Support for TP-link RE205 v3

Running an initramfs-image from RAM should be a safe option.

I tried to access the bootloader to start an OpenWrt-image, or at least to be able to recover if something went wrong.
I connected ground of my serial interface to TP5.
TP4 seems to be 3.3V
TP2 is TX (connect to RX of the serial interface)
I thought TP1 might be RX, but TP1 seems to be pulled to ground.

I can see output from the bootloader (u-boot 1.1.3). But I cannot interrupt it, I cannot send commands to the bootloader.

Did anybody had more luck than I?
Did anybody found TP3?

This is the output from the bootloader:

cid reg:00010102, cid:1[04010D07][04010D0A]
DDR Calibration DQS reg = 00008988

DDR Calibration MEMCTRL reg = 0E120003

U-Boot 1.1.3 (Nov 28 2020 - 10:44:01)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: 20, device id 70 17
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

Ralink UBoot Version:
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 28 2020  Time:10:44:01
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 3

3: System Boot system code via Flash.
## Booting image at bc020000 ...
text base: 80000000
entry point: 8000c150
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c150) ...
## Giving linux memsize in MB, 64

Starting kernel ...