OpenWrt support for ZBT-Z800AX - IPQ8072A - WiFi6 - 5G Modem (RM520N-GL)

Hello community...

I'm starting this new thread because I think this device could be a good option for Wifi6 router combo and 5G modem with external antenna support.

I'm not experienced enough to do it alone.
So please give your help and ideas to bring openwrt 22.X to this device.

Specifications of ZBT-Z800AX :

Qualcomm IPQ8072A
Qualcomm QCN5024 for 2.4 GHz 4x4 MIMO
Qualcomm QCN5054 for 5 GHz 4x4 MIMO
AX - Wi-Fi 6 Dual-Band 4+4 (2.4GHz, 5GHz)
4-Lanport Gigabit
1-Wan Gigabit
4-external Antenna for 2.4 GHz
4-external Antenna for 5 GHz
4-external Antenna for 5G Module
1-Built in M.2 (for 5G Module)
1-USB 3.0
1-Simcardslot

This is the dts I got from ZBT:

/dts-v1/;
/*
 * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
#include "qcom-ipq807x-soc.dtsi"
#include "qcom-ipq807x-hk-cpu.dtsi"

/ {
	#address-cells = <0x2>;
	#size-cells = <0x2>;
	model = "Qualcomm Technologies, Inc. IPQ807x/AP-HK09";
	compatible = "qcom,ipq807x-hk09", "qcom,ipq807x";
	qcom,msm-id = <0x156 0x0>;
	interrupt-parent = <&intc>;
	qcom,board-id = <0x8 0x0>;
	qcom,pmic-id = <0x0 0x0 0x0 0x0>;

	aliases {
		/*
		 * Aliases as required by u-boot
		 * to patch MAC addresses
		 */
		ethernet0 = "/soc/dp1";
		ethernet1 = "/soc/dp2";
		ethernet2 = "/soc/dp3";
		ethernet3 = "/soc/dp4";
		ethernet4 = "/soc/dp5";
	};

	chosen {
		bootargs = "console=ttyMSM0,115200,n8 root=/dev/ram0 rw \
			init=/init";
		#ifdef __IPQ_MEM_PROFILE_256_MB__
			bootargs-append = " swiotlb=1";
		#else
			bootargs-append = " swiotlb=1 coherent_pool=2M";
		#endif
	};
};

&tlmm {
	pinctrl-0 = <&btcoex_pins>;
	pinctrl-names = "default";

	btcoex_pins: btcoex_pins {
		mux_0 {
			pins = "gpio64";
			function = "pta1_1";
			drive-strength = <6>;
			bias-pull-down;
		};
		mux_1 {
			pins = "gpio65";
			function = "pta1_2";
			drive-strength = <6>;
			bias-pull-down;
		};
		mux_2 {
			pins = "gpio66";
			function = "pta1_0";
			drive-strength = <6>;
			bias-pull-down;
		};
	};

	mdio_pins: mdio_pinmux {
		mux_0 {
			pins = "gpio68";
			function = "mdc";
			drive-strength = <8>;
			bias-pull-up;
		};
		mux_1 {
			pins = "gpio69";
			function = "mdio";
			drive-strength = <8>;
			bias-pull-up;
		};
		mux_2 {
			pins = "gpio25";
			function = "gpio";
			bias-pull-up;
		};
		mux_3 {
			pins = "gpio44";
			function = "gpio";
			bias-pull-up;
		};
	};

	uart_pins: uart_pins {
		mux {
			pins = "gpio23", "gpio24";
			function = "blsp4_uart1";
			drive-strength = <8>;
			bias-disable;
		};
	};

	spi_0_pins: spi_0_pins {
		mux {
			pins = "gpio38", "gpio39", "gpio40", "gpio41";
			function = "blsp0_spi";
			drive-strength = <8>;
			bias-disable;
		};
	};

	qpic_pins: qpic_pins {
		data_0 {
			pins = "gpio15";
			function = "qpic_pad0";
			drive-strength = <8>;
			bias-disable;
		};
		data_1 {
			pins = "gpio12";
			function = "qpic_pad1";
			drive-strength = <8>;
			bias-disable;
		};
		data_2 {
			pins = "gpio13";
			function = "qpic_pad2";
			drive-strength = <8>;
			bias-disable;
		};
		data_3 {
			pins = "gpio14";
			function = "qpic_pad3";
			drive-strength = <8>;
			bias-disable;
		};
		data_4 {
			pins = "gpio5";
			function = "qpic_pad4";
			drive-strength = <8>;
			bias-disable;
		};
		data_5 {
			pins = "gpio6";
			function = "qpic_pad5";
			drive-strength = <8>;
			bias-disable;
		};
		data_6 {
			pins = "gpio7";
			function = "qpic_pad6";
			drive-strength = <8>;
			bias-disable;
		};
		data_7 {
			pins = "gpio8";
			function = "qpic_pad7";
			drive-strength = <8>;
			bias-disable;
		};
		qpic_pad {
			pins = "gpio1", "gpio3", "gpio4",
			       "gpio10", "gpio11", "gpio17";
			function = "qpic_pad";
			drive-strength = <8>;
			bias-disable;
		};
	};

	button_pins: button_pins {
		reset_button {
			pins = "gpio34";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-up;
		};
		
		wps_button {
			pins = "gpio46";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-up;
		};
	};


	led_pins: led_pins {
		wifi1 {
			pins = "gpio42";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};

		wifi0 {
			pins = "gpio43";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};
		
		4g {
			pins = "gpio30";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};
		
		internet {
			pins = "gpio22";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};
		
		//m2 3.8V prwer 
		4g_power {
			pins = "gpio55";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};
	};
/*
	usb_mux_sel_pins: usb_mux_pins {
		mux {
			pins = "gpio27";
			function = "gpio";
			drive-strength = <8>;
			bias-pull-down;
		};
	};
*/
	pcie0_pins: pcie_pins {
		pcie0_rst {
			pins = "gpio58";
			function = "pcie0_rst";
			drive-strength = <8>;
			bias-pull-down;
		};
		pcie0_wake {
			pins = "gpio59";
			function = "pcie0_wake";
			drive-strength = <8>;
			bias-pull-down;
		};
	};

};

&soc {
	gpio_keys {
		compatible = "gpio-keys";
		pinctrl-0 = <&button_pins>;
		pinctrl-names = "default";

		reset {
			label = "reset";
			linux,code = <KEY_RESTART>;
			gpios = <&tlmm 34 GPIO_ACTIVE_LOW>;
			linux,input-type = <1>;
			debounce-interval = <60>;
		};

		wps {
			label = "wps";
			linux,code = <KEY_WPS_BUTTON>;
			gpios = <&tlmm 46 GPIO_ACTIVE_LOW>;
			linux,input-type = <1>;
			debounce-interval = <60>;
		};
	};

	mdio: mdio@90000 {
		pinctrl-0 = <&mdio_pins>;
		pinctrl-names = "default";
		phy-reset-gpio = <&tlmm 37 0>;
		compatible = "qcom,ipq40xx-mdio", "qcom,qca-mdio";
		phy0: ethernet-phy@0 {
			reg = <0>;
		};
		phy1: ethernet-phy@1 {
			reg = <1>;
		};
		phy2: ethernet-phy@2 {
			reg = <2>;
		};
		phy3: ethernet-phy@3 {
			reg = <3>;
		};
		phy4: ethernet-phy@4 {
			reg = <4>;
		};
	};

	ess-switch@3a000000 {
		switch_cpu_bmp = <0x1>;  /* cpu port bitmap */
		switch_lan_bmp = <0x1e>; /* lan port bitmap */
		switch_wan_bmp = <0x20>; /* wan port bitmap */
		switch_mac_mode = <0x0>; /* mac mode for uniphy instance0*/
		switch_mac_mode1 = <0xff>; /* mac mode for uniphy instance1*/
		switch_mac_mode2 = <0xff>; /* mac mode for uniphy instance2*/
		bm_tick_mode = <0>; /* bm tick mode */
		tm_tick_mode = <0>; /* tm tick mode */
		qcom,port_phyinfo {
			port@0 {
				port_id = <1>;
				phy_address = <0>;
			};
			port@1 {
				port_id = <2>;
				phy_address = <1>;
			};
			port@2 {
				port_id = <3>;
				phy_address = <2>;
			};
			port@3 {
				port_id = <4>;
				phy_address = <3>;
			};
			port@4 {
				port_id = <5>;
				phy_address = <4>;
			};
		};
		port_scheduler_resource {
			port@0 {
				port_id = <0>;
				ucast_queue = <0 143>;
				mcast_queue = <256 271>;
				l0sp = <0 35>;
				l0cdrr = <0 47>;
				l0edrr = <0 47>;
				l1cdrr = <0 7>;
				l1edrr = <0 7>;
			};
			port@1 {
				port_id = <1>;
				ucast_queue = <144 159>;
				mcast_queue = <272 275>;
				l0sp = <36 39>;
				l0cdrr = <48 63>;
				l0edrr = <48 63>;
				l1cdrr = <8 11>;
				l1edrr = <8 11>;
			};
			port@2 {
				port_id = <2>;
				ucast_queue = <160 175>;
				mcast_queue = <276 279>;
				l0sp = <40 43>;
				l0cdrr = <64 79>;
				l0edrr = <64 79>;
				l1cdrr = <12 15>;
				l1edrr = <12 15>;
			};
			port@3 {
				port_id = <3>;
				ucast_queue = <176 191>;
				mcast_queue = <280 283>;
				l0sp = <44 47>;
				l0cdrr = <80 95>;
				l0edrr = <80 95>;
				l1cdrr = <16 19>;
				l1edrr = <16 19>;
			};
			port@4 {
				port_id = <4>;
				ucast_queue = <192 207>;
				mcast_queue = <284 287>;
				l0sp = <48 51>;
				l0cdrr = <96 111>;
				l0edrr = <96 111>;
				l1cdrr = <20 23>;
				l1edrr = <20 23>;
			};
			port@5 {
				port_id = <5>;
				ucast_queue = <208 223>;
				mcast_queue = <288 291>;
				l0sp = <52 55>;
				l0cdrr = <112 127>;
				l0edrr = <112 127>;
				l1cdrr = <24 27>;
				l1edrr = <24 27>;
			};
			port@6 {
				port_id = <6>;
				ucast_queue = <224 239>;
				mcast_queue = <292 295>;
				l0sp = <56 59>;
				l0cdrr = <128 143>;
				l0edrr = <128 143>;
				l1cdrr = <28 31>;
				l1edrr = <28 31>;
			};
			port@7 {
				port_id = <7>;
				ucast_queue = <240 255>;
				mcast_queue = <296 299>;
				l0sp = <60 63>;
				l0cdrr = <144 159>;
				l0edrr = <144 159>;
				l1cdrr = <32 35>;
				l1edrr = <32 35>;
			};
		};
		port_scheduler_config {
			port@0 {
				port_id = <0>;
				l1scheduler {
					group@0 {
						sp = <0 1>; /*L0 SPs*/
						/*cpri cdrr epri edrr*/
						cfg = <0 0 0 0>;
					};
				};
				l0scheduler {
					group@0 {
						/*unicast queues*/
						ucast_queue = <0 4 8>;
						/*multicast queues*/
						mcast_queue = <256 260>;
						/*sp cpri cdrr epri edrr*/
						cfg = <0 0 0 0 0>;
					};
					group@1 {
						ucast_queue = <1 5 9>;
						mcast_queue = <257 261>;
						cfg = <0 1 1 1 1>;
					};
					group@2 {
						ucast_queue = <2 6 10>;
						mcast_queue = <258 262>;
						cfg = <0 2 2 2 2>;
					};
					group@3 {
						ucast_queue = <3 7 11>;
						mcast_queue = <259 263>;
						cfg = <0 3 3 3 3>;
					};
				};
			};
			port@1 {
				port_id = <1>;
				l1scheduler {
					group@0 {
						sp = <36>;
						cfg = <0 8 0 8>;
					};
					group@1 {
						sp = <37>;
						cfg = <1 9 1 9>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <144>;
						ucast_loop_pri = <16>;
						mcast_queue = <272>;
						mcast_loop_pri = <4>;
						cfg = <36 0 48 0 48>;
					};
				};
			};
			port@2 {
				port_id = <2>;
				l1scheduler {
					group@0 {
						sp = <40>;
						cfg = <0 12 0 12>;
					};
					group@1 {
						sp = <41>;
						cfg = <1 13 1 13>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <160>;
						ucast_loop_pri = <16>;
						mcast_queue = <276>;
						mcast_loop_pri = <4>;
						cfg = <40 0 64 0 64>;
					};
				};
			};
			port@3 {
				port_id = <3>;
				l1scheduler {
					group@0 {
						sp = <44>;
						cfg = <0 16 0 16>;
					};
					group@1 {
						sp = <45>;
						cfg = <1 17 1 17>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <176>;
						ucast_loop_pri = <16>;
						mcast_queue = <280>;
						mcast_loop_pri = <4>;
						cfg = <44 0 80 0 80>;
					};
				};
			};
			port@4 {
				port_id = <4>;
				l1scheduler {
					group@0 {
						sp = <48>;
						cfg = <0 20 0 20>;
					};
					group@1 {
						sp = <49>;
						cfg = <1 21 1 21>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <192>;
						ucast_loop_pri = <16>;
						mcast_queue = <284>;
						mcast_loop_pri = <4>;
						cfg = <48 0 96 0 96>;
					};
				};
			};
			port@5 {
				port_id = <5>;
				l1scheduler {
					group@0 {
						sp = <52>;
						cfg = <0 24 0 24>;
					};
					group@1 {
						sp = <53>;
						cfg = <1 25 1 25>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <208>;
						ucast_loop_pri = <16>;
						mcast_queue = <288>;
						mcast_loop_pri = <4>;
						cfg = <52 0 112 0 112>;
					};
				};
			};
			port@6 {
				port_id = <6>;
				l1scheduler {
					group@0 {
						sp = <56>;
						cfg = <0 28 0 28>;
					};
					group@1 {
						sp = <57>;
						cfg = <1 29 1 29>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <224>;
						ucast_loop_pri = <16>;
						mcast_queue = <292>;
						mcast_loop_pri = <4>;
						cfg = <56 0 128 0 128>;
					};
				};
			};
			port@7 {
				port_id = <7>;
				l1scheduler {
					group@0 {
						sp = <60>;
						cfg = <0 32 0 32>;
					};
				};
				l0scheduler {
					group@0 {
						ucast_queue = <240>;
						mcast_queue = <296>;
						cfg = <60 0 144 0 144>;
					};
				};
			};
		};
	};

	dp1 {
		device_type = "network";
		compatible = "qcom,nss-dp";
		qcom,id = <1>;
		reg = <0x3a001000 0x200>;
		qcom,mactype = <0>;
		local-mac-address = [000000000000];
		qcom,link-poll = <1>;
		qcom,phy-mdio-addr = <0>;
		phy-mode = "sgmii";
	};

	dp2 {
		device_type = "network";
		compatible = "qcom,nss-dp";
		qcom,id = <2>;
		reg = <0x3a001200 0x200>;
		qcom,mactype = <0>;
		local-mac-address = [000000000000];
		qcom,link-poll = <1>;
		qcom,phy-mdio-addr = <1>;
		phy-mode = "sgmii";
	};

	dp3 {
		device_type = "network";
		compatible = "qcom,nss-dp";
		qcom,id = <3>;
		reg = <0x3a001400 0x200>;
		qcom,mactype = <0>;
		local-mac-address = [000000000000];
		qcom,link-poll = <1>;
		qcom,phy-mdio-addr = <2>;
		phy-mode = "sgmii";
	};

	dp4 {
		device_type = "network";
		compatible = "qcom,nss-dp";
		qcom,id = <4>;
		reg = <0x3a001600 0x200>;
		qcom,mactype = <0>;
		local-mac-address = [000000000000];
		qcom,link-poll = <1>;
		qcom,phy-mdio-addr = <3>;
		phy-mode = "sgmii";
	};

	dp5 {
		device_type = "network";
		compatible = "qcom,nss-dp";
		qcom,id = <5>;
		reg = <0x3a001800 0x200>;
		qcom,mactype = <0>;
		local-mac-address = [000000000000];
		qcom,link-poll = <1>;
		qcom,phy-mdio-addr = <4>;
		phy-mode = "sgmii";
	};

	leds {
		compatible = "gpio-leds";
		pinctrl-0 = <&led_pins>;
		pinctrl-names = "default";

		wifi1 {
			label = "wifi1";
			gpio = <&tlmm 42 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};

		wifi0 {
			label = "wifi0";
			gpio = <&tlmm 43 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};

		4g {
			label = "4g";
			gpio = <&tlmm 30 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};

		internet {
			label = "internet";
			gpio = <&tlmm 22 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};
		
		4g_power {
			label = "4g_power";
			gpio = <&tlmm 55 GPIO_ACTIVE_HIGH>;
			default-state = "off";
		};
	};
};

&serial_blsp4 {
	pinctrl-0 = <&uart_pins>;
	pinctrl-names = "default";
	status = "ok";
};

&spi_0 { /* BLSP1 QUP1 */
	pinctrl-0 = <&spi_0_pins>;
	pinctrl-names = "default";
	cs-select = <0>;
	status = "ok";

	m25p80@0 {
		#address-cells = <1>;
		#size-cells = <1>;
		reg = <0>;
		compatible = "n25q128a11";
		linux,modalias = "m25p80", "n25q128a11";
		spi-max-frequency = <50000000>;
		use-default-sizes;
	};
};

&serial_blsp2 {
	status = "disabled";
};

&msm_imem {
	status = "disabled";
};

&ssphy_0 {
	status = "ok";
};

&qusb_phy_0 {
	status = "ok";
};

&ssphy_1 {
	status = "ok";
};

&qusb_phy_1 {
	status = "ok";
};

&usb3_0 {
	status = "ok";
};

&usb3_1 {
	status = "ok";
};

&cryptobam {
	status = "ok";
};

&crypto {
	status = "ok";
};

&i2c_0 {
	status = "disabled";
};

&i2c_1 {
	status = "disabled";
};

&qpic_bam {
	status = "ok";
};

&nand {
	pinctrl-0 = <&qpic_pins>;
	pinctrl-names = "default";
	status = "ok";
};

&qpic_lcd {
	status = "disabled";
};

&qpic_lcd_panel {
	status = "disabled";
};

&ledc {
	status = "disabled";
};

&pcie0 {
	status = "ok";
};

&pcie1 {
	status = "disabled";
};

&wifi0 {
	qcom,board_id = <0x90>;
};

&wifi1 {
	qcom,board_id = <0x290>;
};
 

other info I have:

dev:    size   erasesize  name
mtd0: 00050000 00010000 "0:SBL1"
mtd1: 00010000 00010000 "0:MIBIB"
mtd2: 00020000 00010000 "0:BOOTCONFIG"
mtd3: 00020000 00010000 "0:BOOTCONFIG1"
mtd4: 00180000 00010000 "0:QSEE"
mtd5: 00180000 00010000 "0:QSEE_1"
mtd6: 00010000 00010000 "0:DEVCFG"
mtd7: 00010000 00010000 "0:DEVCFG_1"
mtd8: 00010000 00010000 "0:APDP"
mtd9: 00010000 00010000 "0:APDP_1"
mtd10: 00040000 00010000 "0:RPM"
mtd11: 00040000 00010000 "0:RPM_1"
mtd12: 00010000 00010000 "0:CDT"
mtd13: 00010000 00010000 "0:CDT_1"
mtd14: 00010000 00010000 "0:APPSBLENV"
mtd15: 000a0000 00010000 "0:APPSBL"
mtd16: 000a0000 00010000 "0:APPSBL_1"
mtd17: 00040000 00010000 "0:ART"
mtd18: 00080000 00010000 "0:ETHPHYFW"
mtd19: 03400000 00020000 "rootfs"
mtd20: 00800000 00020000 "0:WIFIFW"
mtd21: 03400000 00020000 "rootfs_1"
mtd22: 00800000 00020000 "0:WIFIFW_1"

U-Boot 2016.01 (Mar 23 2021 - 11:02:46 +0800)
arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 5.2.0 unknown) 5.2.0
GNU ld (GNU Binutils) 2.24.0

IPQ807x# is_sec_boot_enabled
secure boot fuse is not enabled

output of uboot help

IPQ807x# help
?       - alias for 'help'
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base    - print or set address offset
bdinfo  - print Board Info structure
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootz   - boot Linux zImage image from memory
canary  - test stack canary
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
dm      - Driver model low level access
echo    - echo args to console
env     - environment handling commands
erase   - erase FLASH memory
exectzt - execute TZT

exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
flash   - flash part_name
        flash part_name load_addr file_size

flasherase- flerase part_name

flinfo  - print FLASH memory information
fuseipq - fuse QFPROM registers from memory

go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not

itest   - return true/false on integer compare
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image

setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
uart    - UART sub-system
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version

smem

IPQ807x#  smem
flash_type:             0x6
flash_index:            0x0
flash_chip_select:      0x0
flash_block_size:       0x10000
flash_density:          0x1000000
partition table offset  0x0
No.: Name             Attributes            Start             Size
  0: 0:SBL1           0x0000ffff              0x0          0x50000
  1: 0:MIBIB          0x001040ff          0x50000          0x10000
  2: 0:BOOTCONFIG     0x001040ff          0x60000          0x20000
  3: 0:BOOTCONFIG1    0x001040ff          0x80000          0x20000
  4: 0:QSEE           0x0000ffff          0xa0000         0x180000
  5: 0:QSEE_1         0x0000ffff         0x220000         0x180000
  6: 0:DEVCFG         0x0000ffff         0x3a0000          0x10000
  7: 0:DEVCFG_1       0x0000ffff         0x3b0000          0x10000
  8: 0:APDP           0x0000ffff         0x3c0000          0x10000
  9: 0:APDP_1         0x0000ffff         0x3d0000          0x10000
 10: 0:RPM            0x0000ffff         0x3e0000          0x40000
 11: 0:RPM_1          0x0000ffff         0x420000          0x40000
 12: 0:CDT            0x0000ffff         0x460000          0x10000
 13: 0:CDT_1          0x0000ffff         0x470000          0x10000
 14: 0:APPSBLENV      0x0000ffff         0x480000          0x10000
 15: 0:APPSBL         0x0000ffff         0x490000          0xa0000
 16: 0:APPSBL_1       0x0000ffff         0x530000          0xa0000
 17: 0:ART            0x0000ffff         0x5d0000          0x40000
 18: 0:ETHPHYFW       0x0000ffff         0x610000          0x80000
 19: rootfs           0x0100ffff              0x0        0x3400000
 20: 0:WIFIFW         0x0100ffff        0x3400000         0x800000
 21: rootfs_1         0x0100ffff        0x3c00000        0x3400000
 22: 0:WIFIFW_1       0x0100ffff        0x7000000         0x800000
IPQ807x#

root@Router:/# df -h
Filesystem                Size      Used Available Use% Mounted on
mtd:ubi_rootfs           19.0M     19.0M         0 100% /rom
tmpfs                   432.9M    520.0K    432.4M   0% /tmp
/dev/ubi0_2              17.0M    388.0K     15.7M   2% /overlay
overlayfs:/overlay       17.0M    388.0K     15.7M   2% /
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock26           2.3M      2.3M         0 100% /lib/firmware/IPQ8074/WIFI_FW

IPQ807x#   nand device

Device 0: nand0, sector size 128 KiB
  Page size       2048 b
  OOB size          80 b
  Erase size    131072 b
  subpagesize        0 b
  options     0x       0
  bbt options 0x       0
IPQ807x# nand info

Device 0: nand0, sector size 128 KiB
  Page size       2048 b
  OOB size          80 b
  Erase size    131072 b
  subpagesize        0 b
  options     0x       0
  bbt options 0x       0
Device 1: 25x nand1, sector size 64 KiB
  Page size        256 b
  OOB size           0 b
  Erase size     65536 b
  subpagesize      313 b
  options     0x65746172
  bbt options 0x       0

IPQ807x# sf probe
SPI_ADDR_LEN=3
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
IPQ807x#

I can use tftpboot to load an uImage and mboot starts it

IPQ807x# tftpboot openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb
ipq807x_eth_halt: done
eth0 PHY0 up Speed :1000 Full duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :10 Full duplex
eth0 PHY5 up Speed :10 Full duplex
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.11
Filename 'openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 56304
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
########################################################
879.9 KiB/s
done
Bytes transferred = 11312956 (ac9f3c hex)
ipq807x_eth_halt:
bootm
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@rt5010w-d350-rev0' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.104
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000ec
     Data Size:    11269126 Bytes = 10.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   b2654b81
     Hash algo:    sha1
     Hash value:   f787796571574081ff3ccdbfe0c82c684afa9f07
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@rt5010w-d350-rev0' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt dynalink_dl-wrx36 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x44abf638
     Data Size:    41883 Bytes = 40.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   b249df20
     Hash algo:    sha1
     Hash value:   827d5b08a2cee589612e0c87765bb7991c878dbf
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x44abf638
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f2000, end 4a3ff39a ... OK
fdt-fixup: unable to find compatible node
mtdids not defined, no default present
Could not find PCI in device tree
Using machid 0x8010008 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.104 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22438-d98c4fb8bf) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Mar 27 18:07:54 2023
[    0.000000] Machine model: Dynalink DL-WRX36
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x00000000510fffff]
[    0.000000]   node   0: [mem 0x0000000051100000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 17 pages/cpu s30808 r8192 d30632 u69632
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_1
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 881484K/1048576K available (7808K kernel code, 860K rwdata, 2136K rodata, 7552K init, 289K bss, 167092K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000126] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000142] pid_max: default: 32768 minimum: 301
[    0.000299] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.000317] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.001949] rcu: Hierarchical SRCU implementation.
[    0.002126] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.002658] smp: Bringing up secondary CPUs ...
[    0.003260] Detected VIPT I-cache on CPU1
[    0.003324] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.003958] Detected VIPT I-cache on CPU2
[    0.003997] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.004585] Detected VIPT I-cache on CPU3
[    0.004623] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.004689] smp: Brought up 1 node, 4 CPUs
[    0.004715] SMP: Total of 4 processors activated.
[    0.004723] CPU features: detected: 32-bit EL0 Support
[    0.004730] CPU features: detected: CRC32 instructions
[    0.004779] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.004788] CPU: All CPU(s) started at EL1
[    0.004809] alternatives: patching kernel code
[    0.012344] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.012379] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.012536] pinctrl core: initialized pinctrl subsystem
[    0.013818] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.014256] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.014300] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.014336] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.014672] thermal_sys: Registered thermal governor 'step_wise'
[    0.016147] cpuidle: using governor menu
[    0.016358] ASID allocator initialised with 65536 entries
[    0.068236] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.076994] SCSI subsystem initialized
[    0.077169] usbcore: registered new interface driver usbfs
[    0.077209] usbcore: registered new interface driver hub
[    0.077247] usbcore: registered new device driver usb
[    0.077633] qcom_scm: convention: smc arm 64
[    0.078984] clocksource: Switched to clocksource arch_sys_counter
[    0.079771] NET: Registered PF_INET protocol family
[    0.079916] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.080835] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.080867] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.080883] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.080970] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.081121] TCP: Hash tables configured (established 8192 bind 8192)
[    0.081215] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.081255] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.081429] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.081461] PCI: CLS 0 bytes, default 64
[    0.101269] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.105192] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.105223] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.106033] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.107750] qcom-qmp-phy 78000.phy: supply vdda-phy not found, using dummy regulator
[    0.107938] qcom-qmp-phy 78000.phy: supply vdda-pll not found, using dummy regulator
[    0.109062] qcom-qmp-phy 78000.phy: Registered Qcom-QMP phy
[    0.109948] qcom-qusb2-phy 79000.phy: supply vdda-pll not found, using dummy regulator
[    0.110101] qcom-qusb2-phy 79000.phy: supply vdda-phy-dpdm not found, using dummy regulator
[    0.110258] qcom-qusb2-phy 79000.phy: Registered Qcom-QUSB2 phy
[    0.114424] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[    0.114448] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[    0.118259] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.120065] msm_serial 78b3000.serial: msm_serial: detected port #0
[    0.120131] msm_serial 78b3000.serial: uartclk = 3686400
[    0.120189] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 22, base_baud = 230400) is a MSM
[    0.120227] msm_serial: console setup on port #0
[    0.753471] printk: console [ttyMSM0] enabled
[    0.758604] msm_serial: driver initialized
[    0.766543] loop: module loaded
[    0.766619] Loading iSCSI transport class v2.0-870.
[    0.771342] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa
[    0.774289] nand: Macronix MX30UF2G28AD
[    0.781110] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    0.784460] Block protection check failed
[    0.800261] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    0.803308] s1: supplied by regulator-dummy
[    0.805159] s2: supplied by regulator-dummy
[    0.809229] vdd_s3: supplied by regulator-dummy
[    0.813467] vdd_s4: supplied by regulator-dummy
[    0.817961] s5: supplied by regulator-dummy
[    0.822352] l1: supplied by regulator-dummy
[    0.826525] l2: supplied by regulator-dummy
[    0.830699] l3: supplied by regulator-dummy
[    0.834856] l4: supplied by regulator-dummy
[    0.839015] l5: supplied by regulator-dummy
[    0.843171] l6: supplied by regulator-dummy
[    0.847356] l7: supplied by regulator-dummy
[    0.851523] l8: supplied by regulator-dummy
[    0.855667] l9: supplied by regulator-dummy
[    0.859988] l11: supplied by regulator-dummy
[    0.864007] l12: supplied by regulator-dummy
[    0.868524] l13: supplied by regulator-dummy
[    0.921507] i2c_dev: i2c /dev entries driver
[    0.925378] sdhci: Secure Digital Host Controller Interface driver
[    0.925420] sdhci: Copyright(c) Pierre Ossman
[    0.930867] sdhci-pltfm: SDHCI platform and OF driver helper
[    0.938567] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[    0.943424] NET: Registered PF_INET6 protocol family
[    0.947496] Segment Routing with IPv6
[    0.951896] In-situ OAM (IOAM) with IPv6
[    0.955459] NET: Registered PF_PACKET protocol family
[    0.959447] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.964361] 8021q: 802.1Q VLAN Support v1.8
[    0.993180] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[    0.993475] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    0.999469] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    1.005907] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    1.013581] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    1.021081] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    1.030219] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    1.037160] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 824000 uV
[    1.047150] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused    TURBO: open-loop= 888000 uV
[    1.056958] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused   STURBO: open-loop= 968000 uV
[    1.066814] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 707, quot_offset[ 7]=   0
[    1.076580] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 943, quot_offset[ 7]= 235
[    1.087429] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused    TURBO: quot[ 7]=1055, quot_offset[ 7]= 110
[    1.098365] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused   STURBO: quot[ 7]=1204, quot_offset[ 7]= 145
[    1.109455] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    1.111740] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa
[    1.126998] nand: Macronix MX30UF2G28AD
[    1.133431] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    1.136995] Block protection check failed
[    1.151781] 23 qcomsmem partitions found on MTD device qcom_nand.0
[    1.151828] Creating 23 MTD partitions on "qcom_nand.0":
[    1.156864] 0x000000000000-0x0000000a0000 : "0:sbl1"
[    1.163455] 0x0000000a0000-0x0000000c0000 : "0:mibib"
[    1.167787] 0x0000000c0000-0x000000100000 : "0:bootconfig"
[    1.172889] 0x000000100000-0x000000140000 : "0:bootconfig1"
[    1.178200] 0x000000140000-0x000000440000 : "0:qsee"
[    1.185983] 0x000000440000-0x000000740000 : "0:qsee_1"
[    1.191167] 0x000000740000-0x000000760000 : "0:devcfg"
[    1.193731] 0x000000760000-0x000000780000 : "0:devcfg_1"
[    1.198838] 0x000000780000-0x0000007a0000 : "0:apdp"
[    1.204351] 0x0000007a0000-0x0000007c0000 : "0:apdp_1"
[    1.209304] 0x0000007c0000-0x000000840000 : "0:rpm"
[    1.214520] 0x000000840000-0x0000008c0000 : "0:rpm_1"
[    1.219330] 0x0000008c0000-0x0000008e0000 : "0:cdt"
[    1.224192] 0x0000008e0000-0x000000900000 : "0:cdt_1"
[    1.228885] 0x000000900000-0x000000920000 : "0:appsblenv"
[    1.234142] 0x000000920000-0x000000a60000 : "0:appsbl"
[    1.240449] 0x000000a60000-0x000000ba0000 : "0:appsbl_1"
[    1.245441] 0x000000ba0000-0x000000c20000 : "0:art"
[    1.250332] 0x000000c20000-0x000000d20000 : "0:ethphyfw"
[    1.255298] 0x000000000000-0x000003400000 : "rootfs"
[    1.303077] mtd: setting mtd19 (rootfs) as root device
[    1.303368] mtdsplit: no squashfs found in "rootfs"
[    1.307145] 0x000003400000-0x000003c00000 : "0:wififw"
[    1.318951] 0x000003c00000-0x000007000000 : "rootfs_1"
[    1.362504] 0x000007000000-0x000007800000 : "0:wififw_1"
[    1.377301] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 19200 KHz, changing to: 1017600 KHz
[   [    1.390937] Freeing unused kernel memory: 7552K
[    1.429430] Run /init as init process
[    1.572123] init: Console is alive
[    1.572267] init: - watchdog -
[    1.578921] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.598517] ssdk_switch_device_num_init[1335]:INFO:ess-switch dts node number: 1
[    1.598613] ssdk_dt_get_switch_node[1124]:INFO:ess-switch DT exist!
[    1.605041] ssdk_dt_parse_access_mode[999]:INFO:switch_access_mode: local bus
[    1.610983] ssdk_dt_parse_access_mode[1012]:INFO:switchreg_base_addr: 0x3a000000
[    1.618269] ssdk_dt_parse_access_mode[1013]:INFO:switchreg_size: 0x1000000
[    1.625740] ssdk_dt_parse_mac_mode[327]:INFO:mac mode = 0xb
[    1.632426] ssdk_dt_parse_mac_mode[336]:INFO:mac mode1 = 0xff
[    1.637884] ssdk_dt_parse_mac_mode[345]:INFO:mac mode2 = 0xc
[    1.643808] ssdk_dt_parse_phy_info[716]:INFO:[PORT 6] port_mac_sel = QGMAC_PORT
[    1.649575] ssdk_dt_parse_uniphy[364]:INFO:ess-uniphy DT exist!
[    1.656652] ssdk_dt_parse_intf_mac[942]:INFO:dp1 MAC xx:xx:xx:xx:xx:xx
[    1.662485] ssdk_dt_parse_intf_mac[942]:INFO:dp2 MAC xx:xx:xx:xx:xx:xx
[    1.669080] ssdk_dt_parse_intf_mac[942]:INFO:dp3 MAC xx:xx:xx:xx:xx:xx
[    1.675584] ssdk_dt_parse_intf_mac[942]:INFO:dp4 MAC xx:xx:xx:xx:xx:xx
[    1.682172] ssdk_plat_init[1692]:INFO:ssdk_plat_init start
[    1.800282] ssdk_gcc_clock_init[1275]:INFO:SSDK gcc clock init successfully!
[    1.801385] ssdk_phy_driver_init[363]:INFO:dev_id = 0, phy_adress = 28, phy_id = 0xffffffff phytype doesn't match
[    1.806413] malibu_phy_api_ops_init[2846]:INFO:qca probe malibu phy driver succeeded!
[    1.820572] hsl_phy_phydev_get[773]:ERROR:phy_addr 4 phydev is NULL
[    1.825486] regi_init[3953]:INFO:Initializing HPPE!!
[    2.068999] ssdk_ppe_reset_init[1535]:INFO:ppe reset successfully!
[    2.072594] qca_hppe_portctrl_hw_init[126]:INFO:Hawkeye PPE port initializing
[    2.075286] hsl_phy_phydev_get[773]:ERROR:phy_addr 4 phydev is NULL
[    2.081669] hsl_phy_phydev_get[773]:ERROR:phy_addr 4 phydev is NULL
[    2.765079] ssdk_switch_register[2017]:INFO:Chip version 0x1500
[    2.765109] qca_link_polling_select[1487]:INFO:link-polling-required node does not exist
[    2.769809] ssdk_switch_register[2043]:INFO:polling is selected
[    2.778134] regi_init[3957]:INFO:Initializing HPPE Done!!
[    2.783857] ssdk_genl_init[211]:INFO:ssdk genl family register success.
[    2.789341] regi_init[4020]:INFO:qca-ssdk module init succeeded!
[    2.798235] EDMA ver 1 hw init
[    2.802240] EDMA HW Reset completed succesfully
[    2.804894] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[    2.809297] RxDesc:1 (15-15) RxFill:1 (7-7)
[    2.815090] Generic PHY 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=POLL)
[    2.819255] nss-dp 3a001000.dp1 lan4: Registered netdev lan4(qcom-id:1)
[    2.828677] Generic PHY 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL)
[    2.835410] nss-dp 3a001200.dp2 lan3: Registered netdev lan3(qcom-id:2)
[    2.844836] Generic PHY 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=POLL)
[    2.851509] nss-dp 3a001400.dp3 lan2: Registered netdev lan2(qcom-id:3)
[    2.861019] Generic PHY 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL)
[    2.867702] nss-dp 3a001600.dp4 lan1: Registered netdev lan1(qcom-id:4)
[    2.877312] Generic PHY 90000.mdio-1:1c: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:1c, irq=POLL)
[    2.883845] nss-dp 3a007000.dp6-syn wan: Registered netdev wan(qcom-id:6)
[    2.893091] **********************************************************
[    2.899753] * NSS Data Plane driver
[    2.906161] **********************************************************
[    2.917142] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    2.917191] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    2.921808] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000000002010010
[    2.929226] xhci-hcd xhci-hcd.1.auto: irq 89, io mem 0x08a00000
[    2.938626] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    2.944457] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    2.950015] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    2.958039] hub 1-0:1.0: USB hub found
[    2.964314] hub 1-0:1.0: 1 port detected
[    2.968193] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    2.972216] hub 2-0:1.0: USB hub found
[    2.980057] hub 2-0:1.0: 1 port detected
[    2.985405] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.994341] init: - preinit -
[    3.048263] random: jshn: uninitialized urandom read (4 bytes read)
[    3.063547] random: jshn: uninitialized urandom read (4 bytes read)
[    3.071983] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.089836] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
[    4.120783] usb 2-1: LPM exit latency is zeroed, disabling LPM.
[    5.152501] procd: - early -
[    5.152602] procd: - watchdog -
[    5.676984] procd: - watchdog -
[    5.677232] procd: - ubus -
[    5.681584] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.728837] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.729023] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.735135] procd: - init -
Please press Enter to activate this console.
[    5.825724] urngd: v1.0.2 started.
[    5.839334] random: crng init done
[    5.839369] random: 26 urandom warning(s) missed due to ratelimiting
[    5.841609] kmodloader: loading kernel modules from /etc/modules.d/*
[    5.873610] Loading modules backported from Linux version v6.1-rc8-0-g76dcd734eca2
[    5.873646] Backport generated by backports.git v5.15.81-1-41-g02e352527db5
[    5.883661] NET: Registered PF_QIPCRTR protocol family
[    5.908956] PPP generic driver version 2.4.2
[    5.909620] NET: Registered PF_PPPOX protocol family
[    5.917908] ath11k c000000.wifi: ipq8074 hw2.0
[    5.917941] ath11k c000000.wifi: FW memory mode: 0
[    5.921837] remoteproc remoteproc0: powering up cd00000.q6v5_wcss
[    5.926369] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668
[    6.286112] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up
[    6.288067] ath11k c000000.wifi: qmi ignore invalid mem req type 3
[    6.293138] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff
[    6.298577] ath11k c000000.wifi: fw_version 0x250a04a5 fw_build_timestamp 2021-12-20 07:09 fw_build_id WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
[    6.308226] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.352329] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=Dynalink-DL-WRX36 from ath11k/IPQ8074/hw2.0/board-2.bin
[    6.352394] ath11k c000000.wifi: failed to fetch board data for bus=ahb,qmi-chip-id=0,qmi-board-id=255 from ath11k/IPQ8074/hw2.0/board-2.bin
[    6.366208] ath11k c000000.wifi: failed to fetch board.bin from IPQ8074/hw2.0
[    6.378885] ath11k c000000.wifi: qmi failed to fetch board file: -12
[    6.385893] ath11k c000000.wifi: failed to load board data file: -12
[    9.271903] br-lan: port 1(lan1) entered blocking state
[    9.271949] br-lan: port 1(lan1) entered disabled state
[    9.276160] device lan1 entered promiscuous mode
[    9.288149] br-lan: port 2(lan2) entered blocking state
[    9.288193] br-lan: port 2(lan2) entered disabled state
[    9.292478] device lan2 entered promiscuous mode
[    9.299962] br-lan: port 3(lan3) entered blocking state
[    9.302262] br-lan: port 3(lan3) entered disabled state
[    9.307401] device lan3 entered promiscuous mode
[    9.314391] nss-dp 3a001000.dp1 lan4: PHY Link up speed: 1000
[    9.317857] br-lan: port 4(lan4) entered blocking state
[    9.323028] br-lan: port 4(lan4) entered disabled state
[    9.328162] device lan4 entered promiscuous mode
[   10.329052] br-lan: port 4(lan4) entered blocking state
[   10.329108] br-lan: port 4(lan4) entered forwarding state
[   10.333334] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   31.849019] l11:
BusyBox v1.36.0 (2023-03-27 18:07:54 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r22438-d98c4fb8bf
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

from here I need the community ...
Thanks for any help or idea

I took your openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb
and I was able to boot into it. but after that i'm stocking, because I'm not able to boot into any factory.ubi after I took them to my (mtd19&mtd21).

It shouldn't be too hard, then... Check out a similar commit, pick the Dynalink DL-WRX36 since it booted for you and do about the same for your device:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=26c095cb4d27428acedf1b738507a585f1585fe4

What might also help is the developer documentation in the Wiki (but you've already got most of the required bits): https://openwrt.org/docs/guide-developer/add.new.device

NB: I'm not familiar with the IPQ platforms, I've only done other targets, so these instructions are relatively generic.

And don't forget to take a full backup from the initramfs image, just in case...

I have already tried different images (AX9000, WRX36) the respective uImages work, but none of the factory images can be started.

I have already made a full backup. So far I could always go back to my original image.

What are you trying to achieve with the factory images? Are you looking for a way to install from the OEM firmware?

I just took the way to bring openwrt to my device.
For WRX36 or AX9000 it is:

1.) Boot initramfs from tftpboot (ie openwrt-ipq807x-generic-dynalink_dl-wrx36-initramfs-uImage.itb)

2.) Install OpenWrt from initramfs image to mtd (ie openwrt-ipq807x-generic-dynalink_dl-wrx36-squashfs-factory.ubi)

3.) do a sysupgrade (ie openwrt-ipq807x-generic-dynalink_dl-wrx36-squashfs-sysupgrade.bin)

this is what I found, just in short words...

I can do 1.) without problems
I can do 2.) installing to mtd works, but it´s not booting into it.
that's where I'm always stuck at the moment

If I just get it starting from there, it would be a milestone.

If you know a differnt way to get openwrt to the device, I´m open for every approach

Sorry, I'm not familiar enough with the IPQ devices, hence I deleted this post.

Do not even think about flashing the factory images of another device, you will hard-brick your device. It's now your turn (as you're the only one with the hardware on your desk) to modify the initramfs images to match your hardware, to get everything working on a self-built initramfs image and to double-/ triple check the NAND partitioning in particular, only after that ("everything") is working, you can start thinking about adding a sysupgrade image to your own image recipes - a factory image would then be the icing on the top, but it comes pretty much last.

On these NAND based devices, if you kill the bootloader (because your flash partitions don't match up with the way ZBT has set them up) or the wireless calibration data (ART), it's game over - as you can't recover from a broken bootloader on NAND easily.

1 Like

ok, but how can I modify the initramfs ?
Is there any HowToDo ?

i'm ready to learn

Please see my first post, I already told you and showed you everything that is required!

this I checked, but it seems more for the ramips and different RAM.
And the WRX36 part I already tried without success

I would need to have more something like a rawmodel from any other nand whitch i can study und modify to my needs...
or a way to make my own image at all.

Sorry, I somewhat assumed that your dev environment is already set up.
So first, you would want to set up a development environment to be able to build images:

I usually follow this guide:

But if you need more background information, check out these two guides:

and

Once your build system is in place, have a look at the Dynalink commit that I referenced. This contains all the required changes for adding a new device in the ipq807x target.

Thanks for the info, I'll try to read it up...

but regardless, I still have questions.

Since the router has the same data twice (mtd19&mtd21 with watchdog), wouldn't it be possible to create a dual boot with it?
So 1.) original and 2.) openwrt22.x ?

How can I decide for myself which MTD the router boots into?

OpenWrt doesn't support dual-boot well (only for some devices). Usually, the developer decides if partition 1 or partition 2 is used - so it's up to you to decide. I usually go with partition 1 for OpenWrt as most other images do as well (there are exceptions).
OpenWrt has a look at the kernel command line passed in by the bootloader and uses it as rootfs or it looks for a partition called "ubi" and uses that. Sometimes, you need to overwrite the kernel command line if its contents doesn't work with OpenWrt.

but do I need to replace both mtd? would it be ok just to change partition1 and leave the other one as it is? or is watchdog comparing ?

This is something that you will have to find out (watchdog). You can of course just use one partition, this is also your job to figure out (when you create your .dts you need to decide on a partition layout).

I have started to work on building openwrt to run on z800ax router. I took the hint by tschii about tftpboot the wrx36 image on z800ax router. So I got the source code for wrx36, and built the image. Then I did tftpvoot as he mentioned earlier. The bootm did boot all the way to the shell prompt came up. The LAN port worked. But not the WAN interface. I then modified the dts file about the wan port to map to dp5, instead of dp6_sync. Now the wan port is kind of responsive, but still not fully working. By that I meant, if I plug or pull out the cable from wan socket, dmesg did show "nss-dp 3a001800.dp5 wan: PHY Link is down/up speed:1000". So that proves the wan socket on z800ax was indeed connected to dp5. Then ifconfig wan output would show some tx packets, but not any rx packets. So dhcp would not work. Anybody can provide insight? I am not really familiar with dts for ipq8072. So I may have made some mistake while updating the dts file.