IPQ5018: Adding OpenWrt support for TP-Link Deco XE70Pro v3

db215 · March 6, 2026, 10:14pm

I am requesting assistance adding the TP-Link Deco XE70Pro.

This is an IPQ5018 device with 1 2.5G WAN and 2 1G LAN. The platform supports Wi-Fi 6E.

The WAN appears to have a 2.5G RTL8226b PHY, I believe this hangs off mdio1 / dp2.

Based on the GPL, I believe the Wi-Fi is IPQ5018 for 2.4G, QCN6122 5G, and QCN6122 6G.

https://static.tp-link.com/upload/gpl-code/2024/202404/20240410/XE70ProV3_GPL.tar.gz

Similar to other TP-Link platforms, u-boot access is obtained by typing “tpl” after “Enter magic string to stop autoboot in 1 seconds”

u-boot is kind enough to report the presence of an RTL8367 switch - this feeds the LAN ports. I believe this hangs off mdio0 / dp1.

I can boot .itb from tftpboot.

I am not a developer but am comfortable building images. I have constructed a DTS (I used various LLMs for assistance), this DTS boots, recognizes the lan and wan, but I am unable to send / receive traffic. I suspect the 2.5G PHY settings to be incorrect for wan/dp2 but have tried various combinations without success. I suspect the RTL8367 switch may be a challenge for LAN, no IPQ5018 devices in OpenWrt seem to use this switch, but other OpenWrt devices do.

I cannot login to the oem console - unless someone has suggestions how this could be accomplished.

Net:   cmbblk is stable 5
MAC0 addr:0:11:22:33:44:55
PHY ID1: 0x4d
PHY ID2: 0xd0c0
MAC1 addr:0:11:22:33:44:56
rtl8367_sw_init-809:rtk_switch_init ret = 0!!!!!!!!!!!!
eth0, eth1
IPQ5018#


IPQ5018# mii device 'IPQ MDIO0'
IPQ5018# mii info
PHY 0x00: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x01: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x02: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x03: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x04: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x05: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x06: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x07: OUI = 0x1374, Model = 0x0C, Rev = 0x00,  10baseT, HDX
PHY 0x08: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x09: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0A: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0B: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0C: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0D: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0E: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x0F: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x10: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x11: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x12: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x13: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x14: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x15: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x16: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x17: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x18: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x19: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1A: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1B: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1C: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1D: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1E: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
PHY 0x1F: OUI = 0x0000, Model = 0x00, Rev = 0x00,  10baseT, HDX
IPQ5018# mii device 'IPQ MDIO1'
IPQ5018# mii info
PHY 0x00: OUI = 0x0732, Model = 0x04, Rev = 0x09, 100baseT, FDX
PHY 0x06: OUI = 0x0732, Model = 0x04, Rev = 0x09, 100baseT, FDX

I believe MAC Address is stored on mtd14 0x5e1830

I can provide OEM boot log, my attempted DTS and resultant boot log.

db215 · March 6, 2026, 10:19pm

oem boot log

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 4.4.60 (tplink@0e649a6e2fa7) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 4a504bb+r49254) ) #1 SMP PREEMPT Wed Jul 24 10:44:49 UTC 2024
[    0.000000] Boot CPU: AArch64 Processor [51af8014]
[    0.000000] Ignoring memory range 0x40000000 - 0x41000000
[    0.000000] Machine: Qualcomm Technologies, Inc. IPQ5018/AP-MP03.5-C1
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: not enough space all defined regions.
[    0.000000] Reserved memory: not enough space all defined regions.
[    0.000000] Reserved memory: not enough space all defined regions.
[    0.000000] Reserved memory: not enough space all defined regions.
[    0.000000] Reserved memory: OVERLAP DETECTED!
[    0.000000] q6_mem_regions@4B000000 (0x000000004b000000--0x0000000050400000) overlaps with q6_code_data@4B000000 (0x000000004b000000--0x000000004b060000)
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 14 pages/cpu@ffffffc01ef97000@ffffffc01ef97000 s19200 r8192 d29952 u57344
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 101808
[    0.000000] Kernel command line: ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait test_mode=disable swiotlb=1 coherent_pool=2M
[    0.000000] PID hash table entries: 2048 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
[    0.000000] software IO TLB [mem 0x5fe93000-0x5fed3000] (0MB) mapped at [ffffffc01ee93000-ffffffc01eed2fff]
[    0.000000] Memory: 386688K/413696K available (5382K kernel code, 615K rwdata, 2308K rodata, 228K init, 430K bss, 27008K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000   (   246 GB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000   (     8 GB maximum)
[    0.000000]               0xffffffbdc0040000 - 0xffffffbdc0800000   (     7 MB actual)
[    0.000000]     fixed   : 0xffffffbffa7fd000 - 0xffffffbffac00000   (  4108 KB)
[    0.000000]     PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000   (    16 MB)
[    0.000000]     modules : 0xffffffbffc000000 - 0xffffffc000000000   (    64 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc01f000000   (   496 MB)
[    0.000000]       .init : 0xffffffc000805000 - 0xffffffc00083e000   (   228 KB)
[    0.000000]       .text : 0xffffffc000080000 - 0xffffffc000804844   (  7699 KB)
[    0.000000]       .data : 0xffffffc00084d000 - 0xffffffc0008e6c00   (   615 KB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=64, nr_cpu_ids=2
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] GICv2m: Node v2m: range[0xb00a000:0xb00affc], SPI[448:480]
[    0.000000] GICv2m: Node v2m: range[0xb00b000:0xb00bffc], SPI[480:512]
[    0.000000] Architected cp15 timer(s) running at 24.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000005] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000389] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000403] pid_max: default: 32768 minimum: 301
[    0.000521] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.000534] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.001233] Initializing cgroup subsys io
[    0.001262] Initializing cgroup subsys memory
[    0.001306] Initializing cgroup subsys devices
[    0.001320] Initializing cgroup subsys freezer
[    0.001333] Initializing cgroup subsys net_cls
[    0.001345] Initializing cgroup subsys pids
[    0.001710] EFI services will not be available.
[    0.001750] ASID allocator initialised with 65536 entries
[    0.051875] MSM Memory Dump base table set up
[    0.051908] MSM Memory Dump apps data table set up
[    0.090217] Detected VIPT I-cache on CPU1
[    0.090274] CPU1: Booted secondary processor [51af8014]
[    0.090401] Brought up 2 CPUs
[    0.090419] SMP: Total of 2 processors activated.
[    0.090430] CPU: All CPU(s) started at EL1
[    0.103696] DMI not present or invalid.
[    0.104056] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.104085] futex hash table entries: 512 (order: 4, 65536 bytes)
[    0.104375] pinctrl core: initialized pinctrl subsystem
[    0.105781] NET: Registered protocol family 16
[    0.130141] cpuidle: using governor ladder
[    0.160173] cpuidle: using governor menu
[    0.160507] NET: Registered protocol family 42
[    0.160639] vdso: 2 pages (1 code @ ffffffc000855000, 1 data @ ffffffc000854000)
[    0.161899] DMA: preallocated 2048 KiB pool for atomic allocations
[    0.162099] CPU: IPQ0518, SoC Version: 1.1
[    0.162637] IPC logging disabled
[    0.162646] IPC logging disabled
[    0.162650] IPC logging disabled
[    0.162655] IPC logging disabled
[    0.162659] IPC logging disabled
[    0.168904] qcom,gcc-ipq5018 1800000.gcc: Registered ipq5018 GCC clocks provider
[    0.171953] sps:sps is ready.
[    0.174436] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.176024] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.232567] pps_core: LinuxPPS API ver. 1 registered
[    0.232581] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti giometti@linux.it
[    0.232623] PTP clock support registered
[    0.232863] dmi: Firmware registration failed.
[    0.234666] Advanced Linux Sound Architecture Driver Initialized.
[    0.235562] clocksource: Switched to clocksource arch_sys_counter
[    0.238032] NET: Registered protocol family 2
[    0.238972] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.239039] TCP bind hash table entries: 4096 (order: 4, 65536 bytes)
[    0.239140] TCP: Hash tables configured (established 4096 bind 4096)
[    0.239224] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.239249] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.239533] NET: Registered protocol family 1
[    0.249467] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.249493] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.254377] Key type asymmetric registered
[    0.254397] Asymmetric key parser 'x509' registered
[    0.254439] io scheduler noop registered
[    0.254452] io scheduler deadline registered (default)
[    0.262684] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[    0.263168] bt_driver 1943008.bt: bt_parse_ipc
[    0.263215] bt_driver 1943008.bt: bt_parse_mem
[    0.263261] bt_driver 1943008.bt: bt_parse_dt operating in secure mode
[    0.264444] 58000.qcom,msm-eud: ttyEUD0 at MMIO 0x0 (irq = 186, base_baud = 0) is a EUD UART
[    0.266071] Registered Sucessfully
[    0.266705] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.266767] msm_serial 78af000.serial: uartclk = 1843199
[    0.266824] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 5, base_baud = 115199) is a MSM
[    0.266855] msm_serial: console setup on port #0
[    0.965850] console [ttyMSM0] enabled
[    0.970899] msm_serial: driver initialized
[    0.974363] msm_serial_hsl_init: driver initialized
[    0.991021] brd: module loaded
[    0.991890] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    0.994971] m25p80 spi32766.0: unrecognized JEDEC id bytes: 00,  0,  0
[    1.000345] flash_chrdev : flash_chrdev_init
[    1.006575] flash_chrdev : flash_chrdev_init
[    1.011892] phase not found in dts, falling to 50MHz
[    1.015264] QPIC platform data not populated
[    1.020488] QPIC controller hw version Major:2, Minor:1
[    1.024553] QPIC controller support serial nand.
[    1.029870] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0x11
[    1.034366] nand: GigaDevice F50D1G41LB(2M) SPI NAND 1G 1.8V
[    1.040734] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.046849] 16 ofpart partitions found on MTD device qcom_nand.0
[    1.053723] Creating 16 MTD partitions on "qcom_nand.0":
[    1.059922] 0x000000000000-0x000000080000 : "0:SBL1"
[    1.076842] 0x000000080000-0x000000100000 : "0:MIBIB"
[    1.088369] 0x000000100000-0x000000140000 : "0:BOOTCONFIG"
[    1.099660] 0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
[    1.110941] 0x000000180000-0x000000280000 : "0:QSEE"
[    1.122866] 0x000000280000-0x0000002c0000 : "0:DEVCFG"
[    1.134157] 0x0000002c0000-0x000000300000 : "0:CDT"
[    1.145429] 0x000000300000-0x000000380000 : "0:APPSBLENV"
[    1.156951] 0x000000380000-0x0000004c0000 : "0:APPSBL"
[    1.169107] 0x0000004c0000-0x0000005c0000 : "0:ART"
[    1.181066] 0x0000005c0000-0x000000640000 : "0:TRAINING"
[    1.192556] 0x000000640000-0x000003040000 : "rootfs"
[    1.236755] mtd: device 11 (rootfs) set to be root filesystem
[    1.237019] mtdsplit: no squashfs found in "rootfs"
[    1.241492] 0x000003040000-0x000005a40000 : "rootfs_1"
[    1.290008] 0x000005a40000-0x000005ac0000 : "0:ETHPHYFW"
[    1.301535] 0x000005ac0000-0x0000063c0000 : "factory_data"
[    1.319866] 0x0000063c0000-0x0000074c0000 : "runtime_data"
[    1.335444] libphy: Fixed MDIO Bus: probed
[    1.556189] qca-mdio 88000.mdio: Could not find phy-reset-gpio
[    1.556369] libphy: qca_mdio: probed
[    1.571626] qca-mdio 88000.mdio: qca-mdio driver was registered
[    2.012189] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[    2.012351] libphy: qca_mdio: probed
[    2.016975] qca-mdio 90000.mdio: qca-mdio driver was registered
[    2.130974] cnss: INFO: IPC Logging is disabled!
[    2.131619] cnss[2]: INFO: Platform driver probed successfully. plat ffffffc01cd08018 tgt 0xfffc
[    2.135041] cnss[41]: INFO: Platform driver probed successfully. plat ffffffc01cd18018 tgt 0xfffb
[    2.143853] cnss[42]: INFO: Platform driver probed successfully. plat ffffffc01cd20018 tgt 0xfffb
[    2.152585] i2c /dev entries driver
[    2.162330] qcom-tsens 4a8000.thermal-sensor: tsens calibration failed
[    2.186489] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 799999 KHz
[    2.186586] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 800000 KHz
[    2.192868] sdhci: Secure Digital Host Controller Interface driver
[    2.201330] sdhci: Copyright(c) Pierre Ossman
[    2.207290] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.213732]
[    2.213732] Version Rollback Feature Disabled
[    2.221034] qcom-q6v5-wcss-pil cd00000.qcom_q6v5_wcss: ssr registeration success qcom_q6v5_wcss
[    2.223159] remoteproc remoteproc0: cd00000.qcom_q6v5_wcss is available
[    2.231777] q6v5_wcss_userpd1(ffffffc01efd0dd8) node found
[    2.239398] platform q6v5_wcss_userpd1: ssr registeration success q6v5_wcss_userpd1
[    2.243898] remoteproc remoteproc1: q6v5_wcss_userpd1 is available
[    2.251465] q6v5_wcss_userpd2(ffffffc01efd12d8) node found
[    2.258684] platform q6v5_wcss_userpd2: ssr registeration success q6v5_wcss_userpd2
[    2.263156] remoteproc remoteproc2: q6v5_wcss_userpd2 is available
[    2.270737] q6v5_wcss_userpd3(ffffffc01efd1770) node found
[    2.277965] platform q6v5_wcss_userpd3: ssr registeration success q6v5_wcss_userpd3
[    2.282431] remoteproc remoteproc3: q6v5_wcss_userpd3 is available
[    2.290512] of_graph_get_next_endpoint(): no port node found in /soc/csr@6001000
[    2.296335] coresight-csr 6001000.csr: CSR initialized
[    2.303967] of_graph_get_next_endpoint(): no port node found in /soc/cti@6010000
[    2.308933] of_graph_get_next_endpoint(): no port node found in /soc/cti@6011000
[    2.316444] of_graph_get_next_endpoint(): no port node found in /soc/cti@6012000
[    2.323771] of_graph_get_next_endpoint(): no port node found in /soc/cti@6013000
[    2.331196] of_graph_get_next_endpoint(): no port node found in /soc/cti@6014000
[    2.338571] of_graph_get_next_endpoint(): no port node found in /soc/cti@6015000
[    2.345935] of_graph_get_next_endpoint(): no port node found in /soc/cti@6016000
[    2.353270] of_graph_get_next_endpoint(): no port node found in /soc/cti@6017000
[    2.360698] of_graph_get_next_endpoint(): no port node found in /soc/cti@6018000
[    2.368077] of_graph_get_next_endpoint(): no port node found in /soc/cti@6019000
[    2.375418] of_graph_get_next_endpoint(): no port node found in /soc/cti@601a000
[    2.382832] of_graph_get_next_endpoint(): no port node found in /soc/cti@601b000
[    2.390205] of_graph_get_next_endpoint(): no port node found in /soc/cti@601c000
[    2.397584] of_graph_get_next_endpoint(): no port node found in /soc/cti@601d000
[    2.404928] of_graph_get_next_endpoint(): no port node found in /soc/cti@601e000
[    2.412349] of_graph_get_next_endpoint(): no port node found in /soc/cti@601f000
[    2.419734] of_graph_get_next_endpoint(): no port node found in /soc/cti@6198000
[    2.427291] of_graph_get_next_endpoint(): no port node found in /soc/cti@6199000
[    2.434607] of_graph_get_next_endpoint(): no port node found in /soc/cti@610c000
[    2.442150] sps_register_bam_device : unable to create IPC Logging 0 for bam 0x0000000006064000
[    2.449079] sps_register_bam_device : unable to create IPC Logging 1 for bam 0x0000000006064000sps_register_bam_device : unable to create IPC Logging 2 for bam 0x0000000006064000
[    2.466134] sps_register_bam_device : unable to create IPC Logging 3 for bam 0x0000000006064000sps_register_bam_device : unable to create IPC Logging 4 for bam 0x0000000006064000
[    2.482020] sps:BAM 0x0000000006064000 is registered.[    2.489877] coresight-tmc 6048000.tmc: TMC initialized
[    2.494701] coresight-tmc 6047000.tmc: TMC initialized
[    2.499883] coresight-funnel 6041000.funnel: FUNNEL initialized
[    2.504820] coresight-funnel 6100000.funnel: FUNNEL initialized
[    2.510681] coresight-funnel 6120000.funnel: FUNNEL initialized
[    2.516585] coresight-funnel 6130000.funnel: FUNNEL initialized
[    2.522430] coresight-funnel 61a1000.funnel: FUNNEL initialized
[    2.529081] coresight-etm4x 619c000.etm: ETM 4.0 initialized
[    2.534623] coresight-etm4x 619d000.etm: ETM 4.0 initialized
[    2.540282] coresight-replicator-qcom 6046000.replicator: REPLICATOR 1.0 initialized
[    2.546039] coresight-stm 6002000.stm: STM initialized
[    2.554782] of_graph_get_next_endpoint(): no port node found in /soc/hwevent@6101000
[    2.558274] coresight-hwevent 6101000.hwevent: Hardware Event driver initialized
[    2.569332] nf_conntrack version 0.5.0 (3021 buckets, 12084 max)
[    2.573882] ip_tables: (C) 2000-2006 Netfilter Core Team
[    2.579419] Initializing XFRM netlink socket
[    2.585249] NET: Registered protocol family 10
[    2.600568] NET: Registered protocol family 17
[    2.600669] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    2.603931] Bridge firewalling registered
[    2.616790] 8021q: 802.1Q VLAN Support v1.8
[    2.623697] ubi0: attaching mtd12
[    2.783544] ubi0: scanning is finished
[    2.787695] ubi0: attached mtd12 (name "rootfs_1", size 42 MiB)
[    2.787717] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.792408] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.799415] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.806240] ubi0: good PEBs: 336, bad PEBs: 0, corrupted PEBs: 0
[    2.812981] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.819247] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1239794609
[    2.826283] ubi0: available PEBs: 78, total reserved PEBs: 258, PEBs reserved for bad PEB handling: 20
[    2.835575] ubi0: background thread "ubi_bgt0d" started, PID 95
[    2.857392] input: soc:gpio_keys as /devices/platform/soc/soc:gpio_keys/input/input0
[    2.857562] hctosys: unable to open rtc device (rtc0)
[    2.872138] ALSA device list:
[    2.872156]   No soundcards found.
[    2.877079] VFS: Mounted root (squashfs filesystem) readonly on device 31:17.
[    2.877558] Freeing unused kernel memory: 228K (ffffffc000805000 - ffffffc00083e000)
[    2.884603] Freeing alternatives memory: 40K (ffffffc00083e000 - ffffffc000848000)
[    2.898849] random: nonblocking pool is initialized
[    3.299190] init: Console is alive
[    3.299417] init: - watchdog -
[    4.619149] Button Hotplug driver version 0.4.1
[    4.620351] remoteproc remoteproc4: bt_rproc_driver is available
[    4.622533] bt_rproc_driver bt_rproc_driver: Probed
[    5.302299] init: - preinit -
ignore preinit load_wifi_board_bin
Before mount_root
mounting /dev/root
cp: can't stat '/tmp/log_export_tmp/*': No such file or directory
After mount_root
[    6.169190] procd: - early -
[    6.169286] procd: - watchdog -
[    6.806648] procd: - ubus -
[    7.809149] procd: - init -
Please press Enter to activate this console.
[    7.898098] ubi1: attaching mtd14
[    7.931462] ubi1: scanning is finished
[    7.935865] ubi1: attached mtd14 (name "factory_data", size 9 MiB)
[    7.935890] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    7.940928] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    7.947818] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[    7.954643] ubi1: good PEBs: 72, bad PEBs: 0, corrupted PEBs: 0
[    7.961440] ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128
[    7.967343] ubi1: max/mean erase counter: 5/3, WL threshold: 4096, image sequence number: 1576737333
[    7.974612] ubi1: available PEBs: 0, total reserved PEBs: 72, PEBs reserved for bad PEB handling: 20
[    7.983937] ubi1: background thread "ubi_bgt1d" started, PID 169
ubi_factory_data found, mounting...
[    8.055741] UBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 176
[    8.071905] UBIFS (ubi1:0): recovery needed
[    8.118085] UBIFS (ubi1:0): recovery completed
[    8.118222] UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "ubi_factory_data"
[    8.121419] UBIFS (ubi1:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.129715] UBIFS (ubi1:0): FS size: 4825088 bytes (4 MiB, 38 LEBs), journal size 1142785 bytes (1 MiB, 9 LEBs)
[    8.139669] UBIFS (ubi1:0): reserved for root: 0 bytes (0 KiB)
[    8.149560] UBIFS (ubi1:0): media format: w4/r0 (latest is w4/r0), UUID 5A2449D2-C01D-47DD-AB0A-3A40FBCDE1E3, small LPT model
[    8.171779] ubi2: attaching mtd15
[    8.236554] ubi2: scanning is finished
[    8.241192] ubi2: attached mtd15 (name "runtime_data", size 17 MiB)
[    8.241219] ubi2: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    8.246304] ubi2: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    8.253202] ubi2: VID header offset: 2048 (aligned 2048), data offset: 4096
[    8.260077] ubi2: good PEBs: 136, bad PEBs: 0, corrupted PEBs: 0
[    8.266843] ubi2: user volume: 1, internal volumes: 1, max. volumes count: 128
[    8.273082] ubi2: max/mean erase counter: 77/46, WL threshold: 4096, image sequence number: 2138617432
[    8.280126] ubi2: available PEBs: 0, total reserved PEBs: 136, PEBs reserved for bad PEB handling: 20
[    8.289447] ubi2: background thread "ubi_bgt2d" started, PID 182
ubi_runtime_data found, mounting...
[    8.321693] UBIFS (ubi2:0): background thread "ubifs_bgt2_0" started, PID 189
[    8.340435] UBIFS (ubi2:0): recovery needed
[    8.401381] UBIFS (ubi2:0): recovery completed
[    8.401536] UBIFS (ubi2:0): UBIFS: mounted UBI device 2, volume 0, name "ubi_runtime_data"
[    8.404733] UBIFS (ubi2:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.413021] UBIFS (ubi2:0): FS size: 4825088 bytes (4 MiB, 38 LEBs), journal size 1142785 bytes (1 MiB, 9 LEBs)
[    8.422964] UBIFS (ubi2:0): reserved for root: 0 bytes (0 KiB)
[    8.432853] UBIFS (ubi2:0): media format: w4/r0 (latest is w4/r0), UUID 810E1691-CCBA-4203-B38C-F78F14F37194, small LPT model

read caldata

===> hw_ver:1
[   10.768401] NET: Registered protocol family 15
[   10.793158] ssdk_switch_device_num_init[1159]:INFO:ess-switch dts node number: 1
[   10.793198] ssdk_dt_get_switch_node[970]:INFO:ess-switch DT exist!
[   10.799667] ssdk_dt_parse_access_mode[856]:INFO:switch_access_mode: local bus
[   10.805630] ssdk_dt_parse_access_mode[869]:INFO:switchreg_base_addr: 0x39c00000
[   10.812804] ssdk_dt_parse_access_mode[870]:INFO:switchreg_size: 0x200000
[   10.819943] ssdk_dt_parse_mac_mode[295]:INFO:mac mode = 0xc
[   10.826898] ssdk_dt_parse_mac_mode[301]:INFO:mac mode1 doesn't exit!
[   10.832165] ssdk_dt_parse_mac_mode[310]:INFO:mac mode2 doesn't exit!
[   10.838792] ssdk_dt_parse_port_bmp[757]:INFO:port_bmp doesn't exist!
[   10.845113] ssdk_dt_parse_uniphy[332]:INFO:ess-uniphy DT exist!
[   10.851463] ssdk_dt_parse_led[943]:INFO:current dts led_source_num is 0
[   10.857185] ssdk_plat_init start
[   13.265576] ssdk_mp_reset_init[739]:INFO:MP reset successfully!
[   13.265639] ssdk_gcc_clock_init[1033]:INFO:SSDK gcc clock init successfully!
[   13.270978] ssdk_phy_driver_init[326]:INFO:get port_bmp[2] idx[1]
[   13.277638] mpge_phy_api_ops_init[1089]:INFO:qca probe mpge phy driver succeeded!
[   13.283950] regi_init[3610]:INFO:Initializing SCOMPHY!
[   14.421673] ssdk_switch_register[1711]:INFO:Chip version 0xee
[   14.421718] qca_link_polling_select[1316]:INFO:link-polling-required node does not exist
[   14.426423] ssdk_switch_register[1745]:INFO:polling is selected
[   14.434547] regi_init[3620]:INFO:Initializing SCOMPHY Done!!
[   14.440333] regi_init[3647]:INFO:qca-ssdk module init succeeded!
[   14.969902] switch_probe-456:get data[6642], regValue[50]
[   14.970114] switch_probe-499:get data[6642], regValue[50]
[   14.974267] hal_find_device-539:get switch chip[4]
[   14.979756] _rtk_switch_init-47:get switch type[4]
[   14.984510] dal_mgmt_attachDevice-49:get switchChip[4]
[   14.989383] dal_mgmt_attachDevice-70:get pMapper[ffffffbffc1a7cc8]
[   15.494699] vid    portmap
[   15.495054]   0    -------
[   15.499296]   1    -------
[   15.501986]   2    -------
[   15.504676]   3    -------
[   15.507378]   4    -------
[   15.510057]   5    -------
[   15.512750]   6    -------
[   15.515440]   7    -------
[   15.518142]   8    -------
[   15.520831]   9    -------
[   15.523512]  10    -------
[   15.526204]  11    -------
[   15.528895]  12    -------
[   15.531586]  13    -------
[   15.534297]  14    -------
[   15.536968]  15    -------
[   15.541661] after rtk_vlan_init:

vid    portmap
[   15.544257]   0    -------
[   15.548423]   1    1111111
[   15.551123]   2    -------
[   15.553803]   3    -------
[   15.556496]   4    -------
[   15.559186]   5    -------
[   15.561896]   6    -------
[   15.564567]   7    -------
[   15.567269]   8    -------
[   15.569949]   9    -------
[   15.572640]  10    -------
[   15.575331]  11    -------
[   15.578023]  12    -------
[   15.580713]  13    -------
[   15.583405]  14    -------
[   15.586106]  15    -------
[   15.621765] enter rtl8367s_swconfig_init
[   15.621792] rtl8367s_swconfig_init-584:register_switch [0]
[   15.624735] [rtl8367s_swconfig_init]
[   15.630043] rtl8367c_lanWanPartitionNormal-243:get wanPort[-1]
[   15.634097] vlan2: mbr[0x10001] untag[0x1] pvid[2]
[   15.639744] vlan3: mbr[0x10002] untag[0x2] pvid[3]
[   15.644595] vlan4: mbr[0x10004] untag[0x4] pvid[4]
[   15.649050] rtl8367c(per port vlan) set wan port = -1
[   15.653814] vid    portmap
[   15.659272]   0    -------
[   15.664553]   1    1111111
[   15.667245]   2    1----1-
[   15.669935]   3    -1---1-
[   15.672637]   4    --1--1-
[   15.675316]   5    -------
[   15.678008]   6    -------
[   15.680699]   7    -------
[   15.683389]   8    -------
[   15.686081]   9    -------
[   15.688772]  10    -------
[   15.691484]  11    -------
[   15.694154]  12    -------
[   15.696845]  13    -------
[   15.699536]  14    -------
[   15.702237]  15    -------
[   15.704591] Default : disable RTL8367S EEE.
[   15.712200] init_rtl8367s disable RTL8367S port.
[   15.715974] init_rtl8367s-858:get switch type[4]
[   15.716312] vid    portmap
[   15.720800]   0    -------
[   15.725994]   1    1111111
[   15.728685]   2    1----1-
[   15.731375]   3    -1---1-
[   15.734066]   4    --1--1-
[   15.736758]   5    -------
[   15.739448]   6    -------
[   15.742160]   7    -------
[   15.744830]   8    -------
[   15.747522]   9    -------
[   15.750213]  10    -------
[   15.752913]  11    -------
[   15.755604]  12    -------
[   15.758286]  13    -------
[   15.760976]  14    -------
[   15.763667]  15    -------
[   16.695599] Not rtl8221b and skip init flow...id = c849 ,
[   18.602647] rtl8221_phy_init Rtl8226b_enable_set power: 0
[   18.602720] Rtl8226b_enable_set power: 0
[   18.608726] tun: Universal TUN/TAP device driver, 1.6
[   18.611094] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com
[   18.623046] **********************************************************
[   18.623073] * NSS Data Plane driver
[   18.628695] **********************************************************
[   18.644471] l2tp_core: L2TP core driver, V2.0
[   18.645674] l2tp_netlink: L2TP netlink interface
[   18.870702] nss_driver - fw of size 763016  bytes copied to load addr: 40000000, nss_id : 0
[   18.872582] Supported Frequencies -
[   18.877887] 850 MHz 1 GHz
[   18.883486]
[   18.884395] ffffffbffc39ad80: set sdma ffffffc01caedd00
[   18.886184] node size 2 # items 4
[   18.890784] memory: 40000000 536870912 (avl 427737088) items 4 active_cores 1
[   18.894264] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[   18.901400] ffffffbffc39ad80: NSS core 0 DDR from 40000000 to 41000000
[   18.908266] ffffffbffc39ad80: meminfo init succeed
[   18.918235] sit: IPv6 over IPv4 tunneling driver
[   18.924719] nat46: module (version 8ff2ae59ec9840a7b8b45f976c51cae80abe0226) loaded.
[   18.931972] tipc: Activated (version 2.0.0)
[   18.932124] NET: Registered protocol family 30
[   18.936552] tipc: Started in single node mode
[   18.941723] gre: GRE over IPv4 demultiplexor driver
[   18.948460] node size 2 # items 4
[   18.949469] memory: 40000000 536870912 (avl 427737088) items 4 active_cores 1
[   18.952946] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[   18.960157] ffffffbffc39ad80: nss core 0 booted successfully
[   18.976695] ip_gre: GRE over IPv4 tunneling driver
[   18.983772] ip6_gre: GRE over IPv6 tunneling driver
[   18.991871] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[   19.007405] QCA multicast snooping installed successfully
[   19.009063] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   19.034871] openvswitch: Open vSwitch switching datapath
[   19.041275] QCA Hy-Fi multicast installation successfully
[   19.047417] PPP generic driver version 2.4.2
[   19.077035] nss_lag_init[352]:LAG Manager Installed
[   19.080077] NET: Registered protocol family 24
[   19.085837] PPTP driver version 0.8.5
[   19.100504] diag: IPC Logging disabled
[   19.132416] TRACK: P[0]      PMask[4]
[   19.132436] TRACK: P[1]      PMask[4]
[   19.134697] TRACK: P[2]      PMask[4]
[   19.175853] TRACK: P[3]      PMask[4]
[   19.175951] nik 4097 info->svc_id
[   19.193557] :module loaded Build_ID - 07/24/24, 10:24:25 SoC=ipq50xx_64
[   19.197148] cannot find nss-macsec0 node
[   19.200926] nss-macsec1 DT exist!
[   19.204542] cannot find nss-macsec2 node
[   19.208047] nss_macsec init success
[   19.271428] u32 classifier
[   19.271455]     Performance counters on
[   19.273017]     input device check on
[   19.276918]     Actions configured
[   19.282343] Mirror/redirect action on
[   19.311982] safesearch_dns: module license 'unspecified' taints kernel.
[   19.312020] Disabling lock debugging due to kernel taint
[   19.332097] Ebtables v2.0 registered
[   19.343110] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   19.551685] Netfilter messages via NETLINK v0.30.
[   19.557851] PPP MPPE Compression module registered
[   19.599306] xt_time: kernel timezone is -0000
[   19.612000] ctnetlink v0.93: registering with nfnetlink.

db215 · March 6, 2026, 10:21pm

ipq50xx.mk


define Device/tplink_deco-xe70pro
$(call Device/FitImage)
$(call Device/UbiFit)
DEVICE_VENDOR := TP-Link
DEVICE_MODEL := Deco XE70 Pro
SOC := ipq5018
BLOCKSIZE := 128k
PAGESIZE := 2048
IMAGE_SIZE := 43008k
NAND_SIZE := 128m
KERNEL_IN_UBI := 1
DEVICE_DTS_CONFIG := config@mp03.5-c1
DEVICE_PACKAGES := ath11k-firmware-ipq5018-qcn6122 
ipq-wifi-linksys_mx6200 
kmod-rtl8367s 
swconfig
endef
TARGET_DEVICES += tplink_deco-xe70pro

root@OpenWrt:/proc# cat mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "0:sbl1"
mtd1: 00080000 00020000 "0:mibib"
mtd2: 00100000 00020000 "0:qsee"
mtd3: 00040000 00020000 "0:devcfg"
mtd4: 00040000 00020000 "0:cdt"
mtd5: 00080000 00020000 "0:appsblenv"
mtd6: 00040000 00020000 "env-data"
mtd7: 00140000 00020000 "0:appsbl"
mtd8: 00100000 00020000 "0:art"
mtd9: 00080000 00020000 "0:training"
mtd10: 00080000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 05200000 00020000 "kernel"
mtd14: 05200000 00020000 "rootfs"
mtd15: 00200000 00020000 "sysdiag"
mtd16: 04400000 00020000 "syscfg"

db215 · March 6, 2026, 10:24pm

Attempted DTS w/o Wi-Fi


/dts-v1/;
// this boots without errors but no dp function and all ports are bridged

#include "ipq5018-mx-base.dtsi"
#include "ipq5018-qcn6122.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/clock/qcom,gcc-ipq5018.h>
#include <dt-bindings/reset/qcom,gcc-ipq5018.h>

/ {
model = "TP-Link Deco XE70 Pro";
compatible = "tplink,deco-xe70pro", "qcom,ipq5018";

chosen {
	bootargs-append = " coherent_pool=2M";
	stdout-path = "serial0:115200n8";
};

};

&soc {

uniphy1: ess-uniphy@9a000 {
compatible = "qcom,ess-uniphy";
reg = <0x9a000 0x800>;
uniphy_access_mode = "local bus";
status = "okay";

clocks = <&gcc GCC_UNIPHY_AHB_CLK>,
<&gcc GCC_UNIPHY_SYS_CLK>;
clock-names = "uniphy_ahb_clk", "uniphy_sys_clk";
};
};

&qpic_nand {
nand@0 {
partitions {
partition-art {
label = "0:ART";
read-only;
};

		partition@factory_data {
			label = "factory_data";
			reg = <0x0 0x900000>;
			compatible = "nvmem-cells"; 
			#address-cells = <1>;
			#size-cells = <1>;
			read-only;
			nvmem-layout {
				compatible = "fixed-layout";
				#address-cells = <1>;
				#size-cells = <1>;
					macaddr_factory: mac-address@5e1830 {
					reg = <0x5e1830 0x6>;
				};
			};
		};
	};
};

};

/*

Based on TP-Link GPL mp03.5-c1 switch datapath:

MAC0 -> internal GE PHY (addr 7)

MAC1 -> SGMII uplink for external switch/PHY path
*/
&switch {
status = "okay";


switch_cpu_bmp = <0x1>;
switch_lan_bmp = <0x2>; / Port 1 /
switch_wan_bmp = <0x4>; / Port 2 */
switch_mac_mode = <MAC_MODE_SGMII_CHANNEL0>;
//	switch_mac_mode = <MAC_MODE_SGMII_PLUS>;
switch_mac_mode1 = <MAC_MODE_SGMII_CHANNEL0>;
switch_mac_mode2 = <MAC_MODE_SGMII_PLUS>;


qcom,port_phyinfo {
port@0 {
port_id = <1>;
mdiobus = <&mdio0>;
phy_address = <7>;
};

 port@1 {
 	port_id = <2>;
 	mdiobus = <&mdio1>;
 	phy_address = <6>;

//			port_mac_sel = "SGMII_PLUS";
//			port_mac_sel = "QGMAC_PORT";
//			port_mac_sel = "SGMII";
//			phy-mode = "sgmii-2500";

uniphy-handle = <&uniphy1>;
forced-speed = <2500>;
forced-duplex = <1>;
};
};
};

&dp1 {
reg = <0x39C00000 0x10000>;
status = "okay";
label = "lan";
qcom,port_id = <1>; 

interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
qcom,mactype = <2>;
phy-mode = "sgmii";
qcom,link-poll = <1>;
qcom,rx_desc_num = <512>;
qcom,tx_desc_num = <512>;
phy-handle = <&ge_phy>;
};

&dp2 {

reg = <0x39d00000 0x10000>, <0x39d40000 0x10000>;
reg-names = "dp_gmac_base", "dp_xpcs_base";
status = "okay";
label = "wan";
qcom,port_id = <2>; 
qcom,mactype = <2>;
//	qcom,rx_desc_num = <512>;
//	qcom,tx_desc_num = <512>;

phy-handle = <&mdio1_phy6>;
//	phy-mode = "sgmii-2500";
//	phy-mode = "2500base-x";
//	phy-mode = "2500base-t";
phy-mode = "sgmii";

qcom,uniphy-id = <1>;

/* Pull the MAC address found at 0x5e1830 */
nvmem-cells = <&macaddr_factory>;
nvmem-cell-names = "mac-address";


qcom,link-poll;

qcom,rx_desc_num = <512>;
    qcom,tx_desc_num = <512>;
    
qcom,tx_pause;
qcom,rx_pause;


    clocks = <&gcc GCC_UNIPHY_AHB_CLK>,
	 <&gcc GCC_UNIPHY_SYS_CLK>,
	 <&gcc GCC_UNIPHY_RX_CLK>,
	 <&gcc GCC_UNIPHY_TX_CLK>,
	 <&gcc GCC_SNOC_GMAC1_AHB_CLK>,
	 <&gcc GCC_SNOC_GMAC1_AXI_CLK>;
clock-names = "uniphy_ahb_clk", 
	      "uniphy_sys_clk", 
	      "uniphy_rx_clk", 
	      "uniphy_tx_clk",
	      "nss-snoc-gmac-ahb-clk",
	      "nss-snoc-gmac-axi-clk"; 

resets = <&gcc GCC_UNIPHY_BCR>,
	 <&gcc GCC_UNIPHY_SOFT_RESET>;
reset-names = "uniphy_bcr_rst", "uniphy_rst";
qcom,mru = <1500>;
qcom,nss-common-id = <0>; 

};

&mdio0 {
status = "okay";
};

&ge_phy {
qcom,dac-preset-short-cable;
};

&mdio1 {
status = "okay";
pinctrl-0 = <&mdio1_pins>;
pinctrl-names = "default";


mdio1_phy0: ethernet-phy@0 {
	reg = <0>;
};

mdio1_phy6: ethernet-phy@6 {
	reg = <6>;

//	        compatible = "ethernet-phy-ieee802.3-c45";
//        	realtek,aldps-enable;
};
};

anon63541380 · March 6, 2026, 11:11pm

Did you manage to decrypt - binwalk - dd - ddtc the OEM DTS? It could clarify eg where dsa is found....

db215 · March 6, 2026, 11:12pm

If you can provide instructions I’m happy to try.

anon63541380 · March 6, 2026, 11:15pm

Random MAC-s in log means factory data is not at correct offset. Scan "system" partitions for first 5 pieces of printed MAC.

1/ seatch tplink decrypt in forum (optional, may not be needed)
2/ binwalk oem.bin
2a/ binwalk -eM oem.bin
3/ dd if=oem.bin size=1 skip=$offset count=$size of=oem.dtb
4/ dtc -I dtb -O dts -o oem.dts oem.dtb

db215 · March 7, 2026, 4:27am

Very complicated to get as I had to dump from u-boot to tftp…

There are three .dts

board1.dts: model = "Qualcomm Technologies, Inc. IPQ5018/DB-MP03.1-C2";
board2.dts: model = "Qualcomm Technologies, Inc. IPQ5018/AP-MP03.5-C2";
board3.dts: model = "Qualcomm Technologies, Inc. IPQ5018/TB-MP04";

All are too large to post the text of. I can share something specific, otherwise I’ll come back and put on Google Drive or similar.

anon63541380 · March 7, 2026, 5:42am

That is for reference, like wifi caldata is at art partition at offset 0x100 etc, or leds are at gpio number 5,15,23 if you get stuck.
Those ID-s are from various reference boards, usually meaning OEM devicetree is edited on top that.

ElektromAn · March 7, 2026, 10:57am

another one with RTL8367
but now with IPQ5018, and not with IPQ5332

db215 · March 7, 2026, 1:38pm

anon63541380 · March 7, 2026, 1:57pm

Can you point to your local OEM device page where one could download firmwares?

Hostle · March 7, 2026, 2:02pm

you'll need to extract the dtb from the kernel .. see this tool/thread for more info

db215 · March 7, 2026, 2:53pm

https://static.tp-link.com/upload/gpl-code/2024/202404/20240410/XE70ProV3_GPL.tar.gz

db215 · March 7, 2026, 3:15pm

The DTS files posted to the Google Drive absolutely came from the device flash.

Here are the flash partition dumps. I named the files based on the labels from mtd in OpenWrt…I found the kernel in the rootfs_complete.

These have ubi partitions which I then extracted, then binwalk and extracted. Then:
dd if=img-1239794609_vol-kernel.ubifs of=board2.dtb bs=1 skip=2993420 count=61131

It’s possible other DTS are present and I missed them.

I have the kernel and squashfs extracted..

ubifs-root/kernel_full.bin$ ls
board1.dtb board2.dtb board3.dtb img-1239794609_vol-kernel.ubifs img-1239794609_vol-ubi_rootfs.ubifs
board1.dts board2.dts board3.dts _img-1239794609_vol-kernel.ubifs.extracted squashfs-root

cd _img-1239794609_vol-kernel.ubifs.extracted/
_img-1239794609_vol-kernel.ubifs.extracted$ ls
E8 E8.7z vmlinux

Hostle · March 7, 2026, 4:34pm

these are not device specific dtb/dts ... these are just platform generic. the actual device specific dtb is most likely included in the kernel.itb. If its a fit image, you can use mkimage or dumpimage to get the location of the fdt --> "flattened device tree" then use dd to dump it, and dtc to convert it back to dts format

mkimage -l or dumpimage -l

the thread i pointed you to has an example of using mkimage to list the parts

bjorn@canardo:/usr/local/src/openwrt$ staging_dir/host/bin/mkimage  -l bin/r23456-81f667513a2d/targets/ramips/mt7621/openwrt-snapshot-ramips-mt7621-ubnt_unifi-6-lite-squashfs-sysupgrade.bin
FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
Created:         Thu Jun 29 12:54:38 2023
 Image 0 (kernel-1)
  Description:  MIPS OpenWrt Linux-5.15.118
  Created:      Thu Jun 29 12:54:38 2023
  Type:         Kernel Image
  Compression:  lzma compressed
  Data Size:    2932336 Bytes = 2863.61 KiB = 2.80 MiB
  Architecture: MIPS
  OS:           Linux
  Load Address: 0x80001000
  Entry Point:  0x80001000
  Hash algo:    crc32
  Hash value:   ba90272c
  Hash algo:    sha1
  Hash value:   4a8ad8efc95301231b289db772718d19f0182ff5
 Image 1 (fdt-1)
  Description:  MIPS OpenWrt ubnt_unifi-6-lite device tree blob
  Created:      Thu Jun 29 12:54:38 2023
  Type:         Flat Device Tree
  Compression:  uncompressed
  Data Size:    11371 Bytes = 11.10 KiB = 0.01 MiB
  Architecture: MIPS
  Load Address: 0x87000000
  Hash algo:    crc32
  Hash value:   a8683697
  Hash algo:    sha1
  Hash value:   47c58a6742b8e90170c9f9f6187ead8ad1911e62
 Default Configuration: 'config@1'
 Configuration 0 (config@1)
  Description:  OpenWrt ubnt_unifi-6-lite
  Kernel:       kernel-1
  FDT:          fdt-1

you can see it above ...

 Image 1 (fdt-1)
  Description:  MIPS OpenWrt ubnt_unifi-6-lite device tree blob
  Created:      Thu Jun 29 12:54:38 2023
  Type:         Flat Device Tree
  Compression:  uncompressed
  Data Size:    11371 Bytes = 11.10 KiB = 0.01 MiB
  Architecture: MIPS
  Load Address: 0x87000000
  Hash algo:    crc32
  Hash value:   a8683697
  Hash algo:    sha1
  Hash value:   47c58a6742b8e90170c9f9f6187ead8ad1911e62

so dd from 0x87000000 + 11371 + pad to page size, in the above example

anon63541380 · March 7, 2026, 4:44pm

I know that, some manufacturers edit 10 lines and leave boilerplate strings intact.

Hostle · March 7, 2026, 4:47pm

that why i quoted your response probably should've added ....as brada4 said.

anon63541380 · March 7, 2026, 4:50pm

No worries, thanks for joining in

ElektromAn · March 7, 2026, 5:19pm

@db215

Which Hardware revision ?
And I didn't see the serial on the FCC pictures