OpenWrt support for TP-Link EC227

Found serial pins: 3.3V GND RX TR from left to right:


Gain root access via serial:

admin:spbu100e

/proc/mtd

dev:    size   erasesize  name
mtd0: 08000000 00020000 "mtk-nand"
mtd1: 00080000 00020000 "boot"
mtd2: 00080000 00020000 "boot_env"
mtd3: 00600000 00020000 "misc_ro"
mtd4: 00600000 00020000 "misc_rw"
mtd5: 01600000 00020000 "firmware1"
mtd6: 00380000 00020000 "kernel"
mtd7: 01280000 00020000 "rootfs"
mtd8: 00720000 00020000 "rootfs_data"
mtd9: 01600000 00020000 "firmware2"
mtd10: 00600000 00020000 "bflag"
mtd11: 00600000 00020000 "misc_rw_bak"
mtd12: 00600000 00020000 "misc_isp"
mtd13: 07800000 00020000 "whole"

https://raw.githubusercontent.com/a-gurin/TP-Link-EC227/refs/heads/main/boot.log
boot log from stock fw
binwalk stock fw:

binwalk -a mtd0 
                                                                                                 
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0                                  0x0                                uImage firmware image, header size: 64 bytes, data size: 103172 bytes, compression: none, CPU: MIPS32, OS: Firmware, image type: Standalone Program, load 
                                                                      address: 0x80100000, entry point: 0x80100000, creation time: 1970-01-01 00:00:00, image name: "MT7621 NAND"
131072                             0x20000                            uImage firmware image, header size: 64 bytes, data size: 154707 bytes, compression: lzma, CPU: MIPS32, OS: Firmware, image type: Firmware Image, load address: 
                                                                      0x80200000, entry point: 0x80200000, creation time: 2024-07-01 03:19:06, image name: "U-Boot 2018.09 for mt7621_nand_r]"
7077888                            0x6C0000                           JFFS2 filesystem, little endian, nodes: 23, total size: 10240 bytes
9830400                            0x960000                           JFFS2 filesystem, little endian, nodes: 37, total size: 131072 bytes
10354688                           0x9E0000                           JFFS2 filesystem, little endian, nodes: 18, total size: 57616 bytes
13631488                           0xD00000                           Device tree blob (DTB), version: 17, CPU ID: 0, total size: 3581928 bytes
17213416                           0x106A7E8                          uImage firmware image, header size: 64 bytes, data size: 0 bytes, compression: none, CPU: MIPS32, OS: Linux, image type: Firmware Image, load address: 
                                                                      0x81000000, entry point: 0x81000000, creation time: 2024-07-01 04:09:39, image name: "rootfs"
17301504                           0x1080000                          SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 770, block size: 262144, image size: 11901888 bytes, created: 2020-04-17 
                                                                      06:18:44
67633152                           0x4080000                          JFFS2 filesystem, little endian, nodes: 36, total size: 131072 bytes
70516736                           0x4340000                          JFFS2 filesystem, little endian, nodes: 15, total size: 55368 bytes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Analyzed 1 file for 85 file signatures (196 magic patterns) in 451.0 milliseconds

binwalk mtd1

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0                                  0x0                                uImage firmware image, header size: 64 bytes, data size: 103172 bytes, compression: none, CPU: MIPS32, OS: Firmware, image type: Standalone Program, load 
                                                                      address: 0x80100000, entry point: 0x80100000, creation time: 1970-01-01 00:00:00, image name: "MT7621 NAND"
131072                             0x20000                            uImage firmware image, header size: 64 bytes, data size: 154707 bytes, compression: lzma, CPU: MIPS32, OS: Firmware, image type: Firmware Image, load address: 
                                                                      0x80200000, entry point: 0x80200000, creation time: 2024-07-01 03:19:06, image name: "U-Boot 2018.09 for mt7621_nand_r]"
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Analyzed 1 file for 85 file signatures (196 magic patterns) in 8.0 milliseconds

Cross compiled dtc and upload with curl:

/dts-v1/;

/ {
	model = "MediaTek MT7621 RFB (NAND with NMBM)";
	compatible = "mediatek,mt7621-rfb-nmbm", "mediatek,mt7621-soc";
	#address-cells = <0x01>;
	#size-cells = <0x01>;

	gsw {
		mediatek,mdio = <0x0d>;
		interrupts = <0x00 0x17 0x04>;
		mediatek,mcm;
		compatible = "mediatek,mt753x";
		mt7530,direct-phy-access;
		reset-names = "mcm";
		mediatek,portmap = "wllll";
		resets = <0x05 0x02>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		interrupt-parent = <0x01>;

		port@5 {
			reg = <0x05>;
			compatible = "mediatek,mt753x-port";
			phy-mode = "rgmii";

			fixed-link {
				full-duplex;
				speed = <0x3e8>;
			};
		};

		port@6 {
			reg = <0x06>;
			compatible = "mediatek,mt753x-port";
			phy-mode = "trgmii";

			fixed-link {
				full-duplex;
				speed = <0x3e8>;
			};
		};

		mdio-bus {
			#address-cells = <0x01>;
			#size-cells = <0x00>;
		};
	};

	pcie@1e140000 {
		reg = <0x1e140000 0x40000>;
		interrupts = <0x00 0x04 0x04 0x00 0x18 0x04 0x00 0x19 0x04>;
		pinctrl-0 = <0x0e>;
		compatible = "mediatek,mt7621-pci";
		clock-names = "pcie0", "pcie1", "pcie2";
		reset-gpios = <0x02 0x13 0x01>;
		reset-names = "pcie0", "pcie1", "pcie2";
		bus-range = <0x00 0xff>;
		device_type = "pci";
		clocks = <0x0f 0x18 0x0f 0x19 0x0f 0x1a>;
		reset-gpio-names = "pcie";
		ranges = <0x2000000 0x00 0x00 0x60000000 0x00 0x10000000 0x1000000 0x00 0x00 0x1e160000 0x00 0x10000>;
		resets = <0x05 0x18 0x05 0x19 0x05 0x1a>;
		status = "okay";
		#address-cells = <0x03>;
		#size-cells = <0x02>;
		pinctrl-names = "default";
		interrupt-parent = <0x01>;

		pcie0 {
			reg = <0x00 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;
		};

		pcie1 {
			reg = <0x800 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;
		};

		pcie2 {
			reg = <0x1000 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;
		};
	};

	cpus {

		cpu@0 {
			compatible = "mips,mips1004Kc";
		};

		cpu@1 {
			compatible = "mips,mips1004Kc";
		};
	};

	nmbm {
		compatible = "generic,nmbm";
		forced-create;
		#address-cells = <0x01>;
		lower-mtd-device = <0x16>;
		#size-cells = <0x01>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <0x01>;
			#size-cells = <0x01>;

			partition@2300000 {
				reg = <0x2300000 0x1600000>;
				label = "firmware2";
			};

			partition@100000 {
				reg = <0x100000 0x600000>;
				label = "misc_ro";
			};

			partition@700000 {
				reg = <0x700000 0x600000>;
				label = "misc_rw";
			};

			partition@3900000 {
				reg = <0x3900000 0x600000>;
				label = "bflag";
			};

			partition@4500000 {
				reg = <0x4500000 0x600000>;
				label = "misc_isp";
			};

			partition@0 {
				reg = <0x00 0x80000>;
				label = "boot";
			};

			partition@w {
				reg = <0x00 0x7800000>;
				label = "whole";
			};

			partition@d00000 {
				reg = <0xd00000 0x1600000>;
				label = "firmware1";
			};

			partition@80000 {
				reg = <0x80000 0x80000>;
				label = "boot_env";
			};

			partition@3f00000 {
				reg = <0x3f00000 0x600000>;
				label = "misc_rw_bak";
			};
		};
	};

	crypto@1e004000 {
		reg = <0x1e004000 0x1000>;
		interrupts = <0x00 0x13 0x04>;
		compatible = "mediatek,mtk-eip93";
		status = "okay";
		interrupt-parent = <0x01>;
	};

	sdhci@1e130000 {
		reg = <0x1e130000 0x4000>;
		interrupts = <0x00 0x14 0x04>;
		compatible = "mediatek,mt7621-sdhci";
		status = "disabled";
		interrupt-parent = <0x01>;
	};

	usb-phy@1e1d0000 {
		reg = <0x1e1d0000 0x300>;
		compatible = "mediatek,mt7621-u3phy", "mediatek,mt2701-u3phy";
		ranges;
		status = "okay";
		#address-cells = <0x01>;
		#size-cells = <0x01>;

		usb-phy@0x1e1d0800 {
			reg = <0x1e1d0800 0x100>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			clocks = <0x10>;
			phandle = <0x11>;
			linux,phandle = <0x11>;
		};

		usb-phy@0x1e1d0900 {
			reg = <0x1e1d0900 0x700>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			clocks = <0x10>;
			phandle = <0x12>;
			linux,phandle = <0x12>;
		};

		usb-phy@0x1e1d1000 {
			reg = <0x1e1d1000 0x100>;
			clock-names = "ref";
			#phy-cells = <0x01>;
			clocks = <0x10>;
			phandle = <0x13>;
			linux,phandle = <0x13>;
		};
	};

	hnat@1e100000 {
		reg = <0x1e100000 0x3000>;
		mtketh-ppd = "eth0";
		mtketh-wan = "eth1";
		compatible = "mediatek,mtk-hnat_v1";
		reset-names = "mtketh";
		resets = <0x0c 0x00>;
		status = "okay";
		ext-devices = "rai0", "ra0", "rai1", "ra1", "rai2", "ra2", "rai3", "ra3", "apclii0", "apcli0";
		mtketh-max-gmac = <0x02>;
	};

	rstctrl {
		#reset-cells = <0x01>;
		compatible = "ralink,rt2880-reset";
		phandle = <0x05>;
		linux,phandle = <0x05>;
	};

	sysclock50M@0 {
		#clock-cells = <0x00>;
		compatible = "fixed-clock";
		clock-frequency = <0x2faf080>;
		phandle = <0x09>;
		linux,phandle = <0x09>;
	};

	apll@0 {
		#clock-cells = <0x00>;
		compatible = "fixed-clock";
		clock-frequency = <0x1017df80>;
		phandle = <0x04>;
		linux,phandle = <0x04>;
	};

	chosen {
		bootargs = "console=ttyS0,115200";
	};

	raeth@1e100000 {
		reg = <0x1e100000 0xe000>;
		interrupts = <0x00 0x03 0x04>;
		compatible = "mediatek,mt7621-eth";
		status = "disabled";
		mediatek,ethsys = <0x0c>;
		interrupt-parent = <0x01>;
	};

	gpio-keys-polled {
		compatible = "gpio-keys-polled";
		poll-interval = <0x14>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;

		reset {
			gpios = <0x02 0x12 0x01>;
			label = "reset";
			linux,code = <0x198>;
		};
	};

	palmbus@1e000000 {
		reg = <0x1e000000 0x100000>;
		compatible = "palmbus";
		ranges = <0x00 0x1e000000 0xfffff>;
		#address-cells = <0x01>;
		#size-cells = <0x01>;

		nand@3000 {
			reg = <0x3000 0x800>;
			pinctrl-0 = <0x0b>;
			ecc-engine = <0x0a>;
			compatible = "mediatek,mt7621-nfc";
			status = "okay";
			#address-cells = <0x01>;
			#size-cells = <0x01>;
			pinctrl-names = "default";

			flash@0 {
				reg = <0x00>;
				nand-ecc-mode = "hw";
				phandle = <0x16>;
				linux,phandle = <0x16>;

				partitions {
					compatible = "fixed-partitions";
					#address-cells = <0x01>;
					#size-cells = <0x01>;
				};
			};
		};

		i2s@a00 {
			reg = <0xa00 0x100>;
			dmas = <0x06 0x04 0x06 0x06>;
			interrupts = <0x00 0x10 0x04>;
			txdma-req = <0x02>;
			compatible = "mediatek,mt7621-i2s";
			reset-names = "i2s";
			clocks = <0x04>;
			resets = <0x05 0x11>;
			status = "disabled";
			rxdma-req = <0x03>;
			dma-names = "tx", "rx";
			interrupt-parent = <0x01>;
		};

		i2c@0 {
			pinctrl-0 = <0x03>;
			gpios = <0x02 0x03 0x01 0x02 0x04 0x01>;
			compatible = "i2c-gpio";
			status = "okay";
			#address-cells = <0x01>;
			i2c-gpio,delay-us = <0x03>;
			#size-cells = <0x00>;
			pinctrl-names = "default";
		};

		spi@b00 {
			reg = <0xb00 0x100>;
			pinctrl-0 = <0x08>;
			compatible = "mediatek,mt7621-spi";
			reset-names = "spi";
			clocks = <0x07>;
			resets = <0x05 0x12>;
			status = "disabled";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			pinctrl-names = "default";
		};

		uartlite@c00 {
			reg = <0xc00 0x100>;
			interrupts = <0x00 0x1a 0x04>;
			reg-shift = <0x02>;
			no-loopback-test;
			compatible = "mediatek,mt6577-uart", "ns16550a";
			clock-frequency = <0x2faf080>;
			clocks = <0x09>;
			reg-io-width = <0x04>;
			interrupt-parent = <0x01>;
		};

		gdma@2800 {
			reg = <0x2800 0x800>;
			interrupts = <0x00 0x0d 0x04>;
			compatible = "mtk,rt3883-gdma";
			reset-names = "dma";
			#dma-requests = <0x10>;
			resets = <0x05 0x0e>;
			status = "disabled";
			#dma-channels = <0x10>;
			#dma-cells = <0x01>;
			phandle = <0x06>;
			linux,phandle = <0x06>;
			interrupt-parent = <0x01>;
		};

		sysc@0 {
			reg = <0x00 0x100>;
			compatible = "mtk,mt7621-sysc";
		};

		memc@5000 {
			reg = <0x5000 0x1000>;
			compatible = "mtk,mt7621-memc";
		};

		uartfull@d00 {
			reg = <0xd00 0x100>;
			interrupts = <0x00 0x1b 0x04>;
			reg-shift = <0x02>;
			no-loopback-test;
			compatible = "mediatek,mt6577-uart", "ns16550a";
			clock-frequency = <0x2faf080>;
			clocks = <0x09>;
			status = "disabled";
			reg-io-width = <0x04>;
			interrupt-parent = <0x01>;
		};

		uartfull@e00 {
			reg = <0xe00 0x100>;
			interrupts = <0x00 0x1c 0x04>;
			reg-shift = <0x02>;
			no-loopback-test;
			compatible = "mediatek,mt6577-uart", "ns16550a";
			clock-frequency = <0x2faf080>;
			clocks = <0x09>;
			status = "disabled";
			reg-io-width = <0x04>;
			interrupt-parent = <0x01>;
		};

		ecc@3800 {
			reg = <0x3800 0x800>;
			compatible = "mediatek,mt7621-ecc";
			status = "okay";
			phandle = <0x0a>;
			linux,phandle = <0x0a>;
		};

		wdt@100 {
			reg = <0x100 0x100>;
			compatible = "mtk,mt7621-wdt";
		};

		hsdma@7000 {
			reg = <0x7000 0x1000>;
			interrupts = <0x00 0x0b 0x04>;
			compatible = "mediatek,mt7621-hsdma";
			reset-names = "hsdma";
			#dma-requests = <0x01>;
			resets = <0x05 0x05>;
			status = "disabled";
			#dma-channels = <0x01>;
			#dma-cells = <0x01>;
			interrupt-parent = <0x01>;
		};

		gpio@600 {
			reg = <0x600 0x100>;
			interrupts = <0x00 0x0c 0x04>;
			compatible = "mtk,mt7621-gpio";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			interrupt-parent = <0x01>;

			bank@0 {
				reg = <0x00>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				phandle = <0x02>;
				gpio-controller;
				linux,phandle = <0x02>;
			};

			bank@1 {
				reg = <0x01>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
			};

			bank@2 {
				reg = <0x02>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
			};
		};
	};

	ethernet@1e100000 {
		reg = <0x1e100000 0xe000>;
		interrupts = <0x00 0x03 0x04>;
		compatible = "mediatek,mt7621-eth", "syscon";
		status = "okay";
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		mediatek,ethsys = <0x0c>;
		interrupt-parent = <0x01>;

		mac@0 {
			reg = <0x00>;
			compatible = "mediatek,eth-mac";
			phy-mode = "trgmii";
			mac-address = [00 0a eb 13 09 69];

			fixed-link {
				full-duplex;
				pause;
				speed = <0x3e8>;
			};
		};

		mac@1 {
			reg = <0x01>;
			compatible = "mediatek,eth-mac";
			phy-mode = "rgmii";
			mac-address = [00 0a eb 13 09 70];

			fixed-link {
				full-duplex;
				pause;
				speed = <0x3e8>;
			};
		};

		mdio-bus {
			#address-cells = <0x01>;
			phandle = <0x0d>;
			#size-cells = <0x00>;
			linux,phandle = <0x0d>;

			ethernet-phy@1f {
				reg = <0x1f>;
				phy-mode = "rgmii";
			};
		};
	};

	sysclock125M@0 {
		#clock-cells = <0x00>;
		compatible = "fixed-clock";
		clock-frequency = <0x7735940>;
		phandle = <0x10>;
		linux,phandle = <0x10>;
	};

	aliases {
		serial0 = "/palmbus@1e000000/uartlite@c00";
	};

	interrupt-controller@1fbc0000 {
		reg = <0x1fbc0000 0x2000>;
		compatible = "mti,gic";
		mti,reserved-cpu-vectors = <0x07>;
		#interrupt-cells = <0x03>;
		phandle = <0x01>;
		interrupt-controller;
		linux,phandle = <0x01>;

		timer {
			interrupts = <0x01 0x01 0x00>;
			compatible = "mti,gic-timer";
			clocks = <0x14>;
		};
	};

	pinctrl {
		pinctrl-0 = <0x15>;
		compatible = "mtk,mtkmips-pinmux";
		pinctrl-names = "default";

		i2c {
			phandle = <0x03>;
			linux,phandle = <0x03>;

			i2c {
				mtk,function = "gpio";
				mtk,group = "i2c";
			};
		};

		spi {
			phandle = <0x08>;
			linux,phandle = <0x08>;

			spi {
				mtk,function = "spi";
				mtk,group = "spi";
			};
		};

		mdio {

			mdio {
				mtk,function = "mdio";
				mtk,group = "mdio";
			};
		};

		nand {
			phandle = <0x0b>;
			linux,phandle = <0x0b>;

			sdhci-nand {
				mtk,function = "nand2";
				mtk,group = "sdhci";
			};

			spi-nand {
				mtk,function = "nand1";
				mtk,group = "spi";
			};
		};

		pcie {
			phandle = <0x0e>;
			linux,phandle = <0x0e>;

			pcie {
				mtk,function = "gpio";
				mtk,group = "pcie";
			};
		};

		sdhci {

			sdhci {
				mtk,function = "sdhci";
				mtk,group = "sdhci";
			};
		};

		uart1 {

			uart1 {
				mtk,function = "uart1";
				mtk,group = "uart1";
			};
		};

		uart2 {

			uart2 {
				mtk,function = "uart2";
				mtk,group = "uart2";
			};
		};

		uart3 {

			uart3 {
				mtk,function = "uart3";
				mtk,group = "uart3";
			};
		};

		pinctrl0 {
			phandle = <0x15>;
			linux,phandle = <0x15>;

			gpio {
				mtk,function = "gpio";
				mtk,group = "i2c", "uart2", "uart3";
			};
		};

		rgmii1 {

			rgmii1 {
				mtk,function = "rgmii1";
				mtk,group = "rgmii1";
			};
		};

		rgmii2 {

			rgmii2 {
				mtk,function = "rgmii2";
				mtk,group = "rgmii2";
			};
		};
	};

	ethsys@1e000000 {
		reg = <0x1e000000 0x8000>;
		compatible = "mediatek,mt7621-ethsys", "syscon";
		phandle = <0x0c>;
		linux,phandle = <0x0c>;
	};

	usb@1e1c0000 {
		reg = <0x1e1c0000 0x1000 0x1e1d0700 0x100>;
		phys = <0x11 0x03 0x12 0x04 0x13 0x03>;
		interrupts = <0x00 0x16 0x04>;
		reg-names = "mac", "ippc";
		compatible = "mediatek,mt7621-xhci", "mediatek,mt2701-xhci";
		clock-names = "sys_ck", "free_ck", "ahb_ck", "dma_ck";
		clocks = <0x10 0x10 0x10 0x10>;
		status = "okay";
		interrupt-parent = <0x01>;
	};

	sysbusclock@0 {
		#clock-cells = <0x00>;
		compatible = "mtk,mt7621-sys-bus-clock";
		phandle = <0x07>;
		linux,phandle = <0x07>;
	};

	cpuclock@0 {
		#clock-cells = <0x00>;
		compatible = "mtk,mt7621-cpu-clock";
		phandle = <0x14>;
		linux,phandle = <0x14>;
	};

	cpuintc@0 {
		compatible = "mti,cpu-interrupt-controller";
		#interrupt-cells = <0x01>;
		#address-cells = <0x00>;
		interrupt-controller;
	};

	clkctrl {
		#clock-cells = <0x01>;
		compatible = "ralink,rt2880-clock";
		phandle = <0x0f>;
		linux,phandle = <0x0f>;
	};
};

I'm stuck at valid dts file for device, any help?

Can't boot from flash however it boots fine from ram

Checking firmware2, please wait...
firmware2 checksum [6FE9E6C5530D8D54B0FD0DD2E40FD9F6] OK
Loading FIT image at offset 0x2300000 to memory 0x80010000, size 0x323890 ...
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  MIPS OpenWrt Linux-6.6.95
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    3276459 Bytes = 3.1 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x80001000
     Entry Point:  0x80001000
     Hash algo:    crc32
     Hash value:   807afdbd
     Hash algo:    sha1
     Hash value:   8ae4933cb25d75e7bf89960673857273aea4f57c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  MIPS OpenWrt tplink_ec227-v1 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x803300d0
     Data Size:    12924 Bytes = 12.6 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   3bc92da1
     Hash algo:    sha1
     Hash value:   4aad7ef09888853fbcc678a89f99cc46185609c3
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x803300d0
   Uncompressing Kernel Image ... lzma compressed: uncompress error 1
Must RESET board to recover

from ram

Checking firmware1, please wait...
firmware1 checksum [74C6BDDC7A0FB698821108B1ECB55CC7] OK
Loading FIT image at offset 0xd00000 to memory 0x80010000, size 0x323890 ...
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config-1' configuration
=> tftpboot openwrt-ramips-mt7621-tplink_ec227-v1-initramfs-kernel.bin
Using eth@1e100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-ramips-mt7621-tplink_ec227-v1-initramfs-kernel.bin'.
Load address: 0x80010000
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################
         1.2 MiB/s
done
Bytes transferred = 6981505 (6a8781 hex)
Automatic boot of image at addr 0x80010000 ...
## Booting kernel from Legacy Image at 80010000 ...
   Image Name:   MIPS OpenWrt Linux-6.6.95
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    6981441 Bytes = 6.7 MiB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK


OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 6.6.95 (caro@turbo) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28759-49fdb75c7b) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Thu Jul 10 18:49:17 2025
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
define Device/tplink_ec227-v1 
  $(Device/nand)
  $(Device/uimage-lzma-loader)  
  LOADER := bin
  IMAGE_SIZE := 49152k
  DEVICE_VENDOR := TP-Link
  DEVICE_MODEL := EC227
  DEVICE_VARIANT := v1
  TPLINK_BOARD_ID := EC227-V1
  KERNEL_LOADADDR := 0x80001000
  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb-ledtrig-usbport uboot-envtools
  KERNEL := kernel-bin | relocate-kernel $(loadaddr-y) | lzma | \
	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
       uImage none
  IMAGES += factory.bin
  IMAGE/factory.bin := append-kernel | append-rootfs | pad-rootfs | check-size
  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata | check-size
endef
TARGET_DEVICES += tplink_ec227-v1

fixed with

KERNEL_LOADADDR := 0x81001000

now it stuck at

*** Upgrading Firmware ***

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default): 0

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-tplink_ec227-v1-squashfs-factory.bin

Using eth@1e100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-ramips-mt7621-tplink_ec227-v1-squashfs-factory.bin'.
Load address: 0x80010000
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #########################################
         1.6 MiB/s
done
Bytes transferred = 9175040 (8c0000 hex)

*** Loaded 9175040 (0x8c0000) bytes at 0x80010000 ***

fw1_version=15, fw1_status=0
fw2_version=16, fw2_status=0
******** upgrade mtd firmware1, checksum [70504CB8D901A268972024BBC5005419] ********
Saving Environment to NMBM... Erasing on NMBM...
Writing on NMBM... OK
OK

Erasing from 0xd00000 to 0x15bffff, size 0x8c0000 ... OK
Writting from 0x80010000 to 0xd00000, size 0x8c0000 ... OK

*** Firmware upgrade completed! ***

Hit any key to stop firmware bootup:  0 
fw1_version=17, fw1_status=0
fw2_version=16, fw2_status=0
Saving Environment to NMBM... Erasing on NMBM...
Writing on NMBM... OK
OK
******** try booting from firmware1 count=0 ********
Checking firmware1, please wait...
firmware1 checksum [70504CB8D901A268972024BBC5005419] OK
Loading FIT image at offset 0xd00000 to memory 0x80010000, size 0x3238c0 ...
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  MIPS OpenWrt Linux-6.6.95
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    3276459 Bytes = 3.1 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x81001000
     Entry Point:  0x81001000
     Hash algo:    crc32
     Hash value:   807afdbd
     Hash algo:    sha1
     Hash value:   8ae4933cb25d75e7bf89960673857273aea4f57c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  MIPS OpenWrt tplink_ec227-v1 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x803300d0
     Data Size:    12972 Bytes = 12.7 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   9034e53a
     Hash algo:    sha1
     Hash value:   9b25a6b7af12c3a06272aef3cf46c584f5604e69
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x803300d0
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 87e66000, end 87e6c2ab ... OK