I have MR200 V5.2 and already look at the serial output. Found out that it has much resemblance with MR200 V4. Using SOC MT7628AN, 5G using MT7610EN, Modem Qualcom MDM9207. So theoretically V4 firmware would be compatible. I will find out more. Here is truncated version of serial log
[04080C0A][04080C0A][89890000][27273B3B][0027273A]
DU Setting Cal Done
U-Boot 1.1.3 (Feb 26 2021 - 16:19:26)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb4000
gpiomode1 55154404.
gpiomode2 05550555.
######GPIO CTRL 0 for GPIO 0~31 OUTPUT tmp(0x00000030)#####
######GPIO CTRL 1 for GPIO 32~64 OUTPUT tmp(0x00000f80)#####
######GPIO CTRL 1 for GPIO 32~64 INPUT tmp(0x00000f80)#####
flash manufacture id: 1c, device id 70 17
spi device id: 1c 70 17 0 80 (70170080)
find flash: EN25QH64A
RALINK_GPIOMODE_REG_1(0xb0000060) old=0x55154404 new=0x55154404
RALINK_GPIO_CTRL_32_63(0xb0000604) old=0xf80 new=0xf90
RALINK_GPIO_DATA_32_63(0xb0000624) old=0x2f1f new=0x2f0f
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Feb 26 2021 Time:16:19:26
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!..................................................
starting recovery...
TODO, Read MAC Address from Flash
netboot_common, argc= 3
NetTxPacket = 0x83FE4100
KSEG1ADDR(NetTxPacket) = 0xA3FE4100
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
TFTP from server 192.168.0.225; our IP address is 192.168.0.2
Filename 'tp_recovery.bin'.
TIMEOUT_COUNT=10,Load address: 0x80060000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c150) ...
## Giving linux memsize in MB, 64
Starting kernel ...
怘▒▒▒▒ff▒fa▒~▒▒▒f▒Æ▒▒▒怘▒怘▒f30f▒`▒
▒`▒▒f▒▒f▒▒▒Linux version 2.6.36 (tp-link@Sohoidev) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Fri Feb 26 16:22:57 CST 2021
The CPU feqenuce set to 575 MHz
MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=000706b2
Readback ErrCtl register=000706b2
Memory: 61036k/65536k available (2920k kernel code, 4500k reserved, 544k data, 184k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 55154404
RALINK_GPIOMODE = 55144404
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0
*************** MT7628 PCIe RC mode *************
PCIE0 enabled
Port 0 N_FTS = 1b105000
init_rt2880pci done
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0: bridge window [io disabled]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:00:00.0: bridge window [mem pref disabled]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20100000
res[0]->end = 201fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
i2cdrv_major = 218
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
create tplink/console_ctl
create tplink/console_ctl done
brd: module loaded
flash manufacture id: 1c, device id 70 17
EN25QH64A(1c 70171c30 flash_version = 1) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007d0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007d0000-0x0000007e0000 : "config"
0x0000007e0000-0x0000007f0000 : "romfile"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 140(0x0000008C)
FM detection done! loop = 1
SR calibration value u1SrCalVal = 6
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Mirror/redirect action on
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (953 buckets, 3812 max)
GRE over IPv4 demultiplexor driver
gre: can't add protocol
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 184k freed
starting pid 35, tty '': '/etc/init.d/rcS'
cp: can't stat '/etc/SingleSKU_FCC.dat': No such file or directory
SCSI subsystem initialized
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/usb/core/usbcore.ko': No such file or directory
Started WatchDog Timer.
Ralink APSoC Hardware Watchdog Timer
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/usb/host/ifxusb_host.ko': No such file or directory
rdm_major = 253
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7EF100) 5c-ffffffa6-ffffffe6-ffffffba-ffffffa0-56
GMAC1_MAC_ADRH -- : 0x00005ca6
GMAC1_MAC_ADRL -- : 0xe6baa056
Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500!
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7EF100) 5c-ffffffa6-ffffffe6-ffffffba-ffffffa0-56
GMAC1_MAC_ADRH -- : 0x00005ca6
GMAC1_MAC_ADRL -- : 0xe6baa056
PROC INIT OK!
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
usbcore: registered new interface driver cdc_wdm
dns_init
domain_name:tplinkmodem.net
Backtrace parameters (ver: 0.9 build time: Feb 26 2021 16:25:09):
----------------------------------------------------------------------
regbtsig: enable to hook signals. =1
sigmask: signals mask to be hooked. =0x60000688
maxdepth: calltrace depth. =16
showregs: enable to show regs. =0
showstack: enable to show stack. =0
showallstack: enable to show all stacks. =0
showmaps: enable to show maps. =0
reboot: enable to reboot when cos/httpd exit unusual. =0
showgroup: enable to show each thread's backtrace. =0
testcos: enable to hook more signals for cos. =1
----------------------------------------------------------------------
scsi0 : usb-storage 1-1:1.5
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Please press Enter to activate this console. scsi 0:0:0:0: Direct-Access Linux File-Stor Gadget 0318 PQ: 0 ANSI: 2
sd 0:0:0:0: [sda] 143360 512-byte logical blocks: (73.4 MB/70.0 MiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Assuming drive cache: write through
sda:
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
[err] syslogd[main --1001] syslogd : syslogd_init
[ dm_readFile ] 2042: can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007d0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007d0000 length 0x9ac0, ret 0, retlen 0x9ac0
[ dm_loadCfg ] 2504: currSwRevision = 55aa0100 currSwRevision = 55aa0100
spiflash_ioctl_read, Read from 0x007d0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007d0000 length 0x9ac0, ret 0, retlen 0x9ac0
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac 5c-a6-e6-ba-a0-57
qmi_wwan: probe of 1-1:1.0 failed with error -22
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac 5c-a6-e6-ba-a0-57
qmi_wwan: probe of 1-1:1.1 failed with error -22
qmi_wwan 1-1:1.2: bogus CDC Union: master=0, slave=0
qmi_wwan: probe of 1-1:1.2 failed with error -1
qmi_wwan 1-1:1.3: bogus CDC Union: master=0, slave=0
qmi_wwan: probe of 1-1:1.3 failed with error -1
qmi_wwan 1-1:1.4: cdc-wdm0: USB WDM device
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac 5c-a6-e6-ba-a0-57
LTE has booted, tell cos to start qmuxd and mobile
[zc] qmi_wwan_bind: in
[zc] change dtr 1
[ qmiReconnectChspiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
angedHandler ] 5Init mac 5c-a6-e6-ba-a0-57
16: receive qmiqmi_wwan: probe of 1-1:1.6 failed with error -22
connect msg!
[zc] qmi_wwan_bind: in
[zc] change dtr 1
fuser: can't staspiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
t '/tmp/udisk': Init mac 5c-a6-e6-ba-a0-57
No such file or qmi_wwan: probe of 1-1:1.7 failed with error -22
directory
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac 5c-a6-e6-ba-a0-57
qmi_wwan: probe of 1-1:1.8 failed with error -22
usbcore: registered new interface driver qmi_wwan
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbserial_generic 1-1:1.0: generic converter detected
usb 1-1: generic converter now attached to ttyUSB0
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
[ prepareForQmi ] 062: wait for lte to recognize count:0
umount: can't forcibly umount /tmp/udisk: Invalid argument
[ prepareForQmi ] 062: wait for lte to recognize count:1
[ qmiReconnectChangedHandler ] 522: mount /tmp/udisk
[ checkUdiskReady ] 398: [cos] times:0, mount cmd:mount -t auto -o ro /dev/sda /tmp/udisk
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
mount: mounting /dev/sdb on /tmp/udisk failed: No such device or address
mount: mounting /dev/sdc on /tmp/udisk failed: No such device or address
killall: flowstat: no process killed
killall: mobile: no process killed
killall: qmuxd: no process killed
spiflash_ioctl_read, Read from 0x007ef500 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
spiflash_ioctl_read, Read from 0x007ef200 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007ef700 length 0x18, ret 0, retlen 0x18
spiflash_ioctl_read, Read from 0x007ef300 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef400 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef800 length 0x48, ret 0, retlen 0x48
read model:▒▒▒▒▒spiflash_ioctl_read, Read from 0x007ef900 length 0x20, ret 0, retlen 0x20
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒spiflash_ioctl_read, Read from 0x00020000 length 0x200, ret 0, retlen 0x200
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒spiflash_ioctl_read, Read from 0x007ef700 length 0x18, ret 0, retlen 0x18
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒spiflash_ioctl_read, Read from 0x007ef300 length 0x29, ret 0, retlen 0x29
▒▒▒▒▒T▒j+
[ qspiflash_ioctl_read, Read from 0x007ef400 length 0x29, ret 0, retlen 0x29
miReconnectChangspiflash_ioctl_read, Read from 0x007ef800 length 0x48, ret 0, retlen 0x48
edHandler ] 542:spiflash_ioctl_read, Read from 0x007ef900 length 0x20, ret 0, retlen 0x20
disconnect... spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
LTE ip connection.
read model:▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒j+▒▒
15 ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
15 ERROR: Client communication with server failed.
[ rsl_getWanLteLinkCfgObj ] 2660: Fail to get lte module status...
[ rsl_getObj ] 1265: perror:1
[ rsl_getNextObj ] 1413: perror:1
[err] syslogd[syslogd_msg_process_thread --881] begin to lost!, msg = ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
sendto /var/tmp/7 msg 2001 error No such file or directory ,pid 90
[ ntpc ] 979: Get time zone, g_timeZone = 1200
[ oal_sys_getOldTZInfo ] 854: Open TZ file error!
Raeth v3.1 (Tasklet,SkbRecycle)
phy_tx_ring = 0x03656000, tx_ring = 0xa3656000
phy_rx_ring0 = 0x03657000, rx_ring0 = 0xa3657000
[fe_sw_init:4982]rt305x_esw_init.
disable switch phyport...
GMAC1_MAC_ADRH -- : 0x00005ca6
GMAC1_MAC_ADRL -- : 0xe6baa056
RT305x_ESW: Link Status Changed
/bin/sh: can't create /proc/tplink/eth_vlan: nonexistent directory
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
ioctl: No such device
brctl: bridge br0: Invalid argument
set if eth0.1 to *not wan dev
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0.1) entering forwarding state
br0: port 1(eth0.1) entering forwarding state
set if eth0.2 to *not wan dev
device eth0.2 entered promiscuous mode
br0: port 2(eth0.2) entering forwarding state
br0: port 2(eth0.2) entering forwarding state
set if eth0.3 to *not wan dev
device eth0.3 entered promiscuous mode
br0: port 3(eth0.3) entering forwarding state
br0: port 3(eth0.3) entering forwarding state
set if eth0.4 to *not wan dev
device eth0.4 entered promiscuous mode
br0: port 4(eth0.4) entering forwarding state
br0: port 4(eth0.4) entering forwarding state
[ vlan_addLanPortsIntoBridge ] 550: add lan Port 255 from br0
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
[ rsl_initVlanObj ] 993:
+++++++++++++rsl_initVlanObj done!
[ qmiReconnectChangedHandler ] 552: start qmuxd
linux_qmi_qmux_io_pwr_up_init.c: Unable to open wakelock file = /sys/power/wake_lock, error [2:No such file or directory]
qmuxd: linux_qmi_read_sysfs_config: couldn't open file /sys/module/f_rmnet/parameters/rmnet_ctl_chqmuxd: linux_qmi_read_sysfs_config: couldn't open /sys/module/rmnet/parameters/rmnet_ctl_chlinux_qmi_qmux_if_configure_port_timeout: failed to open SMD timeout config=/sys/devices/virtual/smdpkt/cdc-wdm0/open_timeout errno [2:No such file or directory]ra0 no private ioctls.