TP-Link RE220 v1

Hi,

I have a TP-Link RE-220 (US) marked Ver 1.8 on the label, which according to TP-Link is a V1. I saw the commit to support V2. Does anybody have information on whether the V2 build will work for V1, or what may have to be changed to support V1?

Thanks for any support.

Christoph

+1 for adding RE220 v1

Could use some help from those that wear the Ghengis Khan suit or the Wizard's hat.
I bought a refurb hoping to get v2, but got a v1.

Removing case is near impossible same case as the RE200

I ended up cutting away the case (front and back) on right edge of device about 1/3 the way down. I found four open pin holes, soldered in a head. Then I plugged cable into top 3 pins from top to bottom White, Green Black(GND) for my usb ttl adapter.

Shazam! got serial connection.

#1 Question, how do I stop the boot loader? It displays a menu, but just scrolls by like the "3" choice is hard coded.

U-Boot 1.1.3 (Jun 16 2019 - 20:09:21)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
Use New Uboot
Use New Uboot patch lock_dcache addiu $12, 0x1000
******************************
Software System Reset Occurred
******************************
flash manufacture id: 20, device id 70 17
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun 16 2019  Time:20:09:21
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 3
                                                                                                                                                 0

3: System Boot system code via Flash.
gpioMode1 Reg: 0x571504c4
gpioMode2 Reg: 0x5550555
tplink_turn_off_led
## Booting image at bc020000 ...
text base: 80000000
entry point: 8000c150
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c150) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.36 (jenkins@Sohoiipf) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Sun Jun 16 20:14:47 CST 2019

 The CPU feqenuce set to 580 MHz
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384

I was able to get to the boot loader command line.
Maybe setting control flow to none in putty helped, not sure. Maybe I just hit the key at the right time.

What info do I need to collect to make a working openwrt image for this device?

Here is what I have so far.

MT7628 # base
Base Address: 0x00000000
MT7628 # bdinfo
boot_params = 0x83F57FB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x00000000
flashsize   = 0x00800000
flashoffset = 0x00000000
ethaddr     = 00:00:AA:BB:CC:DD
ip_addr     = 192.168.0.254
baudrate    = 57600 bps


MT7628 # iminfo

## Checking Image at 82000000 ...
   Bad Magic Number

MT7628 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.0.254
serverip=192.168.0.184
stdin=serial
stdout=serial
stderr=serial
BootType=3

Environment size: 164/4092 bytes
MT7628 #

MT7628 # version

U-Boot 1.1.3 (Jun 16 2019 - 20:09:21)

let it boot, post the kernel output from serial.

I see the RE220v2 uses the same SoC, I'd try to create a v2 initramfs image, and boot it through uboot,
see if the device comes up all the way. If it does, figure out the device specific quirks.

1 Like

@frollic, your sage advice has hit pay dirt!

I downloaded this beauty and did the tftp dance.

after a tftpboot and bootm bootm 82000000, it appears to have booted the V2 initramfs image successfully. Can connect to ssh and luci over wired connection.

What can I do next to figure out the device specific quirks and head toward flashing an image?

MT7628 # tftpboot

 NetTxPacket = 0x83FE7840

 KSEG1ADDR(NetTxPacket) = 0xA3FE7840

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.0.184; our IP address is 192.168.0.254
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (28:f1:0e:02:34:29)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############Got ARP REQUEST, return our IP
##################################################
         #############################################################
done
Bytes transferred = 4971137 (4bda81 hex)
LoadAddr=82000000 NetBootFileXferSize= 004bda81
MT7628 # help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
nm      - memory modify (constant address)
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
spi     - spi command
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7628 # help bootm
bootm [addr [arg ...]]
    - boot application image stored in memory
        passing arguments 'arg ...'; when booting a Linux kernel,
        'arg' can be the address of an initrd image

MT7628 # bootm 82000000
## Booting image at 82000000 ...
text base: 80000000
entry point: 80000000
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.4.154 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16325-88151b8303)) #0 Sun Oct 24 09:01:35 2021
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link RE220 v2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00016fb0
[    0.000000] Readback ErrCtl register=00016fb0
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 54628K/65536K available (5088K kernel code, 204K rwdata, 636K rodata, 4044K init, 205K bss, 10908K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] random: get_random_bytes called from 0x805cda28 with crng_init=0
[    0.000000] CPU Clock: 580MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000009] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015403] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
[    0.059456] pid_max: default: 32768 minimum: 301
[    0.068758] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.083093] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.104316] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.123520] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.137022] pinctrl core: initialized pinctrl subsystem
[    0.150202] NET: Registered protocol family 16
[    0.263744] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.424573] PCI host bridge /pcie@10140000 ranges:
[    0.433910]  MEM 0x0000000020000000..0x000000002fffffff
[    0.444221]   IO 0x0000000010160000..0x000000001016ffff
[    0.477317] PCI host bridge to bus 0000:00
[    0.485365] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.498872] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    0.512458] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.525872] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.541579] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.553432] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.565787] pci 0000:00:00.0: reg 0x14: [mem 0x20200000-0x2020ffff]
[    0.578242] pci 0000:00:00.0: supports D1
[    0.586077] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.599218] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000
[    0.611046] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.623498] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.635672] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100
[    0.647480] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.659940] pci 0000:01:00.1: supports D1
[    0.667726] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold
[    0.681848] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.694829] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.707903] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.720942] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.734703] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.748118] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.761543] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.774956] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    0.788369] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.798172] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.811705] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.835712] clocksource: Switched to clocksource MIPS
[    0.846724] thermal_sys: Registered thermal governor 'step_wise'
[    0.847138] NET: Registered protocol family 2
[    0.867667] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.882709] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.899192] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.914261] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.928188] TCP: Hash tables configured (established 1024 bind 1024)
[    0.940895] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.953743] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.967858] NET: Registered protocol family 1
[    0.976440] PCI: CLS 80 bytes, default 32
[    1.475704] random: fast init done
[    6.165145] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    6.185857] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    6.197311] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    6.232537] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    6.250375] mt7621_gpio 10000600.gpio: registering 32 gpios
[    6.261611] mt7621_gpio 10000600.gpio: registering 32 gpios
[    6.272800] mt7621_gpio 10000600.gpio: registering 32 gpios
[    6.284074] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    6.299246] printk: console [ttyS0] disabled
[    6.307684] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    6.325499] printk: console [ttyS0] enabled
[    6.325499] printk: console [ttyS0] enabled
[    6.341973] printk: bootconsole [early0] disabled
[    6.341973] printk: bootconsole [early0] disabled
[    6.361949] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    6.391494] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    6.401233] 4 fixed-partitions partitions found on MTD device spi0.0
[    6.413817] Creating 4 MTD partitions on "spi0.0":
[    6.423311] 0x000000000000-0x000000020000 : "u-boot"
[    6.434249] 0x000000020000-0x0000007c0000 : "firmware"
[    6.447872] 2 tplink-fw partitions found on MTD device firmware
[    6.459628] Creating 2 MTD partitions on "firmware":
[    6.469472] 0x000000000000-0x0000000d5cdd : "kernel"
[    6.480459] 0x0000000e0000-0x0000007a0000 : "rootfs"
[    6.491370] mtd: device 3 (rootfs) set to be root filesystem
[    6.504762] 1 squashfs-split partitions found on MTD device rootfs
[    6.517135] 0x0000007c0000-0x0000007f0000 : "config"
[    6.528158] 0x0000007f0000-0x000000800000 : "radio"
[    6.539635] libphy: Fixed MDIO Bus: probed
[    6.560440] rt3050-esw 10110000.esw: link changed 0x00
[    6.572701] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    6.591126] NET: Registered protocol family 10
[    6.604582] Segment Routing with IPv6
[    6.612035] NET: Registered protocol family 17
[    6.620910] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    6.646579] 8021q: 802.1Q VLAN Support v1.8
[    6.679462] Freeing unused kernel memory: 4044K
[    6.688464] This architecture does not have kernel memory protection.
[    6.701211] Run /init as init process
[    7.238922] init: Console is alive
[    7.246087] init: - watchdog -
[    7.273977] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    7.293942] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.318849] init: - preinit -
[    7.579529] random: jshn: uninitialized urandom read (4 bytes read)
[    7.677550] random: jshn: uninitialized urandom read (4 bytes read)
[    7.747466] random: jshn: uninitialized urandom read (4 bytes read)
[    7.896927] rt3050-esw 10110000.esw: link changed 0x00
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   12.111979] procd: - early -
[   12.117865] procd: - watchdog -
[   12.713635] procd: - watchdog -
[   12.720369] procd: - ubus -
[   12.735521] urandom_read: 3 callbacks suppressed
[   12.735531] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.776061] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.789316] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.805332] procd: - init -
Please press Enter to activate this console.
[   13.467531] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.482929] rt3050-esw 10110000.esw: link changed 0x10
[   13.521543] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[   13.536614] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[   13.620414] xt_time: kernel timezone is -0000
[   13.751491] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   13.866933] urngd: v1.0.2 started.
[   14.073095] random: crng init done
[   14.079867] random: 1 urandom warning(s) missed due to ratelimiting
[   14.813192] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   14.824984] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   14.863759] mt76_wmac 10300000.wmac: firmware init done
[   15.119061] PPP generic driver version 2.4.2
[   15.149909] NET: Registered protocol family 24
[   15.220239] kmodloader: done loading kernel modules from /etc/modules.d/*
[  101.626474] rt3050-esw 10110000.esw: link changed 0x00
[  106.081594] rt3050-esw 10110000.esw: link changed 0x10
[  107.614196] br-lan: port 1(eth0) entered blocking state
[  107.624642] br-lan: port 1(eth0) entered disabled state
[  107.635385] device eth0 entered promiscuous mode
[  107.734112] br-lan: port 1(eth0) entered blocking state
[  107.744533] br-lan: port 1(eth0) entered forwarding state
[  108.615934] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

Check if everything is working as it should, port assignments, wifi, LEDs, etc...

If so, try to install the v2 image.

@frollic do you mean install v2 factory image via the serial connection command and tftp?

Here is an update...
Biggest issue:
In luci for re220 v1, only radio0 2.4GHz shows up, not 5GHz radio.
In re220 v2, you get both.

Regarding LEDs
I have a v2 device also. There is an error in the re220 v2 led naming.
there is a green:power that doesn't do anything afaik
there is a red:wifi2g that toggles the power led on the device.

running the v2 initramfs on a re220 v1 device, everything works the same for leds except that the green:power acts as a master switch for all leds. when on all are on selected ones are on, when off all are off.

Looking at the re220 v2 dts, it just has an include of an re200 dtsi. And it has this...

        led_power: power {
            label = "green:power";
            gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
        };

        wifi2g_red {
            label = "red:wifi2g";
            gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
        };

so for the re220 v2, should fork or override and change green:power to gpio 43 and delete red:wifi2g. I guess this would be fine for re220 v1 also.

On both versions, not sure if the wps button worked. The reset worked on both. It causes device to reboot.

Here is my script for led testing.

#!/bin/sh
# script to test leds

# RE220 LEDs listed top to bottom
# 5GHz
# 2.4GHz
# WIFI SIGNAL,  Solid Green Connected, Solid Red poor signal, Off no conn
# Ethernet
# Power On/Off, Blinking=startup
# WPS On=WPS working, Blink=WPS in progress, OFF=working 5min+ or failed

# Command lind's help message
helpMsg="
    Run
    usage: testleds [--help] mode
    mode options:
    allon turn all leds on
    alloff turn all leds off
    cycle  turn on each led one at a time 2s on time
    led    turn one led on or off.  Example  testleds led green:wifi on

"
# Tips message
tipsMsg0='Require params! Please input: testleds --help'
tipsMsg1='testing leds'

function setled {
case "$1" in
        on)
                echo 255 > /sys/devices/platform/leds/leds/green:wifi5g/brightness
                echo 255 > /sys/devices/platform/leds/leds/green:wifi2g/brightness
                echo 255 > /sys/devices/platform/leds/leds/red:wifi5g/brightness
                echo 255 > /sys/devices/platform/leds/leds/red:wifi2g/brightness
                echo 255 > /sys/devices/platform/leds/leds/green:wifi/brightness
                echo 255 > /sys/devices/platform/leds/leds/green:power/brightness
                echo 255 > /sys/devices/platform/leds/leds/green:lan/brightness
                echo 255 > /sys/devices/platform/leds/leds/green:wps/brightness
            ;;

        off)
                echo   0 > /sys/devices/platform/leds/leds/green:wifi5g/brightness
                echo   0 > /sys/devices/platform/leds/leds/green:wifi2g/brightness
                echo   0 > /sys/devices/platform/leds/leds/red:wifi5g/brightness
                echo   0 > /sys/devices/platform/leds/leds/red:wifi2g/brightness
                echo   0 > /sys/devices/platform/leds/leds/green:wifi/brightness
                echo   0 > /sys/devices/platform/leds/leds/green:power/brightness
                echo   0 > /sys/devices/platform/leds/leds/green:lan/brightness
                echo   0 > /sys/devices/platform/leds/leds/green:wps/brightness
            ;;

        *)
         exit 1
esac
}

function oneled {
echo one led
echo $1 $2

case "$2" in
        on)
                echo 255 > /sys/devices/platform/leds/leds/$1/brightness
            ;;

        off)
                echo   0 > /sys/devices/platform/leds/leds/$1/brightness
            ;;

        *)
        exit 1
esac
}

if [ $# -eq '0' ]
    then
    echo "${tipsMsg0}"
    exit
else
    echo "${tipsMsg1}"
fi

if [ $1 = "alloff" ]
  then
  echo "alloff"
  setled off

elif [ $1 = "allon" ]
  then
  setled on

elif [ $1 = "led" ]
  then
  echo "set $2 to $3"
#  setled off
  oneled $2 $3

elif [ $1 = "cycle" ]
  then
  echo "all off"
  setled off
  echo "green:wifi2g on"
  oneled green:wifi2g on
  sleep 5
  echo "green:wifi2g off"
  oneled green:wifi2g off

  echo "green:wifi5g on"
  oneled green:wifi5g on
  sleep 5
  echo "green:wifi5g off"
  oneled green:wifi5g off
  echo "red:wifi2g on"
  oneled red:wifi2g on
  sleep 5
  echo "red:wifi2g off"
  oneled red:wifi2g off

  echo "red:wifi5g on"
  oneled red:wifi5g on
  sleep 5
  echo "red:wifi5g off"
  oneled red:wifi5g off

  echo "green:wifi on"
  oneled green:wifi on
  sleep 5
  echo "green:wifi off"
  oneled green:wifi off

  echo "green:lan on"
  oneled green:lan on
  sleep 5
  echo "green:lan off"
  oneled green:lan off

  echo "green:wps on"
  oneled green:wps on
  sleep 5
  echo "green:wps off"
  oneled green:wps off

else
    if [ $1 = "--help" ]
      then
      echo $helpMsg
      exit
    else
      echo "${tipsMsg0}"
      exit
    fi
fi

echo "led test completed"

Anyone have any luck with this? I also have one of these v1 externders I wanted to use with my existing AP. Looking at the versions that are out there of the RE200 and the RE220, the RE220 V1 appears to be the same or very similar to the RE200V3. If needed I can try ripping mine apart to get a serial connection, but wasn't sure if any progress was able to be made here.

If it helps at all, it appears that there was some discussion around fixing the RE200's 5ghz radio issues. i found discussion of that in this thread

Resurrected...
Looking at this again. RE220 v1 hardware
Still where I was at in Dec '21

Have serial port connected. baud 57600, 8,n,1 flow off
Can break out of u-boot and tftp upload an RE220 v2 initramfs image and bootm 0x82000000
For radios, the 5GHz does not show up b default.
A couple of LEDs have the wrong pin #.

I heard a mystic voice telling me 'Use the Force'. Tried sysupgrade -F. Got me a boot loop.
Still I can break out of U-boot and upload initramfs to get to running OpenWRT (22.03r6).

Can anyone advise next steps to get to a working sysupgrade image?
Seems to be same chips as RE220 V2. ( MediaTek MT7628AN and MT7610EN)

Why doesn't it see the 5GHz radio? Is there some address it needs to talk to 7610?

so I'm trying to look at the device specific files for similar devices with ( MediaTek MT7628AN and MT7610EN)
namely RE220v2, RE200v2,v3,v4 to see what content is different.

Are these guides current?
add.new.device
adding_new_device

They reference dirs/files I cannot find. At least for ramips 76x8
mach-myboard.c ?
diag.sh ?
board.d/ ?

For dts files, all four similar devices (RE220v2, RE200v2,v3,v4 ) import the same *re200.dtsi file.
They just have a few lines to define compatible and model w/ specific model name.

I know there is at least one change needed for led definitions.

How do you determine the correct values for the flash@ section in dts assuming they need to change?

For the models already supported, I did not find any differences in the source files other than the model name.

Libre Office spreadsheet comparing source files for supported models

I have a couple of these, would like to see it supported

Having some success using the RE200v3 image on RE220v1.

High level steps
Connect to Serial
Interrupt U-Boot
tftpboot RE200v3 initramfs version
sysupgrade the RE200v3 sysupgrade version

Leds all work properly. Tested with script in above post.
There are a couple of oddities with LEDs, nothing major and probably the same behavior on the RE200v3.
On boot, during u-boot phase a lights come on. Then they all go off during the time their should be the flashing to indicate the timing to go to failsafe.
During normal operation using just wifi, the wifi2g and wifi5g are blinking as expected, but the power light is off.
If I manually toggle off the power light per above script, all lights go off. If I toggle power light back on, all lights return to their previous state (some on, some off)

Ran tyrekick.sh with medium. All passed
This was run on RE220v1 with RE200v3 image, so script reports it as RE200v3. Version 22.03.

model,OUI,testID,result-v1
TP-Link-RE200-v3,74da88,inet-dns-000001,pass
TP-Link-RE200-v3,74da88,ntp-000001,pass
TP-Link-RE200-v3,74da88,uhttpd-000001,pass
TP-Link-RE200-v3,74da88,firewall-fw4-test-000001,pass
TP-Link-RE200-v3,74da88,opkg-unzip-000001,pass
TP-Link-RE200-v3,74da88,iperf3-000001,pass
TP-Link-RE200-v3,74da88,all-radio-on-000001,pass
TP-Link-RE200-v3,74da88,wireless-extra-options-radio0-2g-11-10-psk2,pass
TP-Link-RE200-v3,74da88,wireless-extra-options-radio1-5g-36-10-psk2+ccmp,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-10-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-10-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-10-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-1-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-1-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-1-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-10-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-10-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-10-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-1-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-1-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-6-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-10-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-10-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-10-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-1-psk2,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-1-sae,pass
TP-Link-RE200-v3,74da88,radio0-2g-11-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-4-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-4-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-4-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-1-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-1-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-36-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-4-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-4-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-4-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-1-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-1-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-100-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-4-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-4-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-4-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-1-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-1-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-149-1-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-4-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-4-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-4-sae-mixed,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-1-psk2,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-1-sae,pass
TP-Link-RE200-v3,74da88,radio1-5g-165-1-sae-mixed,pass

Buttons worked great.
Followed the button test web page. The reset button short press would reboot. The reset button 10s would do a factor reset. The WPS button generated a WPS event.

root@OpenWrt:/# find /sys/firmware/devicetree/base/keys -mindepth 1 -type d | wh
ile read -r f; do printf '%s: %s\n' $(basename $f) $(hexdump -s2 -e '2/1 "%02x""
\n"' $f/linux,code); done
wps: 0211
reset: 0198

0198    KEY_RESTART    reset
0211    KEY_WPS_BUTTON    wps
root@OpenWrt:/# opkg install kmod-button-hotplug
Installing kmod-button-hotplug (5.10.138-3) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ramips/mt76x8/packages/kmod-button-hotplug_5.10.138-3_mipsel_24kc.ipk
Installing kmod-input-core (5.10.138-1) to root...
Downloading https://downloads.openwrt.org/releases/22.03.0/targets/ramips/mt76x8/packages/kmod-input-core_5.10.138-1_mipsel_24kc.ipk
Configuring kmod-input-core.
Configuring kmod-button-hotplug.
[ 2200.060910] kmodloader: loading kernel modules from /etc/modules.d/*
[ 2200.091097] Button Hotplug driver version 0.4.1
[ 2200.112167] kmodloader: done loading kernel modules from /etc/modules.d/*
root@OpenWrt:/# mkidr -p /etc/hotplug.d/button
/bin/ash: mkidr: not found
root@OpenWrt:/# mkdir -p /etc/hotplug.d/button
root@OpenWrt:/# cat << "EOF" > /etc/hotplug.d/button/buttons
> logger "the button was ${BUTTON} and the action was ${ACTION}"
> EOF
root@OpenWrt:/# logread -f
Tue Sep 27 20:04:44 2022 user.notice root: the button was wps and the action was pressed
Tue Sep 27 20:04:45 2022 user.notice root: the button was wps and the action was released
Tue Sep 27 20:04:48 2022 user.notice root: the button was wps and the action was pressed
Tue Sep 27 20:04:50 2022 user.notice root: the button was wps and the action was released
Tue Sep 27 20:05:19 2022 user.notice root: the button was reset and the action was pressed
REBOOT
Tue Sep 27 20:05:19 2022 daemon.info procd: - shutdown -
Tue Sep 27 20:05:19 2022 user.notice root: the button was reset and the action was released

Wired interface on lan worked as expected.

Tested using radios. Used 5Ghz for uplink and 2.4Ghz for clients. Mostly worked ok. It would just repeatedly try to connect to 5Ghz three times and then fail. Eventually it would connect and stay connected. Performance was poor. Maybe an optimized config or environment would work better. Not seeing anything to indicate problem w/ running this image.

Will share anything else interesting.

Conclusion: The RE200v3 images works on the RE220v1 device. Support can be added for the RE220v1 by cloning the specifics of the RE200v3.