I found a uboot for ipq5018 qcom reference boards https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016 .Considering my router is quite similar to one of those boards so the uboot should workon EA9350 i think? Let me compile and try to chainload it from the stock uboot.(Btw I have never tried chainloading on qcom platform but i did try that on amlogic platform.) U-Boot 2016.01 (Dec 06 2021 - 10:08:47 +0800) CBT U-Boot ver: 3.2.08 ([IPQ5018].[SPF11.3].[CSU2]) DRAM: smem ram ptable found: ver: 1 len: 4 512 MiB NAND: QPIC controller support serial NAND ID = 22c822c8 Vendor = c8 Device = 22 Serial Nand Device Found With ID : 0xc8 0x22 Serial NAND device Manufacturer:GD5F2GQ5REYIH Device Size:256 MiB, Page size:2048, Spare Size:64, ECC:4-bit SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000 ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 256 MiB MMC: sdhci: Node Not found, skipping initialization PCI Link Intialized PCI1 is not defined in the device tree In: serial@78AF000 Out: serial@78AF000 Err: serial@78AF000 machid: 8040001 eth0 MAC Address from ART is not valid eth1 MAC Address from ART is not valid Updating boot_count ... done Hit any key to stop autoboot: 3 0 Net: cmbblk is stable 5 MAC1 addr:0:11:22:33:44:55 athrs17_reg_init: complete S17c init done eth0 Warning: eth0 MAC addresses don't match: Address in SROM is 00:11:22:33:44:55 Address in environment is 00:03:7f:ba:db:ad IPQ5018# IPQ5018# IPQ5018# usb start starting USB... USB0: Register 2000140 NbrPorts 2 Starting the controller USB XHCI 1.10 scanning bus 0 for devices... 2 USB Device(s) found IPQ5018# fatload usb 0 ${loadaddr} u-boot.bin reading u-boot.bin 419816 bytes read in 261 ms (1.5 MiB/s) IPQ5018# go ${loadaddr} ## Starting application at 0x44000000 ... prefetch abort pc : [<44000004>] lr : [<4a92891b>] reloc pc : [<44000004>] lr : [<4a92891b>] sp : 4a822840 ip : 0000001c fp : 00000002 r10: 00000000 r9 : 4a822ea0 r8 : 4a97d300 r7 : 4a9288f1 r6 : 00000002 r5 : 44000000 r4 : 4a828b74 r3 : 44000000 r2 : 4a828b74 r1 : 4a828b74 r0 : 00000001 Flags: nzCv IRQs off FIQs off Mode SVC_32 Resetting CPU ... resetting ...