OpenWrt Support for Linksys SPNMX57 variants

Originally, I was supplied with a SPNMX56 by my ISP, but the two child nodes supplied by them were SPNMX57's.

I'm not too knowledgeable on OpenWrt, and in fact routers as a whole, but I do know that they are more or less computers, albeit with a less generalised purpose :slight_smile:

I also do know that I am very impatient, and being a software developer by nature, I don't necessarily like waiting around for others to do something I can do!

I'll post the bootlog and /sys/firmware/fdt file below (though, I really should've FTP'd it to my system, rather than create an octal dump), with any progress I've made below.

Feel free to chip in, and I would appreciate some guidance / pointers / starter tips!

Great, start at https://openwrt.org/docs/guide-developer/add.new.device.

can you scp or tftp the fdt file to your PC and then also, if you're in stock anyways, tar/zip the entire /etc/ directory upload it them somewhere?
Since the firmware of the device isn't published anywhere, I recommend you to make a backup of your device before tinkering with it..

EDIT: besides work, I'm prioritizing work on the spi-qpic-snand driver, completing support for Xiaomi AX6000 and fixing the clocks/reset issues impacting the 2.5GB WAN port on AX6000 and SPNMX56.

and @frollic

Thank you both for your responses - yes, I will tftp the file instead, I just wasn't really sure how to approach the issue, getting a decent serial terminal emulator was a pain (ended up with Termius).

I'll take a backup of the entire device as advised, but worst case scenario, I do have another SPNMX57 I can pull the firmware from.

George, it's not a worry mate, you do your thing, I'm more than happy to leverage some of this stress off your shoulders.

http://0x0.st/8J8l.zip

Full dump of the router's firmware, including:

  • bootlog
  • /sys/firmware/fdt (and the .dts created from that)
  • full /etc folder
  • full /tmp/var folder
  • each partition available at /dev/mtd
  • md5 checksums

Mirror: https://gofile.io/d/6qQoiY
md5 checksum:

448941bfe3835ea5bb75c1e63b0da912  SPNMX57_dump.zip

Haven't been able to do anything as of far, just thinking of how to set up a build system, considering I'm on macOS. I'm thinking podman may be a good approach.

@georgem83 It doesn't seem to be too different to the other SPNMX router variants, do you happen to spot any differences initially?

Physically it looks 1:1 with an SPNMX56, with the addition of one 2.5G LAN port, with the other two LAN ports being 1G. The WAN port has remained 2.5G.

checked the fdt a bit further. It looks like a relatively simple adaptation of the SPNMX56 and other Linksys devices. The main difference is that it uses a qca8386 switch which the qca8084 driver that was sent upstream should support. I know @Ansuel has been playing with it in the qualcommbe target, can you share if this driver is ready for primetime?

The SoC's internal GE Phy isn't used. Since the qca8386 switch has 4 QCA8084 PHYs capable of 2.5G each, I wonder why Linksys or qcom has implemented 2x 2.5G (1 for LAN and 1 for WAN) and 2x 1G links. Maybe, if we're lucky, we could enable them all with 2.5G..

That means we can flash SPNMX56 on SPNMX57?

no, it's not that straightforward. As mentioned above, the SPNMX57 (which I think is one of the most interesting ipq50xx devices out there) uses a different switch. If you flash the SPNMX56 image, you'll have no ethernet

I want to use it as dump AP, so I’ll cook a firmware with WiFi/mesh enabled by default, I can use SPNMX56 to test the config and flash it onto SPNMX57 and I won’t need the Ethernet interfaces right?

I wouldn't do that as there's a high risk you'll end up with a brick, unless you have serial access and 'know what you're doing'. Mind you that wifi is disabled by default. And if you flash, make sure you have a backup of the stock partitions

1 Like

Yes your right, is very risky.. but worth for this as I found in a cupboard abandoned I can give a new love to it, I’ll test the config in the 56 and flash the new settings mesh and WiFi enabled wish me luck. I also have a serial USB but haven’t really checked where is the serial port in this one :slight_smile:

Hi there,

I successfully flashed the SPNMX56 firmware onto the SPNMX57, and as @georgem83 predicted, the Ethernet ports are unusable. I was able to enable Wi-Fi through the serial connection, and I can now access the router. The same problem occurs when I flash the MX5500 firmware.

In the LuCI UI, eth0 is shown, but lan1-2-3 are listed as absent.

Could you please help me understand what to do next?

Here are some of the errors I've encountered:

Warning: eth0 MAC addresses don't match:
Address in SROM is         **:**:**:**:**:**
Address in environment is  **:**:**:**:**:**

[    1.234766] pci 0000:01:00.0: 8.000 Gb/s available PCIe bandwidth, limited by 5.0 GT/s PCIe x2 link at 0000:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)

[    1.769971] 0x00000acc0000-0x00000f0c0000 : "syscfg"
[    2.055413] mdio_bus 90000.mdio-1: MDIO device at address 0 is missing.
[    2.055611] mdio_bus 90000.mdio-1: MDIO device at address 1 is missing.
[    2.060982] mdio_bus 90000.mdio-1: MDIO device at address 2 is missing.
[    2.067606] mdio_bus 90000.mdio-1: MDIO device at address 3 is missing.
[    2.074273] mdio_bus 90000.mdio-1: MDIO device at address 4 is missing.
[    2.096808] qca8k 90000.mdio-1:11: Switch id detected 17 but expected 13
[    2.096996] i2c_dev: i2c /dev entries driver

Sun Aug 10 13:16:17 2025 user.info kernel: [    4.709216] kmodloader: loading kernel modules from /etc/modules-boot.d/*
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.772208] gpio_button_hotplug: loading out-of-tree module taints kernel.
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.789002] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.789054] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.794663] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.800789] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.311326] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.312380] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 284, phy_id = 0xfffafffa phytype doesn't match
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.645351] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.645581] regi_init[2574]:INFO:qca-ssdk module init succeeded!

@ivorsmorenburg, you won't be able to use the router as an access point because you have no way to supply a connection to it, unless you want to use it as a wireless repeater.

I made a successful backup of my 56 and flash it into the 57 enabling by default a mesh peer so I was able to access it.

1 Like

If it helps, here is the original firmware from the Linksys website:

download.linksys.com/FW_MX57CF_1.0.1.216553_prod.img

Checksum: 62b76e25b194ecd42275460a7eedcace
Branded: Community Fibre (UK)

I also uploaded a copy here: https://0x0.st/Kz1i.img

Ethernet won’t work because the SPNMX57 uses a different switch, the qca8386 (qca8084 PHY) instead of the qca8337. I’m unsure about the status of driver availability..

I don't possess much in the way of coding skills but would like to try and help.
I have recently received an spnmx57 and would like to try and get the ethernet ports working.
I also have an Spnmx56 running a snapshot of openwrt succesfully.
Where do I start if I want to try and integrate the drivers for the the new internal qca8386 switch?
Any pointers would be great thanks.

I am in the same situation. While I am capable of coding the firmware, I am currently stuck on locating the correct port addresses.

My progress and findings so far:

  • The drivers appear to be available, given the porting efforts on the qualcommbe/ipq95xx platform: https://github.com/openwrt/openwrt/pull/18796
  • I have tried applying the same kernel patches. The firmware boots successfully, but I cannot map the ports correctly due to my limited experience with the DTS.
  • I successfully reverted back to the official firmware shared earlier.
  • My next step is trying to reverse engineer the official firmware to see if I can extract the port configurations from there.
1 Like