[Solved]Help ZTE MF286R Bootloop

I have this modem for a year now and last november 2023, when the openwrt build is unstable, I immediately flash it with a new version of openwrt for zte mf286r, all of a sudden it seems like it is not proceeding and when I shut it down, I got stock in a bootloop. Now I have this serial module to know what is the problem and I got this log.
Can someone help me on how to fix this one, I am new to OpenWRT anyway and since I was curious about this router, what should I search? Or any article that may relate on how to fix this bootloop on my router, thanks.

Here is the full log.

U-Boot 1.1.4 (Jun  8 2021 - 23:42:27)

ap152 - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x11, 0x11, 0x11, 0x11)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 659k for U-Boot at: 87f58000
Reserving 192k for malloc() at: 87f28000
Reserving 44 Bytes for Board Info at: 87f27fd4
Reserving 36 Bytes for Global Data at: 87f27fb0
Reserving 128k for boot params() at: 87f07fb0
Stack Pointer at: 87f07f98
Now running in RAM - U-Boot at: 87f58000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x15
flash size 2MB, sector count = 32
Flash:  2 MB
*** Warning - bad CRC, using default environment

Power up PLL with outdiv = 0 then switch to 3
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init (MDC/MDIO config)::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:ff:ff:ff
ath_gmac_phy_setup
eth0 up
eth0
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
ath_spi_nand_ecc: furture feat = 0x10
ath_spi_nand_ecc: middle feat = 0x10
zte ath_spi_nand_read_id 0xc8d1
zte ath_spi_nand_read_id 0xc8d1c8
zte debug gd 128 oob
====== NAND Parameters ======
sc addr = 0x87fa6d20 page(write size) = 0x800 (erase size) block = 0x20000
Setting 0x181162c0 to 0x4b962100
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0xff from 0x0
Hit any key to stop autoboot:  0

Loading from device 0: ath-spi-nand (offset 0x1800000)
   Image Name:   MIPS OpenWrt Linux-5.10.127
   Created:      2022-06-29  22:23:42 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2456722 Bytes =  2.3 MB
   Load Address: 80060000
   Entry Point:  80060000
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
ath_spi_nand_page_read :status=0x1
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.127
   Created:      2022-06-29  22:23:42 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2456722 Bytes =  2.3 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.10.127 (ubuntu) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r19971-416d4483e8) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Wed Jun 29 22:23:42 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is ZTE MF286R
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 120452K/131072K available (6032K kernel code, 586K rwdata, 1264K rodata, 1196K init, 205K bss, 10620K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008265] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074801] pid_max: default: 32768 minimum: 301
[    0.079799] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087510] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,linear)
[    0.097683] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_COREbuild
[    0.108343] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118749] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.126011] pinctrl core: initialized pinctrl subsystem
[    0.132869] NET: Registered protocol family 16
[    0.190080] clocksource: Switched to clocksource MIPS
[    0.196503] NET: Registered protocol family 2
[    0.201353] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.209543] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.218470] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.226570] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.234021] TCP: Hash tables configured (established 1024 bind 1024)
[    0.240852] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.247758] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.255415] NET: Registered protocol family 1
[    0.260036] PCI: CLS 0 bytes, default 32
[    0.273247] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.283506] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.289655] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.303470] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.310589] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.317893] printk: console [ttyS0] disabled
[    0.322524] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.331642] printk: console [ttyS0] enabled
[    0.331642] printk: console [ttyS0] enabled
[    0.340708] printk: bootconsole [early0] disabled
[    0.340708] printk: bootconsole [early0] disabled
[    0.363631] spi-nand spi0.1: GigaDevice SPI NAND was found.
[    0.369403] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.378624] 6 fixed-partitions partitions found on MTD device (null)
[    0.385235] Creating 6 MTD partitions on "(null)":
[    0.390212] 0x000000000000-0x0000000a0000 : "fota-flag"
[    0.397471] 0x0000000a0000-0x000000120000 : "art"
[    0.404828] 0x000000120000-0x0000001a0000 : "mac"
[    0.412216] 0x0000001a0000-0x000001800000 : "ubiconcat0"
[    0.450391] 0x000001800000-0x000001c00000 : "kernel"
[    0.462785] 0x000001c00000-0x000008000000 : "ubiconcat1"
[    0.614728] spi-nor spi0.0: gd25q16 (2048 Kbytes)
[    0.619647] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.626251] Creating 3 MTD partitions on "spi0.0":
[    0.631227] 0x000000000000-0x0000000a0000 : "u-boot"
[    0.638066] 0x0000000a0000-0x0000000c0000 : "u-boot-env"
[    0.644581] 0x0000000c0000-0x000000200000 : "reserved1"
[    0.653604] Concatenating MTD devices:
[    0.657488] (0): "ubiconcat0"
[    0.660599] (1): "ubiconcat1"
[    0.663658] into device "ubi-concat"
[    0.667383] 1 fixed-partitions partitions found on MTD device ubi-concat
[    0.674324] Creating 1 MTD partitions on "ubi-concat":
[    0.679632] 0x000000000000-0x000007a60000 : "ubi"
[    1.374337] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    2.031606] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036,driver=Atheros AR8216/AR8236/AR8316]
[    2.042867] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    2.051238] NET: Registered protocol family 10
[    2.062510] Segment Routing with IPv6
[    2.066397] NET: Registered protocol family 17
[    2.071139] 8021q: 802.1Q VLAN Support v1.8
[    2.079360] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    2.085730]  MEM 0x0000000012000000..0x0000000013ffffff
[    2.091141]   IO 0x0000000000000000..0x0000000000000000
[    2.096694] PCI host bridge to bus 0000:00
[    2.100965] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.108058] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.113836] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    2.120857] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.129086] pci 0000:00:00.0: [168c:0056] type 00 class 0x028000
[    2.135338] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.142481] pci 0000:00:00.0: PME# supported from D0 D3hot
[    2.149295] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.156192] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.167536] UBI: auto-attach mtd9
[    2.171030] ubi0: attaching mtd9
[    4.966877] ubi0: scanning is finished
[    5.005512] ubi0: attached mtd9 (name "ubi", size 122 MiB)
[    5.011232] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    5.018327] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    5.025358] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    5.032559] ubi0: good PEBs: 978, bad PEBs: 1, corrupted PEBs: 0
[    5.038757] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[    5.046228] ubi0: max/mean erase counter: 9/4, WL threshold: 4096, image sequence number: 2003202686
[    5.055665] ubi0: available PEBs: 955, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19
[    5.065617] ubi0: background thread "ubi_bgt0d" started, PID 303
[    5.072210] /dev/root: Can't open blockdev
[    5.076447] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    5.084207] Please append a correct "root=" boot option; here are the available partitions:
[    5.092848] 1f00             640 mtdblock0
[    5.092851]  (driver?)
[    5.099598] 1f01             512 mtdblock1
[    5.099601]  (driver?)
[    5.106354] 1f02             512 mtdblock2
[    5.106357]  (driver?)
[    5.113110] 1f03           22912 mtdblock3
[    5.113113]  (driver?)
[    5.119856] 1f04            4096 mtdblock4
[    5.119859]  (driver?)
[    5.126614] 1f05          102400 mtdblock5
[    5.126617]  (driver?)
[    5.133378] 1f06             640 mtdblock6
[    5.133381]  (driver?)
[    5.140134] 1f07             128 mtdblock7
[    5.140137]  (driver?)
[    5.146888] 1f08            1280 mtdblock8
[    5.146891]  (driver?)
[    5.153654] 1f09          125312 mtdblock9
[    5.153657]  (driver?)
[    5.160410] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    5.168941] Rebooting in 1 seconds..
▒

U-Boot 1.1.4 (Jun  8 2021 - 23:42:27)

ap152 - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 659k for U-Boot at: 87f58000
Reserving 192k for malloc() at: 87f28000
Reserving 44 Bytes for Board Info at: 87f27fd4
Reserving 36 Bytes for Global Data at: 87f27fb0
Reserving 128k for boot params() at: 87f07fb0
Stack Pointer at: 87f07f98
Now running in RAM - U-Boot at: 87f58000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x15
flash size 2MB, sector count = 32
Flash:  2 MB
*** Warning - bad CRC, using default environment

Power up PLL with outdiv = 0 then switch to 3
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init (MDC/MDIO config)::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:ff:ff:ff
ath_gmac_phy_setup
eth0 up
eth0
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
ath_spi_nand_ecc: furture feat = 0x10
ath_spi_nand_ecc: middle feat = 0x10
zte ath_spi_nand_read_id 0xc8d1
zte ath_spi_nand_read_id 0xc8d1c8
zte debug gd 128 oob
====== NAND Parameters ======
sc addr = 0x87fa6d20 page(write size) = 0x800 (erase size) block = 0x20000
Setting 0x181162c0 to 0x4b962100
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0xff from 0x0
Hit any key to stop autoboot:  0
ath

interrupt u-boot, and do another install.

https://openwrt.org/toh/zte/mf286r#step_3booting_initramfs_image

I had followed this step

setenv serverip 192.168.0.22
setenv ipaddr 192.168.0.1
tftpboot 0x81000000 openwrt-ath79-nand-zte_mf286a-initramfs-kernel.bin
bootm 0x81000000

but still in bootloop, any idea on how to fix?

no surprise, you haven't actually installed anything yet ..

That is method 1, practically, to the end. All it says after that is:

Replace server IP and router IP as needed).

There is no emergency TFTP boot sequence triggered by buttons, contrary to MF283+. - When OpenWrt initramfs finishes booting, proceed to actual installation.

I need that last line translated too. I have no idea what it means other than "install, you should know how"

yes, and ?

there's a step 4, called "Actual installation" ?

1 Like

Just for my, remedial, sake:

What would I need to do. I've never gone into a router that way.

when ?

OP is installing via serial interface ...

I see that now, it is sub divided.

Thank you.

I tftpboot the initramfs provided on the router and i got this log,

ath> tftpboot 0x81000000 f.bin
Trying eth0
ath_gmac_phy_link
ath_gmac_phy_duplex
ath_gmac_phy_speed
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.22; our IP address is 192.168.0.1
Filename 'f.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################
done
Bytes transferred = 5861034 (596eaa hex)
ath> bootm 0x81000000
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.134
   Created:      2023-10-09  21:45:35 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5860970 Bytes =  5.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... ERROR: LzmaDecode.c, 543

Decoding error = 1
LZMA ERROR 1 - must RESET board to recover
▒

what does it mean reset? like the button on the router? i pressed that reset button?

try using the initramfs of an older release, at https://firmware-selector.openwrt.org/

1 Like

thank you, the provided initramfs just worked, i booted the router, it booted fine then i flash a new image, it is now operational, i can use it again.

i have same problem what version you use ?

I am using OpenWrt SNAPSHOT r19971-416d4483e8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.