Adding support for TP-Link XDR-6086

For Developers
104

  1. Teardown your router and connect the TTL jumper and make sure it works.

    The UART is always 115200 8n1.

    You can find a teardown for XDR6086 and XDR6088.

    For XDR6088, you may need a soldering iron and temporarily remove one antenna to flip the board.

  2. Get root shell of your device in factory firmware. ref

  3. Get my firmware and compile.

    If you haven't setup the OpenWRT build system, you should refer to this to finish the setup.

    git clone https://github.com/cyyself/openwrt.git -b tl-xdr608x
./scripts/feeds update -a
./scripts/feeds install -a
make nconfig
# Set Target System to MediaTek Ralink ARM
# Set Subtarget to Filogic 830 (MT7986)
# Set Target Profile to XDR6086 or XDR6088 depends on your router model
# Turn on LuCI if you need it at LuCI->Collections->luci
# turn on some other kernel modules you need such as something about usb
# Save and exit
make -j `nproc`

    Now you will get the firmware at openwrt/bin/targets/mediatek/filogic

  4. Backup entire factory firmware through root shell

    It's a important step as we have some factory settings like wireless calibration data.

    dd if=/dev/mtdblock9 of=/tmp/backup.img bs=131072
md5sum /tmp/backup.img
# Then send /tmp/backup.img to your PC via USB Storage or TCP. 
# You can use nc (netcat) for file transfer. 
# If you are using Windows, I recommend socat as nc alternative.
# Don't forget to check the md5 after you get the backup.

  5. Send the new bootloader to your router.

    Note: The new bootloader cannot be stored in filesystem which stores in the NAND of your router.

    We need to files at openwrt/bin/targets/mediatek/filogic:

    • openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
    • openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    If you are using xdr6086, the "xdr6088" should be replaced to "xdr6086".

    Send these two files to your router's /tmp via USB or TCP, and then checks the md5sum is the same as it on your PC.

    md5sum /tmp/openwrt-mediatek-filogic-tplink_tl-xdr608*

  6. Setup TFTP Server

    Setup TFTP Server at your computer the and root path has everything as openwrt/bin/targets/mediatek/filogic.

    And set your TFTP server's IP address to 192.168.1.254, and connect to any of the 1G LAN Port of your router.

    The U-Boot will have default IP address 192.168.1.1, so please make sure the IP address will not conflict if you connect your router to switch.

  7. Flash the bootloader.

    Warning: After this step, Factory firmware will no longer start, if you want to back to the factory firmware, you can flash the entire nand backup in U-Boot.

    dd bs=131072 conv=sync of=/dev/mtdblock9 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
dd bs=131072 conv=sync of=/dev/mtdblock9 seek=28 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    Then you should turn on TTL console and check it works before reboot.

    Don't let u-boot autoboot for the first time.

    If the TFTP fetch fails, you will need NAND Programmer and a WSON8 Probe (which is 8mm*6mm) to restore your router.

  8. Reboot to U-Boot Menu

    You will see the menu through TTL UART like this:

    The first thing you need to do is press any key to prevent the U-Boot from running default boot command.

    	    ( ( ( OpenWrt ) ) )       U-Boot 2022.10-OpenWrt-r21446-dd4d33a684 (Dec 11 2022 - 00:56:46 +0000)

	  1. Run default boot command.
	  2. Boot system via TFTP.
	  3. Boot production system from NAND.
	  4. Boot recovery system from NAND.
	  5. Load production system via TFTP then write to NAND.
	  6. Load recovery system via TFTP then write to NAND.
	  7. Load BL31+U-Boot FIP via TFTP then write to NAND.
	  8. Load BL2 preloader via TFTP then write to NAND.
	  9. Reboot.
	  a. Reset all settings to factory defaults.
	  0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

    As we can find the U-Boot commands here. U-Boot will fetch the openwrt-mediatek-filogic-tplink_tl-xdr6088-initramfs-recovery.itb and openwrt-mediatek-filogic-tplink_tl-xdr6088-squashfs-sysupgrade.itb at server 192.168.1.254.

    Then Follow these steps:

      1. Load recovery system via TFTP then write to NAND.
      1. Load production system via TFTP then write to NAND.
    • a. Reset all settings to factory defaults.

    Then you can enjoy OpenWRT!

4 Likes