OpenWrt support for Linksys MX4200

There's a v1 and V2 of the mx4200, anyone know what the difference is?

Nothing majorly different seems to have exact same specs, knowing Linksys it's probably because they changed the supplier for some parts

Looking at the kernel source and logs we have IPQ8174 is a rebranded IPQ807X, uses same DTSI files

@supersebbo could you by any chance try to boot Xiaomi AX3600 initramfs through UART and see if it boots, id do it but i dont have a uart to usb dongle

Hi, I have both a V1 and V2 MX4200 and a USB to UART dongle.

Also is there is guide / info of how to boot though UART? I assume 3.3v is used on this board? Thanks

You just plug it in through uart and the use putty to connect and get shell access command is tftpboot 50000000 IP:LOCATION_xiaomi_ax3600-initramfs-fit-uImage.itb; bootm

1 Like

Ok, thanks for the info - I should be able to give it a try this weekend

Have you had Any luck so far

Not yet I'm afraid, I did order the JST cable to connect to the 6 pin PCB connector, but it turns out I ordered the wrong cable. I've now ordered what I believe to be the correct cable which will hopefully arrive this week. Once it's arrived, I should be give the AX3600 firmware a try.

Ah ok, well let's hope it's correct

How far we got now

Have you had Any luck so far

Hi, apologies for the delay with this! I've finally managed to get it to boot after resolving a few issues. It boots OK through using this file: openwrt-ipq807x-generic-xiaomi_ax3600-initramfs-uImage.itb
which I got from here:
https://firmware-selector.openwrt.org/?version=SNAPSHOT&target=ipq807x%2Fgeneric&id=xiaomi_ax3600

When booting, some of the serial data gets cut off at the start, dmesg shows a little more, here's the output:

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.1.33 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23375-cdfcac6e24) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Wed Jun 14 21:27:29 2023
[    0.000000] Machine model: Xiaomi AX3600
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004a4fffff]
[    0.000000]   node   0: [mem 0x000000004a500000-0x000000004a5fffff]
[    0.000000]   node   0: [mem 0x000000004a600000-0x000000004e8fffff]
[    0.000000]   node   0: [mem 0x000000004e900000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 17 pages/cpu s31592 r8192 d29848 u69632
[    0.000000] pcpu-alloc: s31592 r8192 d29848 u69632 alloc=17*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_0
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 407536K/524288K available (8128K kernel code, 872K rwdata, 2276K rodata, 8576K init, 291K bss, 116752K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] .Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000000] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000108] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000122] pid_max: default: 32768 minimum: 301
[    0.000602] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000615] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.002462] cblist_init_generic: Setting adjustable number of callback queues.
[    0.002475] cblist_init_generic: Setting shift to 2 and lim to 1.
[    0.002669] rcu: Hierarchical SRCU implementation.
[    0.002673] rcu: .Max phase no-delay instances is 1000.
[    0.003428] smp: Bringing up secondary CPUs ...
[    0.004073] Detected VIPT I-cache on CPU1
[    0.004206] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.004862] Detected VIPT I-cache on CPU2
[    0.004957] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.005569] Detected VIPT I-cache on CPU3
[    0.005662] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.005729] smp: Brought up 1 node, 4 CPUs
[    0.005737] SMP: Total of 4 processors activated.
[    0.005742] CPU features: detected: 32-bit EL0 Support
[    0.005746] CPU features: detected: CRC32 instructions
[    0.005809] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.005815] CPU: All CPU(s) started at EL1
[    0.005818] alternatives: applying system-wide alternatives
[    0.016048] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.016075] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.016290] pinctrl core: initialized pinctrl subsystem
[    0.017720] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.018244] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.018285] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.018320] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.018707] thermal_sys: Registered thermal governor 'step_wise'
[    0.018894] cpuidle: using governor menu
[    0.019146] ASID allocator initialised with 65536 entries
[    0.072066] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.080643] SCSI subsystem initialized
[    0.080849] usbcore: registered new interface driver usbfs
[    0.080913] usbcore: registered new interface driver hub
[    0.080960] usbcore: registered new device driver usb
[    0.081363] qcom_scm: convention: smc arm 64
[    0.082805] clocksource: Switched to clocksource arch_sys_counter
[    0.083955] NET: Registered PF_INET protocol family
[    0.084085] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.085076] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.085096] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.085109] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.085158] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.085301] TCP: Hash tables configured (established 4096 bind 4096)
[    0.085385] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.085410] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.085609] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.085645] PCI: CLS 0 bytes, default 64
[    0.086812] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.091887] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.091902] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.093072] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.098221] qcom-pcie 20000000.pci: host bridge /soc/pci@20000000 ranges:
[    0.098275] qcom-pcie 20000000.pci:       IO 0x0020200000..0x002020ffff -> 0x0000000000
[    0.098300] qcom-pcie 20000000.pci:      MEM 0x0020220000..0x002fffffff -> 0x0020220000
[    0.214445] qcom-pcie 20000000.pci: iATU unroll: enabled
[    0.214462] qcom-pcie 20000000.pci: iATU regions: 8 ob, 8 ib, align 4K, limit 1024G
[    1.212891] qcom-pcie 20000000.pci: Phy link never came up
[    1.213084] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[    1.213095] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.213106] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.213129] pci_bus 0000:00: root bus resource [mem 0x20220000-0x2fffffff]
[    1.213170] pci 0000:00:00.0: [17cb:1002] type 01 class 0x060400
[    1.213192] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    1.213275] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.216589] pci 0000:00:00.0: BAR 8: assigned [mem 0x20300000-0x204fffff]
[    1.216610] pci 0000:00:00.0: BAR 9: assigned [mem 0x20500000-0x206fffff 64bit pref]
[    1.216621] pci 0000:00:00.0: BAR 0: assigned [mem 0x20220000-0x20220fff]
[    1.216634] pci 0000:00:00.0: BAR 7: assigned [io  0x1000-0x1fff]
[    1.216646] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.216655] pci 0000:00:00.0:   bridge window [io  0x1000-0x1fff]
[    1.216665] pci 0000:00:00.0:   bridge window [mem 0x20300000-0x204fffff]
[    1.216675] pci 0000:00:00.0:   bridge window [mem 0x20500000-0x206fffff 64bit pref]
[    1.218853] pcieport 0000:00:00.0: PME: Signaling with IRQ 16
[    1.219133] pcieport 0000:00:00.0: AER: enabled with IRQ 16
[    1.222568] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[    1.222583] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[    1.226952] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.229025] msm_serial 78b3000.serial: msm_serial: detected port #0
[    1.229064] msm_serial 78b3000.serial: uartclk = 3686400
[    1.229160] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 21, base_baud = 230400) is a MSM
[    1.229190] msm_serial: console setup on port #0
[    2.002796] printk: console [ttyMSM0] enabled
[    2.007920] msm_serial: driver initialized
[    2.016777] loop: module loaded
[    2.016857] Loading iSCSI transport class v2.0-870.
[    2.020606] nand: device found, Manufacturer ID: 0xad, Chip ID: 0xac
[    2.023648] nand: Hynix H27S4G8F2EDA-BC
[    2.030205] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    2.043278] 13 fixed-partitions partitions found on MTD device qcom_nand.0
[    2.043337] Creating 13 MTD partitions on "qcom_nand.0":
[    2.049058] 0x000000000000-0x000000100000 : "0:sbl1"
[    2.056116] 0x000000100000-0x000000200000 : "0:mibib"
[    2.060873] 0x000000200000-0x000000500000 : "0:qsee"
[    2.067814] 0x000000500000-0x000000580000 : "0:devcfg"
[    2.070425] 0x000000580000-0x000000600000 : "0:rpm"
[    2.075441] 0x000000600000-0x000000680000 : "0:cdt"
[    2.080131] 0x000000680000-0x000000700000 : "0:appsblenv"
[    2.085014] 0x000000700000-0x000000800000 : "0:appsbl"
[    2.091011] 0x000000800000-0x000000880000 : "0:art"
[    2.095692] 0x000000880000-0x000000900000 : "bdata"
[    2.100368] 0x000000900000-0x000000a00000 : "pstore"
[    2.105754] 0x000000a00000-0x000002dc0000 : "ubi_kernel"
[    2.143482] 0x000002dc0000-0x000010000000 : "rootfs"
[    2.343912] mtd: setting mtd12 (rootfs) as root device
[    2.344285] mtdsplit: no squashfs found in "rootfs"
[    2.352316] pcieport 0000:00:00.0: Failed to create device link (0x180) with 79b0000.nand-controller
[    2.353701] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    2.418529] i2c_dev: i2c /dev entries driver
[    2.424604] sdhci: Secure Digital Host Controller Interface driver
[    2.424648] sdhci: Copyright(c) Pierre Ossman
[    2.429683] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.435939] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    2.442391] NET: Registered PF_INET6 protocol family
[    2.446560] Segment Routing with IPv6
[    2.450726] In-situ OAM (IOAM) with IPv6
[    2.454364] NET: Registered PF_PACKET protocol family
[    2.458278] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.463328] 8021q: 802.1Q VLAN Support v1.8
[    2.498316] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    2.498651] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    2.504470] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    2.511040] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    2.518713] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    2.526223] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    2.535355] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    2.542294] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 816000 uV
[    2.552285] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 872000 uV
[    2.562101] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 968000 uV
[    2.571958] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 686, quot_offset[ 7]=   0
[    2.581720] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 889, quot_offset[ 7]= 200
[    2.592564] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]= 980, quot_offset[ 7]=  90
[    2.603503] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1144, quot_offset[ 7]= 160
[    2.614628] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    2.616163] cpu cpu0: SoC ID 399 is not part of IPQ8074 family, limiting to 1.4GHz!
[    2.633223] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 19200 KHz, changing to: 1017600 KHz
[ ¯[    2.654377] Freeing unused kernel memory: 8576K
[    2.722717] Run /init as init process
[    2.925255] init: Console is alive
[    2.925450] init: - watchdog -
[    2.935122] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.961904] ssdk_switch_device_num_init[1335]:INFO:ess-switch dts node number: 1
[    2.962037] ssdk_dt_get_switch_node[1124]:INFO:ess-switch DT exist!
[    2.968439] ssdk_dt_parse_access_mode[999]:INFO:switch_access_mode: local bus
[    2.974391] ssdk_dt_parse_access_mode[1012]:INFO:switchreg_base_addr: 0x3a000000
[    2.981659] ssdk_dt_parse_access_mode[1013]:INFO:switchreg_size: 0x1000000
[    2.989132] ssdk_dt_parse_mac_mode[327]:INFO:mac mode = 0x0
[    2.995812] ssdk_dt_parse_mac_mode[336]:INFO:mac mode1 = 0xff
[    3.001274] ssdk_dt_parse_mac_mode[345]:INFO:mac mode2 = 0xff
[    3.007269] ssdk_dt_parse_uniphy[364]:INFO:ess-uniphy DT exist!
[    3.013778] ssdk_plat_init[1692]:INFO:ssdk_plat_init start
[    3.134604] ssdk_gcc_clock_init[1275]:INFO:SSDK gcc clock init successfully!
[    3.135889] malibu_phy_api_ops_init[2846]:INFO:qca probe malibu phy driver succeeded!
[    3.140883] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    3.155073] regi_init[3953]:INFO:Initializing HPPE!!
[    3.392684] ssdk_ppe_reset_init[1535]:INFO:ppe reset successfully!
[    3.396187] qca_hppe_portctrl_hw_init[126]:INFO:Hawkeye PPE port initializing
[    3.397807] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    3.405104] hsl_phy_phydev_get[773]:ERROR:phy_addr 0 phydev is NULL
[    3.638808] adpt_hppe_port_mux_mac_type_set[2787]:WARN:port 6 need not to configure mux and mac type
[    3.638870] ssdk_switch_register[2017]:INFO:Chip version 0x1500
[    3.647012] qca_link_polling_select[1487]:INFO:link-polling-required node does not exist
[    3.652643] ssdk_switch_register[2043]:INFO:polling is selected
[    3.660986] regi_init[3957]:INFO:Initializing HPPE Done!!
[    3.666699] ssdk_genl_init[211]:INFO:ssdk genl family register success.
[    3.672177] regi_init[4020]:INFO:qca-ssdk module init succeeded!
[    3.680962] EDMA ver 1 hw init
[    3.685080] EDMA HW Reset completed succesfully
[    3.687738] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    3.692132] RxDesc:1 (15-15) RxFill:1 (7-7)
[    3.697727] GMAC2(ffffff8003813940) Invalid MAC@ - using e6:24:58:36:4a:4d
[    3.701905] Generic PHY 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    3.709129] nss-dp 3a001200.dp2 wan: Registered netdev wan(qcom-id:2)
[    3.718372] GMAC3(ffffff8003817940) Invalid MAC@ - using ee:4a:27:b2:e7:56
[    3.724700] Generic PHY 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    3.731935] nss-dp 3a001400.dp3 lan1: Registered netdev lan1(qcom-id:3)
[    3.741198] GMAC4(ffffff8003519940) Invalid MAC@ - using 96:c1:2a:65:13:7f
[    3.747513] Generic PHY 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    3.754971] nss-dp 3a001600.dp4 lan2: Registered netdev lan2(qcom-id:4)
[    3.764204] GMAC5(ffffff8004e6b940) Invalid MAC@ - using de:9b:34:14:f6:b2
[    3.770512] Generic PHY 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=POLL)
[    3.777995] nss-dp 3a001800.dp5 lan3: Registered netdev lan3(qcom-id:5)
[    3.787145] **********************************************************
[    3.793363] * NSS Data Plane driver
[    3.799941] **********************************************************
[    3.812050] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.814183] init: - preinit -
[    9.892677] random: crng init done
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   12.084906] procd: - early -
[   12.085039] procd: - watchdog -
[   12.616485] procd: - watchdog -
[   12.616725] procd: - ubus -
[   12.769068] procd: - init -
Please press Enter to activate this console.
[   12.902805] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.931347] urngd: v1.0.2 started.
[   12.941879] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[   12.941919] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[   12.953284] NET: Registered PF_QIPCRTR protocol family
[   12.984722] PPP generic driver version 2.4.2
[   12.985500] NET: Registered PF_PPPOX protocol family
[   12.994730] ath11k c000000.wifi: ipq8074 hw2.0
[   12.994766] ath11k c000000.wifi: FW memory mode: 1
[   12.998313] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[   13.003027] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[   13.356255] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[   13.360347] kmodloader: done loading kernel modules from /etc/modules.d/*
[   13.400237] ath11k c000000.wifi: qmi ignore invalid mem req type 3
[   13.407668] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[   13.407705] ath11k c000000.wifi: fw_version 0x290c84a5 fw_build_timestamp 2023-03-25 07:34 fw_build_id WLAN.HK.2.9.0.1-01385-QCAHKSWPL_SILICONZ-1
[   13.496752] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Xiaomi-AX3600 from ath11k/IPQ8074/hw2.0/board-2.bin
[   13.496814] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ8074/hw2.0/board-2.bin
[   13.510313] ath11k c000000.wifi: failed to fetch board.bin from IPQ8074/hw2.0
[   13.522951] ath11k c000000.wifi: qmi failed to fetch board file: -12
[   13.529962] ath11k c000000.wifi: failed to load board data file: -12
[   19.793794] br-lan: port 1(lan1) entered blocking state
[   19.793836] br-lan: port 1(lan1) entered disabled state
[   19.798056] device lan1 entered promiscuous mode
[   19.812571] br-lan: port 2(lan2) entered blocking state
[   19.812616] br-lan: port 2(lan2) entered disabled state
[   19.816918] device lan2 entered promiscuous mode
[   19.824506] nss-dp 3a001800.dp5 lan3: PHY Link up speed: 1000
[   19.827292] br-lan: port 3(lan3) entered blocking state
[   19.832327] br-lan: port 3(lan3) entered disabled state
[   19.837682] device lan3 entered promiscuous mode
[   20.792718] br-lan: port 3(lan3) entered blocking state
[   20.792766] br-lan: port 3(lan3) entered forwarding state
[   20.797019] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   33.112721] l11: disabling




BusyBox v1.36.1 (2023-06-14 21:27:29 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r23375-cdfcac6e24
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00300000 00020000 "0:qsee"
mtd3: 00080000 00020000 "0:devcfg"
mtd4: 00080000 00020000 "0:rpm"
mtd5: 00080000 00020000 "0:cdt"
mtd6: 00080000 00020000 "0:appsblenv"
mtd7: 00100000 00020000 "0:appsbl"
mtd8: 00080000 00020000 "0:art"
mtd9: 00080000 00020000 "bdata"
mtd10: 00100000 00020000 "pstore"
mtd11: 023c0000 00020000 "ubi_kernel"
mtd12: 0d240000 00020000 "rootfs"

root@OpenWrt:~# uname -a
Linux OpenWrt 6.1.33 #0 SMP Wed Jun 14 21:27:29 2023 aarch64 GNU/Linux

Hopefully this helps - let me know if you need me to try anything once it's booted.

No worries about the delay, but that's some amazing news

@Ansuel where do we go from here

Also may I know what voltage you used

Sure, I used 3.3v, along with a CP2102 USB adapter set to 115200, 8N1

I was able to use a scope to test, the TX pin on my V1 unit was around 3.4v peak to peak with nothing else connected to it.

I do have the DTS file from stock firmware, maybe we could build a initramfs using that and see if more stuff can be enabled and working

Anything I can help with regarding this? Would be keen getting OpenWrt on these bad boys.

Need to get all the DTS and add all kernel patches and then build and test,

Currently I have the DTS available

Just to fully understand the requirements here
Chipset is the same as ax3600 so initial testing of ax3600 initramfs has yielded a successful bootloader.
Other than mapping the differences betweek the mx4200 and ax3600, take the 3600 source and see what bits can be built and applied (lots of trial and error).
Have 2 of these to play with - 1 running (isp locked) firmware as an ap in use and 1 to play with openwrt