup in hand, we have unlocked a whole new SBC to use in our projects – at a surprisingly low price!
At times when even the simplest Pi Zero is unobtainium (yet again!), this is a wonderful find. For a bit over the price of a Zero 2W, you get a computer with a similar CPU (4-core 1GHz A53-based Qualcomm MSM8916), same amount of RAM, 4GB storage, WiFi – and an LTE modem. You can stick this one into a powerbank or a wallwart and run it at a remote location, make it into a home automation hub, or perhaps, process some CPU-intensive tasks in a small footprint. You can even get them with a microSD slot for extra storage – or perhaps, even extra GPIOs? You’re not getting a soldering-friendly GPIO header, but it has a few LEDs and, apparently, a UART header, so it’s not all bad. As [extrowerk] points out, this is basically a mobile phone in a stick form factor, but without the display and the battery.
Now, there’s caveats. [extrowerk] points out that you should buy the modem with the appropriate LTE bands for your country – and that’s not the only thing to watch out for. A friend of ours recently obtained a visually identical modem; when we got news of this hack, she disassembled it for us – finding out that it was equipped with a far more limited CPU, the MDM9600. That is an LTE modem chip, and its functions are limited to performing USB 4G stick duty with some basic WiFi features. Judging by a popular mobile device reverse-engineering forum’s investigations (Russian, translated), looks like the earlier versions of this modem came with the way more limited MDM9600 SoC, not able to run Linux like the stick we’re interested in does. If you like this modem and understandably want to procure a few, see if you can make sure you’ll get MSM8916 and not the MDM9600.
Days of using WiFi routers to power our robots are long gone since the advent of Raspberry Pi, but we still remember them fondly, and we’re glad to see a router stick with the Pi Zero 2W oomph. We’ve been hacking at such sticks for over half a decade now, most of them OpenWRT-based, some as small as an SD card reader. Now, when SBCs are hard to procure, this could be a perfect fit for one of your next projects.
Update: in the comments below, people have found a few links where you should be able to get one of these modems with the right CPU. Also, [Joe] has started investigating the onboard components!
someone make a usb hub for this stick
https://momoe.ml/shizuku/084639.html
https://oshwhub.com/zy143l/ufi_hub_lite_share
Hi,
do you have some intressting use cases for this Linux USB Stick ?
I am thinking how to add one USB port … would be perfect to turn that into a small “to-go-server”.
where can I get the firmware for 4g lte USD Dongle wifi with Qulacomm 8916 chip. Also the firmware flashing tool
can someone please share/upload UF896_V1.1 stock rom for msm8916 qualcomm 4ge lte dongle
https://github.com/mbahmodin/UF896_V1.1-EMMC-Dump
This worked for me:
https://github.com/OpenStick/OpenStick/issues/16#issuecomment-1319759067
…
adb connect 192.168.100.1:7628
…
Hello, sorry for necro’ing this discussion. I have recently bought a pair of these sticks for tinkering purposes. Inside of them is indeed a Qualcomm MSM8916 SoC (aka. Snapdragon 410) and a Kingston 4 GB eMMC flash chip so I believe they should be compatible with supplied Debian images.
Issue is that those sticks do not seem to expose ADB mode (my guess the firmware was updated). I’ve heard from a forum discussion (someone was trying to recover from a failed flash) that there’s some kind of recovery mode which can be entered by shorting certain pins but I have lost a link to that forum discussion.
Does anyone else have one of these sticks with newer firmware and know how to enter recovery mode or enable ADB on them ?
Yes you can enter EDL mode by shorting on USB side GND and D+
You can have a look here: https://forum.openwrt.org/t/uf896-qualcomm-msm8916-lte-router-384mib-ram-2-4gib-flash-android-openwrt/131712/164?page=5
Thanks for information. I have already figured out myself how to enable ADB. It can be done simply by visiting /usbdebug.html on the stock web UI. This page has no content but opening it will enable the built-in ADB server.
I flashed Debian on one stick and kept the other with stock firmware for now. Both of my sticks have UZ801 V3.0 PCBs. As described in the OpenStick Github page, modem does not seem to work. SIM card is detected but not enabled. I will need to investigate the other stick to see if I can find out anything about how the modem works. I suspect this is a configuration issue due to differences between PCB versions.
Interestingly, the stock firmware build on both of my sticks is very recent – kernel build date is February, 2023. I’ll upload a firmware dump somewhere if I can figure out how to correctly dump everything.
Hello, sorry for necro’ing this discussion. I have recently bought a pair of these sticks for tinkering purposes. Inside of them is indeed a Qualcomm MSM8916 SoC (aka. Snapdragon 410) and a Kingston 4 GB eMMC flash chip so I believe they should be compatible with supplied Debian images.
Issue is that those sticks do not seem to expose ADB mode (my guess the firmware was updated). I’ve heard from a forum discussion (someone was trying to recover from a failed flash) that there’s some kind of recovery mode which can be entered by shorting certain pins but I have lost a link to that forum discussion.
Does anyone else have one of these sticks with newer firmware and know how to enter recovery mode or enable ADB on them ?
Really sorry for double-posting. I didn’t notice there was a “Newer comments” button.
For anyone who has bought one of these recently and is having modem issues under Debian, try copying files from stock firmware’s “modem” partition to /lib/firmware.
Modem firmware files shipped in the Debian image are device specific and do not work with all PCB versions of this stick. This has fixed modem under Debian on my UZ801 V3.0.
Files to copy are (inside /image directory): modem.*, wcnss.*, mba.mbn and modem_pr/mcfg/configs/mcfg_sw/generic/eu/ee/commerci/mcfg_sw.mbn. The last one is region specific, mine is for EU, there should be files for other regions as well.
Thank you so much ! it works !
I have been struggling for month to understand how to activate this @!& modem !
At least I see sim activated. Now I need to connect it to 4G network …
Glad to hear something worked for you. Because there’s some misleading information in OpenStick’s Chinese wiki page regarding certain models of sticks about modem not working. But as I initially suspected, this was a configuration issue.
Some updates regarding my UZ801 V3.0
The Debian stick has now regained it’s router functionality. To get the WiFi AP mode work without crashing, I had to grab the WiFi NVRAM file from /persist partition of the stock ROM. This file also seems to be device specific.
I’ve also re-built the kernel using the latest source code and added the correct DTS to get the LEDs working.
There still seem to be issues with overall device stability. Sometimes, device just randomly reboots by itself. Tried assigning one of the LEDs to panic trigger but either there is no kernel panic or the trigger just doesn’t work. Without access to UART, it’s hard to tell.
By changing DTB from the stock UFI001 to UZ801, device became more stable, now with over 10 hours of regular 4G use without reboots.
Since these sticks are quite cheaply made I wouldn’t rule out issues with hardware, especially power-related.
More things to try:
1. Bluetooth. It is detected and does appear to work without errors but I haven’t been able to pair with anything yet. Also, there are some kernel modules missing. Not sure about the antenna, I very much hope it uses the same one as WiFi.
2. USB host mode. I have an Y-cable with main and power-only plug’s 5V pins wired in parallel. The power-only plug should work to power devices at both ends. Now I need a USB A gender changer.
Will report back on this.
3. Video HW codecs. Reported as broken on the Chinese wiki. But again, the modem was also reported as broken on some models. This may very well be another config issue.
Will likely move further updates to my weblog at ddscentral dot org as I don’t feel very comfortable using this comment section for updates.
From my side I did not managed to activate 4G connection.
Modem stay in configuring (prepare) and never goes green.
Hope to check you further discovery on your indicated web site.
Final update here. Have some bad news. I believe I found the cause of reboots: overheating.
In my UZ801 V3.0, the main SoC, eMCP (RAM+eMMC in one chip) and LTE amplifier are located under one RF shield without any thermal pads connecting chips to RF shield. This means the chips will overheat under load, causing instability (mine reboots at about 97 °C). But just those thermal pads aren’t enough. You do need to install a small heatsink on the RF shield for stable operation. Which means the board will no longer fit in it’s original case.
As-is, these things are unusable for anything but the lightest of loads. But with some modding, they can be made stable.
BTW, the original ROM actually disables 2 out of 4 processor cores to reduce overheating.
Did you managed to see it by dissambling the original ROM or by other ways ? like strace ?
It is visible in multiple places in the original ROM. dmesg log, /proc/cpuinfo
/proc/config.gz is also available which has a config switch capping the number of CPUs to 2.
Well, I guess their thinking was that for basic 4G use you don’t really need all 4 cores. Indeed MSM8916 is overkill for basic router use at LTE speeds, even with all the Android GUI bloat of the original ROM.
i have a problem with the modem i have the version UZ801 V2
i copy the original firmware of the dongle to linux but if i enter “mmcli -m 0” :
i have this :
Status | lock: sim-pin2
| unlock retries: sim-pin (3), sim-puk (10), sim-pin2 (3), sim-puk2 (10)
| state: registered
| power state: on
| access tech: umts
| signal quality: 65% (cached)
without the orignal firmwares i have nothing. but i don’t understand beacause the sim is not blocked.
and if i enter “nmcli device status”:
the interface is not connected :
DEVICE TYPE STATE CONNECTION
usb0 ethernet connected USB
wlan0 wifi connected Wi-Fi connection 1
wwan0qmi0 gsm disconnected —
lo loopback unmanaged —
do you have ideas ?
Is there any way to get a stream of raw I/Q signal from SoC? That Qualcomm Linux kernel should have some source code relating to that, but cant find out.
.It would allow further decoding
Howdy,
I have ordered this one today: https://de.aliexpress.com/item/1005005750212397.html
It claims to be “qualcomm 8916” so I guess it will be a MSM8916. If there’s anyone interested I can report ;-)
They all look pretty much identical from the outside, it’s the insides that differ. These sticks went through many internal board revisions and it’s impossible to know in advance which one you will get.
When your stick arrives, it would be useful to note the PCB model and revision. Also, some pics of the PCB would be great.
Also, before you mod anything do yourself a favor and make a FULL dump of the internal flash. Different revisions of this stick use different (and sometimes incompatible) versions of firmware files. And you may need those files to get things like modem and WiFi working properly.
That’s the main reason I got a 2-pack even though I only needed one stick. To have one with stock ROM as a reference (and a spare should I manage to brick my original modded unit).
no backup no pity :-D Will do so and have pics ready as soon as it’s in my shack.
I have bought one to actually use it. Then I have read that it can be tinkered with. Just in case it is an MSM8916, I’ll order two or three more.
It reads QUALCOMM PM8916 :-D
AE633WSB E063302
Here we go:
https://photos.app.goo.gl/FN8FGFoY2XuajhC5A
Enjoy
Hope it works now…all Pictures:
https://photos.google.com/album/AF1QipNsvDHbqzIV92R7ow09qJQAOGJjKutY3X-kNWVd