Adding support for TP-Link XDR-6086

For Developers
96

I found the RTL8221B datasheet and I hope to help you guys with it
8221B datasheet

1 Like
97

I did some measurements using ping, iperf, and tcpdump and found something interesting with XDR-6088 when 2.5G PHY (RTL8221B-VB-CG) works at 1G mode. The OpenWRT version is here.

Firstly, The WAN port (which is connected to GMAC1) works fine at 2.5Gbps without any packet loss in both directions. But when it is negotiated to 1Gbps, TX works fine, but RX always has a 30% packet loss rate. But if the Ethernet frame size is less than 64 Bytes (including FCS) or the size is an odd number or the size (including FCS) mod 32 is zero, we have no packet loss. It's obvious that the minimum size of an Ethernet frame is 64. So we got padding and the packet didn't lose?

Here is my packet loss rate with different ICMP payload sizes, measured by ping -s. And the total ethernet frame size is the size here + 8 (which is ICMP header) + 20 (which is IPv4 header) + 18 (which is ethernet header + FCS):

photo_2023-01-30_17-43-56
photo_2023-01-30_17-43-561280×573 68.9 KB

Secondly, I got some packet drop through ifconfig. And I measured it with tcpdump to see what the dropped packet is, and it shows the unknown ether type in the ethernet header. But when looking carefully, the frame is sent by the sender but gets some header cut. Here is my pcap file when doing iperf UDP with default 1M bandwidth receive by xdr6088.

Last, the LAN 2.5G port (which is connected to the MT7531 switch) can only work at 2.5Gbps, and these two LEDs of the 2.5Gbps Port didn't light at all even though it's working properly at 2.5Gbps Mode.

I come up with the following ideas to solve the 2.5Gbps problem and the LED problem.

2.5G Port didn't work properly at not 2.5G speed: I reviewed the device tree dump from factory firmware, and it shows both 2.5G Ports are fixed speed 2.5Gbps, which makes me confused. Then I checked the RTL8221B datasheet, and it shows a special "Rate Adaptor" mode that connects to MAC at a fixed 2.5Gbps speed, the only disadvantage in this Mode is the EEE will not work. Recall that the factory firmware set both 2.5G ports to fixed 2.5Gbps, and it works at 2.5G in the current version of OpenWRT. I think this mode may be the factory firmware set, but I didn't find out how to set it to this mode through MDIO registers or the device tree, maybe I should reread the document carefully.

LED problem: The RTL8221B datasheet shows LED configuration registers, so maybe the LED is directly connected to PHY, so it's not a big problem.

8 Likes
98

Update:

I didn't find out how to set these MDIO registers to Rate Adaptor Mode. Finally, I emailed Realtek FAE for help, they said they have a SERDES application note (which is mentioned in the datasheet) for the configuration. But the request for this document is generally processed by Realtek distributors and an NDA sign is needed.

So what can we do next? Can we use Logic Analyzer to track the MDIO signals or reverse-engineer the factory kernel and patch somewhere to trace the MDIO?

5 Likes
99

Have you ever seen Netgear WAX206 GPL source code? WAX206 is using mt7622+RTL8221B

https://www.downloads.netgear.com/files/GPL/WAX206_V1.0.4.0_Source.rar

see target/linux/mediatek/patches-4.4/1006-rtk822x.patch

5 Likes
100

Nice work! I have ported the patches to kernel v5.15 and changed the device tree to fixed link mode. Now the 2.5G wan port works at 1G mode without packet loss!

The code is here. You can get the patch by git diff c5a4aefe8ee4eeb1cdfd1fdc3ff91a70797370de > ../openwrt/target/linux/mediatek/patches-5.15/1006-rtk822x.patch and make the OpenWRT (don't forget to change the device tree and set the gmac1 to fixed link 2500 full-duplex).

There is still some work needed to make the 2.5G LAN works since this code hardwired PHY register number to 7, we have another PHY number 5 for LAN.

But I'm not sure whether this code will be merged to OpenWRT through it has some code with Realtek copyright claims.

8 Likes
101

Finally, I made the XDR 608x works. I made the LEDs of the two 2.5G ports lights and made them works at a speed of less than 2.5Gbps (I've tested 2.5G/1G/100M Full Duplex) without packet loss.

You can find my source code at https://github.com/cyyself/openwrt/tree/tl-xdr608x and compile it yourself.

There is some further work to make it available to be upstream.

Since we don't have a step-by-step tutorial just now, I strongly recommend you have a TTL cable connected before flashing the router and back up the entire flash (which contains the wifi firmware set by the factory and it's not identical for each device) before writing the OpenWRT. The U-Boot will show some important messages through TTL UART, don't let U-Boot runs the default boot command the first time. I have broken my router once, the U-Boot is even broken, and then saved it by the CH341 programmer and WSON8 probe. It takes me about 100 CNY and a few days to wait for the package.

12 Likes
102

Good job. Really appreciate it. :kissing_heart:

103

Can you post the wiring sequence of the ttl

104

  1. Teardown your router and connect the TTL jumper and make sure it works.

    The UART is always 115200 8n1.

    You can find a teardown for XDR6086 and XDR6088.

    For XDR6088, you may need a soldering iron and temporarily remove one antenna to flip the board.

  2. Get root shell of your device in factory firmware. ref

  3. Get my firmware and compile.

    If you haven't setup the OpenWRT build system, you should refer to this to finish the setup.

    git clone https://github.com/cyyself/openwrt.git -b tl-xdr608x
./scripts/feeds update -a
./scripts/feeds install -a
make nconfig
# Set Target System to MediaTek Ralink ARM
# Set Subtarget to Filogic 830 (MT7986)
# Set Target Profile to XDR6086 or XDR6088 depends on your router model
# Turn on LuCI if you need it at LuCI->Collections->luci
# turn on some other kernel modules you need such as something about usb
# Save and exit
make -j `nproc`

    Now you will get the firmware at openwrt/bin/targets/mediatek/filogic

  4. Backup entire factory firmware through root shell

    It's a important step as we have some factory settings like wireless calibration data.

    dd if=/dev/mtdblock9 of=/tmp/backup.img bs=131072
md5sum /tmp/backup.img
# Then send /tmp/backup.img to your PC via USB Storage or TCP. 
# You can use nc (netcat) for file transfer. 
# If you are using Windows, I recommend socat as nc alternative.
# Don't forget to check the md5 after you get the backup.

  5. Send the new bootloader to your router.

    Note: The new bootloader cannot be stored in filesystem which stores in the NAND of your router.

    We need to files at openwrt/bin/targets/mediatek/filogic:

    • openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
    • openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    If you are using xdr6086, the "xdr6088" should be replaced to "xdr6086".

    Send these two files to your router's /tmp via USB or TCP, and then checks the md5sum is the same as it on your PC.

    md5sum /tmp/openwrt-mediatek-filogic-tplink_tl-xdr608*

  6. Setup TFTP Server

    Setup TFTP Server at your computer the and root path has everything as openwrt/bin/targets/mediatek/filogic.

    And set your TFTP server's IP address to 192.168.1.254, and connect to any of the 1G LAN Port of your router.

    The U-Boot will have default IP address 192.168.1.1, so please make sure the IP address will not conflict if you connect your router to switch.

  7. Flash the bootloader.

    Warning: After this step, Factory firmware will no longer start, if you want to back to the factory firmware, you can flash the entire nand backup in U-Boot.

    dd bs=131072 conv=sync of=/dev/mtdblock9 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
dd bs=131072 conv=sync of=/dev/mtdblock9 seek=28 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    Then you should turn on TTL console and check it works before reboot.

    Don't let u-boot autoboot for the first time.

    If the TFTP fetch fails, you will need NAND Programmer and a WSON8 Probe (which is 8mm*6mm) to restore your router.

  8. Reboot to U-Boot Menu

    You will see the menu through TTL UART like this:

    The first thing you need to do is press any key to prevent the U-Boot from running default boot command.

    	    ( ( ( OpenWrt ) ) )       U-Boot 2022.10-OpenWrt-r21446-dd4d33a684 (Dec 11 2022 - 00:56:46 +0000)

	  1. Run default boot command.
	  2. Boot system via TFTP.
	  3. Boot production system from NAND.
	  4. Boot recovery system from NAND.
	  5. Load production system via TFTP then write to NAND.
	  6. Load recovery system via TFTP then write to NAND.
	  7. Load BL31+U-Boot FIP via TFTP then write to NAND.
	  8. Load BL2 preloader via TFTP then write to NAND.
	  9. Reboot.
	  a. Reset all settings to factory defaults.
	  0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

    As we can find the U-Boot commands here. U-Boot will fetch the openwrt-mediatek-filogic-tplink_tl-xdr6088-initramfs-recovery.itb and openwrt-mediatek-filogic-tplink_tl-xdr6088-squashfs-sysupgrade.itb at server 192.168.1.254.

    Then Follow these steps:

      1. Load recovery system via TFTP then write to NAND.
      1. Load production system via TFTP then write to NAND.
    • a. Reset all settings to factory defaults.

    Then you can enjoy OpenWRT!

4 Likes
105

Then we can discuss how to merge this patch to the mainline.

As you can see my patch, which ports the rtl822x driver found from WAX206 source code.

Although it works, I don't think it can be merged into the mainline because of these problems:

  • Realtek Copyright
  • Directly call the PHY driver in the MAC driver and vice versa.
  • Bypass Linux Kernel's PHY Link driver with fixed link mode, so the kernel will not probe the PHY and setup auto-negotiation and change the MAC speed.

I reviewed the kernel symbol from the TP-Link factory firmware. I'm sure what I have done is what TP-Link and NETGEAR have done for the same PHY chip from their factory. But I think we should decouple PHY and MAC drivers and provide an interface to make them work in this special Rate Adaptor Mode before sending to upstream.

There are two challenges to making it upstream:

    1. Let Linux Kernel support the Rate Adaptor PHY Mode which will allow kernels to just poll link status from PHY and set the correct MAC status rather than set link speed.
    1. Get the details about some undocumented registers and patch the Kernel's RTL PHY Driver.

The first challenge is that the linux kernel will not allow fixed link mode probe PHY, you can see the phylink.c:1149. So there are 2 ways to solve this:

  1. Patch Kernel drivers/net/phy/phylink.c to allow PHY to be probed at fixed link mode and some other patches to always set MAC link speed to fixed link speed. Then patch drivers/net/phy/realtek.c to initialize all the MDIO regs to this special Rate Adaptor Mode.

  2. Change Kernel's PHY Link logic to support decoupled MAC and PHY speed. Then patch drivers/net/phy/realtek.c to allow rate adaptor Mode.

The second challenge is that. If we patched the PHY driver to make Rate Adaptor works, we just know it will work. However, we didn't know the meaning of these shadow MDIO registers which will be hard to convince the maintainer our patch is right and verifiable.

3 Likes
106

Can you provide the position corresponding to the TTL pin angle

107

You can find in the teardown for XDR6086 and XDR6088, it's a 4-pin hole, both at the corner of the board.

1 Like
108

Now you're just being lazy, it's described two posts up, and the pins have markings on the PCB.

image

109

I just don’t understand this, there is no RX TX vacancy corresponding to the mark, thank you

110

Lets restart, what device do you have ? the 86 or 88 ?

111

It's true for my XDR6088 board. But we can see the PCB locate where the TX and RX are since it will connect to a resistor, and just swap the pins if it not works.

1 Like
112

I get it, thank

113

Mine is, 88

114

Where can you buy these nice looking devices?

115

They are produced for the Chinese domestic market only, you may find them occasionally from one of the smaller importers of these goods.

3 Likes