The recovery routine as read from the flash dump, traced with two OpenWrt images.

TitleU-Boot TFTP recovery, TL-WR740N v5
SourceU-Boot 1.1.4, read from the flash dump
Sheet2 of 4