TP-Link EAP610 v4

lamero · June 1, 2026, 8:19am

I have a TP-Link EAP 610 v4. I'd love to see OpenWrt support. Here's my contribution. Is there anything else I can do? Thanks. I can access it via ttl

/bin $ cat /proc/cpuinfo
system type             : MediaTek MT7621 ver:1 eco:3
machine                 : MediaTek MT7621 RFB (802.11ax,SNOR)
processor               : 0
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 586.13
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0f                                                                                                             fb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
VPE                     : 0

processor               : 1
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 586.13
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0f                                                                                                             fb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
VPE                     : 1

processor               : 2
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 586.13
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0f                                                                                                             fb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VCED exceptions         : not available
VCEI exceptions         : not available
VPE                     : 0

processor               : 3
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 586.13
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0f                                                                                                             fb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VCED exceptions         : not available
VCEI exceptions         : not available
VPE                     : 1



/bin $ cat /proc/mtd
dev:    size   erasesize  name
mtd0: 000a0000 00010000 "u-boot"
mtd1: 00380000 00010000 "os-image"
mtd2: 00b90000 00010000 "rootfs"
mtd3: 00040000 00010000 "oops"
mtd4: 00010000 00010000 "radio"

GPT Help:

Device: TP-Link EAP610 V4

SoC:
MediaTek MT7621 ver:1 eco:3
MIPS 1004Kc V2.15 (2 cores / 4 threads SMT)

Switch:
MediaTek MT7530 rev 1

Wi-Fi:

PCIe 0000:01:00.0 [14c3:7915] (MediaTek MT7915)
PCIe 0000:02:00.0 [14c3:7916] (MediaTek MT7916)
Driver: mt76

Bootloader:
U-Boot 2018.09 (MTK custom build)

Flash:
SPI NOR (~16MB)
MTD layout:

u-boot
os-image
rootfs
oops
radio (calibration data)

Notes:

Full MediaTek reference platform
Wi-Fi calibration stored in "radio" partition
PCIe-based dual radio Wi-Fi (mt7915 + mt7916)
MT7530 integrated switch

Status:
Hardware fully identified, ready for OpenWrt DTS creation

Gui13 · June 1, 2026, 11:47am

I have the same, and I was also able to login to the SSH busybox.

I could also run DMESG on it:

See the DMESG

/bin $ dmesg
[    0.000000] Linux version 4.4.198 (tplink@sohoiapbuild) (gcc version 5.4.0 (LEDE GCC 5.4.0 unknown) ) #1 SMP Wed May 7 18:15:50 CST 2025
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is MediaTek MT7621 RFB (802.11ax,SNOR)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x0000000000ffffff]
[    0.000000]   Normal   [mem 0x0000000001000000-0x000000000fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] On node 0 totalpages: 65536
[    0.000000] free_area_init_node: node 0, pgdat 818e1780, node_mem_map 81992000
[    0.000000]   DMA zone: 32 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 4096 pages, LIFO batch:0
[    0.000000]   Normal zone: 480 pages used for memmap
[    0.000000]   Normal zone: 61440 pages, LIFO batch:15
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 10 pages/cpu @81ba1000 s8544 r8192 d24224 u40960
[    0.000000] pcpu-alloc: s8544 r8192 d24224 u40960 alloc=10*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 249860K/262144K available (7334K kernel code, 282K rwdata, 1680K rodata, 228K init, 255K bss, 12284K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000008] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.007775] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.070393] pid_max: default: 32768 minimum: 301
[    0.075101] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.081625] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    4.950117] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    4.950126] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    4.950136] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    4.950275] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.177388] Synchronize counters for CPU 1: done.
[    4.727352] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    4.727359] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    4.727365] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    4.727435] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.267724] Synchronize counters for CPU 2: done.
[    4.817450] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    4.817456] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    4.817462] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    4.817545] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.352901] Synchronize counters for CPU 3: done.
[    0.357637] Brought up 4 CPUs
[    0.365142] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.374944] futex hash table entries: 1024 (order: 3, 32768 bytes)
[    0.381220] pinctrl core: initialized pinctrl subsystem
[    0.387231] NET: Registered protocol family 16
[    0.399540] tpwdt init ok
[    0.402232] FPU Affinity set after 11720 emulations
[    0.426740] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.432394] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.437988] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.444069] mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe1
[    0.450184] mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe2
[    0.656646] PCIe port 2 link down
[    0.659878] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    0.709349] PCI host bridge to bus 0000:00
[    0.713383] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    0.720265] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    0.727034] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.733795] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.741677] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    0.741728] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.741791] pci 0000:00:00.0: supports D1
[    0.741804] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.742052] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    0.742114] pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.742185] pci 0000:00:01.0: supports D1
[    0.742199] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    0.742454] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.750403] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.758489] pci 0000:01:00.0: [14c3:7916] type 00 class 0x000280
[    0.758586] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    0.758634] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    0.758670] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    0.758780] pci 0000:01:00.0: supports D1 D2
[    0.758793] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.759001] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.759229] pci 0000:02:00.0: [14c3:7915] type 00 class 0x000280
[    0.759323] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    0.759368] pci 0000:02:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    0.759402] pci 0000:02:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    0.759508] pci 0000:02:00.0: supports D1 D2
[    0.759521] pci 0000:02:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.759734] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    0.759766] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 02
[    0.759861] pci 0000:00:00.0: BAR 9: assigned [mem 0x60000000-0x601fffff pref]
[    0.767022] pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x603fffff pref]
[    0.774145] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    0.780913] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    0.787640] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit pref]
[    0.795355] pci 0000:01:00.0: BAR 2: assigned [mem 0x60100000-0x60103fff 64bit pref]
[    0.803027] pci 0000:01:00.0: BAR 4: assigned [mem 0x60104000-0x60104fff 64bit pref]
[    0.810724] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.815621] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x601fffff pref]
[    0.822814] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit pref]
[    0.830508] pci 0000:02:00.0: BAR 2: assigned [mem 0x60300000-0x60303fff 64bit pref]
[    0.838203] pci 0000:02:00.0: BAR 4: assigned [mem 0x60304000-0x60304fff 64bit pref]
[    0.845871] pci 0000:00:01.0: PCI bridge to [bus 02]
[    0.850801] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x603fffff pref]
[    0.859598] clocksource: Switched to clocksource GIC
[    0.866461] NET: Registered protocol family 2
[    0.871396] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.878281] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.884724] TCP: Hash tables configured (established 2048 bind 2048)
[    0.891084] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.896830] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.903368] NET: Registered protocol family 1
[    0.907713] PCI: CLS 80 bytes, default 32
[    0.919310] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.925138] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.937565] io scheduler noop registered
[    0.941525] io scheduler deadline registered (default)
[    0.948015] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.955595] console [ttyS0] disabled
[    0.959135] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 33, base_baud = 3125000) is a 16550A
[    0.968135] console [ttyS0] enabled
[    0.975037] bootconsole [early0] disabled
[    0.983518] 1e000d00.uartfull: ttyS1 at MMIO 0x1e000d00 (irq = 34, base_baud = 3125000) is a 16550A
[    0.993051] 1e000e00.uartfull: ttyS2 at MMIO 0x1e000e00 (irq = 35, base_baud = 3125000) is a 16550A
[    1.003864] ipq_flash_chrdev_init() 736:      register flash_chrdev ok
[    1.010103] ipq_get_mtd() 277: Cannot find device of spi32766.0
[    1.016019] ipq_get_mtd Can not open mtd!
[    1.021251] m25p80 spi32766.0: xm25qh128c (16384 Kbytes)


[    1.026612] 5 ofpart partitions found on MTD device spi32766.0
[    1.032475] Creating 5 MTD partitions on "spi32766.0":
[    1.037621] 0x000000000000-0x0000000a0000 : "u-boot"
[    1.043897] 0x0000000a0000-0x000000420000 : "os-image"
[    1.050195] 0x000000420000-0x000000fb0000 : "rootfs"
[    1.056242] mtd: device 2 (rootfs) set to be root filesystem
[    1.061977] 0x000000fb0000-0x000000ff0000 : "oops"
[    1.067994] 0x000000ff0000-0x000001000000 : "radio"
[    1.074705] libphy: Fixed MDIO Bus: probed
[    1.139871] libphy: mdio: probed
[    1.143639] mtk_soc_eth 1e100000.ethernet: generated random MAC address 82:a1:70:8b:56:e6
[    1.152326] mtk_soc_eth 1e100000.ethernet: connected mac 0 to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.163521] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 10
[    1.171979] mtk_soc_eth 1e100000.ethernet: generated random MAC address ae:d9:2c:b4:e9:92
[    1.180702] mtk_soc_eth 1e100000.ethernet: connected mac 1 to PHY at fixed-0:01 [uid=00000000, driver=Generic PHY]
[    1.191884] mtk_soc_eth 1e100000.ethernet eth1: mediatek frame engine at 0xbe100000, irq 10
[    1.201012] register mt_drv
[    1.203991] <--mt7916_hif_init()
[    1.207225] pci_data_init: DATA RxRing[0] use DYNAMIC_SLAB_ALLOC buf type
[    1.214552] Rx[0] Ring: total 24576 bytes allocated
[    1.223875] Rx[1] Ring: total 16384 bytes allocated
[    1.228858] <-- pci_alloc_tx_rx_ring_mem, Status=0
[    1.267199] 
[    1.267199] 
[    1.267199] === pAd = c0301000, size = 13798080 ===
[    1.267199] 
[    1.278269] <-- RTMPAllocAdapterBlock, Status=0
[    1.282854] PCI CSRBaseAddress =0xc0200000, csr_addr=0xc0200000!
[    1.288867] RTMPInitPCIeDevice():device_id=0x7915
[    1.293587] mt7915_init()-->
[    1.296466] Use the default iPAiLNA bin image!
[    1.300994] <--mt7915_init()
[    1.306618] RtmpOSFileOpen(): Error 2 opening /tmp/wireless/l1profile.dat
[    1.315382] wdev_init(caller:RTMP_COM_IoctlHandle+0x360/0x193c), wdev(0)
[    1.322144] pci_data_init: DATA RxRing[0] use DYNAMIC_SLAB_ALLOC buf type
[    1.328929] pci_data_init: DATA RxRing[1] use DYNAMIC_SLAB_ALLOC buf type
[    1.336619] Rx[0] Ring: total 24576 bytes allocated
[    1.341746] Rx[1] Ring: total 24576 bytes allocated
[    1.348898] Rx[2] Ring: total 8192 bytes allocated
[    1.357966] Rx[3] Ring: total 16384 bytes allocated
[    1.365134] Rx[4] Ring: total 8192 bytes allocated
[    1.370021] <-- pci_alloc_tx_rx_ring_mem, Status=0
[    1.375721] 
[    1.377309] ****************************************************
[    1.383421]                   tp mesh netlink init              
[    1.389510] ****************************************************
[    1.396689] mt7621_wdt 1e000100.wdt: Initialized
[    1.403177] NET: Registered protocol family 10
[    1.409106] NET: Registered protocol family 17
[    1.413677] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.426308] 8021q: 802.1Q VLAN Support v1.8
[    1.469737] mt753x gsw: Switch is MediaTek MT7530 rev 1
[    1.496457] libphy: mt753x_mdio: probed
[    1.508894] hctosys: unable to open rtc device (rtc0)
[    1.520437] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.528151] Freeing unused kernel memory: 228K
[    1.532649] This architecture does not have kernel memory protection.
[    1.941430] Starting init: /sbin/init couldn't execute it (error 0)
[    3.105248] mtdoops: ready 0, 1 (no erase)
[    3.105274] mtdoops: Attached to MTD device 3
[    3.542691] xt_time: kernel timezone is -0000
[    3.897935] nf_conntrack version 0.5.0 (3907 buckets, 15628 max)
[    4.281315] mt753x gsw: Port 0 Link is Up - 1Gbps/Full
[    4.876283] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.188329] Ebtables v2.0 registered
[    5.252640] ---utility module open ok
[    5.374560] ---tls tuple module open ok
[    5.510254] ---portal module open ok
[    5.560174] ---multiPort module open ok
[    5.615404] 
[    5.615404] Register vlan_manage hooks success.
[    5.773548] [Debug gpio_parse_conf:322] Open File /etc/EAP610_4.0/gpio.conf SUCCESS!!
[    5.832547] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 14, readCount 256
[    5.840228] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 44, readCount 256
[    5.847798] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 6 , readCount 256
[    5.855412] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 7 , readCount 256
[    5.863009] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 2 , readCount 256
[    5.870603] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 7 , readCount 256
[    5.878173] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 44, readCount 256
[    5.885763] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 6 , readCount 256
[    5.893355] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 7 , readCount 256
[    5.900946] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 2 , readCount 256
[    5.908516] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 7 , readCount 256
[    5.916117] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 44, readCount 252
[    5.923713] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 7 , readCount 208
[    5.931313] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 6 , readCount 201
[    5.938884] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 6 , readCount 195
[    5.946475] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 6 , readCount 189
[    5.954068] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 2 , readCount 183
[    5.961662] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 51, readCount 181
[    5.969232] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 44, readCount 130
[    5.976843] [Debug gpio_parse_conf:408] GPIO Parse OK:  led_sys     led(1) high(1) high(1) 7
[    5.985313] [Debug gpio_parse_conf:408] GPIO Parse OK:  btn_reset   btn(2) low (0) high(1) 8
[    5.993775] [Debug gpio_parse_conf:353] Ignore line (0), skipLen 1 , readCount 1
[    6.001256] [Debug btn_netlink_init:179] btn: create netlink socket SUCCESS.
[    6.008449] [Debug _btn_parse_conf:796] Open File /etc/EAP610_4.0/dev_config.json SUCCESS!!
[    6.016976] [Debug _btn_parse_conf:870] l_ledBtnResetSupp=0 ledBtnResetAHwVer=0
[    6.024316] [Debug wdt_module_init:255] Create watchdog proc dir SUCCESS.
[    6.031169] [Debug led_entry_handler:872] Create led_sys     proc dir SUCCESS.
[    6.038741] [Debug btn_entry_handler:1343] Init button: btn_reset 2 8 0 success.
[    6.101735] rate_limit: module license 'BSD' taints kernel.
[    6.107327] Disabling lock debugging due to kernel taint
[    6.224104] tp sniffer module init success
[    6.484621] [Debug btn_netlink_receive:72] BTN netlink with user space daemon 492 SUCCESS.
[    6.584918] random: nonblocking pool is initialized
[    7.421409] <tp_sniffer>[debug]tpsniffer_upload_lan_proc_write(): 1208       -> set l_uplink_lan.lan_name eth0 l_uplink_lan.lan_name_len:4
[    7.421409] 
[    8.540834] [_addi_hwver_write_proc:1166]: set l_cur_addiHwVer 0002
[    8.827944] device eth0 entered promiscuous mode
[    8.859253] br0: port 1(eth0) entered forwarding state
[    8.859327] br0: port 1(eth0) entered forwarding state
[   10.890912] 
[   10.890912] Disable VlanManage, data.enable(0), data.vid(1)
[   10.898619] get xm device id 0x20 0x40 0x18
[   11.206782] 
[   11.206782] manage vlan set port: ssh (22), http (80), https (443)
[   11.223163] 
[   11.223163] manage vlan set port: ssh (22), http (80), https (443)
[   11.273741] get xm device id 0x20 0x40 0x18
[   18.132745] ra0: ===> main_virtual_if_open
[   18.136867] RTMP_COM_IoctlHandle -> CMD_RTPRIV_IOCTL_VIRTUAL_INF_INIT
[   18.150056] load l1profile succeed!
[   18.153597] mt_service_open: wlan service opens successfully!
[   19.071214] [multi_profile_merge_5g_only] DBDC_MODE=1
[   19.202414] multi-profile merge success, en:1,pf1_num:8,pf2_num:9,total:17
[   19.209307] Open file "/tmp/wireless/DBDC_card0.dat" to store DBDC cfg! (14)
[   19.216791] Write file "/tmp/wireless/DBDC_card0.dat" success (size=24557)!
[   19.226032] BssidNum=17
[   19.228480] Pf2MbssIdxMap:
[   19.231203]  0  1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 
[   19.246744] MacAddress8 = 00:00:00:00:00:00
[   19.309360] UpdateBeaconHandler, wdev(0) bss not ready (state:0, caller:TP_ROAMING_ReadParametersFromFile+0x10c/0x37c)!!
[   19.321517] E2pAccessMode=2
[   19.326440] SSID[0]=Unifi, EdcaIdx=0
[   19.330590] SSID[1]=, EdcaIdx=0
[   19.334380] SSID[2]=, EdcaIdx=0
[   19.338068] SSID[3]=, EdcaIdx=0
[   19.341794] SSID[4]=, EdcaIdx=0
[   19.345487] SSID[5]=, EdcaIdx=0
[   19.349174] SSID[6]=, EdcaIdx=0
[   19.353000] SSID[7]=, EdcaIdx=0
[   19.356834] SSID[8]=Unifi, EdcaIdx=0
[   19.361115] SSID[9]=, EdcaIdx=0
[   19.364932] SSID[10]=, EdcaIdx=0
[   19.368833] SSID[11]=, EdcaIdx=0
[   19.372856] SSID[12]=, EdcaIdx=0
[   19.376764] SSID[13]=, EdcaIdx=0
[   19.380756] SSID[14]=, EdcaIdx=0
[   19.384694] SSID[15]=, EdcaIdx=0
[   19.388597] SSID[16]=, EdcaIdx=0
[   19.393436] RTMPSetProfileParameters(): DBDC Mode=1, eDBDC_mode = 1
[   19.402486] cfg_mode=16
[   19.404937] cfg_mode=16
[   19.407378] cfg_mode=16
[   19.409852] wmode_band_equal(): Band Equal!
[   19.414037] cfg_mode=16
[   19.416477] cfg_mode=16
[   19.418918] cfg_mode=16
[   19.421372] cfg_mode=16
[   19.423815] cfg_mode=16
[   19.426255] cfg_mode=16
[   19.428695] cfg_mode=16
[   19.431150] cfg_mode=16
[   19.433592] cfg_mode=16
[   19.436032] cfg_mode=16
[   19.438472] cfg_mode=16
[   19.440926] cfg_mode=16
[   19.443369] cfg_mode=16
[   19.445808] cfg_mode=16
[   19.448248] cfg_mode=16
[   19.450705] cfg_mode=17
[   19.453151] cfg_mode=17
[   19.455591] cfg_mode=17
[   19.458031] cfg_mode=17
[   19.460486] cfg_mode=17
[   19.462928] cfg_mode=17
[   19.465368] cfg_mode=17
[   19.467808] cfg_mode=17
[   19.470262] cfg_mode=17
[   19.472704] cfg_mode=17
[   19.475144] cfg_mode=17
[   19.477584] cfg_mode=17
[   19.480039] cfg_mode=17
[   19.482481] cfg_mode=17
[   19.484921] cfg_mode=17
[   19.487360] cfg_mode=17
[   19.489814] cfg_mode=17
[   19.492256] cfg_mode=17
[   19.496647] auto_ch_select_set_cfg(): BandIdx0, AutoChannelAtBootup=1, AutoChannelAlg = 3
[   19.504844] auto_ch_select_set_cfg(): BandIdx1, AutoChannelAtBootup=1, AutoChannelAlg = 3
[   19.514422] Index0 Channel=0
[   19.517305] Index1 Channel=0
[   19.527716] [TxPower] BAND0: 100, BAND1: 100
[   19.550476] [SKUenable] BAND0: 1, BAND1: 1
[   19.555132] [SkuTableIdx]: 0
[   19.558688] [CCKTxStream] BAND0: 4, BAND1: 0
[   19.564025] [PERCENTAGEenable] BAND0: 0, BAND1: 0
[   19.569802] [BFBACKOFFenable] BAND0: 1, BAND1: 1
[   19.575401] [Disable160RuMu] BAND0: 1, BAND1: 1
[   19.580947] [MaxRuOfdma] BAND0: 8, BAND1: 8
[   19.586180] [MaxDLMuMimo] BAND0: 2, BAND1: 2
[   19.591462] [MaxULMuMimo] BAND0: 2, BAND1: 2
[ MANY DEBUG MESSAGES]
[   23.316661] fw_prepare():using E2 ROM patch
[   23.320859] fw_prepare():using E2 RAM
[   23.403744] Parsing patch header
[   23.406997]  Built date: 20230330182132a
[   23.411016] 
[   23.412503]  Platform: ALPS
[   23.415306]  HW/SW version: 0x8a108a10
[   23.419075]  Patch version: 0xffffffff
[   23.422859]  Section num: 0x2, subsys: 0x4
[   23.426956]  Section 0: type = 0x30002, offset = 0xe0, size = 0xfc90
[   23.433317]  Target address: 0x200000, length: 0xfc90
[   23.438367]  Section 1: type = 0x30002, offset = 0xfd70, size = 0x13790
[   23.444987]  Target address: 0xe000f000, length: 0x13790
[   23.450492] Patch SEM Status = 2
[   23.453758] patch is not ready && get semaphore success
[   23.458982] Start address = 0x200000, DL length = 64656, Data mode = 0x80000000
[   23.467493] EventGenericEventHandler: CMD Success
[   23.472265] MtCmdAddressLenReq:(ret = 0)
[   23.476969] Start address = 0xe000f000, DL length = 79760, Data mode = 0x80000000
[   23.485678] EventGenericEventHandler: CMD Success
[   23.490453] MtCmdAddressLenReq:(ret = 0)
[   23.495226] MtCmdPatchFinishReq
[   23.502172] EventGenericEventHandler: CMD Success
[   23.507068] Patch SEM Status = 3
[   23.510348] release patch semaphore
[   24.010413] Parsing CPU 0 fw tailer
[   24.013921]  Chip ID: 0x0b
[   24.016636]  Eco version: 0x01
[   24.019735]  Region number: 0x07
[   24.022970]  Format version: 0x02
[   24.026289]  Format flag: 0x01
[   24.029348]  Ram version: ____000000
[   24.032976]  Built date: 20230330182209
[   24.036861]  Common crc: 0x9b939c43
[   24.040365] Parsing tailer region 0
[   24.043850]  Decomp crc: 0x0
[   24.046724]  Decomp size: 0x0
[   24.049773]  Decomp block size: 0x0
[   24.053260]  Target address: 0x21fc00
[   24.056915]  Download size: 110592
[   24.060328]  Feature set: 0x20
[   24.063393] Parsing tailer region 1
[   24.066875]  Decomp crc: 0x0
[   24.069766]  Decomp size: 0x0
[   24.072729]  Decomp block size: 0x0
[   24.076211]  Target address: 0x31dc00
[   24.079883]  Download size: 205824
[   24.083279]  Feature set: 0x00
[   24.086366] Parsing tailer region 2
[   24.089868]  Decomp crc: 0x0
[   24.092745]  Decomp size: 0x0
[   24.095705]  Decomp block size: 0x0
[   24.099187]  Target address: 0x417400
[   24.102866]  Download size: 31744
[   24.106176]  Feature set: 0x00
[   24.109237] Parsing tailer region 3
[   24.112736]  Decomp crc: 0x0
[   24.115613]  Decomp size: 0x0
[   24.118574]  Decomp block size: 0x0
[   24.122086]  Target address: 0xe0022800
[   24.125918]  Download size: 411136
[   24.129311]  Feature set: 0x00
[   24.132393] Parsing tailer region 4
[   24.135876]  Decomp crc: 0x0
[   24.138750]  Decomp size: 0x0
[   24.141728]  Decomp block size: 0x0
[   24.145213]  Target address: 0xe0086e00
[   24.149042]  Download size: 332288
[   24.152452]  Feature set: 0x00
[   24.155515] Parsing tailer region 5
[   24.158998]  Decomp crc: 0x0
[   24.161890]  Decomp size: 0x0
[   24.164853]  Decomp block size: 0x0
[   24.168335]  Target address: 0x23ac00
[   24.172008]  Download size: 87040
[   24.175317]  Feature set: 0x00
[   24.178377] Parsing tailer region 6
[   24.181877]  Decomp crc: 0x0
[   24.184754]  Decomp size: 0x0
[   24.187714]  Decomp block size: 0x0
[   24.191213]  Target address: 0x400000
[   24.194871]  Download size: 81920
[   24.198178]  Feature set: 0x00
[   24.201257]  Release info: header tag = 0, total length = 0
[   24.206832] Start address = 0x21fc00, DL length = 110592, Data mode = 0x80000000
[   24.215477] EventGenericEventHandler: CMD Success
[   24.220279] MtCmdAddressLenReq:(ret = 0)
[   24.225441] Start address = 0x31dc00, DL length = 205824, Data mode = 0x80000000
[   24.234095] EventGenericEventHandler: CMD Success
[   24.238838] MtCmdAddressLenReq:(ret = 0)
[   24.245217] Start address = 0x417400, DL length = 31744, Data mode = 0x80000000
[   24.253980] EventGenericEventHandler: CMD Success
[   24.258722] MtCmdAddressLenReq:(ret = 0)
[   24.263078] Start address = 0xe0022800, DL length = 411136, Data mode = 0x80000000
[   24.271889] EventGenericEventHandler: CMD Success
[   24.276622] MtCmdAddressLenReq:(ret = 0)
[   24.285403] Start address = 0xe0086e00, DL length = 332288, Data mode = 0x80000000
[   24.294421] EventGenericEventHandler: CMD Success
[   24.299188] MtCmdAddressLenReq:(ret = 0)
[   24.307056] Start address = 0x23ac00, DL length = 87040, Data mode = 0x80000000
[   24.315688] EventGenericEventHandler: CMD Success
[   24.320481] MtCmdAddressLenReq:(ret = 0)
[   24.325423] Start address = 0x400000, DL length = 81920, Data mode = 0x80000000
[   24.334002] EventGenericEventHandler: CMD Success
[   24.338739] MtCmdAddressLenReq:(ret = 0)
[   24.343702] MtCmdFwStartReq: override = 0x1, address = 0x21fc00
[   24.350874] EventGenericEventHandler: CMD Success
[   24.405426] Parsing CPU 1 fw tailer
[   24.408934]  Chip ID: 0x00
[   24.411710]  Eco version: 0x01
[   24.414771]  Region number: 0x03
[   24.418004]  Format version: 0x02
[   24.421358]  Format flag: 0x01
[   24.424418]  Ram version: DEV_000000
[   24.428026]  Built date: 20230613145145
[   24.431936]  Common crc: 0x15a77830
[   24.435425] Parsing tailer region 0
[   24.438906]  Decomp crc: 0x0
[   24.441807]  Decomp size: 0x0
[   24.444772]  Decomp block size: 0x0
[   24.448254]  Target address: 0x10200000
[   24.452111]  Download size: 88480
[   24.455421]  Feature set: 0x00
[   24.458482] Parsing tailer region 1
[   24.461988]  Decomp crc: 0x0
[   24.464865]  Decomp size: 0x0
[   24.467826]  Decomp block size: 0x0
[   24.471332]  Target address: 0x10300000
[   24.475164]  Download size: 18976
[   24.478471]  Feature set: 0x00
[   24.481556] Parsing tailer region 2
[   24.485040]  Decomp crc: 0x0
[   24.487914]  Decomp size: 0x0
[   24.490909]  Decomp block size: 0x0
[   24.494394]  Target address: 0xe0000000
[   24.498223]  Download size: 8656
[   24.501465]  Feature set: 0x00
[   24.504529]  Release info: header tag = 0, total length = 0
[   24.510131] Start address = 0x10200000, DL length = 88480, Data mode = 0x80000010
[   24.518911] EventGenericEventHandler: CMD Success
[   24.523694] MtCmdAddressLenReq:(ret = 0)
[   24.528588] Start address = 0x10300000, DL length = 18976, Data mode = 0x80000010
[   24.537378] EventGenericEventHandler: CMD Success
[   24.542148] MtCmdAddressLenReq:(ret = 0)
[   24.546296] Start address = 0xe0000000, DL length = 8656, Data mode = 0x80000010
[   24.554942] EventGenericEventHandler: CMD Success
[   24.559706] MtCmdAddressLenReq:(ret = 0)
[   24.563730] MtCmdFwStartReq: override = 0x4, address = 0x0
[   24.669492] EventGenericEventHandler: CMD Success
[   24.674390] MCU Init Done!
[   24.677109] efuse_probe: efuse = 10000012
[   24.681139] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
[   24.686535] RtmpEepromGetDefault::e2p_dafault=1
[   24.691080] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
[   24.698662] NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x0]
[   24.704433]

rtmp_nv_init(): EEPROM Size[65536]


[   24.765303]

[EEPROMImage - PreCalImageInfo - PreCalImage - TxDPDImage]


[   24.765303]

[0x80410000 - 0x80410e00 - 0x80410e10 - 0x8041d220]


[   24.779146] validFlashEepromID(): eeFlashId=7915, pAd->ChipID=7915
[   24.786144]

[d-die version:1]


[   24.823684]

[a-die version:2]


[   24.955531] 
[   24.957040]

NICReadEEPROMParameters: EEPROM 0x62 0


[   30.248378] Country Region from e2p = 0
[   30.252264] antenna_default_reset() todo
[   30.256188] antenna_default_reset() value = 0x5292, TxPath = 2, RxPath = 2
[   30.263080] RTMPReadTxPwrPerRate(458): Don't Support this now!
[   30.268916] rc_radio_init(): DBDC MODE=1, ConcurrentBand=2
[   30.274425] rc_radio_init(): radio_ctrl=8eb4d638,Band=0,rfcap=3,channel=1,PhyMode=2 extCha=0xf
[   30.283058] rc_radio_init(): radio_ctrl=8eb4d990,Band=1,rfcap=3,channel=1,PhyMode=2 extCha=0xf

Some interesting informations:

Linux version 4.4.198 (tplink@sohoiapbuild) (gcc version 5.4.0 (LEDE GCC 5.4.0 unknown) )

I could see that there is 256MB of RAM, and it looks like a lot of debugging output in the kernel logs.

GPIO config for the buttons & leds are here:

/bin $ cat /etc/EAP610_4.0/gpio.conf 
[snip]
;proc_name      type    active   init   gpio      
;==========================================
led_sys         led     high     high    7
btn_reset       btn     low      high   8

There's plenty of files in the /etc/EAP610_4.0 folder:

/bin $ ls -R /etc/EAP610_4.0/
/etc/EAP610_4.0/:
app_cluster_features.json  ath                        dev_config.json            gpio.conf                  oem.json                   wireless
app_features.json          default_config             factory_config.bin         gpo_rule.conf              radio_config.json

/etc/EAP610_4.0/ath:
REG_DOMAIN2  REG_DOMAIN5

/etc/EAP610_4.0/wireless:
l1profile.dat          mt5g.dat               mt7905_FCC_sku.dat     mt7905_IC_sku_bf.dat   mt7905_RU_sku.dat      multi_radius2g.dat
locktoAP.dat           mt7905_CE_sku.dat      mt7905_FCC_sku_bf.dat  mt7905_MKK_sku.dat     mt7905_RU_sku_bf.dat   multi_radius5g.dat
mt2g.dat               mt7905_CE_sku_bf.dat   mt7905_IC_sku.dat      mt7905_MKK_sku_bf.dat  mt7905_eeprom.bin

lamero · June 2, 2026, 7:38pm

Can I post other useful infos? Can be the v4 added in some way? Thanks

frollic · June 2, 2026, 7:50pm

lamero · June 3, 2026, 9:42am

@svanheule Can you help us?

svanheule · June 3, 2026, 5:34pm

I've had a look at TP-Link's vendor images and there's good news and bad news.

The good news is that v1.6.0 is a safeloader image which supports both the EAP610 (v4, v3) and EAP613 (v2, v1). v1.8.0 is similar, but doesn't contain the SupportList section, so this might be a different version of the safeloader format.

v1.8.1 is where the trouble starts, as this file now seems to be encrypted. I don't know if other TP-Link devices already do this, and whether OpenWrt supports these images.

If you are able to solder the console header for debugging, you can try out the existing images for EAP613v1. I would suggest to first try an initramfs image loaded via the bootloader console, so you know you can recover the device in case you try flasing a (factory) image and that somehow bricks the device.

svanheule · June 3, 2026, 5:50pm

Found a bit more info with the FCC:

Model No.: EAP610, EAP613
Model Difference: It's exactly the same except that the EAP610 will be sold with a power adapter, which the EAP613 will not

So barring any issues with the image format, I don't think getting OpenWrt running should prove to be very difficult.

lamero · June 3, 2026, 8:13pm

[    0.000000] Linux version 6.12.74 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32802-f505120278) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Wed Mar 25 20:09:53 2026
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: legacy bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is TP-Link EAP613 v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[    0.000000] percpu: Embedded 13 pages/cpu s22896 r8192 d22160 u53248
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=00012184
[    0.000000] Readback ErrCtl register=00012184
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65536
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] NR_IRQS: 256
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000005] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 4398046511103ns
[    0.008054] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.066148] pid_max: default: 32768 minimum: 301
[    0.080868] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088085] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.106303] rcu: Hierarchical SRCU implementation.
[    0.111033] rcu:     Max phase no-delay instances is 1000.
[    0.116767] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.125542] smp: Bringing up secondary CPUs ...
[    0.131086] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.131122] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.131140] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.131190] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.192598] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.192627] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.192641] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.192675] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.252576] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.252604] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.252618] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.252654] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.311721] smp: Brought up 1 node, 4 CPUs
[    0.392331] Memory: 241452K/262144K available (8750K kernel code, 653K rwdata, 1092K rodata, 5620K init, 236K bss, 19176K reserved, 0K cma-reserved)
[    0.412011] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.421837] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.434439] pinctrl core: initialized pinctrl subsystem
[    0.442746] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.449395] thermal_sys: Registered thermal governor 'step_wise'
[    0.452045] /pinctrl: Fixed dependency cycle(s) with /pinctrl/pinctrl0
[    0.484755] clocksource: Switched to clocksource GIC
[    0.499694] NET: Registered PF_INET protocol family
[    0.504825] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.513769] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.522132] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.529851] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.537513] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.544749] TCP: Hash tables configured (established 2048 bind 2048)
[    0.552042] MPTCP token hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.559609] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.566119] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.574040] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.579765] PCI: CLS 0 bytes, default 32
[    0.587639] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.596455] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.602208] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.617104] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    1.114449] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.120716] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.127122] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.133609] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    1.140399] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    1.149260] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0060000000
[    1.157411] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    1.514760] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    1.521685] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    1.526539] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    1.531632] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    1.538871] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    1.545192] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.550594] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.557443] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.563705] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400 PCIe Root Port
[    1.570959] pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x7fffffff]
[    1.576838] pci 0000:00:00.0: BAR 1 [mem 0x00000000-0x0000ffff]
[    1.582669] pci 0000:00:00.0: PCI bridge to [bus 00]
[    1.587619] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.593639] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff]
[    1.600409] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    1.607643] pci 0000:00:00.0: supports D1
[    1.611566] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.618160] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400 PCIe Root Port
[    1.625462] pci 0000:00:01.0: BAR 0 [mem 0x00000000-0x7fffffff]
[    1.631301] pci 0000:00:01.0: BAR 1 [mem 0x00000000-0x0000ffff]
[    1.637357] pci 0000:00:01.0: PCI bridge to [bus 00]
[    1.642290] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.648414] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff]
[    1.655220] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    1.662453] pci 0000:00:01.0: supports D1
[    1.666423] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.674243] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.682213] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.690441] pci 0000:01:00.0: [14c3:7916] type 00 class 0x000280 PCIe Endpoint
[    1.697660] pci 0000:01:00.0: BAR 0 [mem 0x00000000-0x000fffff 64bit pref]
[    1.704462] pci 0000:01:00.0: BAR 2 [mem 0x00000000-0x00003fff 64bit pref]
[    1.711322] pci 0000:01:00.0: BAR 4 [mem 0x00000000-0x00000fff 64bit pref]
[    1.718288] pci 0000:01:00.0: supports D1 D2
[    1.722475] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.729120] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.744310] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.749536] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.756459] pci 0000:02:00.0: [14c3:7915] type 00 class 0x000280 PCIe Endpoint
[    1.763648] pci 0000:02:00.0: BAR 0 [mem 0x00000000-0x000fffff 64bit pref]
[    1.770479] pci 0000:02:00.0: BAR 2 [mem 0x00000000-0x00003fff 64bit pref]
[    1.777300] pci 0000:02:00.0: BAR 4 [mem 0x00000000-0x00000fff 64bit pref]
[    1.784227] pci 0000:02:00.0: supports D1 D2
[    1.788427] pci 0000:02:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.795043] pci 0000:02:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.810300] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    1.815528] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    1.822153] pci 0000:00:00.0: BAR 0 [mem size 0x80000000]: can't assign; no space
[    1.829557] pci 0000:00:00.0: BAR 0 [mem size 0x80000000]: failed to assign
[    1.836476] pci 0000:00:01.0: BAR 0 [mem size 0x80000000]: can't assign; no space
[    1.843875] pci 0000:00:01.0: BAR 0 [mem size 0x80000000]: failed to assign
[    1.850828] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff]: assigned
[    1.858247] pci 0000:00:00.0: bridge window [mem 0x60100000-0x602fffff pref]: assigned
[    1.866105] pci 0000:00:01.0: bridge window [mem 0x60300000-0x603fffff]: assigned
[    1.873512] pci 0000:00:01.0: bridge window [mem 0x60400000-0x605fffff pref]: assigned
[    1.881415] pci 0000:00:00.0: BAR 1 [mem 0x60600000-0x6060ffff]: assigned
[    1.888146] pci 0000:00:01.0: BAR 1 [mem 0x60610000-0x6061ffff]: assigned
[    1.894884] pci 0000:00:00.0: bridge window [io  0x0000-0x0fff]: assigned
[    1.901592] pci 0000:00:01.0: bridge window [io  0x1000-0x1fff]: assigned
[    1.908382] pci 0000:01:00.0: BAR 0 [mem 0x60100000-0x601fffff 64bit pref]: assigned
[    1.916068] pci 0000:01:00.0: BAR 2 [mem 0x60200000-0x60203fff 64bit pref]: assigned
[    1.923727] pci 0000:01:00.0: BAR 4 [mem 0x60204000-0x60204fff 64bit pref]: assigned
[    1.931445] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.936366] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.942380] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.949145] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x602fffff pref]
[    1.956336] pci 0000:02:00.0: BAR 0 [mem 0x60400000-0x604fffff 64bit pref]: assigned
[    1.964011] pci 0000:02:00.0: BAR 2 [mem 0x60500000-0x60503fff 64bit pref]: assigned
[    1.971794] pci 0000:02:00.0: BAR 4 [mem 0x60504000-0x60504fff 64bit pref]: assigned
[    1.979509] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.984391] pci 0000:00:01.0:   bridge window [io  0x1000-0x1fff]
[    1.990471] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff]
[    1.997212] pci 0000:00:01.0:   bridge window [mem 0x60400000-0x605fffff pref]
[    2.004351] pci_bus 0000:00: Some PCI device resources are unassigned, try booting with pci=realloc
[    2.013360] pci_bus 0000:00: resource 4 [mem 0x60000000-0x6fffffff]
[    2.019578] pci_bus 0000:00: resource 5 [io  0x0000-0xffff]
[    2.025111] pci_bus 0000:01: resource 0 [io  0x0000-0x0fff]
[    2.030612] pci_bus 0000:01: resource 1 [mem 0x60000000-0x600fffff]
[    2.036859] pci_bus 0000:01: resource 2 [mem 0x60100000-0x602fffff pref]
[    2.043487] pci_bus 0000:02: resource 0 [io  0x1000-0x1fff]
[    2.049040] pci_bus 0000:02: resource 1 [mem 0x60300000-0x603fffff]
[    2.055270] pci_bus 0000:02: resource 2 [mem 0x60400000-0x605fffff pref]
[    2.064413] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    2.079199] printk: legacy console [ttyS0] disabled
[    2.085026] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 18, base_baud = 3125000) is a 16550A
[    2.094071] printk: legacy console [ttyS0] enabled
[    2.094071] printk: legacy console [ttyS0] enabled
[    2.103585] printk: legacy bootconsole [early0] disabled
[    2.103585] printk: legacy bootconsole [early0] disabled
[    2.727319] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[    2.735451] 8 fixed-partitions partitions found on MTD device spi0.0
[    2.742330] Creating 8 MTD partitions on "spi0.0":
[    2.747210] 0x000000000000-0x000000080000 : "u-boot"
[    2.753754] 0x000000080000-0x000000090000 : "partition-table"
[    2.760646] 0x000000090000-0x0000000a0000 : "product-info"
[    2.768051] 0x0000000a0000-0x000000d90000 : "firmware"
[    2.774529] 2 fit-fw partitions found on MTD device firmware
[    2.780265] Creating 2 MTD partitions on "firmware":
[    2.785292] 0x000000000000-0x0000002d0000 : "kernel"
[    2.791443] 0x000000380000-0x000000cf0000 : "rootfs"
[    2.797556] mtd: setting mtd5 (rootfs) as root device
[    2.802724] 1 squashfs-split partitions found on MTD device rootfs
[    2.808952] 0x000000a60000-0x000000cf0000 : "rootfs_data"
[    2.815562] 0x000000d90000-0x000000df0000 : "user-config"
[    2.822153] 0x000000f30000-0x000000fb0000 : "mutil-log"
[    2.828490] 0x000000fb0000-0x000000ff0000 : "oops"
[    2.834445] 0x000000ff0000-0x000001000000 : "radio"
[    2.968117] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.985779] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 19
[    2.996132] i2c_dev: i2c /dev entries driver
[    3.004367] NET: Registered PF_INET6 protocol family
[    3.012641] Segment Routing with IPv6
[    3.016555] In-situ OAM (IOAM) with IPv6
[    3.020615] NET: Registered PF_PACKET protocol family
[    3.025795] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.039592] 8021q: 802.1Q VLAN Support v1.8
[    3.073441] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[    7.102709] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[    7.111035] mt7530-mdio mdio-bus:1f lan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7530 PHY] (irq=21)
[    7.123360] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[    7.126412] mtk_soc_eth 1e100000.ethernet eth0: entered promiscuous mode
[    7.137930] DSA: tree 0 setup
[    7.142103] clk: Disabling unused clocks
[    7.166080] Freeing unused kernel image (initmem) memory: 5620K
[    7.172036] This architecture does not have kernel memory protection.
[    7.178515] Run /init as init process
[    7.772136] init: Console is alive
[    7.776945] init: - watchdog -
[    7.794465] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    7.804089] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    7.816359] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.831993] init: - preinit -
[   11.254780] random: crng init done
[   11.625513] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   11.638060] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   11.638580] mt7530-mdio mdio-bus:1f lan: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   14.427364] mt7530-mdio mdio-bus:1f lan: Link is Up - 1Gbps/Full - flow control off
[   16.012818] mt7530-mdio mdio-bus:1f lan: Link is Down
[   16.027965] procd: - early -
[   16.031070] procd: - watchdog -
[   16.617028] procd: - watchdog -
[   16.620618] procd: - ubus -
[   16.779834] procd: - init -
Please press Enter to activate this console.
[   17.202830] kmodloader: loading kernel modules from /etc/modules.d/*
[   17.224609] mtk-eip93 1e004000.crypto: EIP93 Crypto Engine Initialized.
[   17.793231] Loading modules backported from Linux version v6.18.7-0-g5dfbc5357
[   17.800537] Backport generated by backports.git c8a37ce
[   17.880255] pci 0000:00:00.0: enabling device (0000 -> 0003)
[   17.885996] mt7915e_hif 0000:01:00.0: enabling device (0000 -> 0002)
[   17.892915] pci 0000:00:01.0: enabling device (0000 -> 0003)
[   17.898650] mt7915e 0000:02:00.0: enabling device (0000 -> 0002)
[   18.066710] mt7915e 0000:02:00.0: HW/SW Version: 0x8a108a10, Build Time: 20240429200716a
[   18.094974] mt7915e 0000:02:00.0: WM Firmware Version: ____000000, Build Time: 20240429200752
[   18.136560] mt7915e 0000:02:00.0: WA Firmware Version: DEV_000000, Build Time: 20240429200812
[   18.257151] mt7915e 0000:02:00.0: registering led 'mt76-phy0'
[   18.271968] urngd: v1.0.2 started.
[   18.361583] mt7915e 0000:02:00.0: registering led 'mt76-phy1'
[   18.538851] PPP generic driver version 2.4.2
[   18.544659] NET: Registered PF_PPPOX protocol family
[   18.558798] kmodloader: done loading kernel modules from /etc/modules.d/*
[   37.799938] mtk_soc_eth 1e100000.ethernet eth0: Link is Down
[   37.832781] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   37.841640] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   37.853698] mt7530-mdio mdio-bus:1f lan: configuring for phy/gmii link mode
[   37.863825] br-lan: port 1(lan) entered blocking state
[   37.869299] br-lan: port 1(lan) entered disabled state
[   37.874869] mt7530-mdio mdio-bus:1f lan: entered allmulticast mode
[   37.881205] mtk_soc_eth 1e100000.ethernet eth0: entered allmulticast mode
[   37.891526] mt7530-mdio mdio-bus:1f lan: entered promiscuous mode
[   40.229339] mt7530-mdio mdio-bus:1f lan: Link is Up - 1Gbps/Full - flow control off
[   40.233388] br-lan: port 1(lan) entered blocking state
[   40.242261] br-lan: port 1(lan) entered forwarding state

OpenWrt bootlog with openwrt-25.12.2-ramips-mt7621-tplink_eap613-v1-initramfs-kernel.bin

lamero · June 4, 2026, 9:01pm

How to create a patch to include also v4?

svanheule · June 5, 2026, 2:31pm

It depends on whether you can install the current factory images using the steps laid out in the original commit message. Also try installing from 1.8.0 and 1.8.1, if that's possible.

If that works, then it's basically up to you what you want to do. You could just add some hardware info to the wiki, linking to the EAP613v1 support, and call it a day.

You could also supply at some DEVICE_ALT0_* details in mt7621.mk to generate images using the "eap610" name. That way there will be images for the EAP610, but they will be identical to the EAP613 images.

If the current factory images aren't supported, you may need to update the EAP610-V3 entry in tplink-safeloader.c from the firmware-utils repository. It's possible even that won't be sufficient for the v1.8.1 stock firmware, which would then require you to do some investigating on the image format.

lamero · June 6, 2026, 8:31am

Ok I don't know how to do this. What worked for me:

Open the device by unscrewing four screws from the backside
Carefully remove board from the housing
Connect to UART (3.3V):
1. Find test points labelled "VCC", "GND", "UART_TX", "UART_RX"
2. Solder wires to test points or connect otherwise. Be careful not to damage the PCB e.g. by pulling on soldered wires
3. Open console with 115200n8 settings
Interrupt bootloader and use tftpboot to start an initramfs: setenv ipaddr $DEVICE_IP setenv serverip $SERVER_IP tftpboot 84000000 openwrt-25.12.2-ramips-mt7621-tplink_eap613-v1-initramfs-kernel.bin bootm
Flash via WEB openwrt-25.12.2-ramips-mt7621-tplink_eap613-v1-squashfs-sysupgrade.bin

Source: https://git.openwrt.org/openwrt/staging/svanheule/commit/?id=11588c52b47c2c3b2cdc7849ce9e4804bfdb8bb5

Thanks @svanheule