Table of Contents

TP-Link TL-MR6400 v1.0

TL-MR6400r

LTE router with 4 fast (100Mbps) ethernet ports.

Supported Versions

Hardware highlights

Installation

OEM installation using the TFTP method

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

→ generic.flashing.tftp

Flash via u-boot tftp :
  1. Ensure that LAN interface in original firmware's web-ui is NOT set to address from 192.168.0.0/24 (more info)
  2. Connect to any Ethernet port
  3. Setup your interface to 192.168.0.66/24
  4. Serve factory image as mr6400_tp_recovery.bin via TFTP server
  5. Power on the device while holding the reset button pressed
  6. Keep holding the reset button at least for 5 seconds
  7. Device should flash itself and reboot to new firmware after flashing is complete

Note: If you have troubles with ethernet negotiation (e.g. you are not even receiving any ARP packets for 192.168.0.66) you can put any dumb switch between your NIC and MR6400 to workaround this.

Reverting to original firmware

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

Steps:

  1. download firmware from TP-Link's web (http://www.tp-link.com/download/TL-MR6400.html)
  2. unpack the zip file
  3. you should find there a ~50 MiB .bin file
  4. yet again unpack the .bin file (it has .bin extension but it's actually a zip file)
  5. you should find a file named router.bin
  6. cut out the first 0x20200 (131584) bytes. (tp-link header+bootloader)
    1. e.g. tail -c+131585 router.bin > mr6400_tp_recovery.bin
  7. check that the resulted file has exactly 0x7c0000 (8126464) bytes
  8. flash either via U-Boot's tftp recovery or via sysupgrade (sysupgrade -n mr6400_tp_recovery.bin)

NOTE: This will (obviously) not touch your LTE module's firmware. All changes you've done to LTE module (or were done automatically) will be preserved. Also main board's firmware and LTE module's firmware versions might get out of sync. Both may result in state that was not intended by the manufacturer so it is recommended (unless you know what you're doing) to flash once again via web-ui following TP-Link's instructions.

Upgrading LTE Module

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

WARNING: Be careful what you do in LTE Module's shell. Executing wrong commands might brick your LTE Module.

WARNING: If you're using LTE Module's shared storage this will (obviously) destroy all your data there (don't forget to make backup before upgrading). Also this will revert any changes you have done to /usr/bin/prepareUdisk so you'll need to do redo them once you finish upgrading.

Steps:

  1. free space on /cache
    1. enter LTE Module's shell (adb shell)
    2. unshare v_disk.img
      1. run cat /sys/devices/virtual/android_usb/android0/f_mass_storage/lun/file
      2. you should see /dev/loop7 (this means that /dev/loop7 is shared with main board)
      3. unshare it with echo > /sys/devices/virtual/android_usb/android0/f_mass_storage/lun/file
      4. check once again cat /sys/devices/virtual/android_usb/android0/f_mass_storage/lun/file (should be empty now)
    3. detach v_disk.img from loop device
      1. run losetup
      2. you should see line /dev/loop7: 0 /cache/share/v_disk.img (this means v_disk.img is still associated with /dev/loop7)
      3. detach loop with losetup -d /dev/loop7
      4. check once again losetup
      5. line with /cache/share/v_disk.img should disappear
    4. delete v_disk.img to free space: rm /cache/share/v_disk.img
    5. check free space df -h /cache (you should see about 64M available)
  2. download firmware from TP-Link's web (http://www.tp-link.com/download/TL-MR6400.html)
  3. unpack the zip file
  4. you should find there a ~50 MiB .bin file
  5. change extension to .zip (LTE module's web interface won't accept file with different extension)
  6. login to LTE Module's web interface and upload .zip file via Advanced → Device → Firmware update → Update via local server
  7. LTE Module will flash itself and reboot to new firmware

NOTE: If adb stops working after LTE Module reboots. You can try running rmmod option to get adb working again.

NOTE: LTE Module's web interface won't start automatically after LTE Module boots up. Start it manually (e.g. /etc/init.d/adb-enablemodem start).

Specific configuration

LTE Module

The included modem in this device is running it's own Android OS and has a hidden (disabled in the stock firmware) web interface. At least in LEDE, the hidden web interface is re-activated again on each boot and can be used to setup the 3g/lte connection after switching to LEDE. Modem's web interface is available at http://192.168.0.1/login.html with the default username/password of admin/admin.

The web interface is started by service adb-enablemodem. If you want to disable it (e.g. for security reasons) stop and/or disable adb-enablemodem service as needed.

See /etc/init.d/adb-enablemodem help for more commands.

Using LTE Module's shared storage

There is 60 MiB shared storage available which you can use however you wish but all your data will be lost after reboot by default. You can follow instructions below to make storage data to be preserved even after reboot.

Warning!
This section describes actions that might damage your device or firmware. Proceed with care!

WARNING: Be careful what you do in LTE Module's shell. Executing wrong commands might brick your LTE Module.

Steps:

  1. enter LTE Module's shell (`adb shell`)
  2. edit prepareUdisk script `vi /usr/bin/prepareUdisk`
  3. comment out these lines:
    1. rm -rf /cache/*
    2. dd if=/dev/zero of=/cache/share/v_disk.img bs=1024 count=61440
    3. mkdosfs -n \“TP-LINK\” /dev/loop7
  4. save & close (:wq)
  5. exit LTE Module's shell (e.g. hit ctrl+d or run exit)
  6. now you can use LTE Module's shared storage (all your data will be preserved after reboot)

You'll need kmod-usb-storage installed for shared storage (/dev/sda) to appear. You can format /dev/sda to any filesystem you wish. You can also use partitions. Follow instructions on USB Storage.

NOTE: This won't break upgrade procedure of main board's original firmware's web-ui. Also you can upgrade main board's firmware as well as revert it to original firmware without losing data on shared storage. But once you do upgrade via original firmware's web-ui it will destroy all your data on shared storage.

Bugs / Gotchas

LAN interface & RNDIS interface network collision

LTE Module uses address 192.168.0.1/24 on RNDIS interface by default. But original TP-Link's firmware allows user to set address on LAN interface also to 192.168.0.x which automatically changes LTE Module's RNDIS interface address to 192.168.1.1/24 to avoid collision of networks. In this state if you flash MR6400 with different firmware which uses network 192.168.1.0/24 on LAN interface by default (such as OpenWRT/LEDE) you will get two interfaces which uses the same IPv4 network. This is very likely to cause problems. It is possible to change the address of LTE Module after flashing but to avoid the trouble it is recommended to ensure that the LAN interface is set to address outside of network 192.168.0.0/24 (e.g. the default 192.168.1.1/24 is fine) in original firmware's web-ui before flashing so that LTE Module's address would end up to be set to 192.168.0.1/24.

Port forwarding configuration

TP-Link LTE Module (that keeps the original software inside) has it's own NAT with a DMZ configuration set to an address x.x.x.100. To make the port forwarding from WAN to LAN work you have to set the OpenWrt side to use a static ip of x.x.x.100 on the WAN configuration. By default the OpenWrt side uses an address that it gets with a DHCP from the LTE Module. I also turned the LTE module DHCP server off since you shouldn't need it any more after a static configuration.

Hardware

Info

Architecture MIPS MIPS 24Kc
Vendor Qualcomm Atheros
Bootloader U-Boot
System-On-Chip QCA9531
CPU/Speed 650 MHz
Flash-Chip Winbond W25Q64BV,W25Q64CV or W25Q64FV
Flash size 8 MiB
RAM 64 MiB
Wireless SoC-integrated: 2.4GHz 802.11bgn
Ethernet 10/100 Mbit/s w/ vlan support
USB no
Serial Yes
JTAG Not populated

Photos

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

PCB TL-MR6400-v1.0

Opening the case

FIXME Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

Serial

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
The three grey wires are connected to a 3,5mm stereo headphone jack. You also have to shorten R29 and R30 to connect with soc-uart-

Serial connection parameters
for TP-Link TL-MR6400 v1.0 		115200, 8N1

JTAG

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Bootlogs

Logs

TL-MR6400(EU) v1.0 OEM-Bootlog

UBoot 1.1.4 Environment Variables

OpenWrt bootlog

COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING


Notes

Modem interface at 192.168.0.1 shows up automtically if you're on openwrt 19.07 7. It does not work on 24.10.0.

Tags

How to add tags

, , , , , , ,