Hi everyone,
I'm troubleshooting a bricked UniFi U7 Pro (IPQ5332 platform) that suffered a power surge. I’ve reached a point where I need expert insight into the Qualcomm boot flow to determine if the SoC is permanently damaged or if there’s a logic/firmware bypass I’m missing.
Below is the full serial console log for analysis:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3.1.1-00078-IPQ90xxLZB-1.94601.3
S - IMAGE_VARIANT_STRING=IPQ5332LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu156
S - Boot Interface: SPI
S - Secure Boot: Off
S - Boot Config @ 0x000a602c = 0x000002c1
S - JTAG ID @ 0x000a607c = 0x1023d0e1
S - OEM ID @ 0x000a6080 = 0x02180000
S - Serial Number @ 0x000a60a8 = 0xa6280511
S - OEM Config Row 0 @ 0x000a4058 = 0x0000000000000000
S - OEM Config Row 1 @ 0x000a4060 = 0x0000000000000218
S - Feature Config Row 0 @ 0x000a4018 = 0x0000800004000001
S - Feature Config Row 1 @ 0x000a4020 = 0x0000000000000000
S - Feature Config Row 2 @ 0x000a4028 = 0x0000000000000000
S - FM_VERSION @ 0x000a4004 = 0x00000005
S - TAG_VERSION @ 0x000a4004 = 0x00000000
S - FEATURE ID @ 0x000a4000 = 0x00000000
S - PBL Patch Ver: 1
S - TME-L LCS: 0x0b
S - I-cache: Off
S - D-cache: Off
B - 3413 - PBL, Start
B - 959 - bootable_media_detect_entry, Start
B - 2474 - bootable_media_detect_success, Start
B - 2613 - elf_loader_entry, Start
B - 2616 - auth_hash_seg_entry, Start
B - 12459 - auth_hash_seg_exit, Start
B - 13110 - elf_segs_hash_verify_entry, Start
B - 455264 - elf_segs_hash_verify_exit, Start
B - 519034 - auth_xbl_sec_hash_seg_entry, Start
B - 519093 - auth_xbl_sec_hash_seg_exit, Start
B - 541255 - xbl_sec_segs_hash_verify_entry, Start
B - 541257 - xbl_sec_segs_hash_verify_exit, Start
B - 561057 - PBL, End
B - 465094 - SBL1, Start
B - 1269013 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B - 1271789 - System Reset Reason : Power on Reset [0x20]
B - 1277035 - clock_init, Start
D - 579 - clock_init, Delta
B - 1285239 - boot_flash_init, Start
D - 11102 - boot_flash_init, Delta
B - 1299391 - sbl1_ddr_set_default_params, Start
D - 61 - sbl1_ddr_set_default_params, Delta
B - 1305979 - boot_config_data_table_init, Start
D - 2836 - boot_config_data_table_init, Delta - (615 Bytes)
B - 1314885 - CDT Version:2,Platform ID:8,Major ID:6,Minor ID:0,Subtype:0
B - 1320589 - Image Load, Start
D - 6618 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B - 1329983 - Image Load, Start
D - 5002 - PMIC Image Loaded, Delta - (0 Bytes)
B - 1337852 - sbl1_ddr_set_params, Start
B - 1342610 - CPR configuration: 0x3a7
B - 1346056 - Pre_DDR_clock_init, Start
D - 30 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 1377105 - Image Load, Start
D - 122 - APDP Image Loaded, Delta - (0 Bytes)
B - 1382870 - Image Load, Start
D - 103090 - TME-L FW Image Loaded, Delta - (49388 Bytes)
B - 1486112 - Image Load, Start
D - 2135 - Auth Metadata
D - 4606 - Segments hash check
D - 63654 - QSEE Dev Config Image Loaded, Delta - (35096 Bytes)
B - 1551901 - Image Load, Start
D - 125935 - Auth Metadata
D - 197853 - Segments hash check
D - 2448936 - QSEE Image Loaded, Delta - (1465064 Bytes)
B - 4001935 - Image Load, Start
D - 2043 - Auth Metadata
D - 76860 - Segments hash check
D - 916983 - APPSBL Image Loaded, Delta - (575930 Bytes)
B - 4922059 - SBL1, End
D - 4460778 - SBL1, Delta
S - Flash Throughput, 691 KB/s (2126429 Bytes, 3075309 us)
S - Core 0 Frequency, 800 MHz
S - DDR Frequency, 1188 MHz
U-Boot 2024.01 v1.1.26.115 (Nov 20 2025 - 10:27:26 +0200)
DRAM: smem ram ptable found: ver: 2 len: 4
1023.8 MiB
UART: clk_rate=29491200, baudrate=115200, calculated divisor=16
UART: Set divisor=16 (code=0x88)
SPI_ADDR_LEN=3
SF: Detected MX25U6435F with page size 256 Bytes, erase size 64 KiB, total 8 MiB
device 0 offset 0x400000, size 0x14
SF: 20 bytes @ 0x400000 Read: OK
bomrev: 2085381
NAND:
Current Symptom: The device is stuck in a boot loop/hang. On the serial console, it consistently stops at the NAND: initialization line, as shown in the attached log.
Steps already taken:
- SPI Flash: Desoldered and reflashed the 8MB Winbond chip with a known-good dump. No change in the boot hang.
- eMMC Removal: Suspecting a short in the Kingston eMMC, I physically removed the NAND chip from the board. Surprisingly, the U-Boot still hangs at the exact same
NAND:line instead of reporting "No device found". - Power Rails:
- V_CORE is stable at 0.95V (measured with an oscilloscope during the hang). No ripple or drops detected.
- Power consumption on the bench power supply is 73mA to 100mA @ 1V (injected into the core rail), suggesting no hard short-circuit in the silicon.
- Impedance Check: Measured the core rail in diode mode; it shows approximately 10mV/10 Ohms. While low, the stable current consumption suggests this is the normal impedance for this SoC family.
The Question: Does the IPQ5332 U-Boot implementation for Ubiquiti enter a "Spin-lock" or "Hard Hang" if the eMMC controller fails to initialize or if the chip is missing?
I would appreciate any insights from anyone familiar with the IPQ53xx/90xx boot sequence or if there is a way to force the U-Boot to skip NAND detection via serial commands (though the console is unresponsive at this stage).
Thanks in advance!