Adding support for TP-Link XDR-6086

For Developers
102

Good job. Really appreciate it. :kissing_heart:

103

Can you post the wiring sequence of the ttl

104

  1. Teardown your router and connect the TTL jumper and make sure it works.

    The UART is always 115200 8n1.

    You can find a teardown for XDR6086 and XDR6088.

    For XDR6088, you may need a soldering iron and temporarily remove one antenna to flip the board.

  2. Get root shell of your device in factory firmware. ref

  3. Get my firmware and compile.

    If you haven't setup the OpenWRT build system, you should refer to this to finish the setup.

    git clone https://github.com/cyyself/openwrt.git -b tl-xdr608x
./scripts/feeds update -a
./scripts/feeds install -a
make nconfig
# Set Target System to MediaTek Ralink ARM
# Set Subtarget to Filogic 830 (MT7986)
# Set Target Profile to XDR6086 or XDR6088 depends on your router model
# Turn on LuCI if you need it at LuCI->Collections->luci
# turn on some other kernel modules you need such as something about usb
# Save and exit
make -j `nproc`

    Now you will get the firmware at openwrt/bin/targets/mediatek/filogic

  4. Backup entire factory firmware through root shell

    It's a important step as we have some factory settings like wireless calibration data.

    dd if=/dev/mtdblock9 of=/tmp/backup.img bs=131072
md5sum /tmp/backup.img
# Then send /tmp/backup.img to your PC via USB Storage or TCP. 
# You can use nc (netcat) for file transfer. 
# If you are using Windows, I recommend socat as nc alternative.
# Don't forget to check the md5 after you get the backup.

  5. Send the new bootloader to your router.

    Note: The new bootloader cannot be stored in filesystem which stores in the NAND of your router.

    We need to files at openwrt/bin/targets/mediatek/filogic:

    • openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
    • openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    If you are using xdr6086, the "xdr6088" should be replaced to "xdr6086".

    Send these two files to your router's /tmp via USB or TCP, and then checks the md5sum is the same as it on your PC.

    md5sum /tmp/openwrt-mediatek-filogic-tplink_tl-xdr608*

  6. Setup TFTP Server

    Setup TFTP Server at your computer the and root path has everything as openwrt/bin/targets/mediatek/filogic.

    And set your TFTP server's IP address to 192.168.1.254, and connect to any of the 1G LAN Port of your router.

    The U-Boot will have default IP address 192.168.1.1, so please make sure the IP address will not conflict if you connect your router to switch.

  7. Flash the bootloader.

    Warning: After this step, Factory firmware will no longer start, if you want to back to the factory firmware, you can flash the entire nand backup in U-Boot.

    dd bs=131072 conv=sync of=/dev/mtdblock9 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-preloader.bin
dd bs=131072 conv=sync of=/dev/mtdblock9 seek=28 if=/tmp/openwrt-mediatek-filogic-tplink_tl-xdr6088-bl31-uboot.fip

    Then you should turn on TTL console and check it works before reboot.

    Don't let u-boot autoboot for the first time.

    If the TFTP fetch fails, you will need NAND Programmer and a WSON8 Probe (which is 8mm*6mm) to restore your router.

  8. Reboot to U-Boot Menu

    You will see the menu through TTL UART like this:

    The first thing you need to do is press any key to prevent the U-Boot from running default boot command.

    	    ( ( ( OpenWrt ) ) )       U-Boot 2022.10-OpenWrt-r21446-dd4d33a684 (Dec 11 2022 - 00:56:46 +0000)

	  1. Run default boot command.
	  2. Boot system via TFTP.
	  3. Boot production system from NAND.
	  4. Boot recovery system from NAND.
	  5. Load production system via TFTP then write to NAND.
	  6. Load recovery system via TFTP then write to NAND.
	  7. Load BL31+U-Boot FIP via TFTP then write to NAND.
	  8. Load BL2 preloader via TFTP then write to NAND.
	  9. Reboot.
	  a. Reset all settings to factory defaults.
	  0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

    As we can find the U-Boot commands here. U-Boot will fetch the openwrt-mediatek-filogic-tplink_tl-xdr6088-initramfs-recovery.itb and openwrt-mediatek-filogic-tplink_tl-xdr6088-squashfs-sysupgrade.itb at server 192.168.1.254.

    Then Follow these steps:

      1. Load recovery system via TFTP then write to NAND.
      1. Load production system via TFTP then write to NAND.
    • a. Reset all settings to factory defaults.

    Then you can enjoy OpenWRT!

4 Likes
105

Then we can discuss how to merge this patch to the mainline.

As you can see my patch, which ports the rtl822x driver found from WAX206 source code.

Although it works, I don't think it can be merged into the mainline because of these problems:

  • Realtek Copyright
  • Directly call the PHY driver in the MAC driver and vice versa.
  • Bypass Linux Kernel's PHY Link driver with fixed link mode, so the kernel will not probe the PHY and setup auto-negotiation and change the MAC speed.

I reviewed the kernel symbol from the TP-Link factory firmware. I'm sure what I have done is what TP-Link and NETGEAR have done for the same PHY chip from their factory. But I think we should decouple PHY and MAC drivers and provide an interface to make them work in this special Rate Adaptor Mode before sending to upstream.

There are two challenges to making it upstream:

    1. Let Linux Kernel support the Rate Adaptor PHY Mode which will allow kernels to just poll link status from PHY and set the correct MAC status rather than set link speed.
    1. Get the details about some undocumented registers and patch the Kernel's RTL PHY Driver.

The first challenge is that the linux kernel will not allow fixed link mode probe PHY, you can see the phylink.c:1149. So there are 2 ways to solve this:

  1. Patch Kernel drivers/net/phy/phylink.c to allow PHY to be probed at fixed link mode and some other patches to always set MAC link speed to fixed link speed. Then patch drivers/net/phy/realtek.c to initialize all the MDIO regs to this special Rate Adaptor Mode.

  2. Change Kernel's PHY Link logic to support decoupled MAC and PHY speed. Then patch drivers/net/phy/realtek.c to allow rate adaptor Mode.

The second challenge is that. If we patched the PHY driver to make Rate Adaptor works, we just know it will work. However, we didn't know the meaning of these shadow MDIO registers which will be hard to convince the maintainer our patch is right and verifiable.

3 Likes
106

Can you provide the position corresponding to the TTL pin angle

107

You can find in the teardown for XDR6086 and XDR6088, it's a 4-pin hole, both at the corner of the board.

1 Like
108

Now you're just being lazy, it's described two posts up, and the pins have markings on the PCB.

image

109

I just don’t understand this, there is no RX TX vacancy corresponding to the mark, thank you

110

Lets restart, what device do you have ? the 86 or 88 ?

111

It's true for my XDR6088 board. But we can see the PCB locate where the TX and RX are since it will connect to a resistor, and just swap the pins if it not works.

1 Like
112

I get it, thank

113

Mine is, 88

114

Where can you buy these nice looking devices?

115

They are produced for the Chinese domestic market only, you may find them occasionally from one of the smaller importers of these goods.

3 Likes
116

There is another way to solve this by making the SGMII interface of MAC and switch to be adjusted to 1G or less speed. So setting Rate Adaptor Mode is no need anymore.

I found the patches just a few days ago here: https://lore.kernel.org/linux-arm-kernel/Y96SRu4BFxNmaLjt@lunn.ch/T/#m2e036ab24789d284c3541dee352b31321c167549 .

6 Likes
117

This is fixed here:
https://lore.kernel.org/linux-arm-kernel/Y96SRu4BFxNmaLjt@lunn.ch/T/#mf8f66f4bebf1b35b87d2110b8db40c3f0362cc49

I'm working now to get proper support for interface-mode switching PHYs supported upstream first, then I will do backport to Linux 5.15 for OpenWrt. In the meantime, I'd appreciate testing done against my wip kernel tree here:

7 Likes
118

I am watching x-wrt developments on XDR-6086 and, as far as i can understand on their chinese forum, they have a release with fully working 2,5Gbps.
As x-wrt is OpenWRT based, can their advances be used to finally get OpenWRT working on this device?

119

Sure, someone with the hardware has to pick the PHY driver change from x-wrt and make a PR for OpenWrt adding the hardware.

120

I am wondering if anyone can share the factory firmware backup for XDR6088 and also let me know where the wireless calibration data is stored on this device.

121

You can find where the wireless calibration data is stored from dts. At the wmac0 section, mediatek,mtd-eeprom was set to &factory 0x0. And factory symbol is at flash@0 in the spi0 starting at 0x160000 with size 0xa0000.

Here is the factory partition from factory firmware here. Since it's hardware-dependent data, I recommend everyone back up their factory firmware with the wifi calibration data before every operation that may damage the factory data. Taking it from another router is bad for wireless signal quality.