Support for TP-LINK TL-WR802N V4

Ok, so I didn't have a multimeter, and I didn't find the ground, but here is the complete log (i think): https://ptpb.pw/-h_B.txt

[04040C0E][04040C0C]
DDR Calibration DQS reg = 00008889
U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.
 0 
disable switch phyport...
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c150) ...
## Giving linux memsize in MB, 64
Starting kernel ...

Linux version 2.6.36 (tomcat@buildserver) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Fri Apr 21 20:30:42 CST 2017
 The CPU feqenuce set to 575 MHz
 MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0000056d
Readback ErrCtl register=0000056d
Memory: 61604k/65536k available (2266k kernel code, 3932k reserved, 602k data, 160k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 120
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
i2cdrv_major = 218
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
brd: module loaded
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 7 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007c0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007c0000-0x0000007d0000 : "config"
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "rom"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (962 buckets, 3848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
SQUASHFS error: Xattrs in filesystem, these will be ignored
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 160k freed

starting pid 31, tty '': '/etc/init.d/rcS'
cp: can't stat '/etc/SingleSKU_FCC.dat': No such file or directory
rdm_major = 253
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(  7df100) ffffffc0-25-ffffffe9-6c-ffffffe7-ffffffa8
GMAC1_MAC_ADRH -- : 0x0000c025
GMAC1_MAC_ADRL -- : 0xe96ce7a8
Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(  7df100) ffffffc0-25-ffffffe9-6c-ffffffe7-ffffffa8
GMAC1_MAC_ADRH -- : 0x0000c025
GMAC1_MAC_ADRL -- : 0xe96ce7a8
PROC INIT OK!
add domain:tplinkwifi.net
add domain:tplinkap.net
add domain:tplinkrepeater.net
add domain:tplinklogin.net
tp_domain init ok
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.

starting pid 66, tty '/dev/ttyS1': '/bin/sh'
~ # [ util_execSystem ] 139:  ipt_init cmd is "/var/tmp/dconf/rc.router"
[ dm_readFile ] 2061:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007c0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007c0000 length 0x9dae, ret 0, retlen 0x9dae
===>Enter Routerspiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
 mode
spiflash_ioctl_read, Read from 0x007df200 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007df300 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007df400 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x007df500 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007df600 length 0x21, ret 0, retlen 0x21
spiflash_ioctl_read, Read from 0x007df700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x00020000 length 0x1d0, ret 0, retlen 0x1d0
spiflash_ioctl_read, Read from 0x007df100 length 0x6, ret 0, retlen 0x6
sendto: No such file or directory
pid 65 send 2001 error
[ util_execSystem ] 139:  oal_startDynDns cmd is "dyndns /var/tmp/dconf/dyndns.conf"
[ oal_sys_getOldTZInfo ] 449:  Open TZ file error!
[ util_execSystem ] 139:  oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"
[ util_execSystem ] 139:  oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"
[ util_execSystem ] 139:  oal_startNoipDns cmd is "noipdns /var/tmp/dconf/noipdns.conf"
[ util_execSystem ] 139:  oal_startCmxDns cmd is "cmxdns /var/tmp/dconf/cmxdns.conf"
ioctl: No such device
[ util_execSystem ] 139:  oal_br_addBridge cmd is "brctl addbr br0;brctl setfd br0 0;brctl stp br0 off"
[ util_execSystem ] 139:  oal_ipt_addLanRules cmd is "iptables -t filter -A INPUT -i br+ -j ACCEPT
"
[ util_execSystem ] 139:  oal_intf_setIntf cmd is "ifconfig br0 192.168.0.1 netmask 255.255.255.0 up"
[ util_execSystem ] 139:  oal_util_setProcLanAddr cmd is "echo "br0 16820416," > /proc/net/conRaeth v3.1 (ntract_LocalAddrNAPI
"
[ util_exec,SkbRecycleSystem ] 139:  o)
al_intf_enableIn
phy_tx_ring = 0x030ae000, tx_ring = 0xa30ae000
tf cmd is "ifcon
phy_rx_ring0 = 0x030af000, rx_ring0 = 0xa30af000
fig eth0 up"
[fe_sw_init:4983]rt305x_esw_init.
disable switch phyport...
GMAC1_MAC_ADRH -- : 0x0000c025
GMAC1_MAC_ADRL -- : 0xe96ce7a8
RT305x_ESW: Link Status Changed
[ rsl_getUnusedVlan ] 984:  GET UNUSED VLAN TAG 1 : [3]
[ rsl_getUnusedVlan ] 984:  GET UNUSED VLAN TAG 2 : [4]
[ rsl_getUnusedVlan ] 984:  GET UNUSED VLAN TAG 3 : [5]
[ rsl_getUnusedVlan ] 984:  GET UNUSED VLAN TAG 4 : [6]
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 3"
[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.3 up"
set if eth0.3 to *not wan dev
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 4"
[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.4 up"
set if eth0.4 to *not wan dev
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 5"
[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.5 up"
set if eth0.5 to *not wan dev
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 6"
[ util_execSystem ] 139:  oal_intf_enabldevice eth0.3 entered promiscuous mode
eIntf cmd is "ifdevice eth0 entered promiscuous mode
config eth0.6 upbr0: port 1(eth0.3) entering forwarding state
"
set if eth0br0: port 1(eth0.3) entering forwarding state
.6 to *not wan dev
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfigdevice eth0.4 entered promiscuous mode
 add eth0 2"
br0: port 2(eth0.4) entering forwarding state
[ util_execSystebr0: port 2(eth0.4) entering forwarding state
m ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.2 up"
set if eth0.2 to wadevice eth0.5 entered promiscuous mode
n dev
[ vlan_adbr0: port 3(eth0.5) entering forwarding state
dLanPortsIntoBribr0: port 3(eth0.5) entering forwarding state
dge ] 523:  add lan Port 255 from br0
[ util_execSystem ] 139:  oal_br_addIntfIdevice eth0.6 entered promiscuous mode
ntoBridge cmd isbr0: port 4(eth0.6) entering forwarding state
 "brctl addif brbr0: port 4(eth0.6) entering forwarding state
0 eth0.3"
[ util_execSystem ] 139:  oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.4"
[ util_execSystem ] 139:  oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.5"
[ util_execSystem ] 139:  oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.6"
[ util_execSystem ] 139:  rsl_initIPv6CfgObj cmd is "echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6"
[ util_execSystem ] 139:  oal_eth_setIGMPSnoopParam cmd is "for i in /sys/devices/virtual/net/*/bridge/multicast_snooping;do echo 1 > $i ; done"
[ util_execSystem ] 139:  oal_wlan_ra_setCountryRegion cmd is "cp /etc/SingleSKU_CE.dat /var/Wireless/RT2860AP/SingleSKU.dat"
[ util_execSystem ] 139:  oal_wlan_ra_setCountryRegion cmd is "iwpriv ra0 set CountryRegion=1"
ra0       no private ioctls.
[ util_execSystem ] 166:  execute ok, exit status = 255
[ util_execSystem ] 139:  oal_wlan_ra_loadDriver cmd is "insmod /lib/modules/kmdir/kernel/drivers/net/wireless/mt_wifi_ap/mt_wifi.ko"
ADDRCONF(NETDEV_CHANGE): eth0.4: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.5: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.6: link becomes ready
ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready
=== pAd = c0823000, size = 1470664 ===
<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1156)::(2), pChipCap->fw_len(64560)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
[ util_execSystem ] 139:  oal_wlan_ra_initWlan cmd is "ifconfig ra0 up"
TX_BCN DESC a3279000 size = 320
RX[0] DESC a327c000 size = 1024
RX[1] DESC a327d000 size = 1024
RT_CfgSetApcliMacAddress : invalid mac setting 
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
WscKeyASCII=8
WscKeyASCII=8
[RTMPReadParametersHook:297]wifi read profile faild.
load fw image from fw_header_image
AndesMTLoadFwMethod1(2263)::pChipCap->fw_len(64560)
FW Version:1
FW Build Date:20161213152835
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000012
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
exec!
spiflash_ioctl_read, Read from 0x007f0000 length 0x400, ret 0, retlen 0x400
eeFlashId = 0x7628!
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 34
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1277): Set the Max RxPktLen=450!
<--mt_mac_init()
	WTBL Segment 1 info:
		MemBaseAddr/FID:0x28000/0
		EntrySize/Cnt:32/128
	WTBL Segment 2 info:
		MemBaseAddr/FID:0x40000/0
		EntrySize/Cnt:64/128
	WTBL Segment 3 info:
		MemBaseAddr/FID:0x42000/64
		EntrySize/Cnt:64/128
	WTBL Segment 4 info:
		MemBaseAddr/FID:0x44000/128
		EntrySize/Cnt:32/128
AntCfgInit(2940): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 01
MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
FW LOG: !!!! Pass, dont need recal (total fail[0])
FW LOG: !!!! Pass, dont need recal (total fail[0])
FW LOG: !!!! Pass, dont need recal (total fail[0])
FW LOG: RxDCOC Set DC Valid(8)(2)
CmdSlotTimeSet:(ret = 0)
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
MtAsicSetRalinkBurstMode(3048): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
reload DPD from flash , 0x9F = [ca00] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0
MtAsicSetTxPreamble(3027): Not support for HIF_MT yet!
MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
ap_ftkd> Initialize FT KDP Module...
Main bssid = c0:25:e9:6c:e7:a8
<==== rt28xx_init, Status=0
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
WiFi Startup Cost (ra0): 3.444s
[ util_execSystem ] 139:  oal_wlan_ra_initWlan cmd is "echo 1 > /proc/tplink/led_wlan_24G"
[ util_execSystem ] 139:  oal_wlan_ra_setStaNum cmd is "iwpriv ra0 set MaxStaNum=32"
[ util_execSystem ] 139:  device ra0 entered promiscuous mode
oal_br_addIntfInbr0: port 5(ra0) entering forwarding state
toBridge cmd is br0: port 5(ra0) entering forwarding state
"brctl addif br0 ra0"
[ util_execSystem ] 139:  oal_br_addIntfIntoBridge cmd device apcli0 entered promiscuous mode
is "brctl addif br0 apcli0"
[ util_execSystem ] 139:  oal_br_addIntfIntoBridgdevice ra1 entered promiscuous mode
e cmd is "brctl addif br0 ra1"
[ util_execSystem ] 139:  oal_wlan_ra_initEnd spiflash_ioctl_read, Read from 0x007f0000 length 0x2, ret 0, retlen 0x2
cmd is "wlNetlin
====
@@@ ed_status_read: EDCCA TH - H
pAd->ed_trigger_cnt : 0 > 20 ||  pAd->ed_big_rssi_stat : 0 < 50
====
kTool &"
[ util_execSystem ] 139:  oal_wlan_ra_initEnd cmd is "killall -q wscd"
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_wlan_ra_initEnd cmd is "wscd -i ra0 -m 1 -w /var/tmp/wsc_upnp/ &"
[ util_execSystem ] 139:  rsl_initLanWlanObj cmd is "echo 0 > /proc/tplink/wl_mode"
WLAN-Start wlNetlinkTool
Waiting for Wireless Events from interfaces...
swWlanChkAhbErr: netlink to do
[ oal_wlan_ra_loadDriver ] 1905:  no 5G chip.
[ rsl_initLanWlanObj ] 8519:  perror:1
wscd: SSDP UDP PORT = 1900
sendto: No such file or directory
pid 65 send 2030 error
sendto: No such file or directory
pid 65 send 2004 error
[ util_execSystem ] 139:  oal_startDhcps cmd is "dhcpd /var/tmp/dconf/udhcpd.conf"
[ util_execSystem ] 139:  oal_lan6_startDhcp6s cmd is "dhcp6s -c /var/tmp/dconf/dhcp6s_br0.conf -P /var/run/dhcp6s_br0.pid br0 &"
[ util_execSystem ] 139:  oal_lan6_startRadvd cmd is "radvd -C /var/tmp/dconf/radvd_br0.conf -p /var/run/radvd_br0.pid &"
[ util_execSystem ] 139:  oal_startSnmp cmd is "snmpd -f /var/tmp/dconf/snmpd.conf"
mldProxy# file: src/mld_ifinfo.c;line: 102; error = No such file or directory
mldProxy# Err: get LLA failed
iptables: Bad rule (does a matching rule exist in that chain?).
radvd starting
[Jan 01 00:00:07] radvd: no linklocal address configured for br0
[Jan 01 00:00:07] radvd: error parsing or activating the config file: /var/tmp/dconf/radvd_br0.conf
[ util_execSystem ] 139:  oal_br_delIntfFromBridge cmd is "brctl delif br0 eth0.2"
brctl: bridge br0: Invalid argument
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_intf_setIfMac cmd is "ifconfig eth0.2 down"
[ util_execSystem ] 139:  oal_intf_setIfMac cmd is "ifconfig eth0.2 hw ether C0:25:E9:6C:E7:A9 up"
[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.2 up"
[ rsl_initAppObj ] 743:  ==> start dhcp client
[ util_execSystem ] 139:  oal_ipt_fwDdos cmd is "iptables -D FORWARD -j FIREWALL_DDOS
"
iptables: No chain/target/match by that name.
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_ipt_forbidLanPing cmd is "iptables -t filter -D INPUT -i br+ -p icmp --icmp-type echo-request -j DROP
iptables -t filter -D FORWARD -i br+ -p icmp --icmp-type echo-request -j DROP
"
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_ddos_delPingRule cmd is "iptables -t filter -D INPUT ! -i br+ -p icmp --icmp-type echo-request -j ACCEPT
"
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_ipt_setDDoSRules cmd is "iptables -F FIREWALL_DDOS"
[ util_execSystem ] 139:  ddos_clearAll cmd is "rm -f /var/tmp/dosHost"
[ util_execSystem ] 139:  oal_initFirewallObj cmd is "ebtables -N FIREWALL"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -F"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -X"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -P INPUT ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -P FORWARD DROP"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -P OUTPUT ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -N FIREWALL"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -N FWRULE"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -N SETMSS"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i lo -p ALL -j ACCEPT -m comment 					--comment "loop back""
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT  -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p tcp --dport 23 -j ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p tcp --dport 23 -j DROP"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -i br+ -p icmpv6 --icmpv6-type echo-request -j ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -i br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -o br+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -A FORWARD -j FIREWALL"
[ util_execSystem ] 139:  oal_initIp6FirewallObj cmd is "ip6tables -I FORWARD 1 -j SETMSS"
[ util_execSystem ] 139:  oal_fw6_setFwEnabeld cmd is "ip6tables -D FIREWALL -j ACCEPT"
ip6tables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_fw6_setFwEnabeld cmd is "ip6tables -F FIREWALL"
[ util_execSystem ] 139:  oal_fw6_setFwEnabeld cmd is "ip6tables -A FIREWALL -j ACCEPT"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_ftp.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_ftp.ko"
[ util_execSystem ] 139:  oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH  -p udp --dport 500 -j DROP"
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_pptp.ko"
[ util_execSystem ] 139:  oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH  -p tcp --dport 1723 -j DROP"
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  oal_openAlg cmd is "iptables -D FORWARD_VPN_PASSTHROUGH  -p udp --dport 1701 -j DROP"
iptables: Bad rule (does a matching rule exist in that chain?).
[ util_execSystem ] 166:  execute ok, exit status = 1
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_tftp.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_tftp.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_h323.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_h323.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_sip.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_sip.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_rtsp.ko"
[ util_execSystem ] 139:  setupModules cmd is "insmod /lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_rtsp.ko"
nf_nat_rtsp v0.6.21 loading
enable switch phyport...
Set: phy[0].reg[0] = 3900
[cmd_dutInit():697] init shm
[tddp_taskEntry():151] tddp task start
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
[ util_execSystem ] 139:  prepareDropbear cmd is "dropbearkey -t rsa -f /var/tmp/dropbear/dropbear_rsa_host_key"
Will output 1024 bit rsa secret key to '/var/tmp/dropbear/dropbear_rsa_host_key'
Generating key, this may take a while...
[ util_execSystem ] 139:  prepareDropbear cmd is "dropbearkey -t dss -f /var/tmp/dropbear/dropbear_dss_host_key"
Will output 1024 bit dss secret key to '/var/tmp/dropbear/dropbear_dss_host_key'
Generating key, this may take a while...
[ util_execSystem ] 139:  prepareDropbear cmd is "dropbear -p 22 -r /var/tmp/dropbear/dropbear_rsa_host_key -d /var/tmp/dropbear/dropbear_dss_host_key -A /var/tmp/dropbear/dropbearpwd"
[ util_execSystem ] 139:  oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"
[ util_execSystem ] 139:  oal_sys_unsetTZ cmd is "echo "" > /etc/TZ"

Yeah,it has partitions identical to 840N v4.
So you can build tree https://github.com/robimarko/openwrt/tree/WR802N-v4

If you dont have a way to build it,PM me

I have a linux box, so I should be able to build it. It seems the 802N-v4 does not appear under menuconfig, in Mediatek Ralink Mips > MT76x8 based boards, is this normal?

Should I manually compile it, bypassing menuconfig (if yes, how?).

Many thanks,

Rémy

Yeah,I did not add it to target devices so it was missing.
Download the branch now,it should be there

Hi. Let's assume I managed to compile the openwrt image (after many adventures it seems it's in good way), should I try to flash it through the web interface or should I use another method? It seems i'm not able to stop the boot process by typing on keys through the serial port (but I can get a shell during the boot of the os on the device).

Yes, you can try over WEB UI, it should work.
TP-Link edited boot menu so you need to hold t while booting to get into U-boot console, and they removed all other modes.
So if you can get into U-boot console you can test with initramfs image without permanently flashing

Ok, so I tried to flash the file I compiled on the device, but this is what I get:

[04040D07][04040C0C]
DDR Calibration DQS reg = 00008889
                              

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                 
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                 
============================================
Ralink UBoot Version: 4.3.0.0            
--------------------------------------------
ASIC 7628_MP (Port5<->None)              
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                   
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
                                             
 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!      
continue to starting system.                                                                                                                                                                                                    0
disable switch phyport...                                                                                                                                                                                                    
                     
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000             
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040D07][04040C0D]                                                    
DDR Calibration DQS reg = 00008889
                              

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                 
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************
Software System Reset Occurred
******************************

Could you try to compile it and give me the file, to determine if it's my compilation at fault?

Thanks

Sure,building it now

Here are the images
https://drive.google.com/drive/folders/1cwfvu5vIC75FZMgDKSZSJinryHUpV2II?usp=sharing

I would try loading initramfs through U-boot console,that way you can test everything

Thank you. So, right now, the device is searching for the "tp_recovery.bin", when clicking on the reset button, at boot. Should I rename the initramfs to tp_recovery.bin to boot it? If yes, then, what should I do?

No,wrong way.

Connect serial and when you see something keep t pressed,it should go into U-boot console.
There you can type print to see which variables exist.

Then you can provide us with those.

Basically you need to figure out at which point RAM starts so you can tftpboot image into RAM and then simply load it from there.
This way you dont mess with flash.

I would not flash tftp images since those are padded for 840N v4.
Bootloader on 802N v4 may not be the same.

Ok, so here are the variables:

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
MT7628 # print                   
bootcmd=tftp
bootdelay=1
baudrate=115200
ethaddr="00:0A:EB:13:09:69"
ipaddr=192.168.0.2     
serverip=192.168.0.225
stdin=serial      
stdout=serial
stderr=serial
         
Environment size: 152/4092 bytes

And off course they are minimal.
I gotta take a look at u-boot source.

Can you meanwhile tftp flash stock image?

I tried to use tftpboot to boot the binary I got from the vendor (at adress http://static.tp-link.com/TL-WR802N(EU)_V4_170421.zip ), but it seems i'm stuck in a boot loop (to uboot)

MT7628 # tftpboot

 netboot_common, argc= 1 
                         
 NetTxPacket = 0x83FE7700 
                          
 KSEG1ADDR(NetTxPacket) = 0xA3FE7700 
                                     
 NetLoop,call eth_halt ! 
                         
 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)   
                      
 Waitting for RX_DMA_BUSY status Start... done
                                              

 ETH_STATE_ACTIVE!! 
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.0.225; our IP address is 192.168.0.2
Filename 'test.bin'.                                         
                    
 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (2c:41:38:0d:6f:a9)
Got it                                                              
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################                                     
done                                 
Bytes transferred = 8126976 (7c0200 hex)
NetBootFileXferSize= 007c0200           
MT7628 # bootm               
do_bootm:argc=1, addr=0x80100000
## Booting image at 80100000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0D][04040C0C]                                                        
DDR Calibration DQS reg = 00008888
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!!!!!          
continue to starting system.                                                                                                                                                                                                    0 
disable switch phyport...                                                                                                                                                                                                        
                         
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000                 
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0D][04040C0C]                                                        
DDR Calibration DQS reg = 00008888
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!!!!!          
continue to starting system.                                                                                                                                                                                                    0 
disable switch phyport...                                                                                                                                                                                                        
                         
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000                 
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04050C0D][04050C0C]                                                        
DDR Calibration DQS reg = 00008889
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!!!!!          
continue to starting system.                                                                                                                                                                                                    0 
disable switch phyport...                                                                                                                                                                                                        
                         
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000                 
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0D][04040C0C]                                                        
DDR Calibration DQS reg = 00008888
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
��[04040D06][04040C0C]        
DDR Calibration DQS reg = 00008889
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!!!!!          
continue to starting system.                                                                                                                                                                                                    0 
disable switch phyport...                                                                                                                                                                                                        
                         
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000                 
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0F][04040C0C]                                                        
DDR Calibration DQS reg = 00008889
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!!!!!          
continue to starting system.                                                                                                                                                                                                    0 
disable switch phyport...                                                                                                                                                                                                        
                         
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000                 
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0E][04040C0D]                                                        
DDR Calibration DQS reg = 00008889
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!! 0           
TODO, Read MAC Address from Flash
                                 
switch BootType:
                
4: System Enter Boot Command Line Interface.
                                            
U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
MT7628 # printenv                    
bootcmd=tftp
bootdelay=1 
baudrate=115200
ethaddr="00:0A:EB:13:09:69"
ipaddr=192.168.0.2         
serverip=192.168.0.225
stdin=serial          
stdout=serial
stderr=serial
             
Environment size: 152/4092 bytes
MT7628 # ?                      
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
coninfo - print console devices and information           
cp      - memory copy                          
crc32   - checksum calculation
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help                  
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range                 
md      - memory display                
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test                  
nm      - memory modify (constant address)
printenv- print environment variables     
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU                       
rf      - read/write rf register  
saveenv - save environment variables to persistent storage
setenv  - set environment variables                       
spi     - spi command              
tftpboot- boot image via network using TFTP protocol
version - print monitor version

Ok,then you can try tftpboot just to see default memory adress.
Copy it and then use tftpboot memory-adress filename

That will load the image over TFTP to RAM and then you simply bootm memory-adress

Off course,use OpenWRT image

Using tftpboot, I can read that the destination address is 0x80100000. Either copying the data from this adress to 0xbcc020000, or attempting to bootm directly, results in the same boot loop.

MT7628 # bootm 0x80100000    
do_bootm:argc=2, addr=0x80100000
## Booting image at 80100000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

No,you got it wrong.
You need to use tftpboot 0x80100000 image name
to load the image over TFTP
And then you use bootm 0x80100000

Off course,image needs to be initramfs

Here we go.

flash manufacture id: ef, device id 40 17
find flash: W25Q64BV                     
============================================ 
Ralink UBoot Version: 4.3.0.0                
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)                  
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit                       
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:20:28:08
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
                                                 
 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes   
RESET MT7628 PHY!!! 0           
TODO, Read MAC Address from Flash
                                 
switch BootType:
                
4: System Enter Boot Command Line Interface.
                                            
U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
MT7628 # tftpboot 0x80100000 openwrt-ramips-mt76x8-tl-wr802n-v4-initramfs-kernel.bin

 netboot_common, argc= 3 
                         
 NetTxPacket = 0x83FE7700 
                          
 KSEG1ADDR(NetTxPacket) = 0xA3FE7700 
                                     
 NetLoop,call eth_halt ! 
                         
 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)   
                      
 Waitting for RX_DMA_BUSY status Start... done
                                              

 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.0.225; our IP address is 192.168.0.2
Filename 'openwrt-ramips-mt76x8-tl-wr802n-v4-initramfs-kernel.bin'.
                                                                   
 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (2c:41:38:0d:6f:a9)
Got it                                                              
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################                         
done                                             
Bytes transferred = 3531487 (35e2df hex)
NetBootFileXferSize= 0035e2df           
MT7628 # bootm 0x80100000    
do_bootm:argc=2, addr=0x80100000
## Booting image at 80100000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0E][04040C0C]                                                        
DDR Calibration DQS reg = 00008889
                                  

U-Boot 1.1.3 (Apr 21 2017 - 20:28:08)
                                     
Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************    
Software System Reset Occurred
******************************

Btw i'm on IRC (#openwrt @ freenode) if we need some more synchroneous communication mean.

Hm,that error usually happens when that address is not actually correct.
Most likely TP-Link did not bother to change it.
Converted to kbytes it points to 2098176,I am pretty sure the device does not have that much ram.

You can try OpenWRT TFTP image but only if you have backup of the flash,otherwise you risk bricking.

I have a brand new wr802n v4 that boots the stock firmware; I can access a shell on it when it has booted. Maybe I can use it to determine the real addresses ? What do you think?