Adding OpenWrt support for ZTE MF286 3g/4g wifi router

I did exactly that but Luci is not coming up - even after confirming "luci" is in the field of packages. I cant figure out why

I was able to solve the problem - somehow even with Luci packages installed it didn't run properly.
I manually edited /etc/config/network file to:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd4e:1837:434e::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 0t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

That gave me internet with ISP cable with public IP. And then I ran the "install Luci" instruction commands. Hope this helps someone wrestling with this.
Now everything seems to be working nicely. Running snapshot r28009-11ba2b141f

Is this snapshot-snapshot or from 23.05-SNAPSHOT? The latter one is based on current 23.05 branch and should contain LuCI if I'm not mistaken.

I don't know the difference between those two.
I went to firmware selector. The 23.05.5 didn't show the second wlan radio so I selected snapshot from the pulldown. Even there luci appeared installed (I even clicked request build with "luci") but wasn't accessible.

Both are daily builds, but snapshots are from the main branch, i.e. freshest changes you can get everytime, 23.05-SNAPSHOT is from the current stable branch. And it's somewhat hidden.

Here is the image you want to use until next release:
http://downloads.openwrt.org/releases/23.05-SNAPSHOT/targets/ath79/nand/openwrt-23.05-snapshot-r24133-33b45c0a0e-ath79-nand-zte_mf286-squashfs-sysupgrade.bin
It will contain the packages you want.

@Leo-PL can you give me the script to restart LTE connection?

#!/bin/sh

HOSTS="8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1"
PING_WAIT=2
INTERFACE="wwan0"
DEVICE="/dev/ttyUSB2"
CONNECTION="wan"

function test_ping() {
        local tries=0
        while [[ $tries -lt 4 ]]
        do
                for host in ${HOSTS}
                do
                        if /bin/ping -I ${INTERFACE} -c 1 -W ${PING_WAIT} ${host} >/dev/null
                        then
                                return 0
                        fi
                done
                tries=$((tries+1))
        done
        return 1
}

test_ping && exit 0

logger Ping watchdog triggered, restarting connection
ifup ${CONNECTION}
sleep 15
test_ping && exit 0

logger Ping watchdog triggered, restarting modem
[ -c ${DEVICE} ] && echo -ne '\r\nAT+CFUN=1,1\r\n' > ${DEVICE}
sleep 60

logger Device lost, rebooting device
[ -c ${DEVICE} ] || reboot

Not sure if it'll help you if the operator disables IPv4 ICMP at 23:00-05:00 interval. You might try replacing that with v6 addresses, should work just the same.

But if the signal is gone, the modem will reboot infinitely ?

Yes, it will. Denied network registration isn't accounted for here. It's supposed to be put into crontab to run every minute to 5 minutes, depending on your preference.

Edit: I also posted BDF for MF286A/R to ath10k-devel, for that RX throughput improvement, too.

also, @frollic I started digging into lzma-loader code, and found that commit:

I think we'll need to parametrize that or move that up once more. This matches my experience exactly, the initramfs would fail to boot if uncompressed size exceeds 24192kB.

...and it did work:

ath> setenv serverip 10.0.0.24; setenv ipaddr 10.0.0.254; tftpboot 81000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin; bootm 81000000
Unknown command 'setenv' - try 'help'
Trying eth0
ath_gmac_phy_link
ath_gmac_phy_duplex
ath_gmac_phy_speed
dup 1 speed 1000
Using eth0 device
TFTP from server 10.0.0.24; our IP address is 10.0.0.254
Filename 'openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin'.
Load address: 0x81000000
Loading: #T ################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #######################
done
Bytes transferred = 7101710 (6c5d0e hex)
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-6.6.61
   Created:      2024-11-19  18:52:45 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    7101646 Bytes =  6.8 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 6.6.61 (builder@buildbot) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28139-22664498ebdd) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Tue Nov 19 18:52:45 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is ZTE MF286A
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0

I'll see what is the correct way to configure the LZMA text address - it'll probably have to be set per target, given this has to be moved above 32MB boundary.

The 464xlat only work's if disable Nat Offload, the CPU usage limit speed to 30Mbps :frowning:

I think I need a hand with another MF286 device. The sticker says MF286 but as I've learned that's unreliable. The device accepted the firmware but running into problems when configing it - softbrick very often when changing things. Could it be another sister model? Below is the bootup UART when softbricked. Cant access ssh or Luci. Any ideas?

U-Boot 1.1.4 (Jun 27 2016 - 15:29:38)

ap152 - Dragonfly 1.0DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x11, 0x11, 0x11, 0x11)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 421k for U-Boot at: 87f94000
Reserving 192k for malloc() at: 87f64000
Reserving 44 Bytes for Board Info at: 87f63fd4
Reserving 36 Bytes for Global Data at: 87f63fb0
Reserving 128k for boot params() at: 87f43fb0
Stack Pointer at: 87f43f98
Now running in RAM - U-Boot at: 87f94000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x15
flash size 2MB, sector count = 32
Flash:  2 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init (MDC/MDIO config)::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:ff:ff:ff
ath_gmac_phy_setup
eth0 up
eth0
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
ath_spi_nand_ecc: furture feat = 0x10
ath_spi_nand_ecc: middle feat = 0x10
ath_parse_read_id: SPI NAND M.Id: 0xc8 D.Id: 0xd1
====== NAND Parameters ======
sc addr = 0x87ff5f40 page(write size) = 0x800 (erase size) block = 0x20000
Setting 0x181162c0 to 0x4b962100
Uaztemain: enter into ! 
zte_getHandOffState: read data=0x20 from 0x0
Uaztemain: no need to update '���|7䥬�������/���=��+���u�{�}' 
Hit any key to stop autoboot:  0 

Loading from device 0: ath-spi-nand (offset 0x1300000)
   Image Name:   MIPS OpenWrt Linux-5.15.167
   Created:      2024-11-06  10:43:07 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2559362 Bytes =  2.4 MB
   Load Address: 80060000
   Entry Point:  80060000
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.167
   Created:      2024-11-06  10:43:07 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2559362 Bytes =  2.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.15.167 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24133-33b45c0a0e) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Wed Nov 6 10:43:07 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is ZTE MF286
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 120236K/131072K available (6664K kernel code, 584K rwdata, 840K rodata, 1184K init, 221K bss, 10836K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008296] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074816] pid_max: default: 32768 minimum: 301
[    0.080520] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088258] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.102558] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.112978] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.120373] pinctrl core: initialized pinctrl subsystem
[    0.127538] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.134318] thermal_sys: Registered thermal governor 'step_wise'
[    0.148259] clocksource: Switched to clocksource MIPS
[    0.161282] NET: Registered PF_INET protocol family
[    0.166642] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.175180] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.184156] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.192347] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.200436] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.207882] TCP: Hash tables configured (established 1024 bind 1024)
[    0.214761] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.221721] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.229475] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.235485] PCI: CLS 0 bytes, default 32
[    0.242937] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.254337] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.260556] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.272341] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.283675] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.291084] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.300336] printk: console [ttyS0] disabled
[    0.304909] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.314063] printk: console [ttyS0] enabled
[    0.314063] printk: console [ttyS0] enabled
[    0.323133] printk: bootconsole [early0] disabled
[    0.323133] printk: bootconsole [early0] disabled
[    0.351079] spi-nand spi0.1: GigaDevice SPI NAND was found.
[    0.356859] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.367930] 6 fixed-partitions partitions found on MTD device (null)
[    0.374587] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.381480] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.388822] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.395698] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.403175] Creating 6 MTD partitions on "(null)":
[    0.408143] 0x000000000000-0x000000140000 : "fota-flag"
[    0.418775] 0x000000140000-0x000000280000 : "caldata"
[    0.427583] 0x000000280000-0x0000003c0000 : "mac"
[    0.436160] 0x0000003c0000-0x000001300000 : "ubiconcat0"
[    0.464244] 0x000001300000-0x000001700000 : "kernel"
[    0.476657] 0x000001700000-0x000008000000 : "ubiconcat1"
[    0.633995] spi-nor spi0.0: mx25l1606e (2048 Kbytes)
[    0.639223] 2 fixed-partitions partitions found on MTD device spi0.0
[    0.645792] Creating 2 MTD partitions on "spi0.0":
[    0.650812] 0x000000000000-0x000000080000 : "u-boot"
[    0.657802] 0x000000080000-0x0000000a0000 : "u-boot-env"
[    0.665449] Concatenating MTD devices:
[    0.669400] (0): "ubiconcat0"
[    0.672471] (1): "ubiconcat1"
[    0.675535] into device "ubi-concat"
[    0.679309] 1 fixed-partitions partitions found on MTD device ubi-concat
[    0.686237] Creating 1 MTD partitions on "ubi-concat":
[    0.691565] 0x000000000000-0x000007840000 : "ubi"
[    1.392337] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    2.049892] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.061236] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    2.070600] NET: Registered PF_INET6 protocol family
[    2.086267] Segment Routing with IPv6
[    2.090195] In-situ OAM (IOAM) with IPv6
[    2.094361] NET: Registered PF_PACKET protocol family
[    2.099688] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.113551] 8021q: 802.1Q VLAN Support v1.8
[    2.122484] PCI host bridge to bus 0000:00
[    2.126730] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.133889] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.139660] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.147883] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.154136] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.161206] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.168201] pci 0000:00:00.0: supports D1
[    2.172356] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    2.179552] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.186424] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.194045] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.207937] UBI: auto-attach mtd8
[    2.211444] ubi0: attaching mtd8
[    4.873236] ubi0: scanning is finished
[    4.911735] ubi0: attached mtd8 (name "ubi", size 120 MiB)
[    4.917426] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.924571] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.931603] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.938803] ubi0: good PEBs: 960, bad PEBs: 2, corrupted PEBs: 0
[    4.945003] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    4.952472] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 785257049
[    4.961829] ubi0: available PEBs: 0, total reserved PEBs: 960, PEBs reserved for bad PEB handling: 17
[    4.971459] ubi0: background thread "ubi_bgt0d" started, PID 224
[    4.980625] block ubiblock0_0: created from ubi0:0(rootfs)
[    4.986311] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    4.993779] clk: Disabling unused clocks
[    5.016744] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    5.030465] Freeing unused kernel image (initmem) memory: 1184K
[    5.036593] This architecture does not have kernel memory protection.
[    5.043277] Run /sbin/init as init process
[    5.716910] init: Console is alive
[    5.721029] init: - watchdog -
[    7.331114] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    7.408348] usbcore: registered new interface driver usbfs
[    7.414088] usbcore: registered new interface driver hub
[    7.419724] usbcore: registered new device driver usb
[    7.434263] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    7.444373] fsl-ehci: Freescale EHCI Host controller driver
[    7.451847] ehci-platform: EHCI generic platform driver
[    7.457617] ehci-platform 1b000000.usb: EHCI Host Controller
[    7.463611] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[    7.471884] ehci-platform 1b000000.usb: irq 13, io mem 0x1b000000
[    7.498316] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[    7.505651] hub 1-0:1.0: USB hub found
[    7.510334] hub 1-0:1.0: 1 port detected
[    7.515353] ehci-platform 1b400000.usb: EHCI Host Controller
[    7.521325] ehci-platform 1b400000.usb: new USB bus registered, assigned bus number 2
[    7.529590] ehci-platform 1b400000.usb: irq 14, io mem 0x1b400000
[    7.558276] ehci-platform 1b400000.usb: USB 2.0 started, EHCI 1.00
[    7.565449] hub 2-0:1.0: USB hub found
[    7.570149] hub 2-0:1.0: 1 port detected
[    7.577477] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.595445] init: - preinit -
[    9.283428] random: jshn: uninitialized urandom read (4 bytes read)
[    9.421194] random: jshn: uninitialized urandom read (4 bytes read)
[    9.536073] random: jshn: uninitialized urandom read (4 bytes read)
[   10.128678] usb 1-1: new high-speed USB device number 2 using ehci-platform
[   10.430079] random: procd: uninitialized urandom read (4 bytes read)
[   10.907315] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is up
[   10.915459] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.928177] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   10.935081] eth0: link up (1000Mbps/Full duplex)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   13.170040] UBIFS (ubi0:1): Mounting in unauthenticated mode
[   13.176166] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 386
[   13.358194] UBIFS (ubi0:1): recovery needed
[   13.808950] UBIFS (ubi0:1): recovery completed
[   13.813649] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   13.821772] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   13.832025] UBIFS (ubi0:1): FS size: 113135616 bytes (107 MiB, 891 LEBs), max 902 LEBs, journal size 5713920 bytes (5 MiB, 45 LEBs)
[   13.844255] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB)
[   13.851099] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID B3654FC3-47A4-44BE-903B-E1E61AAC5C61, small LPT model
[   13.884283] mount_root: switching to ubifs overlay
[   13.928531] urandom-seed: Seeding with /etc/urandom.seed
[   14.037026] eth0: link down
[   14.060342] procd: - early -
[   14.063640] procd: - watchdog -
[   14.869325] procd: - watchdog -
[   14.873133] procd: - ubus -
[   15.031919] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.049345] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.064833] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.074905] procd: - init -
Please press Enter to activate this console.
[   16.214788] random: jshn: uninitialized urandom read (4 bytes read)
[   16.298462] random: ubusd: uninitialized urandom read (4 bytes read)
[   16.305361] random: ubus: uninitialized urandom read (4 bytes read)
[   16.558661] kmodloader: loading kernel modules from /etc/modules.d/*
[   17.022343] usbcore: registered new interface driver cdc_wdm
[   17.038994] Loading modules backported from Linux version v6.1.110-0-g5f55cad62cc9d
[   17.046918] Backport generated by backports.git v6.1.110-1-0-g965f73fc
[   17.101127] usbcore: registered new interface driver usbserial_generic
[   17.107962] usbserial: USB Serial support registered for generic
[   17.901080] PPP generic driver version 2.4.2
[   17.919262] NET: Registered PF_PPPOX protocol family
[   17.938592] qmi_wwan 1-1:1.3: cdc-wdm0: USB WDM device
[   17.944675] qmi_wwan 1-1:1.3 wwan0: register 'qmi_wwan' at usb-1b000000.usb-1, WWAN/QMI device, 8a:a9:58:a0:24:3f
[   17.955625] usbcore: registered new interface driver qmi_wwan
[   18.141522] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c.
[   18.189180] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   18.195828] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   18.718000] urngd: v1.0.2 started.
[   20.508622] random: crng init done
[   20.512153] random: 28 urandom warning(s) missed due to ratelimiting
[   22.585080] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043222ff sub 0000:0000
[   22.594681] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   22.606631] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[   22.702464] ath10k_pci 0000:00:00.0: invalid calibration data length in nvmem-cell 'pre-calibration': 12064 != 2116
[   22.763583] ath10k_pci 0000:00:00.0: Loading BDF type 0
[   23.271853] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   23.314487] ath10k_pci 0000:00:00.0: invalid calibration data length in nvmem-cell 'pre-calibration': 12064 != 2116
[   24.233778] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   24.251725] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[   24.258162] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   24.266474] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672'
[   24.338586] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal nvmem max-sta 128 raw 0 hwcrypto 1
[   24.348909] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   24.553801] usbcore: registered new interface driver option
[   24.559719] usbserial: USB Serial support registered for GSM modem (1-port)
[   24.567523] option 1-1:1.0: GSM modem (1-port) converter detected
[   24.574092] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
[   24.581639] option 1-1:1.1: GSM modem (1-port) converter detected
[   24.588214] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
[   24.595779] option 1-1:1.2: GSM modem (1-port) converter detected
[   24.602370] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB2
[   24.731611] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xafe8d31c, irq=2
[   24.768128] kmodloader: done loading kernel modules from /etc/modules.d/*
[   43.409421] eth0: link up (1000Mbps/Full duplex)
[   43.414627] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   43.439103] br-lan: port 1(eth0.1) entered blocking state
[   43.444700] br-lan: port 1(eth0.1) entered disabled state
[   43.450625] device eth0.1 entered promiscuous mode
[   43.455594] device eth0 entered promiscuous mode
[   43.480408] br-lan: port 1(eth0.1) entered blocking state
[   43.486008] br-lan: port 1(eth0.1) entered forwarding state
[   44.418647] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   70.419218] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is down
[   73.538921] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is up

Are you sure you picked the right firmware version? I don't see ath9k probe at all, so possibly caldata location is wrong, which would be the symptom of choosing wrong flash layout.
Also, ath10k probe fails due to missing fix I did for your previous device. Please try 23.05-SNAPSHOT for MF286A and see if it boots properly and fully, because hardware-wise it is MF286A, which has QCA9888 on board, which requests pre-calibration nvmem cell.

Exactly my point, I'm not sure it's the right version because...who knows what these routers are.
Is the 286A 23.05-snapshot hidden again or do you mean "firmware selector" => snapshot and just grab that one?

Do you have boot log from stock FW? Installation manual calls for comparing the flash layout with stock firmware, otherwise you risk overwriting calibration data.

Always has been, but currently something broke in firmware selector anyway, so here is the link, it's permanent for 23.05 branch:
https://downloads.openwrt.org/releases/23.05-SNAPSHOT/targets/ath79/nand/
and from there pick MF286A to try first. I can only curse ZTE for their way of device labeling, sadly - I haven't figured out any better way to differentiate the variants than the flash layout.

...and with all that, initramfs size restriction still applies, so you want to use latest 22.03 initramfs image for installation as well. I've figured out how the root cause, but not the proper way of altering the build system yet.

Thanks, I'll test tonight.
I don't think I saved the log but I did check that the labels for the flash (as they come up) did match the previous router that's working. Now I'm doubting myself for not doing it rigorously enough

OK, I flashed 286A from Luci (clicked to force flashing).
Stuck in bootloop:

Hit any key to stop autoboot:  0 

Loading from device 0: ath-spi-nand (offset 0x1300000)
   Image Name:   MIPS OpenWrt Linux-5.15.173
   Created:      2024-11-29  20:45:01 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2561303 Bytes =  2.4 MB
   Load Address: 80060000
   Entry Point:  80060000
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.173
   Created:      2024-11-29  20:45:01 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2561303 Bytes =  2.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.15.173 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24145-db554fd450) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Fri Nov 29 20:45:01 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is ZTE MF286A
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 120172K/131072K available (6667K kernel code, 588K rwdata, 840K rodata, 1240K init, 221K bss, 10900K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008291] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074815] pid_max: default: 32768 minimum: 301
[    0.080515] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088251] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.102675] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.113094] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.120465] pinctrl core: initialized pinctrl subsystem
[    0.127633] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.134423] thermal_sys: Registered thermal governor 'step_wise'
[    0.148574] clocksource: Switched to clocksource MIPS
[    0.161621] NET: Registered PF_INET protocol family
[    0.166987] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.175527] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.184498] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.192686] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.200779] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.208222] TCP: Hash tables configured (established 1024 bind 1024)
[    0.215099] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.222063] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.229813] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.235828] PCI: CLS 0 bytes, default 32
[    0.243341] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.254977] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.261198] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.272993] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.284361] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.291786] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.301040] printk: console [ttyS0] disabled
[    0.305615] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.314772] printk: console [ttyS0] enabled
[    0.314772] printk: console [ttyS0] enabled
[    0.323842] printk: bootconsole [early0] disabled
[    0.323842] printk: bootconsole [early0] disabled
[    0.351937] spi-nand spi0.1: GigaDevice SPI NAND was found.
[    0.357718] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.368920] 6 fixed-partitions partitions found on MTD device (null)
[    0.375529] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.382444] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.389794] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.396665] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.404148] Creating 6 MTD partitions on "(null)":
[    0.409160] 0x000000000000-0x0000000a0000 : "fota-flag"
[    0.418980] 0x0000000a0000-0x000000120000 : "art"
[    0.426431] 0x000000120000-0x0000001a0000 : "mac"
[    0.434004] 0x0000001a0000-0x000001800000 : "ubiconcat0"
[    0.474176] 0x000001800000-0x000001c00000 : "kernel"
[    0.487100] 0x000001c00000-0x000008000000 : "ubiconcat1"
[    0.649744] spi-nor spi0.0: mx25l1606e (2048 Kbytes)
[    0.654935] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.661553] Creating 3 MTD partitions on "spi0.0":
[    0.666548] 0x000000000000-0x0000000a0000 : "u-boot"
[    0.673530] 0x0000000a0000-0x0000000c0000 : "u-boot-env"
[    0.680111] 0x0000000c0000-0x000000200000 : "reserved1"
[    0.689621] Concatenating MTD devices:
[    0.693511] (0): "ubiconcat0"
[    0.696573] (1): "ubiconcat1"
[    0.699681] into device "ubi-concat"
[    0.703405] 1 fixed-partitions partitions found on MTD device ubi-concat
[    0.710342] Creating 1 MTD partitions on "ubi-concat":
[    0.715656] 0x000000000000-0x000007a60000 : "ubi"
[    0.735019] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.422661] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    2.080202] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.091586] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    2.100994] NET: Registered PF_INET6 protocol family
[    2.116938] Segment Routing with IPv6
[    2.120865] In-situ OAM (IOAM) with IPv6
[    2.125077] NET: Registered PF_PACKET protocol family
[    2.130417] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.144104] 8021q: 802.1Q VLAN Support v1.8
[    2.152932] PCI host bridge to bus 0000:00
[    2.157186] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.164342] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.170114] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.178339] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.184589] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.191660] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.198667] pci 0000:00:00.0: supports D1
[    2.202812] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    2.210038] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.216905] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.224526] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.238364] UBI error: no valid UBI magic found inside mtd9
[    2.244412] clk: Disabling unused clocks
[    2.250025] /dev/root: Can't open blockdev
[    2.254287] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.262052] Please append a correct "root=" boot option; here are the available partitions:
[    2.270694] 1f00             640 mtdblock0 
[    2.270707]  (driver?)
[    2.277453] 1f01             512 mtdblock1 
[    2.277461]  (driver?)
[    2.284218] 1f02             512 mtdblock2 
[    2.284227]  (driver?)
[    2.290983] 1f03           22912 mtdblock3 
[    2.290991]  (driver?)
[    2.297738] 1f04            4096 mtdblock4 
[    2.297745]  (driver?)
[    2.304503] 1f05          102400 mtdblock5 
[    2.304512]  (driver?)
[    2.311267] 1f06             640 mtdblock6 
[    2.311276]  (driver?)
[    2.318022] 1f07             128 mtdblock7 
[    2.318030]  (driver?)
[    2.324788] 1f08            1280 mtdblock8 
[    2.324796]  (driver?)
[    2.331553] 1f09          125312 mtdblock9 
[    2.331561]  (driver?)
[    2.338308] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.346840] Rebooting in 1 seconds..

I also tried starting from the beginning (UART) with 23.05-snapshot-r24145-mf286a-initramfs-kernel. That failed with multiple errors.
I also uploaded from beginning 23.05-snapshot-r24145mf286-squashfs-sysupgrade. That still produces the same problems (ath9k not showing + ath10k errors) BUT appears to run semi-OK

ath9k not showing is almost certainly the incorrect flash layout, because ART location doesn't match - so it looks like you should be using the MF286A image.

Please try booting MF286A initrfams once again (from 22.03 release), then erase "ubi" partition with "mtd erase", and then perform installation.

I'll do that, thanks.
Just to verify the process:

  • UART method install 22.03 initrams for 286A
  • ssh in and run "mtd erase ubi" ?
  • sysupgrade (LuCi or CLI?) to 22.03 or to 23.05.5 release for 286A?

Correct

Correct.

Correct again. You can go 23.05 directly, from the console - initramfs lacks LuCI.

Tested: UART upload fails:

ath> bootm 0x85000000
## Booting image at 85000000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.221
   Created:      2024-07-15  22:25:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5904734 Bytes =  5.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x85000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.10.221 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20341-591b7e93d3) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Mon Jul 15 22:25:54 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is ZTE MF286A
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 109628K/131072K available (6410K kernel code, 600K rwdata, 792K rodata, 12092K init, 214K bss, 21444K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000008] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008280] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074811] pid_max: default: 32768 minimum: 301
[    0.079804] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087513] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097648] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.108415] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118820] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.126094] pinctrl core: initialized pinctrl subsystem
[    0.135579] NET: Registered protocol family 16
[    0.140913] thermal_sys: Registered thermal governor 'step_wise'
[    0.192150] clocksource: Switched to clocksource MIPS
[    0.204991] NET: Registered protocol family 2
[    0.209783] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.218159] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.227066] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.235176] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.242624] TCP: Hash tables configured (established 1024 bind 1024)
[    0.249440] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.256384] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.264028] NET: Registered protocol family 1
[    0.268650] PCI: CLS 0 bytes, default 32
[    0.458382] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.468752] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.474962] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.486945] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.497292] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.504417] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.513233] printk: console [ttyS0] disabled
[    0.517799] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.526944] printk: console [ttyS0] enabled
[    0.526944] printk: console [ttyS0] enabled
[    0.536002] printk: bootconsole [early0] disabled
[    0.536002] printk: bootconsole [early0] disabled
[    0.562871] spi-nand spi0.1: GigaDevice SPI NAND was found.
[    0.568640] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.579556] 6 fixed-partitions partitions found on MTD device (null)
[    0.586212] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.593092] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.600631] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.607533] OF: Bad cell count for /ahb/spi@1f000000/flash@1/partitions
[    0.615116] Creating 6 MTD partitions on "(null)":
[    0.620082] 0x000000000000-0x0000000a0000 : "fota-flag"
[    0.629730] 0x0000000a0000-0x000000120000 : "art"
[    0.637091] 0x000000120000-0x0000001a0000 : "mac"
[    0.644531] 0x0000001a0000-0x000001800000 : "ubiconcat0"
[    0.682316] 0x000001800000-0x000001c00000 : "kernel"
[    0.694669] 0x000001c00000-0x000008000000 : "ubiconcat1"
[    0.845030] spi-nor spi0.0: mx25l1606e (2048 Kbytes)
[    0.850209] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.856827] Creating 3 MTD partitions on "spi0.0":
[    0.861776] 0x000000000000-0x0000000a0000 : "u-boot"
[    0.868675] 0x0000000a0000-0x0000000c0000 : "u-boot-env"
[    0.875153] 0x0000000c0000-0x000000200000 : "reserved1"
[    0.884319] Concatenating MTD devices:
[    0.888201] (0): "ubiconcat0"
[    0.891264] (1): "ubiconcat1"
[    0.894375] into device "ubi-concat"
[    0.898096] 1 fixed-partitions partitions found on MTD device ubi-concat
[    0.905039] Creating 1 MTD partitions on "ubi-concat":
[    0.910358] 0x000000000000-0x000007a60000 : "ubi"
[    0.929058] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.635566] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    2.293656] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.304929] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    2.313665] NET: Registered protocol family 10
[    2.325913] Segment Routing with IPv6
[    2.329810] NET: Registered protocol family 17
[    2.334546] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.347944] 8021q: 802.1Q VLAN Support v1.8
[    2.356393] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    2.362769]  MEM 0x0000000012000000..0x0000000013ffffff
[    2.368164]   IO 0x0000000000000000..0x0000000000000000
[    2.373743] PCI host bridge to bus 0000:00
[    2.377981] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.385112] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.390867] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    2.397882] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.406111] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.412361] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.419412] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.426409] pci 0000:00:00.0: supports D1
[    2.430549] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    2.437725] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.444626] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.452205] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.464640] UBI error: no valid UBI magic found inside mtd9
[    2.470625] clk: Disabling unused clocks
[    2.542083] Freeing unused kernel memory: 12092K
[    2.546882] This architecture does not have kernel memory protection.
[    2.553541] Run /init as init process
[    3.103537] init: Console is alive
[    3.107486] init: - watchdog -
[    3.131574] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.144666] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.162606] init: - preinit -
[    3.454311] random: jshn: uninitialized urandom read (4 bytes read)
[    3.536687] random: jshn: uninitialized urandom read (4 bytes read)
[    3.644123] random: jshn: uninitialized urandom read (4 bytes read)
[    4.667847] random: procd: uninitialized urandom read (4 bytes read)
[    4.681927] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is up
[    4.696365] eth0: link up (1000Mbps/Full duplex)
[    4.701179] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.723016] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.861740] eth0: link down
[    8.883816] procd: - early -
[    8.887124] procd: - watchdog -
[    9.512852] procd: - watchdog -
[    9.516473] procd: - ubus -
[    9.527825] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.570339] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.577476] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.587471] procd: - init -
Please press Enter to activate this console.
[   10.251601] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.710224] Loading modules backported from Linux version v5.15.162-0-gf45bea23c39cb
[   10.718281] Backport generated by backports.git v5.15.162-1-0-g9fa1c65c
[   10.953047] PPP generic driver version 2.4.2
[   10.963812] NET: Registered protocol family 24
[   11.064541] Data bus error, epc == 80339190, ra == 82322d04
[   11.070313] Oops[#1]:
[   11.072661] CPU: 0 PID: 604 Comm: kmodloader Not tainted 5.10.221 #0
[   11.079214] $ 0   : 00000000 00000001 deadc0de 00014000
[   11.084625] $ 4   : b81143fc 000143fc 81be1c14 00000004
[   11.090028] $ 8   : 00000000 8039ed3c ffffffff ffffffff
[   11.095430] $12   : ffffffff 00000020 00000000 ffffffff
[   11.100833] $16   : 8284c080 00000018 82891b44 82891b48
[   11.106236] $20   : 82891f43 80000003 00010000 00014000
[   11.111639] $24   : 00000000 8046245c                  
[   11.117041] $28   : 82890000 82891ad0 00031018 82322d04
[   11.122444] Hi    : 00004b5c
[   11.125411] Lo    : 4e910000
[   11.128381] epc   : 80339190 0x80339190
[   11.132346] ra    : 82322d04 0x82322d04 [ath9k_hw@(ptrval)+0x54ee0]
[   11.138814] Status: 1100dc03	KERNEL EXL IE 
[   11.143135] Cause : 4080801c (ExcCode 07)
[   11.147274] PrId  : 00019750 (MIPS 74Kc)
[   11.151322] Modules linked in: ath9k(+) ath9k_common pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath9k_hw ath pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 cfg80211 slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_ipv6 nf_log_ipv4 nf_log_common nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c crc_ccitt compat sha256_generic libsha256 seqiv jitterentropy_rng drbg hmac cmac gpio_button_hotplug crc32c_generic
[   11.214611] Process kmodloader (pid: 604, threadinfo=(ptrval), task=(ptrval), tls=77e94df0)
[   11.223227] Stack : 00000005 00000003 00000dc0 00000000 82891aec 00000000 00000220 000003ff
[   11.231864]         8188f000 00008000 8284c080 8284c0a8 82320000 82891bb4 82350000 82323e24
[   11.240500]         00000000 8284c080 00020000 00007000 ffffffe0 8284c5b8 8284c0a8 82351f60
[   11.249139]         81a6e04c 00000000 81802d00 00000cc0 000186a0 ffffffff 8284c080 82350568
[   11.257776]         99999999 00008000 00000100 8284c0a8 00000000 82891bb4 82350000 82315358
[   11.266414]         ...
[   11.268941] Call Trace:
[   11.268976] [<82320000>] 0x82320000 [ath9k_hw@(ptrval)+0x54ee0]
[   11.277604] [<82323e24>] 0x82323e24 [ath9k_hw@(ptrval)+0x54ee0]
[   11.283728] [<82315358>] 0x82315358 [ath9k_hw@(ptrval)+0x54ee0]
[   11.289847] [<82306ce4>] 0x82306ce4 [ath9k_hw@(ptrval)+0x54ee0]
[   11.295961] [<8041b504>] 0x8041b504
[   11.299569] [<800a0000>] 0x800a0000
[   11.303176] [<81be2864>] 0x81be2864 [ath9k@(ptrval)+0x192d0]
[   11.309014] [<81be494c>] 0x81be494c [ath9k@(ptrval)+0x192d0]
[   11.314854] [<800c4e24>] 0x800c4e24
[   11.318465] [<81bf00a0>] 0x81bf00a0 [ath9k@(ptrval)+0x192d0]
[   11.324308] [<802434ec>] 0x802434ec
[   11.327910] [<803a3c90>] 0x803a3c90
[   11.331513] [<80245bb0>] 0x80245bb0
[   11.335117] [<804195e0>] 0x804195e0
[   11.338715] [<80416ff4>] 0x80416ff4
[   11.342319] [<80417bf0>] 0x80417bf0
[   11.345919] [<8041991c>] 0x8041991c
[   11.349521] [<80388a40>] 0x80388a40
[   11.353122] [<80417bf8>] 0x80417bf8
[   11.356724] [<80417c74>] 0x80417c74
[   11.360329] [<80417bf8>] 0x80417bf8
[   11.363928] [<80414b80>] 0x80414b80
[   11.367535] [<80416298>] 0x80416298
[   11.371136] [<800ec8a4>] 0x800ec8a4
[   11.374734] [<804185bc>] 0x804185bc
[   11.378338] [<81bff000>] 0x81bff000 [ath9k@(ptrval)+0x192d0]
[   11.384180] [<81bff018>] 0x81bff018 [ath9k@(ptrval)+0x192d0]
[   11.390020] [<80060970>] 0x80060970
[   11.393621] [<800eacd4>] 0x800eacd4
[   11.397222] [<801a5688>] 0x801a5688
[   11.400832] [<800eacf4>] 0x800eacf4
[   11.404428] [<800eccb4>] 0x800eccb4
[   11.408034] [<8006e1a8>] 0x8006e1a8
[   11.411636] 
[   11.413169] Code: 0000000f  8c820000  0000000f <03e00008> 00000000  0000000f  94820000  3042ffff  0000000f 
[   11.423249] 
[   11.424858] ---[ end trace b56778bbe99344bc ]---
[   11.429623] Kernel panic - not syncing: Fatal exception
[   11.435019] Rebooting in 1 seconds..

The file I tried was: openwrt-22.03.7-ath79-nand-zte_mf286a-initramfs-kernel.bin and I tested: openwrt-22.03-snapshot-r20343-4e1d1b7df0-ath79-nand-zte_mf286a-initramfs-kernel.bin