TP-Link EX520 MediaTek MT7981 OpenWrt Support

usuariomega · October 14, 2025, 7:33pm

Hello, I would like to know if there is any firmware for the TP-Link Ex520. It is visually identical to the Ex220 (same number of ports and LEDs), but the processor is different. Below are some pictures and a boot log when starting a serial connection.

Apparently TP-Link already uses modified OpenWrt...

U-Boot 2022.07-rc1 (Oct 15 2024 - 18:29:24 +0800)

CPU: MediaTek MT7981
Model: mt7981-rfb
DRAM: 256 MiB
Core: 36 devices, 16 uclasses, devicetree: embed

Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.4.211


Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                   0 ubi0: attaching mtd10
ubi0: scanning is finished
ubi0: attached mtd10 (name "misc_isp", size 6 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 3/2, WL threshold: 4096, image sequence number: 996483222
ubi0: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 19
Read 16 bytes from volume misc_isp to 000000004f7ff928
Aginet wait 6000 ms
timeout
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
Saving Environment to MTD... Erasing on MTD device 'u-boot-env'... OK
Writing to MTD device 'u-boot-env'... OK
OK
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
ubi0: detaching mtd10
ubi0: mtd10 is detached
ubi0: attaching mtd6
ubi0: scanning is finished
ubi0: attached mtd6 (name "ubi0", size 40 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 320, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 451607051
ubi0: available PEBs: 129, total reserved PEBs: 191, PEBs reserved for bad PEB handling: 19
Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... OK
Reading from volume 'rootfs' to 0x4a000000, size 0x0 ... OK
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Booting kernel from Legacy Image at 41dfffc0 ...
   Image Name:   seconduboot
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    666328 Bytes = 650.7 KiB
   Load Address: 00000000
   Entry Point:  41e00000
   Verifying Checksum ... OK
   Loading Standalone Program


U-Boot 2022.07-rc1 (Oct 15 2024 - 18:28:39 +0800)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  256 MiB
Core:  36 devices, 16 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
second uboot to boot kernel @46000000
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.4.211
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    3743703 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48080000
     Entry Point:  0x48080000
     Hash algo:    crc32
     Hash value:   b9c8a7f7
     Hash algo:    sha1
     Hash value:   3b838fd4ff26839fb73be4e82d5e6648a03ac223
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt EX520 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463921f8
     Data Size:    18476 Bytes = 18 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   87c42ac6
     Hash algo:    sha1
     Hash value:   9cbc5ca1c024f5ac0ef7ca9eb16fd890fc902cc3
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x463921f8
   Uncompressing Kernel Image
   Loading Device Tree to 000000004f7f3000, end 000000004f7fa82b ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.4.211 (root@7086da4efda9) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16649-bcaabe6d05)) #1 SMP Tue Oct 15 18:31:04 CST 2024
[    0.000000] Machine model: MediaTek MT7981 RFB
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] On node 0 totalpages: 64592
[    0.000000]   DMA32 zone: 1024 pages used for memmap
[    0.000000]   DMA32 zone: 0 pages reserved
[    0.000000]   DMA32 zone: 64592 pages, LIFO batch:15
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 20 pages/cpu s44376 r8192 d29352 u81920
[    0.000000] pcpu-alloc: s44376 r8192 d29352 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 63568
[    0.000000] Kernel command line: ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 229768K/258368K available (7614K kernel code, 554K rwdata, 2064K rodata, 448K init, 308K bss, 28600K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     CONFIG_RCU_FANOUT set to non-default value of 32.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] GICv3: Distributor has no Range Selector support
[    0.000000] GICv3: 16 PPIs implemented
[    0.000000] GICv3: no VLPI support, no direct LPI support
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000003] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.008209] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.018616] pid_max: default: 32768 minimum: 301
[    0.023332] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.030594] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.039204] ASID allocator initialised with 65536 entries
[    0.044713] rcu: Hierarchical SRCU implementation.
[    0.049830] smp: Bringing up secondary CPUs ...
[    0.054679] Detected VIPT I-cache on CPU1
[    0.054702] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.054723] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.054784] smp: Brought up 1 node, 2 CPUs
[    0.076384] SMP: Total of 2 processors activated.
[    0.081105] CPU features: detected: 32-bit EL0 Support
[    0.086262] CPU features: detected: CRC32 instructions
[    0.091535] CPU: All CPU(s) started at EL2
[    0.095651] alternatives: patching kernel code
[    0.100644] devtmpfs: initialized
[    0.106064] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.115971] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.122864] pinctrl core: initialized pinctrl subsystem
[    0.128965] NET: Registered protocol family 16
[    0.133660] DMA: preallocated 256 KiB pool for atomic allocations
[    0.140491] cpuidle: using governor ladder
[    0.144625] cpuidle: using governor menu
[    0.162300] cryptd: max_cpu_qlen set to 1000
[    0.168478] SCSI subsystem initialized
[    0.172401] libata version 3.00 loaded.
[    0.177353] rbus 18000000.wbsys: PCI host bridge to bus 0000:00
[    0.183340] pci_bus 0000:00: root bus resource [mem 0x18000000-0x18ffffff]
[    0.190249] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.195762] pci_bus 0000:00: scanning bus
[    0.199808] pci 0000:00:00.0: [14c3:7981] type 00 class 0x000280
[    0.205859] pci 0000:00:00.0: reg 0x10: [mem 0x18000000-0x1800000f 64bit]
[    0.212680] pci 0000:00:00.0: reg 0x18: [mem 0x00000000-0x0000000f]
[    0.218979] pci 0000:00:00.0: reg 0x1c: [mem 0x00000000-0x0000000f]
[    0.225275] pci 0000:00:00.0: reg 0x20: [mem 0x00000000-0x0000000f]
[    0.231573] pci 0000:00:00.0: reg 0x24: [mem 0x00000000-0x0000000f]
[    0.238855] pci_bus 0000:00: fixups for bus
[    0.243064] pci_bus 0000:00: bus scan returning with max=00
[    0.249220] clocksource: Switched to clocksource arch_sys_counter
[    0.256350] thermal_sys: Registered thermal governor 'fair_share'
[    0.256353] thermal_sys: Registered thermal governor 'bang_bang'
[    0.262515] thermal_sys: Registered thermal governor 'step_wise'
[    0.268548] thermal_sys: Registered thermal governor 'user_space'
[    0.274586] thermal_sys: Registered thermal governor 'power_allocator'
[    0.280960] NET: Registered protocol family 2
[    0.291990] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.299618] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.308024] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.315876] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.323072] TCP: Hash tables configured (established 2048 bind 2048)
[    0.329523] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.336088] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.343193] NET: Registered protocol family 1
[    0.347588] PCI: CLS 0 bytes, default 64
[    0.352295] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.362307] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.368443] ntfs: driver 2.1.32 [Flags: R/O].
[    0.372996] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.383134] fuse: init (API version 7.31)
[    0.399774] phy phy-usb-phy@11e10000.1: type_sw - reg 0x218, index 0
[    0.415352] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.423353] printk: console [ttyS0] disabled
[    0.447771] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 12, base_baud = 2500000) is a ST16650V2
[    0.456983] printk: console [ttyS0] enabled
[    0.456983] printk: console [ttyS0] enabled
[    0.465341] printk: bootconsole [uart8250] disabled
[    0.465341] printk: bootconsole [uart8250] disabled
[    0.475928] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.484931] loop: module loaded
[    0.488198] mediatek,mt2701-ice_debug ice_debug: get dbg_sel clock fail: -2
[    0.495225] mediatek,mt2701-ice_debug: probe of ice_debug failed with error -2
[    0.503437] mt7981-pinctrl 11d00000.pinctrl: pin_config_set op failed for pin 19
[    0.510837] mtk-spi 1100a000.spi: Error applying setting, reverse things back
[    0.518542] spi-nand spi0.0: GigaDevice SPI NAND was found.
[    0.524136] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.534849] tun: Universal TUN/TAP device driver, 1.6
[    0.540443] [mtk_hw_init] reset_lock:0, force:0
[    0.544986] [mtk_hw_init] execute fe cold reset
[    0.560616] phylink_parse_mode_phy check phy-link speed:1000 duplex:1
[    0.581258] mtk_soc_eth 15100000.ethernet: generated random MAC address 96:ca:93:c7:7b:8e
[    0.596180] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc011900000, irq 75
[    0.605268] mtk_soc_eth 15100000.ethernet: generated random MAC address 3a:c1:a8:cb:05:e1
[    0.613723] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc011900000, irq 75
[    0.622768] (unnamed net_device) (dummy): netif_napi_add() called with weight 256
[    0.630435] PPP generic driver version 2.4.2
[    0.634850] PPP BSD Compression module registered
[    0.639567] NET: Registered protocol family 24
[    0.644014] PPTP driver version 0.8.5
[    0.647993] i2c /dev entries driver
[    0.652535] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    0.660609] device-mapper: ioctl: 4.41.0-ioctl (2019-09-16) initialised: dm-devel@redhat.com
[    0.669467] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    0.683062] exFAT: Version 1.3.0
[    0.687823] GACT probability NOT on
[    0.691339] Mirror/redirect action on
[    0.694997] u32 classifier
[    0.697690]     input device check on
[    0.701379]     Actions configured
[    0.705087] ipip: IPv4 and MPLS over IPv4 tunneling driver
[    0.710895] gre: GRE over IPv4 demultiplexor driver
[    0.715763] ip_gre: GRE over IPv4 tunneling driver
[    0.721603] Initializing XFRM netlink socket
[    0.726219] NET: Registered protocol family 10
[    0.731783] Segment Routing with IPv6
[    0.735646] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[    0.742401] NET: Registered protocol family 17
[    0.746856] NET: Registered protocol family 15
[    0.751374] Bridge firewalling registered
[    0.755572] l2tp_core: L2TP core driver, V2.0
[    0.759940] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    0.764716] l2tp_netlink: L2TP netlink interface
[    0.769363] 8021q: 802.1Q VLAN Support v1.8
[    0.782937] nmbm nmbm_spim_nand: Signature found at block 1023 [0x07fe0000]
[    0.790761] nmbm nmbm_spim_nand: First info table with writecount 0 found in block 960
[    0.801287] nmbm nmbm_spim_nand: Second info table with writecount 0 found in block 963
[    0.809287] nmbm nmbm_spim_nand: NMBM has been successfully attached
[    0.815917] 10 fixed-partitions partitions found on MTD device nmbm_spim_nand
[    0.823051] Creating 10 MTD partitions on "nmbm_spim_nand":
[    0.828611] 0x000000000000-0x000000200000 : "boot"
[    0.834071] 0x000000200000-0x000000300000 : "u-boot-env"
[    0.839984] 0x000000300000-0x000000900000 : "misc_ro"
[    0.845631] 0x000000900000-0x000000f00000 : "misc_rw"
[    0.851356] 0x000000f00000-0x000003700000 : "ubi0"
[    0.856770] 0x000003700000-0x000005f00000 : "ubi1"
[    0.862222] 0x000005f00000-0x000006500000 : "misc_rw_bak"
[    0.868220] 0x000006500000-0x000006b00000 : "bflag"
[    0.873732] 0x000006b00000-0x000007100000 : "misc_isp"
[    0.879535] 0x000000000000-0x000007800000 : "whole"
[    1.098090] mt7530 mdio-bus:1f lan0 (uninitialized): PHY [dsa-0.0:00] driver [Generic PHY]
[    1.108872] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:01] driver [Generic PHY]
[    1.119668] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY]
[    1.130399] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY]
[    1.140316] mt7530 mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.147459] DSA: tree 0 setup
[    1.147710] mt7530 mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.157854] ubi0: attaching mtd5
[    1.287169] ubi0: scanning is finished
[    1.296273] ubi0: attached mtd5 (name "ubi0", size 40 MiB)
[    1.301766] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.308625] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.315402] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.322351] ubi0: good PEBs: 320, bad PEBs: 0, corrupted PEBs: 0
[    1.328342] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    1.335551] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 451607051
[    1.344583] ubi0: available PEBs: 129, total reserved PEBs: 191, PEBs reserved for bad PEB handling: 19
[    1.353969] ubi0: background thread "ubi_bgt0d" started, PID 768
[    1.635162] random: crng init done
[    3.051537] block ubiblock0_2: created from ubi0:2(rootfs)
[    3.057015] ubiblock: device ubiblock0_2 (rootfs) set to be root filesystem
[    3.064028] hctosys: unable to open rtc device (rtc0)
[    3.069620] UBIFS (ubi0:2): static UBI volume - read-only mode
[    3.075452] UBIFS error (ubi0:2 pid 1): ubifs_mount: cannot mount read-write - read-only media
[    3.087076] VFS: Mounted root (squashfs filesystem) readonly on device 253:0.
[    3.097182] devtmpfs: mounted
[    3.100411] Freeing unused kernel memory: 448K
[    3.129194] Run /sbin/init as init process
starting pid 777, tty '': '/etc/init.d/rcS'
[    3.370195] ubi1: attaching mtd3
[    3.392536] ubi1: scanning is finished
[    3.401120] ubi1: attached mtd3 (name "misc_ro", size 6 MiB)
[    3.406771] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.413659] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.420444] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.427389] ubi1: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    3.433298] ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.440509] ubi1: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 908025214
[    3.449540] ubi1: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 19
[    3.458659] ubi1: background thread "ubi_bgt1d" started, PID 792
UBI device number 1, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
misc_ro found, mounting...
[    3.496437] UBIFS (ubi1:0): Mounting in unauthenticated mode
[    3.554633] UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "misc_ro", R/O mode
[    3.562998] UBIFS (ubi1:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.572904] UBIFS (ubi1:0): FS size: 2031616 bytes (1 MiB, 16 LEBs), journal size 888833 bytes (0 MiB, 5 LEBs)
[    3.582891] UBIFS (ubi1:0): reserved for root: 95957 bytes (93 KiB)
[    3.589151] UBIFS (ubi1:0): media format: w5/r0 (latest is w5/r0), UUID E9166F47-4C9B-4C5D-81A1-39227D479411, small LPT model
[    3.605155] ubi2: attaching mtd4
[    3.627379] ubi2: scanning is finished
[    3.635879] ubi2: attached mtd4 (name "misc_rw", size 6 MiB)
[    3.641549] ubi2: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.648408] ubi2: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.655186] ubi2: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.662136] ubi2: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    3.668039] ubi2: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.675250] ubi2: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1791277016
[    3.684367] ubi2: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 19
[    3.693494] ubi2: background thread "ubi_bgt2d" started, PID 805
UBI device number 2, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0[    3.705551] UBIFS (ubi2:0): Mounting in unauthenticated mode
 bytes), LEB siz[    3.712176] UBIFS (ubi2:0): background thread "ubifs_bgt2_0" started, PID 813
e 126976 bytes (124.0 KiB)
misc_rw found, mounting...
[    3.744709] UBIFS (ubi2:0): recovery needed
[    3.833976] UBIFS (ubi2:0): recovery completed
[    3.838510] UBIFS (ubi2:0): UBIFS: mounted UBI device 2, volume 0, name "misc_rw"
[    3.846003] UBIFS (ubi2:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.855910] UBIFS (ubi2:0): FS size: 2031616 bytes (1 MiB, 16 LEBs), journal size 888833 bytes (0 MiB, 5 LEBs)
[    3.865901] UBIFS (ubi2:0): reserved for root: 95957 bytes (93 KiB)
[    3.872163] UBIFS (ubi2:0): media format: w5/r0 (latest is w5/r0), UUID 4542EA9A-9C46-4E9F-B3A8-9BA60B01FF75, small LPT model
[    3.889939] ubi3: attaching mtd7
[    3.912171] ubi3: scanning is finished
[    3.920694] ubi3: attached mtd7 (name "misc_rw_bak", size 6 MiB)
[    3.926692] ubi3: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.933564] ubi3: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.940342] ubi3: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.947286] ubi3: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    3.953195] ubi3: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.960404] ubi3: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1373402045
[    3.969522] ubi3: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 19
[    3.978642] ubi3: background thread "ubi_bgt3d" started, PID 822
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0[    3.990838] UBIFS (ubi3:0): Mounting in unauthenticated mode
 bytes), LEB siz[    3.997307] UBIFS (ubi3:0): background thread "ubifs_bgt3_0" started, PID 830
e 126976 bytes (124.0 KiB)
misc_rw_bak found, mounting...
[    4.021756] UBIFS (ubi3:0): recovery needed
[    4.095767] UBIFS (ubi3:0): recovery completed
[    4.100288] UBIFS (ubi3:0): UBIFS: mounted UBI device 3, volume 0, name "misc_rw_bak"
[    4.108102] UBIFS (ubi3:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.118009] UBIFS (ubi3:0): FS size: 2031616 bytes (1 MiB, 16 LEBs), journal size 888833 bytes (0 MiB, 5 LEBs)
[    4.127996] UBIFS (ubi3:0): reserved for root: 95957 bytes (93 KiB)
[    4.134257] UBIFS (ubi3:0): media format: w5/r0 (latest is w5/r0), UUID FF0E9549-39B4-469D-B38F-F7A6DABEEFAB, small LPT model
[    4.152490] ubi4: attaching mtd9
[    4.174797] ubi4: scanning is finished
[    4.183358] ubi4: attached mtd9 (name "misc_isp", size 6 MiB)
[    4.189095] ubi4: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.196024] ubi4: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.202803] ubi4: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.209753] ubi4: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    4.215656] ubi4: user volume: 1, internal volumes: 1, max. volumes count: 128
[    4.222867] ubi4: max/mean erase counter: 3/2, WL threshold: 4096, image sequence number: 996483222
[    4.231897] ubi4: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 19
[    4.241021] ubi4: background thread "ubi_bgt4d" started, PID 839
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0[    4.253239] UBIFS (ubi4:0): Mounting in unauthenticated mode
 bytes), LEB size 126976 bytes (124.0 KiB)
misc_isp found, mounting...
[    4.284008] UBIFS (ubi4:0): recovery needed
[    4.301408] UBIFS (ubi4:0): recovery deferred
[    4.305818] UBIFS (ubi4:0): UBIFS: mounted UBI device 4, volume 0, name "misc_isp", R/O mode
[    4.314267] UBIFS (ubi4:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.324174] UBIFS (ubi4:0): FS size: 2031616 bytes (1 MiB, 16 LEBs), journal size 888833 bytes (0 MiB, 5 LEBs)
[    4.334162] UBIFS (ubi4:0): reserved for root: 95957 bytes (93 KiB)
[    4.340422] UBIFS (ubi4:0): media format: w5/r0 (latest is w5/r0), UUID 9813CEA7-18FA-419C-953E-0C1626968E36, small LPT model
/etc/init.d/rcS: line 159: udevtrigger: not found
[    4.469900] Register flash device: flash0
[    4.497948] creat_domain_proc  ok
[    4.501310] tp_domain init ok
[    4.526845] TP_DHCP_HOOK Module init
[    4.558086] device recognition register success

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 015E [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):f3959dd72-dirty
NOTICE:  BL2: Built : 18:30:22, Oct 15 2024
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 600, worse bit 3, min window 72
Window Sum 596, worse bit 8, min window 72
Window Sum 410, worse bit 0, min window 50
Window Sum 386, worse bit 9, min window 46
Window Sum 422, worse bit 0, min window 50
Window Sum 400, worse bit 13, min window 48
Window Sum 430, worse bit 0, min window 52
Window Sum 410, worse bit 9, min window 48
Window Sum 440, worse bit 6, min window 52
Window Sum 416, worse bit 9, min window 50
Window Sum 456, worse bit 0, min window 54
Window Sum 432, worse bit 14, min window 50
Window Sum 466, worse bit 6, min window 54
Window Sum 440, worse bit 14, min window 52
Window Sum 472, worse bit 0, min window 58
Window Sum 446, worse bit 9, min window 54
Window Sum 482, worse bit 0, min window 58
Window Sum 454, worse bit 9, min window 54
Window Sum 484, worse bit 0, min window 58
Window Sum 470, worse bit 14, min window 56
Window Sum 492, worse bit 0, min window 60
Window Sum 474, worse bit 9, min window 56
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):f3959dd72-dirty
NOTICE:  BL31: Built : 18:30:26, Oct 15 2024
NOTICE:  Hello BL31!!!


U-Boot 2022.07-rc1 (Oct 15 2024 - 18:29:24 +0800)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  256 MiB
Core:  36 devices, 16 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                   0 MT7981> <INTERRUPT>
MT7981>
MT7981>
MT7981> setenv ipaddr 192.168.0.1
MT7981> setenv serverip 192.168.0.2
MT7981> tftpboot 0x80010000 initramfs.bin
Using ethernet@15100000 device
TFTP from server 192.168.0.2; our IP address is 192.168.0.1
Filename 'initramfs.bin'.

TFTP error: trying to overwrite reserved memory...
MT7981>

brada4 · October 14, 2025, 8:32pm

can you type help into uboot?

usuariomega · October 14, 2025, 8:44pm

MT7981> help
?         - alias for 'help'
base      - print or set address offset
bdinfo    - print Board Info structure
blkcache  - block cache diagnostics and control
boot      - boot default, i.e., run 'bootcmd'
bootd     - boot default, i.e., run 'bootcmd'
bootefi   - Boots an EFI payload from memory
bootelf   - Boot from an ELF image in memory
bootflow  - Boot flows
booti     - boot Linux kernel 'Image' format from memory
bootm     - boot application image from memory
bootmenu  - ANSI terminal bootmenu
bootp     - boot image via network using BOOTP/TFTP protocol
bootvx    - Boot vxWorks from an ELF image
cmp       - memory compare
coninfo   - print console devices and information
cp        - memory copy
crc32     - checksum calculation
echo      - echo args to console
editenv   - edit environment variable
env       - environment handling commands
erase     - erase FLASH memory
fdt       - flattened device tree utility commands
flinfo    - print FLASH memory information
go        - start application at address 'addr'
gpio      - query and control gpio pins
gzwrite   - unzip and write memory to block device
help      - print command description/usage
iminfo    - print header information for application image
imxtract  - extract a part of a multi-image
itest     - return true/false on integer compare
loadb     - load binary file over serial line (kermit mode)
loads     - load S-Record file over serial line
loadx     - load binary file over serial line (xmodem mode)
loady     - load binary file over serial line (ymodem mode)
loop      - infinite loop on address range
lzmadec   - lzma uncompress a memory region
md        - memory display
mm        - memory modify (auto-incrementing address)
mtd       - MTD utils
mtkautoboot- Display MediaTek bootmenu
mtkboardboot- Boot MTK firmware
mtkload   - MTK image loading utility
mtkupgrade- MTK firmware/bootloader upgrading utility
mw        - memory write (fill)
nand      - NAND utility
net       - NET sub-system
nfs       - boot image via network using NFS protocol
nm        - memory modify (constant address)
nmbm      - NMBM utility commands
panic     - Panic with optional message
ping      - send ICMP ECHO_REQUEST to network host
pinmux    - show pin-controller muxing
printenv  - print environment variables
protect   - enable or disable FLASH write protection
pwm       - control pwm channels
random    - fill memory with random pattern
reset     - Perform RESET of the CPU
run       - run commands in an environment variable
saveenv   - save environment variables to persistent storage
setenv    - set environment variables
setexpr   - set environment variable as the result of eval expression
sf        - SPI flash sub-system
sleep     - delay execution for some time
smc       - Issue a Secure Monitor Call
source    - run script from memory
tftpboot  - boot image via network using TFTP protocol
ubi       - ubi commands
ubifsload - load file from an UBIFS filesystem
ubifsls   - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
unlz4     - lz4 uncompress a memory region
unzip     - unzip a memory region
version   - print monitor, compiler and linker version
MT7981>

usuariomega · October 16, 2025, 2:00am

@brada4 What commands do you need? If you need a dump, teach me how to do it and I'll send it to you.

brada4 · October 16, 2025, 6:00am

tftpboot and bootm and try to netboot similar devices’ initramfs kernels until smth works….

Another would be in same uboot back up mtd devices and try to binwalk them to extract DTB and then decompile that to DTS.

If you get shell access (sometimes root is admin in tplink and sometimes local password is 12345678) you can repeat the backup.

Some commands if you get shell

cat /proc/mtd # it is in the log
ubinfo -a
iwinfo
iw phy

All components are supportable, so put together dts….

Do you have web firmware update file from OEM/provider? Souce code? It is kind of important later to make it usable for masses…

usuariomega · October 16, 2025, 5:06pm

Hi @brada4 I couldn't access the router's shell, so I tried root/12345678, root/admin, and others without success.

I opened the chip cover and saw that they were MT7531AE, MT7981BA, and MT7976CN.

Based on this information, I went to the OpenWrt hardware table and loaded the systems with tftpboot and bootm.

Below is a list of firmware I tried without success (No network, no WiFi):

openwrt-24.10.2-mediatek-filogic-acelink_ew-7886cax-initramfs-kernel.bin
no-openwrt-24.10.2-mediatek-filogic-asus_rt-ax52-initramfs-kernel

Following is a successful list; it only works on the LAN network. The Wi-Fi driver doesn't load on any of the boot attempts below:

openwrt-24.10.2-mediatek-filogic-confiabits_mt7981-initramfs-kernel.bin
openwrt-24.10.2-mediatek-filogic-mercusys_mr80x-v3-initramfs-kernel.bin
openwrt-24.10.2-mediatek-filogic-h3c_magic-nx30-pro-initramfs-recovery.itb
openwrt-24.10.2-mediatek-filogic-abt_asr3000-initramfs-recovery.itb
openwrt-24.10.2-mediatek-filogic-cudy_wr3000h-v1-initramfs-kernel.bin

Here is a print of Luci and boot log:

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                   0 MT7981>
MT7981> setenv ipaddr 192.168.1.1
MT7981> setenv serverip 192.168.1.2
MT7981> tftpboot 4.itb
Using ethernet@15100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename '4.itb'.
Load address: 0x46000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         2.8 MiB/s
done
Bytes transferred = 8585216 (830000 hex)
MT7981> bootm
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.93
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4127771 Bytes = 3.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   ee4eb0ab
     Hash algo:    sha1
     Hash value:   e82cb6d378108d90baba2c8b3a4e7b933471fd42
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt abt_asr3000 initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x463efe3c
     Data Size:    4383080 Bytes = 4.2 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   a9d6d3fd
     Hash algo:    sha1
     Hash value:   8cdb19e57d1fb2550573c693ff65b970208014ce
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt abt_asr3000 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4681e0ac
     Data Size:    22906 Bytes = 22.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   7bbe09e0
     Hash algo:    sha1
     Hash value:   9b1a1e808dfdf0023d168d2099b2b28a1d4b8378
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4681e0ac
   Uncompressing Kernel Image
   Loading Ramdisk to 4f3cd000, end 4f7fb168 ... OK
   Loading Device Tree to 000000004f3c4000, end 000000004f3cc979 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.93 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28739-d9340319c6) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Mon Jun 23 20:40:36 2025
[    0.000000] Machine model: ABT ASR3000
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s35624 r8192 d29912 u73728
[    0.000000] pcpu-alloc: s35624 r8192 d29912 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
[    0.000000] Unknown kernel command line parameters "AC=300", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
[    0.000000] software IO TLB: mapped [mem 0x000000004fe47000-0x000000004fec7000] (0MB)
[    0.000000] Memory: 235596K/262144K available (9024K kernel code, 1000K rwdata, 1672K rodata, 448K init, 307K bss, 26548K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: 0xffffffc080010080
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.008143] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.018554] pid_max: default: 32768 minimum: 301
[    0.026197] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.033465] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.043422] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.050122] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.059532] rcu: Hierarchical SRCU implementation.
[    0.064360] rcu:     Max phase no-delay instances is 1000.
[    0.070042] smp: Bringing up secondary CPUs ...
[    0.075006] Detected VIPT I-cache on CPU1
[    0.075053] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.075084] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.075154] smp: Brought up 1 node, 2 CPUs
[    0.096768] SMP: Total of 2 processors activated.
[    0.101491] CPU features: detected: 32-bit EL0 Support
[    0.106649] CPU features: detected: CRC32 instructions
[    0.111842] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.120233] CPU: All CPU(s) started at EL2
[    0.124346] alternatives: applying system-wide alternatives
[    0.133677] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.143587] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.151686] pinctrl core: initialized pinctrl subsystem
[    0.158122] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.164458] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.171585] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.179382] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.187739] thermal_sys: Registered thermal governor 'fair_share'
[    0.187744] thermal_sys: Registered thermal governor 'bang_bang'
[    0.193863] thermal_sys: Registered thermal governor 'step_wise'
[    0.199906] thermal_sys: Registered thermal governor 'user_space'
[    0.206020] ASID allocator initialised with 65536 entries
[    0.218503] pstore: Using crash dump compression: deflate
[    0.223943] pstore: Registered ramoops as persistent store backend
[    0.230149] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.236656] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.252232] Modules: 29616 pages in range for non-PLT usage
[    0.252244] Modules: 521136 pages in range for PLT usage
[    0.259036] cryptd: max_cpu_qlen set to 1000
[    0.269838] SCSI subsystem initialized
[    0.273760] libata version 3.00 loaded.
[    0.279216] clocksource: Switched to clocksource arch_sys_counter
[    0.287613] NET: Registered PF_INET protocol family
[    0.292697] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.301297] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.309715] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.317501] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.325303] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.332531] TCP: Hash tables configured (established 2048 bind 2048)
[    0.339262] MPTCP token hash table entries: 256 (order: 0, 6144 bytes, linear)
[    0.346630] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.353210] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.360413] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.366119] PCI: CLS 0 bytes, default 64
[    0.370284] Unpacking initramfs...
[    0.380450] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.391971] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.397848] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.464609] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.483012] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.493011] printk: console [ttyS0] disabled
[    0.517751] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.527010] printk: console [ttyS0] enabled
[    0.527010] printk: console [ttyS0] enabled
[    0.535384] printk: bootconsole [uart8250] disabled
[    0.535384] printk: bootconsole [uart8250] disabled
[    0.550445] loop: module loaded
[    0.555818] spi-nand spi0.0: ESMT SPI NAND was found.
[    0.560912] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    1.675798] Freeing initrd memory: 4280K
[    1.687134] 6 fixed-partitions partitions found on MTD device spi0.0
[    1.693805] Creating 6 MTD partitions on "spi0.0":
[    1.698601] 0x000000000000-0x000000100000 : "bl2"
[    1.704486] 0x000000100000-0x000000180000 : "u-boot-env"
[    1.710512] 0x000000180000-0x000000280000 : "art"
[    1.716662] 0x000000280000-0x000000380000 : "factory"
[    1.723411] 0x000000380000-0x000000580000 : "fip"
[    1.729596] 0x000000580000-0x000008000000 : "ubi"
[    1.792192] ubi0: default fastmap pool size: 45
[    1.796728] ubi0: default fastmap WL pool size: 22
[    1.801530] ubi0: attaching mtd5
[    1.816861] ubi0 error: 0xffffffc0805ded9c: bad image sequence number 1791277016 in PEB 28, expected 908025214
[    1.826898] Erase counter header dump:
[    1.830656]  magic          0x55424923
[    1.834393]  version        1
[    1.837347]  ec             6
[    1.840312]  vid_hdr_offset 2048
[    1.843527]  data_offset    4096
[    1.846741]  image_seq      1791277016
[    1.850482]  hdr_crc        0xda667af
[    1.854131] erase counter header hexdump:
[    1.858128] 00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 06 00 00 08 00 00 00 10 00 6a c4 b7 d8 00 00 00 00  UBI#....................j.......
[    1.871677] 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d a6 67 af  ..............................g.
[    1.885233] ubi0 error: 0xffffffc0805d244c: failed to attach mtd5, error -22
[    2.021251] mtk_soc_eth 15100000.ethernet: generated random MAC address 65:74:68:25:64:00
[    2.029692] mtk_soc_eth 15100000.ethernet: generated random MAC address 65:74:68:25:64:00
[    2.058357] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081280000, irq 75
[    2.068298] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081280000, irq 75
[    2.078082] i2c_dev: i2c /dev entries driver
[    2.084263] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    2.093498] NET: Registered PF_INET6 protocol family
[    2.099595] Segment Routing with IPv6
[    2.103285] In-situ OAM (IOAM) with IPv6
[    2.107244] NET: Registered PF_PACKET protocol family
[    2.112358] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.125545] 8021q: 802.1Q VLAN Support v1.8
[    2.241745] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    2.250472] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.261474] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    2.284271] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    2.306360] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    2.318221] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    2.324995] DSA: tree 0 setup
[    2.328347] UBI error: cannot open mtd ubi0, error -2
[    2.333531] clk: Disabling unused clocks
[    2.338075] Freeing unused kernel memory: 448K
[    2.342615] Run /init as init process
[    2.346265]   with arguments:
[    2.349223]     /init
[    2.351484]   with environment:
[    2.354611]     HOME=/
[    2.356959]     TERM=linux
[    2.359657]     AC=300
[    2.577018] init: Console is alive
[    2.580583] init: - watchdog -
[    2.588398] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.598676] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.608951] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.624532] init: - preinit -
[    2.709687] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    2.718205] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.730944] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.937880] random: procd: uninitialized urandom read (4 bytes read)
[    6.940583] procd: - early -
[    6.947283] procd: - watchdog -
[    7.481988] procd: - watchdog -
[    7.485301] procd: - ubus -
[   13.089224] random: crng init done
[   13.095520] procd: - init -
Please press Enter to activate this console.
[   13.287755] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.304803] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   13.319460] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   13.326942] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   13.499892] urngd: v1.0.2 started.
[   13.679387] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823161240a
[   13.679387]
[   13.701483] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823161304
[   13.741752] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823161841
[   13.839665] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   13.846432] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7981_eeprom_mt7976_dbdc.bin failed with error -2
[   13.857568] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7981_eeprom_mt7976_dbdc.bin
[   13.894547] mt798x-wmac: probe of 18000000.wifi failed with error -12
[   13.921735] PPP generic driver version 2.4.2
[   13.927149] NET: Registered PF_PPPOX protocol family
[   13.935207] kmodloader: done loading kernel modules from /etc/modules.d/*
[   20.100981] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   20.131466] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   20.140627] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   20.153878] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[   20.165899] br-lan: port 1(lan1) entered blocking state
[   20.171206] br-lan: port 1(lan1) entered disabled state
[   20.176468] mt7530-mdio mdio-bus:1f lan1: entered allmulticast mode
[   20.182777] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
[   20.192966] mt7530-mdio mdio-bus:1f lan1: entered promiscuous mode
[   20.218097] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   20.236719] br-lan: port 2(lan2) entered blocking state
[   20.242043] br-lan: port 2(lan2) entered disabled state
[   20.247316] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
[   20.256651] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
[   20.275125] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   20.301145] br-lan: port 3(lan3) entered blocking state
[   20.306383] br-lan: port 3(lan3) entered disabled state
[   20.311684] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
[   20.328140] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
[   20.387164] mtk_soc_eth 15100000.ethernet eth1: PHY [mdio-bus:00] driver [MediaTek MT7981 PHY] (irq=POLL)
[   20.396808] mtk_soc_eth 15100000.ethernet eth1: configuring for phy/gmii link mode
[   23.458528] mt7530-mdio mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[   23.458556] br-lan: port 2(lan2) entered blocking state
[   23.471677] br-lan: port 2(lan2) entered forwarding state

usuariomega · October 16, 2025, 5:08pm

Continuing,

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                   0 MT7981> <INTERRUPT>
MT7981> setenv ipaddr 192.168.1.1
MT7981> setenv serverip 192.168.1.2
MT7981> tftpboot 5.bin
Using ethernet@15100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename '5.bin'.
Load address: 0x46000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################################
         1 MiB/s
done
Bytes transferred = 8536932 (824364 hex)
MT7981> bootm
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.93
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4127771 Bytes = 3.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   ee4eb0ab
     Hash algo:    sha1
     Hash value:   e82cb6d378108d90baba2c8b3a4e7b933471fd42
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt cudy_wr3000h-v1 initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x463efe40
     Data Size:    4383080 Bytes = 4.2 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   a9d6d3fd
     Hash algo:    sha1
     Hash value:   8cdb19e57d1fb2550573c693ff65b970208014ce
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt cudy_wr3000h-v1 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4681e0b4
     Data Size:    23931 Bytes = 23.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   f61d8ecb
     Hash algo:    sha1
     Hash value:   c6184ff3cf8bc5ec923777dd277d19cb2d1476d8
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4681e0b4
   Uncompressing Kernel Image
   Loading Ramdisk to 4f3cd000, end 4f7fb168 ... OK
   Loading Device Tree to 000000004f3c4000, end 000000004f3ccd7a ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.93 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28739-d9340319c6) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Mon Jun 23 20:40:36 2025
[    0.000000] Machine model: Cudy WR3000H v1
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s35624 r8192 d29912 u73728
[    0.000000] pcpu-alloc: s35624 r8192 d29912 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
[    0.000000] Unknown kernel command line parameters "AC=300", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
[    0.000000] software IO TLB: mapped [mem 0x000000004fe46000-0x000000004fec6000] (0MB)
[    0.000000] Memory: 235592K/262144K available (9024K kernel code, 1000K rwdata, 1672K rodata, 448K init, 307K bss, 26552K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: 0xffffffc080010080
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.008148] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.018559] pid_max: default: 32768 minimum: 301
[    0.026206] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.033473] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.043427] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.050131] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.059542] rcu: Hierarchical SRCU implementation.
[    0.064372] rcu:     Max phase no-delay instances is 1000.
[    0.070053] smp: Bringing up secondary CPUs ...
[    0.075018] Detected VIPT I-cache on CPU1
[    0.075067] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.075099] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.075171] smp: Brought up 1 node, 2 CPUs
[    0.096783] SMP: Total of 2 processors activated.
[    0.101506] CPU features: detected: 32-bit EL0 Support
[    0.106664] CPU features: detected: CRC32 instructions
[    0.111857] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.120248] CPU: All CPU(s) started at EL2
[    0.124361] alternatives: applying system-wide alternatives
[    0.133786] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.143698] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.151805] pinctrl core: initialized pinctrl subsystem
[    0.158241] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.164596] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.171724] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.179521] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.187883] thermal_sys: Registered thermal governor 'fair_share'
[    0.187888] thermal_sys: Registered thermal governor 'bang_bang'
[    0.194007] thermal_sys: Registered thermal governor 'step_wise'
[    0.200049] thermal_sys: Registered thermal governor 'user_space'
[    0.206163] ASID allocator initialised with 65536 entries
[    0.218653] pstore: Using crash dump compression: deflate
[    0.224093] pstore: Registered ramoops as persistent store backend
[    0.230299] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.236858] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.252517] Modules: 29616 pages in range for non-PLT usage
[    0.252529] Modules: 521136 pages in range for PLT usage
[    0.259335] cryptd: max_cpu_qlen set to 1000
[    0.270156] SCSI subsystem initialized
[    0.274069] libata version 3.00 loaded.
[    0.279521] clocksource: Switched to clocksource arch_sys_counter
[    0.287933] NET: Registered PF_INET protocol family
[    0.293022] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.301630] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.310047] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.317833] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.325635] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.332863] TCP: Hash tables configured (established 2048 bind 2048)
[    0.339584] MPTCP token hash table entries: 256 (order: 0, 6144 bytes, linear)
[    0.346951] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.353530] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.360734] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.366439] PCI: CLS 0 bytes, default 64
[    0.370599] Unpacking initramfs...
[    0.380785] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.392323] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.398199] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.464830] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.483146] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.493185] printk: console [ttyS0] disabled
[    0.517920] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.527179] printk: console [ttyS0] enabled
[    0.527179] printk: console [ttyS0] enabled
[    0.535554] printk: bootconsole [uart8250] disabled
[    0.535554] printk: bootconsole [uart8250] disabled
[    0.551019] loop: module loaded
[    0.557341] spi-nand spi0.0: calibration result: 0x3
[    0.562447] spi-nand spi0.0: ESMT SPI NAND was found.
[    0.567496] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.576087] Signature found at block 1023 [0x07fe0000]
[    0.581265] NMBM management region starts at block 960 [0x07800000]
[    0.588686] First info table with writecount 0 found in block 960
[    0.597678] Second info table with writecount 0 found in block 963
[    0.603892] NMBM has been successfully attached
[    1.675539] Freeing initrd memory: 4280K
[    1.686888] 6 fixed-partitions partitions found on MTD device spi0.0
[    1.693545] Creating 6 MTD partitions on "spi0.0":
[    1.698341] 0x000000000000-0x000000100000 : "BL2"
[    1.704422] 0x000000100000-0x000000180000 : "u-boot-env"
[    1.710888] 0x000000180000-0x000000380000 : "Factory"
[    1.717692] 0x000000380000-0x0000003c0000 : "bdinfo"
[    1.723633] 0x0000003c0000-0x0000005c0000 : "FIP"
[    1.729841] 0x0000005c0000-0x0000045c0000 : "ubi"
[    1.764973] ubi0: default fastmap pool size: 25
[    1.769507] ubi0: default fastmap WL pool size: 12
[    1.774324] ubi0: attaching mtd5
[    1.788650] ubi0 error: 0xffffffc0805ded9c: bad image sequence number 1791277016 in PEB 26, expected 908025214
[    1.798669] Erase counter header dump:
[    1.802415]  magic          0x55424923
[    1.806152]  version        1
[    1.809106]  ec             6
[    1.812068]  vid_hdr_offset 2048
[    1.815284]  data_offset    4096
[    1.818499]  image_seq      1791277016
[    1.822239]  hdr_crc        0xda667af
[    1.825888] erase counter header hexdump:
[    1.829892] 00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 06 00 00 08 00 00 00 10 00 6a c4 b7 d8 00 00 00 00  UBI#....................j.......
[    1.843437] 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d a6 67 af  ..............................g.
[    1.856991] ubi0 error: 0xffffffc0805d244c: failed to attach mtd5, error -22
[    1.991571] mtk_soc_eth 15100000.ethernet: generated random MAC address 65:74:68:25:64:00
[    2.000025] mtk_soc_eth 15100000.ethernet: generated random MAC address 65:74:68:25:64:00
[    2.262954] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081280000, irq 75
[    2.272896] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081280000, irq 75
[    2.282707] i2c_dev: i2c /dev entries driver
[    2.288858] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    2.298065] NET: Registered PF_INET6 protocol family
[    2.304178] Segment Routing with IPv6
[    2.307867] In-situ OAM (IOAM) with IPv6
[    2.311855] NET: Registered PF_PACKET protocol family
[    2.316924] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.330182] 8021q: 802.1Q VLAN Support v1.8
[    2.456928] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    2.465935] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    2.476697] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    2.499691] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    2.521775] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    2.543896] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=82)
[    2.555513] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    2.562286] DSA: tree 0 setup
[    2.565651] UBI error: cannot open mtd ubi0, error -2
[    2.570855] clk: Disabling unused clocks
[    2.575363] Freeing unused kernel memory: 448K
[    2.579882] Run /init as init process
[    2.583533]   with arguments:
[    2.586486]     /init
[    2.588747]   with environment:
[    2.591881]     HOME=/
[    2.594229]     TERM=linux
[    2.596923]     AC=300
[    2.814749] init: Console is alive
[    2.818303] init: - watchdog -
[    2.826219] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.836519] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.847121] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.862260] init: - preinit -
[    2.968174] mtk_soc_eth 15100000.ethernet wan: renamed from eth1
[    3.011273] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.021310] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.039834] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.248418] random: procd: uninitialized urandom read (4 bytes read)
[    7.251169] procd: - early -
[    7.257819] procd: - watchdog -
[    7.793225] procd: - watchdog -
[    7.796536] procd: - ubus -
[   14.569530] random: crng init done
[   14.575776] procd: - init -
Please press Enter to activate this console.
[   14.765454] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.784113] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   14.798781] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   14.806349] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   14.975809] urngd: v1.0.2 started.
[   15.159700] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823161240a
[   15.159700]
[   15.181831] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823161304
[   15.224259] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823161841
[   15.321840] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   15.328608] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7981_eeprom_mt7976_dbdc.bin failed with error -2
[   15.339757] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7981_eeprom_mt7976_dbdc.bin
[   15.376696] mt798x-wmac: probe of 18000000.wifi failed with error -12
[   15.403337] PPP generic driver version 2.4.2
[   15.408410] NET: Registered PF_PPPOX protocol family
[   15.416109] kmodloader: done loading kernel modules from /etc/modules.d/*
[   21.461173] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   21.488119] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   21.498502] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   21.514798] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[   21.527304] br-lan: port 1(lan1) entered blocking state
[   21.532653] br-lan: port 1(lan1) entered disabled state
[   21.537905] mt7530-mdio mdio-bus:1f lan1: entered allmulticast mode
[   21.544233] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
[   21.554218] mt7530-mdio mdio-bus:1f lan1: entered promiscuous mode
[   21.577582] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   21.586414] br-lan: port 2(lan2) entered blocking state
[   21.591737] br-lan: port 2(lan2) entered disabled state
[   21.597002] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
[   21.612461] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
[   21.631065] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   21.643511] br-lan: port 3(lan3) entered blocking state
[   21.648746] br-lan: port 3(lan3) entered disabled state
[   21.654080] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
[   21.663921] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
[   21.704093] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   21.718599] br-lan: port 4(lan4) entered blocking state
[   21.723918] br-lan: port 4(lan4) entered disabled state
[   21.729174] mt7530-mdio mdio-bus:1f lan4: entered allmulticast mode
[   21.741212] mt7530-mdio mdio-bus:1f lan4: entered promiscuous mode
[   21.999620] mtk_soc_eth 15100000.ethernet wan: validation of  with support 00,00000000,00000000,00006000 and advertisement 00,00000000,00000000,00000000 failed: -EINVAL
[   22.249532] mtk_soc_eth 15100000.ethernet wan: mtk_open: could not attach PHY: -22
[   24.443800] mt7530-mdio mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[   24.443838] br-lan: port 2(lan2) entered blocking state
[   24.456944] br-lan: port 2(lan2) entered forwarding state

Do you have web firmware update file from OEM/provider? Souce code? It is kind of important later to make it usable for masses…

Yes, it is the original Firmware: https://static.tp-link.com/upload/firmware/2025/202508/20250821/EX520_0.5.0%203.0.0%20v60b4.0%20Build%20250730%20Rel.72230n.rar

I think the Cudy WR3000H was the closest, as it recognized all 5 ports on the router, but none of them detected the Wi-Fi...

What are the next steps?

brada4 · October 16, 2025, 5:14pm

OK, do not program anything. You need to alter that cudy to partitions in OEM boot log, back them up and try to find the rest - MAC address, LED GPIOs, wifi calibration (after wifi mac usually) etc. (And patiently waiting for somebody smarter to guide you ahead…..)

EDIT: you dont need OEM OS - you can try backing up MTD/UBI parts to tftp from uboot

And then again from edited OpenWrt…

OEM DTS is a bit weird, first it is flat long file without includes then some labeled values come back as hex and you need to guess/infer/match to openwrt or mainline dts(s)-s.

usuariomega · October 16, 2025, 6:58pm

Okay, I don’t know how to backing up MTD/UBI parts to from u-boot, what’s the command?

I went to u-boot and typed some commands. See the log below.

MT7981> nand list
List of NAND devices:
* spi-nand0
  - device: spi_nand@0
  - parent: spi@1100a000
  - driver: spi_nand
  - type: NAND flash
  - block size:        0x20000 bytes
  - page size:         0x800 bytes
  - OOB size:          64 bytes
  - OOB available:     24 bytes
  - 0x000000000000-0x000008000000 : "spi-nand0"
  
  
MT7981> printenv
addHver=0
baudrate=115200
bootargs=ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 AC=300
ethact=ethernet@15100000
ethaddr=32:cf:30:e9:28:9f
fdtcontroladdr=4ffc3260
filesize=10
flashmac=30:68:93:CB:F0:8F
functioncode=Country=BR:Region=BR:Language=pt_BR:TimeZone=-03:00:2_4G_C=1,2,3,4,5,6,7,8,9,10,11,12,13:5G_C=36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,144,149,153,157,161,165:2_4G_P=TARGET:5G_P=TARGET:
ipaddr=192.168.1.1
labelMac=30:68:93:CB:F0:8F
labelMacType=1
loadaddr=0x46000000
mtdids=nmbm0=nmbm0
mtdparts=nmbm0:2M(boot),1M(u-boot-env),6M(misc_ro),6M(misc_rw),40M(ubi0),40M(ubi1),6M(misc_rw_bak),6M(bflag),6M(misc_isp)
netmask=255.255.255.0
pin=17710381
platformVer=2768437248
productId=945460481
productVer=393396
serverip=192.168.1.2
sn=224B0N3007278
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
swRevision=1437204481

Environment size: 912/131068 bytes
MT7981>


MT7981> iminfo

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-5.4.211
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    3743703 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48080000
     Entry Point:  0x48080000
     Hash algo:    crc32
     Hash value:   b9c8a7f7
     Hash algo:    sha1
     Hash value:   3b838fd4ff26839fb73be4e82d5e6648a03ac223
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt EX520 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463921f8
     Data Size:    18476 Bytes = 18 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   87c42ac6
     Hash algo:    sha1
     Hash value:   9cbc5ca1c024f5ac0ef7ca9eb16fd890fc902cc3
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt
     Kernel:       kernel-1
     FDT:          fdt-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32 error!
Bad hash value for 'hash-1' hash node in 'kernel-1' image node
Bad hash in FIT image!


MT7981> bdinfo
boot_params = 0x0000000040000100
DRAM bank   = 0x0000000000000000
-> start    = 0x0000000040000000
-> size     = 0x0000000010000000
flashstart  = 0x0000000000000000
flashsize   = 0x0000000000000000
flashoffset = 0x0000000000000000
baudrate    = 115200 bps
relocaddr   = 0x000000004ff20000
reloc off   = 0x000000000e120000
Build       = 64-bit
current eth = ethernet@15100000
ethaddr     = 32:cf:30:e9:28:9f
IP addr     = 192.168.1.1
fdt_blob    = 0x000000004ffc3260
new_fdt     = 0x0000000000000000
fdt_size    = 0x0000000000000000
lmb_dump_all:
 memory.cnt  = 0x1
 memory[0]      [0x40000000-0x4fffffff], 0x10000000 bytes flags: 0
 reserved.cnt  = 0x1
 reserved[0]    [0x4f7fb160-0x4fffffff], 0x00804ea0 bytes flags: 0
devicetree  = embed
arch_number = 0x0000000000000000
TLB addr    = 0x000000004fff0000
irq_sp      = 0x000000004f7ffd80
sp start    = 0x000000004f7ffd80
Early malloc usage: 6c8 / 4000


MT7981> sf probe
spi-nand: spi_nand spi_nand@0: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
MT7981>

I also tried reading something with a nand dump, but I don't know how to save it or convert it to a file...

MT7981> nand dump 0x900
Dump of page at 0x800:
00000800: 4d 4d 4d 01  38 00 00 00  46 49 4c 45  5f 49 4e 46  MMM.8...FILE_INF
00000810: 4f 00 00 00  01 00 00 00  01 00 02 01  00 0d 20 00  O............. .
00000820: f4 87 01 00  f4 8f 01 00  00 03 00 00  20 00 00 00  ............ ...
00000830: 00 03 00 00  01 00 00 00  4d 4d 4d 01  0c 00 01 00  ........MMM.....
00000840: 01 00 00 00  4d 4d 4d 01  14 00 02 00  00 00 00 00  ....MMM.........
00000850: 10 00 00 00  80 00 00 00  4d 4d 4d 01  14 02 03 00  ........MMM.....
00000860: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000870: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000880: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000890: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008a0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008b0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008c0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008d0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008e0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000008f0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000900: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000910: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000920: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000930: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000940: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000950: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000960: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000970: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000980: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000990: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009a0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009b0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009c0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009d0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009e0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
000009f0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a00: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a10: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a20: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a30: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a40: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a50: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a60: 00 00 00 00  00 00 00 00  00 00 00 00  4d 4d 4d 03  ............MMM.
00000a70: 64 00 07 00  90 11 00 00  00 00 00 00  00 00 00 00  d...............
00000a80: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000a90: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000aa0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000ab0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000ac0: 00 64 00 00  88 13 00 00  00 00 00 00  00 00 00 00  .d..............
00000ad0: 4d 4d 4d 01  30 00 08 00  03 00 00 00  00 00 00 00  MMM.0...........
00000ae0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000af0: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
00000b00: 20 00 00 10  81 00 80 d2  04 00 01 cb  e0 02 00 58   ..............X
00000b10: 1f 00 04 eb  40 01 00 54  80 02 00 58  e1 03 04 aa  ....@..T...X....
00000b20: 82 02 00 58  23 00 40 f9  03 00 00 f9  00 20 00 91  ...X#.@...... ..
00000b30: 21 20 00 91  1f 00 02 eb  6b ff ff 54  e0 01 00 58  ! ......k..T...X
00000b40: 01 02 00 58  1f 00 00 f9  00 20 00 91  1f 00 01 eb  ...X..... ......
00000b50: ab ff ff 54  a0 01 00 58  1f 00 00 91  e0 03 04 aa  ...T...X........
00000b60: 81 01 00 58  20 00 1f d6  00 00 10 00  00 00 00 00  ...X ...........
00000b70: 8c 25 10 00  00 00 00 00  90 25 10 00  00 00 00 00  .%.......%......
00000b80: 40 a2 10 00  00 00 00 00  f0 ff 10 00  00 00 00 00  @...............
00000b90: ec 04 10 00  00 00 00 00  fd 7b bf a9  fd 03 00 91  .........{......
00000ba0: 1d 00 00 94  fd 7b c1 a8  00 00 80 52  2f 00 00 14  .....{.....R/...
00000bb0: 01 00 84 d2  01 20 a2 f2  21 50 00 91  20 c0 1e b8  ..... ..!P.. ...
00000bc0: 20 00 40 b9  00 04 1b 12  1f 80 01 71  a1 ff ff 54   .@........q...T
00000bd0: c0 03 5f d6  00 11 90 d2  00 00 a2 f2  01 00 40 b9  .._...........@.
00000be0: 00 00 00 d0  02 a4 45 b9  5f 00 01 6b  02 00 00 d0  ......E._..k....
00000bf0: 89 00 00 54  43 a0 45 b9  63 04 00 11  43 a0 05 b9  ...TC.E.c...C...
00000c00: 01 a4 05 b9  e1 03 01 2a  40 a0 45 b9  20 80 00 aa  .......*@.E. ...
00000c10: c0 03 5f d6  00 10 90 d2  61 0c 80 52  00 00 a2 f2  .._.....a..R....
00000c20: 01 00 00 b9  00 00 00 d0  1f a0 05 b9  00 00 00 d0  ................
00000c30: 1f a4 05 b9  c0 03 5f d6  e4 03 00 2a  fd 7b bf a9  ......_....*.{..
00000c40: fd 03 00 91  e4 ff ff 97  81 02 80 52  84 00 a1 9b  ...........R....
00000c50: 84 04 00 91  e0 ff ff 97  1f 00 04 eb  c3 ff ff 54  ...............T
00000c60: fd 7b c1 a8  c0 03 5f d6  fd 7b ba a9  fd 03 00 91  .{...._..{......
00000c70: f9 6b 04 a9  9a 41 9c d2  3a 00 a2 f2  fb 2b 00 f9  .k...A..:....+..
00000c80: fb 03 00 2a  40 03 40 b9  99 43 9c d2  f3 53 01 a9  ...*@.@..C...S..
00000c90: 39 00 a2 f2  00 00 00 32  f5 5b 02 a9  96 49 9c d2  9......2.[...I..
00000ca0: 36 00 a2 f2  f7 63 03 a9  98 45 9c d2  38 00 a2 f2  6....c...E..8...
00000cb0: 40 03 00 b9  97 47 9c d2  37 00 a2 f2  95 4b 9c d2  @....G..7....K..
00000cc0: 20 03 40 b9  35 00 a2 f2  14 51 9c d2  13 4e 9c d2   .@.5....Q...N..
00000cd0: 00 00 00 32  20 03 00 b9  34 00 a2 f2  33 00 a2 f2  ...2 ...4...3...
00000ce0: 00 03 40 b9  00 00 00 32  00 03 00 b9  e0 02 40 b9  ..@....2......@.
00000cf0: 00 00 00 32  e0 02 00 b9  c0 02 40 b9  00 00 00 32  ...2......@....2
00000d00: c0 02 00 b9  a0 02 40 b9  00 00 00 32  a0 02 00 b9  ......@....2....
00000d10: 80 02 40 b9  00 00 00 32  80 02 00 b9  60 02 40 b9  ..@....2....`.@.
00000d20: 00 00 00 32  60 02 00 b9  20 00 80 52  c3 ff ff 97  ...2`... ..R....
00000d30: 40 03 40 b9  02 40 9c d2  22 00 a2 f2  01 40 b0 52  @.@..@.."....@.R
00000d40: 00 78 1e 12  40 03 00 b9  83 22 80 52  85 24 80 52  .x..@....".R.$.R
00000d50: 20 03 40 b9  84 28 80 52  00 78 1e 12  20 03 00 b9   .@..(.R.x.. ...
00000d60: 00 03 40 b9  00 78 1e 12  00 03 00 b9  e0 02 40 b9  ..@..x........@.
00000d70: 00 78 1e 12  e0 02 00 b9  17 42 9c d2  c0 02 40 b9  .x.......B....@.
00000d80: 37 00 a2 f2  00 78 1e 12  c0 02 00 b9  16 44 9c d2  7....x.......D..
00000d90: a0 02 40 b9  36 00 a2 f2  00 78 1e 12  a0 02 00 b9  ..@.6....x......
00000da0: 15 48 9c d2  80 02 40 b9  35 00 a2 f2  00 78 1e 12  .H....@.5....x..
00000db0: 80 02 00 b9  14 4a 9c d2  60 02 40 b9  34 00 a2 f2  .....J..`.@.4...
00000dc0: 00 78 1e 12  60 02 00 b9  80 40 9c d2  13 4c 9c d2  .x..`....@...L..
00000dd0: 20 00 a2 f2  33 00 a2 f2  01 00 00 b9  41 00 40 b9   ...3.......A.@.
00000de0: 21 00 03 2a  41 00 00 b9  01 46 9c d2  e0 02 40 b9  !..*A....F....@.
00000df0: 21 00 a2 f2  00 00 03 2a  e0 02 00 b9  83 26 80 52  !......*.....&.R
00000e00: c0 02 40 b9  00 00 05 2a  c0 02 00 b9  20 00 40 b9  ..@....*.... .@.
00000e10: 00 00 03 2a  20 00 00 b9  a0 02 40 b9  00 00 04 2a  ...* .....@....*
00000e20: a0 02 00 b9  84 20 80 52  80 02 40 b9  00 00 04 2a  ..... .R..@....*
00000e30: 80 02 00 b9  00 4f 9c d2  20 00 a2 f2  04 00 40 b9  .....O.. .....@.
00000e40: 84 00 03 2a  04 00 00 b9  63 02 40 b9  63 00 05 2a  ...*....c.@.c..*
00000e50: 63 02 00 b9  43 00 40 b9  63 00 00 32  43 00 00 b9  c...C.@.c..2C...
00000e60: e2 02 40 b9  42 00 00 32  e2 02 00 b9  c2 02 40 b9  ..@.B..2......@.
00000e70: 42 00 00 32  c2 02 00 b9  22 00 40 b9  42 00 00 32  B..2....".@.B..2
00000e80: 22 00 00 b9  a1 02 40 b9  21 00 00 32  a1 02 00 b9  ".....@.!..2....
00000e90: 81 02 40 b9  21 00 00 32  81 02 00 b9  01 00 40 b9  ..@.!..2......@.
00000ea0: 21 00 00 32  01 00 00 b9  60 02 40 b9  00 00 00 32  !..2....`.@....2
00000eb0: 60 02 00 b9  80 02 80 52  60 ff ff 97  e0 02 40 b9  `......R`.....@.
00000ec0: 00 00 09 32  e0 02 00 b9  c0 02 40 b9  00 00 09 32  ...2......@....2
00000ed0: c0 02 00 b9  a0 02 40 b9  00 00 09 32  a0 02 00 b9  ......@....2....
00000ee0: 80 02 40 b9  00 00 09 32  80 02 00 b9  60 02 40 b9  ..@....2....`.@.
00000ef0: 00 00 09 32  60 02 00 b9  5b 01 00 35  81 07 80 d2  ...2`...[..5....
00000f00: 41 40 a3 f2  20 00 40 b9  00 00 1f 32  20 00 00 b9  A@.. .@....2 ...
00000f10: 80 00 82 d2  a1 00 80 52  00 00 a2 f2  01 00 00 b9  .......R........
00000f20: 01 c8 80 d2  42 02 80 52  01 08 a2 f2  f3 53 41 a9  ....B..R.....SA.
00000f30: 20 00 40 b9  f5 5b 42 a9  00 68 1b 12  00 00 02 2a   .@..[B..h.....*
00000f40: 02 00 81 52  f7 63 43 a9  02 60 a0 72  f9 6b 44 a9  ...R.cC..`.r.kD.
00000f50: fb 2b 40 f9  20 00 00 b9  00 f8 80 d2  00 08 a2 f2  .+@. ...........
00000f60: 01 00 40 b9  21 00 02 2a  01 00 00 b9  22 20 a0 52  ..@.!..*...." .R
00000f70: 01 00 40 b9  21 00 17 32  01 00 00 b9  80 00 96 d2  ..@.!..2........
00000f80: 21 20 80 52  20 00 a2 f2  01 00 00 b9  01 20 80 52  ! .R ........ .R
00000f90: 21 20 a0 72  01 10 00 b9  02 20 00 b9  82 06 96 d2  ! .r..... ......
00000fa0: 22 00 a2 f2  e0 c3 00 32  40 00 00 b9  41 10 00 b9  "......2@...A...
00000fb0: 81 0a 96 d2  21 00 a2 f2  20 00 00 b9  20 10 00 b9  ....!... ... ...
00000fc0: 20 20 00 b9  20 30 00 b9  00 38 96 d2  20 00 a2 f2    .. 0...8.. ...
00000fd0: 61 9c 9f 52  c1 ff af 72  01 00 00 b9  61 00 80 52  a..R...r....a..R
00000fe0: 01 04 00 b9  fd 7b c6 a8  c0 03 5f d6  fd 7b bd a9  .....{...._..{..
00000ff0: fd 03 00 91  f3 53 01 a9  f4 03 00 aa  e7 fe ff 97  .....S..........

OOB:
00000000: ff ff ff ff  ff ff ff ff  a5 96 a5 aa  aa aa ff ff  ................
00000010: ff ff ff ff  ff ff ff ff  a5 56 55 a9  a9 a9 ff ff  .........VU.....
00000020: ff ff ff ff  ff ff ff ff  33 00 cf ff  ff ff fc ff  ........3.......
00000030: ff ff ff ff  ff ff ff ff  95 65 65 a5  a5 a5 fc ff  .........ee.....
MT7981>
MT7981> nand dump 0x1000
Dump of page at 0x1000:
00001000: 01 f8 ff d0  21 30 16 91  21 7c 40 92  40 88 89 52  ....!0..!|@.@..R
00001010: 33 00 14 8b  40 06 aa 72  21 68 74 b8  3f 00 00 6b  3...@..r!ht.?..k
00001020: a0 00 00 54  00 00 00 d0  00 90 13 91  27 07 00 94  ...T........'...
00001030: 00 00 00 14  60 06 40 b9  01 ff bf 12  00 00 48 51  ....`.@.......HQ
00001040: 1f 00 01 6b  a9 00 00 54  00 00 00 d0  00 00 14 91  ...k...T........
00001050: 1e 07 00 94  f7 ff ff 17  62 0a 40 b9  5f 00 41 71  ........b.@._.Aq
00001060: a9 00 00 54  00 00 00 d0  00 88 14 91  17 07 00 94  ...T............
00001070: f0 ff ff 17  00 05 a0 52  00 00 02 4b  61 42 00 91  .......R...KaB..
00001080: 00 ec 7c 92  e2 03 02 2a  e0 13 00 f9  a2 07 00 94  ..|....*........
00001090: 61 0a 40 b9  04 00 00 d0  73 06 40 b9  03 01 a0 52  a.@.....s.@....R
000010a0: 05 0f 8f d2  63 00 01 4b  84 a0 26 91  e2 a3 00 91  ....c..K..&.....
000010b0: e0 83 00 91  e1 03 01 2a  f3 17 00 f9  2d 07 00 94  .......*....-...
000010c0: 80 fb ff 35  60 02 3f d6  da ff ff 17  03 00 40 b9  ...5`.?.......@.
000010d0: 04 e0 bf 12  7f 00 04 6b  68 01 00 54  63 5c 18 53  .......kh..Tc\.S
000010e0: 03 00 00 b9  03 0c 40 f9  05 08 40 f9  66 04 00 91  ......@...@.f...
000010f0: 06 0c 00 f9  04 04 40 b9  a3 68 63 38  63 20 04 0b  ......@..hc8c ..
00001100: 03 04 00 b9  03 00 40 b9  25 00 40 79  64 7c 0b 53  ......@.%.@yd|.S
00001110: 86 7c 05 1b  04 04 40 b9  df 00 04 6b  e9 05 00 54  .|....@....k...T
00001120: 03 00 81 52  63 00 05 4b  06 00 00 b9  a5 14 83 0b  ...Rc..K........
00001130: 83 00 80 d2  62 50 22 8b  25 00 00 79  21 00 02 8b  ....bP".%..y!...
00001140: 42 00 80 52  05 01 80 52  02 90 00 b9  22 00 80 52  B..R...R...."..R
00001150: 09 e0 bf 12  0a 00 81 52  03 00 40 b9  28 44 22 8b  .......R..@.(D".
00001160: 7f 00 09 6b  68 01 00 54  63 5c 18 53  03 00 00 b9  ...kh..Tc\.S....
00001170: 03 0c 40 f9  06 08 40 f9  67 04 00 91  07 0c 00 f9  ..@...@.g.......
00001180: 04 04 40 b9  c3 68 63 38  63 20 04 0b  03 04 00 b9  ..@..hc8c ......
00001190: 07 18 40 29  42 78 1f 53  03 01 40 79  e4 7c 0b 53  ..@)Bx.S..@y.|.S
000011a0: 84 7c 03 1b  9f 00 06 6b  e9 06 00 54  04 00 00 b9  .|.....k...T....
000011b0: 44 01 03 4b  63 14 84 0b  03 01 00 79  bf 00 02 6b  D..Kc......y...k
000011c0: c8 fc ff 54  01 90 40 b9  21 00 05 4b  22 00 02 0b  ...T..@.!..K"...
000011d0: 02 90 00 b9  c0 03 5f d6  63 00 06 4b  84 00 06 4b  ......_.c..K...K
000011e0: 03 10 00 29  a5 14 45 4b  25 00 00 79  05 e0 bf 12  ...)..EK%..y....
000011f0: 7f 00 05 6b  48 01 00 54  63 5c 18 53  03 00 00 b9  ...kH..Tc\.S....
00001200: 03 0c 40 f9  05 08 40 f9  66 04 00 91  06 0c 00 f9  ..@...@.f.......
00001210: a3 68 63 38  64 20 04 0b  04 04 00 b9  06 14 40 29  .hc8d ........@)
00001220: 23 04 40 79  c4 7c 0b 53  84 7c 03 1b  9f 00 05 6b  #.@y.|.S.|.....k
00001230: 69 01 00 54  42 7c 7c d3  04 00 00 b9  04 00 81 52  i..TB||........R
00001240: 84 00 03 4b  42 10 04 91  63 14 84 0b  23 04 00 79  ...KB...c...#..y
00001250: 21 00 02 8b  42 01 80 52  bb ff ff 17  c6 00 04 4b  !...B..R.......K
00001260: a4 00 04 4b  06 10 00 29  63 14 43 4b  23 04 00 79  ...K...)c.CK#..y
00001270: 42 02 80 52  05 20 80 52  21 10 08 91  02 90 00 b9  B..R. .R!.......
00001280: b3 ff ff 17  e7 00 04 4b  c4 00 04 4b  07 10 00 29  .......K...K...)
00001290: 63 14 43 4b  42 04 00 11  03 01 00 79  c8 ff ff 17  c.CKB......y....
000012a0: 03 0c 40 f9  e6 03 02 2a  df 00 03 eb  c2 04 00 54  ..@....*.......T
000012b0: 03 30 40 b9  7f 00 02 6b  69 04 00 54  23 00 40 b9  .0@....ki..T#.@.
000012c0: 05 08 40 f9  02 10 40 f9  e4 03 03 2a  42 00 05 cb  ..@...@....*B...
000012d0: 5f 00 04 eb  42 90 84 9a  df 00 05 eb  e4 03 02 2a  _...B..........*
000012e0: 62 00 02 4b  22 00 00 b9  a1 04 00 d1  21 00 06 cb  b..K".......!...
000012f0: 63 00 00 54  02 14 40 f9  21 00 02 8b  03 08 40 f9  c..T..@.!.....@.
00001300: 22 04 00 91  05 00 40 f9  66 04 00 91  06 08 00 f9  ".....@.f.......
00001310: a1 68 61 38  a1 68 23 38  01 14 40 f9  3f 00 02 eb  .ha8.h#8..@.?...
00001320: 41 10 9f 9a  84 04 00 71  a1 fe ff 54  01 08 41 a9  A......q...T..A.
00001330: 5f 00 01 eb  42 00 00 54  01 0c 00 f9  20 00 80 52  _...B..T.... ..R
00001340: 02 00 00 14  00 00 80 52  c0 03 5f d6  0c a0 00 91  .......R.._.....
00001350: fd 7b bf a9  eb 03 00 aa  fd 03 00 91  81 09 40 f9  .{............@.
00001360: 80 11 40 f9  3f 00 00 eb  e2 00 00 54  60 91 40 b9  ..@.?......T`.@.
00001370: a0 00 00 34  62 7d 40 b9  61 41 02 91  e0 03 0c aa  ...4b}@.aA......
00001380: c8 ff ff 97  0e e0 bf 12  0f 00 81 52  2d 00 80 52  ...........R-..R
00001390: 86 09 40 f9  81 11 40 f9  60 01 40 b9  df 00 01 eb  ..@...@.`.@.....
000013a0: 82 00 00 54  61 89 41 a9  3f 00 02 eb  e9 01 00 54  ...Ta.A.?......T
000013b0: 01 e0 bf 12  1f 00 01 6b  48 01 00 54  62 05 41 a9  .......kH..Tb.A.
000013c0: 00 5c 18 53  60 01 00 b9  60 05 40 b9  23 04 00 91  .\.S`...`.@.#...
000013d0: 63 0d 00 f9  41 68 61 38  20 20 00 0b  60 05 00 b9  c...Aha8  ..`...
000013e0: 20 00 80 52  fb 00 00 14  62 9d 40 b9  1f 00 0e 6b   ..R....b.@....k
000013f0: 67 8d 40 b9  42 00 06 0a  48 01 00 54  00 5c 18 53  g.@.B...H..T.\.S
00001400: 60 01 00 b9  60 09 40 f9  24 04 00 91  64 0d 00 f9  `...`.@.$...d...
00001410: 63 05 40 b9  00 68 61 38  00 20 03 0b  60 05 00 b9  c.@..ha8. ..`...
00001420: e0 03 07 2a  e5 03 02 2a  61 01 40 b9  a5 10 00 8b  ...*...*a.@.....
00001430: 65 05 05 8b  23 7c 0b 53  a4 40 41 79  68 7c 04 1b  e...#|.S.@Ayh|..
00001440: 63 05 40 b9  1f 01 03 6b  69 11 00 54  e0 01 04 4b  c.@....ki..T...K
00001450: 68 01 00 b9  c2 04 00 d1  84 14 80 0b  a4 40 01 79  h............@.y
00001460: a6 07 00 b5  80 15 40 f9  00 04 00 d1  84 0d 40 f9  ......@.......@.
00001470: 64 07 00 b4  81 01 40 f9  21 68 60 38  65 81 52 29  d.....@.!h`8e.R)
00001480: ff 18 00 71  00 00 06 8a  03 20 c5 9a  00 01 80 52  ...q..... .....R
00001490: 00 00 05 4b  20 24 c0 1a  00 00 03 0b  01 c0 80 52  ...K $.........R
000014a0: 00 2c a1 9b  00 30 3c 91  c8 06 00 54  21 00 80 52  .,...0<....T!..R
000014b0: 62 01 40 b9  26 7c 7f d3  5f 00 0e 6b  68 01 00 54  b.@.&|.._..kh..T
000014c0: 42 5c 18 53  62 01 00 b9  62 0d 40 f9  64 09 40 f9  B\.Sb...b.@.d.@.
000014d0: 45 04 00 91  65 0d 00 f9  63 05 40 b9  82 68 62 38  E...e...c.@..hb8
000014e0: 42 20 03 0b  62 05 00 b9  65 11 40 29  21 78 1f 53  B ..b...e.@)!x.S
000014f0: 02 68 66 78  a3 7c 0b 53  63 7c 02 1b  7f 00 04 6b  .hfx.|.Sc|.....k
00001500: 29 03 00 54  63 01 00 b9  e3 01 02 4b  42 14 83 0b  )..Tc......KB...
00001510: 02 68 26 78  3f fc 03 71  c9 fc ff 54  82 01 40 f9  .h&x?..q...T..@.
00001520: 80 09 40 f9  03 04 00 91  83 09 00 f9  41 68 20 38  ..@.........Ah 8
00001530: 80 05 41 a9  3f 00 00 eb  42 00 00 54  80 0d 00 f9  ..A.?...B..T....
00001540: 60 8d 40 b9  1f 0c 00 71  a8 08 00 54  7f 8d 00 b9  `.@....q...T....
00001550: 90 ff ff 17  e0 03 02 aa  c5 ff ff 17  01 00 80 52  ...............R
00001560: c7 ff ff 17  a5 00 03 4b  83 00 03 4b  65 0d 00 29  .......K...Ke..)
00001570: 42 14 42 4b  21 04 00 11  02 68 26 78  e6 ff ff 17  B.BK!....h&x....
00001580: 63 7d 40 b9  41 00 03 cb  df 00 03 eb  68 00 00 54  c}@.A.......h..T
00001590: 82 15 40 f9  21 00 02 8b  e4 04 00 b4  82 01 40 f9  ..@.!.........@.
000015a0: 44 68 61 38  84 78 1f 53  06 20 80 52  21 00 80 52  Dha8.x.S. .R!..R
000015b0: 89 00 06 0a  c2 00 01 0b  42 00 09 0b  63 01 40 b9  ........B...c.@.
000015c0: 84 78 1f 53  42 f8 7f d3  7f 00 0e 6b  68 01 00 54  .x.SB......kh..T
000015d0: 63 5c 18 53  63 01 00 b9  63 0d 40 f9  67 09 40 f9  c\.Sc...c.@.g.@.
000015e0: 68 04 00 91  68 0d 00 f9  65 05 40 b9  e3 68 63 38  h...h...e.@..hc8
000015f0: 63 20 05 0b  63 05 00 b9  68 1d 40 29  21 78 1f 53  c ..c...h.@)!x.S
00001600: 03 68 62 78  05 7d 0b 53  a5 7c 03 1b  bf 00 07 6b  .hbx.}.S.|.....k
00001610: 69 01 00 54  65 01 00 b9  e5 01 03 4b  c6 00 29 0a  i..Te......K..).
00001620: 63 14 85 0b  03 68 22 78  3f fc 03 71  29 fc ff 54  c....h"x?..q)..T
00001630: bb ff ff 17  04 00 80 52  db ff ff 17  08 01 05 4b  .......R.......K
00001640: e5 00 05 4b  68 15 00 29  63 14 43 4b  21 04 00 11  ...Kh..)c.CK!...
00001650: e6 03 09 2a  03 68 22 78  f4 ff ff 17  02 18 00 51  ...*.h"x.......Q
00001660: 01 0c 00 51  1f 28 00 71  20 30 82 1a  60 8d 00 b9  ...Q.(.q 0..`...
00001670: 48 ff ff 17  21 00 08 4b  63 00 08 4b  61 0d 00 29  H...!..Kc..Ka..)
00001680: 84 14 44 4b  a4 40 01 79  3f 00 0e 6b  48 01 00 54  ..DK.@.y?..kH..T
00001690: 21 5c 18 53  61 01 00 b9  61 0d 40 f9  64 09 40 f9  !\.Sa...a.@.d.@.
000016a0: 26 04 00 91  66 0d 00 f9  81 68 61 38  23 20 03 0b  &...f....ha8# ..
000016b0: 63 05 00 b9  60 05 00 8b  61 01 40 b9  04 40 44 79  c...`...a.@..@Dy
000016c0: 23 7c 0b 53  66 7c 04 1b  63 05 40 b9  df 00 03 6b  #|.Sf|..c.@....k
000016d0: 09 19 00 54  e1 01 04 4b  ff 1c 00 71  66 01 00 b9  ...T...K...qf...
000016e0: 84 14 81 0b  41 01 80 52  04 40 04 79  e0 00 80 52  ....A..R.@.y...R
000016f0: 00 30 81 1a  60 8d 00 b9  60 85 40 b9  61 11 1c 91  .0..`...`.@.a...
00001700: 60 89 00 b9  60 81 40 b9  60 85 00 b9  60 7d 40 b9  `...`.@.`...`}@.
00001710: 60 81 00 b9  e0 03 0b aa  6d fe ff 97  60 91 40 b9  `.......m...`.@.
00001720: a1 00 80 52  1f 14 00 71  01 90 81 1a  20 00 80 52  ...R...q.... ..R
00001730: 21 08 00 51  21 20 00 91  21 e0 79 d3  62 01 40 b9  !..Q! ..!.y.b.@.
00001740: 26 44 20 8b  5f 00 0e 6b  68 01 00 54  42 5c 18 53  &D ._..kh..TB\.S
00001750: 62 01 00 b9  62 0d 40 f9  64 09 40 f9  45 04 00 91  b...b.@.d.@.E...
00001760: 65 0d 00 f9  63 05 40 b9  82 68 62 38  42 20 03 0b  e...c.@..hb8B ..
00001770: 62 05 00 b9  65 11 40 29  00 78 1f 53  62 69 66 78  b...e.@).x.Sbifx
00001780: a3 7c 0b 53  63 7c 02 1b  7f 00 04 6b  69 02 00 54  .|.Sc|.....ki..T
00001790: 63 01 00 b9  e3 01 02 4b  42 14 83 0b  62 69 26 78  c......KB...bi&x
000017a0: 1f fc 00 71  c9 fc ff 54  00 00 01 51  1f 0c 00 71  ...q...T...Q...q
000017b0: 28 02 00 54  60 7d 00 b9  62 7d 40 b9  61 41 02 91  (..T`}..b}@.aA..
000017c0: e0 03 0c aa  b7 fe ff 97  00 1c 00 72  21 de ff 54  ...........r!..T
000017d0: fd 7b c1 a8  c0 03 5f d6  a5 00 03 4b  83 00 03 4b  .{...._....K...K
000017e0: 65 0d 00 29  42 14 42 4b  00 04 00 11  62 69 26 78  e..)B.BK....bi&x
000017f0: ec ff ff 17  01 00 00 12  02 7c 01 53  21 08 00 11  .........|.S!...

OOB:
00000000: ff ff ff ff  ff ff ff ff  f3 ff 30 ff  ff ff ff ff  ..........0.....
00000010: ff ff ff ff  ff ff ff ff  a6 69 66 a9  a9 a9 ff ff  .........if.....
00000020: ff ff ff ff  ff ff ff ff  55 a5 5a a6  a6 a6 fc ff  ........U.Z.....
00000030: ff ff ff ff  ff ff ff ff  fc fc f0 ff  ff ff ff ff  ................
MT7981>

Address goes from 0x800 to 0x7000000

brada4 · October 16, 2025, 8:14pm

Try binwalk ….

usuariomega · October 17, 2025, 2:22pm

Ok, I binwalked from the original firmware: https://static.tp-link.com/upload/firmware/2025/202508/20250821/EX520_0.5.0%203.0.0%20v60b4.0%20Build%20250730%20Rel.72230n.rar

Generated this files:

You can download it here: EX520.zip

Can someone verify the content and merge it with the Cudy WR3000H?
Or create an OpenWrt version based on the information I provided?

brada4 · October 17, 2025, 4:19pm

You are missing MAC addresses and likely wifi calibration data and partitions, probably LEDs, and WAN port is also way off. It is still a boring weekend or two to go.

JRD_McLAREN · October 19, 2025, 5:47pm

MAC address and wifi firmware are on the end of the flash. MTD7 and MTD8 partitions … probably ..

It is no a part of “stock firmware” …

You have to extract it from the flash …

Rafaelf · October 28, 2025, 12:29pm

Hello friend, I have the same TP-Link Ex520 Router, I would like to know if there is openwrt for this TP-Link Ex520 router

frollic · October 28, 2025, 2:09pm

Currently, no.

Rafaelf · October 28, 2025, 2:32pm

My TP-LINK EX520 router requires a stronger password with a secret letter, lowercase letters, and characters. Note: To ensure the security of your network, the password must contain secret letters, lowercase letters, digits (0-9), and special characters. Its length must be between 8 and 63. I've tried everything to use lowercase passwords, but it won't accept them at all; it only accepts lowercase letters. I like to use lowercase passwords. Is there a way to modify the firmware?

brada4 · October 28, 2025, 2:47pm

You can join the party here, towards working OpenWrt where you and not others set (password) rules. Or at least follow until a viable test release is out.

frollic · October 28, 2025, 2:50pm

Ok, and ?

You own one, we don't, you tell us.

You could try to mount the overlay from an initramfs, and manually modify the wifi password.

Rafaelf · October 28, 2025, 3:02pm

How could you explain it to me better?

Rafaelf · October 28, 2025, 3:13pm

How could you explain it to me better?

I live in Brazil the reason MY TP-LINK EX520 router requiring stronger password with lowercase and lowercase letter and character and because the Anatel telecommunications agency is demanding a new router security standard. TP-LINK updated the equipment on the TP-LINK website, the firmware description Modifications and Bug Fixes: Corrected the Wi-Fi password rule, as updated in Act nº 45, of January 2, 2025.