RM551E Compatibility in an X3000?

Hello,

I wanted to know if replacing the RM520 in my X3000 with an RM551E-GL is possible.

I recently acquired another vendor’s router with RM551E but I would much prefer to enjoy the performance of the RM551E in the X3000.

I found this thread where a user discusses trying to install one in his router without luck, support offers to try to assist but there is no response and the thread is a year old.

If anyone has done this and has any tips to offer, it’s greatly appreciated. The physical swap doesn’t concern me as I’m an experienced electronics technician, but after that point I have no idea what to expect and the thread I linked makes me think it wont be detected automatically after swapping.

Thanks for the advice in advance!

Hi

We do not recommend disassembling the X3000 to replace the modem module, as doing so will void the warranty.

However, if you decide to proceed and encounter issues using the X3000 with the RM551E, as mentioned in the original thread, we can try to help troubleshoot the problem remotely and see if we can get it working properly.

You can refer to the following guide to share your device with us via GoodCloud:

Please ensure that the X3000 has a stable internet connection via an alternative method, such as a repeater or WAN.

And send us the MAC address and the router password via private message so we can access it

Hi Will,

After installing the RM551 today, and trying to enable GoodCloud, it bound successfully but shows the device is offline on GoodCloud even though the router has a Ethernet connection which is working. The cloud log on the device shows the following:

Fri Jul 24 14:49:49 2026 daemon.info gl-cloud[28506]: (gl-cloud:1210) connect mqtt broker: 18.209.114.161 28883
Fri Jul 24 14:49:49 2026 daemon.info gl-cloud[28506]: (gl-cloud:1420) conack: 0 connection accepted
Fri Jul 24 14:49:49 2026 daemon.err gl-cloud[28506]: (gl-cloud: 56) ...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:98: attempt to index a nil value (local 'status') stack traceback: 	...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:98: in function 'cloud.cellular.get_current_sim_slot' 	...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:1008: in function <...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:1005>
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:1512) lua-eco version: 3.20.0
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:648) Ubus services init done.
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:1053) fetch ca from: https://gslb-eu.goodcloud.xyz/getCaCert/ca.crt
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:1117) fetch server from: https://gslb-eu.goodcloud.xyz/v2/device/auth
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:1210) connect mqtt broker: 18.209.114.161 28883
Fri Jul 24 14:49:55 2026 daemon.info gl-cloud[28593]: (gl-cloud:1420) conack: 0 connection accepted
Fri Jul 24 14:49:55 2026 daemon.err gl-cloud[28593]: (gl-cloud: 56) ...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:98: attempt to index a nil value (local 'status') stack traceback: 	...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:98: in function 'cloud.cellular.get_current_sim_slot' 	...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:657: in upvalue 'get_sim_status' 	...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:947: in function <...3/gl-sdk4-cloud/usr/local/lib/lua/5.4/cloud/cellular.lua:945>

Furthermore, it appears from my understanding the modem is coming up in EDL mode:

P: Vendor=05c6 ProdID=9008 Rev= 0.00
S: Manufacturer=Qualcomm CDMA Technologies MSM

Thoughts or suggestions?

By the way, the RM551 is running RM551EGL00AAR02A02M8G_01.001.01.001. (Which I was able to tell by running AT+QGMR from the original non-GL.iNet device it shipped in.)

I have x3000 and rm551 in non gl-inet device.

What firmware inside router?

Interesting to try same.

Could you check what usb mode enabled on your modem by command:

AT+QCFG=“usbnet”

thank you

GL-X3000 (Spitz AX): PCIe link never trains with Quectel RM551E-GL (SDX75) — two gaps in the router firmware

Hi,

I have a Quectel RM551E-GL (X75/SDX75) in a GL-X3000 and cannot get the PCIe link up.
I have a second GL-X3000 with the stock RM520N-GL that I used as a known-good reference
for every measurement, so this is a like-for-like comparison.

Important: the RM551E-GL sits in the same unit where an RM520N-GL previously ran over
PCIe without any problem, so the board's PCIe path is known good.

The symptom

Reference unit, RM520N-GL, firmware 4.8.3 — link trains at 0.752 s:


\[0.752\] mtk-pcie 11280000.pcie: PCI host bridge to bus 0001:00 0001:01:00.0 17cb:0308 driver=mhi_q /dev/mhi_BHI /dev/mhi_DIAG /dev/mhi_DUN /dev/mhi_QMI0 → rmnet_mhi0

Test unit, RM551E-GL, firmware 4.9.0 — controller gives up at 0.834 s:


\[0.475\] mtk-pcie 11280000.pcie: host bridge /pcie@11280000 ranges: \[0.834\] mtk-pcie 11280000.pcie: PCIe link down, ltssm reg val: 0x1 \[0.840\] mtk-pcie: probe of 11280000.pcie failed with error -110

The whole 0001:* domain is therefore absent. LTSSM stuck at Detect means no link
partner was seen at all.

What I already ruled out

Module configuration (verified by reading it back after each reboot):


AT+QCFG="data_interface" → 1,0 (network port over PCIe) AT+QCFG="pcie/mode" → 0 (Endpoint — the default) ATI → RM551E-GL, RM551EGL00AAR02A02M8G

The switch definitely takes effect: after it the module re-enumerates with 4 USB
interfaces instead of 5, dropping its USB network interface — exactly like the
RM520N-GL behaves in PCIe mode.

  • Re-probed the host controller by hand via /sys/bus/platform/drivers/mtk-pcie/bind
    at 2, 3, 4, 5, 7, 10, 15, 20, 35, 115 and 438 seconds after a clean module restart.
    Always ltssm 0x1.
  • Followed Quectel's manual to the letter: no AT+CFUN=1,1 (their note 6 warns it
    breaks PCIe init timing), 105 s wait for the NV write to persist (note 9), then a
    wall power cycle so host and module start synchronously (note 5). Same result.
  • pcie@11280000 has no reset-gpios in the device tree. Neither 5G_reset nor
    5G_control is PERST# — both just drop the module off the USB bus entirely. So
    there is no way from userspace to give the endpoint a PERST# edge once it is ready.

Why I think this is a timing problem

On the Quectel forum, users who run RM551E-GL in PCIe EP mode successfully report that
the endpoint only becomes ready for PERST# roughly 3 seconds after power-up. On a mini
PC this was worked around by powering the modem from a separate supply, so it boots
before the host does its PCI scan. Some x86 BIOSes also expose a "delay before PCI
scan" setting for exactly this.

On the X3000 neither is possible: the M.2 slot is powered by the router, so the module
starts together with it and the controller scans at 0.83 s — about two seconds too
early. The RM520N-GL is ready at 0.752 s and just makes it; the RM551E-GL cannot.

Second, independent gap: the MHI driver does not know SDX75

The PCI ID table inside /lib/modules/5.4.211/pcie_mhi.ko (kmod-gl-pcie-modem)
contains only:


17cb:0303 17cb:0304 17cb:0305 17cb:0306 17cb:0308

17cb:0309 — the generic Qualcomm SDX75 ID, which mainline Linux maps to
mhi_qcom_sdx75_info in drivers/bus/mhi/host/pci_generic.c — does not appear
anywhere in the binary. So even once the link trains, mhi_q would not bind.

Requests

  1. Could PCIe link training get a retry or a configurable delay, so an endpoint that
    needs a few seconds to become ready is not lost at 0.83 s? A deferred probe or a
    longer timeout would do it.
  2. Could 17cb:0309 (SDX75) be added to the MHI driver's PCI ID table?

I am happy to test any build, provide full logs, or run whatever debug you need — I
have both units side by side.

Thanks!

RM551E-GL fully working over USB with 3 small changes — please add support (still hoping for PCIe)

Hi,

Companion to my other thread about the PCIe link not training with this module. Since
PCIe is out of reach for now, I got the Quectel RM551E-GL working over USB/QMI in a
GL-X3000 on firmware 4.9.0, using the stock cellular stack. Three changes are needed.
Everything below is verified across multiple reboots.

What blocks it in stock firmware

1. Neither driver knows PID 0122. All five USB interfaces come up unbound —
option and qmi_wwan have no entry for 2c7c:0122. No /dev/ttyUSB*, no
/dev/cdc-wdm0, not even an AT port.

2. The model is missing from /lib/modem_data/modem_list.json. Moving this table
out of the binaries into a data file in 4.9.0 was a good change, by the way — adding a
module is now a one-entry edit.

3. The cellular manager discards the modem outright. This is the actual blocker:


cellular_manage: (modem.c:454) skip build-in USB bus 1-1.2, PCIe counterpart in build-in list

The device tree declares build-in-modem = 0001:01:00.0,1-1.2, so the built-in modem
is assumed to be a PCIe device and the USB bus is thrown away. Fixing 1 and 2 alone
achieves nothing without this.

What makes it work

# 1. register the PID with both drivers (from /etc/rc.local, backgrounded)
echo "2c7c 0122" > /sys/bus/usb-serial/drivers/option1/new_id
echo "2c7c 0122" > /sys/bus/usb/drivers/qmi_wwan/new_id
# then wait for /dev/cdc-wdm0 and restart gl_cellular_manager — it starts before
# the drivers attach and does not pick the module up on its own

# 2. add an RM551E entry to /lib/modem_data/modem_list.json:
#    a copy of the RM520N USB entry with pid "0122"

# 3. stop the manager from discarding the USB bus
uci set board_special.hardware.build_in_modem='1-1.2'
uci commit board_special

Result — the stock stack detects and dials the module normally:

"name":"RM551E-GL", "version":"RM551EGL00AAR02A02M8G_01.001.01.001"
wwan0 up with a public IP, default route metric 40
T-Mobile LTE, RSRP -92, ping 8.8.8.8 → 0% loss, ~65 ms

Why I would still much prefer PCIe

The M.2 slot in the X3000 is wired behind a USB 2.0 hub (speed=480), so the USB path tops out around 250-300 Mbps. The same module does roughly 800 Mbps in other hardware over USB 3. Getting PCIe to work is what would actually unlock this module's speed on the X3000 — hence the other thread.

Requests

  1. Add 2c7c:0122 to the option and qmi_wwan ID tables.

  2. Add an RM551E-GL entry to modem_list.json.

  3. Do not discard a built-in USB modem when its PCIe counterpart is absent — modem.c:454 currently skips it unconditionally.

Happy to share the exact JSON entry and rc.local snippet, or to test any build.

Thanks!

UPDATE!!! 28.07.2026

Got the Quectel RM551E-GL (X75/SDX75) running over PCIe on a GL-X3000/XE3000 :winking_face_with_tongue: :winking_face_with_tongue: :winking_face_with_tongue:

Same board, same spot, same 5G NSA cell:

USB 309 Mbps (M.2 sits behind a USB 2.0 hub — that's the ceiling)
PCIe :firecracker: 550–620 Mbps :firecracker: (491 on the first run, higher on repeats)

Two things block it in stock firmware:

1. The bootloader doesn't wait long enough. pcie-mediatek-gen3 has no hotplug, so
the modem must be up before the kernel starts. RM520N-GL is ready in ~0.75 s and just
makes it; the X75 needs 4–5 s and misses the window — the link never trains
(PCIe link down, ltssm 0x1), and nothing can be done from userspace afterwards.

Mainline OpenWrt's U-Boot exposes this as an env variable, so I flashed it and changed
init_modem from sleep 1 to sleep 5. Stock GL firmware keeps booting fine under it.
Verified threshold: 4 s is not enough, 5 s is.

2. The MHI driver doesn't know SDX75. The endpoint enumerates as 17cb:0309, but the
PCI ID table in pcie_mhi.ko stops at 17cb:0308. Adding it at runtime is enough:

echo "17cb 0309" > /sys/bus/pci/drivers/mhi_q/new_id

After that mhi_q binds, /dev/mhi_* appear, rmnet_mhi0 comes up and the stock
cellular manager dials on its own.

Request: could both land in a future release?

  • a longer (or configurable) modem power-up delay in the bootloader — 1 s only covers
    the RM520N;
  • 17cb:0309 in the MHI driver's PCI ID table.

Neither should affect existing hardware, and it would make X75-class modules work on
these routers out of the box.

GL team — worth a look: this is roughly double what the same router does today, on the
same antenna and the same cell, from two small changes. Happy to provide logs, dmesg
output or test any build you want.

3 Likes

Hi,

Sorry for the delayed reply.

Thank you very much for your detailed debugging efforts and the tutorial on getting the RM551E working properly on the X3000.

We will ask our R&D team to check whether we can add the corresponding compatibility support in future firmware releases.

2 Likes

@Polarbear — that EDL entry is almost certainly mechanical, not firmware.

The pad under the M.2 slot is in two parts: one half is a plain thermal pad,
the other half is a metal-mesh type that is electrically conductive (it grounds
to the shield). On the RM520N that area of the PCB is bare, but the RM551E has
an exposed test point right there, and the mesh shorts it to ground — which
forces the module into bootloader/EDL mode.

So the modem drops to 05c6:9008 on every power-up and never comes up on USB or
PCIe. Looks exactly like a dead module.

Fix is a scrap of plastic tape between the mesh half of the pad and the module.
Mine did the same thing until I insulated it; it's been solid since.

Once it boots normally, see post #8 above for the driver/config side.

2 Likes

@will.qiu Thanks — glad it's going to R&D.

Two concrete asks, both small:

  1. Bootloader: increase the delay after the modem power-up sequence. The current
    one is fine for the RM520N (ready at ~0.75 s) but the RM551E needs 4-5 s, and
    pcie-mediatek-gen3 can't hotplug, so the link has to be up before the kernel
    starts. 5 s works; 4 s doesn't.
  2. Driver: add 17cb:0309 (SDX75) to the MHI PCI ID table.

If it helps R&D reproduce or verify a test build, I have a spare board running
the RM551E over PCIe and I'm happy to make it available — just send me a PM.

1 Like

Thank you - that is immensely helpful to know and quite observant. I really appreciate you and Will taking the time to answer my questions and provide this info. I’m sure there are other people who will be just as eager to have this information.

Before I ended up reading these replies, I had decided to put the RM551E into an M.2 Ethernet enclosure and connecting it to the X3000 with the 2.5Gbe WAN port, which so far is working nicely for my purposes.

But when I have the time, I will revisit this and try to put the RM551E inside my X3000 again. I’ll report back when I do if this thread is still open at that point.

And while I’m here: a big shout out to GLi.Net for this product in general. My X3000 has been at the center of my life for the past two years, mounted in the back of a vehicle where it has dealt with extreme temperature swings on both ends, harsh vibrations, and constant use. The added features and constant firmware development are really encouraging to see when most other vendors seem to ignore what their users actually want.

2 Likes