Router Emulator 4.0

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash).
Board presets are a separate archive, ...-presets.zip: unpack it over the
package. No flash images are included: build them with tools/prepare-nand.sh
(see README.md / README.ru.md), take ready ones from
Google Drive
or Yandex Disk, or use dumps of a real router.

What's new in 4.0

• Xiaomi Mi Router 4A Gigabit Edition v2, three presets:
  • xiaomi-mi-router-4a-gigabit-v2: the stock 16 MB board with its Xiaomi U-Boot 2018.09 and the official OpenWrt image. The folder takes your router's u-boot and factory (Wi-Fi calibration; all four MACs are replaced). Config and Bdata hold the serial number and passwords and are not needed.
  • xiaomi-mi-router-4a-gigabit-v2-breed: the board with its flash replaced by a 32 MB W25Q256JV and Breed 1.1 as the bootloader. Put Breed's settings (*u-boot-env*.bin) next to the dumps, without them Breed does not boot the firmware.
  • xiaomi-mi-router-4a-gigabit-v2-64m-uboot: a 64 MB W25Q512JV. Neither the stock U-Boot nor Breed 1.1 knows that chip, so this preset uses OpenWrt's U-Boot 2026.07 built for the board (sources and build.sh in tools/uboot-mi-router-4a-gigabit-v2; not built by CI). It boots in the emulator but has not booted on a real router yet: do not flash it.
• OpenWrt for a bigger flash than the board was made with: tools/ib-flash-size.py builds it from the official ImageBuilder, changing only the kernel's device tree (firmware to the end of the flash). prepare-nand.sh --nor-mb 32|64 runs it on its own when the dumps folder has no sysupgrade image.
• Fix: kernel timestamps jumped on MT7621 (4.x → 8795.x → 0.x in dmesg). The emulated GIC counter was 32 bits wide while Linux uses it as a 64-bit clock, so it wrapped every 4.88 s. It is 64 bits now, as on the chip.
• Fix: a reboot from Linux could hang at "Trying to boot from NOR" on boards with a U-Boot SPL. At reset the second CPU core ran the bootloader alongside the first and damaged it. The second core now waits to be started, as on the chip.
• Fix: the stock Xiaomi U-Boot saw 32 KB of RAM. The CPU data cache model now keeps both the cached and the memory contents of a line written uncached while dirty, as a real cache does.
• Flash folders of the 16 MB and the 32 MB (Breed) 4A Gigabit presets are on Google Drive and Yandex Disk.

Full Changelog: v3.9...v4.0

Router Emulator 3.9

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash).
Board presets are a separate archive, ...-presets.zip: unpack it over the
package. No flash images are included: build them with tools/prepare-nand.sh
(see README.md / README.ru.md), take ready ones from
Google Drive
or Yandex Disk, or use dumps of a real router.

What's new in 3.9

• Fix: the Windows launcher dropped nor-id on MT7621 boards. In 3.8 the Cudy M1300 v2 preset's XMC chip (nor-id=204018) never reached the emulator on Windows, so it ran with the default Winbond chip and the stock admin login could not work there. The launcher now passes nor, nor-id and nor-uid to MT7621 boards (Linux was not affected).
• SPI-NOR of 32 and 64 MB on MT7621 (nor=32, nor=64), as on boards like the ZBT WG3526-32M or GL.iNet GL-MT1300. Over 16 MB the chip uses 4-byte addresses; without nor-id the Winbond chip of that size answers (W25Q256JV ef4019, W25Q512JV ef4020). Tested: OpenWrt for the ZBT WG3526-32M sees 32 MB and data written past 16 MB survives a reboot; the stock Cudy M1300 v2 U-Boot reads a W25Q512JV's ID (it does not know that chip, warns and boots on).
• Board preset editor (Windows):
  • NOR UID for MT7621 boards with a SPI-NOR on the "Chip identity" tab (stock Cudy firmware: the 16 digits after the - of /proc/sys/dev/flash_uuid), and the chosen NOR chip ID is now saved for MT7621 boards.
  • New boot flash choice "SPI-NOR 32 MB (Winbond W25Q256JV)"; the 32 and 64 MB chips can be used on MT7621 boards. "XMC XM25QH128C/D" (same ID).
  • The MT7621 tab is now "PCIe / CPU", right after "Ethernet", with a line on what it is for.
  • Fields the chosen SoC or device does not have are hidden instead of greyed out, the rows below move up; "Chip identity" is hidden when nothing on it applies (MT7621 with parallel NAND).

Full Changelog: v3.8...v3.9

Router Emulator 3.8

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash).
Board presets are a separate archive, ...-presets.zip: unpack it over the
package. No flash images are included: build them with tools/prepare-nand.sh
(see README.md / README.ru.md), take ready ones from
Google Drive
or Yandex Disk, or use dumps of a real router.

What's new in 3.8

• New preset: Cudy M1300 v2 (MT7621A, MIPS; 1G WAN on MT7530 PHY 4 muxed to GMAC1 + 1G LAN on switch port 3, DDR3 128 MB, SPI-NOR 16 MB XMC XM25QH128D, stock Cudy U-Boot 1.1.3, Wi-Fi MT7603E + MT7663E (MT7613BE) on PCIe, radio silent). It boots official OpenWrt (cudy_m1300-v2, new flash folder nor-m1300-v2, generated MAC 80:af:ca:11:22:33).
• Stock Cudy M1300 v2 firmware runs (LEDE, Linux 4.4, MediaTek's vendor Wi-Fi drivers), from a dump of your own router's whole flash (not provided; split at 0x30000 / 0x40000 / 0x50000 / 0xff0000 into mt7621.mtd0..4 files, see the README). Both Wi-Fi drivers come up, the ports auto-detect WAN, WAN gets its DHCP lease and reaches the internet, the web UI answers on 192.168.10.1 (-l user -o lan-ip=192.168.10.1). Its console has no shell (Cudy disabled it). For the admin password give the emulator your router's flash unique ID (next item).
• SPI-NOR chip ID and unique ID on MT7621: nor-id, nor-uid. Stock Cudy firmware builds /proc/sys/dev/flash_uuid from the NOR's ID and unique ID and compares it with bdinfo; with the emulated Winbond chip and no unique ID no admin password could be created, or every password was "Invalid password!". The M1300 v2 preset now has its XMC XM25QH128D (nor-id=204018); add -o nor-uid=<the 16 digits after the '-' of cat /proc/sys/dev/flash_uuid on your router> and the stock admin password can be set and logged in with.
• MT7621: CP0 timers through the GIC. VPE 0's CP0 timer was wired straight to IP7 for Breed; the stock M1300 v2 kernel never handles IP7 and got an "irq 7: nobody cared" storm. Every VPE's timer now goes through the GIC, routed to IP7 after reset, as Breed expects (its web console still works); Linux masks it.
• MT7530 port 5 as a MAC to GMAC1: MediaTek's SDK switch driver (stock M1300 v2) connects GMAC1 to switch port 5 over RGMII and runs the WAN as VLAN 2 there. The emulator dropped those frames, so the stock firmware had no WAN; they now pass. OpenWrt's PHY muxing is unchanged.
• MT7663E with MediaTek's vendor driver: the MT7663E model now answers what the vendor driver checks (chip version registers, firmware state, its RX interrupt bit, ROM patch semaphore and extended command events with the right IDs and lengths, answers a moment after the command, as the firmware does). It downloads its patch and firmware and brings up rai0 without timeouts or the oops on close. The MT7603E's vendor driver already worked. mt76 in OpenWrt works as before.
• MT7621 boards without USB (usb-port=none) keep the chip's xHCI root ports, with nothing on them: Linux 4.4 gave up on a root hub without ports ("No ports on the roothubs?").

Full Changelog: v3.7.1...v3.8

Router Emulator 3.7.1 (presets)

Board presets only, no new packages: unpack Router-Emulator-3.7.1-presets.zip
over the Router Emulator 3.7 package (Windows, Linux x86_64 or aarch64) of
release v3.7, replacing its presets folder.

Presets 3.7.1

Presets-only release for the 3.7 packages: unpack Router-Emulator-3.7.1-presets.zip over the 3.7 package folder (replacing presets/).

• New preset: Bazis AX3000WM / WD-R3000N-G2A (the same board, Shenzhen Jia Yan Technology WD-R3000N-G2A sold as Bazis AX3000WM): MT7981B, 2.5G WAN MaxLinear GPY211C on GMAC0, 1G LAN on the built-in PHY (no switch), DDR3 256 MB, NAND 128 MB, USB 3.0, reset and mesh buttons, six LEDs. Boots official OpenWrt (bazis_ax3000wm, flash folder nand-ax3000wm, in dumps/ on Google Drive and Yandex Disk) and the vendor firmware from a dump of your own router (not provided).

Full Changelog: v3.7...v3.7.1

Router Emulator 3.7

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash).
Board presets are a separate archive, ...-presets.zip: unpack it over the
package. No flash images are included: build them with tools/prepare-nand.sh
(see README.md / README.ru.md), take ready ones from
Google Drive
or Yandex Disk, or use dumps of a real router.

What's new in 3.7

• Vendor firmware with MediaTek's SDK Ethernet driver no longer hangs. That driver (kernel 5.4: SNR-CPE-AX2 firmware, stock Cudy WR3000P) routes the Ethernet interrupts itself (FE_INT_GRP). The emulator used mainline's routing, so a "Trigger FE Misc ISR: 0x0" interrupt storm started as soon as eth came up and the watchdog rebooted the board. The emulator now follows the routing the driver programs and has the PDMA interrupt lines (GIC 189..192). Mainline OpenWrt is unchanged.
• gmac1=mt7531-p5: GMAC1 linked over SGMII to MT7531 port 5, as on MediaTek's reference design. Also in the Windows preset editor.
• New preset: SNR-CPE-AX2 (MT7981B, 5×1G MT7531 with WAN on port 0, DDR3 256 MB, NAND 128 MB, no USB). It boots official OpenWrt (snr_snr-cpe-ax2, new flash folder nand-snr-cpe-ax2). The SNR firmware boots from a dump of your own router's whole NAND (not provided; one file mt7981.mtd0.<name>.bin in a flash folder); its WAN goes through GMAC1 and switch port 5, both WAN and LAN work.
• nand-id: the bytes the SPI-NAND answers to READ ID, e.g. nand-id=c8017f7f7f = ESMT F50L1G41LB, the chip of the real Cudy WR3000P. Stock Cudy firmware compares chip ID + unique ID with fuuid in bdinfo ("Invalid board info!" otherwise): with nand-id=c8017f7f7f and nand-uid = the 32 hex digits after C801- it matches. The Windows preset editor has the ESMT chip in the boot flash list and an editable chip ID field, filled in from the chosen chip.
• Cudy WR3000P v1 preset: ESMT F50L1G41LB NAND (nand-id=c8017f7f7f), the chip of the real board, instead of the Winbond one. OpenWrt (its U-Boot and Linux) runs with it as before; the stock Cudy firmware now gets the flash_uuid of the real router.
• TP-Link TL-7DR7230 (OpenWrt snapshot): the new MT7988 DDR init in the snapshot BL2 (TF-A 2.14) printed "gddrphyfmeter_value = 0" and 256 "fcWAVEFORM_MEASURE_A ... time out" errors. The emulator now answers its DDR PHY frequency meter and the test agent's waveform measure mode; the BL2 log is clean.
• Stock Cudy WR3000P firmware: Wi-Fi comes up instead of crashing. MediaTek's vendor Wi-Fi driver runs the Wi-Fi through WED (Wireless Ethernet Dispatch): it enables the Wi-Fi's receive path and takes its interrupts there. The emulator now passes the Wi-Fi's receive enable and interrupts through WED and answers each firmware command with the length the firmware gives it. The vendor driver downloads and starts its firmware and creates ra0; before, the init failed and the Wi-Fi daemon crashed the kernel. The radio stays silent, as for OpenWrt.
• WED offload CPU (WO) answered: MediaTek's vendor driver sends messages to WED's offload CPU and waited 3 s for each answer, on the SNR-CPE-AX2 forever (one every 3 s), on the stock Cudy WR3000P 8 times at boot (~24 s). The emulator now has the WO's mailbox and message rings and answers every request; the driver loads the WO firmware the image carries, sees the CPU running and its heartbeat. No more warp_msg_wait_rsp ... timeout; on the SNR both ra0 and rax0 come up.

Full Changelog: v3.6.1...v3.7

Router Emulator 3.6.1 (presets)

Board presets only, no new packages: unpack Router-Emulator-3.6.1-presets.zip
over the Router Emulator 3.6 package (Windows, Linux x86_64 or aarch64) of
release v3.6, replacing its presets folder.

Presets 3.6.1

Presets-only release for the 3.6 packages: unpack Router-Emulator-3.6.1-presets.zip over the 3.6 package folder (replacing presets/).

USB fixed to match the real boards (OpenWrt device trees and hardware lists):

• Cudy WR3000U v1: USB 3.0 (was: no USB).
• Routerich AX3000 v1: USB 3.0 (was: 2.0).
• Xiaomi Mi Router 4: no USB (the preset used to get the MT7621 default, USB 3.0).

The board table in the README now also shows USB 3.0 for the Cudy WR1300S (the preset was already right). Flash folders did not change.

Full Changelog: v3.6...v3.6.1

Router Emulator 3.6

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash).
Board presets are a separate archive, ...-presets.zip: unpack it over the
package. No flash images are included: build them with tools/prepare-nand.sh
(see README.md / README.ru.md), take ready ones from
Google Drive
or Yandex Disk, or use dumps of a real router.

What's new in 3.6

Board presets are a separate archive

The packages no longer contain presets/. Every release now has Router-Emulator-<version>-presets.zip next to the packages, on GitHub, Google Drive and Yandex Disk. Unpack it over the package; it adds the presets folder.

• Upgrading from 3.5: unpack the new package and Router-Emulator-3.6-presets.zip into the same place. If you edited presets, keep a copy of your presets folder and put your files back afterwards.
• Presets-only releases: when only presets change, a release X.Y.Z (e.g. 3.6.1) brings just a new presets archive for the X.Y packages, without new binaries.
• No presets found: emulator.sh and emulator.exe now say where to get them.

Corrected RAM sizes

Checked every preset against the hardware list in the OpenWrt commit that added the board. Six were wrong:

Board	Was	Now
Cudy WBR3000UAX v1	256 MB	512 MB DDR3
Cudy WR3000U v1	256 MB	512 MB DDR3
Routerich AX3000 v1	256 MB	512 MB DDR3
Teltonika RUTC50	256 MB	512 MB
Cudy WR3000H v1	512 MB	256 MB DDR3
TP-Link TL-7DR7230 v1	1 GB	512 MB DDR4

The Teltonika RUTC50's USB port is USB 2.0, not 3.0. The flash folders did not change.

CI

The workflow's GitHub actions moved to their Node.js 24 versions, which removes the Node.js 20 deprecation warnings.

Full Changelog: v3.5...v3.6

Router Emulator 3.5

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash). No flash images are
included: build them with tools/prepare-nand.sh (see README.md /
README.ru.md), or use dumps of a real router.

What's new in 3.5

Wi-Fi TX power fixed (Filogic boards)

LuCI and iwinfo showed a maximum of about 3 dBm (6 dBm on 4-chain MT7986 boards). Now they show 20 dBm, as the board's calibration gives:

• MT7981 / MT7986 WMAC model: the WF top IP version register answered 0x02090000 (MT7986: 0). The mt7915 driver polls it for 0x02060000 before it starts the WM CPU, and right after that it stores the a-die SKU. The poll timed out without an error message. The driver never saw the MT7976 a-die, read the TX power from the MT7915 EEPROM offsets and got 0. Measured on a Cudy WR3000P with its real calibration: 3 dBm before, 20 dBm now on both bands.
• Minimal Wi-Fi EEPROM (boards without their own Factory: GL-MT6000, Netcore N60, N60 Pro, Xiaomi Redmi AX6000, Bananapi BPi-R4): the generated EEPROM had no target TX power. It now has 20 dBm per path (tools/mknand.py, tools/mkemmc.py).

Flash folders

Rebuilt with the new EEPROM: Router-Emulator-emmc-gl-mt6000.zip, Router-Emulator-nand-n60.zip, Router-Emulator-nand-n60-pro.zip, Router-Emulator-nand-redmi-ax6000.zip, Router-Emulator-emmc-bpi-r4.zip (Google Drive, Yandex Disk). The other folders did not change: their EEPROM is the board's own calibration, and the fixed QEMU is enough for them.

QEMU: patch 0048.

Full Changelog: v3.4...v3.5

Router Emulator 3.4

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash). No flash images are
included: build them with tools/prepare-nand.sh (see README.md /
README.ru.md), or use dumps of a real router.

What's Changed

• Report PAN to the guest; Linux build with PGO (version 3.4) by @fildunsky in #5
• Linux PGO build: PGO_NAND=DIR switches it on (fixes the 3.4 release run) by @fildunsky in #6

What's new in 3.4

Faster guest system calls: PAN (Filogic boards)

The Cortex-A53 / A73 cores have no PAN (Privileged Access Never), so OpenWrt's arm64 kernel emulates it by switching TTBR0 on every kernel entry and exit, and under QEMU's TCG every switch flushes the whole TLB. The Filogic machines now report PAN in the CPU ID registers (machine option pan, default on), and the kernel uses the PAN that QEMU implements anyway. Measured on a Cudy WR3000P (pan=on vs pan=off):

	pan=on	pan=off
200 × ubus call system board	1.6 s	4.6 s	2.9× faster
100 × uci show network	0.5 s	1.3 s	2.7× faster
500 × /bin/true (fork + exec)	1.5 s	4.3 s	2.8× faster
procd "init complete" (guest uptime)	26 s	38 s	30 % sooner
full boot, until QEMU goes quiet	47 s	58 s	18 % faster
host CPU for the full boot	38 s	63 s	39 % less

LuCI, uci, init scripts and package installs gain the most; BL2, U-Boot and the early kernel do not change. pan=off keeps the cores' own ID registers. The MT7621 (MIPS) boards are not concerned. Same on Windows and Linux: it is the guest's code path, not the host's.

Linux packages built with PGO

The Linux packages (x86_64, aarch64) are now built with profile-guided optimisation, as the Windows one already was: an instrumented QEMU boots OpenWrt on a WR3000P and runs shell / ubus / uci work, then QEMU is rebuilt with that profile (~8–10 % faster on system-call heavy guest work). Own builds: PGO_NAND=nand-wr3000p ./build.sh, see README.build.linux.md.

Flash folders

Unchanged, keep those of 3.3 (Google Drive, Yandex Disk).

QEMU: patch 0047.

Full Changelog: v3.3...v3.4

Router Emulator 3.3

Packages: ...-win64.zip (Windows 10/11 x64, run emulator.exe) and
...-linux-x86_64.tar.gz (run ./emulator.sh), ...-linux-aarch64.tar.gz
(64-bit Arm Linux: Raspberry Pi 4/5, TV boxes with CoreELEC; also with a
32-bit userland, run ./bash emulator.sh where there is no bash). No flash images are
included: build them with tools/prepare-nand.sh (see README.md /
README.ru.md), or use dumps of a real router.

What's new in 3.3

New preset: Cudy WR1300S

MT7621A, DDR3 128 MB, SPI-NOR 16 MB, the stock Cudy U-Boot 1.1.3, 4×1G LAN on the MT7530 and the WAN on GMAC1 (the switch's PHY 0 muxed through port 5), USB 3.0, Wi-Fi MT7603E 2.4 GHz + MT7663E (MT7613BE) 5 GHz (radio silent). The board is not in OpenWrt yet (PR #22365): its flash folder carries an OpenWrt 25.12.5 build for it. tools/prepare-nand.sh --soc mt7621 --nor --stock DIR cudy_wr1300s builds it from the router's u-boot and factory (bdinfo, which holds the MAC and encrypted board data, is generated with the MAC 80:af:ca:11:22:33) and the sysupgrade.bin.

MT7621 (MIPS)

• MT7663E Wi-Fi card (pcie0..2=mt7663e, driver mt7615e): the ROM patch and N9 firmware load, hostapd runs on 5 GHz; nothing goes on the air.
• The stock MediaTek U-Boot of SPI-NOR boards works: the SPI controller's legacy mode and automatic chip select, the whole flash memory-mapped at 0x1c000000.
• Fixed: a rare abort at boot ("Bad ram pointer", about 1 in 100 boots of the ZBT-WG3526): locking L2 cache lines flushed the other CPUs' TLBs from the wrong thread.

Presets

• The presets with OpenWrt's own BL2 / FIP ("ubootmod" images) now say so in their name: "(U-Boot layout)".
• Preset editor: MT7663E in the PCIe slot choices.

Flash folders

New Router-Emulator-nor-wr1300s.zip on Google Drive and Yandex Disk; the other folders did not change.

QEMU: patches 0044–0046.

Full Changelog: v3.2...v3.3