Ath79: eth1 fails to initialize unless autoboot interrupted and bootcmd manually executed

I'm trying to add support to a new device.

I've gotten to the point where if I interrupt the autoboot in u-boot, and then run the bootcmd manually, it works flawlessly, but if I let it autoboot on its own eth1 fails to initialize.

autoboot:

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.120
   Created:      2022-06-15   8:44:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2232191 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 5.10.120 (w43322@g14) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r19801-230c9da963) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Wed Jun 15 08:44:32 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link TL-AP301C v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56192K/65536K available (5458K kernel code, 596K rwdata, 1196K rodata, 1188K init, 201K bss, 9344K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000011] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008347] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074953] pid_max: default: 32768 minimum: 301
[    0.080019] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087727] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098781] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.109871] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120319] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127666] pinctrl core: initialized pinctrl subsystem
[    0.135125] NET: Registered protocol family 16
[    0.217034] clocksource: Switched to clocksource MIPS
[    0.223955] NET: Registered protocol family 2
[    0.228926] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.237437] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.246331] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.254496] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.261959] TCP: Hash tables configured (established 1024 bind 1024)
[    0.268876] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.275797] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.283647] NET: Registered protocol family 1
[    0.288362] PCI: CLS 0 bytes, default 32
[    0.301408] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.313236] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.319471] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.335104] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.342450] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.350159] printk: console [ttyS0] disabled
[    0.354767] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.363970] printk: console [ttyS0] enabled
[    0.363970] printk: console [ttyS0] enabled
[    0.373039] printk: bootconsole [early0] disabled
[    0.373039] printk: bootconsole [early0] disabled
[    0.398451] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.403401] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.410047] Creating 4 MTD partitions on "spi0.0":
[    0.415007] 0x000000000000-0x000000020000 : "factoryBoot"
[    0.425927] 0x000000020000-0x000000030000 : "factoryInfo"
[    0.432991] 0x000000030000-0x000000040000 : "art"
[    0.441581] 0x000000040000-0x000000800000 : "firmware"
[    0.448634] 2 uimage-fw partitions found on MTD device firmware
[    0.454771] Creating 2 MTD partitions on "firmware":
[    0.460001] 0x000000000000-0x000000230000 : "kernel"
[    0.468733] 0x000000230000-0x0000007c0000 : "rootfs"
[    0.475153] mtd: device 5 (rootfs) set to be root filesystem
[    0.482465] 1 squashfs-split partitions found on MTD device rootfs
[    0.488961] 0x0000005b0000-0x0000007c0000 : "rootfs_data"
[    0.506664] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.848146] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    0.856409] ag71xx 1a000000.eth: invalid MAC address, using random address
[    1.540436] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.550565] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: mii
[    1.557149] i2c /dev entries driver
[    1.562764] NET: Registered protocol family 10
[    1.577282] Segment Routing with IPv6
[    1.581228] NET: Registered protocol family 17
[    1.585940] 8021q: 802.1Q VLAN Support v1.8
[    1.591816] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.938111] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.946525] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.288100] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    2.306394] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.323532] Freeing unused kernel memory: 1188K
[    2.328263] This architecture does not have kernel memory protection.
[    2.334934] Run /sbin/init as init process
[    3.065507] init: Console is alive
[    3.069869] init: - watchdog -
[    4.137387] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.185887] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.193978] ag71xx 19000000.eth: invalid MAC address, using random address
[    4.212494] init: - preinit -
[    4.570766] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    5.941540] random: jshn: uninitialized urandom read (4 bytes read)
[    6.385099] random: jshn: uninitialized urandom read (4 bytes read)
[    6.490521] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.141221] jffs2: notice: (440) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (0 unchecked, 2 orphan) and 8 of xref (2 dead, 0 orphan) found.
[   11.159681] mount_root: switching to jffs2 overlay
[   11.168953] overlayfs: upper fs does not support tmpfile.
[   11.182642] urandom-seed: Seeding with /etc/urandom.seed
[   11.475722] procd: - early -
[   11.479387] procd: - watchdog -
[   12.218165] procd: - watchdog -
[   12.257826] procd: - ubus -
[   12.476722] urandom_read_iter: 5 callbacks suppressed
[   12.476734] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.492479] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.500387] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.516444] procd: - init -
Please press Enter to activate this console.
[   13.795842] urandom_read_iter: 19 callbacks suppressed
[   13.795854] random: jshn: uninitialized urandom read (4 bytes read)
[   14.000264] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.007380] random: ubus: uninitialized urandom read (4 bytes read)
[   14.126654] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.695797] urngd: v1.0.2 started.
[   14.731911] Loading modules backported from Linux version v5.15.33-0-g06f50ca83ace
[   14.739841] Backport generated by backports.git v5.15.33-1-0-g183c4ab2
[   15.433826] random: crng init done
[   15.437475] random: 1 urandom warning(s) missed due to ratelimiting
[   15.475801] PPP generic driver version 2.4.2
[   15.485175] NET: Registered protocol family 24
[   15.576413] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   15.584375] ag71xx 19000000.eth: invalid MAC address, using random address
[   15.673283] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.928247] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.

interrupt autoboot, and then boot manually:

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x83fee16c
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:0c:f0:60:dc:98
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
ath> bootm 0x9f040000
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.120
   Created:      2022-06-15   8:44:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2232191 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 5.10.120 (w43322@g14) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r19801-230c9da963) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Wed Jun 15 08:44:32 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link TL-AP301C v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56192K/65536K available (5458K kernel code, 596K rwdata, 1196K rodata, 1188K init, 201K bss, 9344K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000011] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008347] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074953] pid_max: default: 32768 minimum: 301
[    0.080018] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087727] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098777] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.109866] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120310] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127657] pinctrl core: initialized pinctrl subsystem
[    0.135112] NET: Registered protocol family 16
[    0.217037] clocksource: Switched to clocksource MIPS
[    0.223960] NET: Registered protocol family 2
[    0.228928] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.237436] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.246332] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.254497] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.261960] TCP: Hash tables configured (established 1024 bind 1024)
[    0.268874] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.275797] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.283647] NET: Registered protocol family 1
[    0.288361] PCI: CLS 0 bytes, default 32
[    0.301415] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.313243] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.319472] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.335099] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.342443] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.350151] printk: console [ttyS0] disabled
[    0.354759] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.363961] printk: console [ttyS0] enabled
[    0.363961] printk: console [ttyS0] enabled
[    0.373030] printk: bootconsole [early0] disabled
[    0.373030] printk: bootconsole [early0] disabled
[    0.398461] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.403412] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.410066] Creating 4 MTD partitions on "spi0.0":
[    0.415024] 0x000000000000-0x000000020000 : "factoryBoot"
[    0.425937] 0x000000020000-0x000000030000 : "factoryInfo"
[    0.433005] 0x000000030000-0x000000040000 : "art"
[    0.441608] 0x000000040000-0x000000800000 : "firmware"
[    0.448664] 2 uimage-fw partitions found on MTD device firmware
[    0.454799] Creating 2 MTD partitions on "firmware":
[    0.460028] 0x000000000000-0x000000230000 : "kernel"
[    0.468753] 0x000000230000-0x0000007c0000 : "rootfs"
[    0.475178] mtd: device 5 (rootfs) set to be root filesystem
[    0.482483] 1 squashfs-split partitions found on MTD device rootfs
[    0.488979] 0x0000005b0000-0x0000007c0000 : "rootfs_data"
[    0.506694] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.848148] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    0.856406] ag71xx 1a000000.eth: invalid MAC address, using random address
[    1.551553] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[    1.609588] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.619754] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: mii
[    1.626222] i2c /dev entries driver
[    1.631889] NET: Registered protocol family 10
[    1.646068] Segment Routing with IPv6
[    1.650093] NET: Registered protocol family 17
[    1.654804] 8021q: 802.1Q VLAN Support v1.8
[    1.660630] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.009163] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    2.019772] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.038904] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.055985] Freeing unused kernel memory: 1188K
[    2.060709] This architecture does not have kernel memory protection.
[    2.067379] Run /sbin/init as init process
[    2.802435] init: Console is alive
[    2.806681] init: - watchdog -
[    3.878304] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.926794] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.945666] init: - preinit -
[    5.671431] random: jshn: uninitialized urandom read (4 bytes read)
[    6.116847] random: jshn: uninitialized urandom read (4 bytes read)
[    6.221658] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.579959] eth1: link up (100Mbps/Full duplex)
[    8.584717] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   10.908909] jffs2: notice: (453) jffs2_build_xattr_subsystem: complete building xattr subsystem, 8 of xdatum (0 unchecked, 3 orphan) and 9 of xref (3 dead, 0 orphan) found.
[   10.927470] mount_root: switching to jffs2 overlay
[   10.936716] overlayfs: upper fs does not support tmpfile.
[   10.950202] urandom-seed: Seeding with /etc/urandom.seed
[   11.245023] eth1: link down
[   11.266017] procd: - early -
[   11.270125] procd: - watchdog -
[   12.010254] procd: - watchdog -
[   12.049829] procd: - ubus -
[   12.269556] urandom_read_iter: 5 callbacks suppressed
[   12.269568] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.285297] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.292776] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.309000] procd: - init -
Please press Enter to activate this console.
[   13.636972] urandom_read_iter: 19 callbacks suppressed
[   13.636984] random: jshn: uninitialized urandom read (4 bytes read)
[   13.850412] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.860880] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.877380] random: ubus: uninitialized urandom read (4 bytes read)
[   14.511693] Loading modules backported from Linux version v5.15.33-0-g06f50ca83ace
[   14.519622] Backport generated by backports.git v5.15.33-1-0-g183c4ab2
[   14.545521] urngd: v1.0.2 started.
[   15.261307] PPP generic driver version 2.4.2
[   15.278609] NET: Registered protocol family 24
[   15.315572] random: crng init done
[   15.319217] random: 1 urandom warning(s) missed due to ratelimiting
[   15.400565] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   15.496123] kmodloader: done loading kernel modules from /etc/modules.d/*
[   37.576334] br-lan: port 1(eth1) entered blocking state
[   37.581859] br-lan: port 1(eth1) entered disabled state
[   37.587705] device eth1 entered promiscuous mode
[   39.620065] eth1: link up (100Mbps/Full duplex)
[   39.624823] br-lan: port 1(eth1) entered blocking state
[   39.630292] br-lan: port 1(eth1) entered forwarding state
[   39.824147] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

From what I understand, it seems like some ethernet initialization is happening after I press Ctrl+B to interrupt autoboot. When running OEM firmware, that initialization process continues after bootdelay. But when running OpenWrt, it skips that process.

Are there any workarounds / solutions? TIA.

post the uboot's printenv.

bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm   0x9f040000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}board953x${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

bootcmd used to be bootelf 0x9f060600, but I changed it to bootm 0x9f040000 in order to boot OpenWrt.

can you elaborate on this ?

and is the bootm the only change you made to the uboot environment variables ?

Yes, that's the only change I've made.

Hold on a second, let me flash the OEM firmware back onto the device

This is what happens with the OEM firmware (everything in their original conditions):

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
Loading .text @ 0x80248c40 (4784 bytes)
Loading .rodata.str1.4 @ 0x80249ef0 (212 bytes)
Loading .data @ 0x80249fd0 (782018 bytes)
Clearing .bss @ 0x80308ea0 (4202512 bytes)
## Starting application at 0x80248c40 ...
Booting QCA953x
Linux version 2.6.31 (smbrouter@SMBapbuild) (gcc version 4.3.3 (GCC) ) #1 PREEMPT Sun Dec 24 13:02:27 CST 2017
flash_size passed from bootloader = -1
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 391 ahb 216
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:05 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(factoryBoot),64k(factoryInfo),64k(art),128k(bootloader),1536k(kernel),6016k(rootfs) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62480k/65536k available (1761k kernel code, 2984k reserved, 456k data, 112k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 122
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
6 cmdlinepart partitions found on MTD device ath-nor0
Creating 6 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "factoryBoot"
0x000000020000-0x000000030000 : "factoryInfo"
0x000000030000-0x000000040000 : "art"
0x000000040000-0x000000060000 : "bootloader"
0x000000060000-0x0000001e0000 : "kernel"
0x0000001e0000-0x0000007c0000 : "rootfs"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 112k freed
init started:  BusyBox v1.01 (2017.10.18-01:16+0000) multi-call binary
read_flash /dev/ar7100_flash_chrdev addr = 0x00060000 buf = 0x0x42e008 buflen = 0x00000600 (1536)
dkmgt_firmware.c:1775: [TRACE]dkmgt_firmware_flash_file_read_cloud_info() | Success write cloud info to FILE[/tmp/cloudinfo]
This Board use 2.6.31
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
br_strom_control: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint

****************************************************
                   stromcontrol init
****************************************************

****************************************************
                   arpfilter init
****************************************************
<cloud>[debug]opCloudInit(): 460  -> Begin opCloudInit()...
<cloud>[debug]ucl_cloudCfg_setup(): 449  -> Begin ucl_cloudCfg_setup()...
firmwareId=EADF814B0BDEFC25FFB6B84A8B191054
backFwIDNum=0, backwardFirmwareIdStr=
FwID = EADF814B0BDEFC25FFB6B84A8B191054

Fw Description = AP301Cv4

sw version = 1.0.0 Build 20171224 Rel.47510

ptnNum=9

name=factoryBoot, base=0, tail=20000, size=20000
name=factoryInfo, base=20000, tail=30000, size=10000
name=art, base=30000, tail=40000, size=10000
name=bootloader, base=40000, tail=60000, size=20000
name=tpHead, base=60000, tail=60600, size=600
name=kernel, base=60600, tail=1e0000, size=17fa00
name=rootfs, base=1e0000, tail=7c0000, size=5e0000
name=rootfs_data, base=7c0000, tail=7d0000, size=10000
name=log, base=7d0000, tail=7e0000, size=10000
product info: TL-AP301C(TP-LINK|CN|N300-2):4.0
PRODUCT_ID = 0x0301CD04

Firmware Version: 1.0.0 Build 20171224 Rel.47510
sn1:1 sn2:0 sn3:0, sn: 10000, date: 20171224, time: 47510
Product ID=0x301cd04

opt:    1    12 | 94D9B35A06C9
opt:    2    13 | 0000000000000
opt:    3    40 | 000CA4E989ABC45415504BB50BED019419D77C6E
opt:    4    32 | B184C26B63F4FE78288E7B69F4A60B69
opt:    5    74 | {devModel:TL-AP301C,2.4gChip:QCA9533-BL3A,5gChip:N/A,switch:N/A,hwVer:4.0}
opt:    6   256 | ED8D6254364404938FA3D1BF409AE50FAAF82C2BD67A3C554019237AB4F82A1581936B5C018E0A11CB48CD6F64CF5F6E30FC6FF920A0C5F49886AC1A6B0270FB407FFE8C51FD71426B5EB9EB4F81F5507A82079575BA5668D800CAAF62E44BF4AF5FFB1FC2CDF48BD3B61F9CC1BBE6C14C436FDC35C9B76136F2DAC4CA0F253B
opt:    7    17 | EDB8E558E983F163B
Syslog disabled or log buffer not allocated
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet :   1
qca953x_GMAC: Max tx descriptor count :   128
qca953x_GMAC: Max rx descriptor count :   128
qca953x_GMAC: Mac capability flags    :   3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet :   1
qca953x_GMAC: Max tx descriptor count :   128
qca953x_GMAC: Max rx descriptor count :   128
qca953x_GMAC: Mac capability flags    :   3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a51800
athr_gmac_ring_alloc Allocated 2048 at 0x83a51000
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83a32800
athr_gmac_ring_alloc Allocated 2048 at 0x83a32000
[ntlinkInit(169)HONEYBEE ----> S27 PHY MDIO
]socket ok
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
insmod: cannot open module `/lib/modules/2.6.31/kernel/br_igmp_snooping.ko': No such file or directory
rmmod: br_dhcp_filter.ko: No such file or directory
route: SIOC[ADD|DEL]RT: No such process
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found

************************************ 0
ath_spi_uid_read 0x38333537
ath_spi_uid_read 0x31095b33

************************************ 0
fat_ap
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
insmod: cannot open module `/lib/modules/2.6.31/net/hst_tx99.ko': No such file or directory
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
ath_get_caps[6232] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6207] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12725] dfsdomain 1

****************************************************
                   dhcpfilter init
****************************************************

****************************************************
                   maclimit init
****************************************************

****************************************************
                   rrm tplink init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 83078000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
ath_attach_dfs[12725] dfsdomain 1
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
wlan_vap_create : enter. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
ath0
ath_attach_dfs[12725] dfsdomain 1
Interface doesn't accept private ioctl...
ForBiasAuto (8BE0): Operation not permitted
TP-DCS: [wifi0] Channel == AUTO, Disable DCS First
TP-DCS: [wifi0] DCS Auto Mode, Enable DCS

[ieee80211_ioctl_siwessid:1143] tmpssid.ssid=TP-LINK_2.4G_59FDFD, tmpssid.len = 19

[ieee80211_ioctl_siwessid:1150] DES SSID SET=TP-LINK_2.4G_59FDFD
device ath0 entered promiscuous mode
[wlanCreateVAP(243)]FIXME tmp enable rrm wnm
br0: port 3(ath0) entering forwarding state
Best Channel 6
Best Channel 6
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
br0: port 3(ath0) entering disabled state
br0: port 3(ath0) entering forwarding state
route: SIOC[ADD|DEL]RT: No such process
fat_ap
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
#################check http status############
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
@@@@, start cloud-brd/cloud-client
httpMudCreate: MUD 0x6163a0 was created
httpServerCreate: try to add port 80
enet1 port4 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1  RGMII  1000Mbps  full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
Setting Drop CRC Errors, Pause Frames and Length Error frames
br0: port 2(eth1) entering forwarding state
mmmInit():Total mem size=51364, addr=0x0x449150.
*************************************************************
*************************MMM TABLE DUMP**********************
-------------------------------------------------------------
 poolhead(40)  poolnum  dynamictimes  chainhead  poolend
-------------------------------------------------------------
 0x449150        8          0         (nil)     0x4559f4
-------------------------------------------------------------
 index  poolhead(20)    size    blocks    free     usage
-------------------------------------------------------------
  1     0x449178        32          256       256       0
  2     0x44b590        64          128       128       0
  3     0x44d7a8        128         64        64        0
  4     0x44f8c0        256         32        32        0
  5     0x451958        512         8         8         0
  6     0x452990        1024        4         4         0
  7     0x4539b8        2048        2         2         0
  8     0x4549d8        4096        1         1         0
-------------------------------------------------------------
 index  chainnode(16)   magic    length    prev    next
-------------------------------------------------------------
(nil)
*************************************************************
Function is:get_device_name, Line is:202.[buffer is TL-AP301C:4.0
].

Function is:get_device_hardware, Line is:243.hw_ver:[4.0]
Function is:get_device_software, Line is:261.sw_ver:[1.0.0 Build 20171224 Rel. 47510]
Function is:get_device_fwId, Line is:359.[buffer is firmwareId:EADF814B0BDEFC25FFB6B84A8B191054
].

Function is:get_device_fwId, Line is:377.[buffer is EADF814B0BDEFC25FFB6B84A8B191054].

Function is:get_device_hwId, Line is:390.UCL_OPID_GET_HARDWAREID:[1048594]
Function is:get_device_hwId, Line is:398.hw_id:[B184C26B63F4FE78288E7B69F4A60B69]
Function is:get_device_mac, Line is:284.mac:[94D9B35A06C9]
Function is:get_device_Id, Line is:304.device_id:[000CA4E989ABC45415504BB50BED019419D77C6E]
Function is:getDeviceBasicInfo, Line is:276.device config:
name[TL-AP301C]
, info[TL-AP301C]
, model[TL-AP301C]
,                                       hw version[4.0]
, sw version[1.0.0 Build 20171224 Rel. 47510]
, alias[TL-AP301C]
,                                       device id[000CA4E989ABC45415504BB50BED019419D77C6E]
, fw id[EADF814B0BDEFC25FFB6B84A8B191054]
, hw id[B184C26B63F4FE78288E7B69F4A60B69]
, mac[94D9B35A06C9]

<cloud>[debug]cloud_ucl_opfun_getCloudInfo(): 479  -> get cloud config...
<cloud>[debug]cloud_ucl_opfun_setCloudInfo(): 505  -> set cloud...
Function is:getDevBindRecord, Line is:293.get device bind record...

Function is:getDevBindRecord, Line is:296.bind status is not bind

Function is:logHandler2, Line is:313.Enter log handler, push log info to cloud...

Function is:initPthreadLogHandler, Line is:384.init signal handler success!

Function is:downloadHandler, Line is:188.Enter download handler, download firmware/plugins from cloud...

Function is:downloadHandler, Line is:193.wait semaphore to download firmware or plugin to device...

Function is:initPthreadDownloadHandler, Line is:264.init download handler success!

Function is:thread_console, Line is:326.Starting wdctl.
Function is:thread_console, Line is:329.Socket name: /tmp/wdctl.sock
Function is:thread_console, Line is:331.Creating socket
Function is:create_unix_socket, Line is:186.Got unix socket 0
Function is:create_unix_socket, Line is:191.Filling sockaddr_un
Function is:create_unix_socket, Line is:195.Binding socket (/tmp/wdctl.sock) (15)
Function is:cloudClientInit, Line is:173.Init cloud-client environment successful.

Function is:print_hello_cloud_request, Line is:46.deviceId is 000CA4E989ABC45415504BB50BED019419D77C6E

Function is:print_hello_cloud_request, Line is:47.cloudUserName is

Function is:print_hello_cloud_request, Line is:48.deviceName is TL-AP301C

Function is:print_hello_cloud_request, Line is:49.aliasName is TL-AP301C

Function is:print_hello_cloud_request, Line is:50.deviceMac is 94D9B35A06C9

Function is:print_hello_cloud_request, Line is:51.hardwareId is B184C26B63F4FE78288E7B69F4A60B69

Function is:print_hello_cloud_request, Line is:52.deviceModel is TL-AP301C

Function is:print_hello_cloud_request, Line is:53.deviceHwVer is 4.0

Function is:print_hello_cloud_request, Line is:54.firmwareId is EADF814B0BDEFC25FFB6B84A8B191054

Function is:print_hello_cloud_request, Line is:55.oemId is

Function is:print_hello_cloud_request, Line is:56.fwVersion is 1.0.0 Build 20171224 Rel. 47510


 TL-AP301C mips #1 PREEMPT Sun Dec 24 13:02:27 CST 2017 (none)
TL-AP301C login:

the initialization seems to be still running after the bootloader hands off to the the kernel.