TP-Link EX220 v1 as distributed by the Russian ISP MTS, labelled
"EX220(RU)MTS) Ver:1.30". It carries the same model name as the already
supported tplink,ex220-v1, but it is a different board: 128 MB of
parallel NAND managed by NMBM instead of 16 MB of SPI-NOR, and an entirely
different flash layout. The bootloader tells the two apart - on this
revision U-Boot prints "NAND: 128 MiB" followed by "NMBM has been
successfully attached".
Hardware specification:
- SoC: MediaTek MT7621AT (MIPS 1004Kc, ver 1 eco 3)
- RAM: 128 MB DDR3 (chip hidden under the shielding can)
- Flash: 128 MB parallel NAND, ESMT F59L1G81MB, NMBM managed
(the driver identifies the chip as "ESMT PSU1GA30DT")
- WiFi: MediaTek MT7915E, DBDC, 2x2 2.4 GHz + 2x2 5 GHz (AX1800)
- Ethernet: MediaTek MT7530, 5x 10/100/1000 Mbps (4x LAN + 1x WAN)
- LEDs: 7x GPIO - power, LAN, WAN green, WAN amber, WLAN 2.4 GHz,
WLAN 5 GHz, WPS
- Buttons: 2x tactile - reset, WPS
- UART: 4 unpopulated through holes on the solder side of the board,
beside the silver factory sticker, with no silkscreen designator.
Counting from the hole furthest from the ethernet ports: pin 1 TX,
pin 2 RX, pin 3 GND, pin 4 unused - leave it unconnected.
115200 8N1, 3.3 V.
- Power: 12 VDC, 1 A
MAC addresses:
LAN f0:a7:31:xx:xx:xx misc_ro @ 0x5c50bc, matches the label
WAN f0:a7:31:xx:xx:xx same as LAN
2.4G label MAC + 2
5G label MAC + 3
The radio calibration lives in the misc_ro partition, which holds a
JFFS2 filesystem with five files named after their original flash
offsets. The largest one carries the MT7915 EEPROM at offset 0x90000,
so 11-mt76-caldata mounts the partition read-only and copies it out.
Reading it needs CONFIG_JFFS2_ZLIB - the vendor compressed those nodes
with zlib, which OpenWrt does not build in by default.
It is worth the kernel option. With the factory calibration the client
reports -44 dBm at half a metre and negotiates HE-MCS 11; with the
generic default EEPROM the very same link reports -82 dBm and settles
at HE-MCS 3, and a local transfer peaks at 541 instead of 692 Mbit/s.
The vendor bootloader loads a FIT image from the fixed address
0xd00000 and does not evaluate partition names, so the vendor firmware
slot is split into a raw kernel partition and a UBI partition holding
rootfs and rootfs_data.
Flash instructions:
The vendor web interface offers no way in, so the first installation is
done over the serial console.
1. Open the case and attach a 3.3 V USB-to-serial adapter to the 4-pin
header described above.
2. Power the board up and interrupt the bootloader by pressing any key
when it prints "Hit any key to stop autoboot".
3. Load the initramfs image into RAM over YMODEM:
loady 0x84000000
Send openwrt-ramips-mt7621-tplink_ex220-v1-nand-initramfs-kernel.bin
using the YMODEM transfer of your terminal program - this takes
about 11 minutes at 115200 baud - and boot it:
bootm 0x84000000
Do not raise the bootloader console speed to shorten the transfer:
with the console set to 921600 baud the kernel hangs while taking
the UART over from the bootloader, leaving nothing after the 16550A
line, and the watchdog resets the board.
4. The running system serves 192.168.1.1/24 on the LAN ports. Transfer
openwrt-ramips-mt7621-tplink_ex220-v1-nand-squashfs-sysupgrade.bin
to /tmp and install it:
sysupgrade -n /tmp/openwrt-*-ex220-v1-nand-squashfs-sysupgrade.bin
The board reboots into OpenWrt on its own; later updates use
sysupgrade as usual.
Reverting to stock:
The second firmware slot ships empty, so there is nothing to fall back
to - take a backup while the initramfs image of step 3 is running, ie
before step 4:
cat /dev/mtd4 /dev/mtd5 > /tmp/stock.bin
and copy it off the device. To restore it, boot the initramfs image
again and write it back:
dd if=stock.bin bs=1M count=4 | mtd write - kernel
dd if=stock.bin bs=1M skip=4 | mtd write - ubi
Signed-off-by: Denis Faizullin <triplexit.help@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24831
Signed-off-by: Robert Marko <robimarko@gmail.com>
Denis Faizullin
13f1e1c66d