@BrainSlayer: I've submitted the PR for this device. I just can't scan the 6G SSIDs on iPhone anymore. I must have lucked into it last time when it worked, but no matter what I try, I can't see it. No errors in dmesg or logread. Any suggestions on how to proceed with configuring / troubleshooting?
do you remember what exactly?
might be helpful ...
https://svn.dd-wrt.com/changeset/59339/src/router/hostapd-2025-01-04
Hey, i just received this router, and i flashed openwrt using instructions from your commit, but after setting u-boot variables iâm still getting âunsigned imageâ error, and it goes back to original firmware. Here is the bootlog:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1.1-00075
S - IMAGE_VARIANT_STRING=MAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002c5
B - 127 - PBL, Start
B - 1564 - bootable_media_detect_entry, Start
B - 3584 - bootable_media_detect_success, Start
B - 3588 - elf_loader_entry, Start
B - 8639 - auth_hash_seg_entry, Start
B - 29529 - auth_hash_seg_exit, Start
B - 122075 - elf_segs_hash_verify_entry, Start
B - 191756 - PBL, End
B - 156984 - SBL1, Start
B - 218380 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B - 226554 - clock_init, Start
D - 7716 - clock_init, Delta
B - 234453 - boot_flash_init, Start
D - 18818 - boot_flash_init, Delta
B - 253333 - boot_config_data_table_init, Start
D - 4544 - boot_config_data_table_init, Delta - (575 Bytes)
B - 260958 - Boot Setting : 0x00030618
B - 267485 - CDT version:2,Platform ID:8,Major ID:4,Minor ID:0,Subtype:4
B - 274408 - sbl1_ddr_set_params, Start
B - 276025 - Pre_DDR_clock_init, Start
B - 281667 - Pre_DDR_clock_init, End
B - 924150 - do ddr sanity test, Start
D - 61 - do ddr sanity test, Delta
B - 928816 - Image Load, Start
D - 253425 - QSEE Image Loaded, Delta - (587396 Bytes)
B - 1183095 - Image Load, Start
D - 23881 - DEVCFG Image Loaded, Delta - (19992 Bytes)
B - 1207037 - Image Load, Start
D - 192669 - APPSBL Image Loaded, Delta - (443584 Bytes)
B - 1399767 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 1406233 - SBL1, End
D - 1251750 - SBL1, Delta
S - Flash Throughput, 2464 KB/s (1052219 Bytes, 426991 us)
S - DDR Frequency, 800 MHz
S - Core 0 Frequency, 800 MHz
U-Boot 2016.01 (Feb 03 2023 - 09:15:14 +0000)
CBT U-Boot ver: 7.1.25 ([IPQ5018].[SPF12.1].[CS1])
DRAM: smem ram ptable found: ver: 1 len: 4
512 MiB
NAND: QPIC controller support serial NAND
ID = 82c882c8
Vendor = c8
Device = 82
Serial Nand Device Found With ID : 0xc8 0x82
Serial NAND device Manufacturer:GD5F2GM7RExxG
Device Size:256 MiB, Page size:2048, Spare Size:128, ECC:8-bit
qpic_nand: changing oobsize to 80 from 128 bytes
SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78AF000
Out: serial@78AF000
Err: serial@78AF000
machid: 8040004
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
> parittion 1 is active
auto-recovery enabled:1, boot_part:1, boot_part_ready:3
#### auto_recovery ####
#### boot_count = 3 ####
BOOT_COUNT_TO_RECOVERY
Updating boot_count ... done
update_rootfs_primaryboot: Switching Partitions.
0:HLOS: change from 1 to 2
rootfs: change from 1 to 2
NAND erase: device 0 offset 0x200000, size 0x40000
Erasing at 0x220000 -- 100% complete.
OK
NAND write: device 0 offset 0x200000, size 0x800
2048 bytes written: OK
NAND erase: device 0 offset 0x240000, size 0x40000
Erasing at 0x260000 -- 100% complete.
OK
NAND write: device 0 offset 0x240000, size 0x800
2048 bytes written: OK
Do reset
resetting ...
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1.1-00075
S - IMAGE_VARIANT_STRING=MAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002c5
B - 127 - PBL, Start
B - 1564 - bootable_media_detect_entry, Start
B - 3590 - bootable_media_detect_success, Start
B - 3593 - elf_loader_entry, Start
B - 8654 - auth_hash_seg_entry, Start
B - 29543 - auth_hash_seg_exit, Start
B - 122183 - elf_segs_hash_verify_entry, Start
B - 191850 - PBL, End
B - 157044 - SBL1, Start
B - 218441 - GCC [RstStat:0x10, RstDbg:0x400000] WDog Stat : 0x4
B - 226798 - clock_init, Start
D - 7747 - clock_init, Delta
B - 234697 - boot_flash_init, Start
D - 18818 - boot_flash_init, Delta
B - 253577 - boot_config_data_table_init, Start
D - 4544 - boot_config_data_table_init, Delta - (575 Bytes)
B - 261202 - Boot Setting : 0x00030618
B - 267759 - CDT version:2,Platform ID:8,Major ID:4,Minor ID:0,Subtype:4
B - 274652 - sbl1_ddr_set_params, Start
B - 276269 - Pre_DDR_clock_init, Start
B - 281942 - Pre_DDR_clock_init, End
B - 924424 - do ddr sanity test, Start
D - 61 - do ddr sanity test, Delta
B - 929091 - Image Load, Start
D - 253424 - QSEE Image Loaded, Delta - (587396 Bytes)
B - 1183369 - Image Load, Start
D - 23882 - DEVCFG Image Loaded, Delta - (19992 Bytes)
B - 1207312 - Image Load, Start
D - 192607 - APPSBL Image Loaded, Delta - (443584 Bytes)
B - 1400011 - QSEE Execution, Start
D - 30 - QSEE Execution, Delta
B - 1406446 - SBL1, End
D - 1252086 - SBL1, Delta
S - Flash Throughput, 2464 KB/s (1052219 Bytes, 426901 us)
S - DDR Frequency, 800 MHz
S - Core 0 Frequency, 800 MHz
U-Boot 2016.01 (Feb 03 2023 - 09:15:14 +0000)
CBT U-Boot ver: 7.1.25 ([IPQ5018].[SPF12.1].[CS1])
DRAM: smem ram ptable found: ver: 1 len: 4
512 MiB
NAND: QPIC controller support serial NAND
ID = 82c882c8
Vendor = c8
Device = 82
Serial Nand Device Found With ID : 0xc8 0x82
Serial NAND device Manufacturer:GD5F2GM7RExxG
Device Size:256 MiB, Page size:2048, Spare Size:128, ECC:8-bit
qpic_nand: changing oobsize to 80 from 128 bytes
SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78AF000
Out: serial@78AF000
Err: serial@78AF000
machid: 8040004
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
> parittion 2 is active
auto-recovery enabled:1, boot_part:1, boot_part_ready:3
#### Sync BOOTCONFIG to boot_part(1 -> 2) ####
varname=boot_part, varvalue=2
Saving Environment to NAND...
Erasing NAND...
Erasing at 0x1460000 -- 100% complete.
Writing to NAND... OK
#### auto_recovery ####
#### boot_count = 0 ####
Updating boot_count ... done
Hit any key to stop autoboot: 0
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2018942242
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (5586944)
Kernel image authentication failed
BUG: failure at board/qca/arm/common/cmd_bootqca.c:661/do_boot_signedimg()!
BUG!
resetting ...
can you show the output of printenv from uboot?
Think I know whatâs going on, missed an instruction in the commit message, will add it.
After setting all the variables in uboot, run:
setenv bootcmd 'run bootcmd2'
Then save again:
saveenv
Can you try again?
OK, i let you know in a little bit.
Ok, it booted into OpenWRT, but I have no WiFi:
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.790683] ath11k c000000.wifi: ipq5018 hw1.0
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.790737] ath11k c000000.wifi: FW memory mode: 1
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.909067] remoteproc remoteproc1: powering up pd-1
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.910076] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.913141] remoteproc remoteproc0: powering up cd00000.remoteproc
[4 gru 2025, 09:23:40 UTC] kern.info: [ 14.921652] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.392672] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.411529] remoteproc remoteproc1: remote processor pd-1 is now up
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.415063] ath11k b00a040.wifi: Multipd architecture - userpd: 2
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.417405] ath11k b00a040.wifi: qcn6122 hw1.0
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.422971] ath11k b00a040.wifi: FW memory mode: 1
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 17.437608] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.445244] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.445324] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.492094] remoteproc remoteproc2: powering up pd-2
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.492661] remoteproc remoteproc2: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.507134] remoteproc remoteproc2: remote processor pd-2 is now up
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.508708] ath11k b00b040.wifi: Multipd architecture - userpd: 3
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.513331] ath11k b00b040.wifi: qcn6122 hw1.0
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.518501] ath11k b00b040.wifi: FW memory mode: 1
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 17.588406] ath11k b00a040.wifi: qmi ignore invalid mem req type 10
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.595701] ath11k b00a040.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.595782] ath11k b00a040.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.681173] remoteproc remoteproc3: powering up pd-3
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.681891] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.696050] remoteproc remoteproc3: remote processor pd-3 is now up
[4 gru 2025, 09:23:40 UTC] user.info: [ 17.708038] kmodloader: done loading kernel modules from /etc/modules.d/*
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 17.792661] ath11k b00b040.wifi: qmi ignore invalid mem req type 10
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.800054] ath11k b00b040.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[4 gru 2025, 09:23:40 UTC] kern.info: [ 17.800131] ath11k b00b040.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[4 gru 2025, 09:23:40 UTC] kern.err: [ 17.813392] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Linksys-MX6200 from ath11k/IPQ5018/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 17.820668] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ5018/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 17.835007] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ5018/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 17.847834] ath11k c000000.wifi: failed to fetch board.bin from IPQ5018/hw1.0
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 17.860404] ath11k c000000.wifi: qmi failed to fetch board file: -12
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 17.867411] ath11k c000000.wifi: failed to load board data file: -12
[4 gru 2025, 09:23:40 UTC] kern.err: [ 18.107857] ath11k b00a040.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Linksys-MX6200-5G from ath11k/QCN6122/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 18.107944] ath11k b00a040.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/QCN6122/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 18.121776] ath11k b00a040.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/QCN6122/hw1.0/board-2.bin
[4 gru 2025, 09:23:40 UTC] kern.err: [ 18.134469] ath11k b00a040.wifi: failed to fetch board.bin from QCN6122/hw1.0
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 18.147030] ath11k b00a040.wifi: qmi failed to fetch board file: -12
[4 gru 2025, 09:23:40 UTC] kern.warn: [ 18.154073] ath11k b00a040.wifi: failed to load board data file: -12
So, iâve managed to solve it by building board-2.bin files from wifi firmware in your BDF repo. Everything works, no errors in log. Great job for supporting this. 
you might want to build a new image as I've just made some updates. It's now using SMEM to build the partition table. It also comes with 'somewhat simplified' code for U-boot. So you'd have to replace the variables and c/p from the commit message here:
Can i run these commands with openwrt already installed, or do i have to start from serial and initramfs ?
you can override them in openwrt from ssh. use fw_setenv instead of setenv and no need to run saveenv at the end then.
Oh, thank god, i donât have to dissasemble the bloody thing again 
yeah, this device is a pain to disassemble
Hey, So i build a new image, and it works, but when i want to run upgrade script, in fw_setenv boot_part 1 (valid options <1|2>), i get syntax error: unexpected â(â. Do you know how to fix this ?
Edit: Also, when i run linksys_bootconfig_toggle_primaryboot "0:bootconfig" i get:
-ash: linksys_bootconfig_toggle_primaryboot: not found
Jeez, i just noticed thatâs for switching partitions. SorryâŚ
Another quick question, do you know by chance if Advanced Reboot can be used on this router with openwrt or itâs too complicated for now ?
Im working on it, but itâs not as simple as other Linksys devices as the Linux label is at different offsets between stock and openwrt images. Iâm addition, switching requires not only setting the boot_part variable in U-boot but also modifying the partition table in bootconfig.
Yes, itâs either fw_setenv boot_part 1 or fw_setenv boot_part 2
When switching to boot_part 2, run:
linksys_bootpart_set_bootconfig â0:bootconfigâ 1
Else
linksys_bootpart_set_bootconfig â0:bootconfigâ 0
And likewise for â0:bootconfig1â
Hey, @georgem83, i wanna ask you if you monitor the memory usage on MX6200 when devices are using WiFi. How much free memory do you have, and whatâs the general RAM usage for you ?
Hi at all
I tried this out, but had no output on my serial interface. So after some guessing I learned that on 2 units I have here GNDâTX is definitely 1.8V, not 3.3V. I cant proceed at the moment since I just ordered a 1.8 capable adpater (and hope I didnt fry anything..)
So I think there might