OpenWrt support for Linksys MX6200

For Developers
21

That's right, both LAN and WAN ports are working. Boot logs:

IPQ5018# bootm 0x44000000
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.31
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e8
     Data Size:    15494156 Bytes = 14.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   b4b2b49d
     Hash algo:    sha1
     Hash value:   de30c95d5e334fa4d742f58ff39c4c97ce2e5b69
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_mx6200 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44ec6e34
     Data Size:    26381 Bytes = 25.8 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   fc7de39e
     Hash algo:    sha1
     Hash value:   b78e53d0ab65506cdbb121fe070e130f8f31bc49
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44ec6e34
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f6000, end 4a3ff70c ... OK
Using machid 0x8040004 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.31 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r29883+4-d989d9a8ec4c) 14.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Tue Jun  3 09:26:38 2025
[    0.000000] Machine model: Linksys MX6200
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[    0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x000000004dffffff (49152 KiB) nomap non-reusable q6_mem_regions@4b000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004a9fffff]
[    0.000000]   node   0: [mem 0x000000004aa00000-0x000000004aafffff]
[    0.000000]   node   0: [mem 0x000000004ab00000-0x000000004adfffff]
[    0.000000]   node   0: [mem 0x000000004ae00000-0x000000004affffff]
[    0.000000]   node   0: [mem 0x000000004b000000-0x000000004dffffff]
[    0.000000]   node   0: [mem 0x000000004e000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43288 r8192 d30440 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_0 coherent_pool=2M
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000005f540000-0x000000005f5c0000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[    0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000118] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000138] pid_max: default: 32768 minimum: 301
[    0.005118] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005141] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.050250] rcu: Hierarchical SRCU implementation.
[    0.050263] rcu:     Max phase no-delay instances is 1000.
[    0.050855] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.060257] smp: Bringing up secondary CPUs ...
[    0.070532] Detected VIPT I-cache on CPU1
[    0.070675] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.070885] smp: Brought up 1 node, 2 CPUs
[    0.070906] SMP: Total of 2 processors activated.
[    0.070911] CPU: All CPU(s) started at EL1
[    0.070917] CPU features: detected: 32-bit EL0 Support
[    0.070923] CPU features: detected: CRC32 instructions
[    0.071013] alternatives: applying system-wide alternatives
[    0.071269] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.071543] Memory: 427884K/524288K available (8640K kernel code, 892K rwdata, 2748K rodata, 12672K init, 287K bss, 94560K reserved, 0K cma-reserved)
[    0.078134] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.078169] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.078293] 26400 pages in range for non-PLT usage
[    0.078301] 517920 pages in range for PLT usage
[    0.080557] pinctrl core: initialized pinctrl subsystem
[    0.083413] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.084445] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[    0.084801] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.085116] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.085660] thermal_sys: Registered thermal governor 'step_wise'
[    0.085841] cpuidle: using governor menu
[    0.086173] ASID allocator initialised with 65536 entries
[    0.091343] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[    0.132084] SCSI subsystem initialized
[    0.132437] usbcore: registered new interface driver usbfs
[    0.132520] usbcore: registered new interface driver hub
[    0.132609] usbcore: registered new device driver usb
[    0.132946] qcom_scm: convention: smc arm 64
[    0.135801] clocksource: Switched to clocksource arch_sys_counter
[    0.139879] NET: Registered PF_INET protocol family
[    0.140145] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.142531] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.142565] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.142593] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.142647] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.142837] TCP: Hash tables configured (established 4096 bind 4096)
[    0.143450] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
[    0.143690] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.143726] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.144302] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.144368] PCI: CLS 0 bytes, default 64
[    0.147895] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.148595] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.148614] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.405550] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.407772] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.407989] msm_serial 78af000.serial: uartclk = 1843199
[    0.408710] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
[    0.408846] msm_serial: console setup on port #0
[    0.408925] printk: legacy console [ttyMSM0] enabled
[    1.132447] msm_serial: driver initialized
[    1.152901] loop: module loaded
[    1.159869] spi-nand spi0.0: Macronix SPI NAND was found.
[    1.159948] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.323912] 18 fixed-partitions partitions found on MTD device spi0.0
[    1.323976] Creating 18 MTD partitions on "spi0.0":
[    1.329411] 0x000000000000-0x000000080000 : "0:SBL1"
[    1.336347] 0x000000080000-0x000000100000 : "0:MIBIB"
[    1.341406] 0x000000100000-0x000000200000 : "0:QSEE"
[    1.348160] 0x000000200000-0x000000240000 : "0:DEVCFG"
[    1.350983] 0x000000240000-0x000000280000 : "0:CDT"
[    1.356036] 0x000000280000-0x000000300000 : "0:APPSBLENV"
[    1.361628] 0x000000300000-0x000000440000 : "0:APPSBL"
[    1.368768] 0x000000440000-0x000000540000 : "0:ART"
[    1.372763] 0x000000540000-0x0000005c0000 : "0:TRAINING"
[    1.376684] 0x0000005c0000-0x000000640000 : "u_env"
[    1.382166] 0x000000640000-0x000000680000 : "s_env"
[    1.386219] 0x000000680000-0x0000006c0000 : "devinfo"
[    1.391327] 0x0000006c0000-0x0000058c0000 : "kernel"
[    1.560530] 0x000000ec0000-0x0000058c0000 : "rootfs"
[    1.561797] mtd: setting mtd13 (rootfs) as root device
[    1.565256] mtdsplit: no squashfs found in "rootfs"
[    1.569653] 0x0000058c0000-0x00000aac0000 : "alt_kernel"
[    1.740346] 0x0000060c0000-0x00000aac0000 : "alt_rootfs"
[    1.741629] 0x00000aac0000-0x00000acc0000 : "sysdiag"
[    1.750095] 0x00000acc0000-0x00000f0c0000 : "syscfg"
[    2.065700] i2c_dev: i2c /dev entries driver
[    2.071130] sdhci: Secure Digital Host Controller Interface driver
[    2.071181] sdhci: Copyright(c) Pierre Ossman
[    2.076361] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.084258] remoteproc remoteproc0: releasing cd00000.remoteproc
[    2.158206] NET: Registered PF_INET6 protocol family
[    2.160320] Segment Routing with IPv6
[    2.162313] In-situ OAM (IOAM) with IPv6
[    2.165989] NET: Registered PF_PACKET protocol family
[    2.170182] 8021q: 802.1Q VLAN Support v1.8
[    2.226771] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
[    2.229185] remoteproc remoteproc0: cd00000.remoteproc is available
[    2.236625] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[    2.244302] remoteproc remoteproc1: pd-1 is available
[    2.248215] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[    2.254708] remoteproc remoteproc2: pd-2 is available
[    2.258801] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
[    2.265382] remoteproc remoteproc3: pd-3 is available▒[    2.283043] Freeing unused kernel memory: 12672K
[    2.283304] Run /init as init process
[    2.964151] init: Console is alive
[    2.964592] init: - watchdog -
[    2.989041] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.020674] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.038045] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
[    3.038101] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
[    3.043592] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
[    3.049949] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    4.565837] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
[    4.567058] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 271, phy_id = 0x67c9df10 phytype doesn't match
[    4.899863] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
[    4.900083] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    4.907976] GMAC1(ffffff80047b0940) Invalid MAC@ - using 6e:2d:f4:47:16:5d
[    4.910728] nss-dp 39c00000.dp1 lan (uninitialized): nss_dp_gmac: Registering netdev lan(qcom-id:1) with GMAC, mac_base: 0xffffffc082420000
[    4.986956] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
[    4.989830] GMAC2(ffffff80068a0940) Invalid MAC@ - using c6:03:b2:31:a4:94
[    4.997787] nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc082450000
[    5.006417] Generic PHY 90000.mdio-1:0f: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:0f, irq=POLL)
[    5.019295] **********************************************************
[    5.026811] * NSS Data Plane driver
[    5.033116] **********************************************************
[    5.054756] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.058216] init: - preinit -
[    8.035813] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.446380] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   12.560744] nss-dp 39c00000.dp1 lan: PHY Link is down
[   12.569610] procd: - early -
[   12.569878] procd: - watchdog -
[   13.194860] procd: - watchdog -
[   13.195295] procd: - ubus -
[   13.253855] procd: - init -
Please press Enter to activate this console.
[   13.703963] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.981192] urngd: v1.0.2 started.
[   14.029471] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   14.029523] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   14.107827] NET: Registered PF_QIPCRTR protocol family
[   14.290201] PPP generic driver version 2.4.2
[   14.297840] NET: Registered PF_PPPOX protocol family
[   14.303001] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   14.303051] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   14.366174] ath11k c000000.wifi: ipq5018 hw1.0
[   14.366230] ath11k c000000.wifi: FW memory mode: 2
[   14.486801] remoteproc remoteproc1: powering up pd-1
[   14.487014] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   14.490854] remoteproc remoteproc0: powering up cd00000.remoteproc
[   14.499361] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   14.633816] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   14.652879] remoteproc remoteproc1: remote processor pd-1 is now up
[   14.656565] ath11k b00a040.wifi2: Multipd architecture - userpd: 3
[   14.658678] ath11k b00a040.wifi2: qcn6122 hw1.0
[   14.664249] ath11k b00a040.wifi2: FW memory mode: 2
[   14.678918] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   14.686565] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   14.686650] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   14.731381] remoteproc remoteproc3: powering up pd-3
[   14.731721] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   14.746220] remoteproc remoteproc3: remote processor pd-3 is now up
[   14.776090] batman_adv: B.A.T.M.A.N. advanced 2025.1-openwrt-1 (compatibility version 15) loaded
[   14.784935] kmodloader: done loading kernel modules from /etc/modules.d/*
[   14.842298] ath11k b00a040.wifi2: qmi ignore invalid mem req type 10
[   14.849672] ath11k b00a040.wifi2: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   14.849734] ath11k b00a040.wifi2: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   14.860309] ------------[ cut here ]------------
[   14.870221] WARNING: CPU: 1 PID: 38 at arch/arm64/mm/ioremap.c:28 ioremap_prot+0x68/0xa0
[   14.875002] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet batman_adv(O) ath11k_ahb(O) ath11k(O) wireguard pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211(O) libchacha20poly1305 chacha_neon cfg80211(O) slhc qrtr_smd qrtr_mhi qrtr qmi_helpers(O) poly1305_neon nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mhi mdio_netlink(O) libcurve25519_generic libcrc32c libchacha hwmon crc_ccitt compat(O) ip6_udp_tunnel udp_tunnel sha512_generic sha512_arm64 seqiv sha3_generic jitterentropy_rng drbg michael_mic hmac geniv cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp(O) qca_ssdk(O) gpio_button_hotplug(O) ext4 mbcache jbd2 crc32c_generic
[   14.882171] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   14.942876] CPU: 1 UID: 0 PID: 38 Comm: kworker/u8:2 Tainted: G           O       6.12.31 #0
[   14.942907] Tainted: [O]=OOT_MODULE
[   14.942914] Hardware name: Linksys MX6200 (DT)
[   14.942923] Workqueue: ath11k_qmi_driver_event ath11k_qmi_deinit_service [ath11k]
[   14.943010] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   14.943024] pc : ioremap_prot+0x68/0xa0
[   14.943048] lr : ioremap_prot+0x38/0xa0
[   15.008671] sp : ffffffc08237bb00
[   15.012489] x29: ffffffc08237bb00 x28: ffffff80062d0000 x27: ffffff80062d0168
[   15.015966] x26: 0000000000000000 x25: 00000000464c457f x24: ffffffc0824ed06c
[   15.023085] x23: ffffff800027a010 x22: ffffff80062d0140 x21: ffffffc08237bc20
[   15.030202] x20: 0000000000040000 x19: 000000004e500000 x18: ffffff8003ee3123
[   15.037319] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
[   15.044440] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
[   15.051556] x11: 0000000000000000 x10: ffffffc07a7feaa1 x9 : 0000000000000020
[   15.058674] x8 : 0000000012000000 x7 : 0000000000000018 x6 : ffffffc0818b1af0
[   15.065792] x5 : ffffffc0818b1a60 x4 : 0000000000000007 x3 : 0000000000000007
[   15.072910] x2 : 0000000060000000 x1 : 0000000000000006 x0 : 0000000000000001
[   15.080029] Call trace:
[   15.087141]  ioremap_prot+0x68/0xa0
[   15.089397]  ath11k_qmi_deinit_service+0x458/0x1a80 [ath11k]
[   15.092873]  ath11k_qmi_deinit_service+0x6f0/0x1a80 [ath11k]
[   15.098780]  ath11k_qmi_deinit_service+0x820/0x1a80 [ath11k]
[   15.104419]  ath11k_qmi_deinit_service+0x1090/0x1a80 [ath11k]
[   15.110063]  process_one_work+0x178/0x304
[   15.115700]  worker_thread+0x278/0x440
[   15.119693]  kthread+0xdc/0xe0
[   15.123338]  ret_from_fork+0x10/0x20
[   15.126379] ---[ end trace 0000000000000000 ]---
[   15.130304] ath11k b00a040.wifi2: qmi ioremap error for bdf_addr
[   15.134724] ath11k b00a040.wifi2: qmi failed to load bdf file
[   15.140977] ath11k b00a040.wifi2: failed to load board data file: -5
[   27.294612] br-lan: port 1(lan) entered blocking state
[   27.294675] br-lan: port 1(lan) entered disabled state
[   27.304085] nss-dp 39c00000.dp1 lan: entered allmulticast mode
[   27.307280] nss-dp 39c00000.dp1 lan: entered promiscuous mode
[   31.446448] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   31.446731] br-lan: port 1(lan) entered blocking state
[   31.451220] br-lan: port 1(lan) entered forwarding state

2.4 GHz radio works:

Capture d’écran 2025-06-03 135544
Capture d’écran 2025-06-03 135544943×164 10.1 KB

root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 6E:2D:F4:47:16:5D
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fd88:97f9:56ee::1/60 Scope:Global
          inet6 addr: fe80::6c2d:f4ff:fe47:165d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:681331 errors:0 dropped:18 overruns:0 frame:0
          TX packets:1075220 errors:0 dropped:9 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:74908298 (71.4 MiB)  TX bytes:1580819963 (1.4 GiB)

lan       Link encap:Ethernet  HWaddr 6E:2D:F4:47:16:5D
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:666434 errors:0 dropped:24 overruns:0 frame:0
          TX packets:1059695 errors:0 dropped:4 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:54029336 (51.5 MiB)  TX bytes:1570396133 (1.4 GiB)
          Interrupt:43

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1950 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1950 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:160618 (156.8 KiB)  TX bytes:160618 (156.8 KiB)

phy0-ap0  Link encap:Ethernet  HWaddr 00:03:7F:12:3A:3A
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:29351 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17377 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:34012185 (32.4 MiB)  TX bytes:15173747 (14.4 MiB)

wan       Link encap:Ethernet  HWaddr C6:03:B2:31:A4:94
          inet addr:172.30.167.90  Bcast:172.30.167.255  Mask:255.255.255.0
          inet6 addr: fe80::c403:b2ff:fe31:a494/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1150076 errors:0 dropped:197 overruns:0 frame:0
          TX packets:670751 errors:0 dropped:22 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1620569084 (1.5 GiB)  TX bytes:85658025 (81.6 MiB)
          Interrupt:44
22

ok, that's an improvement. I don't think the mac addresses are right. Can you run strings /dev/mtd11

23

Indeed, the MAC address that is on the label is 80:69:1A:8B:87:67.

root@OpenWrt:~# strings /dev/mtd11
4B]S
 v4&
UU?~
v~#:
=@iCH
IRVINE1
LINKSYS1'0%
General Linksys attestation CA1
Linksys attestation CA0
230626145335Z
430621145335Z0
SecTools1
Irvine1
Linksys1
California1"0
01 0000000000000005 SW_ID1"0
02 001540E177313538 HW_ID1"0
03 0000000000000000 DEBUG1
04 7731 OEM_ID1
05 000000A8 SW_SIZE1
06 3538 MODEL_ID1
07 0001 SHA2560
=);Q
fUf@
>|$O
S0Q0
 Exy
#:%T
x$;Z
0+o:
cDQ=
@"?Q
AQbD
QX}(l
IRVINE1
LINKSYS1
self-sign root CA0
230111225810Z
321010225810Z0
IRVINE1
LINKSYS1'0%
General Linksys attestation CA1
Linksys attestation CA0
H6'Zl$x
\l,i
#g7a
`0^0
 Exy
f$7T
IRVINE1
LINKSYS1
self-sign root CA0
230111225810Z
430106225810Z0Y1
IRVINE1
LINKSYS1
self-sign root CA0
]&vcs
H:x+@Ua
[![Y
OO;2
=$l'bDX
<0:0
E`>[
mthE9
]BN#3
ABT_Propdata_oem
NOCError_Propdata_oem
DalEnv
TargetCfg
disable_xpu_ac
is_kdf_fix_enable
license_data_store_path
disable_security_stream_check
get_IV_constraint
use_legacy_hdmi_hdcp_check
provision_constraint_flag
maximum_hdcp_2x_capability
enable_kcb_logging_flag
external_display_dsi_intf_num
block_content_thru_dsi
kernel_version
kernel_version_str_length
challenges
challenges_array_length
mdtp_system_min_verify_ratio
mdtp_system_path_00
mdtp_system_path_01
mdtp_system_path_02
mdtp_system_path_03
mdtp_system_path_04
mdtp_system_path_05
mdtp_system_path_06
mdtp_system_path_07
mdtp_system_path_08
mdtp_system_path_09
client_00
client_01
client_02
client_03
client_04
client_05
client_06
client_07
fpta_name
gk_timeout_config
fp_sensor_name
fp_sensor_version
enable_finger_id
enable_soter
proprietary_play_enabler_video_protect
proprietary_play_enabler_default_behaviour
IV_constraint
robustness_version
proprietary_play_enabler_profile
proprietary_opl_profile_0
OEM_sec_wdog_bark_time
OEM_sec_wdog_bite_time
OEM_kernel_code_region
OEM_kernel_code_size
OEM_pil_secure_app_load_region_start
OEM_pil_secure_app_load_region_size
OEM_pil_subsys_load_region_start
OEM_pil_subsys_load_region_size
OEM_MRC_activation_list
OEM_MRC_revocation_list
tz_enable_logs
OEM_enable_sdi_in_secboot
hdcp1_storage_type
chamomile_ips
cmnlib_gppo_rpmb_enablement
cmnlib_gppo_root_path
hdcp2p2_storage_type
chamomile_ips_hdcp2p2
"/data/misc/qsee/"
"Linux version 3.14.26-g43b1178-00038-g96ef344 (lnxbuild@abait242-sd-lnx) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Jun 5 15:15:57 PDT 2015"
"/system/build.prop"
"/system/default.prop"
"/system/app"
"/system/bin"
"/system/etc"
"/system/framework"
"/system/lib"
"/system/priv-app"
"/system/vendor"
"/system/xbin"
"fidocrypto"
fingerprint
Stargate
"/data/misc/qsee/"
"/persist/data/"
T=$*x
%Adk
tB~wI
Prqe
OR,S
qD^Z
$0Fi
6<Id
        "Ql
/[P9-
8]f%W
&Dyyf
Nn?5
O[jeQ
X$=?
~Ws     5
_Y)o
~0Zu'<
CN|5
M:&1
9R:r
T'd*
Au((
h}>g
o`?!N
0n<Y
`qNA,
5{J)
Js;*
[ZW-
@('
64V_y
])x]H
50u<X/
jzd_%
]w=G@S
Qy`<
^]{F
Zbsp
8       tu0#
E)/;
h~M>g
\*w*
gEw8e
ped>}
4uHn
>_jJ.!S
tB~wI
Prqe
OR,S
qD^Z
$0Fi
6<Id
        "Ql
/[P9-
8]f%W
&Dyyf
Nn?5
O[jeQ
X$=?
~Ws     5
_Y)o
~0Zu'<
CN|5
M:&1
9R:r
T'd*
Au((
h}>g
o`?!N
0n<Y
`qNA,
5{J)
Js;*
[ZW-
@('
64V_y
])x]H
50u<X/
jzd_%
]w=G@S
Qy`<
^]{F
Zbsp
8       tu0#
E)/;
h~M>g
\*w*
gEw8e
ped>}
4uHn
>_jJ.!S
/dev/ABTimeoutOEM
/dev/NOCErrorOEM
/ac/xpu
/tz/oem/kdf_fix
widevine
dhsecapp
mdtp
chamomile
keymaster
playread
/tz/oem
hdcp1
commonlib
qcom.tz.hdcp2p2
NOC_0
NOC_1
NOC_2
NOC_3
NOC_4
NOC_5
NOC_6
NOC_7
NOC_8
NOC_9
NOC_10
NOC_11
SNOC
OEM_sec_wdog_bark_time
OEM_sec_wdog_bite_time
OEM_kernel_code_region
OEM_kernel_code_size
OEM_pil_secure_app_load_region_start
OEM_pil_secure_app_load_region_size
OEM_pil_subsys_load_region_start
OEM_pil_subsys_load_region_size
OEM_MRC_activation_list
OEM_MRC_revocation_list
tz_enable_logs
OEM_enable_sdi_in_secboot
@ AE
/tz/oem
24

ok, I see. It has a different partition layout than the other MX devices. I'll adjust and create a new image shortly.

25

okay, new image uploaded which should fix the partition layout and mac addresses

26

Perfect! MAC addresses are correct. Boot logs:

IPQ5018# bootm 0x44000000
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.31
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e8
     Data Size:    15494328 Bytes = 14.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   aba646e6
     Hash algo:    sha1
     Hash value:   5a0b9f3f83e2bcc5a3ad42c27b76de08d2a78903
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_mx6200 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44ec6ee0
     Data Size:    26877 Bytes = 26.2 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   e17af001
     Hash algo:    sha1
     Hash value:   6d273fec8a23147faa2380df6380840387b8da5a
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44ec6ee0
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f6000, end 4a3ff8fc ... OK
Using machid 0x8040004 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.31 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r29883+4-d989d9a8ec4c) 14.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Tue Jun  3 13:25:02 2025
[    0.000000] Machine model: Linksys MX6200
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[    0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x000000004dffffff (49152 KiB) nomap non-reusable q6_mem_regions@4b000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004a9fffff]
[    0.000000]   node   0: [mem 0x000000004aa00000-0x000000004aafffff]
[    0.000000]   node   0: [mem 0x000000004ab00000-0x000000004adfffff]
[    0.000000]   node   0: [mem 0x000000004ae00000-0x000000004affffff]
[    0.000000]   node   0: [mem 0x000000004b000000-0x000000004dffffff]
[    0.000000]   node   0: [mem 0x000000004e000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43288 r8192 d30440 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_0 coherent_pool=2M
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000005f540000-0x000000005f5c0000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[    0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000116] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000135] pid_max: default: 32768 minimum: 301
[    0.005124] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005145] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.070286] rcu: Hierarchical SRCU implementation.
[    0.070299] rcu:     Max phase no-delay instances is 1000.
[    0.070890] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.080717] smp: Bringing up secondary CPUs ...
[    0.090963] Detected VIPT I-cache on CPU1
[    0.091104] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.091318] smp: Brought up 1 node, 2 CPUs
[    0.091341] SMP: Total of 2 processors activated.
[    0.091345] CPU: All CPU(s) started at EL1
[    0.091351] CPU features: detected: 32-bit EL0 Support
[    0.091357] CPU features: detected: CRC32 instructions
[    0.091443] alternatives: applying system-wide alternatives
[    0.091687] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.091951] Memory: 427880K/524288K available (8640K kernel code, 892K rwdata, 2748K rodata, 12672K init, 287K bss, 94564K reserved, 0K cma-reserved)
[    0.098718] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.098750] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.098874] 26400 pages in range for non-PLT usage
[    0.098882] 517920 pages in range for PLT usage
[    0.101156] pinctrl core: initialized pinctrl subsystem
[    0.103951] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.104974] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[    0.105329] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.105645] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.106188] thermal_sys: Registered thermal governor 'step_wise'
[    0.106374] cpuidle: using governor menu
[    0.106705] ASID allocator initialised with 65536 entries
[    0.111942] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[    0.152576] SCSI subsystem initialized
[    0.152928] usbcore: registered new interface driver usbfs
[    0.153013] usbcore: registered new interface driver hub
[    0.153099] usbcore: registered new device driver usb
[    0.153434] qcom_scm: convention: smc arm 64
[    0.156251] clocksource: Switched to clocksource arch_sys_counter
[    0.160369] NET: Registered PF_INET protocol family
[    0.160638] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.162968] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.163005] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.163035] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.163090] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.163281] TCP: Hash tables configured (established 4096 bind 4096)
[    0.163895] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
[    0.164115] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.164149] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.164709] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.164774] PCI: CLS 0 bytes, default 64
[    0.166957] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.167555] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.167568] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.425715] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.427744] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.427906] msm_serial 78af000.serial: uartclk = 1843199
[    0.429049] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
[    0.429266] msm_serial: console setup on port #0
[    0.429349] printk: legacy console [ttyMSM0] enabled
[    1.152846] msm_serial: driver initialized
[    1.173704] loop: module loaded
[    1.181284] spi-nand spi0.0: Macronix SPI NAND was found.
[    1.181344] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.346374] 24 fixed-partitions partitions found on MTD device spi0.0
[    1.346458] Creating 24 MTD partitions on "spi0.0":
[    1.351828] 0x000000000000-0x000000100000 : "0:SBL1"
[    1.360804] 0x000000100000-0x000000200000 : "0:MIBIB"
[    1.364782] 0x000000200000-0x000000240000 : "0:BOOTCONFIG"
[    1.368987] 0x000000240000-0x000000280000 : "0:BOOTCONFIG1"
[    1.373737] 0x000000280000-0x000000480000 : "0:QSEE"
[    1.382745] 0x000000480000-0x000000680000 : "0:QSEE_1"
[    1.388128] 0x000000680000-0x000000780000 : "0:DEVCFG"
[    1.391398] 0x000000780000-0x000000880000 : "0:DEVCFG_1"
[    1.396189] 0x000000880000-0x000000980000 : "0:CDT"
[    1.401386] 0x000000980000-0x000000a80000 : "0:CDT_1"
[    1.405987] 0x000000a80000-0x000000b80000 : "ppinfo"
[    1.411383] 0x000000b80000-0x000000e00000 : "0:APPSBL"
[    1.419441] 0x000000e00000-0x000001080000 : "0:APPSBL_1"
[    1.425914] 0x000001080000-0x000001280000 : "0:ART"
[    1.431342] 0x000001280000-0x000001380000 : "0:TRAINING"
[    1.434724] 0x000001380000-0x000001480000 : "u_env"
[    1.439148] 0x000001480000-0x000001580000 : "s_env"
[    1.443588] 0x000001580000-0x000001680000 : "devinfo"
[    1.448803] 0x000001680000-0x000004880000 : "kernel"
[    1.553001] 0x000001e80000-0x000004880000 : "rootfs"
[    1.554216] mtd: setting mtd19 (rootfs) as root device
[    1.557770] mtdsplit: no squashfs found in "rootfs"
[    1.562043] 0x000004880000-0x000007a80000 : "alt_kernel"
[    1.668985] 0x000005080000-0x000007a80000 : "alt_rootfs"
[    1.670182] 0x000007a80000-0x000007c80000 : "sysdiag"
[    1.678864] 0x000007c80000-0x00000fe80000 : "syscfg"
[    2.125891] i2c_dev: i2c /dev entries driver
[    2.131209] sdhci: Secure Digital Host Controller Interface driver
[    2.131262] sdhci: Copyright(c) Pierre Ossman
[    2.136417] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.144746] remoteproc remoteproc0: releasing cd00000.remoteproc
[    2.418063] NET: Registered PF_INET6 protocol family
[    2.419816] Segment Routing with IPv6
[    2.422150] In-situ OAM (IOAM) with IPv6
[    2.425768] NET: Registered PF_PACKET protocol family
[    2.430061] 8021q: 802.1Q VLAN Support v1.8
[    2.482357] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
[    2.484649] remoteproc remoteproc0: cd00000.remoteproc is available
[    2.492173] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[    2.499912] remoteproc remoteproc1: pd-1 is available
[    2.503729] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[    2.510339] remoteproc remoteproc2: pd-2 is available
[    2.514280] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
▒[    2.537770] Freeing unused kernel memory: 12672Kable
[    2.538262] Run /init as init process
[    3.189788] init: Console is alive
[    3.190208] init: - watchdog -
[    3.213555] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.241247] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.258588] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
[    3.258643] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
[    3.264132] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
[    3.270458] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    4.786275] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
[    4.787486] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 271, phy_id = 0x67c9df10 phytype doesn't match
[    5.120340] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
[    5.120619] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    5.129398] nss-dp 39c00000.dp1 lan (uninitialized): nss_dp_gmac: Registering netdev lan(qcom-id:1) with GMAC, mac_base: 0xffffffc082480000
[    5.197129] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
[    5.201248] nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc0824b0000
[    5.209506] Generic PHY 90000.mdio-1:0f: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:0f, irq=POLL)
[    5.222669] **********************************************************
[    5.230107] * NSS Data Plane driver
[    5.236478] **********************************************************
[    5.258149] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.269308] init: - preinit -
[    7.056262] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.496881] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   11.561200] nss-dp 39c00000.dp1 lan: PHY Link is down
[   11.570059] procd: - early -
[   11.570329] procd: - watchdog -
[   12.213202] procd: - watchdog -
[   12.213647] procd: - ubus -
[   12.272459] procd: - init -
Please press Enter to activate this console.
[   12.707498] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.976940] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   12.976991] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   13.022250] NET: Registered PF_QIPCRTR protocol family
[   13.079070] urngd: v1.0.2 started.
[   13.139174] PPP generic driver version 2.4.2
[   13.142638] NET: Registered PF_PPPOX protocol family
[   13.147732] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   13.147779] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   13.186421] ath11k c000000.wifi: ipq5018 hw1.0
[   13.186474] ath11k c000000.wifi: FW memory mode: 2
[   13.311934] remoteproc remoteproc1: powering up pd-1
[   13.312219] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.316005] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.324521] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.479304] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   13.500257] remoteproc remoteproc1: remote processor pd-1 is now up
[   13.520109] ath11k b00a040.wifi1: Multipd architecture - userpd: 3
[   13.524469] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   13.531938] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   13.533468] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.533486] ath11k b00a040.wifi1: qcn6122 hw1.0
[   13.555167] ath11k b00a040.wifi1: FW memory mode: 2
[   13.685050] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   15.197906] remoteproc remoteproc3: powering up pd-3
[   15.198293] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   15.212873] remoteproc remoteproc3: remote processor pd-3 is now up
[   15.223877] batman_adv: B.A.T.M.A.N. advanced 2025.1-openwrt-1 (compatibility version 15) loaded
[   15.233844] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.294279] ath11k b00a040.wifi1: qmi ignore invalid mem req type 10
[   15.301633] ath11k b00a040.wifi1: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   15.301690] ath11k b00a040.wifi1: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   15.452801] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   27.034871] br-lan: port 1(lan) entered blocking state
[   27.034951] br-lan: port 1(lan) entered disabled state
[   27.044290] nss-dp 39c00000.dp1 lan: entered allmulticast mode
[   27.047634] nss-dp 39c00000.dp1 lan: entered promiscuous mode
[   31.206812] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   31.207053] br-lan: port 1(lan) entered blocking state
[   31.211591] br-lan: port 1(lan) entered forwarding state
[   31.286832] nss-dp 39d00000.dp2 wan: PHY Link up speed: 1000

The only thing missing is the 6GHz radio:

root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fdd7:d85a:5219::1/60 Scope:Global
          inet6 addr: fe80::8269:1aff:fe8b:8767/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4332 errors:0 dropped:13 overruns:0 frame:0
          TX packets:1007 errors:0 dropped:9 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:424023 (414.0 KiB)  TX bytes:538982 (526.3 KiB)

lan       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4513 errors:0 dropped:11 overruns:0 frame:0
          TX packets:1090 errors:0 dropped:4 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:516421 (504.3 KiB)  TX bytes:549206 (536.3 KiB)
          Interrupt:43

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:266 errors:0 dropped:0 overruns:0 frame:0
          TX packets:266 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:22432 (21.9 KiB)  TX bytes:22432 (21.9 KiB)

phy0-ap0  Link encap:Ethernet  HWaddr 80:69:1A:8B:87:68
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:1877 (1.8 KiB)

phy1-ap0  Link encap:Ethernet  HWaddr 80:69:1A:8B:87:69
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:526 (526.0 B)

wan       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          inet addr:172.30.167.90  Bcast:172.30.167.255  Mask:255.255.255.0
          inet6 addr: fe80::8269:1aff:fe8b:8767/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:11054 errors:0 dropped:50 overruns:0 frame:0
          TX packets:385 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:992272 (969.0 KiB)  TX bytes:79740 (77.8 KiB)
          Interrupt:44
27

is the mac address for wan the same as for lan in stock?

28

No, 80:69:1A:8B:87:67 for WAN and 80:69:1A:8B:87:68 for LAN:

~ # ifconfig
ath0      Link encap:Ethernet  HWaddr 80:69:1A:8B:87:69
          inet6 addr: fe80::8269:1aff:fe8b:8769/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath0.4    Link encap:Ethernet  HWaddr 80:69:1A:8B:87:69
          inet6 addr: fe80::8269:1aff:fe8b:8769/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:2480 (2.4 KiB)

ath10     Link encap:Ethernet  HWaddr 80:69:1A:8B:87:6A
          inet6 addr: fe80::8269:1aff:fe8b:876a/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath10.4   Link encap:Ethernet  HWaddr 80:69:1A:8B:87:6A
          inet6 addr: fe80::8269:1aff:fe8b:876a/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:2480 (2.4 KiB)

ath30     Link encap:Ethernet  HWaddr 82:69:1A:8B:87:6B
          inet6 addr: fe80::8069:1aff:fe8b:876b/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath30.4   Link encap:Ethernet  HWaddr 82:69:1A:8B:87:6B
          inet6 addr: fe80::8069:1aff:fe8b:876b/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:2480 (2.4 KiB)

ath7      Link encap:Ethernet  HWaddr 86:69:1A:8B:87:69
          inet6 addr: fe80::8469:1aff:fe8b:8769/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:68
          inet addr:192.168.41.50  Bcast:192.168.41.255  Mask:255.255.255.0
          inet6 addr: fe80::8269:1aff:fe8b:8768/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:3147 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3195 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:590851 (577.0 KiB)  TX bytes:3587932 (3.4 MiB)

br2       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:69
          inet addr:192.168.20.1  Bcast:192.168.20.255  Mask:255.255.255.0
          inet6 addr: fe80::8269:1aff:fe8b:8769/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:56 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:6761 (6.6 KiB)

eth0      Link encap:Ethernet  HWaddr 80:69:1A:8B:87:68
          inet6 addr: fe80::8269:1aff:fe8b:8768/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:3207 errors:0 dropped:16 overruns:0 frame:0
          TX packets:4695 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:660960 (645.4 KiB)  TX bytes:3704893 (3.5 MiB)
          Interrupt:100

eth0.4    Link encap:Ethernet  HWaddr 80:69:1A:8B:87:68
          inet6 addr: fe80::8269:1aff:fe8b:8768/64 Scope:Link
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:64 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:7721 (7.5 KiB)

eth1      Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          inet addr:172.30.167.90  Bcast:172.30.167.255  Mask:255.255.255.0
          inet6 addr: fe80::8269:1aff:fe8b:8767/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3204 errors:7 dropped:7 overruns:0 frame:7
          TX packets:419 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:383323 (374.3 KiB)  TX bytes:57559 (56.2 KiB)
          Interrupt:101

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:525 errors:0 dropped:0 overruns:0 frame:0
          TX packets:525 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:59910 (58.5 KiB)  TX bytes:59910 (58.5 KiB)

wifi0     Link encap:UNSPEC  HWaddr 80-69-1A-8B-87-69-00-00-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:2699
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wifi1     Link encap:UNSPEC  HWaddr 80-69-1A-8B-87-6A-30-30-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:2699
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wifi2     Link encap:UNSPEC  HWaddr 80-69-1A-8B-87-6B-30-30-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:2699
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
29

wan mac now incremented by 1 in the latest image, same URL

EDIT: another image uploaded with wifi mac addresses fixed in line with stock too

30

Good job!

root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::8269:1aff:fe8b:8767/64 Scope:Link
          inet6 addr: fd9b:d03a:c3c5::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:871 errors:0 dropped:2 overruns:0 frame:0
          TX packets:8 errors:0 dropped:3 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:63170 (61.6 KiB)  TX bytes:1072 (1.0 KiB)

lan       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:67
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1040 errors:0 dropped:2 overruns:0 frame:0
          TX packets:11 errors:0 dropped:4 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:92293 (90.1 KiB)  TX bytes:1382 (1.3 KiB)
          Interrupt:39

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:56 errors:0 dropped:0 overruns:0 frame:0
          TX packets:56 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4368 (4.2 KiB)  TX bytes:4368 (4.2 KiB)

wan       Link encap:Ethernet  HWaddr 80:69:1A:8B:87:68
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:40

Do you think it is possible to add the 6 GHZ radio?

31

see edit above for wifi mac updates

technically, yes, but the ath11k driver needs some changes to load the board id from the DTS. Since this board has 2x QCN6122 chips, the board-2.bin file should be packaged with both the 5G BDF and 6G BDF.

In the meantime, I could try and build an image to test the 6G radio with 5G turned off

32

Why don't you give the new image I just uploaded a try..

33

The result is the same, the 6GHz is missing:

Capture d’écran 2025-06-04 082636
Capture d’écran 2025-06-04 082636958×264 19.4 KB

If it helps, here are the boot logs:

IPQ5018# bootm 0x44000000
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.31
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e8
     Data Size:    15498617 Bytes = 14.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   df0bedab
     Hash algo:    sha1
     Hash value:   38a91d6dbe5eabccfc20fd1f3feaa240a15236c9
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_mx6200 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44ec7fa4
     Data Size:    26903 Bytes = 26.3 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   2b73dd32
     Hash algo:    sha1
     Hash value:   1d6fcfc3a1a299571d09ef2068becfafae09877f
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44ec7fa4
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f6000, end 4a3ff916 ... OK
Using machid 0x8040004 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.31 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r29883+4-d989d9a8ec4c) 14.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Tue Jun  3 15:07:53 2025
[    0.000000] Machine model: Linksys MX6200
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[    0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x000000004f3fffff (69632 KiB) nomap non-reusable q6_mem_regions@4b000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004a9fffff]
[    0.000000]   node   0: [mem 0x000000004aa00000-0x000000004aafffff]
[    0.000000]   node   0: [mem 0x000000004ab00000-0x000000004adfffff]
[    0.000000]   node   0: [mem 0x000000004ae00000-0x000000004affffff]
[    0.000000]   node   0: [mem 0x000000004b000000-0x000000004f3fffff]
[    0.000000]   node   0: [mem 0x000000004f400000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43288 r8192 d30440 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_0 coherent_pool=2M
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000005f580000-0x000000005f600000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[    0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000121] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000141] pid_max: default: 32768 minimum: 301
[    0.005105] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005125] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.070292] rcu: Hierarchical SRCU implementation.
[    0.070305] rcu:     Max phase no-delay instances is 1000.
[    0.070883] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.080305] smp: Bringing up secondary CPUs ...
[    0.081414] Detected VIPT I-cache on CPU1
[    0.081558] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.081770] smp: Brought up 1 node, 2 CPUs
[    0.081789] SMP: Total of 2 processors activated.
[    0.081794] CPU: All CPU(s) started at EL1
[    0.081800] CPU features: detected: 32-bit EL0 Support
[    0.081809] CPU features: detected: CRC32 instructions
[    0.081890] alternatives: applying system-wide alternatives
[    0.082131] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.082392] Memory: 407440K/524288K available (8640K kernel code, 892K rwdata, 2748K rodata, 12672K init, 287K bss, 115004K reserved, 0K cma-reserved)
[    0.089085] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.089120] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.089245] 26400 pages in range for non-PLT usage
[    0.089254] 517920 pages in range for PLT usage
[    0.091514] pinctrl core: initialized pinctrl subsystem
[    0.094319] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.095341] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[    0.095690] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.096003] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.096548] thermal_sys: Registered thermal governor 'step_wise'
[    0.096730] cpuidle: using governor menu
[    0.097053] ASID allocator initialised with 65536 entries
[    0.102396] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[    0.143151] SCSI subsystem initialized
[    0.143490] usbcore: registered new interface driver usbfs
[    0.143548] usbcore: registered new interface driver hub
[    0.143635] usbcore: registered new device driver usb
[    0.143998] qcom_scm: convention: smc arm 64
[    0.146805] clocksource: Switched to clocksource arch_sys_counter
[    0.150886] NET: Registered PF_INET protocol family
[    0.151158] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.153440] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.153474] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.153501] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.153556] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.153743] TCP: Hash tables configured (established 4096 bind 4096)
[    0.154350] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
[    0.154564] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.154598] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.155159] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.155224] PCI: CLS 0 bytes, default 64
[    0.157395] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.157995] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.158009] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.406223] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.408449] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.408594] msm_serial 78af000.serial: uartclk = 1843199
[    0.409333] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
[    0.409474] msm_serial: console setup on port #0
[    0.409551] printk: legacy console [ttyMSM0] enabled
[    1.133050] msm_serial: driver initialized
[    1.151583] loop: module loaded
[    1.159210] spi-nand spi0.0: Macronix SPI NAND was found.
[    1.159271] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.335628] 24 fixed-partitions partitions found on MTD device spi0.0
[    1.335693] Creating 24 MTD partitions on "spi0.0":
[    1.341186] 0x000000000000-0x000000100000 : "0:SBL1"
[    1.350176] 0x000000100000-0x000000200000 : "0:MIBIB"
[    1.354014] 0x000000200000-0x000000240000 : "0:BOOTCONFIG"
[    1.358168] 0x000000240000-0x000000280000 : "0:BOOTCONFIG1"
[    1.362776] 0x000000280000-0x000000480000 : "0:QSEE"
[    1.372452] 0x000000480000-0x000000680000 : "0:QSEE_1"
[    1.378142] 0x000000680000-0x000000780000 : "0:DEVCFG"
[    1.381486] 0x000000780000-0x000000880000 : "0:DEVCFG_1"
[    1.385578] 0x000000880000-0x000000980000 : "0:CDT"
[    1.390920] 0x000000980000-0x000000a80000 : "0:CDT_1"
[    1.395442] 0x000000a80000-0x000000b80000 : "ppinfo"
[    1.400703] 0x000000b80000-0x000000e00000 : "0:APPSBL"
[    1.408772] 0x000000e00000-0x000001080000 : "0:APPSBL_1"
[    1.415109] 0x000001080000-0x000001280000 : "0:ART"
[    1.420427] 0x000001280000-0x000001380000 : "0:TRAINING"
[    1.423677] 0x000001380000-0x000001480000 : "u_env"
[    1.428305] 0x000001480000-0x000001580000 : "s_env"
[    1.432593] 0x000001580000-0x000001680000 : "devinfo"
[    1.437932] 0x000001680000-0x000004880000 : "kernel"
[    1.540790] 0x000001e80000-0x000004880000 : "rootfs"
[    1.542041] mtd: setting mtd19 (rootfs) as root device
[    1.545526] mtdsplit: no squashfs found in "rootfs"
[    1.549874] 0x000004880000-0x000007a80000 : "alt_kernel"
[    1.656567] 0x000005080000-0x000007a80000 : "alt_rootfs"
[    1.657845] 0x000007a80000-0x000007c80000 : "sysdiag"
[    1.666356] 0x000007c80000-0x00000fe80000 : "syscfg"
[    2.107432] i2c_dev: i2c /dev entries driver
[    2.112835] sdhci: Secure Digital Host Controller Interface driver
[    2.112890] sdhci: Copyright(c) Pierre Ossman
[    2.118055] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.126058] remoteproc remoteproc0: releasing cd00000.remoteproc
[    2.405526] NET: Registered PF_INET6 protocol family
[    2.407418] Segment Routing with IPv6
[    2.409617] In-situ OAM (IOAM) with IPv6
[    2.413220] NET: Registered PF_PACKET protocol family
[    2.417571] 8021q: 802.1Q VLAN Support v1.8
[    2.467722] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
[    2.470462] remoteproc remoteproc0: cd00000.remoteproc is available
[    2.477547] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[    2.485126] remoteproc remoteproc1: pd-1 is available
[    2.489239] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[    2.495608] remoteproc remoteproc2: pd-2 is available
[    2.499774] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
▒[    2.523959] Freeing unused kernel memory: 12672Kable
[    2.524405] Run /init as init process
[    3.146165] init: Console is alive
[    3.146583] init: - watchdog -
[    3.169955] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.196080] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.213655] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
[    3.213709] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
[    3.219325] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
[    3.225452] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    4.736843] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
[    4.738175] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 271, phy_id = 0x67c9df10 phytype doesn't match
[    5.070911] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
[    5.071117] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    5.079904] nss-dp 39c00000.dp1 lan (uninitialized): nss_dp_gmac: Registering netdev lan(qcom-id:1) with GMAC, mac_base: 0xffffffc082470000
[    5.147866] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
[    5.151862] nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc0824a0000
[    5.160191] Generic PHY 90000.mdio-1:0f: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:0f, irq=POLL)
[    5.173447] **********************************************************
[    5.180824] * NSS Data Plane driver
[    5.187203] **********************************************************
[    5.208632] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.210758] init: - preinit -
[    6.996793] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.407403] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   11.511283] nss-dp 39c00000.dp1 lan: PHY Link is down
[   11.520046] procd: - early -
[   11.520314] procd: - watchdog -
[   12.160704] procd: - watchdog -
[   12.161145] procd: - ubus -
[   12.220948] procd: - init -
Please press Enter to activate this console.
[   12.659943] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.947320] urngd: v1.0.2 started.
[   12.981326] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   12.981377] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   13.050912] NET: Registered PF_QIPCRTR protocol family
[   13.249592] PPP generic driver version 2.4.2
[   13.252419] NET: Registered PF_PPPOX protocol family
[   13.257327] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   13.257892] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   13.286443] ath11k c000000.wifi: ipq5018 hw1.0
[   13.286504] ath11k c000000.wifi: FW memory mode: 2
[   13.349285] remoteproc remoteproc1: powering up pd-1
[   13.349575] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.353386] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.361929] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.482336] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   13.501624] remoteproc remoteproc1: remote processor pd-1 is now up
[   13.505219] ath11k b00a040.wifi1: Multipd architecture - userpd: 2
[   13.507477] ath11k b00a040.wifi1: qcn6122 hw1.0
[   13.512992] ath11k b00a040.wifi1: FW memory mode: 2
[   13.527512] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   13.535186] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   13.535259] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.580805] remoteproc remoteproc2: powering up pd-2
[   13.581118] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.595714] remoteproc remoteproc2: remote processor pd-2 is now up
[   13.597591] ath11k b00a040.wifi2: Multipd architecture - userpd: 3
[   13.601773] ath11k b00a040.wifi2: qcn6122 hw1.0
[   13.607213] ath11k b00a040.wifi2: FW memory mode: 2
[   13.676891] ath11k b00a040.wifi1: qmi ignore invalid mem req type 10
[   13.684139] ath11k b00a040.wifi1: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   13.684211] ath11k b00a040.wifi1: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   13.722519] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   15.278294] remoteproc remoteproc3: powering up pd-3
[   15.278818] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   15.293484] remoteproc remoteproc3: remote processor pd-3 is now up
[   15.304633] batman_adv: B.A.T.M.A.N. advanced 2025.1-openwrt-1 (compatibility version 15) loaded
[   15.313432] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.389841] ath11k b00a040.wifi2: qmi ignore invalid mem req type 10
[   15.397216] ath11k b00a040.wifi2: chip_id 0x0 chip_family 0x4 board_id 0xb0 soc_id 0xffffffff
[   15.397294] ath11k b00a040.wifi2: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   15.432202] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   17.505386] mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
[   20.806942] ath11k b00a040.wifi2: failed to receive control response completion, polling..
[   21.856849] ath11k b00a040.wifi2: Service connect timeout
[   21.856903] ath11k b00a040.wifi2: failed to connect to HTT: -110
[   21.863642] ath11k b00a040.wifi2: failed to start core: -110
[   30.209906] br-lan: port 1(lan) entered blocking state
[   30.209977] br-lan: port 1(lan) entered disabled state
[   30.214763] nss-dp 39c00000.dp1 lan: entered allmulticast mode
[   30.222266] nss-dp 39c00000.dp1 lan: entered promiscuous mode
[   34.407332] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   34.407599] br-lan: port 1(lan) entered blocking state
[   34.412097] br-lan: port 1(lan) entered forwarding state
34

@xrx54: I've uploaded the code for this device here in case you would like to explore options to enable the 6G wifi radio:

35

So I was pointed to this thread to for 3 radio support for ipq5018. I'm working on zyxel scr50axe.
I see you contributed QCN6122 support patches to OpenWrt . Is it possible to just duplicate/adjust 6122 into 6122_2 and use that?

36

@xrx54: I’ve managed to get my hands on an mx6200 unit, so will be working on it soon. How did you safely dissemble it (without breaking anything if possible)? Are there screws under the label? Did you use a spudger to lift the top?

37

From below, it's impossible. You have to use a thin tool on top to unclip. Don't hesitate to force it once you've managed to get all the way around with the tool. There's a clip in the center that holds the top, in my case it broke.

20251023_203200
20251023_203200600×800 460 KB

38

20251023_203934
20251023_203934800×600 145 KB

I don't see how to remove the clips in the center without breaking them.

39

Opened it up, but that wasn’t easy! Will start working on it

40

okay, I’ve got everything up now incl. the QCN6122 5G and 6G radios. But on the 6G radio, I’m encountering an issue. The SSID is not picked up by any client. QCN6122 5G works well.
@lytr: this seems the be the same issue you had with the MX8500. Channels are listed but the transmit power values don’t populate correctly either here:

Screenshot from 2025-10-29 15-47-17
Screenshot from 2025-10-29 15-47-17886×516 50.7 KB

OpenWrt support for Linksys MX8500 - #241 by pppig236

Issue:

how did you eventually fix this? What needs to be done to the BDF?

I have already upgraded the BDF and the embedded regdb based on the latest 2.12 firmware.