Adding support for XUNISON Exigo D50 5G / ZEARTS D50 5G (IPQ5018)

IceG · February 28, 2026, 6:11pm

Hi,
Does anyone have this router and can help with getting official support? Maybe someone knows this platform well and can also help.

SoC: Qualcomm IPQ5018
Memory: 512 MB RAM
Flash: 128 MB NAND SLC
Modem: Quectel RM500Q-AE
Wi-Fi: Qualcomm QCN6024/9024/9074 Wi-Fi 6 AX5400
System: OpenWrt 23.05-SNAPSHOT (r0-6d811db45), kernel Linux 5.4.213

P.S.
Yes, I know router is weak, but it's worth trying to save it from becoming electronic waste.

At this point:

loading image via TFTP
running image in RAM
supporting LANs as DSA
supporting WAN
supporting buttons
supporting LEDs
using one of the LEDs to signal startup
supporting the modem (at least as a 3G prototype)
assigning MAC addresses to wired interfaces as in the original software
Wi-Fi running
assigning MAC addresses to wireless interfaces as in the original software
recovery via U-Boot Web GUI
restoring the original software
sysupgrade via console
saving image to flash

To be checked:

what about the modem and its support on MHI (requires a pcie modem)
what about the modem and its support by QMI/MBIM

Problems noticed:

No modem on the pcie (Problem with pcie / usb muxing)
LED reversed from wan (Hardware controlled LED)

Not done:

external USB (probably does not work, fake or UART?)

Errors to ignore

adpt_mp_port_netdev_change_notify[1186]:ERROR:netdev change notify with incorrect port 0 appears in the logs

Github
ipq50xx-xunison-d50

mega.nz/folder

LS3434 · February 28, 2026, 6:24pm

That’s standard on ipq5018 routers that have a switch for ports. Don’t worry about it.

georgem83 · February 28, 2026, 6:41pm

Can you post the stock and openwrt boot logs?

IceG · March 1, 2026, 9:02am

That is all I have at the moment:
999-mhi-add-rm500q-ae.patch
fork.log
fork_d50_dts.txt
info.txt
ipq5018-exigo-hub-d50-5g.dts
my_initramfs.log

my_files

IceG · March 2, 2026, 5:45pm

I have no knowledge and experience in adding support, so I am asking for help. My logs from the last compiled image vs fork.

logs.zip

I am open to suggestions.

IceG · March 6, 2026, 8:07am

The most important problems I cannot solve:

no modem on the PCI (in the fork, the modem starts up and is visible on the bus; I don't know if a patch has been added there or if the modem requires a better description in dts)

Fork:

root@Exigo_Hub:~# lspci
0000:00:00.0 PCI bridge: Qualcomm Device 1004
0000:01:00.0 Unassigned class [ff00]: Qualcomm Device 0306
0001:00:00.0 PCI bridge: Qualcomm Device 1004
0001:01:00.0 Network controller: Qualcomm QCN6024/9024/9074 Wireless Network Adapter (rev 01)

I have:

root@Exigo_Hub:~# lspci
0000:00:00.0 PCI bridge: Qualcomm Device 1004
0001:01:00.0 Network controller: Qualcomm QCN6024/9024/9074 Wireless Network Adapter (rev 01)
0001:00:00.0 PCI bridge: Qualcomm Device 1004

lack of hardware support for the WAN LED (it is controlled by the switch), the LED also has reversed logic, it is turned on by default at startup.

Fork:

[   15.647658] ssdk_mp_reset_init[1299]:INFO:MP reset successfully!
[   15.648435] mpge_phy_api_ops_init[606]:INFO:qca probe mpge phy driver succeeded!
[   15.653508] ssdk_led_init[34]:INFO:port id 0x1, ssdk_led_mode:3, ssdk_led_map:7fc, ssdk_led_src_id:0
[   16.021668] _adpt_mp_uniphy_clk_output_ctrl_set[255]:INFO:uniphy will output clock as 25000000Hz

At this point, I don't see any chance of official support for this device.

IceG · March 9, 2026, 3:08pm

At the moment, I'm losing with router and modem won't show up. I have a gpio list from two forks, I have dts from one fork, but either my knowledge is insufficient or something is missing in my OpenWrt.

root@gw7177af424074452a92f31c21a94cb530-R5Q-D50-1G-DB4-EM:/# cat /sys/kernel/debug/gpio

GPIOs 0-46, platform/1000000.pinctrl, 1000000.pinctrl:
 gpio0   : in  0 8mA pull down
 gpio1   : out 0 8mA pull down
 gpio2   : in  7 8mA pull down
 gpio3   : in  7 8mA pull down
 gpio4   : in  2 8mA no pull
 gpio5   : in  2 8mA no pull
 gpio6   : in  2 8mA no pull
 gpio7   : in  2 8mA no pull
 gpio8   : in  2 8mA no pull
 gpio9   : in  2 8mA no pull
 gpio10  : out 1 2mA no pull
 gpio11  : out 1 2mA no pull
 gpio12  : in  1 2mA no pull
 gpio13  : out 1 2mA no pull
 gpio14  : in  0 8mA pull down
 gpio15  : out 0 2mA pull down
 gpio16  : in  0 8mA pull down
 gpio17  : in  0 8mA pull down
 gpio18  : out 0 8mA pull down
 gpio19  : in  1 8mA pull up
 gpio20  : in  1 8mA pull up
 gpio21  : in  1 8mA pull up
 gpio22  : in  0 8mA pull up
 gpio23  : in  0 8mA pull down
 gpio24  : out 0 8mA pull down
 gpio25  : out 0 8mA pull up
 gpio26  : in  0 8mA pull down
 gpio27  : out 0 8mA pull down
 gpio28  : out 0 8mA pull down
 gpio29  : in  0 8mA pull down
 gpio30  : out 0 8mA pull down
 gpio31  : out 0 2mA pull up
 gpio32  : in  0 8mA pull down
 gpio33  : out 0 8mA pull down
 gpio34  : out 0 8mA pull down
 gpio35  : out 0 8mA pull down
 gpio36  : in  1 8mA pull up
 gpio37  : in  1 8mA pull up
 gpio38  : in  0 8mA pull up
 gpio39  : out 0 8mA pull down
 gpio40  : in  1 8mA pull down
 gpio41  : in  0 8mA pull down
 gpio42  : in  5 8mA pull down
 gpio43  : in  5 8mA pull down
 gpio44  : in  0 8mA pull down
 gpio45  : in  0 8mA pull down
 gpio46  : in  1 8mA pull down

root@gw7177af424074452a92f31c21a94cb530-R5Q-D50-1G-DB4-EM:/# lspci
0000:00:00.0 PCI bridge: Airgo Networks, Inc. Device 1004
0000:01:00.0 Unassigned class [ff00]: Airgo Networks, Inc. Device 0306
0001:00:00.0 PCI bridge: Airgo Networks, Inc. Device 1004
0001:01:00.0 Network controller: Airgo Networks, Inc. Device 1104 (rev 01)

root@Exigo_Hub:/# cat /sys/kernel/debug/gpio
gpiochip0: GPIOs 465-511, parent: platform/1000000.pinctrl, 1000000.pinctrl:
 gpio0   : in  low  func0 8mA pull down
 gpio1   : out low  func0 8mA pull up
 gpio2   : in  high func7 8mA pull down
 gpio3   : in  low  func7 8mA pull down
 gpio4   : in  high func2 8mA no pull
 gpio5   : in  high func2 8mA no pull
 gpio6   : in  low  func2 8mA no pull
 gpio7   : in  low  func2 8mA no pull
 gpio8   : in  high func2 8mA no pull
 gpio9   : in  low  func2 8mA no pull
 gpio10  : out low  func1 2mA no pull
 gpio11  : out low  func1 2mA no pull
 gpio12  : in  low  func1 2mA no pull
 gpio13  : out low  func1 2mA no pull
 gpio14  : in  low  func0 8mA pull down
 gpio15  : out high func0 2mA pull down
 gpio16  : in  high func0 8mA pull down
 gpio17  : in  low  func0 8mA pull down
 gpio18  : out high func0 8mA pull down
 gpio19  : in  high func0 8mA pull up
 gpio20  : in  high func1 8mA no pull
 gpio21  : in  high func1 8mA no pull
 gpio22  : in  high func0 8mA pull up
 gpio23  : in  low  func0 8mA pull down
 gpio24  : out high func0 8mA pull down
 gpio25  : in  low  func0 8mA pull down
 gpio26  : in  low  func0 8mA pull down
 gpio27  : out high func0 8mA pull down
 gpio28  : out low  func0 8mA pull down
 gpio29  : in  low  func0 8mA pull down
 gpio30  : out high func0 8mA pull down
 gpio31  : out high func0 2mA pull up
 gpio32  : in  low  func0 8mA pull down
 gpio33  : out low  func0 8mA pull down
 gpio34  : out low  func0 8mA pull down
 gpio35  : out low  func0 8mA pull down
 gpio36  : in  high func1 8mA pull up
 gpio37  : in  high func1 8mA pull up
 gpio38  : in  high func0 8mA pull up
 gpio39  : out high func0 8mA pull down
 gpio40  : in  high func1 8mA pull down
 gpio41  : in  low  func0 8mA pull down
 gpio42  : in  low  func5 8mA pull down
 gpio43  : in  high func5 8mA pull down
 gpio44  : in  high func0 8mA pull down
 gpio45  : in  low  func0 8mA pull down
 gpio46  : in  low  func1 8mA pull down

IceG · March 9, 2026, 3:11pm

Does anyone have any idea how to get this modem working on a pcie?

vaultecboy · March 9, 2026, 4:55pm

I wish they support this router

IceG · March 9, 2026, 7:19pm

Someone with more knowledge needs to join in, I don't know enough to move forward on my own. We know that there are more users of this router.

Hostle · March 9, 2026, 9:28pm

can you post the full oem bootlog on file.bin or paste.bin, my av is flagging what ever it is you are currently using.

IceG · March 9, 2026, 9:55pm

It's strange because I added files to filebin.net normally.

full bootlog (fork)

fork_d50_dts

Hostle · March 9, 2026, 11:09pm

should be able to get the ipq stuff up without too much trouble.

[   40.454150] wlan: [4703:I:ANY] ol_ath_wifi_ssr: Starting Driver Probe
[   40.496717] cnss[2]: INFO: Downloading BDF: IPQ5018/regdb.bin, size: 24278
[   40.497143] cnss[2]: INFO: Waiting for FW ready. Device: 0xfffc, FW ready timeout: 60 seconds
[   40.523156] cnss[2]: INFO: Downloading BDF: IPQ5018/bdwlan.b24, size: 131072
[   40.595806] cnss[2]: INFO: Downloading BDF: IPQ5018/caldata.bin, size: 131072

...
Downloading BDF: qcn9000/bdwlan.ba0

you can start by fetching the bdf's from the oem firmware, as you can see above, you are looking for

ipq5018 --> bdwlan.b24
qcn9000 --> bdwlan.ba0

@georgem83 have you looked at this ? I am away for a couple days, I will look at it closer when i get back. Just wondering if you see anything problematic ... besides the modem

georgem83 · March 10, 2026, 6:38am

we should be able to get wifi up and running. Send over the bdwlan files (b24 for ipq5018 and ba0 for qcn9074) and I'll create the package for you.

As for the modem, if it's connected to pcie1, we have a similar issue with the Xiaomi AX6000 where we can't get the ath10k IoT wifi working. This is likely also related to not being able to enabling USB3 on the MR5500. USB3 and PCIE1 are muxed and is controlled by a register in TCSR.
Although the register is set correctly and the PHY probes successfully, it remains in Rx.Detect state and falls back to USB2.
My best guess it's a clock / reset issue which I haven't been able to figure out.

Hostle · March 10, 2026, 12:01pm

Are you setting the mode correctly...

Parent Mode Requirement: The Linksys MR5500 FAQ specifies that USB functionality is only supported when the router is in Parent Mode; it is disabled in Child/Node mode.

and set mux to 1 for USB3 0 for PCeei

&tcsr {
...
    qcom,usb3-pcie-mux = <1>; // Set to 1 for USB3
};

TCSR Register Address: Typically located within the 0x01900000 block (common for IPQ5018/IPQ5400 series architectures).
Bit Value:
0: Selects PCIe1 (often the factory default if the lane is used for a secondary Wi-Fi chip or M.2 slot).
1: Selects USB3.0.

I sure you've considered this already ...

Hostle · March 10, 2026, 1:09pm

If you need help retrieving the bdf's let us know. In any case, you should backup each partition and scp them to safety first. Afterwards, you can mount the wifi partition and grab the bdfs from there.

Once you got them, zip them and post the link to a file.bin.

IceG · March 10, 2026, 2:26pm

I copied files from the router:
/lib/firmware/IPQ5018/WIFI_FW
I also made copies of the partitions, but I did not extract data from the art partition.
Correct me if I did it "unprofessionally".

ipq5018 --> bdwlan.b24
qcn9000 --> bdwlan.ba0

wi-fi

initial dts

Hostle · March 10, 2026, 2:44pm

looks good.

the caldata script does that for you, no worries.

@georgem83 i think we've got everything you need here now. Let me know if you need anything else.

Thanks for helping out

IceG · March 10, 2026, 5:56pm

@Hostle @georgem83 Is there any way to fix this symptom? The WAN LED is on (hardware controlled) and turns off when the plug is inserted.

P.S.
The dts added above reads correct lans/wan MAC. I will add MAC for Wi-Fi in the 11-ath11k-caldata file. That's all the ideas I have.

Hostle · March 10, 2026, 6:08pm

perhaps invert the gpio ACTIVE state in dts...

GPIO_ACTIVE_HIGH --> GPIO_ACTIVE_LOW

or vice versa

leds {
    compatible = "gpio-leds";
    pwr_led: pwr {
        label = "system-pwr";
        // gpios = <&expgpio 2 GPIO_ACTIVE_LOW>; // Example with a specific controller handle
        gpios = <&gpio1 2 GPIO_ACTIVE_LOW>; // Example with controller 'gpio1' and pin 2
        linux,default-trigger = "default-on";
    };
}

I should have used function/ color instead of label ... but you get the idea

EDIT

this has the same effect ...

gpios = <&gpio 17 0>; // ACTIVE HIGH
gpios = <&gpio 17 1>; // ACTIVE LOW