Question about compatibilty for TL-R480T+ V9

Hardware Questions and Recommendations
1

Hi,
i have this device (TL-R480T+), is a load balancer broadband router with no wireless support, only 5 eth ports.
Is it possible to build a firmware for this device? i look at the forum about the individual specs from this router and i think they're all compatible..

These are the specs:
CPU:
MEDIATEK
MT7628NN
2138-AFSL
BCMSLT3T

FLASH: 16MB
WINBOND
25Q128JVSQ
2148

DRAM: 128MB
ESMT
M14D1G1664A
AZS1 -2.5B
P08NY01 046

NETWORK TRANSFORMERS:
2X GROUP-TEK HST2027DAR
1X GROUP-TEK HST-1025DAR

SIDACtor Protection Thyristors:
3X IB MKDA P31B

LOW VOLTAGE SUPERVISORY CIRCUIT WITH POWER-FAIL DETECTOR:
3PEAK
V6S
BALiL

Thanks

2

Can you set log level in OEM firmware to DEBUG/maximum level and collect boot log and try to discover mtd and/or ubi partitions, or better upload log, taking out last 3 or last 2 octedts from MAC and IP respectively.
Where would you download OEM Firmware Upgrade Files?

Change area for developers in the meantime

3

One here https://www.tp-link.com/us/support/download/tl-r480t%252b/#Firmware
Contains old openwrt with serial console login available.
Does it have open ssh?

To directly answer your question: yes, it is possible involving light development work on your side. But dont expect much fanaticism for 100mbps. Most home networks today grew past it.

4

I ssh'd into the device but couldn't figure out how to set log level nor find the log file..
There's no syslogd, only logd, loggerd and klogd
Can you help me set it up?

OpenWRT version is Barrier Braker but doesn't say any version number, just 'unknown'
Busybox version is 1.22.1 (2020-03-13)

I'm not familiarized with openwrt (or any router firmware) but i'm willing to learn..
Thanks for reaching out

5

try the dmesg command, hopefully you'll get the complete system log.

6

So you got the ssh

cat /proc/mtd
cat /proc/cpuinfo
ubinfo -a
free # cat /proc/meminfo if that absent.
lspci
ifconfig -a
lsmod

Just ignore commands throwing errors or missing.
then run ethtool -i eth0 against every interface seen to check drivers used

1 Like
7

in addition to what @brada4 posted, use the </> button when you post all the output.

1 Like
8

From unzipped firmware

       "support-list":[
                {"model_name": "TL-R480T+", "model_version": "9.0", "special_id": "00000000"}

So FW is not shared with anything else.

Something in the strings

        "disk-size":    "0x01000000",
        "partition-table":      [{
                        "name": "bootloader",
                        "base": "0x00000000",
                        "size": "0x00040000",
                        "attr": "0x11111111"
                }, {
                        "name": "kernel",
                        "base": "0x00040000",
                        "size": "0x00150000",
                        "attr": "0x22222222"
                }, {
                        "name": "rootfs",
                        "base": "0x00190000",
                        "size": "0x00B90000",
                        "attr": "0x33333333"
                }, {
                        "name": "partition-table",
                        "base": "0x00D20000",
                        "size": "0x00010000",
                        "attr": "0x44444444"
                }, {
                        "name": "device-info",
                        "base": "0x00D30000",
                        "size": "0x00010000",
                        "attr": "0x55555555"
                }, {
                        "name": "support-list",
                        "base": "0x00D40000",
                        "size": "0x00010000",
                        "attr": "0x66666666"
                }, {
                        "name": "firmware-info",
                        "base": "0x00D50000",
                        "size": "0x00010000",
                        "attr": "0x77777777"
                }, {
                        "name": "tddp",
                        "base": "0x00D60000",
                        "size": "0x00010000",
                        "attr": "0x88888888"
                }, {
                        "name": "log",
                        "base": "0x00D70000",
                        "size": "0x00020000",
                        "attr": "0x99999999"
                }, {
                        "name": "rootfs_data",
                        "base": "0x00E00000",
                        "size": "0x00200000",
                        "attr": "0xAAAAAAAA"
                }]
9

Thanks for the help!
I was able to run most of the commands and ethtool was not found
Here is the output:

cat /proc/mtd:
dev:    size   erasesize  name
mtd0: 00040000 00010000 "bootloader"
mtd1: 00150000 00010000 "kernel"
mtd2: 00b90000 00010000 "rootfs"
mtd3: 00020000 00010000 "device-info"
mtd4: 00010000 00010000 "support-list"
mtd5: 00010000 00010000 "firmware-info"
mtd6: 00010000 00010000 "tddp"
mtd7: 00020000 00010000 "log"
mtd8: 00200000 00010000 "rootfs_data"
mtd9: 01000000 00010000 "firmware"

cat /proc/cpuinfo:
system type		: MT7628
machine			: Unknown
processor		: 0
cpu model		: MIPS 24KEc V5.5
BogoMIPS		: 382.46
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp
shadow register sets	: 1
kscratch registers	: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

free:
                                     total          used            free    shared      buffers
Mem:                     126016        41876        84140            0         5028
-/+ buffers:                                 36848        89168
Swap:                               0                 0                0

cat /proc/meminfo:
MemTotal:         126016 kB
MemFree:           84140 kB
Buffers:            5028 kB
Cached:            18464 kB
SwapCached:            0 kB
Active:            15284 kB
Inactive:          12352 kB
Active(anon):       4708 kB
Inactive(anon):     1804 kB
Active(file):      10576 kB
Inactive(file):    10548 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          4160 kB
Mapped:             3856 kB
Shmem:              2368 kB
Slab:               8480 kB
SReclaimable:       2392 kB
SUnreclaim:         6088 kB
KernelStack:         456 kB
PageTables:          488 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       63008 kB
Committed_AS:      18876 kB
VmallocTotal:    1048372 kB
VmallocUsed:        4860 kB
VmallocChunk:    1022780 kB

ifconfig -a:
bond0     Link encap:Ethernet  HWaddr <mac-address>  
          BROADCAST MASTER MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr <mac-address>  
          inet addr:192.168.0.1  Bcast:192.168.255.255  Mask:255.255.0.0
          inet6 addr: fe80::b6b0:24ff:feee:4316/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1209 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1082 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:101066 (98.6 KiB)  TX bytes:1000914 (977.4 KiB)

eth0      Link encap:Ethernet  HWaddr <mac-address>  
          inet6 addr: fe80::20c:43ff:fe28:8032/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1209 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1127 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:122828 (119.9 KiB)  TX bytes:1018240 (994.3 KiB)
          Interrupt:3 

eth0.1    Link encap:Ethernet  HWaddr <mac-address>  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1209 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1082 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:101066 (98.6 KiB)  TX bytes:1000914 (977.4 KiB)

eth0.10   Link encap:Ethernet  HWaddr <mac-address>  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:6222 (6.0 KiB)

eth0.20   Link encap:Ethernet  HWaddr <mac-address>  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:6222 (6.0 KiB)

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-65-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

gretap0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ip6tnl0   Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1452  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:101 errors:0 dropped:0 overruns:0 frame:0
          TX packets:101 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:6907 (6.7 KiB)  TX bytes:6907 (6.7 KiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lsmod:
af_key                 30288  0 
ah4                     4960  0 
ah6                     4816  0 
arc4                    1344  0 
arp_garp                7536  0 
atm                    38994  2 pppoatm
authenc                 5632  0 
authlimit               4571  0 
balance_route           1200  0 
bonding                84598  0 
br2684                  7216  0 
cbc                     2192  0 
compat_xtables          1980  1 xt_ACCOUNT
crc_ccitt               1003  1 ppp_async
deflate                 1472  0 
des_generic            18697  0 
ecb                     1424  0 
esp4                    5664  0 
esp6                    5216  0 
fast_classifier       274629  0 
gpio_button_hotplug     4944  0 
gre                     1906  2 pptp
hmac                    2464  0 
ip6_tables              9825  3 ip6table_raw
ip6_tunnel             15041  0 
ip6t_REJECT             2544  2 
ip6table_filter          624  1 
ip6table_mangle         1072  1 
ip6table_raw             592  0 
ip_gre                  8048  0 
ip_set                 26293 23 arp_garp
ip_set_bitmap_ip        6912  0 
ip_set_bitmap_ipmac     6944  0 
ip_set_bitmap_port      6144  0 
ip_set_hash_iface      11584  1 
ip_set_hash_ip         21280  4 
ip_set_hash_ipauthlimit   11664  0 
ip_set_hash_ipipmark   11616  0 
ip_set_hash_ipmac      12080  3 
ip_set_hash_ipmark     21392  0 
ip_set_hash_ipport     22000  0 
ip_set_hash_ipportip   22816  0 
ip_set_hash_ipportnet   27264  0 
ip_set_hash_mac        10912  1 
ip_set_hash_net        24288  4 
ip_set_hash_netiface   25584  0 
ip_set_hash_netnet     27696  0 
ip_set_hash_netport    25792  0 
ip_set_hash_netportnet   28832  0 
ip_set_hash_qq         11824  0 
ip_set_list_set         6800  0 
ip_tunnel              11291  2 ip_gre
ipcomp                  2112  0 
ipcomp6                 1920  0 
ipt_ECN                 1392  0 
ipt_MASQUERADE          1152  2 
ipt_REJECT              1872  2 
ipt_TRIGGER             2080  0 
ipt_ah                   704  0 
iptable_filter           672  1 
iptable_nat             2032  1 
iptable_raw              640  1 
iptvx                   1120  0 
l2tp_core              18670  2 l2tp_ppp
l2tp_netlink            6968  1 l2tp_ppp
l2tp_ppp               16832  0 
leds_gpio               1824  0 
ledtrig_timer           1184  0 
liblogger               1326  2 arp_garp
md5                     1424  0 
nf_conntrack_amanda     1904  1 nf_nat_amanda
nf_conntrack_broadcast     861  1 nf_conntrack_snmp
nf_conntrack_ftp        5328  1 nf_nat_ftp
nf_conntrack_h323      35647  1 nf_nat_h323
nf_conntrack_ipv6       6848  4 
nf_conntrack_irc        2944  1 nf_nat_irc
nf_conntrack_netlink   21904  1 special_route
nf_conntrack_pptp       3600  1 nf_nat_pptp
nf_conntrack_proto_gre    3237  1 nf_conntrack_pptp
nf_conntrack_sip       19325  1 nf_nat_sip
nf_conntrack_snmp        784  1 nf_nat_snmp_basic
nf_defrag_ipv6          9457  1 nf_conntrack_ipv6
nf_nat                 11632 14 nf_nat_pptp
nf_nat_amanda            864  0 
nf_nat_ftp              1312  0 
nf_nat_h323             5536  0 
nf_nat_ipv4             2878  1 iptable_nat
nf_nat_irc              1008  0 
nf_nat_pptp             1552  0 
nf_nat_proto_gre         896  1 nf_nat_pptp
nf_nat_sip              7648  0 
nf_nat_snmp_basic       7872  0 
nfnetlink               2667  5 nfnetlink_queue
nfnetlink_queue         8461  1 
ppp_async               7312  0 
ppp_generic            22690  7 pppoe
ppp_mppe                5200  0 
pppoatm                 3664  0 
pppoe                   9072  0 
pppox                   1370  3 pppoe
pptp                   14208  0 
sha1_generic            1603  0 
shortcut_fe           899144  1 fast_classifier
shortcut_fe_ipv6      545993  1 fast_classifier
sit                    12400  0 
slhc                    4603  1 ppp_generic
special_route          10159  1 special_route_target
special_route_target     976  0 
ts_bm                   1456  0 
ts_fsm                  2608  0 
ts_kmp                  1376  5 
tunnel4                 1838  2 sit
tunnel6                 1758  2 xfrm6_tunnel
url_dns_match           1408  0 
urlset                 80946  5 websecmatch
urlsetmatch             2496  0 
urlsettarget            4960  0 
web_dns_match           1456  0 
webfiltermatch          2320  0 
websecmatch             1632  0 
xfrm4_mode_beet         1440  0 
xfrm4_mode_transport     688  0 
xfrm4_mode_tunnel       1876  0 
xfrm4_tunnel            1136  0 
xfrm6_mode_beet         1184  0 
xfrm6_mode_transport     736  0 
xfrm6_mode_tunnel       1184  0 
xfrm6_tunnel            2479  1 ipcomp6
xfrm_algo               3790  7 esp6
xfrm_ipcomp             3021  2 ipcomp6
xfrm_user              22512  0 
xt_ACCOUNT              9440  0 
xt_CLASSIFY              576  0 
xt_CT                   2880  0 
xt_DSCP                 1488  0 
xt_HL                   1344  0 
xt_LOG                 10416  0 
xt_NETMAP               1168  0 
xt_NFQUEUE              1760  0 
xt_REDIRECT             1056  0 
xt_TCPMSS               2864  0 
xt_addrtype             2192  0 
xt_authlimit             672  0 
xt_comment               480  4 
xt_connbytes            1584  0 
xt_connlimit            3856  0 
xt_conntrack            2240  6 
xt_dosdrop               896  9 
xt_dscp                  992  0 
xt_ecn                  1280  0 
xt_esp                   784  0 
xt_helper                880  0 
xt_hl                    800  0 
xt_iprange              1088  0 
xt_ipsecmark             480  5 
xt_ipv4options           640  1 
xt_layer7              10468  0 
xt_length                688  4 
xt_limit                1104  0 
xt_mac                   608  0 
xt_multinetdev           848  0 
xt_multiport            1200 10 
xt_nat                  1152  0 
xt_owner                 688  0 
xt_pkttype               592  0 
xt_policy               1952  2 
xt_quota                 768  0 
xt_recent               6896  0 
xt_set                  6896  0 
xt_state                 704  0 
xt_statistic             880  0 
xt_string               1040  0 
xt_tcpmss               1008  0 
xt_time                 1696  0 
xt_tplimit              3440  0 
xt_vlan                  608  0 
zlib_deflate           18456  1 deflate

dmesg:

[    0.000000] Linux version 3.10.14 (jenkins_router@Sohoilinuxbuild) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 unknown) ) #1 Fri Mar 13 10:37:24 CST 2020
[    0.000000] 
[    0.000000]  The CPU feqenuce set to 575 MHz
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] @@----debug cmdline=[  board=TL-R480V9 console=ttyS1,115200 root=31:02 init=/sbin/init mtdparts=raspi:256k(u-boot)ro,3072k(kernel),12288k(rootfs) ]
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000] free_area_init_node: node 0, pgdat 8038af60, node_mem_map 81000000
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd rootfstype=squashfs,yaffs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=000379b0
[    0.000000] Readback ErrCtl register=000379b0
[    0.000000] Memory: 125808k/131072k available (2837k kernel code, 5264k reserved, 792k data, 208k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.088000] Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
[    0.116000] pid_max: default: 32768 minimum: 301
[    0.120000] Security Framework initialized
[    0.124000] Mount-cache hash table entries: 512
[    0.128000] NET: Registered protocol family 16
[    0.132000] RALINK_GPIOMODE = 54054444 
[    0.136000] RALINK_GPIOMODE = 54044444 
[    0.236000] ***** Xtal 25MHz *****
[    0.240000] start PCIe register access
[    0.740000] RALINK_RSTCTRL = 2400000
[    0.744000] RALINK_CLKCFG1 = fdbfffc0
[    0.744000] 
[    0.744000] *************** MT7628 PCIe RC mode *************
[    1.244000] PCIE0 no card, disable it(RST&CLK)
[    1.272000] bio: create slab <bio-0> at 0
[    1.276000] Switching to clocksource MIPS
[    1.280000] NET: Registered protocol family 2
[    1.288000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    1.296000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.300000] TCP: Hash tables configured (established 1024 bind 1024)
[    1.308000] TCP: reno registered
[    1.312000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.316000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.324000] NET: Registered protocol family 1
[    1.328000] PCI: CLS 0 bytes, default 32
[    1.328000] Load Ralink Timer0 Module
[    1.332000] Load Ralink Timer1 Module
[    1.336000] Load Ralink Timer2 Module
[    1.356000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.364000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.376000] msgmni has been set to 245
[    1.380000] alg: No test for stdrng (krng)
[    1.384000] io scheduler noop registered (default)
[    1.388000] io scheduler deadline registered
[    1.392000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.400000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.408000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.416000] flash manufacture id: ef, device id 40 18
[    1.420000] W25Q128BV(ef 40180000) (16384 Kbytes)
[    1.428000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.436000] @@-----debug r470/r480 tplink flash parse--------
[    1.444000] 10 tp-link partitions found on MTD device raspi
[    1.448000] Creating 10 MTD partitions on "raspi":
[    1.452000] 0x000000000000-0x000000040000 : "bootloader"
[    1.460000] 0x000000040000-0x000000190000 : "kernel"
[    1.468000] 0x000000190000-0x000000d20000 : "rootfs"
[    1.472000] mtd: device 2 (rootfs) set to be root filesystem
[    1.480000] 0x000000d20000-0x000000d40000 : "device-info"
[    1.488000] 0x000000d40000-0x000000d50000 : "support-list"
[    1.492000] 0x000000d50000-0x000000d60000 : "firmware-info"
[    1.500000] 0x000000d60000-0x000000d70000 : "tddp"
[    1.508000] 0x000000d70000-0x000000d90000 : "log"
[    1.512000] 0x000000e00000-0x000001000000 : "rootfs_data"
[    1.520000] 0x000000000000-0x000001000000 : "firmware"
[    1.528000] rdm_major = 253
[    1.532000] netif_napi_add() called with weight 128 on device eth0
[    1.536000] GMAC1_MAC_ADRH -- : 0x0000000c
[    1.540000] GMAC1_MAC_ADRL -- : 0x432880df
[    1.544000] Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
[    1.556000] NAPI enable, Tx Ring = 512, Rx Ring = 512
[    1.560000] GMAC1_MAC_ADRH -- : 0x0000000c
[    1.564000] GMAC1_MAC_ADRL -- : 0x43288032
[    1.568000] eth0: Found an MT7628
[    1.572000] PROC INIT OK!
[    1.576000] Mirror/redirect action on
[    1.580000] nf_conntrack version 0.5.0 (1965 buckets, 7860 max)
[    1.588000]  ## netfilter xt_connextmark loaded.
[    1.588000]  
[    1.592000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.596000] Type=Linux
[    1.600000] TCP: cubic registered
[    1.604000] NET: Registered protocol family 10
[    1.612000] NET: Registered protocol family 17
[    1.616000] 8021q: 802.1Q VLAN Support v1.8
[    1.624000] Registered character driver slp_flash_chrdev
[    1.636000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.644000] Freeing unused kernel memory: 208K (8038c000 - 803c0000)
[    1.652000] Failed to execute squashfs,jffs2.  Attempting defaults...
[    4.436000] jffs2: notice: (263) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[    8.112000] liblogger: module license 'unspecified' taints kernel.
[    8.116000] Disabling lock debugging due to kernel taint
[    8.148000] NET: Registered protocol family 8
[    8.152000] NET: Registered protocol family 20
[    8.164000] Initializing XFRM netlink socket
[    8.172000] NET: Registered protocol family 15
[    8.228000] l2tp_core: L2TP core driver, V2.0
[    8.232000] l2tp_netlink: L2TP netlink interface
[    8.240000] sit: IPv6 over IPv4 tunneling driver
[    8.252000] gre: GRE over IPv4 demultiplexor driver
[    8.264000] ip_gre: GRE over IPv4 tunneling driver
[    8.292000] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[    8.344000] PPP generic driver version 2.4.2
[    8.364000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.380000] Netfilter messages via NETLINK v0.30.
[    8.400000] ip_set: protocol 6
[    8.480000]  ipset kmod ipauthlimit loading 
[    8.508000] 
[    8.508000]  module multinetdev loding 
[    8.520000]  module xt_tplimit loding 
[    8.524000]     xt_tplimit create cell_memcache OK! 
[    8.532000]     xt_tplimit create cell_mempool OK, capacity 8192! 
[    8.560000]  kmodule authlimit loding 
[    8.564000]  add cdev authlimit ok, MAJOR 254, MINOR 0 
[    8.572000]     create cell_memcache OK! 
[    8.576000]     create cell_mempool OK, capacity 8192! 
[    8.584000]     create authlimit hash table OK, spec 256  @0xffffffff80738000
[    8.604000]  netfilter module authlimit loding 
[    8.628000] balance route match init success!
[    8.704000] ctnetlink v0.93: registering with nfnetlink.
[    8.768000] PPP MPPE Compression module registered
[    8.772000] NET: Registered protocol family 24
[    8.784000] PPTP driver version 0.8.5
[    8.812000] xt_connlimit: enable /proc/connlimit_stat for per-ip statistics 256.
[    8.852000] xt_time: kernel timezone is -0000
[    8.864000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   14.348000] Raeth v3.1 (NAPI
[   14.352000] ,SkbRecycle)
[   14.356000] 
[   14.356000] phy_tx_ring = 0x073a2000, tx_ring = 0xa73a2000
[   14.364000] 
[   14.364000] phy_rx_ring0 = 0x073c4000, rx_ring0 = 0xa73c4000
[   14.384000] GMAC1_MAC_ADRH -- : 0x0000000c
[   14.392000] GMAC1_MAC_ADRL -- : 0x43288032
[   14.396000] RT305x_ESW: Link Status Changed
[   15.208000] device eth0.1 entered promiscuous mode
[   15.212000] device eth0 entered promiscuous mode
[   15.220000] br-lan: port 1(eth0.1) entered forwarding state
[   15.224000] br-lan: port 1(eth0.1) entered forwarding state
[   17.228000] br-lan: port 1(eth0.1) entered forwarding state
[   26.692000] iptvc v1.0.0 loading
[   32.500000] arp_garp is loaded.
[   32.504000] narr=3
[   44.532000] fast-classifier: starting up
[   44.536000] fast-classifier: registered
[   44.564000] Update Subnet-> ip: 0000A8C0, mask: 0000FFFF
[   47.972000] init special_route module finish, nf_conntrack_max=[30000].
[   48.052000] special route target init success!
[   70.820000] RT305x_ESW: Link Status Changed
10 
[    1.244000] PCIE0 no card, disable it(RST&CLK)

Does it have any onboard PCIE slot, or like field of unsoldered pins -> this is where wifi goes.

Realtek switch should be separate chip near eth ports with spider-like feat on it.

What now - can you post motherboard picture so we look fro 4 or 3 pins in a row looking like serial header?
We need to see if bootloader can be used to back up and restore rest of flash and if it can netboot from tftp to try Openwrt initrd.

11

MT7628 is not a powerful chip but this unit having 16/128 is definitely supportable. If you can find another model with 16 MB flash and the kernel at 0x40000 you could probably treat it as that model. This is reasonably simple to test by booting initramfs builds using serial control of the bootloader.

1 Like
12

No, there's no PCIE slot.. Maybe because this devices doesn't have wireless capabilities
The Realtek switch i didn't see either..
Let me know if the pictures look too blurry

2024-11-17-20-17-52-662
2024-11-17-20-17-52-6621920×1440 445 KB

@mk24 That's was kind of my original idea, maybe another model could work with this device

Thanks again

13

Here's a better look at the solder points

2024-11-17-20-33-36-051
2024-11-17-20-33-36-0511920×2560 472 KB

14

Looks like it, measure voltage between first and last, whether it is 3.3v or 5v
Arrow is likely zero and middle ones are tx and rx one or other way.

15

When i test the first (arrow) with the fourth (last) it doesn' show anything, but if i test first or last with one of the middle it reads 6.5v
Don't know if i'm doing something wrong or my voltimeter is broken

16

It looks like the first two are transmit and receive data the third one is linked to the ground plane, and #4 is probably power but you don't need to connect to that. Unlike what TP-Link usually does the factory installed all the resistors in place to connect the data pins to the CPU.

17

This looks like a dead end.. Can't figure out the uart connection and don't know if i can flash a firmware through tftp directly from the device, booting in emergency mode or something similar..

Anyways, thanks for the help!