ZTE mf286d no boot after sysupgrade + CPU problems

Hi and thank you in advance! Everything started last week I installed a third-party luci-app-cpu-perf, I just wanted CPU usage in the overview and downloaded the wrong package. The CPU governor frequencies seemed to be altered, the author of that package said just uninstalling it would take back default CPU governor parameters but that seems not to be the case. BTW the router was continuously crashing and I did not connect the problem with that app in my mind so I proceeded with a fresh reinstall with the latest 23.5.3 just release, via serial port. The process finished successfully on the serial but at the first reboot, I got this log.

I already tried to force format mtd9, and tried to install the 22 and 23.5.2 previously used, eko.pl and gargoyle, all of them install correctly but at first restart, it hangs on the serial prompt. I don't know how to proceed. Seems a hook is missing somewhere.

[  563.837712] ubi: mtd9 is already attached to ubi0
[  564.391945] ubi: mtd9 is already attached to ubi0
[  574.313213] ubi: mtd9 is already attached to ubi0
[  574.837246] ubi: mtd9 is already attached to ubi0
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Wed May  1 15:56:19 CEST 2024 upgrade: Sending TERM to remaining processes ...
Wed May  1 15:56:24 CEST 2024 upgrade: Sending KILL to remaining processes ...
[  585.500778] stage2 (4678): drop_caches: 3
Wed May  1 15:56:30 CEST 2024 upgrade: Switching to ramdisk...
Wed May  1 13:56:32 UTC 2024 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
Volume ID 0, size 24 LEBs (3047424 bytes, 2.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 1, size 63 LEBs (7999488 bytes, 7.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 15364096
Volume ID 2, size 121 LEBs (15364096 bytes, 14.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy[  592.583315] reboot: Restarting system

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00126
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1342 - bootable_media_detect_entry, Start
B -      1683 - bootable_media_detect_success, Start
B -      1697 - elf_loader_entry, Start
B -      5105 - auth_hash_seg_entry, Start
B -      7268 - auth_hash_seg_exit, Start
B -    582973 - elf_segs_hash_verify_entry, Start
B -    701462 - PBL, End
B -    701486 - SBL1, Start
B -    792384 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    793856 - boot_flash_init, Start
D -     53196 - boot_flash_init, Delta
B -    851201 - boot_config_data_table_init, Start
D -      3857 - boot_config_data_table_init, Delta - (419 Bytes)
B -    858379 - clock_init, Start
D -      7748 - clock_init, Delta
B -    870603 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    874017 - sbl1_ddr_set_params, Start
B -    879115 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    883497 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13177 - sbl1_ddr_set_params, Delta
B -    896812 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    967238 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    982695 - Image Load, Start
D -    153188 - QSEE Image Loaded, Delta - (299560 Bytes)
B -   1136312 - Image Load, Start
D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1146605 - Image Load, Start
D -    247792 - APPSBL Image Loaded, Delta - (507051 Bytes)
B -   1394795 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1400982 - SBL1, End
D -    701604 - SBL1, Delta
S - Flash Throughput, 2011 KB/s  (809078 Bytes,  402254 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Chaos Calmer 15.05.1,IPQ4019.ILQ.6.1.0.r2-00006-P-1] (Apr 19 2021 - 23:50:05)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010001
NAND:  ID = 302012c
Vendor = 2c
Device = 1
ONFI device found
SF: Detected GD25Q16 with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 0
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0x4e from 0x0
Press ESC to abort autoboot in 0 seconds
setenv - set environment variables

(IPQ40xx) #

your C&P from the console doesn't show any of this ....

A nice start would be to flash last release that you found was working.

Thank you for your prompt reply, the last working one was the official 23.5.2, it worked 1 year without any issue, I tried already flashing it back, same issue unfortunately.

I'm sorry, I don't understand what is C&P, apologies.

pick one https://acronyms.thefreedictionary.com/C%26P :wink:

1 Like

:rofl: thank you. I can assure you I did a serial initramfs and a Luci sysupgrade, and I did several times, what can cause boot stopping? Thank you

that's fine, but we want to see this.

anyway,

post the output of the bootloader's printenv command

1 Like

Sure! here you have it. Thank you!

(IPQ40xx) # printenv
baudrate=115200
bootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
bootcmd=bootipq
bootdelay=2
ethact=eth0
ethaddr=0x00:0xaa:0xbb:0x1d:0x3e:0x 4
fdt_high=0x87000000
fileaddr=84000000
filesize=1275A58
flash_type=0
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
ipaddr=192.168.1.1
lc=tftpboot 0x84000000 ${dir}cdt-AP.DK04.1-C1.bin&&sf probe&&sf erase 0xc0000 +$filesize&&sf write $fileaddr 0xc0000 $filesize
lp=tftpboot 0x84000000 ${dir}norplusnand-system-partition-ipq40xx.bin&&sf probe&&sf erase 0x40000 +$filesize&&sf write $fileaddr 0x40000 $filesize
lr=tftpboot 0x84000000 ${dir}root_uImage&&nand erase 0x1000000 0x800000 &&nand write_partition 0x84000000     0x1000000     0x800000 &&nand erase 0x1800000 0x1D00000 &&nand write_partition 0x84800000     0x1800000     0x1D00000
lrb=tftpboot 0x84000000 ${dir}delta.bin&&nand erase 0x3500000 0x1900000&&nand write $fileaddr 0x3500000 $filesize
lrs=tftpboot 0x84000000 ${dir}root_uImage_s&&nand erase 0x1800000 0x1D00000&&nand write $fileaddr 0x1800000 $filesize
lu=tftpboot 0x84000000 ${dir}uboot.bin&&sf probe&&sf erase 0xf0000 +$filesize&&sf write $fileaddr 0xf0000 $filesize
lw=tftpboot 0x84000000 ${dir}web.img&&nand erase 0x1000000 0x800000&&nand write $fileaddr 0x1000000 $filesize
machid=8010001
mtddevname=fs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x1d00000@0x1800000(fs),
partition=nand0,0
serverip=192.168.1.2
stderr=serial
stdin=serial
stdout=serial

Environment size: 1656/65532 bytes

and if you issue bootipq ?

(IPQ40xx) # bootipq
setenv - set environment variables

(IPQ40xx) #


ok, interesting :slight_smile:
what about bootcmd, same ?

I'm happy it is interesting :laughing: here you have it, than you for your kind help!

(IPQ40xx) # bootcmd
Unknown command 'bootcmd' - try 'help'
(IPQ40xx) #

ok, then post help, I was going to ask for it anyway.

(IPQ40xx) # help
?       - alias for 'help'
base    - print or set address offset
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory

go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imxtract- extract a part of a multi-image
is_sec_boot_enabled- check secure boot fuse is enabled or not

loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image

setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
uartrd  - uartrd read from second UART
uartwr  - uartwr to second UART
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
(IPQ40xx) #

taken from https://www.ispreview.co.uk/talk/threads/zte-mf286d-feature-unlock-rough-guide-for-h3g-units.37795/page-14#post-316600
try nboot 0x81000000 0 0x1800000
based on that same post, your u-boot env looks weird, but it might change when you install openwrt, I haven't done it on the MF286D.

do you think OpenWRT changed the env in this strange way, or do you mean that installing OpenWRT might fix it? Because I have already tried to install OpenWRT several times and in different versions. Anyway, I'll send you the output of the command. Thank you!

(IPQ40xx) # nboot 0x81000000 0 0x1800000

Loading from nand0, offset 0x1800000
** Unknown image type
(IPQ40xx) # 

no, it's just different from the post I linked to, but I obviously didn't read the whole thread.

@Leo-PL could you assist ?

I just want to add, that during the sysupgrade, it crashed two times, I was able to finish the update by restarting it from the beginning, I'm not sure can be the CPU , its governor or a faulty flash. Again, I'm not sure the device efficiency is trustable at this point.

@gericho Are you really sure you're flashing the correct image? MF286D is loading kernel from UBI, and you try too boot it from NAND directly. Please link to the image you try to run on the device.

@frollic this device doesn't boot from NAND directly - please refer to the device page:
https://openwrt.org/toh/zte/mf286d

As for reinstallation, please erase the UBI partition from within initramfs, before sysupgrade - then everything should work, as sysupgrade will reformat the flash partition from scratch - otherwise some issues were possible, especially when installing from stock Nordic B12 firmware.