Dear OpenWRT community,
are some developers interested in getting OpenWRT to work on the Zyxel NR7302?
A few insights on how to flash the device and also access the modem recovery mode (but needs soldering of at least two wires for USB 2.0 and a GND connection) has been made.
If anyone is interested in starting the project?
The devices are selling relatively cheap on eBay for around 80 EUR without password stickers, but there is already a method to retrieve admin/root password.
Great,
we also have this device and already got some findings.
To document these here:
root@NR7302:~# cat /proc/device-tree/model
Qualcomm Technologies, Inc. SDXLEMUR MTP MBB NTN3 PCIE V2
root@NR7302:~# cat /etc/os-release
ID=qti-distro-nogplv3-debug
NAME="QTI Linux reference nogplv3 distro with debug capabilities."
VERSION="LE.UM.6.2.3.r1-03100-SDX65.0"
VERSION_ID=le.um.6.2.3.r1-03100-sdx65.0
PRETTY_NAME="QTI Linux reference nogplv3 distro with debug capabilities. LE.UM.6.2.3.r1-03100-SDX65.0"
root@NR7302:~# uname -a
Linux NR7302 5.4.210 #9 PREEMPT Thu Jun 6 15:04:29 CST 2024 armv7l GNU/Linux
root@NR7302:~# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 38.40
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5
Hardware : Qualcomm Technologies, Inc. SDXLEMUR (Flattened Device Tree)
Revision : 0000
Serial : 0000000000000000
root@NR7302:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00280000 00040000 "sbl"
mtd1: 00100000 00040000 "mibib"
mtd2: 01600000 00040000 "efs2"
mtd3: 00280000 00040000 "rawdata"
mtd4: 00380000 00040000 "sys_rev"
mtd5: 00280000 00040000 "cust_info"
mtd6: 00200000 00040000 "tz"
mtd7: 00140000 00040000 "tz_devcfg"
mtd8: 00140000 00040000 "ddr"
mtd9: 00140000 00040000 "apdp"
mtd10: 00140000 00040000 "xbl_config"
mtd11: 00100000 00040000 "xbl_ramdump"
mtd12: 00140000 00040000 "multi_image"
mtd13: 00100000 00040000 "multi_image_qti"
mtd14: 00140000 00040000 "aop"
mtd15: 00140000 00040000 "qhee"
mtd16: 00140000 00040000 "abl"
mtd17: 00340000 00040000 "uefi"
mtd18: 00140000 00040000 "toolsfv"
mtd19: 00140000 00040000 "loader_sti"
mtd20: 00100000 00040000 "logfs"
mtd21: 00140000 00040000 "devinfo"
mtd22: 00140000 00040000 "sec"
mtd23: 00a80000 00040000 "multi_fota"
mtd24: 00140000 00040000 "misc"
mtd25: 00140000 00040000 "ipa_fw"
mtd26: 00140000 00040000 "usb_qti"
mtd27: 01700000 00040000 "boot"
mtd28: 01700000 00040000 "b_boot"
mtd29: 05b00000 00040000 "modem"
mtd30: 05b00000 00040000 "b_modem"
mtd31: 06500000 00040000 "system"
mtd32: 06500000 00040000 "b_system"
mtd33: 03d00000 00040000 "oemapp"
mtd34: 03d00000 00040000 "b_oemapp"
mtd35: 01f00000 00040000 "oemdata"
mtd36: 00100000 00040000 "factory"
mtd37: 00180000 00040000 "rom-d"
mtd38: 06500000 00040000 "syslog"
mtd39: 10a00000 00040000 "usrdata"
root@NR7302:~# iw phy
Wiphy phy0
wiphy index: 0
max # scan SSIDs: 9
max scan IEs length: 2304 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Available Antennas: TX 0 RX 0
Supported interface modes:
* IBSS
* managed
* AP
* P2P-client
* P2P-GO
Band 1:
Capabilities: 0x1962
HT20/HT40
Static SM Power Save
RX HT20 SGI
RX HT40 SGI
RX STBC 1-stream
Max AMSDU length: 7935 bytes
DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 16 usec (0x07)
HT Max RX data rate: 150 Mbps
HT TX/RX MCS rate indexes supported: 0-7
Frequencies:
* 2412 MHz [1] (17.0 dBm)
* 2417 MHz [2] (17.0 dBm)
* 2422 MHz [3] (17.0 dBm)
* 2427 MHz [4] (17.0 dBm)
* 2432 MHz [5] (17.0 dBm)
* 2437 MHz [6] (17.0 dBm)
* 2442 MHz [7] (17.0 dBm)
* 2447 MHz [8] (17.0 dBm)
* 2452 MHz [9] (17.0 dBm)
* 2457 MHz [10] (17.0 dBm)
* 2462 MHz [11] (17.0 dBm)
* 2467 MHz [12] (17.0 dBm)
* 2472 MHz [13] (17.0 dBm)
* 2484 MHz [14] (disabled)
valid interface combinations:
* #{ managed, P2P-client } <= 2, #{ AP, P2P-GO } <= 1,
total <= 2, #channels <= 1
Supported extended features:
We would need some help to create a dts and openwrt firmware though, but root access is possible. I don't know if this is already publically mentioned somewhere and I would rather not burn the information myself.
Do you already have something more @equinox ?
Best regards
Getting root is already documented on Github.
Is there a way to send you a Discord-Invite?
Thanks.
I managed to create a dts file from the /sys/firmware/fdt of this device, which gave quite a lot of warnings:
output.dts: Warning (reg_format): /soc/qcom,glink/modem/qcom,gpr:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1)
output.dts: Warning (reg_format): /soc/qcom,glink/modem/qcom,gpr/spf_core:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1)
output.dts: Warning (reg_format): /soc/qcom,glink/modem/qcom,gpr/audio-pkt:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1)
output.dts: Warning (reg_format): /soc/qcom,glink/modem/qcom,gpr/audio_prm:reg: property has invalid length (4 bytes) (#address-cells == 2, #size-cells == 1)
output.dts: Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /reserved-memory/llcc_tcm_region: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/dload_mode: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/clock-controller@0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/rsc@17830000/clock-controller@1: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,smp2p-modem@1799000c: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,glink/modem/qcom,gpr: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,glink/modem/qcom,gpr/spf_core: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,glink/modem/qcom,gpr/audio-pkt: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,glink/modem/qcom,gpr/audio_prm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmk8350_ref_gnd: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmk8350_vref_1p25: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmk8350_die_temp: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmk8350_xo_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_pa_therm1: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_pa_therm2: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_mdm_case_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_ambient_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_qtm_skin_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/pmx65_die_temp: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/adc0: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/adc1: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/vadc@3100/vph_pwr: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/adc_tm@3400/pmx65_pa_therm1: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/adc_tm@3400/pmx65_pa_therm2: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/adc_tm@3400/pmx65_mdm_case_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/adc_tm@3400/pmx65_ambient_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,spmi@c440000/qcom,pmk8350@0/adc_tm@3400/pmx65_qtm_skin_therm: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,lpm-levels/qcom,pm-cluster@0/qcom,pm-cpu@0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,pcie@1c00000/pcie0_rp: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,pcie@1c00000/pcie0_rp/cnss_pci: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/qcom,pcie@1c00000/pcie0_rp/pcie0_generic_ep: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/i2c@837000/tavil_codec: node has a reg or ranges property, but no unit name
output.dts: Warning (unit_address_vs_reg): /soc/i2c@837000/tavil_codec/wcd_pinctrl@5: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/msm_cdc_pinctrl@49: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/aqc_rx@eth0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/aqc_tx@eth0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/r8125_rx@eth0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/r8125_tx@eth0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,cnss-qca6490@b0000000/mhi_events/mhi_event@0: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,cnss-qca6490@b0000000/mhi_events/mhi_event@1: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_vs_reg): /soc/qcom,cnss-qca6490@b0000000/mhi_events/mhi_event@2: node has a unit name, but no reg or ranges property
output.dts: Warning (unit_address_format): /reserved-memory/aop_regions@0x8fe00000: unit name should not have leading "0x"
output.dts: Warning (unit_address_format): /reserved-memory/secdata_region@0x8fcfd000: unit name should not have leading "0x"
output.dts: Warning (unit_address_format): /reserved-memory/ipa_fw_region@0x8fced000: unit name should not have leading "0x"
output.dts: Warning (unit_address_format): /soc/clock-controller@0x100000: unit name should not have leading "0x"
output.dts: Warning (unit_address_format): /soc/mailbox@0x17811000: unit name should not have leading "0x"
output.dts: Warning (unit_address_format): /soc/qcom,ipa@03e00000: unit name should not have leading 0s
output.dts: Warning (unit_address_format): /soc/tpdm@06990000: unit name should not have leading 0s
output.dts: Warning (pci_device_reg): Failed prerequisite 'reg_format'
output.dts: Warning (pci_device_bus_num): Failed prerequisite 'reg_format'
output.dts: Warning (simple_bus_reg): Failed prerequisite 'reg_format'
output.dts: Warning (i2c_bus_reg): Failed prerequisite 'reg_format'
output.dts: Warning (spi_bus_reg): Failed prerequisite 'reg_format'
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr: Relying on default #address-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr: Relying on default #size-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/spf_core: Relying on default #address-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/spf_core: Relying on default #size-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/audio-pkt: Relying on default #address-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/audio-pkt: Relying on default #size-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/audio_prm: Relying on default #address-cells value
output.dts: Warning (avoid_default_addr_size): /soc/qcom,glink/modem/qcom,gpr/audio_prm: Relying on default #size-cells value
output.dts: Warning (avoid_unnecessary_addr_size): Failed prerequisite 'avoid_default_addr_size'
output.dts: Warning (unique_unit_address): Failed prerequisite 'avoid_default_addr_size'
output.dts: Warning (interrupts_property): /soc/wcd9xxx-irq: Missing interrupt-controller or interrupt-map property
output.dts: Warning (graph_child_address): /soc/replicator@6046000/out-ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
output.dts: Warning (graph_child_address): /soc/funnel@680c000/in-ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
output.dts: Warning (graph_child_address): /soc/funnel@6005000/in-ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
output.dts: Warning (graph_child_address): /soc/funnel@69e2000/in-ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary
The final output dts is available here:
Though it looks not very clean in contrast to the ones for new devices.
By the way, the mentioned Github documentation of this device is found here:
Hi everyone, and thanks to @fmaurer for pointing me to this thread.
This device looks interesting (and cheap), however we are not dealing with a Qualcomm wireless SoC (IPQ) here, this is Snapdragon X65 (Codename Lemur, successor of the SDX55 alias SDX Prairie). I have a few devices with SDX55 already (D-Link DWR-2101 portable router and DWP-1010 outdoor CPE), but the next steps for these would probably be adding support in postmarketOS.
SDX55 is even in mainline, and there are some devices (5G modules) supported, but adding this new target to OpenWrt would probably be a lot of effort (though I hope to see it one day).
These routers are not even like Android phones without screen (which have an application processor that talks to the baseband processor), these things are just the baseband processor.
As seen in the log, they run QTI Linux, which even uses a preempt kernel since it has to take care of many real-time tasks in the modem, and load binary blobs into the modem hardware underneath etc..
So, it's definitely feasible to run a customized Linux on this thing (and learning postmarketOS has been on my list for years), but I'm not sure how much of the kernel patches requires by gluon would be adaptable to postmarketOS, or how simple it would be to support this new target in OpenWrt.
Some progress has been made with very old cellular Qualcomm MSM89xx chipsets (found in ~10 $ LTE dongles with 150MBit/s), there is a fork of OpenWrt that supports these https://github.com/HandsomeMod/HandsomeMod and quite some discussion is also happening here in the forum UF896 - Qualcomm MSM8916 LTE router ~384MiB RAM/2.4GiB flash, Android: OpenWrt?, so I hope one day we can also have SDX55 and SDX65 devices, but at the moment this is beyond my skill level 
//edit:
Since last year, I've been struggling with DWR-978, which is MT7622 + SDX55 conencted via MHI (both PCIE and USB), it kind of works sometimes but is annoying, e.g. some pins need to be pulled before performing reboot otherwise the modem won't come up... when it does not, triggering a pci rescan in the kernel would find it, but modemmanager would not see it etc...
the 21GB gpl tar ball by Zyxel is available here, in-case anyone wants to take a look
but it's a lot to take in
this will be useful:
https://www.lteforum.at/mobilfunk/nr7302-ohne-passwortaufkleber.24838/
and maybe also this
There is also sdx65.dtsi already, these have been mainlined by the linaro project, according to their status page most basic peripherals should work:
it just needs someone to port this as a new target to OpenWrt, and I'm not sure about the PREEMPT stuff (and lots of binary blobs required to get cellular working at all).