The Cisco RV220W Wireless-N Network Security Firewall is a five-port Gigabit router based on a Cavium OCTEON Plus CN5010 SoC, a Broadcom BCM53115 switch, and a removable Broadcom BCM4322 Mini PCI wireless card.
An out-of-tree OpenWrt port is available from the RV220W research repository. Release 1.16.0-rc7, based on OpenWrt v25.12.5, has been hardware-qualified on an RV220W-A V01 with PCB YK910A-1.6.
This device is not supported by official OpenWrt releases. The images and installation tools linked from this page are an independent, out-of-tree port and are not produced or supported by the OpenWrt project.
No official OpenWrt release currently contains an RV220W device profile.
| Port release | OpenWrt base | Status | Source and documentation |
|---|---|---|---|
1.16.0-rc7 | v25.12.5 | Out-of-tree, hardware-qualified release candidate | Source repository |
The qualified port supports persistent SquashFS/JFFS2, LuCI, normal configuration-preserving sysupgrade, WAN, all four LAN ports, 2.4 GHz BCM4322/b43 wireless, and the POWER, DIAG, WLAN, and DMZ LEDs.
| Architecture | MIPS64, Cavium OCTEON Plus |
|---|---|
| SoC | Cavium/Marvell CN5010-SCP pass 1.1, one active core at 400 MHz |
| OpenWrt target | octeon/generic with an out-of-tree RV220W device profile |
| RAM | 128 MiB DDR2, two Etron EM68B16CWQD-25H devices |
| Flash | 32 MiB Macronix MX29GL256EHT2I-90Q parallel NOR |
| Ethernet | Broadcom BCM53115, 1 x Gigabit WAN and 4 x Gigabit LAN |
| Wireless | Broadcom BCM4322 Mini PCI, PCI ID 14e4:432b, 802.11a/b/g/n hardware |
| Qualified wireless operation | 2.4 GHz AP and client operation using b43; 5 GHz is not qualified |
| USB | No exposed USB port; the OpenWrt device tree disables USB |
| Bootloader | Vendor U-Boot 1.1.1 development revision 193M, with a required qualified policy patch |
| Serial | JP1, 3.3 V TTL, 115200 8N1 |
| Tested board | RV220W-A V01, PCB YK910A-1.6 |
The first installation can modify the boot chain, U-Boot environment, kernel, and rootfs in parallel NOR flash. A mistake or power loss can brick the router.
Before writing anything, make a verified full 32 MiB NOR backup, confirm JP1 serial access, and have a suitable external parallel-NOR recovery method. Never continue when the helper reports unknown U-Boot bytes, an unexpected flash geometry, a failed checksum, or a failed readback.
The Cisco web interface cannot install these images. First installation uses the repository's guarded UART/TFTP workflow.
RV220W-A V01 / PCB YK910A-1.6 matching the tested hardwareClose picocom, minicom, screen, and any other process using the serial adapter before starting the helpers.
These are independent project images, not official OpenWrt downloads. The links are pinned to the RC7 publication commit 1ba5ecb63f9b6c36facc158522db5e8066bdcffb so they cannot change with the repository's default branch:
Verify the images before use:
d08f9250eb2adde128873c8f8b9a2fdeba7423d897c9d90fa8bd9535e48b85ee rv220w-openwrt-release-initramfs.elf 23e3405895d5442ed3f934c2242644428e8deffcd4c33a76b5ad332452394882 rv220w-openwrt-release-sysupgrade.tar
The guided liveboot helper automatically detects and verifies the image pair included under prebuilt/ in the research repository.
The release pins OpenWrt and all feeds to exact commits. On the supported host:
git clone https://github.com/Gadorach/rv220w-research.git cd rv220w-research/openwrt make verify make all
The build uses a dedicated Ubuntu 24.04 Distrobox and writes images to openwrt/build/artifacts/.
Clone the repository, enter its openwrt/ directory, and run:
make u-boot-verify make u-boot-patches make initramfs-liveboot
make u-boot-verify performs a read-only bootloader compatibility and environment check. make u-boot-patches offers either a complete 32 MiB backup or a warning-gated 640 KiB backup covering the 512 KiB boot chain and 128 KiB U-Boot environment before any write.
The helper recognizes known stock-compatible, partially patched, and qualified-patched states. Unknown content fails closed. The exact untouched-stock classification branch is regression-tested; the destructive write machinery was hardware-qualified by a forced rewrite of an already-qualified unit.
The qualified U-Boot policy is:
bootdelay=3 bootcmd=run openwrt_boot
make initramfs-liveboot temporarily configures the host as 192.168.240.1/24, configures U-Boot as 192.168.240.2, intercepts U-Boot, and TFTP-loads the initramfs ELF. The RAM environment starts at 192.168.1.1.
You can stop after RAM boot for a non-persistent recovery session. If permanent installation is selected, the helper verifies the sysupgrade image, requires the exact confirmation INSTALL RV220W, writes rootfs first and kernel last, verifies both partitions by SHA-256 readback, and reboots only after both pass.
Read the complete installation guide and recovery guide before starting.
| Setting | Default |
|---|---|
| LAN | 192.168.1.1/24 |
| LuCI | http://192.168.1.1/ |
| Wireless | OpenWrt, 2.4 GHz |
| Wireless security | Open; no password |
| WLAN LED | Network activity on phy0-ap0, TX and RX |
Set a root password and configure WPA2/WPA3 wireless security immediately.
After the router is already running this RV220W port, use the project sysupgrade tar through LuCI's System → Backup / Flash Firmware page or the normal command-line sysupgrade process. Configuration-preserving LuCI sysupgrade has been hardware-qualified.
Do not use normal sysupgrade as the first-install method from Cisco firmware; use the guarded UART/TFTP workflow above.
The captured stock firmware used the following physical layout. The Linux-visible partition named bootload-env at 0x01780000 is not the actual U-Boot environment; U-Boot uses the final 128 KiB sector at 0x01fe0000.
| Offset | Size | Region | Notes |
|---|---|---|---|
0x00000000 | 192 KiB | boot stub | First three 128 KiB sectors |
0x00030000 | 320 KiB | U-Boot | Ends at 0x00080000 |
0x00080000 | 6 MiB | Cisco kernel | Vendor header and ELF64 kernel |
0x00680000 | 16 MiB | Cisco rootfs | Big-endian SquashFS 3.0 |
0x01680000 | 1 MiB | Cisco data | Big-endian JFFS2 configuration/data |
0x01780000 | 128 KiB | Linux-named bootload-env | Not the environment used by U-Boot |
0x017a0000 | 8448 KiB | Unmapped vendor tail | Erased in the captured unit |
0x01fe0000 | 128 KiB | Actual U-Boot environment | Final NOR sector |
The OpenWrt layout preserves the boot chain and final U-Boot environment while reclaiming the old data partition and unused vendor tail for rootfs.
| Offset | Size | MTD region | Policy |
|---|---|---|---|
0x00000000 | 512 KiB | boot-chain | Preserved after the qualified boot-policy patch |
0x00080000 | 6 MiB | openwrt-kernel | Gzip-compressed ELF copied and decompressed by U-Boot |
0x00680000 | 25,984 KiB | rootfs | SquashFS with automatically split JFFS2 rootfs_data |
0x01fe0000 | 128 KiB | uboot-env | Preserved; managed only by the guarded U-Boot workflow |
A complete stock backup is required for full restoration of the Cisco firmware layout.
The BCM53115 is managed by Linux B53/DSA at pseudo-PHY address 0x1e.
| Front-panel port | BCM53115 port | Octeon path | OpenWrt interface |
|---|---|---|---|
| WAN | 0 | CPU port 5 → eth1 | wan |
| LAN1 | 1 | CPU port 8 → eth0 | lan1 |
| LAN2 | 2 | CPU port 8 → eth0 | lan2 |
| LAN3 | 3 | CPU port 8 → eth0 | lan3 |
| LAN4 | 4 | CPU port 8 → eth0 | lan4 |
The default LAN bridge contains lan1 through lan4. WAN uses an independent CPU conduit and is isolated by the default OpenWrt firewall policy.
| Subsystem | Component | Notes |
|---|---|---|
| CPU | Cavium/Marvell CN5010-400BG564-SCP-G | OCTEON Plus networking SoC, 400 MHz |
| RAM | 2 x Etron EM68B16CWQD-25H | 64 MiB each, 128 MiB total |
| Flash | Macronix MX29GL256EHT2I-90Q | 32 MiB, 3 V, x16 parallel NOR |
| Switch | Broadcom BCM53115SKFBG | Five integrated Gigabit PHYs |
| Wireless | Broadcom BCM4322LKFBG | Full-size Mini PCI, physical SPROM |
The stock firmware is based on Linux 2.6.21.7-Cavium-Octeon. The qualified port uses OpenWrt v25.12.5 with Linux 6.12.94.
JP1 is the confirmed primary UART. Pin 1 is the square pad furthest from the JP1 reference designator.
| JP1 pin | Target function | USB-UART connection |
|---|---|---|
| 1 | VCC/VREF | Do not connect |
| 2 | TX | Adapter RX |
| 3 | RX | Adapter TX |
| 4 | GND | Adapter GND |
| Serial parameters | 115200 baud, 8 data bits, no parity, 1 stop bit, no flow control |
|---|---|
| Logic level | 3.3 V TTL |
| U-Boot prompt | rv200w# |
Connect only TX, RX, and GND. Leave USB-UART VCC disconnected. JP2 is a separate unconfirmed interface and must not be assumed to have the same pinout.
The physical reset/recovery button is active-low on CN5010 GPIO 1. The qualified boot-policy patch preserves the U-Boot Sercomm recovery path when the button is held during boot.
Linux reset-button policy is intentionally disabled in the current device tree and remains unqualified. Do not assume that holding the button after Linux starts performs an OpenWrt factory reset.
The following mainboard LEDs are exposed through gpio-leds and were hardware-qualified:
| LED | GPIO | Polarity | Default policy |
|---|---|---|---|
| POWER, green | 2 | Active low | Preserve bootloader state |
| DIAG, red | 3 | Active low | Off |
| WLAN, green | 4 | Active low | netdev activity on phy0-ap0 |
| DMZ, green | 6 | Active low | Off |
Recovery options, in increasing order of severity:
Do not intentionally reboot or remove power after a rootfs or kernel write begins unless the corresponding readback PASS marker has appeared. See the project phase-specific recovery guide.
The final RC7 transcript records initramfs TFTP boot, sysupgrade validation, rootfs-first and kernel-last writes, SHA-256 readback, persistent NOR reboot, LAN/LuCI defaults, wireless operation, and LED policy.
RV220W-A V01 / YK910A-1.6 hardware is qualified.