Flashing Quectel on X3000 Spitz AX?

Hi there!

I have been tinkering around with my Spitz X3000 and have discovered many things such as tweaks and running non-complainant scripts that have been ported from other models I guess. I will be posting all my findings in other separate posts.

For this post, I want to know whether the engineers at GL.Inet have already tested the new firmware of the Quectel modem? I have contacted Quectel and they provided me with the latest firmware for their chip … but I am hesitant to flash at the moment as the release notes does not mention any security or performance improvements.

The latest firmware A07M4G while the current installed one is:

Revision: RM520NGLAAR01A06M4G


There is someone on here that recently posted a screenshot of his and it appears their unit shipped from the factory with the most recent firmware.

The only way I know now how to update is to remove the modem from the router and update through windows using a USB sled.

1 Like

No way to do it via “libusb” on the Linux side?

I’ve heard that may be possible but I was cautioned that unless I really knew what I was doing Linux had a higher risk of a bad flash. YMMV

I’d be surprised at that, unless it was a warning to newbies. :slight_smile: After all, I’m sure the GL-iNet devs have an upgrade path in place in their firmware.

1 Like

Hi SpitzAX3000:
Do you want to update the firmware(A07M4G)? You can upgrade with the following command:

QFirehose -p /dev/mhi_BHI -f RM520NGLAAR01A07M4G

YES,We are also testing RM520NGLAAR01A07M4G. Current test results: This version is available.

Do you see any improvements while testing it? If yes, then I will take the risk and update it.

By the way, do you upgrade such firmware with Openwrt upgrades ?

Please note that Quectel engineers are saying that the latest firmware cannot be downgraded to previous versions.

Actual performance has not improved significantly.

What is the exact version number of the firmware you got?

1 Like

Revision: RM520NGLAAR01A06M4G

I tried to flash it but failed:

QFirehose -p /dev/mhi_BHI -f RM520NGLAAR01A07M4G_01.201.01.201

[000.000]: QFirehose Version: Quectel_LTE&5G_QFirehose_Linux&Android_V1.4
[000.000]: Builded: Apr 15 2023 06:27:19
[000.000]: Find md5 check file <RM520NGLAAR01A07M4G_01.201.01.201/md5.txt>
[000.001]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/contents.xml pass
[000.008]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/abl.elf pass
[000.012]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/aop.mbn pass
[000.014]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/apdp.mbn pass
[000.015]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/devcfg_low_ddr.mbn pass
[000.017]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/devcfg.mbn pass
[000.018]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/firehose/partition_complete_p4K_b256K.mbn pass
[000.018]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/firehose/patch_p4K_b256K.xml pass
[000.034]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/firehose/prog_firehose_lite.elf pass
[000.035]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/firehose/rawprogram_nand_p4K_b256K_update.xml pass
[000.038]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/hyp.mbn pass
[000.040]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/ipa_fws.elf pass
[000.041]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/logfs_ufs_8mb.bin pass
[000.042]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/multi_image.mbn pass
[000.043]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/multi_image_qti.mbn pass
[001.741]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/NON-HLOS.ubi pass
[001.760]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/oemapp.ubi pass
[001.773]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/oemdata.ubi pass
[001.773]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/partition.mbn pass
[001.774]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/partition_nand.xml pass
[001.957]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/sdxlemur-boot.img pass
[002.244]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/sdxlemur-recoveryfs.ubi pass
[003.628]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/sdxlemur-sysfs.ubi pass
[003.629]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/sec.dat pass
[003.650]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/tz.mbn pass
[003.693]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/uefi.elf pass
[003.777]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/usrdata.ubi pass
[003.781]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/xbl_config.elf pass
[003.797]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/xbl.elf pass
[003.802]: md5 checking: RM520NGLAAR01A07M4G_01.201.01.201/update/xbl_ramdump.elf pass
[003.802]: Totals checking 30 files md5 value, 0 file fail!
[003.802]: fail to fopen RM520NGLAAR01A07M4G_01.201.01.201/update/firehose/prog_firehose_sdx55.mbn, errno: 2 (No such file or directory)
[003.803]: gl-sdk4-modem-git-2023.104.26958-b709b07/quec_UPGRADE/usb_linux.c qpcie_open 915 fail
[003.803]: gl-sdk4-modem-git-2023.104.26958-b709b07/quec_UPGRADE/qfirehose.c main 297 fail

The file “prog_firehose_sdx55.mbn” that failed to open is renamed by Quectel in the upgrade directory as “/prog_firehose_lite.elf”

How can I fix this?


I found the cause of the error:

grep -arn ‘prog_firehose_sdx55.mbn’ / 2>/dev/null

/rom/usr/bin/QFirehose:307:%s/prog_firehose_sdx24.mbn%s/prog_firehose_sdx55.mbngl-sdk4-modem-git-2023.104.26958-b709b07/quec_UPGRADE/usb_linux.c/dev/mhi_DIAG%s: switch_to_edl_mode

/usr/bin/QFirehose:307:%s/prog_firehose_sdx24.mbn%s/prog_firehose_sdx55.mbngl-sdk4-modem-git-2023.104.26958-b709b07/quec_UPGRADE/usb_linux.c/dev/mhi_DIAG%s: switch_to_edl_mode

The file QFirehose is looking for prog_firehose_sdx55.mbn while the one in the folder is renamed by Quectel. Anyway I am happy that it did not flash otherwise it may malfunction :wink:

Can you please provide the RM520NGLAAR01A07M4G zip file that worked with gl engineers?

Another issue is that the provided upgrade zip file by Quectel is 32-bit as opposed to Spitz’s binaries:

file RM520NGLAAR01A07M4G_01.201.01.201/update/uefi.elf

RM520NGLAAR01A07M4G_01.201.01.201/update/uefi.elf: ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, no section header

file /usr/bin/QFirehose

/usr/bin/QFirehose: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-musl-aarch64.so.1, no section header

Not sure if this upgrade would impact the chip installed on the Spitz?

I am very sorry that there is something wrong with this instruction at present. I will update the new firmware.

You can download attachments to replace QFirehose first.Then exec:

QFirehose -f RM520NGLAAR01A07M4G

QFirehose.zip (45.7 KB)

Thank you. Can you please share also RM520NGLAAR01A07M4G

Is it possible release a modem firmware upgrade say once every 6 months with easy instructions that works for everyone ? Its inconvenient to have each user to ask for the upgrade instructions one by one

1 Like

@bOcy I agree with you!

Thank you very much for your advice. We will consider developing a stable version with carrier in the future.

You can send your email to me through Message. I will send the firmware to you.

I sent it to you on private message.

Please note that there are TWO UNSUPPORTED AT commands when you click on “Export Debug Info” under the cellular advanced section:

      "cmd": "AT+QCFG=\"nwscanmode\"",
        "result": "\r\nERROR\r\n"
        "cmd": "AT+QCFG=\"band\"",
        "result": "\r\nERROR\r\n"

The above commadns are not supported by Quectel and needs to be removed from new OpenWrt releases.