OpenWrt Support for Linksys SPNMX57 variants

For Developers
1

Originally, I was supplied with a SPNMX56 by my ISP, but the two child nodes supplied by them were SPNMX57's.

I'm not too knowledgeable on OpenWrt, and in fact routers as a whole, but I do know that they are more or less computers, albeit with a less generalised purpose :slight_smile:

I also do know that I am very impatient, and being a software developer by nature, I don't necessarily like waiting around for others to do something I can do!

I'll post the bootlog and /sys/firmware/fdt file below (though, I really should've FTP'd it to my system, rather than create an octal dump), with any progress I've made below.

Feel free to chip in, and I would appreciate some guidance / pointers / starter tips!

2

Great, start at https://openwrt.org/docs/guide-developer/add.new.device.

3

can you scp or tftp the fdt file to your PC and then also, if you're in stock anyways, tar/zip the entire /etc/ directory upload it them somewhere?
Since the firmware of the device isn't published anywhere, I recommend you to make a backup of your device before tinkering with it..

EDIT: besides work, I'm prioritizing work on the spi-qpic-snand driver, completing support for Xiaomi AX6000 and fixing the clocks/reset issues impacting the 2.5GB WAN port on AX6000 and SPNMX56.

4

and @frollic

Thank you both for your responses - yes, I will tftp the file instead, I just wasn't really sure how to approach the issue, getting a decent serial terminal emulator was a pain (ended up with Termius).

I'll take a backup of the entire device as advised, but worst case scenario, I do have another SPNMX57 I can pull the firmware from.

George, it's not a worry mate, you do your thing, I'm more than happy to leverage some of this stress off your shoulders.

5

http://0x0.st/8J8l.zip

Full dump of the router's firmware, including:

  • bootlog
  • /sys/firmware/fdt (and the .dts created from that)
  • full /etc folder
  • full /tmp/var folder
  • each partition available at /dev/mtd
  • md5 checksums
6

Mirror: https://gofile.io/d/6qQoiY
md5 checksum:

448941bfe3835ea5bb75c1e63b0da912  SPNMX57_dump.zip

Haven't been able to do anything as of far, just thinking of how to set up a build system, considering I'm on macOS. I'm thinking podman may be a good approach.

@georgem83 It doesn't seem to be too different to the other SPNMX router variants, do you happen to spot any differences initially?

Physically it looks 1:1 with an SPNMX56, with the addition of one 2.5G LAN port, with the other two LAN ports being 1G. The WAN port has remained 2.5G.

7

checked the fdt a bit further. It looks like a relatively simple adaptation of the SPNMX56 and other Linksys devices. The main difference is that it uses a qca8386 switch which the qca8084 driver that was sent upstream should support. I know @Ansuel has been playing with it in the qualcommbe target, can you share if this driver is ready for primetime?

The SoC's internal GE Phy isn't used. Since the qca8386 switch has 4 QCA8084 PHYs capable of 2.5G each, I wonder why Linksys or qcom has implemented 2x 2.5G (1 for LAN and 1 for WAN) and 2x 1G links. Maybe, if we're lucky, we could enable them all with 2.5G..

8

That means we can flash SPNMX56 on SPNMX57?

9

no, it's not that straightforward. As mentioned above, the SPNMX57 (which I think is one of the most interesting ipq50xx devices out there) uses a different switch. If you flash the SPNMX56 image, you'll have no ethernet

10

I want to use it as dump AP, so I’ll cook a firmware with WiFi/mesh enabled by default, I can use SPNMX56 to test the config and flash it onto SPNMX57 and I won’t need the Ethernet interfaces right?

11

I wouldn't do that as there's a high risk you'll end up with a brick, unless you have serial access and 'know what you're doing'. Mind you that wifi is disabled by default. And if you flash, make sure you have a backup of the stock partitions

1 Like
12

Yes your right, is very risky.. but worth for this as I found in a cupboard abandoned I can give a new love to it, I’ll test the config in the 56 and flash the new settings mesh and WiFi enabled wish me luck. I also have a serial USB but haven’t really checked where is the serial port in this one :slight_smile:

13

Hi there,

I successfully flashed the SPNMX56 firmware onto the SPNMX57, and as @georgem83 predicted, the Ethernet ports are unusable. I was able to enable Wi-Fi through the serial connection, and I can now access the router. The same problem occurs when I flash the MX5500 firmware.

In the LuCI UI, eth0 is shown, but lan1-2-3 are listed as absent.

Could you please help me understand what to do next?

Screenshot 2025-08-13 190827
Screenshot 2025-08-13 1908271590×1148 140 KB

Here are some of the errors I've encountered:

Warning: eth0 MAC addresses don't match:
Address in SROM is         **:**:**:**:**:**
Address in environment is  **:**:**:**:**:**

[    1.234766] pci 0000:01:00.0: 8.000 Gb/s available PCIe bandwidth, limited by 5.0 GT/s PCIe x2 link at 0000:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)

[    1.769971] 0x00000acc0000-0x00000f0c0000 : "syscfg"
[    2.055413] mdio_bus 90000.mdio-1: MDIO device at address 0 is missing.
[    2.055611] mdio_bus 90000.mdio-1: MDIO device at address 1 is missing.
[    2.060982] mdio_bus 90000.mdio-1: MDIO device at address 2 is missing.
[    2.067606] mdio_bus 90000.mdio-1: MDIO device at address 3 is missing.
[    2.074273] mdio_bus 90000.mdio-1: MDIO device at address 4 is missing.
[    2.096808] qca8k 90000.mdio-1:11: Switch id detected 17 but expected 13
[    2.096996] i2c_dev: i2c /dev entries driver

Sun Aug 10 13:16:17 2025 user.info kernel: [    4.709216] kmodloader: loading kernel modules from /etc/modules-boot.d/*
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.772208] gpio_button_hotplug: loading out-of-tree module taints kernel.
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.789002] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.789054] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.794663] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    4.800789] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.311326] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.312380] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 284, phy_id = 0xfffafffa phytype doesn't match
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.645351] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
Sun Aug 10 13:16:17 2025 kern.warn kernel: [    6.645581] regi_init[2574]:INFO:qca-ssdk module init succeeded!

@ivorsmorenburg, you won't be able to use the router as an access point because you have no way to supply a connection to it, unless you want to use it as a wireless repeater.

14

I made a successful backup of my 56 and flash it into the 57 enabling by default a mesh peer so I was able to access it.

1 Like
15

If it helps, here is the original firmware from the Linksys website:

download.linksys.com/FW_MX57CF_1.0.1.216553_prod.img

Checksum: 62b76e25b194ecd42275460a7eedcace
Branded: Community Fibre (UK)

I also uploaded a copy here: https://0x0.st/Kz1i.img

16

Ethernet won’t work because the SPNMX57 uses a different switch, the qca8386 (qca8084 PHY) instead of the qca8337. I’m unsure about the status of driver availability..

17

I don't possess much in the way of coding skills but would like to try and help.
I have recently received an spnmx57 and would like to try and get the ethernet ports working.
I also have an Spnmx56 running a snapshot of openwrt succesfully.
Where do I start if I want to try and integrate the drivers for the the new internal qca8386 switch?
Any pointers would be great thanks.

18

I am in the same situation. While I am capable of coding the firmware, I am currently stuck on locating the correct port addresses.

My progress and findings so far:

  • The drivers appear to be available, given the porting efforts on the qualcommbe/ipq95xx platform: https://github.com/openwrt/openwrt/pull/18796
  • I have tried applying the same kernel patches. The firmware boots successfully, but I cannot map the ports correctly due to my limited experience with the DTS.
  • I successfully reverted back to the official firmware shared earlier.
  • My next step is trying to reverse engineer the official firmware to see if I can extract the port configurations from there.
1 Like
19

Hi, I am giving up on this. Here is the last log that I have.
The wan and eth0 ports appear on the UI, but something is still wrong, and I could not get it to connect. I forced the speed to 1000 on all the ports.

I'm happy to assist with setting up the build environment for anyone interested in trying.

                                                                                                                                                                                                                                                                                                         0 

NAND read: device 0 offset 0x58c0000, size 0x800000
 8388608 bytes read: OK
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.55
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e8
     Data Size:    4151090 Bytes = 4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   cb32d3b0
     Hash algo:    sha1
     Hash value:   2521b7ae157284f0518f70c5895bd8f19970282e
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_spnmx57 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x443f595c
     Data Size:    27562 Bytes = 26.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   d58f4c23
     Hash algo:    sha1
     Hash value:   08ec640254d5fb713c2eedaae8d9ca7e577c22c2
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x443f595c
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f6000, end 4a3ffba9 ... OK
fdt_fixup_qpic: QPIC: unable to find node '/soc/qpic-nand@79b0000'
Could not find PCI in device tree
Using machid 0x8040001 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
Booting Linux on physical CPU 0x0000000000 [0x51af8014]
Linux version 6.12.55 (user@debian) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r31055-9cfbd691e9) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Fri Oct 31 20:22:35 2025
Machine model: Linksys spnmx57
OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
OF: reserved mem: 0x000000004b000000..0x000000004dffffff (49152 KiB) nomap non-reusable q6_mem_regions@4b000000
Zone ranges:
  DMA      [mem 0x0000000040000000-0x000000005fffffff]
  DMA32    empty
  Normal   empty
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000040000000-0x000000004a3fffff]
  node   0: [mem 0x000000004a400000-0x000000004a9fffff]
  node   0: [mem 0x000000004aa00000-0x000000004aafffff]
  node   0: [mem 0x000000004ab00000-0x000000004adfffff]
  node   0: [mem 0x000000004ae00000-0x000000004affffff]
  node   0: [mem 0x000000004b000000-0x000000004dffffff]
  node   0: [mem 0x000000004e000000-0x000000005fffffff]
Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
psci: probing for conduit method from DT.
psci: PSCIv1.0 detected in firmware.
psci: Using standard PSCI v0.2 function IDs
psci: MIGRATE_INFO_TYPE not supported.
psci: SMC Calling Convention v1.0
psci: OSI mode supported.
psci: [Firmware Bug]: failed to set PC mode: -1
percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920
Detected VIPT I-cache on CPU0
CPU features: detected: Spectre-v4
alternatives: applying boot alternatives
Kernel command line: init=/sbin/init rootfstype=squashfs ubi.mtd=alt_rootfs root=mtd:squashfs rootwait root=/dev/ubiblock0_0 coherent_pool=2M
Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
Built 1 zonelists, mobility grouping on.  Total pages: 131072
mem auto-init: stack:off, heap alloc:off, heap free:off
software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
software IO TLB: area num 2.
software IO TLB: mapped [mem 0x000000005f540000-0x000000005f5c0000] (0MB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
 Tracing variant of Tasks RCU enabled.
rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
Root IRQ handler: gic_handle_irq
GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
rcu: srcu_init: Setting srcu_struct sizes based on contention.
arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
rcu: Hierarchical SRCU implementation.
rcu:     Max phase no-delay instances is 1000.
Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
smp: Bringing up secondary CPUs ...
Detected VIPT I-cache on CPU1
CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated.
CPU: All CPU(s) started at EL1
CPU features: detected: 32-bit EL0 Support
CPU features: detected: CRC32 instructions
alternatives: applying system-wide alternatives
CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
Memory: 439464K/524288K available (8704K kernel code, 902K rwdata, 2772K rodata, 960K init, 285K bss, 82980K reserved, 0K cma-reserved)
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes, linear)
29312 pages in range for non-PLT usage
520832 pages in range for PLT usage
pinctrl core: initialized pinctrl subsystem
NET: Registered PF_NETLINK/PF_ROUTE protocol family
DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
thermal_sys: Registered thermal governor 'step_wise'
cpuidle: using governor menu
ASID allocator initialised with 65536 entries
/soc@0/phy@86000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
/soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@86000
/soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
/soc@0/phy@86000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
/soc@0/phy@86000: Fixed dependency cycle(s) with /soc@0/clock-controller@1800000
/soc@0/clock-controller@1800000: Fixed dependency cycle(s) with /soc@0/phy@86000
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
qcom_scm: convention: smc arm 64
clocksource: Switched to clocksource arch_sys_counter
NET: Registered PF_INET protocol family
IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
TCP: Hash tables configured (established 4096 bind 4096)
MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
PCI: CLS 0 bytes, default 64
workingset: timestamp_bits=46 max_order=17 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
qcom-pcie a0000000.pcie: host bridge /soc@0/pcie@a0000000 ranges:
qcom-pcie a0000000.pcie:       IO 0x00a0200000..0x00a02fffff -> 0x0000000000
qcom-pcie a0000000.pcie:      MEM 0x00a0300000..0x00b02fffff -> 0x00a0300000
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
msm_serial 78af000.serial: msm_serial: detected port #0
msm_serial 78af000.serial: uartclk = 1843199
78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
msm_serial: console setup on port #0
printk: legacy console [ttyMSM0] enabled
qcom-pcie a0000000.pcie: iATU: unroll T, 8 ob, 8 ib, align 4K, limit 1024G
msm_serial: driver initialized
qcom-pcie a0000000.pcie: PCIe Gen.2 x2 link up
qcom-pcie a0000000.pcie: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [bus 00-ff]
pci_bus 0000:00: root bus resource [io  0x0000-0xfffff]
pci_bus 0000:00: root bus resource [mem 0xa0300000-0xb02fffff]
pci 0000:00:00.0: [17cb:1004] type 01 class 0x060400 PCIe Root Port
pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x00000fff]
pci 0000:00:00.0: PCI bridge to [bus 01-ff]
pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff]
pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff 64bit pref]
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:01:00.0: [17cb:1104] type 00 class 0x028000 PCIe Endpoint
pci 0000:01:00.0: BAR 0 [mem 0x00000000-0x001fffff 64bit]
pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
pci 0000:01:00.0: 8.000 Gb/s available PCIe bandwidth, limited by 5.0 GT/s PCIe x2 link at 0000:00:00.0 (capable of 15.752 Gb/s with 8.0 GT/s PCIe x2 link)
pci 0000:00:00.0: bridge window [mem 0xa0400000-0xa05fffff]: assigned
pci 0000:00:00.0: BAR 0 [mem 0xa0300000-0xa0300fff]: assigned
pci 0000:01:00.0: BAR 0 [mem 0xa0400000-0xa05fffff 64bit]: assigned
pci 0000:00:00.0: PCI bridge to [bus 01-ff]
pci 0000:00:00.0:   bridge window [mem 0xa0400000-0xa05fffff]
pci_bus 0000:00: resource 4 [io  0x0000-0xfffff]
pci_bus 0000:00: resource 5 [mem 0xa0300000-0xb02fffff]
pci_bus 0000:01: resource 1 [mem 0xa0400000-0xa05fffff]
pcieport 0000:00:00.0: PME: Signaling with IRQ 23
pcieport 0000:00:00.0: AER: enabled with IRQ 23
loop: module loaded
spi-nand spi0.0: GigaDevice SPI NAND was found.
spi-nand spi0.0: 512 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
18 fixed-partitions partitions found on MTD device spi0.0
Creating 18 MTD partitions on "spi0.0":
0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000200000 : "0:QSEE"
0x000000200000-0x000000240000 : "0:DEVCFG"
0x000000240000-0x000000280000 : "0:CDT"
0x000000280000-0x000000300000 : "0:APPSBLENV"
0x000000300000-0x000000440000 : "0:APPSBL"
0x000000440000-0x000000540000 : "0:ART"
0x000000540000-0x0000005c0000 : "0:TRAINING"
0x0000005c0000-0x000000640000 : "u_env"
0x000000640000-0x000000680000 : "s_env"
0x000000680000-0x0000006c0000 : "devinfo"
0x0000006c0000-0x0000058c0000 : "kernel"
0x000000ec0000-0x0000058c0000 : "rootfs"
mtd: setting mtd13 (rootfs) as root device
mtdsplit: no squashfs found in "rootfs"
0x0000058c0000-0x00000aac0000 : "alt_kernel"
0x0000060c0000-0x00000aac0000 : "alt_rootfs"
0x00000aac0000-0x00000acc0000 : "sysdiag"
0x00000acc0000-0x00000f0c0000 : "syscfg"
Qualcomm QCA8084 90000.mdio-1:00: probe with driver Qualcomm QCA8084 failed with error -22
Qualcomm QCA8084 90000.mdio-1:01: probe with driver Qualcomm QCA8084 failed with error -22
Qualcomm QCA8084 90000.mdio-1:02: probe with driver Qualcomm QCA8084 failed with error -22
Qualcomm QCA8084 90000.mdio-1:03: probe with driver Qualcomm QCA8084 failed with error -22
Qualcomm QCA8084 90000.mdio-1:04: probe with driver Qualcomm QCA8084 failed with error -22
i2c_dev: i2c /dev entries driver
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
remoteproc remoteproc0: releasing cd00000.remoteproc
NET: Registered PF_INET6 protocol family
Segment Routing with IPv6
In-situ OAM (IOAM) with IPv6
NET: Registered PF_PACKET protocol family
8021q: 802.1Q VLAN Support v1.8
cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 800000 KHz
remoteproc remoteproc0: cd00000.remoteproc is available
qcom-q6-mpd cd00000.remoteproc: pd-1 node found
remoteproc remoteproc1: pd-1 is available
ubi0: attaching mtd15
ubi0: scanning is finished
ubi0: volume 1 ("rootfs_data") re-sized from 9 to 418 LEBs
ubi0: attached mtd15 (name "alt_rootfs", size 74 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 592, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1761942155
ubi0: available PEBs: 0, total reserved PEBs: 592, PEBs reserved for bad PEB handling: 80
ubi0: background thread "ubi_bgt0d" started, PID 567
 VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
Freeing unused kernel memory: 960K
Run /sbin/init as init process
init: Console is alive
init: - watchdog -
random: crng init done
kmodloader: loading kernel modules from /etc/modules-boot.d/*
gpio_button_hotplug: loading out-of-tree module taints kernel.
ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
_adpt_mp_uniphy_clk_output_ctrl_set[264]:INFO:uniphy will output clock as 25000000Hz
regi_init[2548]:INFO:Initializing SCOMPHY Done!!
ssdk_dt_parse_mac_mode[292]:INFO:mac mode doesn't exit!
ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
ssdk_dt_parse[1441]:INFO:switch node is qca83xx!
regi_init[2578]:INFO:qca-ssdk module init, no device found!
nss-dp 39c00000.dp1 (unnamed net_device) (uninitialized): nss_dp_gmac: Registering netdev eth%d(qcom-id:1) with GMAC, mac_base: 0xffffffc081720000
Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc081740000
Generic PHY fixed-0:00: attached PHY driver (mii_bus:phy_addr=fixed-0:00, irq=POLL)
**********************************************************
* NSS Data Plane driver
**********************************************************
kmodloader: done loading kernel modules from /etc/modules-boot.d/*
init: - preinit -
nfig file '/etc/fw_env.config': No such file or directory
NVMEM device
ey and hit [enter] to enter failsafe mode
[2], [3] or [4] key and hit [enter] to select the debug level
UBIFS (ubi0:1): default file-system created
UBIFS (ubi0:1): Mounting in unauthenticated mode
UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 727
UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS (ubi0:1): FS size: 51806208 bytes (49 MiB, 408 LEBs), max 418 LEBs, journal size 2539520 bytes (2 MiB, 20 LEBs)
UBIFS (ubi0:1): reserved for root: 2446934 bytes (2389 KiB)
UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 69503A87-5E0E-42BD-84F4-B6C68C020C20, small LPT model
mount_root: overlay filesystem has not been fully initialized yet
mount_root: switching to ubifs overlay
overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
urandom-seed: Seed file not found (/etc/urandom.seed)
procd: - early -
procd: - watchdog -
procd: - watchdog -
procd: - ubus -
procd: - init -
ter to activate this console.
kmodloader: loading kernel modules from /etc/modules.d/*
urngd: v1.0.2 started.
Loading modules backported from Linux version v6.16-0-g038d61fd6422
Backport generated by backports.git v6.1.145-1-47-g6194bf852a3e
NET: Registered PF_QIPCRTR protocol family
PPP generic driver version 2.4.2
NET: Registered PF_PPPOX protocol family
ath11k c000000.wifi: ipq5018 hw1.0
ath11k c000000.wifi: FW memory mode: 1
remoteproc remoteproc1: powering up pd-1
remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
remoteproc remoteproc0: powering up cd00000.remoteproc
remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
remoteproc remoteproc1: remote processor pd-1 is now up
ath11k_pci 0000:01:00.0: BAR 0 [mem 0xa0400000-0xa05fffff 64bit]: assigned
ath11k_pci 0000:01:00.0: enabling device (0000 -> 0002)
ath11k_pci 0000:01:00.0: MSI vectors: 16
ath11k_pci 0000:01:00.0: qcn9074 hw1.0
ath11k_pci 0000:01:00.0: FW memory mode: 2
ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
mhi mhi0: Requested to power ON
mhi mhi0: Power on setup success
mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
mhi mhi0: Wait for device to enter SBL or Mission mode
kmodloader: done loading kernel modules from /etc/modules.d/*
ath11k_pci 0000:01:00.0: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
ath11k_pci 0000:01:00.0: fw_version 0x290b8862 fw_build_timestamp 2024-09-23 10:51 fw_build_id
mtdblock: MTD device 'devinfo' is NAND, please consider using UBI block devices instead.
ath11k_pci 0000:01:00.0: htt event 48 not handled
nss-dp 39d00000.dp2 wan: PHY Link up speed: 1000

mdio outputs:


root@OpenWrt:~# mdio 9*
 DEV      PHY-ID  LINK
0x04  0x00000000  down
0x05  0x00000000  down
0x10  0x00000000  down
0x11  0x3f003f00  down
0x12  0x00000000  down
0x13  0x00000000  down
0x14  0x00000000  down
0x15  0x00000000  down
0x16  0x00000000  down
0x17  0x00000000  down
0x18  0x00000000  down
0x19  0x00000000  down
0x1a  0x00000000  down
0x1b  0x00000000  down
0x1c  0x00000000  down
0x1d  0x00000000  down
0x1e  0x00000000  down
0x1f  0x00000000  down
root@OpenWrt:~# mdio 8*
 DEV      PHY-ID  LINK
0x00  0x00000000  down
0x01  0x00000000  down
0x02  0x00000000  down
0x03  0x00000000  down
0x04  0x00000000  down
0x05  0x00000000  down
0x06  0x00000000  down
0x07  0x004dd0c0  down
0x08  0x00000000  down
0x09  0x00000000  down
0x0a  0x00000000  down
0x0b  0x00000000  down
0x0c  0x00000000  down
0x0d  0x00000000  down
0x0e  0x00000000  down
0x0f  0x00000000  down
0x10  0x00000000  down
0x11  0x00000000  down
0x12  0x00000000  down
0x13  0x00000000  down
0x14  0x00000000  down
0x15  0x00000000  down
0x16  0x00000000  down
0x17  0x00000000  down
0x18  0x00000000  down
0x19  0x00000000  down
0x1a  0x00000000  down
0x1b  0x00000000  down
0x1c  0x00000000  down
0x1d  0x00000000  down
0x1e  0x00000000  down
0x1f  0x00000000  down
20

This is your issue. The PHY driver doesn’t successfully probe, it fails with EINVAL (22).
Did you check the code what is actually failing?