OpenWrt support for Vodafone Gigacube (B157)

jav · July 2, 2025, 2:32pm

Looking into it.

First, you can do curl 'https://g2master-sa-east.tclclouds.com/check.php?mode=2&cktp=2&cltp=10&type=Firmware&id=[IMEI]&curef=[CU]&fv=[VER]'

Where:
IMEI is your IMEI
CU is DISTRIB_FOTA_CU variable from /etc/openwrt_release in the OEM firmware (HH500V-2XVDESX in my case)
VER is DISTRIB_FOTA variable from /etc/openwrt_release in the OEM firmware. If you try with lower numbers it will tell you possible firmware upgrades. In my case, it worked with 020010.

Getting the firmware is a little bit more complex:

args = "id={imei}&salt={time in milliseconds in 13 digits}123456&curef={cu}&fv={currentversion}&tv={finalversion}&type=Firmware&fw_id={FW_ID tag from XML}&mode=2&cltp=10"
string = args + "1271941121281905392291845155542171963889169361242115412511417616616958244916823523421516924614377131161951402261451161002051042011757216713912611682532031591181861081836612643016596231212872211620511861302106446924625728571011411121471811641125920123641181975581511602312222261817375462445966911723844130106116313122624220514"

args += "&vk=" + sha1(string).hex().upperCase()

curl -d "${args}" "https://g2master-eu-west.tclclouds.com/download_request.php"

It will return some XML data with a list of host and the URL for those hosts.

mkrle · July 2, 2025, 3:32pm

Check for firmware worked, but download did not.
Am I doing something obviously wrong?

https://g2master-eu-west.tclclouds.com/download_request.php?id=xxxxxxxxxxxxxxx&salt=1751469926992123456&curef=HH500V-2XLCNLX&fv=020006&tv=020007&type=Firmware&fw_id=598165&mode=2&cltp=10&vk=E208D3C5D1C9924975DA65FAF3A35E55A184BE21

returns:

<HTML><HEAD></HEAD><BODY><P>Missing 'id' mandatory parameter.</P><P>Missing 'fw_id' mandatory parameter.</P><P>Missing 'curef' mandatory parameter.</P><P>Missing 'vk' mandatory parameter.</P><P>Missing 'salt' mandatory parameter.</P><P>Missing 'fv' mandatory parameter.</P><P>Missing 'tv' mandatory parameter.</P><P>Missing 'type' mandatory parameter.</P><P>Missing 'mode' mandatory parameter.</P><P>Missing 'cltp' mandatory parameter.</P></BODY></HTML>

jav · July 2, 2025, 5:43pm

I'm sorry, a bit rusty. Fixed above. You need to do a POST request for the download, and it will get you the final download page.

mkrle · July 2, 2025, 5:45pm

Thanks, I was able to use the OEM executable to download the image. Useful as back-up, but since I already have it installed then it doesn't help much otherwise.

Now that I think about it, it may not necessarily be the modem upgrade that stabilizes PCI, could also be one of the Qualcomm partition updates that you've got as part of the package (e.g. devcfg/rpm/cdt). And I don't think I should risk touching those.

EDIT: for the record in my case it was an upgrade from 020006 to 020007 which takes the modem from MDMVDFE1A1006 to MDMVDFE1A1007. If anyone ever comes up with an ugprade that goes up from MDMVDFE1A1007 please tag me.

EDIT2: looks like IMEI is mandatory, but not actually checked, so I just need some more combinations of DISTRIB_FOTA_CU and DISTRIB_FOTA

El_Nino9 · August 1, 2025, 3:41pm

is it possible to de-brand to get out of being locked to vodafone DNS (not sim lock)
also how easy is it to flash the firmware without serial or is that the only recommended way?
i have recently purchased 1 to send to relatives abroad that do not have any provider apart from cell

mkrle · August 4, 2025, 7:46pm

It should be possible without serial if you can get into root using instructions in this thread.

El_Nino9 · August 20, 2025, 11:20am

Thanks mate. got ssh access with the whole back up thing. now to try your firmware.

any recommendations to avoid tears? lol

El_Nino9 · August 20, 2025, 8:25pm

Worked a treat!!

if i need to recovery to HH500V_VDFUK_V2.0.0B10 is it possible?

mkrle · August 20, 2025, 9:37pm

You can wait for the PR to be merged, I really hope it will pass the next review round. Alternatively you can build the image from my source, or run an image I build.

In terms of safety/recovery, the device has two root partitions (actually most other partitions have backups too), and sysupgrade from both OEM and OpenWrt will only upgrade the non-active partition and switch to it on the next boot. Also, sysupgrade has a command line switch to upgrade the current (instead of the non-active) partition, so once you get OpenWrt on one of the partitions you can keep upgrading that one and leave OEM on the other forever. This has worked for me so far.

The only potential issue with dual boot is that I haven’t seen a mechanism where bootloader automatically switches the active partition after x failed boots. So if you install a really bad OpenWrt image you may still need serial console (read: soldering) access to recover.

If you want to play it safe wait for the PR merge and official snapshot builds, and for feedback of others like me and jav installing it. If you are willing to accept the (IMHO at this point low) risk of bricking the device and having to solder the serial console then just go for it ASAP.

erxemilla23 · September 22, 2025, 7:24pm

Can you re-upload the file? It appears to be expired. Thank you very much. I'm also struggling with the router.

jav · September 23, 2025, 1:22pm

I could, but OEM bootlog, dts and image won’t help you unless you want to work on a port. @mkrle has done a great job in that matter. It’s just pending to be integrated in the main tree.

mkrle · September 23, 2025, 3:49pm

I’ve been asked by the OpenWrt devs to rename the model in the code from HH500V to LINKHUB HH500V. Even though this looks like a cosmetic change, it’s actually in a few places in the code, so if I’ve made any mistakes things could break.

I am looking for a volunteer(s) with serial console to test the new build for me. Unfortunately I’ve removed my console cables and shipped the device to a remote site so I can’t risk bricking it now as I won’t be able to recover.

The test would involve installing with clean config and checking the following:

booting, dmesg errors
fw_printenv (prints variables such as bootdelay, no errors)
wifi with correct mac addresses (testing one band is enough)
front leds (testing one is enough)
lan with correct mac addresses (testing one is enough)
modem/wwan (if it's detected it's enough)
sysupgrade from OpenWrt

If you are interested please let me know, I can provide image to be flashed, or you can build it from my repo once I push the changes.

erxemilla23 · September 23, 2025, 5:54pm

I'd love to help you. The only drawback would be the language, since I'm Spanish and I have to double-check everything with a translator. I have a TTL converter (FT232), but it only runs on 3.3V or 5V (not 1.8V). However, I could purchase another compatible 1.8V converter. I've already disassembled the router and noticed that my unit has two solder points on the serial port row (not on the modem ones).
I still haven't been able to access SSL via Wi-Fi; I get the message: connection refused.
I also haven't been able to build your most recent Github version (HH500V). I'm using Manjaro and need to check the packages. I managed to download the original firmware using the JAV method (by post-requesting). My software version is: HH500V_VDFES_V2.0.0B19.
Thank you very much for your time and dedication.

mkrle · September 23, 2025, 7:32pm

Since you have SSH access, if you want just to flash OpenWrt then just be a little bit more patient until it’s merged - it's not mandatory to have the serial console to flash. If you do get the 1.8V TTL and you solder the console, then let me know. I do expect a couple of other folks on this thread who already have it soldered will volunteer

jav · September 23, 2025, 7:56pm

I still have the serial console in place (just in case ) so I can do some tests if you share the code. I haven’t flashed any OpenWrt yet, so I’ll be testing from scratch.

jav · September 23, 2025, 8:10pm

Typically a 3.3v converter will work. You just need to reduce the outgoing voltage to 1.8v. I’m using a couple of resistors for that and it works just fine.

mkrle · September 23, 2025, 8:26pm

Thanks! I think in your case you can also try the initramfs without flashing because you don't have the NOR chip and in that case qcomsmem populates the partition table correctly. This should let you test 1-6 without flashing. If those are OK, I would find it safe to assume that 7 works as well.

You can build the source from https://github.com/mkrle/openwrt/tree/tcl-hh500v. Build process is the usual, but you will need to copy the wifi firmware file https://github.com/mkrle/firmware_qca-wireless/blob/hh500v/board-tcl_linkhub-hh500v.ipq8074 into package/firmware/ipq-wifi/src

Otherwise I can just share the images I built.

jav · September 23, 2025, 8:31pm

I guess it will be faster if you just share the image, as I’d need to setup a new build environment from scratch (current one is full of other stuff). Initramfs should be pretty quick to test.

It looks like erxemilla23’s box will be the same as mine, as we’re both based out of Spain, where Vodafone used to sell the NOR-free version.

thai020601 · September 24, 2025, 5:56am

i have been able to compile a new image using my repo, all wifi, eth port seem to be working. But there is one issue: when the device startup in coldboot, pcie modem doesn’t seem to be bringup correctly

Starting kernel ...
Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.12.47 (vinhthai@vinhthai-virtual-machine) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r35371-1fb621d6d8) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP PREEMPT Mon Sep 22 17:04:56 2025
[    0.000000] Machine model: TCL LINKHUB HH500V
[    0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 KiB) nomap non-reusable memory@40000000
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a5fffff (2048 KiB) nomap non-reusable tzapp@4a400000
[    0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 KiB) nomap non-reusable bootloader@4a600000
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable sbl@4aa00000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004affffff (4096 KiB) nomap non-reusable memory@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x0000000050efffff (97280 KiB) nomap non-reusable wcnss@4b000000
[    0.000000] OF: reserved mem: 0x0000000050f00000..0x0000000050ffffff (1024 KiB) nomap non-reusable q6_etr_dump@50f00000
[    0.000000] OF: reserved mem: 0x0000000051000000..0x00000000510fffff (1024 KiB) nomap non-reusable m3_dump@51000000
[    0.000000] OF: reserved mem: 0x0000000051100000..0x00000000511fffff (1024 KiB) nomap non-reusable ramoops@51100000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000511fffff]
[    0.000000]   node   0: [mem 0x0000000051200000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43736 r8192 d29992 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait root=/dev/ubiblock0_1
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 262144
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB
[    0.000000] software IO TLB: area num 4.
[    0.000000] software IO TLB: mapped [mem 0x000000007eb00000-0x000000007ec00000] (1MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Trampoline variant of Tasks RCU enabled.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000124] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000137] pid_max: default: 32768 minimum: 301
[    0.005359] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.005373] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.010559] rcu: Hierarchical SRCU implementation.
[    0.010569] rcu:     Max phase no-delay instances is 1000.
[    0.010864] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.011280] smp: Bringing up secondary CPUs ...
[    0.011951] Detected VIPT I-cache on CPU1
[    0.012063] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.012836] Detected VIPT I-cache on CPU2
[    0.012914] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.013636] Detected VIPT I-cache on CPU3
[    0.013709] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.013796] smp: Brought up 1 node, 4 CPUs
[    0.013804] SMP: Total of 4 processors activated.
[    0.013808] CPU: All CPU(s) started at EL1
[    0.013812] CPU features: detected: 32-bit EL0 Support
[    0.013817] CPU features: detected: CRC32 instructions
[    0.013858] alternatives: applying system-wide alternatives
[    0.014049] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.014318] Memory: 880584K/1048576K available (8832K kernel code, 904K rwdata, 2880K rodata, 960K init, 288K bss, 164520K reserved, 0K cma-reserved)
[    0.025557] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.025583] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.025685] 29248 pages in range for non-PLT usage
[    0.025689] 520768 pages in range for PLT usage
[    0.027871] pinctrl core: initialized pinctrl subsystem
[    0.030379] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.030985] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.031025] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.031061] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.031464] thermal_sys: Registered thermal governor 'step_wise'
[    0.031528] cpuidle: using governor menu
[    0.031762] ASID allocator initialised with 65536 entries
[    0.040837] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.040865] /soc@0/phy@8e000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.040947] /soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@8e000
[    0.040961] /soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@84000
[    0.042041] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.042184] /soc@0/phy@8e000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.044529] /soc@0/phy@8e000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.044616] /soc@0/phy@84000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
[    0.044974] /soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@8e000
[    0.045045] /soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@84000
[    0.095555] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.119022] SCSI subsystem initialized
[    0.119250] usbcore: registered new interface driver usbfs
[    0.119307] usbcore: registered new interface driver hub
[    0.119350] usbcore: registered new device driver usb
[    0.119637] qcom_scm: convention: smc arm 64
[    0.121628] clocksource: Switched to clocksource arch_sys_counter
[    0.125464] NET: Registered PF_INET protocol family
[    0.125605] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.128007] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.128031] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.128046] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.128131] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[    0.128403] TCP: Hash tables configured (established 8192 bind 8192)
[    0.128904] MPTCP token hash table entries: 1024 (order: 2, 24576 bytes, linear)
[    0.129079] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.129117] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.129579] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.129620] PCI: CLS 0 bytes, default 64
[    0.131566] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.132368] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.132375] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.141824] qcom-qmp-usb-phy 58000.phy: supply vdda-phy not found, using dummy regulator
[    0.142009] qcom-qmp-usb-phy 58000.phy: supply vdda-pll not found, using dummy regulator
[    0.143299] qcom-qmp-usb-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.143421] qcom-qmp-usb-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.145115] qcom-qusb2-phy 59000.phy: supply vdd not found, using dummy regulator
[    0.145287] qcom-qusb2-phy 59000.phy: supply vdda-pll not found, using dummy regulator
[    0.145330] qcom-qusb2-phy 59000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.145506] qcom-qusb2-phy 59000.phy: Registered Qcom-QUSB2 phy
[    0.145775] qcom-qusb2-phy 79000.phy: supply vdd not found, using dummy regulator
[    0.145887] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.145946] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.146137] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.148867] gpio-export modem: 3 gpio(s) exported
[    0.150627] qcom-pcie 20000000.pcie: host bridge /soc@0/pcie@20000000 ranges:
[    0.150687] qcom-pcie 20000000.pcie:       IO 0x0020200000..0x002020ffff -> 0x0000000000
[    0.150717] qcom-pcie 20000000.pcie:      MEM 0x0020220000..0x002fffffff -> 0x0020220000
[    0.156958] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.158075] msm_serial 78b1000.serial: msm_serial: detected port #1
[    0.158175] msm_serial 78b1000.serial: uartclk = 19200000
[    0.158584] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 20, base_baud = 1200000) is a MSM
[    0.159150] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.159221] msm_serial 78b3000.serial: uartclk = 3686400
[    0.159617] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 21, base_baud = 230400) is a MSM
[    0.159656] msm_serial: console setup on port #0
[    0.159707] printk: legacy console [ttyMSM0] enabled
[    0.253191] qcom-pcie 20000000.pcie: iATU: unroll T, 8 ob, 8 ib, align 4K, limit 1024G
[    0.261188] msm_serial: driver initialized
[    1.172648] loop: module loaded
[    1.174054] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xaa
[    1.174606] nand: Micron MT29F2G08ABBGAH4
[    1.181196] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    1.185397] 4 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.192591] Creating 4 MTD partitions on "qcom_nand.0":
[    1.199517] 0x000000000000-0x000007000000 : "rootfs_1"
[    1.261650] qcom-pcie 20000000.pcie: Phy link never came up
[    1.262119] qcom-pcie 20000000.pcie: PCI host bridge to bus 0000:00
[    1.266038] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.272308] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.277834] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    1.284101] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400 PCIe Root Port
[    1.290869] pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x00000fff]
[    1.292081] 0x000007000000-0x000007800000 : "0:WIFIFW"
[    1.298089] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.309173] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.310801] 0x000007800000-0x00000e800000 : "rootfs"
[    1.314307] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff]
[    1.314324] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff 64bit pref]
[    1.332338] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.343998] pci 0000:00:00.0: BAR 0 [mem 0x20220000-0x20220fff]: assigned
[    1.346070] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.352860] pci_bus 0000:00: resource 4 [io  0x0000-0xffff]
[    1.357867] pci_bus 0000:00: resource 5 [mem 0x20220000-0x2fffffff]
[    1.366421] pcieport 0000:00:00.0: PME: Signaling with IRQ 23
[    1.369993] pcieport 0000:00:00.0: AER: enabled with IRQ 23
[    1.409105] mtd: setting mtd2 (rootfs) as root device
[    1.409410] mtdsplit: no squashfs found in "rootfs"
[    1.413186] 0x00000e800000-0x00000f000000 : "0:WIFIFW_1"
[    1.428217] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.429222] spi-nor spi0.0: found mx25u25635f, expected n25q128a11
[    1.434716] 19 fixed-partitions partitions found on MTD device spi0.0
[    1.440348] Creating 19 MTD partitions on "spi0.0":
[    1.446865] 0x000000000000-0x000000050000 : "0:SBL1"
[    1.452070] 0x000000050000-0x000000060000 : "0:MIBIB"
[    1.457189] 0x000000060000-0x000000080000 : "0:BOOTCONFIG"
[    1.462153] 0x000000080000-0x0000000a0000 : "0:BOOTCONFIG1"
[    1.467502] 0x0000000a0000-0x000000220000 : "0:QSEE"
[    1.472998] 0x000000220000-0x0000003a0000 : "0:QSEE_1"
[    1.478186] 0x0000003a0000-0x0000003b0000 : "0:DEVCFG"
[    1.483173] 0x0000003b0000-0x0000003c0000 : "0:DEVCFG_1"
[    1.488235] 0x0000003c0000-0x0000003d0000 : "0:APDP"
[    1.493740] 0x0000003d0000-0x0000003e0000 : "0:APDP_1"
[    1.498668] 0x0000003e0000-0x000000420000 : "0:RPM"
[    1.503674] 0x000000420000-0x000000460000 : "0:RPM_1"
[    1.508400] 0x000000460000-0x000000470000 : "0:CDT"
[    1.513653] 0x000000470000-0x000000480000 : "0:CDT_1"
[    1.518290] 0x000000480000-0x000000490000 : "0:APPSBLENV"
[    1.523584] 0x000000490000-0x000000530000 : "0:APPSBL"
[    1.528878] 0x000000530000-0x0000005d0000 : "0:APPSBL_1"
[    1.533940] 0x0000005d0000-0x000000630000 : "0:ART"
[    1.539389] 0x000000630000-0x0000006b0000 : "0:ETHPHYFW"
[    1.552320] spmi_pmic_arb 200f000.spmi: PMIC arbiter version v2 (0x20010000)
[    1.583538] i2c_dev: i2c /dev entries driver
[    1.592636] sdhci: Secure Digital Host Controller Interface driver
[    1.592682] sdhci: Copyright(c) Pierre Ossman
[    1.597717] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.604570] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    1.611896] NET: Registered PF_INET6 protocol family
[    1.614829] Segment Routing with IPv6
[    1.618772] In-situ OAM (IOAM) with IPv6
[    1.622497] NET: Registered PF_PACKET protocol family
[    1.626469] l2tp_core: L2TP core driver, V2.0
[    1.631225] l2tp_netlink: L2TP netlink interface
[    1.635751] 8021q: 802.1Q VLAN Support v1.8
[    1.677023] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    1.677379] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    1.683274] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    1.689754] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    1.697434] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    1.705099] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.714399] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 712000 uV
[    1.721008] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 840000 uV
[    1.731015] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 904000 uV
[    1.740809] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 992000 uV
[    1.750671] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 721, quot_offset[ 7]=   0
[    1.760428] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 957, quot_offset[ 7]= 235
[    1.771279] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1060, quot_offset[ 7]= 100
[    1.782218] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1211, quot_offset[ 7]= 150
[    1.793405] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.798277] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 800000 KHz, changing to: 1017600 KHz
[    1.813001] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    1.821875] ubi0: attaching mtd2
[    2.331201] ubi0: scanning is finished
[    2.392190] ubi0: attached mtd2 (name "rootfs", size 112 MiB)
[    2.392230] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.396923] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.403709] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.410551] ubi0: good PEBs: 896, bad PEBs: 0, corrupted PEBs: 0
[    2.417330] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    2.423582] ubi0: max/mean erase counter: 11/5, WL threshold: 4096, image sequence number: 1774698799
[    2.430610] ubi0: available PEBs: 0, total reserved PEBs: 896, PEBs reserved for bad PEB handling: 40
[    2.439949] ubi0: background thread "ubi_bgt0d" started, PID 692
[    2.440713] block ubiblock0_1: created from ubi0:1(rootfs)
[    2.455328] clk: Disabling unused▒[    2.467150] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.467475] Freeing unused kernel memory: 960K
[    2.473377] Run /sbin/init as init process
[    2.646174] init: Console is alive
[    2.646288] init: - watchdog -
[    2.711669] random: crng init done
[    3.317017] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.397146] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.459808] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    4.481683] regi_init[2525]:INFO:Initializing HPPE Done!!
[    4.481819] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    4.488860] EDMA ver 1 hw init
[    4.492399] EDMA HW Reset completed succesfully
[    4.495043] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    4.499437] RxDesc:1 (15-15) RxFill:1 (7-7)
[    4.505141] GMAC4(ffffff80032af940) Invalid MAC@ - using 9a:26:1e:ef:d3:61
[    4.682512] Qualcomm QCA8075 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    4.684083] GMAC6(ffffff80032a9940) Invalid MAC@ - using 56:d5:9e:68:bb:00
[    4.754004] Qualcomm QCA8081 90000.mdio-1:10: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:10, irq=POLL)
[    4.755235] **********************************************************
[    4.763019] * NSS Data Plane driver
[    4.769423] **********************************************************
[    4.790543] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.790593] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    4.795105] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000808002000010
[    4.802529] xhci-hcd xhci-hcd.1.auto: irq 48, io mem 0x08a00000
[    4.811986] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.817759] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    4.823327] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    4.831200] hub 1-0:1.0: USB hub found
[    4.837635] hub 1-0:1.0: 1 port detected
[    4.841409] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.845516] hub 2-0:1.0: USB hub found
[    4.853438] hub 2-0:1.0: 1 port detected
[    4.857213] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.860994] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 3
[    4.866422] xhci-hcd xhci-hcd.2.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000808002000010
[    4.873882] xhci-hcd xhci-hcd.2.auto: irq 49, io mem 0x08c00000
[    4.883349] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller
[    4.889114] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 4
[    4.894680] xhci-hcd xhci-hcd.2.auto: Host supports USB 3.0 SuperSpeed
[    4.902503] hub 3-0:1.0: USB hub found
[    4.908823] hub 3-0:1.0: 1 port detected
[    4.912751] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.916845] hub 4-0:1.0: USB hub found
[    4.924910] hub 4-0:1.0: 1 port detected
[    4.931245] usbcore: registered new interface driver usb-storage
[    4.933355] usbcore: registered new interface driver uas
[    4.938557] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.945605] init: - preinit -
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.654070] mount_root: loading kmods from internal overlay
[    9.667368] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[    9.670351] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[   10.640802] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[   10.640954] block: unable to load configuration (fstab: Entry not found)
[   10.646705] block: attempting to load /tmp/overlay/etc/config/fstab
[   10.653450] block: unable to load configuration (fstab: Entry not found)
[   10.659397] block: attempting to load /etc/config/fstab
[   10.669365] block: unable to load configuration (fstab: Entry not found)
[   10.671300] block: no usable configuration
[   10.681395] UBIFS (ubi0:2): Mounting in unauthenticated mode
[   10.682331] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 977
[   10.713477] UBIFS (ubi0:2): recovery needed
[   10.785989] UBIFS (ubi0:2): recovery completed
[   10.786126] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[   10.789344] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   10.797269] UBIFS (ubi0:2): FS size: 83550208 bytes (79 MiB, 658 LEBs), max 669 LEBs, journal size 4190208 bytes (3 MiB, 33 LEBs)
[   10.807159] UBIFS (ubi0:2): reserved for root: 3946282 bytes (3853 KiB)
[   10.818778] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID E4CB8243-0D35-4001-8C20-2F90EC217F02, small LPT model
[   10.826485] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   10.840923] block: extroot: not configured
[   10.843601] UBIFS (ubi0:2): un-mount UBI device 0
[   10.847605] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
[   10.855863] UBIFS (ubi0:2): Mounting in unauthenticated mode
[   10.858559] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 980
[   10.932813] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[   10.932860] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   10.939640] UBIFS (ubi0:2): FS size: 83550208 bytes (79 MiB, 658 LEBs), max 669 LEBs, journal size 4190208 bytes (3 MiB, 33 LEBs)
[   10.949559] UBIFS (ubi0:2): reserved for root: 3946282 bytes (3853 KiB)
[   10.961170] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID E4CB8243-0D35-4001-8C20-2F90EC217F02, small LPT model
[   10.971695] usb 3-1: new high-speed USB device number 2 using xhci-hcd
[   10.971852] mount_root: loading kmods from internal overlay
[   10.998247] kmodloader: loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
[   10.999377] kmodloader: done loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
[   11.855253] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[   11.857990] block: extroot: not configured
[   11.863289] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   11.865273] block: extroot: not configured
[   11.873835] mount_root: switching to ubifs overlay
[   11.881482] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[   11.884696] urandom-seed: Seeding with /etc/urandom.seed
[   11.929967] procd: - early -
[   11.930057] procd: - watchdog -
[   12.488259] procd: - watchdog -
[   12.488481] procd: - ubus -
[   12.643176] procd: - init -
Please press Enter to activate this console.
[   12.993700] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.096726] NET: Registered PF_ALG protocol family
[   13.115063] urngd: v1.0.2 started.
[   13.211753] qca-nss 39000000.nss: NSS FW Version: NSS.HK.11.4.0.5-6-R
[   13.211802] qca-nss 39000000.nss: fw of size 835960 bytes copied to addr: 40000000, nss_id: 0
[   13.254080] qca-nss 39000000.nss: NSS core 0 booted successfully
[   13.358037] qca-nss 39400000.nss: fw of size 292296 bytes copied to addr: 40800000, nss_id: 1
[   13.363139] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[   13.363498] qca-nss 39400000.nss: NSS core 1 booted successfully
[   13.373480] nat46: module (version 04923c51039e8ca270c6f1dde3f04f3b36958089) loaded.
[   13.380506] gre: GRE over IPv4 demultiplexor driver
[   13.386605] ip_gre: GRE over IPv4 tunneling driver
[   13.393041] ip6_gre: GRE over IPv6 tunneling driver
[   13.400945] nss_vlan_mgr_init_module[1939]:Module (Build Build Id: 09/22/25, 20:42:14) loaded
[   13.406900] PPP generic driver version 2.4.2
[   13.475470] NET: Registered PF_PPPOX protocol family
[   13.478963] PPTP driver version 0.8.5
[   13.484598] nss_wifi_meshmgr_init_module[1994]:Module Build Id: 09/22/25, 20:42:18 loaded
[   13.488814] GACT probability on
[   13.492816] Mirror/redirect action on
[   13.500763] u32 classifier
[   13.500803]     input device check on
[   13.502828]     Actions configured
[   13.512952] ntfs3: Enabled Linux POSIX ACLs support
[   13.520490] usbcore: registered new interface driver cdc_wdm
[   13.521156] Loading modules backported from Linux version v6.16-0-g038d61fd6422
[   13.525270] Backport generated by backports.git v6.1.145-1-47-g6194bf852a3e
[   13.533797] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   13.548184] PPP MPPE Compression module registered
[   13.549482] <NSS-CRYPTO>:module loaded Build_ID - 09/22/25, 20:41:52 SoC=ipq807x
[   13.554931] NET: Registered PF_QIPCRTR protocol family
[   13.620973] usbcore: registered new interface driver usbserial_generic
[   13.623734] usbserial: USB Serial support registered for generic
[   13.632435] usbcore: registered new interface driver cdc_ether
[   13.637579] usbcore: registered new interface driver cdc_ncm
[   13.756134] usbcore: registered new interface driver qmi_wwan
[   13.757307] usbcore: registered new interface driver rndis_host
[   13.805602] ath11k c000000.wifi: ipq8074 hw2.0
[   13.805638] ath11k c000000.wifi: FW memory mode: 1
[   24.152077] platform leds: deferred probe pending: (reason unknown)
[   32.471793] l11: disabling
[   69.944186] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   69.944550] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   71.027727] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   71.071699] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   71.079141] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   71.079179] ath11k c000000.wifi: fw_version 0x2c0204a5 fw_build_timestamp 2024-10-04 16:07 fw_build_id WLAN.HK.2.12-01460-QCAHKSWPL_SILICONZ-1
[   76.335067] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcss
[   76.335115] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   76.341268] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   76.692302] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   76.697212] usbcore: registered new interface driver cdc_mbim
[   76.701060] usbcore: registered new interface driver option
[   76.704496] usbserial: USB Serial support registered for GSM modem (1-port)
[   76.710187] kmodloader: done loading kernel modules from /etc/modules.d/*
[   76.736120] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   76.743547] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   76.743598] ath11k c000000.wifi: fw_version 0x2c0204a5 fw_build_timestamp 2024-10-04 16:07 fw_build_id WLAN.HK.2.12-01460-QCAHKSWPL_SILICONZ-1
[   76.899091] ath11k c000000.wifi: htt event 48 not handled
[   76.903374] ath11k c000000.wifi: nss init soc nss if_num 203 userpd_id 0
[   80.773837] ECM init
[   80.773913] ECM database jhash random seed: 0x4fd5efc0
[   80.776218] ECM init complete
[   81.188985] br-lan: port 1(lan) entered blocking state
[   81.189045] br-lan: port 1(lan) entered disabled state
[   81.193699] nss-dp 3a001600.dp4 lan: entered allmulticast mode
[   81.198768] nss-dp 3a001600.dp4 lan: entered promiscuous mode
[   81.521588] mhi_init Quectel_Linux_PCIE_MHI_Driver_V1.3.8
[   81.712757] br-lan: port 2(phy1-ap0) entered blocking state
[   81.712834] br-lan: port 2(phy1-ap0) entered disabled state
[   81.717210] ath11k c000000.wifi phy1-ap0: entered allmulticast mode
[   81.727534] ath11k c000000.wifi phy1-ap0: entered promiscuous mode
[   81.729593] br-lan: port 2(phy1-ap0) entered blocking state
[   81.735277] br-lan: port 2(phy1-ap0) entered forwarding state
[   81.744937] br-lan: port 2(phy1-ap0) entered disabled state
[   81.830434] br-lan: port 2(phy1-ap0) entered blocking state
[   81.830480] br-lan: port 2(phy1-ap0) entered forwarding state
[   82.538861] qca-nss 39000000.nss: Configuring additional NSS pbufs
[   82.568703] qca-nss 39000000.nss: Additional pbufs of size 10002432 got added to NSS
[   82.701974] ath11k c000000.wifi phy1-ap0: left allmulticast mode
[   82.702060] ath11k c000000.wifi phy1-ap0: left promiscuous mode
[   82.707468] br-lan: port 2(phy1-ap0) entered disabled state
[   83.518201] br-lan: port 2(phy1-ap0) entered blocking state
[   83.518240] br-lan: port 2(phy1-ap0) entered disabled state
[   83.523245] ath11k c000000.wifi phy1-ap0: entered allmulticast mode
[   83.528511] ath11k c000000.wifi phy1-ap0: entered promiscuous mode
[   83.535054] br-lan: port 2(phy1-ap0) entered blocking state
[   83.540654] br-lan: port 2(phy1-ap0) entered forwarding state
[   83.546548] br-lan: port 2(phy1-ap0) entered disabled state
[   83.563793] br-lan: port 2(phy1-ap0) entered blocking state
[   83.563840] br-lan: port 2(phy1-ap0) entered forwarding state

i have to send “echo 1 > /sys//bus/pci/rescan” to active the pci bus. P/s: i already inclued the /init.d/modem from mkrle repo

erxemilla23 · September 24, 2025, 11:53am

I've already managed to compile both versions and even gain SSH access. I was getting an error compiling with Manjaro, so I had to install Ubuntu.
Regarding the SSL issue, I don't know why I was trying to patch the firmware instead of the configuration file (I wasn't having a good time mentally). At this point, can I risk installing OpenWRT with a fully functional router? If I can skip the step of soldering the TTL converter wires, that would be great, but if there's no other option, I can do that too.
I'll try again in a bit. Thanks again, and if you need help, I'll be here.