Made some progress trying to understand how everything works but still learning, so my assumptions could be incorrect.
This device does not use NAND, but MMC, therefore no MTD was available.
mmcinfo will list the current MMC device, such as
Device: qca_mmc
Manufacturer ID: 15
OEM: 100
Name: 4FPD3
Tran Speed: 25000000
Rd Block Len: 512
MMC version 4.0
High Capacity: Yes
Capacity: 3.6 GiB
Bus Width: 8-bit
And to list partitions you can execute mmc part and will print the following:
Partition Map for MMC device 0 -- Partition Type: EFI
Part Name Start LBA End LBA
1 0:SBL1 0x00000022 0x00000421
2 0:BOOTCONFIG 0x00000422 0x00000821
3 0:QSEE 0x00000822 0x00000C21
4 0:QSEE_1 0x00000C22 0x00001021
5 0:CDT 0x00001022 0x00001221
6 0:CDT_1 0x00001222 0x00001421
7 0:BOOTCONFIG1 0x00001422 0x00001621
8 0:APPSBL 0x00001622 0x00001E21
9 0:APPSBL_1 0x00001E22 0x00002621
10 0:ART 0x00002622 0x00002821
11 u_env 0x00002822 0x00003021
12 s_env 0x00003022 0x00003821
13 devinfo 0x00003822 0x00004021
14 kernel 0x00004022 0x00048021
15 rootfs 0x00008022 0x00048021
16 alt_kernel 0x00048022 0x0008C021
17 alt_rootfs 0x0004C022 0x0008C021
18 sysdiag 0x0008C022 0x0008C421
19 syscfg 0x0008C422 0x00747FDE
I have not been able to find a Device Tree Blob, but the first thing U-Boot does is to load at address 0x84000000 the content of the selected kernel, for instance the primary is located at 0x4022 for a size of 0x4000.
Command used could be mmc read 84000000 4022 4000.
This is in fact a FIT image that contains a config@1 structure with the kernel@1 and fdt@1.
This version of U-Boot comes with a couple of handy commands: imxtract and fdt.
With imxtract we can load part of the Device Tree to a memory address.
For instance, if I want to extract the fdt@1 from address 0x84000000 into address 0x84005000, I could run imxtract 84000000 fdt@1 84005000.
With the FDT in memory, we can load it and browse it.
fdt addr 84005000 and fdt print.
Now I will try to partially create the Device Tree, pull IPQ wifi firmware from Linksys EA8300, diff and complete the kernel config file from the GPL released code from Linksys with OpenWRT's default for IPq40xx, and build an image.