Askey RTF8316VW Support: Airoha AN7583, Wi-Fi 7 MT7992AV, 1x10Gb RTL8261BE, G-PON/XGS-PON

Askey RTF8316VW

SoC: Airoha AN7583GT Dual-Core A53 1.2GHz + 6-core RISC-V Network Processing Unit
RAM: 1GB DDR4 Micron MT40A512M16TB-062E:R x1
NAND SPI: 512MB Winbond 25N04KVZEIR — same as Quantum Fiber W1700K
MT7530 on the SoC, 3x1Gb RJ45 ports
Realtek RTL8261BE PHY 1x10Gb RJ45 port
MediaTek MT7992AV Wi-Fi 7 Filogic 660 + NPU offload
MediaTek MT7979N 5GHz 5T5R 4SS BW160 + 1R 0-DFS
MediaTek MT7975N 2.4GHz 4T4R 2SS BW40
MAC G-PON/XGS-PON on the SoC + NPU
PHY G-PON EN7571
PHY XGS-PON AN8901
Potron PQ4300811 G-PON + XGS-PON BOSA 1xSC/APC
MaxLinear DXS101 SLIC 1xFXS RJ11 (Lantiq/Intel PEF32001)

4 LEDs: telephone, wifi, wifi+, internet
3 buttons: Wi-Fi/WPS, reset, power on/off
RJ45 port LEDs green/yellow
Stock FW: “ASP” vendor layer on top of OpenWrt 21.02.1, Linux 5.4.55.
Bootloader: U-Boot

Soldering pending:

Is that available for purchase anywhere or some ISP unit?

It appears to be the Movistar Smart WiFi 7 Router, sold in Spain for EUR60.

Indeed, it’s the Smart WiFi 7 from Movistar, a Spanish ISP that is deploying it.

I bought it on Wallapop Spain for 50€ after finding out about its specs.

The link @hurrian posted is, I’m afraid, the price for existing customers, but there are units for sale on Wallapop, not many, but they’re there.

I’ll try to contribute as much as I can, it’s also a learning experience for me since I’m not an expert, but the hardware seemed very interesting to me as practically everything is supported except for the PON part and the SLIC.

The SLIC is theoretically easy since it's a derivative of what some of the lantiq stuff used to ship, but the PON will be a hard one.

At least this ONU has WiFi so you could use it as an access point or something.

Airoha AN7583GT 4 núcleos ARM Cortex 64 bits con coprocesador de Red NPU (8 núcleos RISC-V)

Yes, I've read that information, but I can confirm that it's incorrectly referenced for the AN7583GT. This is more accurate:

What will WED2 be?

I don't know for certain. Of the three DTS files I've found referencing this SoC, only this one mentions it. It describes it identically in the AN/EN7581 DTS in that same repository:

The other two don't mention WED hardware availability for the moment because the PCIe side isn't fully supported yet. I think they're suggesting that this function is handled by one of the 6 RISC-V cores the NPU has:

https://gitlab.com/prpl-foundation/prplos/feeds/feed-airoha/-/blob/latest-24.10/airoha/dts/an7583.dtsi?ref_type=heads

To visualize it better, I asked Claude to compare the three DTS files (likely with some inaccuracies):

@Ansuel and @LorenzoBianconi are the official mainline Linux maintainers for the Airoha target:

Thanks to their work, they're driving support for these SoCs forward. They might actually know what hardware blocks this AN7583GT really contains.

It's also worth keeping in mind that these patches are very recent and more will probably come with additional support for the blocks the AN7583 contains.

No soldering required. Root access achieved with NAND flash memory partition dump:

00_bootloader.bin                524288/    524288 B  OK      ff916dc8f6005130bc60f3564350945f
01_kernel.bin                  10485760/  10485760 B  OK      ed2974248b969dbdd54e80f647ebe375
02_filesystem.bin              94371840/  94371840 B  OK      257702823c75a5290685de059702b116
03_kernel_slave.bin            10485760/  10485760 B  OK      188060688d1bd5c9b427f002db14080b
04_filesystem_slave.bin        94371840/  94371840 B  OK      4a776d4818ce202218d99c8dcfe29f42
05_rootfs_data.bin              8388608/   8388608 B  OK      53503a43ff4ad279a170a6a30b32710f
06_bootenv0.bin                 1048576/   1048576 B  OK      f66c8d6e72f9c7c8a2c8d5af8e7c1c57
07_bootenv1.bin                 1048576/   1048576 B  OK      55c1cf6373a794912c73dc32dddea6ed
08_defcfg.bin                   4194304/   4194304 B  OK      dc6e542b67c384d611d3fb6e69b26844
09_bakcfg.bin                   4194304/   4194304 B  OK      b2a96a06ccebd323f228081106838266
10_config.bin                   4194304/   4194304 B  OK      154326719cbb19ee049c20165c063a27
11_status.bin                   8388608/   8388608 B  OK      6bf9d53a0a057561bb2c7f0b231d197e
12_asp_data.bin               209715200/ 209715200 B  OK      ebb439bc5e4eb0f18878951d5a867a98
13_art.bin                      3670016/   3670016 B  OK      8199a565796143f98b89222909938a71

It runs OpenWrt with LuCI!

WED is deprecated on AN7581 and may have been removed by AN7583. All acceleration is in NPU, which is already supported in Openwrt main branch.

Please post DTS, boot log and /proc/mtd (and ideally, a flash dump so we can locate the MAC addresses) and we can get working on this.

How did you get to the LuCI page?

I was confused by having seen references to WED in the DTS I extracted from its memory.

Indeed, the NPU firmware compiled for this Askey programs the WiFi offload function of the MT7992AV — the integrated WiFi chip in this Askey — onto one of its six "harts".

I've reviewed mainline and the NPU firmware for the AN7583 ships "bare", it doesn't program it, so it's essential to recover the firmware that comes with this router to avoid losing that functionality. In contrast, for the EN7581 there are variants of that firmware specific to MediaTek WiFi chipsets:

In principle, the existing Airoha and mt76 infrastructure plugs into that Askey firmware and should bring everything up.

It runs a vendor SDK, there was no Airoha support in kernel v5/"Openwrt" 21.02.

After many, many attempts and prompts to Claude.

I had no soldering iron or TTL adapter, and even if I had, I was also worried about bricking it, so my only path was to put Claude Code in front of the restricted CLI this Askey exposes by default and "try my luck".

And after two or three days, after a lot of trial and error and giving up many times, we found a way to bypass that damn restricted CLI.

It escalated privileges but that wasn't enough — it was still inside that "jailed" CLI. With another couple of days and a lot of patience, it managed to execute a command that wrote to root, slipped through that gap, and reached full root.

That's how I was able to dump the full memory and make progress toward bringing mainline OpenWrt support.

Now I think I need to create a PR in the OpenWrt repository, but I'm waiting for the Airoha target to jump to kernel 6.18 and update its uboot-airoha to v2026.04:

I haven't tested the support on my unit yet because the NAND flash memory has vendor partitions and I don't want to wipe it entirely — even having a full backup — because I want to use one of the two banks it has for mainline OpenWrt while keeping the other vendor bank intact. I have everything documented; once I have it presentable, I'll submit the PR.

I know.

It's the Airoha SDK for this target, which is based on OpenWrt 21.02.01 + LuCI, on top of which it applies a layer called "ASP" with both a simple and advanced vendor interface. It's also what programs and configures the network.

As it turns out, while investigating, I found that the uhttpd service for LuCI was disabled — I told Claude to bring it up to see if LuCI would appear, and it did. But it's a Frankenstein, it's not functional because on top of it sits the vendor "ASP" virus.

Amazing work.

The WED is technically there but it is the version 1 from MT7622. All WIFI acceleration is handled by the NPU on AN7581 and AN7583. On EN7523 it is a hybrid solution with DS handled by the WED and US handled by the NPU.

Anyway the AN7583 is very similar to the AN7581. The PEF slic is mostly open but there are no PCM drivers yet. I am going to put some effort into PON eventually but it is quite complex and there are more pressing things to work on.

@platanopi Would you mind sharing the magic commands to bypass the closed CLI and finally access it via LUCI? thanks!!