RTL960xC porting OpenWRT

[alphaonex86]

hi, making some progress on https://github.com/alphaonex86/openwrt
RTL9607C -> working as headless server
RTL9602C WIP (GPON 90% finished and wifi part)

[Anime4000]

oh that's great, can OpenWRT run only 32MB of RAM? RTL9601D and 1C1 only have 32MB of RAM, I believe OpenWRT need 64MB minimum

[alphaonex86]

you have to respect minimal requirement to be sure it work, my RTL9601 have 64MB, or you can strip openwrt (like quit wifi, ...) to be sure working into 32MB (I can't test)

[Anime4000]

I see,
how about proprietary blob, VEIP/PPTP combo etc... those will get reverse engineer as well?

[alphaonex86]

I will reverse all if I have wait to test it

[Anime4000]

alright, the RTL9602C should work on RTL9601D and 1CI variant?

[alphaonex86]

no, need more rewrite and each manufacturer do them self the chip combination, mean dts have to be costomised too for each model (out of the SoC)

[Anime4000]

I see. So RTL9601D/RTL9601CI need their own implementation. Are the differences mainly in the board peripherals and DTS, or are there SoC-level differences that would require driver changes as well?

[ProMix0]

Hi!
There is also ongoing work for RTL9607C support in OpenWRT - https://github.com/jameywine/openwrt/tree/rtl9607c-dev

[Anime4000]

nice, another RTL9607C porting project

[jameywine]

thanks :]

I was not available at a time to post about it here but i would like to see to us getting together on this if possible.

There is also a thread in OpenWrt forum for discussions about it, which have been here for months already
https://forum.openwrt.org/t/support-for-rtl9607c-rtl8198d-realtek-soc/240741

And the ongoing pull request to bring RTL960X subtarget to main OpenWrt (though only RTL9607C and RTL8198D right now but perhaps it is possible to bring other chips if @alphaonex86 can port their stuff there). There has been a lot done but you can scroll through comment history for context.
openwrt/openwrt#20064

[Anime4000]

@alphaonex86 @ProMix0
Since reverse-engineering discussions can get quite lengthy, I've opened a dedicated thread on my forum where we can collect findings, logs, DTS work, and implementation notes in one place:

https://pururin.moe/viewtopic.php?t=27

Registration has instant activation. Feel free to join and share any findings or progress there.

[alphaonex86]

I have in my plan port this month multiple RTL960x chip, after this it should be just variation then in few days I should be able to port it. I have access to multiple OLT/ONU as ISP, then it's why I can go fast, and I have automated test (with control of power, wifi, ethernet, GPON, ...) then all testing case I can test I can port

[ProMix0]

I have in my plan port this month multiple RTL960x chip

Could be a challenge, at least because of some CPUs are Lexra, and some ones are pure MIPS (and even ARM ones). Plus different endianess of CPU

[Anime4000]

many on the market are RTL9601D with 8MB SPI and 32MB of RAM,
thing is, many ISP have move to VEIP and those old firmware are oblivious OMCI 329
and for ALCL/Nokia OLT, always give LCP Term Request when T-CONT sudden lost due to PPTP ETH1 reactivation

[ProMix0]

many on the market are RTL9601D

For example, in Russia most ISP ONUs are wireless routers, so it have to be at least RTL9603. What market are you mentioning?

and I have automated test (with control of power, wifi, ethernet, GPON, ...)

Could you tell more about? Just for interest

[Anime4000]

For me, we use PON Stick here, ISP also use D-Link DPN-FX3060V which using RTL9607DQ

[alphaonex86]

I have distiled my knowledge into https://github.com/alphaonex86/CatchChallenger/blob/master/security/SKILL.md this way do the IA fast en efficient to the the reverse engineering

[alphaonex86]

now at https://github.com/alphaonex86/CatchChallenger/blob/master/reverse-engineering/SKILL.md

[alphaonex86]

https://github.com/alphaonex86/openwrt -> some progress

[ProMix0]

@alphaonex86 I saw you specified RTL9607C RAM as 512M. All known routers with the SoC have 256M. Could you share router model you use (and/or any other known device models with known chipsets)?

[ProMix0]

Since we are here, don't you know how to check correctness of PHY analog patch? I saw something about autonegotiation in commentaries. Could you confirm that?

[alphaonex86]

@alphaonex86 I saw you specified RTL9607C RAM as 512M. All known routers with the SoC have 256M. Could you share router model you use (and/or any other known device models with known chipsets)?

Most of my device, I don't remember where I buy, https://www.hsgq.com/ -> all this devices are realtek, X111W is my ONU with RTL9602C

[alphaonex86]

Since we are here, don't you know how to check correctness of PHY analog patch? I saw something about autonegotiation in commentaries. Could you confirm that?

I do most of the process with reverse engineering IA + IA full control on OLT/ONU (power, firmware, binary, ther wifi/ethernet/GPON feedback too). And I only interact with the IA when the IA is blocked to give the way to process, something derivative from https://www.herman-brule.com/2026/06/08/the-bench-in-a-box-a-compact-hardware-hacking-rig-for-embedded-bring-up/

yes I see the IA comment me stuff like this, for now I have correctly verified ethernet for RTL9602C and RTL9607C and wifi RTL9602C, the rest is work in progress, I'm focused just now to GPON part (the hardware layer seam ok but seam have upper layer problem)

[gokulEIN]

Hi, I have RTL9602C (Realtek Luna SDK) GPON ONT is there any stable openwrt firmware is available?

[alphaonex86]

Provide me with google drive or any, contact@herman-brule.com and I will port it

[gokulEIN]

I have mailed you

[alphaonex86]

Well RTL9602C: ethernet, wifi, GPON working, what next? RTL9603C? RTL9607C (ethernet already working)?

[alphaonex86]

PS: seam working on 64MB RAM

[Anime4000]

RTL9607DQ, ARM64, Quad Core 1GHz

https://www.mediafire.com/file/icdguplj85680zm/DPN-FX3060V_V1.1.2_20231108_1050_XSTP_rel241118.bin/file
https://www.mediafire.com/file/xkmsp88g8qmhrh9/DPN-FX3060V_V2.0.3_20240802_1421_flowid_rel241118.bin/file

firmware is over 25MB in size each can't upload here

[alphaonex86]

I need the hardware to check if what I do is working and I don't have RTL9607DQ hardware.

[Anime4000]

can I ship to you?

[alphaonex86]

yes, email: contact@herman-brule.com