IPQ5018: NAND block protection still enabled

So I’m trying to build OpenWRT firmware for my device on the qualcommax/ipq50xx target.

The device is an OEM enterprise-grade access point that is very similar to Yuncore AX830. It even uses the exact 128MB NAND (Winbond W25N01GW). So I just copied the DTS with minor changes to make the LED and reset button work, extracted the board data, and followed the AX830 flashing guide.

Everything went well, except for the fact that the device won’t be able to boot once I rebooted the device using the reboot command. Whenever I need to restart the device, I have to physically pull the plug and plug it back again to make it work. So “cold boot” works, but “warm boot” doesn’t.

I suspect the kernel might’ve done something with the NAND flash and didn’t restore the changes properly during reboot, but my knowledge in this area are very limited and I don’t even know where I should begin to look.

U-Boot 2016.01 (Oct 25 2023 - 02:56:42 -0400)

DRAM:  smem ram ptable found: ver: 1 len: 4
512 MiB
NAND:  QPIC controller support serial NAND
ID = 21baef
Vendor = ef
Device = ba
Serial Nand Device Found With ID : 0xef 0xba
Serial NAND device Manufacturer:W25N01GW
Device Size:128 MiB, Page size:2048, Spare Size:64, ECC:4-bit
qpic_spi_nand_config : block protection still enabled.We can't erase a block
qpic_nand_init : Issue with Serial Nand configuration.
SPI_ADDR_LEN=3
SF: Detected MX25U12835F with page size 256 Bytes, erase size 64 KiB, total 16 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x1000000
16 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
In:    serial@78AF000
Out:   serial@78AF000
Err:   serial@78AF000
WPX8324 U-Boot Bv0.0.1

machid: 8040004
GPIO settings
Hit any key to stop autoboot:  0
No such device

Net:   cmbblk is stable 5
MAC0 addr:e8:c7:4f:2a:7:40
PHY ID1: 0x4d
PHY ID2: 0xd0c0
MAC1 addr:e8:c7:4f:2a:7:41
PHY ID1: 0x4d
PHY ID2: 0xd101
eth0, eth1

Net:   cmbblk is stable 5
MAC0 addr:e8:c7:4f:2a:7:40
PHY ID1: 0x4d
PHY ID2: 0xd0c0
MAC1 addr:e8:c7:4f:2a:7:41
PHY ID1: 0x4d
PHY ID2: 0xd101
, eth0, eth1
IPQ5018#

Any help would be greatly appreciated, thanks.

Harder for you if their bootloader poorly supports their flash chip.

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

I’m using the 25.12-SNAPSHOT version of OpenWrt. Yes, the device is currently unsupported, hence I’m planning to add support for it.

Here’s the complete boot log when it manages to boot from a cold start.

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1.1-00066
S - IMAGE_VARIANT_STRING=MAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002c1
B -       127 - PBL, Start
B -      1562 - bootable_media_detect_entry, Start
B -      1738 - bootable_media_detect_success, Start
B -      1743 - elf_loader_entry, Start
B -     10167 - auth_hash_seg_entry, Start
B -     10524 - auth_hash_seg_exit, Start
B -    174958 - elf_segs_hash_verify_entry, Start
B -    237625 - PBL, End
B -    192790 - SBL1, Start
B -    254156 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    262483 - clock_init, Start
D -      7411 - clock_init, Delta
B -    270077 - boot_flash_init, Start
D -      2775 - boot_flash_init, Delta
B -    274164 - boot_config_data_table_init, Start
D -       762 - boot_config_data_table_init, Delta - (575 Bytes)
B -    287310 - Boot Setting :  0x00030618
B -    290177 - CDT version:2,Platform ID:8,Major ID:4,Minor ID:0,Subtype:4
B -    300577 - sbl1_ddr_set_params, Start
B -    305701 - Pre_DDR_clock_init, Start
B -    307501 - Pre_DDR_clock_init, End
B -    954589 - do ddr sanity test, Start
D -        30 - do ddr sanity test, Delta
B -    959255 - Image Load, Start
D -    132980 - QSEE Image Loaded, Delta - (578956 Bytes)
B -   1093089 - Image Load, Start
D -      5734 - DEVCFG Image Loaded, Delta - (13592 Bytes)
B -   1099220 - Image Load, Start
D -     99186 - APPSBL Image Loaded, Delta - (412086 Bytes)
B -   1198467 - QSEE Execution, Start
D -        30 - QSEE Execution, Delta
B -   1204933 - SBL1, End
D -   1014644 - SBL1, Delta
S - Flash Throughput, 4761 KB/s  (1005881 Bytes,  211265 us)
S - DDR Frequency, 800 MHz
S - Core 0 Frequency, 800 MHz


U-Boot 2016.01 (Oct 25 2023 - 02:56:42 -0400)

DRAM:  smem ram ptable found: ver: 1 len: 4
512 MiB
NAND:  QPIC controller support serial NAND
ID = 21baef
Vendor = ef
Device = ba
Serial Nand Device Found With ID : 0xef 0xba
Serial NAND device Manufacturer:W25N01GW
Device Size:128 MiB, Page size:2048, Spare Size:64, ECC:4-bit
SPI_ADDR_LEN=3
SF: Detected MX25U12835F with page size 256 Bytes, erase size 64 KiB, total 16 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x1000000
144 MiB
MMC:   sdhci: Node Not found, skipping initialization

PCI Link Intialized
In:    serial@78AF000
Out:   serial@78AF000
Err:   serial@78AF000
WPX8324 U-Boot Bv0.0.1

machid: 8040004
GPIO settings
Hit any key to stop autoboot:  0
ubi0: attaching mtd2
ubi0: scanning is finished
ubi0: volume 2 ("rootfs_data") re-sized from 9 to 319 LEBs
ubi0: attached mtd2 (name "mtd=0", size 62 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 496, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 40/13, WL threshold: 4096, image sequence number: 402343746
ubi0: available PEBs: 0, total reserved PEBs: 496, PEBs reserved for bad PEB handling: 20
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (5586944)
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.63
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e8
     Data Size:    5491453 Bytes = 5.2 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   5563a5b4
     Hash algo:    sha1
     Hash value:   5fbeed681db32c24d65b4ae5e2b7f8e356cca599
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.5-c1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt liteon_wpx8324bt device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4453cd28
     Data Size:    26061 Bytes = 25.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   00600463
     Hash algo:    sha1
     Hash value:   2f7ffc88b31470275107182c223f765699a77cb8
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4453cd28
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3f6000, end 4a3ff5cc ... OK
fdt-fixup: unable to find compatible node
fdt_fixup_qpic: QPIC: unable to find node '/soc/qpic-nand@79b0000'
Using machid 0x8040004 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.63 (builder@ubuntu) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32403-ec16f2532d) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Fri Jan  2 20:30:01 2026
[    0.000000] Machine model: Lite-On WPX8324-BT
[    0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a7fffff (4096 KiB) nomap non-reusable tz_apps@4a400000
[    0.000000] OF: reserved mem: 0x000000004a800000..0x000000004a9fffff (2048 KiB) nomap non-reusable bootloader@4a800000
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable sbl@4aa00000
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000
[    0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004adfffff (2048 KiB) nomap non-reusable tz@4ac00000
[    0.000000] OF: reserved mem: 0x000000004b000000..0x000000004dffffff (49152 KiB) nomap non-reusable wcss@4b000000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x000000004a3fffff]
[    0.000000]   node   0: [mem 0x000000004a400000-0x000000004adfffff]
[    0.000000]   node   0: [mem 0x000000004ae00000-0x000000004affffff]
[    0.000000]   node   0: [mem 0x000000004b000000-0x000000004dffffff]
[    0.000000]   node   0: [mem 0x000000004e000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] psci: [Firmware Bug]: failed to set PC mode: -1
[    0.000000] percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 cnss2.skip_radio_bmap=2 cnss2.bdf_pci0=0xb0 cnss2.bdf_pci1=0x60 cnss2.bdf_integrated=0x24 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait root=/dev/ubiblock0_1 swiotlb=1 coherent_pool=2M
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
[    0.000000] software IO TLB: mapped [mem 0x000000005f580000-0x000000005f600000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00aff7], SPI[448:479]
[    0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bff7], SPI[480:511]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000126] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000146] pid_max: default: 32768 minimum: 301
[    0.005094] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005120] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.011730] rcu: Hierarchical SRCU implementation.
[    0.011746] rcu:     Max phase no-delay instances is 1000.
[    0.012294] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.012942] smp: Bringing up secondary CPUs ...
[    0.014061] Detected VIPT I-cache on CPU1
[    0.014211] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.014446] smp: Brought up 1 node, 2 CPUs
[    0.014467] SMP: Total of 2 processors activated.
[    0.014472] CPU: All CPU(s) started at EL1
[    0.014477] CPU features: detected: 32-bit EL0 Support
[    0.014483] CPU features: detected: CRC32 instructions
[    0.014574] alternatives: applying system-wide alternatives
[    0.014826] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.015087] Memory: 438392K/524288K available (8768K kernel code, 896K rwdata, 2776K rodata, 960K init, 287K bss, 84052K reserved, 0K cma-reserved)
[    0.022559] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.022596] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.022738] 29296 pages in range for non-PLT usage
[    0.022749] 520816 pages in range for PLT usage
[    0.024916] pinctrl core: initialized pinctrl subsystem
[    0.027705] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.028878] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[    0.029205] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.029521] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.030293] thermal_sys: Registered thermal governor 'step_wise'
[    0.030476] cpuidle: using governor menu
[    0.030843] ASID allocator initialised with 65536 entries
[    0.035925] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@b000000
[    0.075342] SCSI subsystem initialized
[    0.075715] usbcore: registered new interface driver usbfs
[    0.075820] usbcore: registered new interface driver hub
[    0.075887] usbcore: registered new device driver usb
[    0.076303] qcom_scm: convention: smc arm 64
[    0.079171] clocksource: Switched to clocksource arch_sys_counter
[    0.083387] NET: Registered PF_INET protocol family
[    0.083695] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.086100] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.086137] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.086166] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.086225] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.086416] TCP: Hash tables configured (established 4096 bind 4096)
[    0.087060] MPTCP token hash table entries: 512 (order: 2, 12288 bytes, linear)
[    0.087284] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.087324] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.087924] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.087994] PCI: CLS 0 bytes, default 64
[    0.091426] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.092025] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.092043] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.111353] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.113262] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.113487] msm_serial 78af000.serial: uartclk = 1843199
[    0.114352] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 21, base_baud = 115199) is a MSM
[    0.114520] msm_serial: console setup on port #0
[    0.114608] printk: legacy console [ttyMSM0] enabled
[    0.848405] msm_serial: driver initialized
[    0.863247] loop: module loaded
[    0.867918] spi-nand spi0.0: Winbond SPI NAND was found.
[    0.867974] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.872901] qcom_snand 79b0000.spi: ECC strength requirement of 1-bit(s) is unsupported, trying 4-bits
[    0.880957] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.889668] Creating 3 MTD partitions on "spi0.0":
[    0.896017] 0x000000000000-0x000000080000 : "0:TRAINING"
[    0.902769] 0x000000080000-0x000003e80000 : "rootfs_1"
[    1.011236] 0x000003e80000-0x000007c80000 : "rootfs"
[    1.117341] mtd: setting mtd2 (rootfs) as root device
[    1.118022] mtdsplit: no squashfs found in "rootfs"
[    1.125257] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.129495] 18 fixed-partitions partitions found on MTD device spi1.0
[    1.133387] Creating 18 MTD partitions on "spi1.0":
[    1.139752] 0x000000000000-0x000000030000 : "0:SBL1"
[    1.145545] 0x000000030000-0x000000040000 : "0:MIBIB"
[    1.150714] 0x000000040000-0x000000050000 : "0:BOOTCONFIG"
[    1.155573] 0x000000050000-0x000000060000 : "0:BOOTCONFIG1"
[    1.161107] 0x000000060000-0x000000100000 : "0:QSEE"
[    1.166384] 0x000000100000-0x0000001a0000 : "0:QSEE_1"
[    1.171791] 0x0000001a0000-0x0000001b0000 : "0:DEVCFG"
[    1.176606] 0x0000001b0000-0x0000001c0000 : "0:DEVCFG_1"
[    1.181825] 0x0000001c0000-0x0000001d0000 : "0:CDT"
[    1.187161] 0x0000001d0000-0x0000001e0000 : "0:CDT_1"
[    1.191872] 0x0000001e0000-0x0000001f0000 : "0:APPSBLENV"
[    1.196982] 0x0000001f0000-0x000000290000 : "0:APPSBL"
[    1.202468] 0x000000290000-0x000000330000 : "0:APPSBL_1"
[    1.207358] 0x000000330000-0x0000003a0000 : "0:ART"
[    1.213715] 0x0000003a0000-0x0000003c0000 : "0:boarddata"
[    1.217541] 0x0000003c0000-0x0000007c0000 : "0:USERCONFIG"
[    1.223155] 0x0000007c0000-0x000000bc0000 : "0:data"
[    1.228391] 0x000000bc0000-0x000000c40000 : "0:dump"
[    1.402414] i2c_dev: i2c /dev entries driver
[    1.408069] sdhci: Secure Digital Host Controller Interface driver
[    1.408127] sdhci: Copyright(c) Pierre Ossman
[    1.413244] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.421678] remoteproc remoteproc0: releasing cd00000.remoteproc
[    1.427042] NET: Registered PF_INET6 protocol family
[    1.431833] Segment Routing with IPv6
[    1.434356] In-situ OAM (IOAM) with IPv6
[    1.437937] NET: Registered PF_PACKET protocol family
[    1.442365] 8021q: 802.1Q VLAN Support v1.8
[    1.503318] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: 1008000 KHz
[    1.506190] remoteproc remoteproc0: cd00000.remoteproc is available
[    1.513199] qcom-q6-mpd cd00000.remoteproc: pd-1 node found
[    1.520878] remoteproc remoteproc1: pd-1 is available
[    1.524757] qcom-q6-mpd cd00000.remoteproc: pd-2 node found
[    1.531371] remoteproc remoteproc2: pd-2 is available
[    1.535393] qcom-q6-mpd cd00000.remoteproc: pd-3 node found
[    1.542006] remoteproc remoteproc3: pd-3 is available
[    1.547424] ubi0: attaching mtd2
[    1.995006] ubi0: scanning is finished
[    2.077702] ubi0: volume 2 ("rootfs_data") re-sized from 9 to 319 LEBs
[    2.079118] ubi0: attached mtd2 (name "rootfs", size 62 MiB)
[    2.083150] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.088963] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.095710] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.102528] ubi0: good PEBs: 496, bad PEBs: 0, corrupted PEBs: 0
[    2.109288] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    2.115526] ubi0: max/mean erase counter: 12/5, WL threshold: 4096, image sequence number: 1570572373
[    2.122590] ubi0: available PEBs: 0, total reserved PEBs: 496, PEBs reserved for bad PEB handling: 20
[    2.131914] ubi0: background thread "ubi_bgt0d" started, PID 555
[    2.133464] block ubiblock0_1: created from ubi0:1(rootfs)
[▒[    2.163158] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.163704] Freeing unused kernel memory: 960K
[    2.169409] Run /sbin/init as init process
[    2.480786] init: Console is alive
[    2.481152] init: - watchdog -
[    3.229208] random: crng init done
[    3.326899] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.478077] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.529835] ssdk_dt_parse_mac_mode[300]:INFO:mac mode1 doesn't exit!
[    3.529884] ssdk_dt_parse_mac_mode[308]:INFO:mac mode2 doesn't exit!
[    3.535365] ssdk_dt_parse_port_bmp[1064]:INFO:port_bmp doesn't exist!
[    3.541729] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    5.049181] ssdk_mp_reset_init[1311]:INFO:MP reset successfully!
[    5.050270] ssdk_phy_driver_init[341]:INFO:dev_id = 0, phy_adress = 284, phy_id = 0xfffafffa phytype doesn't match
[    5.383211] regi_init[2548]:INFO:Initializing SCOMPHY Done!!
[    5.383437] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    5.391527] nss-dp 39c00000.dp1 lan (uninitialized): nss_dp_gmac: Registering netdev lan(qcom-id:1) with GMAC, mac_base: 0xffffffc081640000
[    5.460710] Qualcomm Atheros IPQ5018 internal PHY 88000.mdio-1:07: attached PHY driver (mii_bus:phy_addr=88000.mdio-1:07, irq=POLL)
[    5.463460] nss-dp 39d00000.dp2 wan (uninitialized): nss_dp_gmac: Registering netdev wan(qcom-id:2) with GMAC, mac_base: 0xffffffc081680000
[    5.540779] Qualcomm QCA8081 90000.mdio-1:1c: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:1c, irq=POLL)
[    5.542830] **********************************************************
[    5.549744] * NSS Data Plane driver
[    5.556203] **********************************************************
[    5.579044] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.581986] init: - preinit -
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.770001] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   10.960494] UBIFS (ubi0:2): default file-system created
[   10.961414] UBIFS (ubi0:2): Mounting in unauthenticated mode
[   10.964769] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 722
[   11.053917] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[   11.053968] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.060801] UBIFS (ubi0:2): FS size: 39235584 bytes (37 MiB, 309 LEBs), max 319 LEBs, journal size 1904640 bytes (1 MiB, 15 LEBs)
[   11.070662] UBIFS (ubi0:2): reserved for root: 1853193 bytes (1809 KiB)
[   11.082284] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 0CBC82C0-2FC0-4038-91A8-FE6BCAC0DC08, small LPT model
[   11.091514] mount_root: overlay filesystem has not been fully initialized yet
[   11.100955] mount_root: switching to ubifs overlay
[   11.111809] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[   11.119012] urandom-seed: Seed file not found (/etc/urandom.seed)
[   11.199201] nss-dp 39c00000.dp1 lan: PHY Link is down
[   11.207923] procd: - early -
[   11.208162] procd: - watchdog -
[   11.868779] procd: - watchdog -
[   11.949360] procd: - ubus -
[   12.112756] procd: - init -
Please press Enter to activate this console.
[   12.799692] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.973930] urngd: v1.0.2 started.
[   13.186349] GACT probability on
[   13.188613] Mirror/redirect action on
[   13.203539] u32 classifier
[   13.203574]     input device check on
[   13.205142]     Actions configured
[   13.233247] Loading modules backported from Linux version v6.18-0-g7d0a66e4b
[   13.233292] Backport generated by backports.git 4d44cef
[   13.267244] NET: Registered PF_QIPCRTR protocol family
[   13.310710] xt_time: kernel timezone is -0000
[   13.533253] PPP generic driver version 2.4.2
[   13.535912] NET: Registered PF_PPPOX protocol family
[   13.540872] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   13.541549] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   13.612287] ath11k c000000.wifi: ipq5018 hw1.0
[   13.612334] ath11k c000000.wifi: FW memory mode: 1
[   13.709314] remoteproc remoteproc1: powering up pd-1
[   13.710099] remoteproc remoteproc1: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   13.713386] remoteproc remoteproc0: powering up cd00000.remoteproc
[   13.721909] remoteproc remoteproc0: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   15.815271] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   15.833390] remoteproc remoteproc1: remote processor pd-1 is now up
[   15.836491] ath11k b00a040.wifi: Multipd architecture - userpd: 3
[   15.839038] ath11k b00a040.wifi: qcn6122 hw1.0
[   15.844776] ath11k b00a040.wifi: FW memory mode: 1
[   15.859805] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   15.867304] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   15.867391] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   15.906533] remoteproc remoteproc3: powering up pd-3
[   15.906832] remoteproc remoteproc3: Booting fw image ath11k/IPQ5018/hw1.0/q6_fw.mdt, size 1820
[   15.921423] remoteproc remoteproc3: remote processor pd-3 is now up
[   15.932443] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.017252] ath11k b00a040.wifi: qmi ignore invalid mem req type 10
[   16.024585] ath11k b00a040.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   16.024644] ath11k b00a040.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[   25.399436] br-lan: port 1(lan) entered blocking state
[   25.399494] br-lan: port 1(lan) entered disabled state
[   25.403801] nss-dp 39c00000.dp1 lan: entered allmulticast mode
[   25.409719] nss-dp 39c00000.dp1 lan: entered promiscuous mode
[   29.532381] nss-dp 39c00000.dp1 lan: PHY Link up speed: 1000
[   29.532819] br-lan: port 1(lan) entered blocking state
[   29.537157] br-lan: port 1(lan) entered forwarding state



BusyBox v1.37.0 (2026-01-02 20:30:01 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 25.12-SNAPSHOT, r32403-ec16f2532d
 -----------------------------------------------------

 === WARNING! =====================================
 There is no root password defined on this device!
 Use the "passwd" command to set up a new password
 in order to prevent unauthorized SSH logins.
 --------------------------------------------------


 OpenWrt recently switched to the "apk" package manager!

 OPKG Command           APK Equivalent      Description
 ------------------------------------------------------------------
 opkg install <pkg>     apk add <pkg>       Install a package
 opkg remove <pkg>      apk del <pkg>       Remove a package
 opkg upgrade           apk upgrade         Upgrade all packages
 opkg files <pkg>       apk info -L <pkg>   List package contents
 opkg list-installed    apk info            List installed packages
 opkg update            apk update          Update package lists
 opkg search <pkg>      apk search <pkg>    Search for packages
 ------------------------------------------------------------------

For more information visit:
https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet

root@OpenWrt:~#

Start a new thread wirhout concealing device info in this case.

It was actually a buggy U-Boot bootloader provided by the factory.

I made a workaround by letting U-Boot reset once during cold boot, afterwards it booted OpenWrt just fine and I’m able to reboot the device using the reboot command without any problem.

setenv bootcmd 'if itest *0x44000000 == 12345678; then mw 0x44000000 0; echo "Manual Reset Detected - Booting Firmware..."; bootipq; else mw 0x44000000 12345678; echo "Cold Boot Detected - Resetting U-Boot..."; reset; fi'
saveenv

I’m planning to do a pull request soon, but I wonder if OpenWrt will accept this kind of shenanigans in order to make the device function properly.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.