Adding support for TP-Link XDR-6086

Excellent work!
I got root shell for my XDR-6088 using @JamesLucas's exploit.
Are there any notable differences for the uboot of 6086 except for the dts? I am trying to build and test it.

1 Like

对,这个利用可以通用。
楼上 Amadeus 已经在做6088了。

1 Like

You can build tested and working TF-A bl2 and U-Boot binaries using my staging tree, I posted instructions here: Adding support for TP-Link XDR-6086 - #34 by daniel

I added some details to the wiki https://openwrt.org/inbox/toh/tp-link/xdr-6086#rooting. It's all from memory and my notes so hopefully I didn't miss any steps and it's clear enough. If something doesn't work, let me know and I'll try to adjust it.

2 Likes


With reference to your example.it seems that it cannot be reproduced

You need to change the <command> tags in the username field. That command is just a reference for how other shell commands can be run.


it returns {"error_code":-40210}.
This seems to be the same problem you encountered before

In the web GUI L2TP server, is there an existing user? If so, delete that and try again.

I put the XDR6088 for firmware recovery and firmware downgrade to no avail. I wonder if there is something wrong with my stok and I can't access it.

I've updated my staging tree with DTS additions imported from @Amadeus tree on github (LEDs, buttons, USB). Also added draft user-space support. Now I will need help of people owning this device to find out:

  • which of the 2.5G PHYs is connected to GMAC1, which is connected to MT7531 port 5?
  • which of the 5x 1GE ports of the MT7531 switch is the 1GE port used on the XDR-6086?
  • what are the differences between XDR-6068 and XDR-6088?
4 Likes

I can help with this tomorrow

1 Like

Can you try to boot initramfs on my branch?

Nice work, also answering a few of my questions (differences between XDR6088 and XDR6068 is the absence of the 2.5G PHYs...). I've left a bunch of comments on Github.

1 Like

Thanks for your suggestion. Btw, is XDR6068 refer to XDR6086? I don't think there is a difference in 2.5g phy between XDR6086 and XDR6088, just the number of gigabit ports. In any case, I managed to borrow an XDR6086 router, and it will take a few days to my school. Sorry I can't answer your question definitively until then.

2 Likes

6088 has 2x 2.5g ports and 4x 1g ports.

  • TP-Link XDR 6086
    • 2x 2.5G ports and the model number is RTL8221B
    • 1x 1GE ports MT7531A
  • TP-Link XDR 6088
    • 2x 2.5G ports RTL8221B
    • 4x 1GE ports MT7531A

so the main difference between XDR6086 and XDR 6088 is the number of gigabit network ports

2 Likes

I have this booted. Some notes:

  1. The rightmost 2.5g port is registered as "eth1", should be "wan".
  2. 1g port works fine
  3. Auto-negotiation appears to work; tested 1g and 2.5g on the middle 2.5G port and it negotiated ok. I did not test an actual data flow yet as I don't have a good setup for that.
1 Like

Thanks. For the renaming of eth1, we need a patch from ramips: https://github.com/openwrt/openwrt/blob/master/target/linux/ramips/patches-5.15/700-net-ethernet-mediatek-support-net-labels.patch
I don't know if it's appropriate to put it into generic.

1 Like

I suppose if it’s targeting multiple SOCs then it’s generic enough?

1 Like

If it applies to the MediaTek ARM target, it's not generic. You can have patches sitting in multiple targets. Generic means they apply to all targets and the MediaTek ethernet driver does not apply to all targets. Apparently it doesn't need to be.

2 Likes