Thanks for the hint to test directly on the SOC. I've found RX and TX to be TP4 & TP5 on the backside.
Orginial Bootlog:
U-Boot 1.1.4 (Jun 7 2016 - 16:58:04)
ap151 - Dragonfly 1.0
DRAM: 64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 341k for U-Boot at: 83fa8000
Reserving 32832k for malloc() at: 81f98000
Reserving 44 Bytes for Board Info at: 81f97fd4
Reserving 36 Bytes for Global Data at: 81f97fb0
Reserving 128k for boot params() at: 81f77fb0
Stack Pointer at: 81f77f98
Now running in RAM - U-Boot at: 83fa8000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :50
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :50
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :50
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :50
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
Autobooting in 1 seconds
## Booting image at 9f020000 ...
Image Name: MIPS OpenWrt Linux-3.3.8
Created: 2016-06-07 6:35:41 UTC
Image Type: MIPS Linux Multi-File Image (lzma compressed)
Data Size: 1069823 Bytes = 1 MB
Load Address: 80060000
Entry Point: 80060000
Contents:
Image 0: 1069815 Bytes = 1 MB
Verifying Checksum at 0x9f020040 ...OK
Uncompressing Multi-File Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864
Starting kernel ...
[ 0.000000] Linux version 3.3.8 (tplink@tplink) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Tue Jun 7 14:35:30 HKT 2016
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA956X rev 0
[ 0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] Early memory PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00004000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS0,115200 board=AP151 rootfstype=squashfs init=/etc/preinit mtdparts=spi0.0:128k(u-boot),1056k(uImage),6944k(rootfs),64k@0x7f0000(ART) mem=64M rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 61308k/65536k available (2283k kernel code, 4228k reserved, 565k data, 180k init, 0k highmem)
[ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:83
[ 0.000000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.060000] pid_max: default: 32768 minimum: 301
[ 0.060000] Mount-cache hash table entries: 512
[ 0.070000] NET: Registered protocol family 16
[ 0.070000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
[ 0.080000] MIPS: machine is Qualcomm Atheros AP151 reference board
[ 0.080000] registering PCI controller with io_map_base unset
[ 0.090000] ar71xx: invalid MDIO id 1
[ 0.490000] bio: create slab <bio-0> at 0
[ 0.500000] PCI host bridge to bus 0000:00
[ 0.500000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.510000] pci_bus 0000:00: root bus resource [io 0x0001]
[ 0.510000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 0.520000] pci 0000:00:00.0: using irq 40 for pin 1
[ 0.520000] Switching to clocksource MIPS
[ 0.530000] NET: Registered protocol family 2
[ 0.530000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.530000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.540000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.540000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.550000] TCP reno registered
[ 0.550000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.560000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.560000] NET: Registered protocol family 1
[ 0.580000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.580000] msgmni has been set to 119
[ 0.590000] io scheduler noop registered
[ 0.590000] io scheduler deadline registered (default)
[ 0.600000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.620000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[ 0.630000] console [ttyS0] enabled, bootconsole disabled
[ 0.630000] console [ttyS0] enabled, bootconsole disabled
[ 0.640000] m25p80 spi0.0: found s25fl064k, expected m25p80
[ 0.650000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[ 0.650000] 4 cmdlinepart partitions found on MTD device spi0.0
[ 0.660000] Creating 4 MTD partitions on "spi0.0":
[ 0.660000] 0x000000000000-0x000000020000 : "u-boot"
[ 0.670000] 0x000000020000-0x000000128000 : "uImage"
[ 0.680000] mtd: partition "uImage" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.690000] 0x000000128000-0x0000007f0000 : "rootfs"
[ 0.690000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.710000] mtd: partition "rootfs" set to be root filesystem
[ 0.710000] 0x0000007f0000-0x000000800000 : "ART"
[ 0.720000] flash_chrdev : flash_chrdev_init
[ 0.740000] ag71xx_mdio: probed
[ 0.870000] ag71xx_mdio: probed
[ 0.870000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[ 0.880000] [ag71xx_hw_stop:458]
[ 1.430000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:00 [uid=004dd042, driver=Generic PHY]
[ 1.440000] [ag71xx_phy_connect_multi:166]
[ 1.450000] eth1: Atheros AG71xx at 0xba000000, irq 5
[ 1.450000] [ag71xx_hw_stop:458]
[ 2.010000] eth1: Found an AR934X built-in switch
[ 3.040000] [ar7240sw_reset:669]
[ 3.040000] [ag71xx_ar7240_init:1311]
[ 3.040000] TCP cubic registered
[ 3.050000] NET: Registered protocol family 17
[ 3.050000] Bridge firewalling registered
[ 3.060000] 8021q: 802.1Q VLAN Support v1.8
[ 3.060000] ### of_selftest(): No testcase data in device tree; not running tests
[ 3.070000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 3.080000] Freeing unused kernel memory: 180k freed
[ 4.770000] [ag71xx_phy_start:57]
[ 4.770000] [ag71xx_hw_start:555]ag71xx_hw_start
[ 4.780000] [ag71xx_open:737]
- preinit -
- regular preinit -
jffs2 not ready yet; using ramdisk
- init -
[ 5.160000] [ag71xx_hw_stop:458]
[ 5.170000] [ag71xx_rings_cleanup:348]ag71xx_rings_cleanup
[ 5.170000] [ag71xx_stop:763]
[ 5.890000] liblog: module license 'unspecified' taints kernel.
[ 5.900000] Disabling lock debugging due to kernel taint
[ 6.190000] NET: Registered protocol family 10
[ 6.370000] SCSI subsystem initialized
[ 6.510000] Button Hotplug driver version 0.4.1
[ 6.540000] PPP generic driver version 2.4.2
[ 6.560000] tun: Universal TUN/TAP device driver, 1.6
[ 6.570000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 6.600000] PPP MPPE Compression module registered
[ 6.680000] L2TP core driver, V2.0
[ 6.690000] L2TP netlink interface
[ 6.700000] IPv6 over IPv4 tunneling driver
[ 6.760000] GRE over IPv4 demultiplexor driver
[ 6.780000] GRE over IPv4 tunneling driver
[ 6.850000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 6.990000] NET: Registered protocol family 24
[ 7.120000] nf_conntrack version 0.5.0 (960 buckets, 3840 max)
[ 7.300000] PPPoL2TP kernel driver, V2.0
[ 7.380000] PPTP driver version 0.8.5
[ 7.710000] xt_time: kernel timezone is -0000
[ 8.070000] nf_conntrack_rtsp v0.6.21 loading
[ 8.080000] nf_nat_rtsp v0.6.21 loading
[ 8.110000] Netfilter messages via NETLINK v0.30.
[ 8.120000] ctnetlink v0.93: registering with nfnetlink.
[ 8.190000] ssdk_plat_init start
[ 8.190000] chip_version:0x0
[ 8.200000] chip_version:0x2
[ 8.200000] Register QCA PHY driver
[ 8.200000] register switch!!
[ 8.220000] qca-ssdk module init succeeded!
reloadconfig() begin:
reloadconfig() end:
reload_profile() begin:
reload_profile() end:
sh: iqos-db-parser: not found
Please press Enter to activate this console. GMT+00:00
Fri Jan 1 00:00:00 GMT 2016
[ 12.640000] [ar7240sw_reset:669]
[ 12.640000] [ag71xx_hw_start:555]ag71xx_hw_start
[ 12.650000] [ag71xx_open:737]
[ 12.660000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 14.010000] [ag71xx_phy_start:57]
[ 14.020000] [ag71xx_hw_start:555]ag71xx_hw_start
[ 14.020000] [ag71xx_open:737]
[ 14.040000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 14.520000] ADDRCONF(NETDEV_UP): lo: link is not ready
[ 14.530000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 14.530000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 14.540000] ADDRCONF(NETDEV_UP): ip6tnl0: link is not ready
[ 14.550000] ADDRCONF(NETDEV_UP): sit0: link is not ready
[ 14.550000] ADDRCONF(NETDEV_UP): gre0: link is not ready
Loading defaults
Loading synflood protection
Adding custom chains
Loading zones
Loading forwardings
Loading rules
Loading redirects
Loading includes
Optimizing conntrack
Loading interfaces
Loading tpcmd
loading access_control
loading basic_security
[ 19.320000] device eth1 entered promiscuous mode
[ 19.320000] ADDRCONF(NETDEV_UP): br-lan: link is not ready
conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied.
Normal env generate
Flush nat forwarding chain
loading administration management
fw unload_local_mgnt
loading parental_control
WPA_DEBUG(tddp.c:149)====>tddp task start
[ 37.770000] ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
[ 37.880000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[ 37.900000] ath_tx99: Version 2.0
[ 37.900000] Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
[ 38.060000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[ 38.920000] __ath_attach: Set global_scn[0]
[ 38.920000] *** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
[ 38.930000] ACBKMinfree = 48
[ 38.940000] ACBEMinfree = 32
[ 38.940000] ACVIMinfree = 16
[ 38.940000] ACVOMinfree = 0
[ 38.940000] CABMinfree = 48
[ 38.950000] UAPSDMinfree = 0
[ 38.950000] ATH_TXBUF=2700
[ 38.960000] Enterprise mode: 0x03bda000
[ 38.970000] Restoring Cal data from DRAM
[ 38.970000]
[ 38.970000] ART Version : -48.0.0
[ 38.970000] SW Image Version : -48.0.0.0.0
[ 38.980000] Board Revision :
[ 38.980000] ar9300_attach: nf_2_nom -110 nf_2_max -60 nf_2_min -125
[ 38.990000] ath_get_caps[6291] rx chainmask mismatch actual 7 sc_chainmak 0
[ 39.000000] ath_get_caps[6266] tx chainmask mismatch actual 7 sc_chainmak 0
[ 39.020000] ath_tx_paprd_init sc 821d8000 PAPRD Enabled
[ 39.030000] wifi0: Atheros 956X: mem=0xb8100000, irq=47
[ 39.030000] ath_pci: (Atheros/multi-bss)
[ 39.040000] ol_ath_pci_probe: PCI device id 0056 :0056
[ 39.040000] ath_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 39.050000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[ 39.060000] *********** Besra *************
[ 39.060000] ath_pci 0000:00:00.0: ath DEBUG: sc=0x821ccc00
[ 39.070000]
[ 39.070000] ol_ath_pci_configure : num_desired MSI set to 0
[ 39.080000]
[ 39.080000] Using PCI Legacy Interrupt
[ 39.080000] chip_id 0xc chip_revision 0x0
[ 39.100000]
[ 39.100000] CLOCK PLL skipped
[ 39.100000] HIF_PCIDeviceProbed: setting the target pll frac ffffffff intval ffffffff
[ 39.110000] HIF_PCIDeviceProbed: no frac provided, skipping pre-configuring PLL
[ 39.120000] __ol_ath_attach: dev name wifi1
[ 39.120000] ol_ath_attach() BMI inited.
[ 39.130000] ol_ath_attach() BMI Get Target Info.
[ 39.140000] Chip id: 0xc, chip version: 0x1000000
[ 39.140000]
[ 39.140000] CE WAR Disabled
[ 39.210000] NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
[ 39.220000] ol_ath_attach() configure Target .
[ 39.220000]
[ 39.220000] Target Version is 1000000
[ 39.230000]
[ 39.230000] Flash Download Address c0000
[ 39.230000] ol_transfer_bin_file: flash data file defined
[ 39.240000] Cal location [0]: 00004000
[ 39.240000]
[ 39.240000] wifi1 NAND FLASH Select OFFSET 0x5000
[ 39.260000] qc98xx_verify_checksum: flash checksum passed: 0xf5a1
[ 39.270000] ol_transfer_bin_file 3903: Download Flash data len 12064
[ 39.280000] Board extended Data download address: 0x0
[ 39.360000]
[ 39.360000] Board data initialized
[ 39.370000] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
[ 39.380000]
[ 39.380000] Selecting OTP binary for CHIP Version 0
[ 39.510000] ol_transfer_bin_file 3738: downloading file 0, Download data len 8568
[ 39.550000]
[ 39.550000] First OTP send param 8000
[ 39.790000] ol_ath_download_firmware :First OTP download and Execute is good address:0x5000 return param 4660
[ 39.800000] ol_ath_download_firmware:##Board Id 20 , CHIP Id 0
[ 39.810000] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
[ 39.820000] Warning : No board id matched. Selecting default boarddata file
[ 39.820000]
[ 39.820000] wifi1: Selecting board data file name boarddata_0.bin
[ 39.830000] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9888/hw.1/boarddata_0.bin
[ 39.850000] ol_transfer_bin_file 3738: downloading file 3, Download data len 12064
[ 39.860000] Board extended Data download address: 0x0
[ 39.890000] ol_ath_download_firmware: Using 0x1234 for the remainder of init
[ 39.900000]
[ 39.900000] Selecting OTP binary for CHIP Version 0
[ 39.920000] ol_transfer_bin_file 3738: downloading file 0, Download data len 8568
[ 39.960000]
[ 39.960000] [Flash] : Ignore Module param
[ 39.960000]
[ 39.960000] Second otp download Param 10000
[ 40.220000] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0
[ 40.230000]
[ 40.230000] Mission mode: Firmware CHIP Version 0
[ 40.250000] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144
[ 40.370000] Swap: bytes_left to copy: fw:16; dma_page:82233
[ 40.380000] Swap: wrong length read:0
[ 40.380000] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 179911 Target address 418850
[ 40.390000] scn=823c0380 target_write_addr=418850 seg_info=821d6010
[ 40.400000] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2
[ 40.410000] bin_filename=QCA9888/hw.1/athwlan.bin swap_filename=/lib/firmware/QCA9888/hw.1/athwlan.codeswap.bin
[ 40.420000] ol_transfer_bin_file: Downloading firmware file: QCA9888/hw.1/athwlan.bin
[ 40.890000] ol_transfer_bin_file 3738: downloading file 1, Download data len 351668
[ 42.250000] ol_ath_attach() Download FW done.
[ 42.260000] ol_ath_attach() HT Create .
[ 42.260000] ol_ath_attach() HIF Claim.
[ 42.270000] ol_ath_attach() BMI Done.
[ 42.270000] ol_ath_attach 6866 host_enable 0 nss_nwifi_offload 0
[ 42.280000] ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
[ 42.290000] OL_ACBKMinfree : 0
[ 42.290000] OL_ACBEMinfree : 0
[ 42.290000] OL_ACVIMinfree : 0
[ 42.300000] OL_ACVOMinfree : 0
[ 42.300000] ol_ath_attach() WMI attached. wmi_handle 81e80000
[ 42.310000] CE_recv_buf_enqueue 844 Populate last entry 512 for CE 5
[ 42.320000] CE_recv_buf_enqueue 853 CE 5 wi 511 dest_ptr 0x1843820 nbytes 0 recv_ctxt 0x8182dc00
[ 42.330000] Startup Mode-0 set
....