GL.iNet GL-BE9300 (Flint 3)

The GL.iNet Flint 3 (GL-BE9300) is a Wi-Fi 7 router based on the Qualcomm IPQ5332, with a Realtek RTL8372N switch providing four 2.5 GbE LAN ports and an RTL8221B 2.5 GbE WAN port, plus tri-band Wi-Fi (IPQ5332 for 2.4 GHz and a dual-mac QCN9274 for 5 GHz and 6 GHz).

ssh root@192.168.8.1 'dd if=/dev/mmcblk0 bs=1M' > flint3-emmc-full.img

A whole-disk checksum will not match afterwards because the unit is live, but the partitions that cannot change at runtime must. Compare these on-device against the same ranges carved out of the image (sfdisk -l gives offsets): 0:SBL1, 0:QSEE, 0:DEVCFG, 0:TME, 0:CDT, 0:APPSBL, 0:ART, 0:WIFIFW, 0:HLOS.

ssh root@192.168.8.1 'cat > /tmp/su.bin' < openwrt-*-glinet_gl-be9300-squashfs-sysupgrade.bin
ssh root@192.168.8.1 'md5sum /tmp/su.bin'

This replicates what OpenWrt's own emmc_upgrade_tar() does: invalidate the kernel, write the rootfs, write the kernel, invalidate the old overlay.

ssh root@192.168.8.1 'sh -s' <<'EOF'
set -e
TAR=/tmp/su.bin; KERN=/dev/mmcblk0p12; ROOT=/dev/mmcblk0p13
DIR=$(tar tf "$TAR" | grep -m1 '^sysupgrade-.*/$'); DIR=${DIR%/}
dd if=/dev/zero of="$KERN" bs=512 count=8; sync
B=$(tar -xOf "$TAR" "$DIR/root" | dd of="$ROOT" bs=512 2>&1 | grep "records out" | cut -d' ' -f1); sync
tar -xOf "$TAR" "$DIR/kernel" | dd of="$KERN" bs=512; sync
dd if=/dev/zero of="$ROOT" bs=512 seek=$(( (${B%%+*} + 127) & ~127 )) count=8; sync
dd if="$KERN" bs=4 count=1 | hexdump -e '4/1 "%02x"'; echo " <- want d00dfeed"
dd if="$ROOT" bs=4 count=1 | hexdump -e '4/1 "%02x"'; echo " <- want 68737173 (hsqs)"
EOF

Reboot only if both magic values are correct. The device then comes up as a default OpenWrt at 192.168.1.1.

• GL.iNet U-Boot web recovery: hold the reset button while powering on, then browse to 192.168.1.1 and upload stock GL.iNet firmware. This works regardless of what is on the eMMC and is the reason the procedure above is reasonably safe.
• Or restore partitions from your own backup.

• The FIT configuration node must be named config-1 (DEVICE_DTS_CONFIG := config-1). Stock U-Boot selects a FIT config by name from a built-in board table that has no AP-MI01.6 entry, so it falls back to requesting config-1. A board-specific name, or OpenWrt's own default config@1, gives Config not available and the unit will not boot from eMMC.
• The four sds0/sds1-rx/tx-swap properties in the rtl837x node are mandatory. Without them the SoC-to-switch link still reports Link is Up - 10Gbps/Full and the driver probes normally, but no traffic crosses in either direction. Check rxdesc_* in /proc/interrupts rather than link state.
• TX checksum offload must be disabled on a DSA conduit: the PPE checksum engine locates L3/L4 headers with its own parser, which does not understand the 4-byte Realtek tag.
• Bridge VLAN filtering does not work with the current rtl837x driver (ports declared untagged still egress tagged). Use 802.1q sub-interfaces on the CPU port instead, e.g. br-lan containing wan.10 plus the LAN ports.
• MLO works with no patches: one wifi-iface listing several radios plus option mlo '1' and WPA3/SAE produces an ap-mld0 AP MLD.

An internal header provides the console at 115200 8N1, 3.3 V. The case must be opened to reach it. U-Boot autoboot is interrupted by sending the literal string gl (not Ctrl-C).

GPT on eMMC: 0:SBL1, 0:QSEE, 0:DEVCFG, 0:TME, 0:CDT, 0:APPSBLENV, 0:APPSBL, 0:ART, 0:WIFIFW, glcfg, log, 0:HLOS (kernel), rootfs.

0:ART holds per-device Wi-Fi calibration, the MAC addresses (offsets 0x4 and 0xa) and the factory regulatory country code (offset 0x88).

• Forum: GL.iNet Flint 3 exploration
• Work-in-progress OpenWrt branch