An initramfs image is a good approach -- at least you're not writing to flash and can hopefully read from it.
I don't know how close the QCA9557 is to the QCA9556 or QCA9558. Getting the GPL drop for the device would be very helpful. It looks like Mojo Networks, or is it Airtight Networks, or it it Aruba, ... might be something of a challenge, but you might have some luck there. That is perhaps the easiest way to figure out how the device is wired up.
Hmm, don't know why I didn't get results before for supported devices with a QCA9557, but there are a bunch!
https://openwrt.org/toh/meraki/mr18 is on the WikiDevi list, although listed as a QCA9558 on OpenWrt. That might provide some clues as well. I'd look at its DTS and others similar to craft as "safe" a one as you can.
flash_size passed from bootloader = 16
arg 1: console=ttyS0,115200
arg 2: root=31:03
arg 3: rootfstype=jffs2
arg 4: init=/sbin/init
arg 5: mtdparts=ath-nor0:256k(u-boot),128k(uboot-env),2048k(kernel),13888k(rootfs),64k(ART);ath-nor1:16M(opt)
arg 6: mem=128M
CPU revision is: 00019750 (MIPS 74Kc)
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 08000000 @ 00000000 (usable)
So there's likely the partitioning of the 16 MB flash, and probably 128 MB of RAM.
The kernel command line (intentionally letting it wrap here)
Kernel command line: console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),128k(uboot-env),2048k(kernel),13888k(rootfs),64k(ART);ath-nor1:16M(opt) mem=128M
Memory: 112356k/131072k available (2199k kernel code, 18544k reserved, 586k data, 164k init, 0k highmem)
help confirm 128 MB of RAM.
The MTD partitioning indicates that there are two, 16 MB flash chips (physical or perhaps just logical) attached
Creating 5 MTD partitions on "ath-nor0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000060000 : "uboot-env"
0x000000060000-0x000000260000 : "kernel"
0x000000260000-0x000000ff0000 : "rootfs"
0x000000ff0000-0x000001000000 : "ART"
1 cmdlinepart partitions found on MTD device ath-nor1
Creating 1 MTD partitions on "ath-nor1":
0x000001000000-0x000002000000 : "opt"
which might help narrow down "similar" devices that already run OpenWrt.
qca955x_GMAC lines look related to the Ethernet
ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2.2.83 (Atheros/multi-bss)
is probably the wireless portion on the "ahb" bus that QCA uses.
Here's some useful addresses and information related to the wireless chips
SC Callback Registration for wifi0
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2.2.83 (Atheros/multi-bss)
PCI device id is 003c :003c
ath_pci 0000:00:00.0: ath DEBUG: sc=0x86afcc00
Much of what follows looks like QCA-proprietary drivers and code bringing up the wireless and some tunnels.
The "crash trace" lets you see what kernel modules are in use
WARNING: at kernel/softirq.c:148 local_bh_enable+0x90/0xec()
Modules linked in:
ifb act_police act_mirred sch_htb sch_tbf sch_ingress cls_u32 ip6_gre ip6_tunnel tunnel6 iptable_WCMASK xt_CONNMARK xt_connmark iptable_PKT_MANGLE(P) nf_nat_pptp nf_nat_proto_gre nf_conntrack_pptp nf_conntrack_proto_gre iptable_CONTANALYTICS(P) ip_gre xt_physdev xt_mark ipt_MASQUERADE ipt_REDIRECT iptable_nat nf_nat_ftp nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT iptable_mangle iptable_filter ip_tables xt_conntrack xt_state nf_conntrack_ftp nf_conntrack nfnetlink_queue xt_tcpudp xt_multiport xt_mac xt_NFQUEUE xt_MARK x_tables nfnetlink reset_sensor(P) ath_pktlog(P) umac ath_dev(P) ath_dfs(P) ath_rate_atheros(P) ath_hal(P) asf(P) adf(P) broadcast_multicast_opt(P) led_driver(P) ipv6 athrs_gmac
Going back to the top
DRAM: 128 MB
cpu_pll_cfg: 0x21480 cpu_pll_dither: 0x3c103f
CFG_PLL_FREQ: 0x2 CFG_HZ: 360000000
CPU Clock: 720MHz DDR Clock: 680MHz
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
flash-2 size 16MB, sector count = 256
Flash: 16 *2 MB
so that I should have caught earlier, but confirms the flash and RAM. Getting to the second flash chip "should be as easy as" adding a second CS and defining the partitions in the DTS. Hopefully they used the "standard" CS line, whatever pin it might be on.
Getting into U-Boot and finding out what options you have there would probably be a good idea, along with trying to guess that password.
I'm still puzzled by
## Booting image at 9f060000 ...
Image Name: Linux Kernel Image
Created: 2019-04-17 7:00:31 UTC
but that gives you some ammo on getting the GPL source, as it was clearly within the last year