Trying to boot LEDE on DHP-W310AV powerline adapter

Hello,
I was given a D-Link DHP-W310AV rev. C1 powerline adapter as not working, but turned out to be just fine so since I had no use for it I took it apart.
Turns out it has a QCA9533 soc (not sure AL3A or BL3A, the chips on the board have glued on heatsinks that won't budge), 32MBs of DDR1 ram and an 8MB spi nor flash (mx25l6406e). Wireless and the single ethernet port seem to be built-in to the soc. No idea on the PLC chip. It also has 4 leds and two buttons, reset and wps.
On one side of the board there are four small pads for uart, settings as usual for ar71xx are 115200 8N1.
Here is the OEM bootlog:

## Booting image at 9f070000 ...
We have SEAMA, ntohs(hdr->metasize) = 24
We have SEAMA, Image Size = 7200800
Verifying Checksum ...
Uncompressing SEAMA linux.lzma ... OK
do_boot_linux entry = 80002000 len = 2854940, data = 9f070040 , size = 7200800
## Transferring control to Linux (at address 00000000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

linux_argv[0]:<NULL>
linux_argv[1]:console=ttyS0,115200
linux_argv[2]:root=/dev/mtdblock0
linux_argv[3]:mem=32m
linux_env[0]:memsize=33554432
linux_env[1]:initrd_start=0x00000000
linux_env[2]:initrd_size=0x0
linux_env[3]:flash_start=0x9F000000
linux_env[4]:flash_size=0x800000
Booting QCA953x
Linux version 2.6.31--LSDK-10.1.478 (shine@shine) (gcc version 4.3.3 (GCC) ) #1 Wed Sep 16 09:50:59 C5
flash_size passed from bootloader = 0
arg 1: console=ttyS0,115200
arg 2: root=/dev/mtdblock0
arg 3: mem=32m
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 550 ddr 387 ahb 183
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock0 mem=32m 
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29580k/32768k available (2176k kernel code, 3188k reserved, 489k data, 124k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 365.56 BogoMIPS (lpj=731136)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
ath_pcibios_init: bus 0
***** Warning PCIe 0 H/W not found !!!
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
brd: module loaded
ELBOX CFI physmap flash device: 800000 at 9f000000
 ATH serial flash !!
ath-nor0: the flash image has SEAMA header
ath-nor0: squashfs filesystem found at offset 0x00160040
Creating 9 MTD partitions on "ath-nor0":
0x000000160060-0x00000074e060 : "rootfs"
0x000000070000-0x0000007f0000 : "upgrade"
0x000000050000-0x000000060000 : "rgdb"
0x000000040000-0x000000050000 : "bdcfg"
0x000000060000-0x000000070000 : "langpack"
0x0000007f0000-0x000000800000 : "radiocfg"
0x000000000000-0x000000800000 : "flash"
0x000000000000-0x000000040000 : "bootloader"
0x000000040000-0x000000050000 : "boot config"
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
Freeing unused kernel memory: 124k freed
init started: BusyBox v1.14.1 (2015-09-16 09:51:02 CST)
starting pid 137, tty '': '/etc/init.d/rcS'
[/etc/init.d/S10init.sh]
[/etc/init.d/S14devpts.sh]
[/etc/init.d/S16ipv6.sh]
[/etc/init.d/S19init.sh]
[/etc/init.d/S20init.sh]
defaultvalue.php enter 0
ssid=dlink-8E7C=password=ixxjr17587wifi=/wifi/entry:1
debugssid=dlink-8E7C
  DEFNODE[/etc/defnodes/S11devdata.xml]
  DEFNODE[/etc/defnodes/S12flashspeed.php]
  DEFNODE[/etc/defnodes/S20device.xml]
  DEFNODE[/etc/defnodes/S22timezone.php]
[/etc/scripts/setdate.sh] 01/01/2000 ...
Sat Jan  1 18:00:04 GMT 2000
  DEFNODE[/etc/defnodes/S30device.php]
  DEFNODE[/etc/defnodes/S30device.xml]
  DEFNODE[/etc/defnodes/S31diagnostic.xml]
  DEFNODE[/etc/defnodes/S31locale.php]
  DEFNODE[/etc/defnodes/S40device.xml]
  DEFNODE[/etc/defnodes/S90sessions.php]
  DEFNODE[/etc/defnodes/S90upnpigd.php]
  DEFNODE[/etc/defnodes/S91upnpbasic.php]
SERVD: start service [LOGD]
[/etc/init.d/S20interfaces.sh]
/proc/sys/net/ipv6/conf/eth0/accept_dad: can't create
/proc/sys/net/ipv6/conf/eth0/disable_ipv6: can't create
[/etc/init.d/S45gpiod.sh]
Factory reset time : 5 secs
[/etc/init.d/rcS] done!
[/etc/init0.d/S21layout.sh]: start ...
SERVD: start service [LAYOUT]
qca955x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled 
qca953x_set_gmac_caps  CHECK DMA STATUS 
mac:0 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: Mac address for unit 0:bfff0000
qca955x_GMAC: ff:ff:ff:ff:ff:ff 
[/etc/init0.d/S21wlan.sh]: start ...
qca955x_GMAC: Max segments per packet :   1
qca955x_GMAC: Max tx descriptor count :   512
qca955x_GMAC: Max rx descriptor count :   128
qca955x_GMAC: Mac capability flags    :   2581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled 
 GPIO LED SETTINGS ....done 
qca953x_set_gmac_caps  CHECK DMA STATUS 
mac:1 Registering S27....
qca955x_GMAC: RX TASKLET - Pkts per Intr:18
qca955x_GMAC: Mac address for unit 1:bfff0006
qca955x_GMAC: ff:ff:ff:ff:ff:ff 
[/etc/init0.d/S22plc.sh]: start ...
qca955x_GMAC: Max segments per packet :   1
qca955x_GMAC: Max tx descriptor count :   512
qca955x_GMAC: Max rx descriptor count :   128
qca955x_GMAC: Mac capability flags    :   2D81
[/etc/init0.d/S40event.br.sh]: start ...
SERVD: event [SEALPAC.LOAD/default]
SEAMA: '/dev/mtdblock/4' is not a seama file !
[/etc/init0.d/S40gpioevent.sh]: start ...
[/etc/init0.d/S41inf.br.sh]: start ...
[/etc/init0.d/S80telnetd.sh]: start ...
[/etc/init0.d/S81wsplcd.sh]: start ...
[/etc/init0.d/S90plc.sh]: start ...
athr_gmac_ring_alloc Allocated 8192 at 0x81c60000
athr_gmac_ring_alloc Allocated 2048 at 0x81ff8000
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
ADDRCONF(NETDEV_UP): eth0: link is not ready
athr_gmac_ring_alloc Allocated 8192 at 0x81d14000
athr_gmac_ring_alloc Allocated 2048 at 0x81fea800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
SERVD: start service [PHYINF.WIFI]
SERVD: start service [PLC.SETTING]
Service PLC.SETTING start !
modpib: Invalid argument: Have '/tmp/user.pib' but want NMK
SERVD: start service [PLC.UICONFIG]
Service PLC.UICONFIG start
SERVD: start service [LOGD]
SERVD: service [LOGD] is already started.
SERVD: start service [BRIDGE]
bridge mode
SERVD: start service [ENLAN]
SERVD: service [ENLAN] return error 108.
SERVD: start service [PHYINF.ETH-1]
SERVD: start service [WIFI_SETTING]
SERVD: start service [INET.BRIDGE-1]
inet_ipv4_dynamic(BRIDGE-1,br0,INET-1,/inet/entry:1)
echo ip addr del 169.254.0.0/16 dev br0
ip addr del 169.254.0.0/16 dev br0
[/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1...
[/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1 done !!!
udhcpc (v1.14.1) started
[/var/servd/BRIDGE-1-udhcpc.sh]: deconfig [br0] [] [] [] [] [] [] [] [] ...
SERVD: start service [INET.BRIDGE-2]
[/var/servd/INET.BRIDGE-2_start.sh]: starting BRIDGE-2...
[/var/run/phpsh-604.sh]: got deconfig for BRIDGE-1 ...
: not found
: bad number
Sending discover...
BRIDGE-2 a is link local interface.
ip: invalid argument 'BRIDGE-2' to 'table'
SERVD: event [BRIDGE-2.UP/default]
[/var/servd/INET.BRIDGE-2_start.sh]: starting BRIDGE-2 done !!!
SERVD: start service [INET.BRIDGE-3]
ifsetup: (BRIDGE-3) not active.
SERVD: service [INET.BRIDGE-3] return error 8.
SERVD: start service [WIFI_MODS]
adf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.1.478 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
Green-AP : Green-AP : Attached

ath_get_caps[5957] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5932] tx chainmask mismatch actual 3 sc_chainmak 0
SC Callback Registration for wifi0
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.1.478 (Atheros/multi-bss)
Sending discover...
sc nodebug 0 
SERVD: start service [PHYINF.REPEATER24G-1.1]
/etc/ath/makeVAP ap-wds dlink-8E7C BANDMODE=2G;CH_MODE=11NGHT40;PUREN=0;PUREG=0;AP_HIDESSID=0;WMM=1;R 
bandmode =2G
ssid =dlink-8E7C
wlanmode =11NGHT40
chan_bw =
channel =0
hidessid =0
wmm =1
puren =0
pureg =0
rf =RF
ATH_NAME =ath0
Creating ap for dlink-8E7C on
VAP device ath0 created 
Added ath0 mode master
 
 DES SSID SET=dlink-8E7C 
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
Created ath0 mode ap for dlink-8E7C
SERVD: start service [WIFI_ACTIVATE]
Invoking ACS module for Best channel selection 
device ath0 entered promiscuous mode
br0: port 3(ath0) entering learning state
SERVD: event [WLAN.CONNECTED/default]
Sending discover...
hy_netlink_event_indicate event_pid is invalid event_type=4
br0: port 3(ath0) entering forwarding state
Channel 1 average beacon RSSI 15 noisefloor -118  ieee80211_acs_find_best_11ng_centerchan chan: 1 bea1
Channel 6 average beacon RSSI 0 noisefloor -118  ieee80211_acs_find_best_11ng_centerchan chan: 6 beac6
Channel 6 average beacon RSSI 0 noisefloor -118  ieee80211_acs_find_best_11ng_centerchan chan: 6 beac6
Channel 11 average beacon RSSI 10 noisefloor -118  ieee80211_acs_find_best_11ng_centerchan chan: 11 b6
ieee80211_acs_find_best_11ng_centerchan found best 11ng center chan: 6 rssi: -236
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
killall: postsettingd: no process killed
Reading topology file /var/topol ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 
ogy.conf ...
madwifi_init: Initiating madwifi_wireless_event_init...
SERVD: stop service [NAMERESOLV.BRIDGE-1]
SERVD: service [NAMERESOLV.BRIDGE-1] is already stopped.
SERVD: start service [NAMERESOLV.BRIDGE-1]
Using interface ath0 with hwaddr a0:ab:1b:9a:8e:7e and ssid 'dlink-8E7C'
[/var/servd/BRIDGE-1-udhcpc.sh]: leasefail [br0] [] [] [] [] [] [] [] [] ...
SERVD: start service [INFSVCS.BRIDGE-2]
/etc/scripts/neaps.sh: can't open
SERVD: event [BRIDGE-2.CONNECTED] not found!
SERVD: event [UPDATERESOLV/default]
: not found
: bad number
No lease, forking to background
SERVD: event [INET.CONNECTED/default]
SERVD: event [INFSVCS.BRIDGE-2.UP] not found!
SERVD: stop service [WSPLCD]
SERVD: service [WSPLCD] is already stopped.
SERVD: start service [WSPLCD]
Service WSPLCD daemon start !
killall: wsplcd: no process killed
killall: hyd: no process killed
 
 DES SSID SET=dlink-8E7C 
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
hy_netlink_receive event_pid=1116
SERVD: stop service [NAMERESOLV]
SERVD: service [NAMERESOLV] is already stopped.
SERVD: start service [NAMERESOLV]
SERVD: start service [HTTP.BRIDGE-2]
apacHyfi20GetWlanBandCapacity, invalid freq read: 0
apacHyfi20ConfigInit, Failed to get Channel Info for ath0
SERVD: stop service [IP6TDEFCHAIN]
SERVD: service [IP6TDEFCHAIN] is already stopped.
SERVD: start service [IP6TDEFCHAIN]
SERVD: service [IP6TDEFCHAIN] return error 108.
SERVD: stop service [LLD2]
SERVD: service [LLD2] is already stopped.
SERVD: start service [LLD2]
SERVD: stop service [DNS]
SERVD: service [DNS] is already stopped.
SERVD: start service [DNS]
SERVD: service [DNS] return error 108.
SERVD: stop service [HTTP]
SERVD: service [HTTP] is already stopped.
SERVD: start service [HTTP]
SERVD: event [HTTP.UP] not found!
SERVD: stop service [MDNSRESPONDER]
SERVD: service [MDNSRESPONDER] is already stopped.
SERVD: start service [MDNSRESPONDER]
mdnsresponder server start !
main 747 PLC MAC -a0:ab:1b:9a:8e:7c-
/tmp/user.pib looks good
main 833 chkpib ret=0
updatePIB_in_MTDathrs27_phy_power_down ==> phyUnit(4) enable(1)
 216 check if mtset phy power down
d is empty ?
updatePIB_in_MTD 220 at offset 0xc000 value 0x2594
updatePIB_in_MTD 223 mtd NOT empty
hpavd: setPLCLanPortPowerDown ==> sd(3) enable(1)
[/etc/init0.d/S99system.sh]: start ...
plc starting...
[/etc/init0.d/rcS] done!

Please press Enter to activate this console. hpavd: setPLCLanathrs27_phy_power_down ==> phyUnit(4) en)
PortPowerDown ==set phy power up
> sd(3) enable(0)
main 876
main 883
enet1 port4 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1  RGMII  1000Mbps  full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl  
Setting Drop CRC Errors, Pause Frames and Length Error frames 
ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
br0: port 2(eth1) entering learning state
TELNETD: timeout terminated !!
br0: port 2(eth1) entering forwarding state
main 944 parent start
drop_caches_sysctl_handler: write=1 sysctl_drop_caches=1
drop_pagecache
br0 A0:AB:1B:9A:8E:7C Read Module from Memory
main 957 child created
plctool: ModuleRead: Read timeout or network error
processingPIB 47athrs27_phy_power_down ==> phyUnit(4) enable(1)
6 plctool dump Penet1 port4 down                                                     
953x_GMAC:unit 1: phy 4 not up carrier 1                                             
IB file size = 0set phy power down                                                   
x0                                                                                   
processingPIbr0: port 2(eth1) entering disabled state                                
B 482 PLC is in BootLoader mode, boot it up using PIB in MTD                         
hpavd: setPLCLanPortPowerDown ==> sd(3) enable(1)                                    
plc starting...                                                                      
hpavd: setPLCLanathrs27_phy_power_down ==> phyUnit(4) enable(0)                      
PortPowerDown ==set phy power up                                                     
> sd(3) enable(0)                                                                    
/tmp/user.pib looks good                                                             
processingPIB 494 chkpib ret=0                                                       
device eth1 left promiscuous mode                                                    
br0: port 2(eth1) entering disabled state                                            
enet1 port4 up 100Mbps Full duplex                                                   
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1  RGMII  1000Mbps  full duplex                
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl                                        
Setting Drop CRC Errors, Pause Frames and Length Error frames                        
eth1 00:B0:52:00:00:01 Write /usr/sbin/panther.nvm (1) (00000040:7104)               
eth1 00:B0:52:00:00:01 Start /usr/sbin/panther.nvm (1) (000000C0)                    
eth1 00:B0:52:00:00:01 Write /tmp/user.pib (1) (00200000:9620)                       
eth1 00:B0:52:00:00:01 Write /usr/sbin/panther.nvm (5) (002CF0B8:370212)             
eth1 00:B0:52:00:00:01 Start /usr/sbin/panther.nvm (5) (002CF4A8)                    
eth1 A0:AB:1B:9A:8E:7C MAC-QCA7420-1.2.0.1578-01-20150617-CS is running              
device eth1 entered promiscuous mode                                                 
br0: port 2(eth1) entering learning state                                            
processingPIB 582 plc uptime=47                                                      
                                                                                     
br0: port 2(eth1) entering forwarding state                                          
getDAK_NMK 369 cmd=plcinit -i br0 -I a0:ab:1b:9a:8e:7c > /tmp/devinfo
-
nmk:50:D3:E4:93:3F:85:5B:70:40:78:4D:F8:15:AA:8D:B7
main 952 end parent
SERVD: event [STATUS.READY/default]
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
gpio_cfg_set_addr:gd->val=70f4ff addr=18108244 new ath_reg_rd(addr)=150f4ff
drop_caches_sysctl_handler: write=1 sysctl_drop_caches=1
drop_pagecache
drop_caches_sysctl_handler: write=1 sysctl_drop_caches=3
**** drop_caches_sysctl_handler: all done timer added ...**** 
hy_netlink_receive event_pid=1317
=============== postsetting is done ================

Linux version, mtd, cpu

Linux dlinkap 2.6.31--LSDK-10.1.478 #1 Wed Sep 16 09:50:59 CST 2015 mips GNU/Linux

system type             : QCA953x
processor               : 0
cpu model               : MIPS 24Kc V7.4
BogoMIPS                : 365.56
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0478, 0x0f60, 0x0dc0]
ASEs implemented        : mips16
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available


dev:    size   erasesize  name
mtd0: 005ee000 00010000 "rootfs"
mtd1: 00780000 00010000 "upgrade"
mtd2: 00010000 00010000 "rgdb"
mtd3: 00010000 00010000 "bdcfg"
mtd4: 00010000 00010000 "langpack"
mtd5: 00010000 00010000 "radiocfg"
mtd6: 00800000 00010000 "flash"
mtd7: 00040000 00010000 "bootloader"
mtd8: 00010000 00010000 "boot config"

At this point I kept backups of the whole flash and each partition, and started playing with u-boot.

U-Boot 1.1.4 (Jul 28 2014 - 16:24:56)

SVN revision: 76
Target board: HPW310

 - Honey Bee 1.0DRAM:  
sri
Honey Bee 1.0
ath_ddr_initial_config(222): (16bit) ddr1 init
tap = 0x00000002
Tap (low, high) = (0xa, 0x36)
Tap values = (0x20, 0x20, 0x20, 0x20)
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 228k for U-Boot at: 81fc4000
Reserving 160k for malloc() at: 81f9c000
Reserving 44 Bytes for Board Info at: 81f9bfd4
Reserving 36 Bytes for Global Data at: 81f9bfb0
Reserving 128k for boot params() at: 81f7bfb0
Stack Pointer at: 81f7bf98
Now running in RAM - U-Boot at: 81fc4000
Flash Manuf Id 0x1c, DeviceId0 0x30, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x103a100
Hit any key to stop autoboot:  0 
ath> help
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
ethreg  - Switch/PHY Reg rd/wr  utility
flinfo  - print FLASH memory information
go      - start application at address 'addr'
gpset   - Set gpio pin 0~22 to 0 or 1 
help    - print online help
httpsvr - Start HTTP server to load image
iminfo  - print header information for application image
itest   - return true/false on integer compare
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
pll cpu-pll dither ddr-pll dither - Set to change CPU & DDR speed
pll erase
pll get
printenv- print environment variables
progmac - Set ethernet MAC addresses
progmac2 - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
sntp    - synchronize RTC via network
tftpboot- boot image via network using TFTP protocol
version - print monitor version
ath> printenv
loadstart=0x81000000
runtimeloadstart=0x80002000
bootstart=0x9f000000
bootsize=0x40000
bootend=0x9F03FFFF
runtimestart=0x9F070000
runtimesize=0x00780000
runtimeend=0x9F7EFFFF
envstart=0x9F040000
envend=0x9F04FFFF
bootargs=console=ttyS0,115200 root=/dev/mtdblock0 mem=32m
bootcmd=run runtime
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
update_bootloader=protect off $(bootstart) $(bootend);erase $(bootstart) $(bootend);cp.b $(loadstart) $(bootstart) $(bootsize)
update_runtime=protect off $(runtimestart) $(runtimeend);erase $(runtimestart) $(runtimeend);cp.b $(loadstart) $(runtimestart) $(runtimesize)
clean_env=protect off $(envstart) $(envend);erase $(envstart) $(envend)
runtime=bootm $(runtimestart) $(runtimeloadstart)
serverip=192.168.0.1
ethact=eth0
ipaddr=192.168.0.50
stdin=serial
stdout=serial
stderr=serial

Environment size: 861/32764 bytes
ath>bdinfo        
boot_params = 0x81F7BFB0
memstart    = 0x80000000
memsize     = 0x02000000
flashstart  = 0x9F000000
flashsize   = 0x00800000
flashoffset = 0x0002CC2C
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     = 192.168.0.50
baudrate    = 115200 bps
ath> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr 
ath>

Since there is no support for this particular device on LEDE, I tried to boot images from targets with the same soc, like the tp-link 802n, but failed, since uboot reported Bad Magic Number on all of them.
I tried with different bootloaders, like the modded uboot and breed, but none gave me any output on serial so I had to re-program the rom with default uboot.
The closest I have been to booting LEDE is by booting ar71xx-generic-vmlinux.elf , which results to this:

ath> bootelf
Loading .text @ 0x80060000 (3151004 bytes)
Loading __ex_table @ 0x803614a0 (6200 bytes)
Loading .rodata @ 0x80363000 (294592 bytes)
Loading .pci_fixup @ 0x803aaec0 (928 bytes)
Loading __ksymtab @ 0x803ab260 (24344 bytes)
Loading __ksymtab_gpl @ 0x803b1178 (14000 bytes)
Loading __ksymtab_strings @ 0x803b4828 (87084 bytes)
Loading __param @ 0x803c9c54 (820 bytes)
Clearing __modver @ 0x803c9f88 (120 bytes)
Loading .data @ 0x803ca000 (152524 bytes)
Loading .data..page_aligned @ 0x803f0000 (8192 bytes)
Loading .init.text @ 0x803f2000 (189264 bytes)
Loading .init.data @ 0x80420350 (81660 bytes)
Loading .mips.machines.init @ 0x8043424c (4096 bytes)
Clearing .bss @ 0x80440000 (210620 bytes)
## Starting application at 0x80065240 ...
[    0.000000] Linux version 4.4.92 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3101-bce140e) ) #0 Tue Oct 17 14:59:45 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] No valid device tree found, continuing without
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 27864K/32768K available (3076K kernel code, 160K rwdata, 412K rodata, 312K init, 205K bss, 4904K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:880.000MHz, DDR:620.000MHz, AHB:293.333MHz, Ref:40.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000006] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.005152] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.066912] pid_max: default: 32768 minimum: 301
[    0.070049] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.074403] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080808] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.087295] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.092233] NET: Registered protocol family 16
[    0.096075] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
[    0.100320] Can't analyze schedule() prologue at 800670fc
[    0.111755] clocksource: Switched to clocksource MIPS
[    0.115903] NET: Registered protocol family 2
[    0.119455] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.124092] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.128289] TCP: Hash tables configured (established 1024 bind 1024)
[    0.132570] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.136431] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.140758] NET: Registered protocol family 1
[    0.146663] Crashlog allocated RAM at address 0x1f00000
[    0.160390] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.164281] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.172572] io scheduler noop registered
[    0.175162] io scheduler deadline registered (default)
[    0.178701] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.184929] console [ttyS0] disabled
[    0.207400] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A

At this point the output stops and after a couple of seconds the device reboots.

D-link has made the gpl code available, I have been looking to find clues on what I need to incorporate the device on the LEDE tree , but frankly I don't know what to look for.
Can someone more experienced help? I am open to a lot of experimentation. :grinning:
Thanks

Did you make any more progress on this?
I also have a DHP-W310AV and would love to load it up with Openwrt/LEDE.