Adding support for (unbranded) IPQ5018

MrConnor · June 17, 2026, 4:39am

I got this ISP ewaste that I've been trying to add support for this no-name device but I don't know where to go from this point. I decompiled the DTB from a firmware dump, cleaned it up, and used GL.iNet GL-B3000 as a reference due to similarities in hardware.

DTS Contents:

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

/dts-v1/;

#include "ipq5018.dtsi"
#include "ipq5018-ess.dtsi"
#include "ipq5018-qcn6122.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>

/ {
	model = "SmartInc S3000AX";
	compatible = "smartinc,s3000ax", "qcom,ipq5018";

	aliases {
		serial0 = &blsp1_uart1;
	};
	
	reserved-memory {
		m3_dump: m3-dump-addr@4E000000 {
			no-map;
			reg = <0x0 0x4E000000 0x0 0x100000>;
		};

	};

	chosen {
		bootargs-append = " root=/dev/ubiblock0_1 swiotlb=1 coherent_pool=2M";
		stdout-path = "serial0:115200n8";
	};
	
	keys {
		compatible = "gpio-keys";
		pinctrl-0 = <&button_pins>;
		pinctrl-names = "default";
		
		reset-button {
			label = "reset";
			gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};

		wps-button {
			label = "wps";
			gpios = <&tlmm 31 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_WPS_BUTTON>;
		};
	};

	leds {
		compatible = "gpio-leds";
		pinctrl-0 = <&led_pins>;
		pinctrl-names = "default";

		led_power_blue {
			gpios = <&tlmm 27 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_BLUE>;
			default-state = "off";
		};
		led_power_red {
			gpios = <&tlmm 28 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_RED>;
			default-state = "on";
		};
		led_power_green {
			gpios = <&tlmm 30 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_GREEN>;
			default-state = "off";
		};
		4g_power {
			label = "4g_power";
			gpios = <&tlmm 23 GPIO_ACTIVE_HIGH>;
			default-state = "on";
		};
		sim_sw {
			label = "sim_sw";
			gpios = <&tlmm 25 GPIO_ACTIVE_LOW>;
			default-state = "off";
		};
		4g {
			label = "4g";
			gpios = <&tlmm 32 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};
	};
};

&qpic_nand {
	pinctrl-0 = <&qpic_pins>;
	pinctrl-names = "default";
	status = "okay";

	nand@0 {
		compatible = "spi-nand";
		reg = <0>;
		nand-ecc-engine = <&qpic_nand>;
		nand-bus-width = <8>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "0:sbl1";
				reg = <0x00000000 0x80000>;
				read-only;
			};

			partition@80000 {
				label = "0:mibib";
				reg = <0x00080000 0x80000>;
				read-only;
			};

			partition@100000 {
				label = "0:bootconfig";
				reg = <0x00100000 0x40000>;
				read-only;
			};

			partition@140000 {
				label = "0:bootconfig1";
				reg = <0x00140000 0x40000>;
				read-only;
			};

			partition@180000 {
				label = "0:qsee";
				reg = <0x00180000 0x100000>;
				read-only;
			};

			partition@280000 {
				label = "0:qsee_1";
				reg = <0x00280000 0x100000>;
				read-only;
			};

			partition@380000 {
				label = "0:devcfg";
				reg = <0x00380000 0x40000>;
				read-only;
			};

			partition@3c0000 {
				label = "0:devcfg_1";
				reg = <0x003c0000 0x40000>;
				read-only;
			};

			partition@400000 {
				label = "0:cdt";
				reg = <0x00400000 0x40000>;
				read-only;
			};

			partition@440000 {
				label = "0:cdt_1`";
				reg = <0x00440000 0x40000>;
				read-only;
			};

			partition@480000 {
				label = "0:appsblenv";
				reg = <0x00480000 0x80000>;
			};

			partition@500000 {
				label = "0:appsbl";
				reg = <0x00500000 0x140000>;
				read-only;
			};

			partition@640000 {
				label = "0:appsbl_1";
				reg = <0x00640000 0x140000>;
				read-only;
			};

			partition@780000 {
				label = "0:art";
				reg = <0x00780000 0x100000>;
				read-only;

				nvmem-layout {
					compatible = "fixed-layout";
					#address-cells = <1>;
					#size-cells = <1>;

					macaddr_dp1: macaddr@0 {
						reg = <0x0 0x6>;
					};

					macaddr_dp2: macaddr@6 {
						reg = <0x6 0x6>;
					};

					ipq5018_caldata: caldata@1000 {
						reg = <0x1000 0x20000>;
					};

					qcn6102_caldata: caldata_1@26800 {
						reg = <0x26800 0x20000>;
					};
				};
			};

			partition@880000 {
				label = "0:training";
				reg = <0x00880000 0x80000>;
				read-only;
			};

			partition@900000 {
				label = "rootfs";
				reg = <0x00900000 0x3A00000>;
			};

			partition@4300000 {
				label = "rootfs_recovery";
				reg = <0x04300000 0x3A00000>;
			};
		};
	};
};

&sleep_clk {
	clock-frequency = <32000>;
};

&xo_board_clk {
	clock-div = <4>;
	clock-mult = <1>;
};

&blsp1_uart1 {
	status = "okay";

	pinctrl-0 = <&serial_0_pins>;
	pinctrl-names = "default";
};

&crypto {
	status = "okay";
};

&cryptobam {
	status = "okay";
};

&prng {
	status = "okay";
};

&qfprom {
	status = "okay";
};

&qpic_bam {
	status = "okay";
};

&tsens {
	status = "okay";
};

&switch {
	status = "okay";
	switch_mac_mode = <MAC_MODE_SGMII_CHANNEL0>;

	qcom,port_phyinfo {
		port@0 {
			port_id = <1>;
			mdiobus = <&mdio0>;
			phy_address = <7>;
		};

		port@1 {
			port_id = <2>;
			forced-speed = <1000>;
			forced-duplex = <1>;
		};
	};
};

&dp1 {
	status = "okay";

	label = "wan";
	nvmem-cells = <&macaddr_dp2 2>;
	nvmem-cell-names = "mac-address";
};

&dp2 {
	status = "okay";
	nvmem-cells = <&macaddr_dp2 0>;
	nvmem-cell-names = "mac-address";

	fixed-link {
		speed = <1000>;
		full-duplex;
	};
};

&mdio0 {
	status = "okay";
};

&mdio1 {
	status = "okay";
	pinctrl-0 = <&mdio1_pins>;
	pinctrl-names = "default";
	reset-gpios = <&tlmm 39 GPIO_ACTIVE_LOW>;

	qca8337_0: ethernet-phy@0 {
		reg = <0>;
	};

	qca8337_1: ethernet-phy@1 {
		reg = <1>;
	};

	qca8337_2: ethernet-phy@2 {
		reg = <2>;
	};

	ethernet-switch@18 {
		compatible = "qca,qca8337";
		reg = <18>;
		#address-cells = <1>;
		#size-cells = <0>;

		ports {
			#address-cells = <1>;
			#size-cells = <0>;

			port@1 {
				reg = <1>;
				label = "wan";
				phy-handle = <&qca8337_0>;
			};

			port@2 {
				reg = <2>;
				label = "lan1";
				phy-handle = <&qca8337_1>;
				
			};
			
			port@3 {
				reg = <3>;
				label = "lan2";
				phy-handle = <&qca8337_2>;
			};
				
			port@6 {
				reg = <6>;
				label = "cpu";
				phy-mode = "sgmii";
				ethernet = <&dp2>;
				qca,sgmii-enable-pll;
				
				fixed-link {
					speed = <1000>;
					full-duplex;
				};
			};
		};
	};
};

&tlmm {
	button_pins: button-state {
		wps-button {
			pins = "gpio31";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-up;
		};
		reset-button {
			pins = "gpio38";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-up;
		};
	};

	led_pins: led-state {
		pins = "gpio27", "gpio28", "gpio30", "gpio23",
		       "gpio25", "gpio32";
		function = "gpio";
		drive-strength = <8>;
		bias-pull-down;
	};

	mdio1_pins: mdio-state {
		mdc-pins {
			pins = "gpio36";
			function = "mdc";
			drive-strength = <8>;
			bias-pull-up;
		};

		mdio-pins {
			pins = "gpio37";
			function = "mdio";
			drive-strength = <8>;
			bias-pull-up;
		};
	};
	
	qpic_pins: qpic-state {
		clock-pins {
			pins = "gpio9";
			function = "qspi_clk";
			drive-strength = <8>;
			bias-disable;
		};

		cs-pins {
			pins = "gpio8";
			function = "qspi_cs";
			drive-strength = <8>;
			bias-disable;
		};

		data-pins {
			pins = "gpio4", "gpio5", "gpio6", "gpio7";
			function = "qspi_data";
			drive-strength = <8>;
			bias-disable;
		};
	};

	serial_0_pins: uart0-state {
			pins = "gpio20", "gpio21";
			function = "blsp0_uart0";
			bias-disable;
	};

	switch_reset_pins: switch-reset-state {
		pins = "gpio39";
		function = "gpio";
		drive-strength = <8>;
		bias-pull-down;
	};
};

&q6v5_wcss {
	status = "okay";
	boot-args = <0x2 4 2 18 0 0>;
};

&wifi {
	status = "okay";
	
	qcom,rproc = <&q6_wcss_pd1>;
	qcom,userpd-subsys-name = "q6v5_wcss_userpd1";

	qcom,caldb-addr = <&ipq5018_caldata>;

	qcom,ath11k-fw-memory-mode = <1>;
	qcom,bdf-addr = <0x4c400000>;
	qcom,m3-dump-addr = <&m3_dump>;

	ieee80211-freq-limit = <2400000 2483000>;
	qcom,multipd_arch;
	qcom,board_id = <23>;
};

&wifi1 {
	status = "okay";

	qcom,rproc = <&q6_wcss_pd3>;
	qcom,userpd-subsys-name = "q6v5_wcss_userpd3";
	
	qcom,caldb-addr = <&qcn6102_caldata>;
	
	qcom,ath11k-fw-memory-mode = <1>;
	qcom,bdf-addr = <0x4d100000>;
	qcom,m3-dump-addr = <0x4df00000>;

	ieee80211-freq-limit = <5150000 5850000>;
	qcom,multipd_arch;
	qcom,board_id = <60>;
};

&pcie0_phy {
	status = "okay";
};

&pcie0 {
	status = "okay";
	perst-gpios = <&tlmm 15 GPIO_ACTIVE_LOW>;
};

&pcie1_phy {
	status = "okay";
};

&pcie1 {
	status = "okay";
	perst-gpios = <&tlmm 18 GPIO_ACTIVE_HIGH>;
};

Serial Log:

... (had to trim it down due to character limit)

[    1.541902] 17 fixed-partitions partitions found on MTD device spi0.0
[    1.541965] Creating 17 MTD partitions on "spi0.0":
[    1.547345] 0x000000000000-0x000000080000 : "0:sbl1"
[    1.555211] 0x000000080000-0x000000100000 : "0:mibib"
[    1.559200-0x000000180000 : "0:bootconfig1"
[    1.569244] 0x000000180000-0x000000280000 : "0:qsee"
[    1.575767] 0x000000280000-0x000000380000 : "0:qsee_1"
[    1.581383] 0x000000380000-0x0000003c0000 : "0:devcfg"
[    1.584981] 0x0000003c0000-0x000000400000 : "0:devcfg_1"
[    1.589789] 0x000000400000-0x000000440000 : "0:cdt"
[    1.595688] 0x000000440000-0x000000480000 : "0:cdt_1`"
[    1.600092] 0x000000480000-0x000000500000 : "0:appsblenv"
[    1.605579] 0x000000500000-0x000000640000 : "0:appsbl"
[    1.612391] 0x000000640000-0x000000780000 : "0:appsbl_1"
[    1.617195] 0x000000780000-0x000000880000 : "0:art"
[    1.623138] 0x000000880000-0x000000900000 : "0:training"
[    1.626205] 0x000000900000-0x000004300000 : "rootfs"
[    1.713582] mtd: setting mtd15 (rootfs) as root device
[    1.714185] mtdsplit: no squashfs found in "rootfs"
[    1.717661] 0x000004300000-0x000007d00000 : "rootfs_recovery"
[    2.012318] i2c_dev: i2c /dev entries driver
[    2.016811] sdhci: Secure Digital Host Controller Interface driver
[    2.016870] sdhci: Copyright(c) Pierre Ossman
[    2.021979] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.030157] remote
[    2.729649] init: Console is alive
[    2.729990] init: - watchdog -
[    2.744688] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.771639] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.786621] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
[    2.786666] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
[    2.792304] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
[    2.798400] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    4.320401] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
[    4.651399] _adpt_mp_uniphy_clk_output_ctrl_set[264]:INFO:uniphy will output clock as 25000000Hz
[    4.651488] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
[    4.659413] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    4.668516] nss-dp 39c00000.dp1 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:1) with GMAC, mac_base: 0xffffffc082220000
[    4.741098] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
[    4.797330] nss-dp 39d00000.dp2 (unnamed net_device) (uninitialized): nss_dp_gmac: Registering netdev eth%d(qcom-id:2) with GMAC, mac_base: 0xffffffc082250000
[    4.798390] Generic PHY fixed-0:00: attached PHY driver (mii_bus:phy_addr=fixed-0:00, irq=POLL)
[    4.812333] **********************************************************
[    4.818998] * NSS Data Plane driver
[    4.825723] **********************************************************
[    4.851736] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.861199] init: - preinit -
[    4.927474] qca8k 90000.mdio-1:12: configuring for fixed/sgmii link mode
[    4.936475] qca8k 90000.mdio-1:12: Link is Up - 1Gbps/Full - flow control off
[    5.001251] qca8k 90000.mdio-1:12 wan (uninitialized): PHY [90000.mdio-1:00] driver [Qualcomm Atheros 8337 internal PHY] (irq=POLL)
[    5.002356] nss-dp 39d00000.dp2 eth0: error -17 registering interface wan
[    5.080954] qca8k 90000.mdio-1:12 lan1 (uninitialized): PHY [90000.mdio-1:01] driver [Qualcomm Atheros 8337 internal PHY] (irq=POLL)
[    5.160914] qca8k 90000.mdio-1:12 lan2 (uninitialized): PHY [90000.mdio-1:02] driver [Qualcomm Atheros 8337 internal PHY] (irq=POLL)
[    5.172909] nss-dp 39d00000.dp2 eth0: entered promiscuous mode
[    5.173039] DSA: tree 0 setup
[    7.240382] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
[    7.471388] nss-dp 39d00000.dp2 eth0: PHY Link up speed: 1000
[    7.474130] qca8k 90000.mdio-1:12 lan1: configuring for phy/gmii link mode
[    7.476470] adpt_mp_port_netdev_change_notify[1186]:ERROR:netdev change notify with incorrect port 0
[    7.483024] ssdk_dev_event[2313]:ERROR:netdev change notify failed
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.632922] qca8k 90000.mdio-1:12 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   10.633004] adpt_mp_port_netdev_change_notify[1186]:ERROR:netdev change notify with incorrect port 0
[   10.639758] ssdk_dev_event[2313]:ERROR:netdev change notify failed
- generating board file -
[   11.778577] qca8k 90000.mdio-1:12 lan1: Link is Down
[   11.789414] procd: - early -
[   11.789615] procd: - watchdog -
[   12.388981] procd: - watchdog -
[   12.389376] procd: - ubus -
[   12.447360] procd: - init -
Please press Enter to activate this console.
[   12.847515] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.998418] urngd: v1.0.2 started.
[   13.077641] Loading modules backported from Linux version v6.18.26-0-g1fe060681
[   13.077691] Backport generated by backports.git 6ecbb44
[   13.108425] NET: Registered PF_QIPCRTR protocol family
[   13.230460] dummy# (dummy): netif_napi_add_weight() called with weight 128
[   13.337663] wwan wwan0: port wwan0at0 attached
[   13.337949] wwan wwan0: port wwan0mbim0 attached
[   13.372598] PPP generic driver version 2.4.2
[   13.376009] NET: Registered PF_PPPOX protocol family
[   13.397967] ath11k c000000.wifi: Multipd architecture - userpd: 1
[   13.399326] ath11k c000000.wifi: ipq5018 hw1.0
[   13.403246] ath11k c000000.wifi: FW memory mode: 1
[   13.676752] remoteproc remoteproc1: powering up pd-1
[   13.677050] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.680957] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.689243] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.800824] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   13.819528] remoteproc remoteproc1: remote processor pd-1 is now up
[   13.822886] ath11k b00a040.wifi: Multipd architecture - userpd: 3
[   13.825181] ath11k b00a040.wifi: qcn6122 hw1.0
[   13.830940] ath11k b00a040.wifi: FW memory mode: 1
[   13.848894] qcom-q6-mpd cd00000.remoteproc: fatal error received: err_smem_ver.2.1: 
[   13.848894] QC Image Version : QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.848894] Image Variant : IMAGE_VARIANT_STRING=5018.wlanfw2.map_spr_spr_evalQ
[   13.848894] platform.c:717 Assertion 0 failed param0 :zero,param1 :zero,param2 :zero
[   13.848894] Thread ID : 0x0000005b Thread name : wlan_platform Process ID : 0x00000001 Process name :wlan0
[   13.848894] 
[   13.848894] Registers:
[   13.848894] SP : 0x4c296f10
[   13.848894] FP : 0x4c296f38
[   13.848894] PC : 0xb023e830
[   13.848894] SSR : 0x00000000
[   13.848894] BADVA : 0x00000000
[   13.848894] LR : 0xb022e260
[   13.848894] 
[   13.848894] StackDump
[   13.848894] from:0x4c296f10
[   13.848894] to: 0x00000000: 
[   13.848894] 
[   13.898656] remoteproc remoteproc0: crash detected in cd00000.remoteproc: type fatal error
[   13.920913] remoteproc remoteproc0: handling crash #1 in cd00000.remoteproc
[   13.929155] remoteproc remoteproc0: recovering cd00000.remoteproc
[   13.945515] remoteproc remoteproc0: stopped remote processor cd00000.remoteproc
[   13.973927] remoteproc remoteproc3: powering up pd-3
[   13.973986] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   19.110430] qcom-q6-mpd cd00000.remoteproc: start timed out
[   19.110500] remoteproc remoteproc0: can't start rproc cd00000.remoteproc: -110
[   19.124324] remoteproc remoteproc3: remote processor pd-3 is now up
[   19.129417] ath11k b00a040.wifi: failed to request irq 5: -16
[   19.137127] ath11k b00a040.wifi: failed to configure irq: -16
[   19.143593] ath11k b00a040.wifi: probe with driver ath11k failed with error -16
[   19.158837] kmodloader: done loading kernel modules from /etc/modules.d/*
[   19.378392] ------------[ cut here ]------------
[   19.378456] qcom-pcie a0000000.pcie: Received unknown event. INT_STATUS: 0x00000002
[   19.382232] WARNING: CPU: 0 PID: 197 at drivers/pci/controller/dwc/pcie-qcom.c:1571 qcom_pcie_global_irq_thread+0xb4/0xc4
[   19.389488] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet ath11k_ahb(O) ath11k(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mhi_wwan_mbim mhi_wwan_ctrl mac80211(O) cfg80211(O) wwan slhc qrtr_smd qrtr_mhi qrtr qmi_helpers(O) nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mhi_net mhi libcrc32c crc_ccitt compat(O) sha512_generic sha512_arm64 seqiv sha3_generic jitterentropy_rng drbg michael_mic hmac geniv cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp(O) qca_ssdk(O) gpio_button_hotplug(O) ext4 mbcache jbd2 crc32c_generic
[   19.451804] CPU: 0 UID: 0 PID: 197 Comm: irq/24-qcom_pci Tainted: G           O       6.12.92 #0
[   19.474035] Tainted: [O]=OOT_MODULE
[   19.482968] Hardware name: SmartInc S3000AX (DT)
[   19.486182] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   19.490698] pc : qcom_pcie_global_irq_thread+0xb4/0xc4
[   19.497639] lr : qcom_pcie_global_irq_thread+0xb4/0xc4
[   19.502849] sp : ffffffc0832ebd90
[   19.507968] x29: ffffffc0832ebd90 x28: ffffffc0800925a8 x27: ffffff80002962e0
[   19.511358] x26: ffffffc080091b4c x25: ffffff80001ef080 x24: ffffff8006426580
[   19.518476] x23: 0000000000000000 x22: 0000000000000001 x21: ffffff80002c8080
[   19.525592] x20: 0000000000000002 x19: ffffff800027ac10 x18: ffffffc08183b658
[   19.532711] x17: 307830203a535554 x16: 4154535f544e4920 x15: 0000000000000141
[   19.539830] x14: 0000000000000141 x13: 00000000ffffffea x12: ffffffc081893600
[   19.546947] x11: ffffffc08183b658 x10: ffffffc081893658 x9 : 0000000000000001
[   19.554065] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff
[   19.561184] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffffc0832ebb70
[   19.568302] x2 : ffffffc08183b580 x1 : ffffffc08183b580 x0 : 0000000000000047
[   19.575420] Call trace:
[   19.582533]  qcom_pcie_global_irq_thread+0xb4/0xc4
[   19.584793]  irq_thread_fn+0x2c/0x94
[   19.589653]  irq_thread+0x180/0x26c
[   19.593383]  kthread+0xdc/0xe0
[   19.596595]  ret_from_fork+0x10/0x20
[   19.599722] ---[ end trace 0000000000000000 ]---
[   24.160582] ath11k c000000.wifi: failed to wait qmi memory request: -110
[   24.160666] ath11k c000000.wifi: qmi failed to respond fw mem req: -110
[   25.969905] nss-dp 39d00000.dp2 eth0: PHY Link is down
[   25.993344] nss-dp 39d00000.dp2 eth0: PHY Link up speed: 1000
[   26.003343] qca8k 90000.mdio-1:12 lan1: configuring for phy/gmii link mode
[   26.056122] br-lan: port 1(lan1) entered blocking state
[   26.056203] br-lan: port 1(lan1) entered disabled state
[   26.062153] qca8k 90000.mdio-1:12 lan1: entered allmulticast mode
[   26.065429] nss-dp 39d00000.dp2 eth0: entered allmulticast mode
[   26.098624] qca8k 90000.mdio-1:12 lan1: entered promiscuous mode
[   26.186238] qca8k 90000.mdio-1:12 lan2: configuring for phy/gmii link mode
[   26.188482] br-lan: port 2(lan2) entered blocking state
[   26.192214] br-lan: port 2(lan2) entered disabled state
[   26.212203] qca8k 90000.mdio-1:12 lan2: entered allmulticast mode
[   26.213715] qca8k 90000.mdio-1:12 lan2: entered promiscuous mode
[   27.030789] adpt_mp_port_netdev_change_notify[1186]:ERROR:netdev change notify with incorrect port 0
[   27.030859] ssdk_dev_event[2313]:ERROR:netdev change notify failed
[   29.193362] qca8k 90000.mdio-1:12 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   29.193589] adpt_mp_port_netdev_change_notify[1186]:ERROR:netdev change notify with incorrect port 0
[   29.200216] ssdk_dev_event[2313]:ERROR:netdev change notify failed
[   29.209574] br-lan: port 1(lan1) entered blocking state
[   29.215358] br-lan: port 1(lan1) entered forwarding state
[   59.125387] qcom-q6-mpd cd00000.remoteproc: fatal error received: err_smem_ver.2.1: 
[   59.125387] QC Image Version : QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   59.125387] Image Variant : IMAGE_VARIANT_STRING=5018.wlanfw2.map_spr_spr_evalQ
[   59.125387] dog_virtual_user.c:242 USER-PD DOG detects stalled initialization, triage with IMAGE OWNER param0 :zero,param1 :zero,param2 :zero
[   59.125387] Thread ID : 0x00000063 Thread name : TIMER_CLIENT_3 Process ID : 0x00000003 Process name :wlan2
[   59.125387] 
[   59.125387] Registers:
[   59.125387] SP : 0x4c287020
[   59.125387] FP : 0x4c287030
[   59.125387] PC : 0xd025bc70
[   59.125387] SSR : 0x00000000
[   59.125387] BADVA : 0x00000000
[   59.125387] LR : 0xd000a3fc
[   59.125387] 
[   59.125387] StackDump
[   59.125387] from:0x4c287020
[   59.125387] to: 0x00000000: 
[   59.125387] 
[   59.180407] remoteproc remoteproc0: crash detected in cd00000.remoteproc: type fatal error

don't know why rproc keeps on throwing errors shortly after the ath11k part. figured to ask someone here who's more experienced than me

Device details:
IPQ5018 Chipset
2x LAN ports
1x WAN port
QCA8337 Switch
QCN6102 WiFi
512 MiB RAM*
128 MiB Flash
1x M.2 PCIe slot

Hostle · June 17, 2026, 3:24pm

I would say its a problem with your bdf's ... from a glance

georgem83 · June 17, 2026, 4:24pm

Have you packaged your BDFs with qca-swiss-army-knife? If not, do so and give it a board name which you’ll use in step 3. Format is Manufacturer-Model (ex: Linksys-MX2000)
let’s clean up your dts:

Useless, remove

Remove

Remove
3. Add to both wifi nodes: qcom,ath11k-calibration-variant = “<insert your board board name>”;
4. From your boot-args, change these properties in your wifi1 node to:

MrConnor · June 17, 2026, 6:30pm

Hi. Thanks for responding, George and Hostle. I really appreciate it.

I didn't. Thanks for pointing that out. This is my first time with IPQs.

From the decompiled DTB, my IPQ5018 uses board-id 23 and QCN6102 uses board-id 60 but according to @Hostle :

board-id is in hexadecimal. So if I were to refer "23" and "60", I would use id=35 and id=96 on my board-2.json file since it expects a decimal value.

My board-2.json would then be... (could someone check please?)

IPQ5018:

[
    {
        "names": [
            "bus=ahb,qmi-chip-id=0,qmi-board-id=35,variant=SmartInc-S3000AX"
        ],
        "data": "bdwlan.b23"
    },
]

QCN6122:

[
    {
        "names": [
            "bus=ahb,qmi-chip-id=0,qmi-board-id=96,variant=SmartInc-S3000AX"
        ],
        "data": "bdwlan.b60"
    }
]

I extracted bdwlan.b23 and bdwlan.b60 from the wifi_fw partition. It's labeled "WLAN.HK.2.6-02451-QCAHKSWPL_SILICONZ-1 v1".

then a command for each board-2.bin

python3 ath11k-bdencoder -p board-2.bin

btw where does board-2.bin go?

IPQ5018:
/home/linux/openwrt/build_dir/target-aarch64_cortex-a53_musl/root-qualcommax/lib/firmware/ath11k/IPQ5018/hw1.0
or
/home/linux/openwrt/build_dir/target-aarch64_cortex-a53_musl/root.orig-qualcommax/rootfs-overlay/lib/firmware/ath11k/IPQ5018/hw1.0

QCN6102:
/home/linux/openwrt/build_dir/target-aarch64_cortex-a53_musl/root-qualcommax/lib/firmware/ath11k/QCN6122/hw1.0
or
/home/linux/openwrt/build_dir/target-aarch64_cortex-a53_musl/root.orig-qualcommax/rootfs-overlay/lib/firmware/ath11k/QCN6122/hw1.0

Hostle · June 17, 2026, 7:02pm

~/openwrt/package/firmware/ipq-wifi/src/ (until you create the pr for the board bdf's).

then add the 2 entry's for your board to the ipq-wifi/Makfile.

you can use generic 255 / FF for board ids and drop the data field ..ie

[
    {
        "names": [
            "bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=SmartInc-S3000AX"
        ],
    }
]

also, bdf names must follow the naming convention (unless you are manually placing them in the firmware post build) .. board-name.ipq5018 & board-name.qcn6122.

Reference ipq-wifi/Makefile for examples.

MrConnor · June 21, 2026, 3:48pm

added 2 entries to the makefile:

...
	zyxel_scr50axe \
	smartinc_s3000ax
...
$(eval $(call generate-ipq-wifi-package,smartinc_s3000ax,SmartInc S3000AX))

been trying this in the past 4 days. is this the correct way?

~/openwrt/package/firmware/ipq-wifi/src/SmartInc-S3000AX.ipq5018
~/openwrt/package/firmware/ipq-wifi/src/SmartInc-S3000AX.qcn6122

sadly it doesn't work so I figured adding them to a folder

~/openwrt/files/lib/firmware/ath11k/IPQ5018/board-2.bin (made from bdwlan.b23)
~/openwrt/files/lib/firmware/ath11k/QCN6122/board-2.bin (made from bdwlan.b60)

based from the logs it looks for "5018.wlanfw2"

[    4.761587] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
- generating board file -
[   13.322021] ath11k c000000.wifi: Multipd architecture - userpd: 1
[   13.324347] ath11k c000000.wifi: ipq5018 hw1.0
[   13.327122] ath11k c000000.wifi: FW memory mode: 2
[   13.614070] remoteproc remoteproc1: powering up pd-1
[   13.614342] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.618150] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.626701] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.738661] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   13.757455] remoteproc remoteproc1: remote processor pd-1 is now up
[   13.760584] ath11k b00a040.wifi: Multipd architecture - userpd: 2
[   13.763165] ath11k b00a040.wifi: qcn6122 hw1.0
[   13.768788] ath11k b00a040.wifi: FW memory mode: 2
[   13.783575] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   13.791108] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   13.791182] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.823990] remoteproc remoteproc2: powering up pd-2
[   13.825576] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.838689] remoteproc remoteproc2: remote processor pd-2 is now up
[   13.838856] genirq: Flags018/hw1.0/board-2.bin
[   13.922455] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ5018/hw1.0/board-2.bin
[   13.937231] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ5018/hw1.0/board-2.bin
[   13.949824] ath11k c000000.wifi: failed to fetch board.bin from IPQ5018/hw1.0
[   13.962340] ath11k c000000.wifi: qmi failed to fetch board file: -12
[   13.969316] ath11k c000000.wifi: failed to load board data file: -12
[   15.911888] qcom-q6-mpd cd00000.remoteproc: fatal error received: err_smem_ver.2.1: 
[   15.911888] QC Image Version : QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   15.911888] Image Variant : IMAGE_VARIANT_STRING=5018.wlanfw2.
[   21.117030] qcom-q6-mpd cd00000.remoteproc: start timed out
[   21.117109] remoteproc remoteproc0: can't start rproc cd00000.remoteproc: -110

Am I doing this right? I need a bit more push in the right direction

Hostle · June 21, 2026, 4:12pm

it may be "files" rather than "src". I vaguely remember having the same issue. Try both, and just build package ipq-wifi, then check in build_dir that

A. your bdfs are being copied there
B. the install apk/ipk directory includes the board-2.bin.


make package/ipq-wifi/clean
make package/ipq-wifi/compile V=s

# check bdfs have been copied to build_dir 
ls ~/ow-dev/openwrt/build_dir/target-aarch64_cortex-a53_musl/ipq-wifi-2026.03.07~beaf4667/ | grep "xunison_exigo-hub-d50-5g"
board-xunison_exigo-hub-d50-5g.ipq5018
board-xunison_exigo-hub-d50-5g.qcn9074

# check if board-2.bins are being built and included 
ls ~/ow-dev/openwrt/build_dir/target-aarch64_cortex-a53_musl/ipq-wifi-2026.03.07~beaf4667/ipkg-aarch64_cortex-a53/ipq-wifi-xunison_exigo-hub-d50-5g/rootfs-overlay/lib/firmware/ath11k/IPQ5018/hw1.0/
board-2.bin

hope that helps.

EDIT

Make sure you add the the ipq package to your device make entry as well, or you need to manually select it which is .. gross!

just make sure you have it in your device def packages ..ie

openwrt/target/linux/qualcommax/image/ipq50xx.mk

define Device/xunison_exigo-hub-d50-5g
    $(call Device/FitImage)
    ...
    
    DEVICE_PACKAGES := ath11k-firmware-ipq5018 \
		kmod-ath11k-pci \
		ath11k-firmware-qcn9074 \
		ipq-wifi-xunison_exigo-hub-d50-5g \  <-- ** YOU NEED THIS ENTRY **

endef
TARGET_DEVICES += xunison_exigo-hub-d50-5g

slh · June 21, 2026, 4:51pm

MrConnor · June 28, 2026, 12:20pm

@slh there's a Git issue submitted last 2023 that it no longer uses local BDF files. we should probably omit that to the Makefile

protectivedad on Sep 28, 2023

The package/firmware/ipq-wifi was changed to pull files from a git repository. It no longer looks at the files in the makefile directory. This was done in commit f576762

I copied the files over here instead which worked. Thanks @Hostle

~/openwrt/files/lib/firmware/ath11k/IPQ5018/hw1.0/board-2.bin
~/openwrt/files/lib/firmware/ath11k/QCN6122/hw1.0/board-2.bin

I'll be submitting a new device support (a PR?) later on. LAN ports and WiFi is now working

There's one last issue. Both WiFi breaks when I enable PCIe (&pcie0 and &pcie1) due to IRQ conflicts. It has to be enabled since it contains an M.2 slot for the 5G module

[   13.293714] ath11k c000000.wifi: Multipd architecture - userpd: 1
[   13.295369] ath11k c000000.wifi: ipq5018 hw1.0
[   13.298815] ath11k c000000.wifi: FW memory mode: 2
[   13.575840] remoteproc remoteproc1: powering up pd-1
[   13.576125] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.579918] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.588555] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.700808] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   13.719625] remoteproc remoteproc1: remote processor pd-1 is now up
[   13.722845] ath11k b00a040.wifi: Multipd architecture - userpd: 2
[   13.725254] ath11k b00a040.wifi: qcn6122 hw1.0
[   13.731023] ath11k b00a040.wifi: FW memory mode: 2
[   13.745511] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   13.753087] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   13.753148] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.791575] remoteproc remoteproc2: powering up pd-2
[   13.791762] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.808902] remoteproc remoteproc2: remote processor pd-2 is now up
[   13.809128] genirq: Flags mismatch irq 51. 00200081 (ce2) vs. 00000000 (mtk_t7xx_0)
[   13.814210] ath11k b00a040.wifi: failed to request irq 5: -16
[   13.821723] ath11k b00a040.wifi: failed to configure irq: -16
[   13.828000] ath11k b00a040.wifi: probe with driver ath11k failed with error -16

Installing irqbalancer didn't help. Using the msi-ranges property on the DTS file seems to be ignored. Can't we just assign an unused irq manually? like higher than 51 perhaps?

Btw about automatically dumping the art partition for wifi calibration. Do we use...

/etc/hotplug.d/firmware/11-ath11k-caldata
or
/lib/functions/caldata.sh

georgem83 · June 29, 2026, 2:49am

Enable only the pcie rail that is connected to the 5G module. The other one is used by QCN6122 wifi.