Cisco RV220W

The Cisco RV220W Wireless-N Network Security Firewall is a five-port Gigabit router based on a Cavium OCTEON Plus CN5010 SoC, a Broadcom BCM53115 switch, and a removable Broadcom BCM4322 Mini PCI wireless card.

An out-of-tree OpenWrt port is available from the RV220W research repository. Release 1.16.0-rc7, based on OpenWrt v25.12.5, has been hardware-qualified on an RV220W-A V01 with PCB YK910A-1.6.

No official OpenWrt release currently contains an RV220W device profile.

The qualified port supports persistent SquashFS/JFFS2, LuCI, normal configuration-preserving sysupgrade, WAN, all four LAN ports, 2.4 GHz BCM4322/b43 wireless, and the POWER, DIAG, WLAN, and DMZ LEDs.

The Cisco web interface cannot install these images. First installation uses the repository's guarded UART/TFTP workflow.

• Cisco RV220W-A V01 / PCB YK910A-1.6 matching the tested hardware
• 3.3 V USB-UART adapter connected to JP1 at 115200 8N1
• UART adapter VCC left disconnected
• Direct Ethernet connection from the host to one of the four LAN ports
• Verified boot-chain and U-Boot-environment backups
• Preferably a verified full 32 MiB stock NOR backup and external programmer access
• CachyOS/Arch Linux with fish, Podman, and Distrobox for the supported automated build workflow

Close picocom, minicom, screen, and any other process using the serial adapter before starting the helpers.

These are independent project images, not official OpenWrt downloads. The links are pinned to the RC7 publication commit 1ba5ecb63f9b6c36facc158522db5e8066bdcffb so they cannot change with the repository's default branch:

• rv220w-openwrt-release-initramfs.elf - RAM installer and recovery image
• rv220w-openwrt-release-sysupgrade.tar - persistent kernel/rootfs image
• SHA256SUMS

Verify the images before use:

d08f9250eb2adde128873c8f8b9a2fdeba7423d897c9d90fa8bd9535e48b85ee  rv220w-openwrt-release-initramfs.elf
23e3405895d5442ed3f934c2242644428e8deffcd4c33a76b5ad332452394882  rv220w-openwrt-release-sysupgrade.tar

The guided liveboot helper automatically detects and verifies the image pair included under prebuilt/ in the research repository.

The release pins OpenWrt and all feeds to exact commits. On the supported host:

git clone https://github.com/Gadorach/rv220w-research.git
cd rv220w-research/openwrt
make verify
make all

The build uses a dedicated Ubuntu 24.04 Distrobox and writes images to openwrt/build/artifacts/.

Clone the repository, enter its openwrt/ directory, and run:

make u-boot-verify
make u-boot-patches
make initramfs-liveboot

make u-boot-verify performs a read-only bootloader compatibility and environment check. make u-boot-patches offers either a complete 32 MiB backup or a warning-gated 640 KiB backup covering the 512 KiB boot chain and 128 KiB U-Boot environment before any write.

The helper recognizes known stock-compatible, partially patched, and qualified-patched states. Unknown content fails closed. The exact untouched-stock classification branch is regression-tested; the destructive write machinery was hardware-qualified by a forced rewrite of an already-qualified unit.

The qualified U-Boot policy is:

bootdelay=3
bootcmd=run openwrt_boot

make initramfs-liveboot temporarily configures the host as 192.168.240.1/24, configures U-Boot as 192.168.240.2, intercepts U-Boot, and TFTP-loads the initramfs ELF. The RAM environment starts at 192.168.1.1.

You can stop after RAM boot for a non-persistent recovery session. If permanent installation is selected, the helper verifies the sysupgrade image, requires the exact confirmation INSTALL RV220W, writes rootfs first and kernel last, verifies both partitions by SHA-256 readback, and reboots only after both pass.

Read the complete installation guide and recovery guide before starting.

Set a root password and configure WPA2/WPA3 wireless security immediately.

After the router is already running this RV220W port, use the project sysupgrade tar through LuCI's System → Backup / Flash Firmware page or the normal command-line sysupgrade process. Configuration-preserving LuCI sysupgrade has been hardware-qualified.

Do not use normal sysupgrade as the first-install method from Cisco firmware; use the guarded UART/TFTP workflow above.

The captured stock firmware used the following physical layout. The Linux-visible partition named bootload-env at 0x01780000 is not the actual U-Boot environment; U-Boot uses the final 128 KiB sector at 0x01fe0000.

The OpenWrt layout preserves the boot chain and final U-Boot environment while reclaiming the old data partition and unused vendor tail for rootfs.

A complete stock backup is required for full restoration of the Cisco firmware layout.

The BCM53115 is managed by Linux B53/DSA at pseudo-PHY address 0x1e.

The default LAN bridge contains lan1 through lan4. WAN uses an independent CPU conduit and is isolated by the default OpenWrt firewall policy.

The stock firmware is based on Linux 2.6.21.7-Cavium-Octeon. The qualified port uses OpenWrt v25.12.5 with Linux 6.12.94.

JP1 is the confirmed primary UART. Pin 1 is the square pad furthest from the JP1 reference designator.

The physical reset/recovery button is active-low on CN5010 GPIO 1. The qualified boot-policy patch preserves the U-Boot Sercomm recovery path when the button is held during boot.

Linux reset-button policy is intentionally disabled in the current device tree and remains unqualified. Do not assume that holding the button after Linux starts performs an OpenWrt factory reset.

The following mainboard LEDs are exposed through gpio-leds and were hardware-qualified:

Recovery options, in increasing order of severity:

1. TFTP RAM-boot the retained initramfs and decline permanent installation.
2. From the RAM environment, rerun the guarded direct installer to repair kernel/rootfs.
3. Hold the physical recovery button during boot to enter the preserved Sercomm recovery path.
4. Use the U-Boot helper to verify or repair a recognized boot-policy/environment state.
5. Externally restore a verified complete 32 MiB NOR backup if U-Boot cannot run.

Do not intentionally reboot or remove power after a rootfs or kernel write begins unless the corresponding readback PASS marker has appeared. See the project phase-specific recovery guide.

• Hardware qualification matrix
• RC7 UART liveboot/install transcript
• Current project status and known limitations

The final RC7 transcript records initramfs TFTP boot, sysupgrade validation, rootfs-first and kernel-last writes, SHA-256 readback, persistent NOR reboot, LAN/LuCI defaults, wireless operation, and LED policy.

• The port is out-of-tree and has not undergone upstream OpenWrt review.
• Only the tested RV220W-A V01 / YK910A-1.6 hardware is qualified.
• BCM4322 2.4 GHz operation is qualified; 5 GHz behavior is not.
• Linux reset-button semantics and watchdog policy remain incomplete.
• Long-duration reliability, performance, and all remaining GPIO details are not fully characterized.
• Untouched-stock U-Boot classification is logic-tested; the destructive path was qualified through a forced rewrite of an already-qualified unit.