TP-Link EX710(RUER) support?

Hi @georgem83 — I'm bringing up another IPQ5018 board and hoping you can point me at the right boot-args for a QCN6024 5 GHz radio.

Device is a TP-Link EX710(RUER) — an ISP (дом.ру) IPQ5018 device, board AP-MP03.1, 5 GHz radio QCN6024, self-built from current master (incl. #20928). 2.4 GHz works fully (phy0, HE, own BDF/caldata from the stock misc_data_ro, since 0:ART is blank). Ethernet + everything else is fine.

The QCN6024 5 GHz radio never registersiw phy shows only phy0. ~51 s after boot the WPSS firmware hits a fatal watchdog:

ath11k b00a040.wifi: Multipd architecture - userpd: 2
ath11k b00a040.wifi: qcn6122 hw1.0
remoteproc remoteproc2: remote processor pd-2 is now up
...
qcom-q6-mpd cd00000.remoteproc: fatal error received: err_smem_ver.2.1:
QC Image Version : WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
dog_virtual_user.c:242 USER-PD DOG detects stalled initialization ...
Thread name : TIMER_CLIENT_2  Process name : wlan1
can't start rproc cd00000.remoteproc: -110

My DTS mirrors ipq5018-mr3000d-ci, including the &q6v5_wcss boot-args override (verified they reach the built DTB):

&q6v5_wcss {
    status = "okay";
    boot-args = <0x1 4 2 15 0 0>;  /* type PCIE0, len 4, UPD ID 2, reset GPIO 15, reserved */
};
&wifi1 {
    qcom,rproc = <&q6_wcss_pd2>;
    qcom,userpd-subsys-name = "q6v5_wcss_userpd2";
    qcom,ath11k-fw-memory-mode = <1>;
    qcom,bdf-addr = <0x4d100000>;
    qcom,m3-dump-addr = <0x4df00000>;
};

Ruled out (identical crash): fw-memory-mode <1>/<2>, coherent_pool 2M/4M, segment count already 5, removing the disable-coldboot patch → failsafe.

I took the boot-args values from MR3000D-CI, whose radio is QCN6102. Mine is QCN6024. Does QCN6024 need a different type / UPD ID / reset GPIO in boot-args? The stock DTB (AP-MP03.1) doesn't expose a dedicated GPIO reset for the 5 GHz radio (only GPIO39 for the network switch), so I suspect the reset field or type field is off for this chip.

Which PCIe rail is the QCN6024 on for AP-MP03.1 — pcie0 or pcie1? I currently have only pcie0 enabled.

Happy to test — UART console, initramfs/TFTP.

Full dmesg + DTS down below.

dmesg
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.94 (mnb@DESKTOP-HUETE8R) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.4.0) 14.4.0, GNU ld (GNU Binutils) 2.46.1) #0 SMP Fri Jul 24 07:38:00 2026
[    0.000000] Machine model: TP-Link EX710 v1
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[    0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable sbl@4aa00000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x000000004dffffff (49152 KiB) nomap non-reusable wcss@4b000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004adfffff]
[    0.000000]   node   0: [mem 0x000000004ae00000-0x000000004affffff]
[    0.000000]   node   0: [mem 0x000000004b000000-0x000000004dffffff]
[    0.000000]   node   0: [mem 0x000000004e000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920
[    0.000000] pcpu-alloc: s43224 r8192 d30504 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_1 swiotlb=1 coherent_pool=4M
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
[    0.000000] software IO TLB: mapped [mem 0x000000005f580000-0x000000005f600000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[    0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] _of_fixed_factor_clk_setup Fixed factor clock <xo-board-clk> must have a clock-div property
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000115] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000132] pid_max: default: 32768 minimum: 301
[    0.005092] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005111] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.011109] rcu: Hierarchical SRCU implementation.
[    0.011122] rcu:     Max phase no-delay instances is 1000.
[    0.011622] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.012193] smp: Bringing up secondary CPUs ...
[    0.013159] Detected VIPT I-cache on CPU1
[    0.013305] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.013505] smp: Brought up 1 node, 2 CPUs
[    0.013521] SMP: Total of 2 processors activated.
[    0.013525] CPU: All CPU(s) started at EL1
[    0.013530] CPU features: detected: 32-bit EL0 Support
[    0.013536] CPU features: detected: CRC32 instructions
[    0.013603] alternatives: applying system-wide alternatives
[    0.013835] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.014117] Memory: 430528K/524288K available (8832K kernel code, 904K rwdata, 2840K rodata, 8704K init, 289K bss, 91908K reserved, 0K cma-reserved)
[    0.020333] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.020366] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.020490] 27328 pages in range for non-PLT usage
[    0.020500] 518848 pages in range for PLT usage
[    0.022640] pinctrl core: initialized pinctrl subsystem
[    0.025288] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.026627] DMA: preallocated 4096 KiB GFP_KERNEL pool for atomic allocations
[    0.027231] DMA: preallocated 4096 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.027822] DMA: preallocated 4096 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.028435] thermal_sys: Registered thermal governor 'step_wise'
[    0.028567] cpuidle: using governor menu
[    0.028828] ASID allocator initialised with 65536 entries
[    0.033035] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[    0.070281] SCSI subsystem initialized
[    0.070629] usbcore: registered new interface driver usbfs
[    0.070701] usbcore: registered new interface driver hub
[    0.070755] usbcore: registered new device driver usb
[    0.071108] qcom_scm: convention: smc arm 64
[    0.073541] clocksource: Switched to clocksource arch_sys_counter
[    0.077899] NET: Registered PF_INET protocol family
[    0.078161] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.080458] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.080493] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.080516] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.080568] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.080742] TCP: Hash tables configured (established 4096 bind 4096)
[    0.081193] MPTCP token hash table entries: 512 (order: 2, 12288 bytes, linear)
[    0.081408] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.081440] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.081993] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.082056] PCI: CLS 0 bytes, default 64
[    0.091881] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.092542] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.092562] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.112671] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.114627] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.114782] msm_serial 78af000.serial: uartclk = 0
[    0.115487] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 0) is a MSM
[    0.115546] msm_serial: console setup on port #0
[    0.115648] printk: legacy console [ttyMSM0] enabled
[    0.843366] msm_serial: driver initialized
[    0.856489] loop: module loaded
[    0.860968] spi-nand spi0.0: ESMT SPI NAND was found.
[    0.861019] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.879238] 21 fixed-partitions partitions found on MTD device spi0.0
[    0.879303] Creating 21 MTD partitions on "spi0.0":
[    0.884889] 0x000000000000-0x000000080000 : "0:SBL1"
[    0.891448] 0x000000080000-0x000000100000 : "0:MIBIB"
[    0.896699] 0x000000100000-0x000000140000 : "0:BOOTCONFIG"
[    0.901022] 0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
[    0.906914] 0x000000180000-0x000000280000 : "0:QSEE"
[    0.913583] 0x000000280000-0x000000380000 : "0:QSEE_1"
[    0.918709] 0x000000380000-0x0000003c0000 : "0:DEVCFG"
[    0.922346] 0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
[    0.927325] 0x000000400000-0x000000440000 : "0:CDT"
[    0.932788] 0x000000440000-0x000000480000 : "0:CDT_1"
[    0.937358] 0x000000480000-0x000000500000 : "0:APPSBLENV"
[    0.943123] 0x000000500000-0x000000640000 : "0:APPSBL"
[    0.949791] 0x000000640000-0x000000780000 : "0:APPSBL_1"
[    0.955054] 0x000000780000-0x000000880000 : "0:ART"
[    0.959819] 0x000000880000-0x000000900000 : "0:TRAINING"
[    0.963715] 0x000000900000-0x000000f00000 : "misc_data_ro"
[    0.979470] 0x000000f00000-0x000001500000 : "misc_data_rw"
[    0.991810] 0x000001500000-0x000001b00000 : "misc_data_rwbak"
[    1.004617] 0x000001b00000-0x000002100000 : "misc_data_isp"
[    1.016892] 0x000002100000-0x000004d00000 : "rootfs"
[    1.099132] mtd: setting mtd19 (rootfs) as root device
[    1.100003] mtdsplit: no squashfs found in "rootfs"
[    1.103217] 0x000004d00000-0x000007900000 : "rootfs_1"
[    1.338401] ipq5018-gmac-dwmac 39c00000.ethernet: IRQ eth_wake_irq not found
[    1.338469] ipq5018-gmac-dwmac 39c00000.ethernet: IRQ sfty not found
[    1.345281] ipq5018-gmac-dwmac 39c00000.ethernet: User ID: 0x11, Synopsys ID: 0x37
[    1.350888] ipq5018-gmac-dwmac 39c00000.ethernet:    DWMAC1000
[    1.358311] ipq5018-gmac-dwmac 39c00000.ethernet: DMA HW capability register supported
[    1.364205] ipq5018-gmac-dwmac 39c00000.ethernet: RX Checksum Offload Engine supported
[    1.371798] ipq5018-gmac-dwmac 39c00000.ethernet: COE Type 2
[    1.379738] ipq5018-gmac-dwmac 39c00000.ethernet: TX Checksum insertion supported
[    1.385544] ipq5018-gmac-dwmac 39c00000.ethernet: Wake-Up On Lan supported
[    1.392892] ipq5018-gmac-dwmac 39c00000.ethernet: Enhanced/Alternate descriptors
[    1.399690] ipq5018-gmac-dwmac 39c00000.ethernet: Enabled extended descriptors
[    1.407241] ipq5018-gmac-dwmac 39c00000.ethernet: Ring mode enabled
[    1.414273] ipq5018-gmac-dwmac 39c00000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    1.422627] i2c_dev: i2c /dev entries driver
[    1.433458] sdhci: Secure Digital Host Controller Interface driver
[    1.433726] sdhci: Copyright(c) Pierre Ossman
[    1.439338] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.445464] remoteproc remoteproc0: releasing cd00000.remoteproc
[    1.452801] NET: Registered PF_INET6 protocol family
[    1.457776] Segment Routing with IPv6
[    1.460485] In-situ OAM (IOAM) with IPv6
[    1.464229] NET: Registered PF_PACKET protocol family
[    1.468321] 8021q: 802.1Q VLAN Support v1.8
[    1.524005] cpufreq: cpufreq_online: ->get() failed
[    1.524201] cpufreq: cpufreq_online: ->get() failed
[    1.527800] cpufreq-dt cpufreq-dt: failed register driver: -19
[    1.534603] remoteproc remoteproc0: cd00000.remoteproc is available
[    1.538591] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[    1.546217] remoteproc remoteproc1: pd-1 is available
[    1.550287] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[    1.556937] remoteproc remoteproc2: pd-2 is available
[    1.560915] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
[    1.567466] remoteproc remoteproc3: pd-3 is available
[    1.572812] clk: Disabling unused clocks
[    1.582537] Freeing unused kernel memory: 8704K
[    1.582752] Run /init as init process
[    1.585959]   with arguments:
[    1.585967]     /init
[    1.585973]   with environment:
[    1.585977]     HOME=/
[    1.585982]     TERM=linux
[    1.949091] init: Console is alive
[    1.949485] init: - watchdog -
[    1.967271] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.997685] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.019064] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.023472] init: - preinit -
[    2.148401] ipq5018-gmac-dwmac 39c00000.ethernet lan: renamed from eth0
[    4.433541] random: crng init done
[    8.929879] procd: - early -
[    8.930122] procd: - watchdog -
[    9.537716] procd: - watchdog -
[    9.538115] procd: - ubus -
[    9.596077] procd: - init -
[   10.038605] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.286558] urngd: v1.0.2 started.
[   10.333862] Loading modules backported from Linux version v6.18.39-0-gf89c29685
[   10.333912] Backport generated by backports.git 614e5ed
[   10.383896] NET: Registered PF_QIPCRTR protocol family
[   10.555601] PPP generic driver version 2.4.2
[   10.557557] NET: Registered PF_PPPOX protocol family
[   10.594077] ath11k c000000.wifi: ipq5018 hw1.0
[   10.594134] ath11k c000000.wifi: FW memory mode: 1
[   10.724489] remoteproc remoteproc1: powering up pd-1
[   10.724685] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   10.728542] remoteproc remoteproc0: powering up cd00000.remoteproc
[   10.737031] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   10.881787] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   10.898661] remoteproc remoteproc1: remote processor pd-1 is now up
[   10.902026] ath11k b00a040.wifi: Multipd architecture - userpd: 2
[   10.904344] ath11k b00a040.wifi: qcn6122 hw1.0
[   10.909996] ath11k b00a040.wifi: FW memory mode: 1
[   10.934342] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   10.934417] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   10.942377] ath11k c000000.wifi: found invalid board magic
[   10.955618] ath11k c000000.wifi: found invalid board magic
[   10.960610] ath11k c000000.wifi: found invalid board magic
[   10.974996] remoteproc remoteproc2: powering up pd-2
[   10.976949] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   10.991134] remoteproc remoteproc2: remote processor pd-2 is now up
[   11.023217] kmodloader: done loading kernel modules from /etc/modules.d/*
[   51.103121] qcom-q6-mpd cd00000.remoteproc: fatal error received: err_smem_ver.2.1:
[   51.103121] QC Image Version : QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   51.103121] Image Variant : IMAGE_VARIANT_STRING=5018.wlanfw2.map_spr_spr_evalQ
[   51.103121] dog_virtual_user.c:242 USER-PD DOG detects stalled initialization, triage with IMAGE OWNER param0 :zero,param1 :zero,param2 :zero
[   51.103121] Thread ID : 0x00000047 Thread name : TIMER_CLIENT_2 Process ID : 0x00000002 Process name :wlan1
[   51.103121]
[   51.103121] Registers:
[   51.103121] SP : 0x4bfc7020
[   51.103121] FP : 0x4bfc7030
[   51.103121] PC : 0xd025bc70
[   51.103121] SSR : 0x00000000
[   51.103121] BADVA : 0x00000000
[   51.103121] LR : 0xd000a3fc
[   51.103121]
[   51.103121] StackDump
[   51.103121] from:0x4bfc7020
[   51.103121] to: 0x00000000:
[   51.103121]
[   51.158102] remoteproc remoteproc0: crash detected in cd00000.remoteproc: type fatal error
[   51.180387] remoteproc remoteproc0: handling crash #1 in cd00000.remoteproc
[   51.188488] remoteproc remoteproc0: recovering cd00000.remoteproc
[   51.203120] remoteproc remoteproc0: stopped remote processor cd00000.remoteproc
[   56.323557] qcom-q6-mpd cd00000.remoteproc: start timed out
[   56.323612] remoteproc remoteproc0: can't start rproc cd00000.remoteproc: -110
DTS
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;

#include "ipq5018.dtsi"
#include "ipq5018-ess.dtsi"
#include "ipq5018-qcn6122.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/*
 * TP-Link EX710 v1 (Aginet / dom.ru, EX710(RUER) nameplate)
 * IPQ5018 + QCN6024 (5G) SoC, 512 MiB RAM, 128 MiB NAND, RTL8367S switch.
 *
 * ATTENTION: partition 0:ART is empty (0xff). The real MAC and caldata are located
 * in the misc_ro UBI volume of the misc_data_ro partition. Therefore, nvmem is not used on ART.
 * The MAC is set to local-mac-address from the dump in the first stage,
 * then substituted by the script in userspace.
 *
 * The first image is for loading into RAM and accessing the console. RTL8367S switch
 * is currently disabled (we'll enable it on a live system). One port, gmac0, is active.
 */

/ {
	model = "TP-Link EX710 v1";
	compatible = "tplink,ex710", "qcom,ipq5018";

	aliases {
		serial0 = &blsp1_uart1;
	};

	chosen {
		bootargs-append = " root=/dev/ubiblock0_1 swiotlb=1 coherent_pool=4M";
		stdout-path = "serial0:115200n8";
	};
	
	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&tlmm 25 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};

		wps {
			label = "wps";
			gpios = <&tlmm 24 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_WPS_BUTTON>;
			debounce-interval = <60>;
		};

		ledswitch {
			label = "ledswitch";
			gpios = <&tlmm 23 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_LIGHTS_TOGGLE>;
		};

		wifi {
			label = "wifi";
			gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RFKILL>;
		};
	};
};

&blsp1_uart1 {
	status = "okay";
};

&sleep_clk {
	clock-frequency = <32000>;
};

&xo_board_clk {
	clock-frequency = <24000000>;
};

/* LAN via built-in GE PHY. MAC temporarily hardcoded from the misc_ro dump. */
&gmac0 {
	status = "okay";
	label = "lan";
	local-mac-address = [5C E9 31 C1 74 22];
};

&mdio0 {
	status = "okay";
};

&qpic_bam {
	status = "okay";
};

&qpic_nand {
	status = "okay";

	nand@0 {
		compatible = "spi-nand";
		reg = <0>;
		nand-ecc-engine = <&qpic_nand>;
		nand-ecc-strength = <4>;
		nand-ecc-step-size = <512>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 { label = "0:SBL1";         reg = <0x0000000 0x0080000>; read-only; };
			partition@80000 { label = "0:MIBIB";      reg = <0x0080000 0x0080000>; read-only; };
			partition@100000 { label = "0:BOOTCONFIG"; reg = <0x0100000 0x0040000>; read-only; };
			partition@140000 { label = "0:BOOTCONFIG1"; reg = <0x0140000 0x0040000>; read-only; };
			partition@180000 { label = "0:QSEE";      reg = <0x0180000 0x0100000>; read-only; };
			partition@280000 { label = "0:QSEE_1";    reg = <0x0280000 0x0100000>; read-only; };
			partition@380000 { label = "0:DEVCFG";    reg = <0x0380000 0x0040000>; read-only; };
			partition@3c0000 { label = "0:DEVCFG_1";  reg = <0x03c0000 0x0040000>; read-only; };
			partition@400000 { label = "0:CDT";       reg = <0x0400000 0x0040000>; read-only; };
			partition@440000 { label = "0:CDT_1";     reg = <0x0440000 0x0040000>; read-only; };
			partition@480000 { label = "0:APPSBLENV"; reg = <0x0480000 0x0080000>; };
			partition@500000 { label = "0:APPSBL";    reg = <0x0500000 0x0140000>; read-only; };
			partition@640000 { label = "0:APPSBL_1";  reg = <0x0640000 0x0140000>; read-only; };
			partition@780000 { label = "0:ART";       reg = <0x0780000 0x0100000>; read-only; };
			partition@880000 { label = "0:TRAINING";  reg = <0x0880000 0x0080000>; read-only; };
			partition@900000 { label = "misc_data_ro"; reg = <0x0900000 0x0600000>; read-only; };
			partition@f00000 { label = "misc_data_rw"; reg = <0x0f00000 0x0600000>; };
			partition@1500000 { label = "misc_data_rwbak"; reg = <0x1500000 0x0600000>; };
			partition@1b00000 { label = "misc_data_isp";   reg = <0x1b00000 0x0600000>; };

			partition@2100000 {
				label = "rootfs";
				reg = <0x2100000 0x2c00000>;
			};

			partition@4d00000 {
				label = "rootfs_1";
				reg = <0x4d00000 0x2c00000>;
			};
		};
	};
};

&q6v5_wcss {
	status = "okay";
	/* QCN6024 radio maps to UPD ID 2. Without boot-args the    */
	/* firmware expects it on UPD ID 3, causing err_smem_ver.2.1 */
	boot-args = 
		/*       type:  */	<0x1	/* PCIE0	*/
		/*     length:  */	4
		/*     UPD ID:  */	2
		/* reset GPIO:  */	15
		/*   reserved:  */	0 0>;
};

/* Built-in radio 2.4 GHz */
&wifi {
	status = "okay";
	qcom,rproc = <&q6_wcss_pd1>;
	qcom,ath11k-fw-memory-mode = <1>;
	qcom,bdf-addr = <0x4c400000>;
};

/* QCN6024 5 GHz по PCIe/remoteproc */
&wifi1 {
	status = "okay";
	qcom,rproc = <&q6_wcss_pd2>;
	qcom,userpd-subsys-name = "q6v5_wcss_userpd2";
	qcom,ath11k-fw-memory-mode = <1>;
	qcom,bdf-addr = <0x4d100000>;
	qcom,m3-dump-addr = <0x4df00000>;
};

Do you have serial access? If so, can you boot into stock and upload the devicetree file somewhere from /sys/firmware/fdt?

Edit: stock boot logs would be useful too.
In addition, try removing the bootargs altogether, then change to PD3 in the wifi node.

Thanks! No stock console access unfortunately — getty is locked on this unit and no working credentials, so stock boot logs are out of reach. But I pulled the stock devicetree straight out of the NAND dump instead — attaching both the raw FDT and the decompiled DTS (board IPQ5018/AP-MP03.1).

Update: switch probes but doesn't forward; both radios look like only part of the antenna chains is live. Logs below.

Board is IPQ5018 / AP-MP03.1. Two separate problems.


1. RTL8367S switch — unknown chip revision

Following the AX55 v1 port (thanks @kuncy7): gmac0 disabled, gmac1 + uniphy0 as the 2.5G HSGMII trunk, switch on mdio1 addr 29, reset GPIO 33. The switch answers (reads are not 0xffff), but:

rtl8365mb-mdio 90000.mdio-1:1d: unrecognized switch (id=0x3321, ver=0x0008)
rtl8365mb-mdio 90000.mdio-1:1d: error -ENODEV: unable to detect switch

0x3321 is in neither rtl8365mb_chip_infos[] nor the vendor SDK probe list (GPL_AX72v1, rtk_switch.c: 0x0276/0x0597/0x6367 → RTL8367C, 0x0652/0x6368 → RTL8370B, 0x0801/0x6511 → RTL8363SC/8364B). The magic-register unlock before reading 0x1300 is done identically by mainline and by the vendor driver, so the read path matches.

Adding a chip_infos entry (0x3321/0x0008, extints copied from RTL8367S) makes it probe:

rtl8365mb-mdio 90000.mdio-1:1d: found an RTL8367S-EX710 switch
rtl8365mb-mdio 90000.mdio-1:1d: unsupported SerDes tuning variant (chip option 0), disabling SerDes interface modes
rtl8365mb-mdio 90000.mdio-1:1d: phylink: error: empty supported_interfaces
rtl8365mb-mdio 90000.mdio-1:1d: error -EINVAL: unable to register switch

Data point for the option-0 TODO: removing the option == 0 bail-out in rtl8365mb_sds_probe_option() and setting sds_supported = true anyway brings the trunk up with the same tuning values:

rtl8365mb-mdio 90000.mdio-1:1d: configuring for fixed/2500base-x link mode
rtl8365mb-mdio 90000.mdio-1:1d: Link is Up - 2.5Gbps/Full - flow control off
rtl8365mb-mdio 90000.mdio-1:1d wan  (uninitialized): PHY [90000.mdio-1:1d:user_mii:00] driver [Generic PHY]
rtl8365mb-mdio 90000.mdio-1:1d lan1 (uninitialized): PHY [90000.mdio-1:1d:user_mii:01] driver [Generic PHY]
... lan2/lan3/lan4 likewise

After that, every table operation fails:

rtl8365mb-mdio 90000.mdio-1:1d: fdb_add ERROR -ENOSPC
ip: SIOCSIFFLAGS: No space left on device

(rtl8365mb_l2_add_uc()rtl8365mb_table_query() returns -ENOENT, mapped to -ENOSPC)

rtl8365mb-mdio 90000.mdio-1:1d: mdb_add ERROR -ENOSPC
rtl8365mb-mdio 90000.mdio-1:1d: port 1 failed to add 33:33:00:00:00:01 vid 0 to mdb: -28
rtl8365mb-mdio 90000.mdio-1:1d: VLAN should already exist in VLAN MC
rtl8365mb-mdio 90000.mdio-1:1d lan1: failed to initialize vlan filtering on this port

Stubbing out the FDB/MDB ops and making the VLAN ops return 0 lets the ports come up — lan1/wan reach UP,LOWER_UP with a live cable and go to forwarding in a bridge — but no traffic passes (ping fails both ways, rx_packets stays flat), and the user PHYs negotiate at 10 Mbps/Half (/sys/class/net/lan1/speed = 10).

The vendor U-Boot driver (GPL_AX72v1, drivers/net/rtl8367s/) drives this same chip fine — TFTP works from U-Boot. The stock Linux boot log prints [RTL8367S INFO] and uses PHYs 0–4.

Does id=0x3321, ver=0x0008 look familiar, or is there a known access-mode difference that would explain both the odd ID and the table engine returning -ENOENT?


2. Both radios: only part of the antenna chains seems live

5 GHz (PCIe 17cb:1104qcn9074) associates clients and passes traffic, but only from the rear of the unit (the port side). From the front (LED side) there is no connection at all, at any distance.

2.4 GHz (IPQ5018, AHB) comes up clean — no driver errors:

ath11k c000000.wifi: ipq5018 hw1.0
ath11k c000000.wifi: FW memory mode: 1
ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
ath11k c000000.wifi: fw_version 0x270206d0 ... WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
hostapd: phy0-ap0: AP-ENABLED

Beacons are visible (4 bars right next to the router), but no client ever associates, from any side: iw dev phy0-ap0 station dump is empty and the log contains not a single IEEE 802.11: authenticated line. No ath11k crashes or recovery. iw reg get reports country US: DFS-FCC, 30 dBm on 2.4 GHz. Antenna mask is TX 0x3 RX 0x3.

Board data on this unit: 0:ART is blank (all 0xff). The stock firmware keeps BDFs in its rootfs (/etc/board_data_files/2g/bdwlan.b2g, 5g/bdwlan.b5g) and per-device caldata in a UBIFS volume (misc_ro, two 131072-byte blobs). Using the stock bdwlan.b2g as board.bin raised the 2.4 GHz signal noticeably but changed nothing about the missing RX. Both caldata blobs have been tried on the 2.4 GHz radio — no difference. The stock DT has qcom,board_id = <0x24> for wifi@c000000; the driver reads board_id 0xff.

Antennas are connected exactly as they came from the factory. Given that 5 GHz only covers the rear half of the unit and 2.4 GHz transmits but never receives, is there a known BDF or antenna-mapping pitfall on AP-MP03.1 boards?

Attaching links:

Stock FDT

https://drive.google.com/file/d/1a9LLPgs0IeBMe6b6Cpc9mm8W5O2P9fBy/view?usp=drive_link

decompiled DTS

https://drive.google.com/file/d/1ahl4tu9Lw_6PM8Vy_cJ5-IODQGRd7Kn_/view?usp=drive_link

my current DTS

https://drive.google.com/file/d/18P1Ax_iomlAlvxNexESMt4tRWoxoenin/view?usp=sharing

owrt boot log

https://drive.google.com/file/d/12g4voPp0_DYfmr6oBZYI2THDljEGyGk3/view?usp=sharing

stock boot log

https://drive.google.com/file/d/1oyaqGC-Hrf9kwJlZGjOHOV23czJFezrd/view?usp=sharing

P.s. Sorry for the late reply, I was away.

There are some other threads mentioning this name, if you search the forum.

Update on the EX710 port. Two things: a working solution that may help others on IPQ5018, and an open question on the switch.

1. Both radios now work — the QCN6122 firmware was the trap

Earlier in this thread I was chasing the 5 GHz radio as an AHB-attached QCN6122. That was wrong: the 5 GHz part is a QCN9074-class device on PCIe (17cb:1104), and there is no second AHB radio on this board. @georgem83 — your earlier suggestions were against that mistaken configuration, so please disregard that part.

What finally worked was following the Xiaomi AX6000 DTS (same AP-MP03.1 board, same IPQ5018 + QCN9074 topology):

  • drop ipq5018-qcn6122.dtsi from the includes; no multipd, no &wifi1
  • add the &q6v5_wcss override with an explicit firmware-name list (q6_fw.mdt, m3_fw.mdt)
  • in &wifi: qcom,rproc = <&q6v5_wcss>, no qcom,bdf-addr, use qcom,ath11k-calibration-variant
  • use upstream ath11k-firmware-ipq5018, not the combined -qcn6122 package

The part worth flagging for anyone else: the combined ath11k-firmware-ipq5018-qcn6122 package silently kills 2.4 GHz on boards that have no second AHB radio. The symptom is misleading — beacons transmit fine, full signal, no driver complaints, but no client frame is ever received and station dump stays empty. It looks exactly like a calibration or antenna problem, and I lost days on BDF and caldata because of it. Switching to the upstream firmware fixed it immediately, with no board-data changes at all.

I had also previously concluded that secure-PIL was incompatible (QMI failing with -107/-110). That was wrong too: the cause was simply that I never overrode &q6v5_wcss with firmware-name.

2. RTL8367S: unknown revision, table engine behaves differently

The switch topology matches Archer AX55 v1 exactly (gmac1 → uniphy0 → 2.5G HSGMII → RTL8367S, gmac0 not bonded out), and I based my DTS on @kuncy7's port. MDIO address 29 on mdio1, reset on GPIO 33.

What I found:

  • the chip reports chip_id 0x3321, chip_ver 0x0008 — not in mainline rtl8365mb and not in the vendor driver either. The read is correct: mainline's rtl8365mb_get_chip_id_and_ver() performs the same unlock sequence the vendor driver does.
  • rtl8365mb_sds_probe_option() returns option 0, which mainline treats as unsupported and stubs out. Enabling it with the same tuning parameters used for option != 0 works. The trunk comes up at 2.5Gbps/Full. This may be useful upstream — the stub exists only because the case was never observed.
  • the internal PHYs read fine: phy_id 0x000e64a1 on all five ports via the child SMI-mdio bus.
  • everything that goes through rtl8365mb_table_query() fails: FDB, MDB and VLAN operations all return -ENOENT internally and surface as -ENOSPC.
  • with those ops stubbed out, ports come up but only at 10Mbps/Half, and no traffic passes. Frames leave the CPU port correctly (tx counter increments), nothing ever comes back.

So the switch answers on MDIO, identifies itself, brings up the SerDes trunk and creates all five ports — but the table engine doesn't respond the way the driver expects.

My question: has anyone seen this revision, and does 0x3321/0x0008 correspond to a different jam table or initialization order? I've been working around individual symptoms one at a time, and each workaround just exposes the next one, which suggests the register access differs more fundamentally than any single table.

Happy to provide full boot logs, the stock DTB, or test patches on real hardware.

@frollic — you suggested searching the forum, as other threads mention this name. I did go through them; unfortunately nothing there applies. The threads referring to "RTL8367S" all describe the standard chip that reports chip_id 0x6367, which mainline already handles. None of them mention a variant reporting 0x3321, and none touch the table-engine behaviour I'm hitting. So the search didn't turn up anything usable — hence this more detailed writeup.

No worries, just saying more than one device appear to be using the same board.