staging/stintel/package/boot, branch master

qualcommax: ipq50xx: add support for Xunison Exigo Hub D50 5G

2026-10-16T07:52:28Z

The Xunison Exigo Hub D50 5G is a 5G/LTE router with Wi-Fi 6. It is also sold as the Zearts D50 5G. Specifications: SoC: Qualcomm IPQ5018, dual-core Cortex-A53 @ 1.0 GHz RAM: 512 MiB Flash: 128 MiB SPI NAND (ESMT F50D1G41LB) WLAN: IPQ5018 2.4 GHz, QCN9074 5 GHz (PCIe), both 802.11ax Ethernet: 1x GbE WAN (IPQ5018 internal GE PHY, gmac0) 3x GbE LAN (QCA8337 switch, SGMII to gmac1) WWAN: Quectel RM500Q-AE, 5G Sub-6 / LTE Cat 16, on USB 2.0 and PCIe Buttons: reset, WPS LEDs: MESH (green/red), 5G (green/red), 4G, WiFi, Internet, WAN; power is hardwired Power: 12 V / 2 A DC Serial: 115200 8N1, 4-pin header JP1 next to SW4 on the main board, from pin 1: VCC, TX, RX, GND Notes: - WAN is gmac0 wired straight to the internal GE PHY, not a switch port; its netdev is named wan by the label property. - The console RX line (gpio20) is pulled up. Left floating with nothing on the header it causes an interrupt storm and, on some units, a hang at boot. - USB is 2.0 only: the controller is limited to the HS PHY and clocks its pipe from UTMI. The 5 V supply for the port and the modem is switched by gpio24 (active low). - MACs follow the stock firmware: LAN uses 0:art 0x0, WAN 0:art 0x6. The label has no MAC printed, so there is no label-mac-device. - Wi-Fi calibration data and MAC addresses come from 0:art through nvmem cells on the Wi-Fi nodes (calibration: IPQ5018 at 0x1000, QCN9074 at 0x26800). The caldata holds the Qualcomm placeholder MAC, so the radios take the 0:art 0x0 MAC + 2 and + 3 instead. - Board data for both radios is submitted separately to firmware_qca-wireless under the calibration variant Xunison-Exigo-Hub-D50-5G, both taken from the stock firmware: bdwlan.b24-brax for the IPQ5018 and qcn9000/bdwlan.ba0 for the QCN9074. The brax file is the vendor's board variant; on my unit it outperformed the bdwlan.b24 that the stock firmware loads. - The modem power line (gpio31) has no consumer and is kept high with a GPIO hog. - The Internet LED is lit while the modem's wwan0 is up. The WiFi LED uses the network trigger in link mode, so it is lit while an AP is up on either radio; the phyNradio triggers never light it with ath11k on this board. The 4G and 5G LEDs have no trigger, as nothing in the kernel reports the modem's access technology. Modem: The RM500Q-AE is wired to both USB and PCIe, and its data_interface setting selects which one carries data. The stock firmware leaves it on PCIe (data_interface 1,0) and this port uses it there, so no AT command is needed after installing. It is driven by mhi-pci-generic with MBIM: data on wwan0, control on /dev/wwan0mbim0 and AT commands on /dev/wwan0at0. No modem interface is preconfigured; add one with the "mbim" protocol on /dev/wwan0mbim0. Installation: The factory image is a raw UBI image for the U-Boot web recovery. 1. Power the router off, hold the reset button and power it on. Keep holding until the Internet LED stays lit (about 10 seconds). 2. Set a computer on a LAN port to 192.168.1.2/24 and open http://192.168.1.254 3. Upload openwrt-qualcommax-ipq50xx-xunison_exigo-hub-d50-5g-squashfs-factory.img and wait for the router to reboot. Later upgrades use the sysupgrade image. The port started from George Moussalem's device support in the 4IceG OpenWrt tree, with the device tree reworked by Lukasz Szczur (LS3434): USB, the modem supply and the NAND/sysupgrade layout. Thanks to Hostle for the flashing work on this board and to Rafał Wabik (4IceG) for the tree it was developed in. Link: https://forum.openwrt.org/t/adding-support-for-xunison-exigo-d50-5g-zearts-d50-5g-ipq5018/247016 Co-developed-by: George Moussalem Signed-off-by: George Moussalem Co-developed-by: Lukasz Szczur <8sdasfasfas@royaleplaysempire.com> Signed-off-by: Lukasz Szczur <8sdasfasfas@royaleplaysempire.com> Co-developed-by: Rafał Wabik <4rafal@gmail.com> Signed-off-by: Rafał Wabik <4rafal@gmail.com> Signed-off-by: Steve Meek Link: https://github.com/openwrt/openwrt/pull/25890 Signed-off-by: Robert Marko

airoha: introduce device tree overlay support for AN7583

2026-10-16T07:30:40Z

To reduce code duplication across different AN7583 evaluation boards, introduce a shared multi-EVB base device tree and utilize Device Tree Overlays (DTSO) for board-specific configurations. Signed-off-by: Yalei Zang Link: https://github.com/openwrt/openwrt/pull/24926 Signed-off-by: Christian Marangi

airoha: introduce device tree overlay support for AN7581

2026-10-16T07:30:40Z

To reduce code duplication across different AN7581 evaluation boards, introduce a shared multi-EVB base device tree and utilize Device Tree Overlays (DTSO) for board-specific configurations. Signed-off-by: Yalei Zang Link: https://github.com/openwrt/openwrt/pull/24926 Signed-off-by: Christian Marangi

uboot-airoha: enable OF_LIBFDT_OVERLAY support

2026-10-16T07:30:39Z

Enable CONFIG_OF_LIBFDT_OVERLAY for the AN7581 and AN7583 EVB defconfigs to support loading and applying device tree overlays at boot time. Signed-off-by: Yalei Zang Link: https://github.com/openwrt/openwrt/pull/24926 Signed-off-by: Christian Marangi

mediatek: filogic: comfast cf-wa933: replace 128M variant with all-in-UBI

2026-10-15T20:03:42Z

Replace the expanded fixed-partition 128M target with a dedicated all-in-UBI target and OpenWrt U-Boot. Include bootloader configuration, image generation and upgrade support together. Share the fixed-partitions container and read-only 1 MiB BL2 range in the common DTSI. Declare the remaining partitions and factory NVMEM data in the variant DTS files. Keep NMBM on the legacy target and preserve its stock partition map and 64 MiB UBI region. The new layout uses a 1 MiB bl2 partition followed by a 127 MiB ubi partition, with factory and fit NVMEM/rootdisk references and redundant U-Boot environment volumes. Set the UBI variant boot arguments to `root=/dev/fit0 rootwait` and identify its fit volume as the root disk. The bootloader supplies memory and console parameters. Add the U-Boot configuration, default environment and target, recovery FIT and sysupgrade FIT images, BL2 and BL31/U-Boot artifacts, UBI environment access and FIT upgrade checks. Recognise the new compatible in board defaults. Bump the uboot-tools package release for the new environment configuration support. The installer creates fip, factory, ubootenv, ubootenv2, recovery and initial fit volumes. U-Boot and sysupgrade manage the production FIT and writable rootfs_data. DTS declarations identify volumes consumed by Linux; they do not themselves create or populate factory data. MAC address layout ------------------ Factory data is read from the legacy Factory MTD partition or the factory UBI volume; the offsets within the data are unchanged. Unit-specific address bytes are xx:xx:xx. LAN: factory offset 0xe000, mac-base cell index 0. WAN: factory offset 0xe000, mac-base cell index 1 (LAN MAC + 1). 2.4 GHz: factory offset 0x4, mac-base cell index 0. 5 GHz: factory offset 0x8000, mac-base cell index 0. Flash instructions ------------------ Conversion requires an installer; the sysupgrade ITB alone cannot convert the stock partition layout or preserve its factory data. 1. Start from the standard CF-WA933 OpenWrt target with stock MTD partitions. Back up BL2, u-boot-env, Factory and FIP with mtd dump, and copy all four files off the device before proceeding: mtd dump BL2 > /tmp/BL2.bin mtd dump u-boot-env > /tmp/u-boot-env.bin mtd dump Factory > /tmp/Factory.bin mtd dump FIP > /tmp/FIP.bin 2. Obtain the CF-WA933 installer from: https://github.com/andros-ua/owrt-ubi-installer/releases Its source and build script are available at: https://github.com/andros-ua/owrt-ubi-installer/tree/cf-wa933 Connect the PC to a LAN port and use 192.168.1.254/24; the device is at 192.168.1.1. Copy the resulting image to /tmp and run: cd /tmp sysupgrade -n \ openwrt-*-comfast_cf-wa933-ubi-initramfs-recovery-installer.itb This external installer extracts calibration/MAC data from the old Factory region before erasing it, creates and populates the static factory UBI volume, writes BL2 and fip, and creates the redundant environment, recovery and initial fit volumes. It copies one NAND eraseblock of factory data; keep the full external Factory backup. The blue WLAN LED blinks during installation and stays lit for five seconds before reboot. Run the installer only for initial conversion. 3. Once recovery boots, copy the production image to /tmp and run: cd /tmp sysupgrade -n \ openwrt-*-comfast_cf-wa933-ubi-squashfs-sysupgrade.itb To return to the legacy layout, boot the standard CF-WA933 initramfs in RAM, restore the saved BL2/u-boot-env/Factory/FIP to their original MTD partitions (using kmod-mtd-rw when needed), then sysupgrade to the standard CF-WA933 image. The restored vendor bootloader's recovery page can install vendor firmware. UART recovery of BL2/FIP is also available using https://github.com/981213/mtk_uartboot. Signed-off-by: Andrii Kuiukoff Signed-off-by: Guillaume RISCHARD Link: https://github.com/openwrt/openwrt/pull/24590 Signed-off-by: Jonas Jelonek

qualcommax: ipq50xx: add support for Wallys DR5018S

2026-10-14T08:18:19Z

The Wallys DR5018S is an IPQ5018-based tri-band Wi-Fi 6E board. Product specification: https://www.wallystech.com/upload/DR5018S.pdf Hardware: - Qualcomm IPQ5018 SoC - 512 MB DDR3L RAM - 8 MB SPI NOR flash (Macronix MX25U6435F) - 128 MB SPI NAND flash (GigaDevice GD5F1GM7REYIG) - 1 x 1 GbE LAN port using the integrated GEPHY - 1 x 2.5 GbE WAN port using a QCA8081 PHY - 2x2 2.4 GHz Wi-Fi 6 using the integrated radio - 2x2 5 GHz and 2x2 6 GHz Wi-Fi 6E using QCN6122 radios - 1 x USB 2.0 pin-header interface - 1 x reset button - 4 x blue status LEDs - UART: J3 next to the USB header, 115200 8N1 - pin 1: 3.3 V (do not connect) - pin 2: TX - pin 3: RX - pin 4: GND - Power: 12-52 V DC jack, or 802.3at/bt and passive 48 V PoE (the manufacturer does not publish a DC current rating) The SPI NOR contains the boot chain, U-Boot environment and ART partitions. The SPI NAND contains the training area and two 62 MiB rootfs slots. Add the device tree, FIT/UBI image definitions, network defaults, calibration extraction, U-Boot environment access and NAND sysupgrade support. MAC addresses: - LAN: stored in ART at offset 0x0 and read through an NVMEM mac-base cell - WAN: stored in ART at offset 0x6 and read through an NVMEM mac-base cell - 2.4 GHz: stored in the ART calibration block at offset 0x100e - 5 GHz: stored in the ART calibration block at offset 0x2680e - 6 GHz: stored in the ART calibration block at offset 0x4c00e The three Wi-Fi calibration blocks are extracted from ART and retain their stored per-radio MAC addresses; they are not derived from the Ethernet MAC addresses. The sysupgrade handler removes OEM-only UBI volumes before creating the OpenWrt kernel, rootfs and rootfs_data volumes. Installation: 1. Connect to the J3 serial console and interrupt the vendor U-Boot. Copy the generated initramfs-uImage.itb to the TFTP root as initramfs.itb, then configure TFTP and boot it: setenv serverip 192.168.1.10 setenv ipaddr 192.168.1.1 tftpboot 0x44000000 initramfs.itb bootm 0x44000000 2. Transfer the generated squashfs-sysupgrade.bin to the device as /tmp/sysupgrade.bin and install it: sysupgrade -n /tmp/sysupgrade.bin Reverting to the vendor firmware has not been tested. Back up the complete SPI NOR and both SPI NAND rootfs slots before installing OpenWrt. Dependencies: - CMN PLL boot fix: https://github.com/openwrt/openwrt/pull/24653 - Internal radio fix: https://github.com/openwrt/openwrt/pull/24909 - Board data: https://github.com/openwrt/firmware_qca-wireless/pull/149 Tested on a Wallys DR5018S with the dependencies above applied: - initramfs boot from the vendor U-Boot - installation to SPI NAND and subsequent sysupgrade - repeated cold boots - 1 GbE LAN and 2.5 GbE WAN - 2.4 GHz, 5 GHz and 6 GHz AP interfaces - USB 2.0 host-controller registration - four blue status LED outputs Signed-off-by: Alan Gao <1226010136@qq.com> Link: https://github.com/openwrt/openwrt/pull/24910 Signed-off-by: Robert Marko

qualcommax: ipq50xx: add support for Linksys MR2000

2026-10-14T08:16:19Z

Add support for Linksys MR2000-family routers based on Qualcomm IPQ5018, including the MR20WH (LN3111) and MR20EC variants. Hardware: - Qualcomm IPQ5018 - 512 MiB RAM - GigaDevice GD5F2GQ5REYIH 256 MiB SPI-NAND - QCA8337 switch with four Gigabit LAN ports over SGMII - dedicated IPQ5018 internal Gigabit Ethernet PHY for WAN - IPQ5018 2.4 GHz 802.11ax - QCN6122 5 GHz 802.11ax - USB host port - RGB status LED - reset and WPS buttons - 12 V / 1.5 A power input The MR20WH uses the same stock firmware as the MR2000 family, so use MR2000 as the canonical OpenWrt board identity. The tested hardware was an MR20WH (LN3111). The board support was initially derived from the existing MX2000 support, but the MR2000 family differs from the MX2000 in Ethernet topology, GPIO assignments and NAND partitioning. UART is available on the four-pin header on the left PCB edge. With the Ethernet ports facing down, the pins from top to bottom are RX, TX, GND and +5V. The serial console uses 115200 8N1. The base MAC address is stored as hw_mac_addr in the devinfo partition. LAN and WAN use the base address. The 2.4 GHz and 5 GHz radios use base +1 and base +2 respectively. Use Qualcomm SMEM partition discovery instead of board-specific fixed partitions. Retain Linksys dual-bank upgrade handling, pending further validation of the NAND layout. The factory image can be installed directly from the stock Linksys firmware web interface. The factory image now inherits the MR2000 Linksys image type from the common device recipe. For recovery and development, initramfs can be loaded from stock U-Boot using TFTP: setenv ethact eth1 setenv ipaddr 192.168.1.1 setenv serverip 192.168.1.10 tftpboot 0x44000000 bootm 0x44000000 After OpenWrt is installed, use the normal sysupgrade image for subsequent upgrades. USB 2.0 hotplug, mass storage and the USB status LED were verified on hardware. USB 3.0 SuperSpeed was verified at 5000 Mbps using a RAM-patched device tree with the upstream dual-PHY configuration. The MR2000-specific IPQ5018 and QCN6122 board files were extracted from stock Linksys firmware and submitted to firmware_qca-wireless PR #169. Select the matching MR2000 calibration variants and ipq-wifi package. The firmware source revision must be updated after the board files are merged. Add the MR2000 uboot-envtools configuration and register the MR2000-specific ipq-wifi package. Signed-off-by: Joe Aear <360alaska@gmail.com> Link: https://github.com/openwrt/openwrt/pull/25673 Signed-off-by: Robert Marko

boot: arm-trusted-firmware-microchipsw: make ECDSA signatures reproducible

2026-10-14T07:39:33Z

Use RFC 6979 nonces with the staged LibreSSL host tool when SOURCE_DATE_EPOCH is set. Retry deterministically for full-width LAN969x signature scalars while preserving random signing otherwise. Two clean builds produced identical FIP, FWU FIP and FWU HTML outputs. Signed-off-by: Robert Marko

boot: arm-trusted-firmware-microchipsw: stabilize cert metadata

2026-10-14T07:39:33Z

Use SOURCE_DATE_EPOCH for X.509 validity and hash the unsigned certificate fields to derive stable serial numbers. The hash includes payload extensions, so changed firmware gets a new serial. Retain the existing behavior when the variable is unset and reject invalid values. ECDSA signatures remain nondeterministic. Signed-off-by: Robert Marko

boot: arm-trusted-firmware-microchipsw: use fixed development keys

2026-10-14T07:39:33Z

Use the published P-256 example key from RFC 6979 for all seven default development signing roles instead of generating new keys. Keep role-specific filenames so TFA_KEY_DIR can supply distinct keys. Pass all supplied keys to both regular and FWU cert_create runs. Certificate times, serials, and ECDSA signatures still vary. The public demo key must not be provisioned as a production trust root. Signed-off-by: Robert Marko