Found serial pins: 3.3V GND RX TR from left to right:
Gain root access via serial:
admin:spbu100e
/proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 "mtk-nand"
mtd1: 00080000 00020000 "boot"
mtd2: 00080000 00020000 "boot_env"
mtd3: 00600000 00020000 "misc_ro"
mtd4: 00600000 00020000 "misc_rw"
mtd5: 01600000 00020000 "firmware1"
mtd6: 00380000 00020000 "kernel"
mtd7: 01280000 00020000 "rootfs"
mtd8: 00720000 00020000 "rootfs_data"
mtd9: 01600000 00020000 "firmware2"
mtd10: 00600000 00020000 "bflag"
mtd11: 00600000 00020000 "misc_rw_bak"
mtd12: 00600000 00020000 "misc_isp"
mtd13: 07800000 00020000 "whole"
https://raw.githubusercontent.com/a-gurin/TP-Link-EC227/refs/heads/main/boot.log
boot log from stock fw
binwalk stock fw:
binwalk -a mtd0
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL HEXADECIMAL DESCRIPTION
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 0x0 uImage firmware image, header size: 64 bytes, data size: 103172 bytes, compression: none, CPU: MIPS32, OS: Firmware, image type: Standalone Program, load
address: 0x80100000, entry point: 0x80100000, creation time: 1970-01-01 00:00:00, image name: "MT7621 NAND"
131072 0x20000 uImage firmware image, header size: 64 bytes, data size: 154707 bytes, compression: lzma, CPU: MIPS32, OS: Firmware, image type: Firmware Image, load address:
0x80200000, entry point: 0x80200000, creation time: 2024-07-01 03:19:06, image name: "U-Boot 2018.09 for mt7621_nand_r]"
7077888 0x6C0000 JFFS2 filesystem, little endian, nodes: 23, total size: 10240 bytes
9830400 0x960000 JFFS2 filesystem, little endian, nodes: 37, total size: 131072 bytes
10354688 0x9E0000 JFFS2 filesystem, little endian, nodes: 18, total size: 57616 bytes
13631488 0xD00000 Device tree blob (DTB), version: 17, CPU ID: 0, total size: 3581928 bytes
17213416 0x106A7E8 uImage firmware image, header size: 64 bytes, data size: 0 bytes, compression: none, CPU: MIPS32, OS: Linux, image type: Firmware Image, load address:
0x81000000, entry point: 0x81000000, creation time: 2024-07-01 04:09:39, image name: "rootfs"
17301504 0x1080000 SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 770, block size: 262144, image size: 11901888 bytes, created: 2020-04-17
06:18:44
67633152 0x4080000 JFFS2 filesystem, little endian, nodes: 36, total size: 131072 bytes
70516736 0x4340000 JFFS2 filesystem, little endian, nodes: 15, total size: 55368 bytes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Analyzed 1 file for 85 file signatures (196 magic patterns) in 451.0 milliseconds
binwalk mtd1
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL HEXADECIMAL DESCRIPTION
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 0x0 uImage firmware image, header size: 64 bytes, data size: 103172 bytes, compression: none, CPU: MIPS32, OS: Firmware, image type: Standalone Program, load
address: 0x80100000, entry point: 0x80100000, creation time: 1970-01-01 00:00:00, image name: "MT7621 NAND"
131072 0x20000 uImage firmware image, header size: 64 bytes, data size: 154707 bytes, compression: lzma, CPU: MIPS32, OS: Firmware, image type: Firmware Image, load address:
0x80200000, entry point: 0x80200000, creation time: 2024-07-01 03:19:06, image name: "U-Boot 2018.09 for mt7621_nand_r]"
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Analyzed 1 file for 85 file signatures (196 magic patterns) in 8.0 milliseconds
Cross compiled dtc and upload with curl:
/dts-v1/;
/ {
model = "MediaTek MT7621 RFB (NAND with NMBM)";
compatible = "mediatek,mt7621-rfb-nmbm", "mediatek,mt7621-soc";
#address-cells = <0x01>;
#size-cells = <0x01>;
gsw {
mediatek,mdio = <0x0d>;
interrupts = <0x00 0x17 0x04>;
mediatek,mcm;
compatible = "mediatek,mt753x";
mt7530,direct-phy-access;
reset-names = "mcm";
mediatek,portmap = "wllll";
resets = <0x05 0x02>;
#address-cells = <0x01>;
#size-cells = <0x00>;
interrupt-parent = <0x01>;
port@5 {
reg = <0x05>;
compatible = "mediatek,mt753x-port";
phy-mode = "rgmii";
fixed-link {
full-duplex;
speed = <0x3e8>;
};
};
port@6 {
reg = <0x06>;
compatible = "mediatek,mt753x-port";
phy-mode = "trgmii";
fixed-link {
full-duplex;
speed = <0x3e8>;
};
};
mdio-bus {
#address-cells = <0x01>;
#size-cells = <0x00>;
};
};
pcie@1e140000 {
reg = <0x1e140000 0x40000>;
interrupts = <0x00 0x04 0x04 0x00 0x18 0x04 0x00 0x19 0x04>;
pinctrl-0 = <0x0e>;
compatible = "mediatek,mt7621-pci";
clock-names = "pcie0", "pcie1", "pcie2";
reset-gpios = <0x02 0x13 0x01>;
reset-names = "pcie0", "pcie1", "pcie2";
bus-range = <0x00 0xff>;
device_type = "pci";
clocks = <0x0f 0x18 0x0f 0x19 0x0f 0x1a>;
reset-gpio-names = "pcie";
ranges = <0x2000000 0x00 0x00 0x60000000 0x00 0x10000000 0x1000000 0x00 0x00 0x1e160000 0x00 0x10000>;
resets = <0x05 0x18 0x05 0x19 0x05 0x1a>;
status = "okay";
#address-cells = <0x03>;
#size-cells = <0x02>;
pinctrl-names = "default";
interrupt-parent = <0x01>;
pcie0 {
reg = <0x00 0x00 0x00 0x00 0x00>;
device_type = "pci";
#address-cells = <0x03>;
#size-cells = <0x02>;
};
pcie1 {
reg = <0x800 0x00 0x00 0x00 0x00>;
device_type = "pci";
#address-cells = <0x03>;
#size-cells = <0x02>;
};
pcie2 {
reg = <0x1000 0x00 0x00 0x00 0x00>;
device_type = "pci";
#address-cells = <0x03>;
#size-cells = <0x02>;
};
};
cpus {
cpu@0 {
compatible = "mips,mips1004Kc";
};
cpu@1 {
compatible = "mips,mips1004Kc";
};
};
nmbm {
compatible = "generic,nmbm";
forced-create;
#address-cells = <0x01>;
lower-mtd-device = <0x16>;
#size-cells = <0x01>;
partitions {
compatible = "fixed-partitions";
#address-cells = <0x01>;
#size-cells = <0x01>;
partition@2300000 {
reg = <0x2300000 0x1600000>;
label = "firmware2";
};
partition@100000 {
reg = <0x100000 0x600000>;
label = "misc_ro";
};
partition@700000 {
reg = <0x700000 0x600000>;
label = "misc_rw";
};
partition@3900000 {
reg = <0x3900000 0x600000>;
label = "bflag";
};
partition@4500000 {
reg = <0x4500000 0x600000>;
label = "misc_isp";
};
partition@0 {
reg = <0x00 0x80000>;
label = "boot";
};
partition@w {
reg = <0x00 0x7800000>;
label = "whole";
};
partition@d00000 {
reg = <0xd00000 0x1600000>;
label = "firmware1";
};
partition@80000 {
reg = <0x80000 0x80000>;
label = "boot_env";
};
partition@3f00000 {
reg = <0x3f00000 0x600000>;
label = "misc_rw_bak";
};
};
};
crypto@1e004000 {
reg = <0x1e004000 0x1000>;
interrupts = <0x00 0x13 0x04>;
compatible = "mediatek,mtk-eip93";
status = "okay";
interrupt-parent = <0x01>;
};
sdhci@1e130000 {
reg = <0x1e130000 0x4000>;
interrupts = <0x00 0x14 0x04>;
compatible = "mediatek,mt7621-sdhci";
status = "disabled";
interrupt-parent = <0x01>;
};
usb-phy@1e1d0000 {
reg = <0x1e1d0000 0x300>;
compatible = "mediatek,mt7621-u3phy", "mediatek,mt2701-u3phy";
ranges;
status = "okay";
#address-cells = <0x01>;
#size-cells = <0x01>;
usb-phy@0x1e1d0800 {
reg = <0x1e1d0800 0x100>;
clock-names = "ref";
#phy-cells = <0x01>;
clocks = <0x10>;
phandle = <0x11>;
linux,phandle = <0x11>;
};
usb-phy@0x1e1d0900 {
reg = <0x1e1d0900 0x700>;
clock-names = "ref";
#phy-cells = <0x01>;
clocks = <0x10>;
phandle = <0x12>;
linux,phandle = <0x12>;
};
usb-phy@0x1e1d1000 {
reg = <0x1e1d1000 0x100>;
clock-names = "ref";
#phy-cells = <0x01>;
clocks = <0x10>;
phandle = <0x13>;
linux,phandle = <0x13>;
};
};
hnat@1e100000 {
reg = <0x1e100000 0x3000>;
mtketh-ppd = "eth0";
mtketh-wan = "eth1";
compatible = "mediatek,mtk-hnat_v1";
reset-names = "mtketh";
resets = <0x0c 0x00>;
status = "okay";
ext-devices = "rai0", "ra0", "rai1", "ra1", "rai2", "ra2", "rai3", "ra3", "apclii0", "apcli0";
mtketh-max-gmac = <0x02>;
};
rstctrl {
#reset-cells = <0x01>;
compatible = "ralink,rt2880-reset";
phandle = <0x05>;
linux,phandle = <0x05>;
};
sysclock50M@0 {
#clock-cells = <0x00>;
compatible = "fixed-clock";
clock-frequency = <0x2faf080>;
phandle = <0x09>;
linux,phandle = <0x09>;
};
apll@0 {
#clock-cells = <0x00>;
compatible = "fixed-clock";
clock-frequency = <0x1017df80>;
phandle = <0x04>;
linux,phandle = <0x04>;
};
chosen {
bootargs = "console=ttyS0,115200";
};
raeth@1e100000 {
reg = <0x1e100000 0xe000>;
interrupts = <0x00 0x03 0x04>;
compatible = "mediatek,mt7621-eth";
status = "disabled";
mediatek,ethsys = <0x0c>;
interrupt-parent = <0x01>;
};
gpio-keys-polled {
compatible = "gpio-keys-polled";
poll-interval = <0x14>;
#address-cells = <0x01>;
#size-cells = <0x00>;
reset {
gpios = <0x02 0x12 0x01>;
label = "reset";
linux,code = <0x198>;
};
};
palmbus@1e000000 {
reg = <0x1e000000 0x100000>;
compatible = "palmbus";
ranges = <0x00 0x1e000000 0xfffff>;
#address-cells = <0x01>;
#size-cells = <0x01>;
nand@3000 {
reg = <0x3000 0x800>;
pinctrl-0 = <0x0b>;
ecc-engine = <0x0a>;
compatible = "mediatek,mt7621-nfc";
status = "okay";
#address-cells = <0x01>;
#size-cells = <0x01>;
pinctrl-names = "default";
flash@0 {
reg = <0x00>;
nand-ecc-mode = "hw";
phandle = <0x16>;
linux,phandle = <0x16>;
partitions {
compatible = "fixed-partitions";
#address-cells = <0x01>;
#size-cells = <0x01>;
};
};
};
i2s@a00 {
reg = <0xa00 0x100>;
dmas = <0x06 0x04 0x06 0x06>;
interrupts = <0x00 0x10 0x04>;
txdma-req = <0x02>;
compatible = "mediatek,mt7621-i2s";
reset-names = "i2s";
clocks = <0x04>;
resets = <0x05 0x11>;
status = "disabled";
rxdma-req = <0x03>;
dma-names = "tx", "rx";
interrupt-parent = <0x01>;
};
i2c@0 {
pinctrl-0 = <0x03>;
gpios = <0x02 0x03 0x01 0x02 0x04 0x01>;
compatible = "i2c-gpio";
status = "okay";
#address-cells = <0x01>;
i2c-gpio,delay-us = <0x03>;
#size-cells = <0x00>;
pinctrl-names = "default";
};
spi@b00 {
reg = <0xb00 0x100>;
pinctrl-0 = <0x08>;
compatible = "mediatek,mt7621-spi";
reset-names = "spi";
clocks = <0x07>;
resets = <0x05 0x12>;
status = "disabled";
#address-cells = <0x01>;
#size-cells = <0x00>;
pinctrl-names = "default";
};
uartlite@c00 {
reg = <0xc00 0x100>;
interrupts = <0x00 0x1a 0x04>;
reg-shift = <0x02>;
no-loopback-test;
compatible = "mediatek,mt6577-uart", "ns16550a";
clock-frequency = <0x2faf080>;
clocks = <0x09>;
reg-io-width = <0x04>;
interrupt-parent = <0x01>;
};
gdma@2800 {
reg = <0x2800 0x800>;
interrupts = <0x00 0x0d 0x04>;
compatible = "mtk,rt3883-gdma";
reset-names = "dma";
#dma-requests = <0x10>;
resets = <0x05 0x0e>;
status = "disabled";
#dma-channels = <0x10>;
#dma-cells = <0x01>;
phandle = <0x06>;
linux,phandle = <0x06>;
interrupt-parent = <0x01>;
};
sysc@0 {
reg = <0x00 0x100>;
compatible = "mtk,mt7621-sysc";
};
memc@5000 {
reg = <0x5000 0x1000>;
compatible = "mtk,mt7621-memc";
};
uartfull@d00 {
reg = <0xd00 0x100>;
interrupts = <0x00 0x1b 0x04>;
reg-shift = <0x02>;
no-loopback-test;
compatible = "mediatek,mt6577-uart", "ns16550a";
clock-frequency = <0x2faf080>;
clocks = <0x09>;
status = "disabled";
reg-io-width = <0x04>;
interrupt-parent = <0x01>;
};
uartfull@e00 {
reg = <0xe00 0x100>;
interrupts = <0x00 0x1c 0x04>;
reg-shift = <0x02>;
no-loopback-test;
compatible = "mediatek,mt6577-uart", "ns16550a";
clock-frequency = <0x2faf080>;
clocks = <0x09>;
status = "disabled";
reg-io-width = <0x04>;
interrupt-parent = <0x01>;
};
ecc@3800 {
reg = <0x3800 0x800>;
compatible = "mediatek,mt7621-ecc";
status = "okay";
phandle = <0x0a>;
linux,phandle = <0x0a>;
};
wdt@100 {
reg = <0x100 0x100>;
compatible = "mtk,mt7621-wdt";
};
hsdma@7000 {
reg = <0x7000 0x1000>;
interrupts = <0x00 0x0b 0x04>;
compatible = "mediatek,mt7621-hsdma";
reset-names = "hsdma";
#dma-requests = <0x01>;
resets = <0x05 0x05>;
status = "disabled";
#dma-channels = <0x01>;
#dma-cells = <0x01>;
interrupt-parent = <0x01>;
};
gpio@600 {
reg = <0x600 0x100>;
interrupts = <0x00 0x0c 0x04>;
compatible = "mtk,mt7621-gpio";
#address-cells = <0x01>;
#size-cells = <0x00>;
interrupt-parent = <0x01>;
bank@0 {
reg = <0x00>;
#gpio-cells = <0x02>;
compatible = "mtk,mt7621-gpio-bank";
phandle = <0x02>;
gpio-controller;
linux,phandle = <0x02>;
};
bank@1 {
reg = <0x01>;
#gpio-cells = <0x02>;
compatible = "mtk,mt7621-gpio-bank";
gpio-controller;
};
bank@2 {
reg = <0x02>;
#gpio-cells = <0x02>;
compatible = "mtk,mt7621-gpio-bank";
gpio-controller;
};
};
};
ethernet@1e100000 {
reg = <0x1e100000 0xe000>;
interrupts = <0x00 0x03 0x04>;
compatible = "mediatek,mt7621-eth", "syscon";
status = "okay";
#address-cells = <0x01>;
#size-cells = <0x00>;
mediatek,ethsys = <0x0c>;
interrupt-parent = <0x01>;
mac@0 {
reg = <0x00>;
compatible = "mediatek,eth-mac";
phy-mode = "trgmii";
mac-address = [00 0a eb 13 09 69];
fixed-link {
full-duplex;
pause;
speed = <0x3e8>;
};
};
mac@1 {
reg = <0x01>;
compatible = "mediatek,eth-mac";
phy-mode = "rgmii";
mac-address = [00 0a eb 13 09 70];
fixed-link {
full-duplex;
pause;
speed = <0x3e8>;
};
};
mdio-bus {
#address-cells = <0x01>;
phandle = <0x0d>;
#size-cells = <0x00>;
linux,phandle = <0x0d>;
ethernet-phy@1f {
reg = <0x1f>;
phy-mode = "rgmii";
};
};
};
sysclock125M@0 {
#clock-cells = <0x00>;
compatible = "fixed-clock";
clock-frequency = <0x7735940>;
phandle = <0x10>;
linux,phandle = <0x10>;
};
aliases {
serial0 = "/palmbus@1e000000/uartlite@c00";
};
interrupt-controller@1fbc0000 {
reg = <0x1fbc0000 0x2000>;
compatible = "mti,gic";
mti,reserved-cpu-vectors = <0x07>;
#interrupt-cells = <0x03>;
phandle = <0x01>;
interrupt-controller;
linux,phandle = <0x01>;
timer {
interrupts = <0x01 0x01 0x00>;
compatible = "mti,gic-timer";
clocks = <0x14>;
};
};
pinctrl {
pinctrl-0 = <0x15>;
compatible = "mtk,mtkmips-pinmux";
pinctrl-names = "default";
i2c {
phandle = <0x03>;
linux,phandle = <0x03>;
i2c {
mtk,function = "gpio";
mtk,group = "i2c";
};
};
spi {
phandle = <0x08>;
linux,phandle = <0x08>;
spi {
mtk,function = "spi";
mtk,group = "spi";
};
};
mdio {
mdio {
mtk,function = "mdio";
mtk,group = "mdio";
};
};
nand {
phandle = <0x0b>;
linux,phandle = <0x0b>;
sdhci-nand {
mtk,function = "nand2";
mtk,group = "sdhci";
};
spi-nand {
mtk,function = "nand1";
mtk,group = "spi";
};
};
pcie {
phandle = <0x0e>;
linux,phandle = <0x0e>;
pcie {
mtk,function = "gpio";
mtk,group = "pcie";
};
};
sdhci {
sdhci {
mtk,function = "sdhci";
mtk,group = "sdhci";
};
};
uart1 {
uart1 {
mtk,function = "uart1";
mtk,group = "uart1";
};
};
uart2 {
uart2 {
mtk,function = "uart2";
mtk,group = "uart2";
};
};
uart3 {
uart3 {
mtk,function = "uart3";
mtk,group = "uart3";
};
};
pinctrl0 {
phandle = <0x15>;
linux,phandle = <0x15>;
gpio {
mtk,function = "gpio";
mtk,group = "i2c", "uart2", "uart3";
};
};
rgmii1 {
rgmii1 {
mtk,function = "rgmii1";
mtk,group = "rgmii1";
};
};
rgmii2 {
rgmii2 {
mtk,function = "rgmii2";
mtk,group = "rgmii2";
};
};
};
ethsys@1e000000 {
reg = <0x1e000000 0x8000>;
compatible = "mediatek,mt7621-ethsys", "syscon";
phandle = <0x0c>;
linux,phandle = <0x0c>;
};
usb@1e1c0000 {
reg = <0x1e1c0000 0x1000 0x1e1d0700 0x100>;
phys = <0x11 0x03 0x12 0x04 0x13 0x03>;
interrupts = <0x00 0x16 0x04>;
reg-names = "mac", "ippc";
compatible = "mediatek,mt7621-xhci", "mediatek,mt2701-xhci";
clock-names = "sys_ck", "free_ck", "ahb_ck", "dma_ck";
clocks = <0x10 0x10 0x10 0x10>;
status = "okay";
interrupt-parent = <0x01>;
};
sysbusclock@0 {
#clock-cells = <0x00>;
compatible = "mtk,mt7621-sys-bus-clock";
phandle = <0x07>;
linux,phandle = <0x07>;
};
cpuclock@0 {
#clock-cells = <0x00>;
compatible = "mtk,mt7621-cpu-clock";
phandle = <0x14>;
linux,phandle = <0x14>;
};
cpuintc@0 {
compatible = "mti,cpu-interrupt-controller";
#interrupt-cells = <0x01>;
#address-cells = <0x00>;
interrupt-controller;
};
clkctrl {
#clock-cells = <0x01>;
compatible = "ralink,rt2880-clock";
phandle = <0x0f>;
linux,phandle = <0x0f>;
};
};
I'm stuck at valid dts file for device, any help?