Ath79: eth1 fails to initialize unless autoboot interrupted and bootcmd manually executed

I'm trying to add support to a new device.

I've gotten to the point where if I interrupt the autoboot in u-boot, and then run the bootcmd manually, it works flawlessly, but if I let it autoboot on its own eth1 fails to initialize.

autoboot:

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.120
   Created:      2022-06-15   8:44:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2232191 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 5.10.120 (w43322@g14) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r19801-230c9da963) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Wed Jun 15 08:44:32 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link TL-AP301C v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56192K/65536K available (5458K kernel code, 596K rwdata, 1196K rodata, 1188K init, 201K bss, 9344K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000011] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008347] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074953] pid_max: default: 32768 minimum: 301
[    0.080019] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087727] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098781] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.109871] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120319] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127666] pinctrl core: initialized pinctrl subsystem
[    0.135125] NET: Registered protocol family 16
[    0.217034] clocksource: Switched to clocksource MIPS
[    0.223955] NET: Registered protocol family 2
[    0.228926] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.237437] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.246331] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.254496] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.261959] TCP: Hash tables configured (established 1024 bind 1024)
[    0.268876] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.275797] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.283647] NET: Registered protocol family 1
[    0.288362] PCI: CLS 0 bytes, default 32
[    0.301408] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.313236] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.319471] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.335104] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.342450] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.350159] printk: console [ttyS0] disabled
[    0.354767] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.363970] printk: console [ttyS0] enabled
[    0.363970] printk: console [ttyS0] enabled
[    0.373039] printk: bootconsole [early0] disabled
[    0.373039] printk: bootconsole [early0] disabled
[    0.398451] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.403401] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.410047] Creating 4 MTD partitions on "spi0.0":
[    0.415007] 0x000000000000-0x000000020000 : "factoryBoot"
[    0.425927] 0x000000020000-0x000000030000 : "factoryInfo"
[    0.432991] 0x000000030000-0x000000040000 : "art"
[    0.441581] 0x000000040000-0x000000800000 : "firmware"
[    0.448634] 2 uimage-fw partitions found on MTD device firmware
[    0.454771] Creating 2 MTD partitions on "firmware":
[    0.460001] 0x000000000000-0x000000230000 : "kernel"
[    0.468733] 0x000000230000-0x0000007c0000 : "rootfs"
[    0.475153] mtd: device 5 (rootfs) set to be root filesystem
[    0.482465] 1 squashfs-split partitions found on MTD device rootfs
[    0.488961] 0x0000005b0000-0x0000007c0000 : "rootfs_data"
[    0.506664] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.848146] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    0.856409] ag71xx 1a000000.eth: invalid MAC address, using random address
[    1.540436] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.550565] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: mii
[    1.557149] i2c /dev entries driver
[    1.562764] NET: Registered protocol family 10
[    1.577282] Segment Routing with IPv6
[    1.581228] NET: Registered protocol family 17
[    1.585940] 8021q: 802.1Q VLAN Support v1.8
[    1.591816] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.938111] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.946525] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.288100] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    2.306394] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.323532] Freeing unused kernel memory: 1188K
[    2.328263] This architecture does not have kernel memory protection.
[    2.334934] Run /sbin/init as init process
[    3.065507] init: Console is alive
[    3.069869] init: - watchdog -
[    4.137387] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.185887] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.193978] ag71xx 19000000.eth: invalid MAC address, using random address
[    4.212494] init: - preinit -
[    4.570766] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    5.941540] random: jshn: uninitialized urandom read (4 bytes read)
[    6.385099] random: jshn: uninitialized urandom read (4 bytes read)
[    6.490521] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.141221] jffs2: notice: (440) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (0 unchecked, 2 orphan) and 8 of xref (2 dead, 0 orphan) found.
[   11.159681] mount_root: switching to jffs2 overlay
[   11.168953] overlayfs: upper fs does not support tmpfile.
[   11.182642] urandom-seed: Seeding with /etc/urandom.seed
[   11.475722] procd: - early -
[   11.479387] procd: - watchdog -
[   12.218165] procd: - watchdog -
[   12.257826] procd: - ubus -
[   12.476722] urandom_read_iter: 5 callbacks suppressed
[   12.476734] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.492479] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.500387] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.516444] procd: - init -
Please press Enter to activate this console.
[   13.795842] urandom_read_iter: 19 callbacks suppressed
[   13.795854] random: jshn: uninitialized urandom read (4 bytes read)
[   14.000264] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.007380] random: ubus: uninitialized urandom read (4 bytes read)
[   14.126654] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.695797] urngd: v1.0.2 started.
[   14.731911] Loading modules backported from Linux version v5.15.33-0-g06f50ca83ace
[   14.739841] Backport generated by backports.git v5.15.33-1-0-g183c4ab2
[   15.433826] random: crng init done
[   15.437475] random: 1 urandom warning(s) missed due to ratelimiting
[   15.475801] PPP generic driver version 2.4.2
[   15.485175] NET: Registered protocol family 24
[   15.576413] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   15.584375] ag71xx 19000000.eth: invalid MAC address, using random address
[   15.673283] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.928247] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.

interrupt autoboot, and then boot manually:

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x83fee16c
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:0c:f0:60:dc:98
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
ath> bootm 0x9f040000
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.120
   Created:      2022-06-15   8:44:32 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2232191 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 5.10.120 (w43322@g14) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r19801-230c9da963) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Wed Jun 15 08:44:32 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link TL-AP301C v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56192K/65536K available (5458K kernel code, 596K rwdata, 1196K rodata, 1188K init, 201K bss, 9344K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000011] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008347] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074953] pid_max: default: 32768 minimum: 301
[    0.080018] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087727] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098777] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.109866] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120310] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127657] pinctrl core: initialized pinctrl subsystem
[    0.135112] NET: Registered protocol family 16
[    0.217037] clocksource: Switched to clocksource MIPS
[    0.223960] NET: Registered protocol family 2
[    0.228928] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.237436] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.246332] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.254497] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.261960] TCP: Hash tables configured (established 1024 bind 1024)
[    0.268874] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.275797] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.283647] NET: Registered protocol family 1
[    0.288361] PCI: CLS 0 bytes, default 32
[    0.301415] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.313243] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.319472] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.335099] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.342443] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.350151] printk: console [ttyS0] disabled
[    0.354759] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.363961] printk: console [ttyS0] enabled
[    0.363961] printk: console [ttyS0] enabled
[    0.373030] printk: bootconsole [early0] disabled
[    0.373030] printk: bootconsole [early0] disabled
[    0.398461] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.403412] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.410066] Creating 4 MTD partitions on "spi0.0":
[    0.415024] 0x000000000000-0x000000020000 : "factoryBoot"
[    0.425937] 0x000000020000-0x000000030000 : "factoryInfo"
[    0.433005] 0x000000030000-0x000000040000 : "art"
[    0.441608] 0x000000040000-0x000000800000 : "firmware"
[    0.448664] 2 uimage-fw partitions found on MTD device firmware
[    0.454799] Creating 2 MTD partitions on "firmware":
[    0.460028] 0x000000000000-0x000000230000 : "kernel"
[    0.468753] 0x000000230000-0x0000007c0000 : "rootfs"
[    0.475178] mtd: device 5 (rootfs) set to be root filesystem
[    0.482483] 1 squashfs-split partitions found on MTD device rootfs
[    0.488979] 0x0000005b0000-0x0000007c0000 : "rootfs_data"
[    0.506694] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.848148] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    0.856406] ag71xx 1a000000.eth: invalid MAC address, using random address
[    1.551553] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[    1.609588] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.619754] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: mii
[    1.626222] i2c /dev entries driver
[    1.631889] NET: Registered protocol family 10
[    1.646068] Segment Routing with IPv6
[    1.650093] NET: Registered protocol family 17
[    1.654804] 8021q: 802.1Q VLAN Support v1.8
[    1.660630] ag71xx 19000000.eth: invalid MAC address, using random address
[    2.009163] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    2.019772] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.038904] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    2.055985] Freeing unused kernel memory: 1188K
[    2.060709] This architecture does not have kernel memory protection.
[    2.067379] Run /sbin/init as init process
[    2.802435] init: Console is alive
[    2.806681] init: - watchdog -
[    3.878304] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.926794] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.945666] init: - preinit -
[    5.671431] random: jshn: uninitialized urandom read (4 bytes read)
[    6.116847] random: jshn: uninitialized urandom read (4 bytes read)
[    6.221658] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.579959] eth1: link up (100Mbps/Full duplex)
[    8.584717] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   10.908909] jffs2: notice: (453) jffs2_build_xattr_subsystem: complete building xattr subsystem, 8 of xdatum (0 unchecked, 3 orphan) and 9 of xref (3 dead, 0 orphan) found.
[   10.927470] mount_root: switching to jffs2 overlay
[   10.936716] overlayfs: upper fs does not support tmpfile.
[   10.950202] urandom-seed: Seeding with /etc/urandom.seed
[   11.245023] eth1: link down
[   11.266017] procd: - early -
[   11.270125] procd: - watchdog -
[   12.010254] procd: - watchdog -
[   12.049829] procd: - ubus -
[   12.269556] urandom_read_iter: 5 callbacks suppressed
[   12.269568] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.285297] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.292776] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.309000] procd: - init -
Please press Enter to activate this console.
[   13.636972] urandom_read_iter: 19 callbacks suppressed
[   13.636984] random: jshn: uninitialized urandom read (4 bytes read)
[   13.850412] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.860880] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.877380] random: ubus: uninitialized urandom read (4 bytes read)
[   14.511693] Loading modules backported from Linux version v5.15.33-0-g06f50ca83ace
[   14.519622] Backport generated by backports.git v5.15.33-1-0-g183c4ab2
[   14.545521] urngd: v1.0.2 started.
[   15.261307] PPP generic driver version 2.4.2
[   15.278609] NET: Registered protocol family 24
[   15.315572] random: crng init done
[   15.319217] random: 1 urandom warning(s) missed due to ratelimiting
[   15.400565] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   15.496123] kmodloader: done loading kernel modules from /etc/modules.d/*
[   37.576334] br-lan: port 1(eth1) entered blocking state
[   37.581859] br-lan: port 1(eth1) entered disabled state
[   37.587705] device eth1 entered promiscuous mode
[   39.620065] eth1: link up (100Mbps/Full duplex)
[   39.624823] br-lan: port 1(eth1) entered blocking state
[   39.630292] br-lan: port 1(eth1) entered forwarding state
[   39.824147] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

From what I understand, it seems like some ethernet initialization is happening after I press Ctrl+B to interrupt autoboot. When running OEM firmware, that initialization process continues after bootdelay. But when running OpenWrt, it skips that process.

Are there any workarounds / solutions? TIA.

post the uboot's printenv.

bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
bootcmd=bootm   0x9f040000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}board953x${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

bootcmd used to be bootelf 0x9f060600, but I changed it to bootm 0x9f040000 in order to boot OpenWrt.

can you elaborate on this ?

and is the bootm the only change you made to the uboot environment variables ?

Yes, that's the only change I've made.

Hold on a second, let me flash the OEM firmware back onto the device

This is what happens with the OEM firmware (everything in their original conditions):

U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov 23 2017 - 03:51:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(234): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x7, 0x37)
Tap values = (0x1f, 0x1f, 0x1f, 0x1f)
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 161k for U-Boot at: 83fd4000
Reserving 192k for malloc() at: 83fa4000
Reserving 44 Bytes for Board Info at: 83fa3fd4
Reserving 36 Bytes for Global Data at: 83fa3fb0
Reserving 128k for boot params() at: 83f83fb0
Stack Pointer at: 83f83f98
Now running in RAM - U-Boot at: 83fd4000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x58b1a100
Hit Ctrl+B to stop autoboot:  0
Loading .text @ 0x80248c40 (4784 bytes)
Loading .rodata.str1.4 @ 0x80249ef0 (212 bytes)
Loading .data @ 0x80249fd0 (782018 bytes)
Clearing .bss @ 0x80308ea0 (4202512 bytes)
## Starting application at 0x80248c40 ...
Booting QCA953x
Linux version 2.6.31 (smbrouter@SMBapbuild) (gcc version 4.3.3 (GCC) ) #1 PREEMPT Sun Dec 24 13:02:27 CST 2017
flash_size passed from bootloader = -1
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 391 ahb 216
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:05 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(factoryBoot),64k(factoryInfo),64k(art),128k(bootloader),1536k(kernel),6016k(rootfs) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62480k/65536k available (1761k kernel code, 2984k reserved, 456k data, 112k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 122
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
6 cmdlinepart partitions found on MTD device ath-nor0
Creating 6 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "factoryBoot"
0x000000020000-0x000000030000 : "factoryInfo"
0x000000030000-0x000000040000 : "art"
0x000000040000-0x000000060000 : "bootloader"
0x000000060000-0x0000001e0000 : "kernel"
0x0000001e0000-0x0000007c0000 : "rootfs"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 112k freed
init started:  BusyBox v1.01 (2017.10.18-01:16+0000) multi-call binary
read_flash /dev/ar7100_flash_chrdev addr = 0x00060000 buf = 0x0x42e008 buflen = 0x00000600 (1536)
dkmgt_firmware.c:1775: [TRACE]dkmgt_firmware_flash_file_read_cloud_info() | Success write cloud info to FILE[/tmp/cloudinfo]
This Board use 2.6.31
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
br_strom_control: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint

****************************************************
                   stromcontrol init
****************************************************

****************************************************
                   arpfilter init
****************************************************
<cloud>[debug]opCloudInit(): 460  -> Begin opCloudInit()...
<cloud>[debug]ucl_cloudCfg_setup(): 449  -> Begin ucl_cloudCfg_setup()...
firmwareId=EADF814B0BDEFC25FFB6B84A8B191054
backFwIDNum=0, backwardFirmwareIdStr=
FwID = EADF814B0BDEFC25FFB6B84A8B191054

Fw Description = AP301Cv4

sw version = 1.0.0 Build 20171224 Rel.47510

ptnNum=9

name=factoryBoot, base=0, tail=20000, size=20000
name=factoryInfo, base=20000, tail=30000, size=10000
name=art, base=30000, tail=40000, size=10000
name=bootloader, base=40000, tail=60000, size=20000
name=tpHead, base=60000, tail=60600, size=600
name=kernel, base=60600, tail=1e0000, size=17fa00
name=rootfs, base=1e0000, tail=7c0000, size=5e0000
name=rootfs_data, base=7c0000, tail=7d0000, size=10000
name=log, base=7d0000, tail=7e0000, size=10000
product info: TL-AP301C(TP-LINK|CN|N300-2):4.0
PRODUCT_ID = 0x0301CD04

Firmware Version: 1.0.0 Build 20171224 Rel.47510
sn1:1 sn2:0 sn3:0, sn: 10000, date: 20171224, time: 47510
Product ID=0x301cd04

opt:    1    12 | 94D9B35A06C9
opt:    2    13 | 0000000000000
opt:    3    40 | 000CA4E989ABC45415504BB50BED019419D77C6E
opt:    4    32 | B184C26B63F4FE78288E7B69F4A60B69
opt:    5    74 | {devModel:TL-AP301C,2.4gChip:QCA9533-BL3A,5gChip:N/A,switch:N/A,hwVer:4.0}
opt:    6   256 | ED8D6254364404938FA3D1BF409AE50FAAF82C2BD67A3C554019237AB4F82A1581936B5C018E0A11CB48CD6F64CF5F6E30FC6FF920A0C5F49886AC1A6B0270FB407FFE8C51FD71426B5EB9EB4F81F5507A82079575BA5668D800CAAF62E44BF4AF5FFB1FC2CDF48BD3B61F9CC1BBE6C14C436FDC35C9B76136F2DAC4CA0F253B
opt:    7    17 | EDB8E558E983F163B
Syslog disabled or log buffer not allocated
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet :   1
qca953x_GMAC: Max tx descriptor count :   128
qca953x_GMAC: Max rx descriptor count :   128
qca953x_GMAC: Mac capability flags    :   3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet :   1
qca953x_GMAC: Max tx descriptor count :   128
qca953x_GMAC: Max rx descriptor count :   128
qca953x_GMAC: Mac capability flags    :   3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a51800
athr_gmac_ring_alloc Allocated 2048 at 0x83a51000
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83a32800
athr_gmac_ring_alloc Allocated 2048 at 0x83a32000
[ntlinkInit(169)HONEYBEE ----> S27 PHY MDIO
]socket ok
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
insmod: cannot open module `/lib/modules/2.6.31/kernel/br_igmp_snooping.ko': No such file or directory
rmmod: br_dhcp_filter.ko: No such file or directory
route: SIOC[ADD|DEL]RT: No such process
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found
sh: iptables: not found

************************************ 0
ath_spi_uid_read 0x38333537
ath_spi_uid_read 0x31095b33

************************************ 0
fat_ap
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
insmod: cannot open module `/lib/modules/2.6.31/net/hst_tx99.ko': No such file or directory
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
ath_get_caps[6232] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6207] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12725] dfsdomain 1

****************************************************
                   dhcpfilter init
****************************************************

****************************************************
                   maclimit init
****************************************************

****************************************************
                   rrm tplink init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 83078000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
ath_attach_dfs[12725] dfsdomain 1
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
wlan_vap_create : enter. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
ath0
ath_attach_dfs[12725] dfsdomain 1
Interface doesn't accept private ioctl...
ForBiasAuto (8BE0): Operation not permitted
TP-DCS: [wifi0] Channel == AUTO, Disable DCS First
TP-DCS: [wifi0] DCS Auto Mode, Enable DCS

[ieee80211_ioctl_siwessid:1143] tmpssid.ssid=TP-LINK_2.4G_59FDFD, tmpssid.len = 19

[ieee80211_ioctl_siwessid:1150] DES SSID SET=TP-LINK_2.4G_59FDFD
device ath0 entered promiscuous mode
[wlanCreateVAP(243)]FIXME tmp enable rrm wnm
br0: port 3(ath0) entering forwarding state
Best Channel 6
Best Channel 6
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
br0: port 3(ath0) entering disabled state
br0: port 3(ath0) entering forwarding state
route: SIOC[ADD|DEL]RT: No such process
fat_ap
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
#################check http status############
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
Write Reg: 0x00000000: Oldval = 0x00001800 Newval = 0x00001000
@@@@, start cloud-brd/cloud-client
httpMudCreate: MUD 0x6163a0 was created
httpServerCreate: try to add port 80
enet1 port4 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1  RGMII  1000Mbps  full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
Setting Drop CRC Errors, Pause Frames and Length Error frames
br0: port 2(eth1) entering forwarding state
mmmInit():Total mem size=51364, addr=0x0x449150.
*************************************************************
*************************MMM TABLE DUMP**********************
-------------------------------------------------------------
 poolhead(40)  poolnum  dynamictimes  chainhead  poolend
-------------------------------------------------------------
 0x449150        8          0         (nil)     0x4559f4
-------------------------------------------------------------
 index  poolhead(20)    size    blocks    free     usage
-------------------------------------------------------------
  1     0x449178        32          256       256       0
  2     0x44b590        64          128       128       0
  3     0x44d7a8        128         64        64        0
  4     0x44f8c0        256         32        32        0
  5     0x451958        512         8         8         0
  6     0x452990        1024        4         4         0
  7     0x4539b8        2048        2         2         0
  8     0x4549d8        4096        1         1         0
-------------------------------------------------------------
 index  chainnode(16)   magic    length    prev    next
-------------------------------------------------------------
(nil)
*************************************************************
Function is:get_device_name, Line is:202.[buffer is TL-AP301C:4.0
].

Function is:get_device_hardware, Line is:243.hw_ver:[4.0]
Function is:get_device_software, Line is:261.sw_ver:[1.0.0 Build 20171224 Rel. 47510]
Function is:get_device_fwId, Line is:359.[buffer is firmwareId:EADF814B0BDEFC25FFB6B84A8B191054
].

Function is:get_device_fwId, Line is:377.[buffer is EADF814B0BDEFC25FFB6B84A8B191054].

Function is:get_device_hwId, Line is:390.UCL_OPID_GET_HARDWAREID:[1048594]
Function is:get_device_hwId, Line is:398.hw_id:[B184C26B63F4FE78288E7B69F4A60B69]
Function is:get_device_mac, Line is:284.mac:[94D9B35A06C9]
Function is:get_device_Id, Line is:304.device_id:[000CA4E989ABC45415504BB50BED019419D77C6E]
Function is:getDeviceBasicInfo, Line is:276.device config:
name[TL-AP301C]
, info[TL-AP301C]
, model[TL-AP301C]
,                                       hw version[4.0]
, sw version[1.0.0 Build 20171224 Rel. 47510]
, alias[TL-AP301C]
,                                       device id[000CA4E989ABC45415504BB50BED019419D77C6E]
, fw id[EADF814B0BDEFC25FFB6B84A8B191054]
, hw id[B184C26B63F4FE78288E7B69F4A60B69]
, mac[94D9B35A06C9]

<cloud>[debug]cloud_ucl_opfun_getCloudInfo(): 479  -> get cloud config...
<cloud>[debug]cloud_ucl_opfun_setCloudInfo(): 505  -> set cloud...
Function is:getDevBindRecord, Line is:293.get device bind record...

Function is:getDevBindRecord, Line is:296.bind status is not bind

Function is:logHandler2, Line is:313.Enter log handler, push log info to cloud...

Function is:initPthreadLogHandler, Line is:384.init signal handler success!

Function is:downloadHandler, Line is:188.Enter download handler, download firmware/plugins from cloud...

Function is:downloadHandler, Line is:193.wait semaphore to download firmware or plugin to device...

Function is:initPthreadDownloadHandler, Line is:264.init download handler success!

Function is:thread_console, Line is:326.Starting wdctl.
Function is:thread_console, Line is:329.Socket name: /tmp/wdctl.sock
Function is:thread_console, Line is:331.Creating socket
Function is:create_unix_socket, Line is:186.Got unix socket 0
Function is:create_unix_socket, Line is:191.Filling sockaddr_un
Function is:create_unix_socket, Line is:195.Binding socket (/tmp/wdctl.sock) (15)
Function is:cloudClientInit, Line is:173.Init cloud-client environment successful.

Function is:print_hello_cloud_request, Line is:46.deviceId is 000CA4E989ABC45415504BB50BED019419D77C6E

Function is:print_hello_cloud_request, Line is:47.cloudUserName is

Function is:print_hello_cloud_request, Line is:48.deviceName is TL-AP301C

Function is:print_hello_cloud_request, Line is:49.aliasName is TL-AP301C

Function is:print_hello_cloud_request, Line is:50.deviceMac is 94D9B35A06C9

Function is:print_hello_cloud_request, Line is:51.hardwareId is B184C26B63F4FE78288E7B69F4A60B69

Function is:print_hello_cloud_request, Line is:52.deviceModel is TL-AP301C

Function is:print_hello_cloud_request, Line is:53.deviceHwVer is 4.0

Function is:print_hello_cloud_request, Line is:54.firmwareId is EADF814B0BDEFC25FFB6B84A8B191054

Function is:print_hello_cloud_request, Line is:55.oemId is

Function is:print_hello_cloud_request, Line is:56.fwVersion is 1.0.0 Build 20171224 Rel. 47510


 TL-AP301C mips #1 PREEMPT Sun Dec 24 13:02:27 CST 2017 (none)
TL-AP301C login:

the initialization seems to be still running after the bootloader hands off to the the kernel.

Hello,

I faced the same issue on a TP-Link EAP245 v1 with a QCA956x SoC.

U-boot was not initializing ethernet on normal path, but if you interrupt boot it initialize it.

Looking in TP-Link GPL code I saw that TP-Link copy and paste code from QCA u-boot directly in Linux kernel (in linux/arch/mips/ath79/mach_ap152.c) to start ethernet instead of configuring U-Boot for their board.

I translated the code to real kernel style and add it to ag71xx driver in commit, call it in DTS.

You may have to do the same, but I don't see GPL code for your device.

1 Like

Hi @w43322
Did you sort out problem with no ethernet initialization on your device when automatically booting? I'm adding support for EAP11x device family and struggling with same issue. Wondering it has been resolved by you.

Sorry, it was not resolved, and I have abandoned the project since last summer. But I might pick it up soon since I have more time to troubleshoot now.
If you want to look into it, you might want to start by looking at j-d-r's comment.

I've already looked there, but the solution they introduced is for other, most recent SoC - I doubt it is applicable for my device, especially when I see number of devices with QCA953x which are already supported and doesn't have this fix.

BTW this is my pr, though prolly wont be accepted since it uses a 3rd party bootloader.

OK I see. Thank you for your efforts btw, appreciate it.

I thought about reverse engineering the u-boot binary to try to locate the function they call to initialize the eth interface, but I didn't have the required knowledge to do it. In their u-boot they have some sort of jump to label or run function command, and their bootcmd can accept multiple lines of command separated by a semi-colon. So theoretically something like run eth_init(); bootelf 0x9f040000 would work, don't know if it will actually work though.

Looks like yet another interesting project - it looks that your device is similar to my EAP11x. We face same issue with mac initialization. I believe it can be resolved somehow while OEM kernel does it. We just need to find a way to incorporate these initialization into OpenWRT kernel - then it is independent what u-boot does. Hope there will be solution on my device, than you can import it to yours, while you have already did great progress. QCA953x SoC is well known and well supported already in OpenWRT - I don't see reason we cannot add even more devices. Let's stay connected.

OK, please let me know if you have made any progress, best of luck!