Support for RTL9607C / RTL8198D Realtek SoC

Last edit date: Janurary 5th, 2026.
Quite a lot happened after September that i think makes it worthwhile to edit some of this original post.

Hello there,

I think it would be a good idea to have a general place for discussions on RTL9607C / RTL8198D SoC, routers (ONTs) based on this chip and their potential OpenWrt support.

As of now, i have a pull request pending to support loading initramfs image on these SoCs based machines. It is not much but at least it is a start.

Update Janurary 5th, 2026: i have also added rtl960x support to existing thermal driver, which enables the thermal sensor of the CPU, and I2C driver, which enables i2c communications with laser driver. Also, i have tested my rtl9607c based router with Linux 6.18 from this pull request and it appears to be functioning as normal.

For flashing sysupgrade/factory images, i personally haven’t tested them because my unit is a primary modem (for which i also don’t have a firmware because vendor doesn’t provide any) and i don’t have any other RTL9607C / RTL8198D based routers so, if anyone could be willing to test, that would be really nice.

Looking at firmware from other routers, it is basically a tar archive file with uImage, rootfs and a fwu.sh files. From the looks of it, it is loading uImage and rootfs to ubi volumes ubi_k{num} and ubi_r{num} inside the ubi_device mtd partition. It is dual flash layout due to presence of ubi_k0, ubi_k1 and ubi_r0, ubi_r1, which is the same layout on across the whole RTL9607C platform. Some RTL8198D based devices seem to also share the same firmware structure.

Potentially could be used to switch between OpenWrt and vendor firmware?

Update Janurary 5th, 2026: The ECC driver got merged into mainline linux and back-ported into OpenWrt. This now gives the ability to attach ubi_device partition and do stuff with it.

There is a GPL source code available from which is based on Linix 5.10.x and have all the necessary drivers for RTL9607C, from usb, pci to ethernet, wifi and the whole Realtek SDK.

Update Janurary 5th, 2026: Included the list of essential drivers/components and links to them:

  • USB Driver: Link
  • PCI Driver: Link
  • GPIO Driver: Link
  • Ethernet/NIC Driver: Link
  • Wifi Drivers: Link
  • SoC Drivers: Link
  • GPON Driver: Link
  • Hardware Offloading Drivers: Link
  • OMCI Driver: Link
  • Bismarck Preloader Code: Link

I have already started work on USB and PCI part (based on the drivers from GPL source code) but haven’t tested them because i wanted to keep pull request as simple as it can be for reviews. Some present realtek drivers can be reused for RTL9607C, perhaps with minor tweaks in some cases.

Update Janurary 5th, 2026: While i did some work on USB and PCI drivers, they are in back-burner right now.

Any kind of help or feedback are welcome here :slight_smile:

Oh if someone asks, i included RTL8198D in the title because its arch folder from gpl source code is a symlink to RTL9607C, which could very much mean that they share a lot in common with each other but it needs testing to verify that.
Update Janurary 5th, 2026: Yes, that is now 100% verified

4 Likes

Here is the bootlog of initramfs for anyone curious:

Phoebus# bootm
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-6.12.45
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5189860 Bytes = 4.9 MiB
   Load Address: 80100000
   Entry Point:  80100000
   Verifying Checksum ... OK
   Uncompressing Kernel Image
[    0.000000] Linux version 6.12.45 (binguy@binpc) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r30930+7-c589fb7baf) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Tue Sep 16 17:48:50 2025
[    0.000000] SoC Type: Realtek RTL9607C rev B (6831)
[    0.000000] printk: legacy bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.000000] MIPS: machine is Realtek RTL9607C Eng Board
[    0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[    0.000000] printk: legacy bootconsole [ns16550a0] enabled
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Using appended Device Tree.
[    0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] percpu: Embedded 12 pages/cpu s18416 r8192 d22544 u49152
[    0.000000] pcpu-alloc: s18416 r8192 d22544 u49152 alloc=12*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Kernel command line: earlycon
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65536
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] NR_IRQS: 256
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] CPU clock is 1150
[    0.000000] rtcl_clocks_init: clk_data.clk_num=2, ocp=1150000000, lx=200000000
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0x10939a911d9, max_idle_ns: 440795210078 ns
[    0.000002] sched_clock: 64 bits at 1150MHz, resolution 0ns, wraps every 2199023255551ns
[    0.009212] clocksource: realtek_otto_timer: mask: 0xfffffff max_cycles: 0xfffffff, max_idle_ns: 19112604400 ns
[    0.020672] Calibrating delay loop... 761.03 BogoMIPS (lpj=3805184)
[    0.067494] pid_max: default: 32768 minimum: 301
[    0.080661] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088837] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.106705] rcu: Hierarchical SRCU implementation.
[    0.112133] rcu:     Max phase no-delay instances is 1000.
[    0.119374] smp: Bringing up secondary CPUs ...
[    0.125703] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.125747] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.125759] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.125838] CPU1 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.200602] Counter synchronization [CPU#0 -> CPU#1]: passed
[    0.238664] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.238704] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.238715] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.238762] CPU2 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.590575] Counter synchronization [CPU#0 -> CPU#2]: passed
[    0.627683] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.627723] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.627735] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.627790] CPU3 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.720591] Counter synchronization [CPU#0 -> CPU#3]:
[    0.755591] Measured 8 cycles counter warp between CPUs
[    0.755839] smp: Brought up 1 node, 4 CPUs
[    0.768061] Memory: 236592K/262144K available (7951K kernel code, 638K rwdata, 1648K rodata, 10940K init, 249K bss, 24180K reserved, 0K cma-reserved, 0K highmem)
[    0.786580] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.797633] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.809952] pinctrl core: initialized pinctrl subsystem
[    0.818318] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.825680] FPU Affinity set after 15220 emulations
[    0.843614] clocksource: Switched to clocksource realtek_otto_timer
[    0.858756] NET: Registered PF_INET protocol family
[    0.864523] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.873645] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.883019] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.891702] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.900315] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.908444] TCP: Hash tables configured (established 2048 bind 2048)
[    0.916489] MPTCP token hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.924985] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.932316] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.941089] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.950046] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.960507] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.967127] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.995908] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.005781] printk: legacy console [ttyS0] disabled
[    1.012830] 18002000.uart: ttyS0 at MMIO 0x18002000 (irq = 22, base_baud = 12500000) is a 16550A
[    1.022997] printk: legacy console [ttyS0] enabled
[    1.022997] printk: legacy console [ttyS0] enabled
[    1.033813] printk: legacy bootconsole [early0] disabled
[    1.033813] printk: legacy bootconsole [early0] disabled
[    1.046723] printk: legacy bootconsole [ns16550a0] disabled
[    1.046723] printk: legacy bootconsole [ns16550a0] disabled
[    1.099799] brd: module loaded
[    1.109709] spi-nand spi1.0: Winbond SPI NAND was found.
[    1.116135] spi-nand spi1.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    1.125703] 5 fixed-partitions partitions found on MTD device spi1.0
[    1.132903] Creating 5 MTD partitions on "spi1.0":
[    1.138436] 0x000000000000-0x0000000e0000 : "boot"
[    1.147088] 0x0000000e0000-0x000000100000 : "env"
[    1.155214] 0x000000100000-0x000000120000 : "env2"
[    1.165100] 0x000000120000-0x000000140000 : "static_conf"
[    1.172065] 0x000000140000-0x000007d80000 : "ubi_device"
[    1.288331] i2c_dev: i2c /dev entries driver
[    1.298534] NET: Registered PF_INET6 protocol family
[    1.307439] Segment Routing with IPv6
[    1.311617] In-situ OAM (IOAM) with IPv6
[    1.316248] NET: Registered PF_PACKET protocol family
[    1.321945] 8021q: 802.1Q VLAN Support v1.8
[    1.363048] clk: Disabling unused clocks
[    1.417279] Freeing unused kernel image (initmem) memory: 10940K
[    1.424059] This architecture does not have kernel memory protection.
[    1.431251] Run /init as init process
[    1.435352]   with arguments:
[    1.438656]     /init
[    1.441181]   with environment:
[    1.444708]     HOME=/
[    1.447341]     TERM=linux
[    1.813462] init: Console is alive
[    1.817712] init: - watchdog -
[    1.832649] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.843467] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    1.854010] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.873064] init: - preinit -
[    5.263635] random: crng init done
ls: /sys/class/net/lan*: No such file or directory
BusyBox v1.37.0 (2025-09-02 16:29:17 UTC) multi-call binary.

Usage: basename FILE [SUFFIX] | -a FILE... | -s SUFFIX FILE...

Strip directory path and SUFFIX from FILE

        -a              All arguments are FILEs
        -s SUFFIX       Remove SUFFIX (implies -a)
mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env not found!
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.756644] procd: - early -
[    9.760171] procd: - watchdog -
[   10.339469] procd: - watchdog -
[   10.343377] procd: - ubus -
[   10.501000] procd: - init -
Please press Enter to activate this console.
[   10.938105] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.016282] kmodloader: done loading kernel modules from /etc/modules.d/*
[   11.823978] urngd: v1.0.2 started.



BusyBox v1.37.0 (2025-09-02 16:29:17 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r31082+1-122135b964
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

 OpenWrt recently switched to the "apk" package manager!

 OPKG Command           APK Equivalent      Description
 ------------------------------------------------------------------
 opkg install <pkg>     apk add <pkg>       Install a package
 opkg remove <pkg>      apk del <pkg>       Remove a package
 opkg upgrade           apk upgrade         Upgrade all packages
 opkg files <pkg>       apk info -L <pkg>   List package contents
 opkg list-installed    apk info            List installed packages
 opkg update            apk update          Update package lists
 opkg search <pkg>      apk search <pkg>    Search for packages
 ------------------------------------------------------------------

For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet

root@OpenWrt:~#

Here is the /proc/cpuinfo from initramfs which surprisingly looks way more filled up compared to the /proc/cpuinfo from a vendor firmware. Don't know if that's a good thing or bad thing or is it due to linux version difference.

root@OpenWrt:~# cat /proc/cpuinfo
system type		: Realtek RTL9607C rev B (6831)
machine			: Realtek RTL9607C Eng Board
processor		: 0
cpu model		: MIPS interAptiv (multi) V2.0
BogoMIPS		: 761.03
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt eva
Options implemented	: tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit cdmm ebase_wg perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VPE			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 1
cpu model		: MIPS interAptiv (multi) V2.0
BogoMIPS		: 761.03
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt eva
Options implemented	: tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit cdmm ebase_wg perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VPE			: 1
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 2
cpu model		: MIPS interAptiv (multi) V2.0
BogoMIPS		: 765.54
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt eva
Options implemented	: tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit cdmm ebase_wg perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 1
VPE			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 3
cpu model		: MIPS interAptiv (multi) V2.0
BogoMIPS		: 761.03
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt eva
Options implemented	: tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit cdmm ebase_wg perf
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 1
VPE			: 1
VCED exceptions		: not available
VCEI exceptions		: not available

root@OpenWrt:~# 

versus:

# cat /proc/cpuinfo
system type             : Formosa
machine                 : rtk,9607c
processor               : 0
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 761.03
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : no
isa                     : mips1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VPE                     : 0

processor               : 1
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 766.77
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : no
isa                     : mips1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VPE                     : 1

processor               : 2
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 766.77
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : no
isa                     : mips1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VPE                     : 0

processor               : 3
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 766.77
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : no
isa                     : mips1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VPE                     : 1
2 Likes

The plan is to make it work with XPON right ?

The Kernel comes up fine on my HW.

Hopefully.. if all things work out but i wouldn't bet on it happening any time soon
And i would assume econet target is gonna be on the same boat as us too when it comes their XPON support.

In Realtek's case, the gpon driver seems be there. And more in dal/rtl9607c folder

But Ethernet support should come before that

Nice to see that, do you know if your RTL9607C is rev A or B? Would like to know if they both works cause i have seen some rtl9607c that run 900Mhz with 2 cores, while mine is 1150Mhz.
Bootlog would also be nice to see if you don't mind.

Let’s continue the development here in a fresh thread. I’ll be looking through the GPL code in your repo

1 Like

Yes, i would hope it gets changed to generic "realtek" in the future to avoid confusion, if people from switch side wouldn't mind. My guess is that it got overlooked because it was very minor or something. Especially given rtl93xx stuff are also in there already.

As for the drivers, Here is what i got so far with rewriting pci driver, yet to test it out.

This is above is confusing as the target is already realtek with the following subtargets:

  • rtl838x
  • rtl839x
  • rtl930x
  • rtl931x

Would like to touch on the subject of permanent flashing and sysupgrade, which will need to be discussed sooner rather than later.

As it currently stands, the partition map, which is the same across other rtl9607c based machine (and seemingly rtl8198d according to this bootlog from this thread is this:

0x000000000000-0x0000000e0000 : "boot"
0x0000000e0000-0x000000100000 : "env"
0x000000100000-0x000000120000 : "env2"
0x000000120000-0x000000140000 : "static_conf"
0x000000140000-0x000007d80000 : "ubi_device"
  1. boot partition is a u-boot binary
  2. env is u-boot environment.
  3. env2 is second u-boot environment?
  4. static_conf seems to be some conf partition? It is filled with ffff for me.
  5. ubi_device is a ubi device and it contains 5 ubi volumes.

From ubinfo -a command:

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        87 LEBs (11046912 bytes, 10.5 MiB)
State:       OK
Name:        ubi_Config
Character device major/minor: 251:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        83 LEBs (10539008 bytes, 10.1 MiB)
State:       OK
Name:        ubi_k0
Character device major/minor: 251:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        207 LEBs (26284032 bytes, 25.1 MiB)
State:       OK
Name:        ubi_r0
Character device major/minor: 251:3
-----------------------------------
Volume ID:   3 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        83 LEBs (10539008 bytes, 10.1 MiB)
State:       OK
Name:        ubi_k1
Character device major/minor: 251:4
-----------------------------------
Volume ID:   4 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        207 LEBs (26284032 bytes, 25.1 MiB)
State:       OK
Name:        ubi_r1
Character device major/minor: 251:5
  1. ubi_Config is mounted to var/config during linux boot and contains config files for OMCI, laser driver and config.xml, config-hs.xml files which seem to be central configs for the whole linux system. You can manipulate the system by changing parameters in config.xml and uploading the xml file through web ui.
  2. ubi_k0 is a volume for the linux kernel.
  3. ubi_r0 is a volume for the squashfs
  4. ubi_k1 is the 2nd volume for the linux kernel.
  5. ubi_r1 is the 2nd volume for the squashfs.

And it looks like you can choose which one to boot from by changing the uboot variable sw_commit to 1 or 0. But for some reason ubi_k1 and ubi_r1 are filled with ffff, at least in my case.

There is some leftover space at the end after ubi_device partition with the size of 0x280000 which is entirely filled with ffff.

This kind of dual boot layout inside one ubi device seems be a unique feature to this platform because other routers i looked at that have dual boot use 2 ubi devices instead (or 2 mtd partitions). Can't really put my hand on what would a proper sysupgrade or factory image would even look like so i would appreciate any help or insight on this matter.

I have both 9607C-VA and 9607C-VB with me. I had tried on VB and that’s where it had come up. I will soon share with you the bootup logs from VB.

For dual bank system, what happens is, as the device will be up and running with FW in one bank say “bank 0” (considering banks are bank 0 and bank 1), then the FW which is downloaded will be written into bank1 and committed in the bootloader env. Then on reboot, the device will come up with bank1 FW.

The FW usually consists of a kernel, rootfs, upgrade scripts, sometimes even bootloader. The k0/k1 is for the kernel and r0/r1 is for the rootfs of the two banks.

If you have any FW with you for the device that you are already using, you can untar/binwalk and check all its components.

BTW, here is the bootup logs from my VB HW.

Phoebus# bootm

Booting kernel from Legacy Image at 81000000 ...

Image Name: MIPS OpenWrt Linux-6.12.45
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 5189275 Bytes = 4.9 MiB
Load Address: 80100000
Entry Point: 80100000
Verifying Checksum ... OK
Uncompressing Kernel Image
[ 0.000000] Linux version 6.12.45 (mkverma@GIPL-SW164) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r31082+1-122135b964) 14.3.05
[ 0.000000] SoC Type: Realtek RTL9607C rev B (6831)
[ 0.000000] printk: legacy bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi))
[ 0.000000] MIPS: machine is Realtek RTL9607C Eng Board
[ 0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[ 0.000000] printk: legacy bootconsole [ns16550a0] enabled
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[ 0.000000] VPE topology {2,2} total 4
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] HighMem empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] percpu: Embedded 12 pages/cpu s18416 r8192 d22544 u49152
[ 0.000000] pcpu-alloc: s18416 r8192 d22544 u49152 alloc=124096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Kernel command line: earlycon
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 65536
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[ 0.000000] NR_IRQS: 256
[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.000000] CPU clock is 1150
[ 0.000000] rtcl_clocks_init: clk_data.clk_num=2, ocp=1150000000, lx=200000000
[ 0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0x10939a911d9, max_idle_ns: 440795210078 ns
[ 0.000002] sched_clock: 64 bits at 1150MHz, resolution 0ns, wraps every 2199023255551ns
[ 0.009212] clocksource: realtek_otto_timer: mask: 0xfffffff max_cycles: 0xfffffff, max_idle_ns: 19112604400 ns
[ 0.020672] Calibrating delay loop... 761.03 BogoMIPS (lpj=3805184)
[ 0.067493] pid_max: default: 32768 minimum: 301
[ 0.080660] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.088837] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.106773] rcu: Hierarchical SRCU implementation.
[ 0.112203] rcu: Max phase no-delay instances is 1000.
[ 0.119484] smp: Bringing up secondary CPUs ...
[ 0.125843] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.125889] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.125900] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.125978] CPU1 revision is: 0001a120 (MIPS interAptiv (multi))
[ 0.200603] Counter synchronization [CPU#0 -> CPU#1]: passed
[ 0.238677] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.238717] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.238728] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.238775] CPU2 revision is: 0001a120 (MIPS interAptiv (multi))
[ 0.590572] Counter synchronization [CPU#0 -> CPU#2]: passed
[ 0.627722] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.627762] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.627774] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.627829] CPU3 revision is: 0001a120 (MIPS interAptiv (multi))
[ 0.700587] Counter synchronization [CPU#0 -> CPU#3]: passed
[ 0.736506] smp: Brought up 1 node, 4 CPUs
[ 0.742945] Memory: 236784K/262144K available (7951K kernel code, 638K rwdata, 1648K rodata, 10748K init, 249K bss, 23988K reserved)
[ 0.761585] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.772671] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[ 0.785078] pinctrl core: initialized pinctrl subsystem
[ 0.793467] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.800946] FPU Affinity set after 15220 emulations
[ 0.818525] clocksource: Switched to clocksource realtek_otto_timer
[ 0.833909] NET: Registered PF_INET protocol family
[ 0.839659] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.848780] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.858150] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.866878] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[ 0.875491] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[ 0.883618] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.891645] MPTCP token hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.900152] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.907484] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.916256] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.925000] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[ 0.936971] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.943673] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.967083] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.976788] printk: legacy console [ttyS0] disabled
[ 0.984011] 18002000.uart: ttyS0 at MMIO 0x18002000 (irq = 22, base_baud = 12500000) is a 16550A
[ 0.994182] printk: legacy console [ttyS0] enabled
[ 0.994182] printk: legacy console [ttyS0] enabled
[ 1.005091] printk: legacy bootconsole [early0] disabled
[ 1.005091] printk: legacy bootconsole [early0] disabled
[ 1.017531] printk: legacy bootconsole [ns16550a0] disabled
[ 1.017531] printk: legacy bootconsole [ns16550a0] disabled
[ 1.072005] brd: module loaded
[ 1.090232] spi-nand spi1.0: Micron SPI NAND was found.
[ 1.096086] spi-nand spi1.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[ 1.105766] 5 fixed-partitions partitions found on MTD device spi1.0
[ 1.113021] Creating 5 MTD partitions on "spi1.0":
[ 1.118382] 0x000000000000-0x0000000e0000 : "boot"
[ 1.126270] 0x0000000e0000-0x000000100000 : "env"
[ 1.132989] 0x000000100000-0x000000120000 : "env2"
[ 1.141073] 0x000000120000-0x000000140000 : "static_conf"
[ 1.151276] 0x000000140000-0x000007d80000 : "ubi_device"
[ 1.267058] i2c_dev: i2c /dev entries driver
[ 1.277961] NET: Registered PF_INET6 protocol family
[ 1.287470] Segment Routing with IPv6
[ 1.291760] In-situ OAM (IOAM) with IPv6
[ 1.296288] NET: Registered PF_PACKET protocol family
[ 1.302394] 8021q: 802.1Q VLAN Support v1.8
[ 1.339496] clk: Disabling unused clocks
[ 1.392557] Freeing unused kernel image (initmem) memory: 10748K
[ 1.399316] This architecture does not have kernel memory protection.
[ 1.406504] Run /init as init process
[ 1.410587] with arguments:
[ 1.413884] /init
[ 1.416409] with environment:
[ 1.419911] HOME=/
[ 1.422534] TERM=linux
[ 1.784944] init: Console is alive
[ 1.789188] init: - watchdog -
[ 1.804396] kmodloader: loading kernel modules from /etc/modules-boot.d/

[ 1.814823] gpio_button_hotplug: loading out-of-tree module taints kernel.
[ 1.823943] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 1.834311] init: - preinit -
[ 4.178528] random: crng init done
ls: /sys/class/net/lan*: No such file or directory
BusyBox v1.37.0 (2025-09-17 08:35:36 UTC) multi-call binary.

Usage: basename FILE [SUFFIX] | -a FILE... | -s SUFFIX FILE...

Strip directory path and SUFFIX from FILE

    -a              All arguments are FILEs
    -s SUFFIX       Remove SUFFIX (implies -a)

mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env not found!
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level

[ 8.673750] procd: - early -
[ 8.677273] procd: - watchdog -
[ 9.267780] procd: - watchdog -
[ 9.271754] procd: - ubus -
[ 9.330718] procd: - init -
Please press Enter to activate this console.

login[532]: root login on 'console'

BusyBox v1.37.0 (2025-09-17 08:35:36 UTC) built-in shell (ash)


| |.-----.-----.-----.| | | |.----.| |_

| - || _ | -| || | | || || |
|
_____|| |
||||___||| |____|
|| W I R E L E S S F R E E D O M

OpenWrt SNAPSHOT, r31082+1-122135b964

=== WARNING! =====================================

There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

OpenWrt recently switched to the "apk" package manager!

OPKG Command APK Equivalent Description

opkg install apk add Install a package

opkg remove apk del Remove a package
opkg upgrade apk upgrade Upgrade all packages
opkg files apk info -L List package contents
opkg list-installed apk info List installed packages
opkg update apk update Update package lists
opkg search apk search Search for packages

For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet

root@(none):~# [ 9.785938] kmodloader: loading kernel modules from /etc/modules.d/*
[ 9.860222] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 10.575390] urngd: v1.0.2 started.

root@(none):~# ubinfo -a
UBI version: 1
Count of UBI devices: 0
UBI control device major/minor: 10:127
root@OpenWrt:
root@OpenWrt:~# cat /proc/kmsg &
root@OpenWrt:~#
root@OpenWrt:~# cat /proc/cpuinfo
system type : Realtek RTL9607C rev B (6831)
machine : Realtek RTL9607C Eng Board
processor : 0
cpu model : MIPS interAptiv (multi) V2.0
BogoMIPS : 761.03
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp mt eva
Options implemented : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets : 1
kscratch registers : 0
package : 0
core : 0
VPE : 0
VCED exceptions : not available
VCEI exceptions : not available

processor : 1
cpu model : MIPS interAptiv (multi) V2.0
BogoMIPS : 761.03
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp mt eva
Options implemented : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets : 1
kscratch registers : 0
package : 0
core : 0
VPE : 1
VCED exceptions : not available
VCEI exceptions : not available

processor : 2
cpu model : MIPS interAptiv (multi) V2.0
BogoMIPS : 765.54
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp mt eva
Options implemented : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets : 1
kscratch registers : 0
package : 0
core : 1
VPE : 0
VCED exceptions : not available
VCEI exceptions : not available

processor : 3
cpu model : MIPS interAptiv (multi) V2.0
BogoMIPS : 761.03
wait instruction : yes
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa : mips1 mips2 mips32r1 mips32r2
ASEs implemented : mips16 dsp mt eva
Options implemented : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets : 1
kscratch registers : 0
package : 0
core : 1
VPE : 1
VCED exceptions : not available
VCEI exceptions : not available

Nice but you really should use "Preformatted text </>" but bootlogs.

Phoebus# bootm
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-6.12.45
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5189275 Bytes = 4.9 MiB
   Load Address: 80100000
   Entry Point:  80100000
   Verifying Checksum ... OK
   Uncompressing Kernel Image
[    0.000000] Linux version 6.12.45 (mkverma@GIPL-SW164) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r31082+1-122135b964) 14.3.05
[    0.000000] SoC Type: Realtek RTL9607C rev B (6831)
[    0.000000] printk: legacy bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.000000] MIPS: machine is Realtek RTL9607C Eng Board
[    0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[    0.000000] printk: legacy bootconsole [ns16550a0] enabled
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Using appended Device Tree.
[    0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] percpu: Embedded 12 pages/cpu s18416 r8192 d22544 u49152
[    0.000000] pcpu-alloc: s18416 r8192 d22544 u49152 alloc=12*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Kernel command line: earlycon
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65536
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] NR_IRQS: 256
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] CPU clock is 1150
[    0.000000] rtcl_clocks_init: clk_data.clk_num=2, ocp=1150000000, lx=200000000
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0x10939a911d9, max_idle_ns: 440795210078 ns
[    0.000002] sched_clock: 64 bits at 1150MHz, resolution 0ns, wraps every 2199023255551ns
[    0.009212] clocksource: realtek_otto_timer: mask: 0xfffffff max_cycles: 0xfffffff, max_idle_ns: 19112604400 ns
[    0.020672] Calibrating delay loop... 761.03 BogoMIPS (lpj=3805184)
[    0.067493] pid_max: default: 32768 minimum: 301
[    0.080660] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088837] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.106773] rcu: Hierarchical SRCU implementation.
[    0.112203] rcu:     Max phase no-delay instances is 1000.
[    0.119484] smp: Bringing up secondary CPUs ...
[    0.125843] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.125889] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.125900] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.125978] CPU1 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.200603] Counter synchronization [CPU#0 -> CPU#1]: passed
[    0.238677] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.238717] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.238728] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.238775] CPU2 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.590572] Counter synchronization [CPU#0 -> CPU#2]: passed
[    0.627722] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.627762] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.627774] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.627829] CPU3 revision is: 0001a120 (MIPS interAptiv (multi))
[    0.700587] Counter synchronization [CPU#0 -> CPU#3]: passed
[    0.736506] smp: Brought up 1 node, 4 CPUs
[    0.742945] Memory: 236784K/262144K available (7951K kernel code, 638K rwdata, 1648K rodata, 10748K init, 249K bss, 23988K reserved)
[    0.761585] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.772671] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.785078] pinctrl core: initialized pinctrl subsystem
[    0.793467] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.800946] FPU Affinity set after 15220 emulations
[    0.818525] clocksource: Switched to clocksource realtek_otto_timer
[    0.833909] NET: Registered PF_INET protocol family
[    0.839659] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.848780] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.858150] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.866878] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.875491] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.883618] TCP: Hash tables configured (established 2048 bind 2048)
[    0.891645] MPTCP token hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.900152] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.907484] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.916256] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.925000] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.936971] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.943673] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.967083] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.976788] printk: legacy console [ttyS0] disabled
[    0.984011] 18002000.uart: ttyS0 at MMIO 0x18002000 (irq = 22, base_baud = 12500000) is a 16550A
[    0.994182] printk: legacy console [ttyS0] enabled
[    0.994182] printk: legacy console [ttyS0] enabled
[    1.005091] printk: legacy bootconsole [early0] disabled
[    1.005091] printk: legacy bootconsole [early0] disabled
[    1.017531] printk: legacy bootconsole [ns16550a0] disabled
[    1.017531] printk: legacy bootconsole [ns16550a0] disabled
[    1.072005] brd: module loaded
[    1.090232] spi-nand spi1.0: Micron SPI NAND was found.
[    1.096086] spi-nand spi1.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    1.105766] 5 fixed-partitions partitions found on MTD device spi1.0
[    1.113021] Creating 5 MTD partitions on "spi1.0":
[    1.118382] 0x000000000000-0x0000000e0000 : "boot"
[    1.126270] 0x0000000e0000-0x000000100000 : "env"
[    1.132989] 0x000000100000-0x000000120000 : "env2"
[    1.141073] 0x000000120000-0x000000140000 : "static_conf"
[    1.151276] 0x000000140000-0x000007d80000 : "ubi_device"
[    1.267058] i2c_dev: i2c /dev entries driver
[    1.277961] NET: Registered PF_INET6 protocol family
[    1.287470] Segment Routing with IPv6
[    1.291760] In-situ OAM (IOAM) with IPv6
[    1.296288] NET: Registered PF_PACKET protocol family
[    1.302394] 8021q: 802.1Q VLAN Support v1.8
[    1.339496] clk: Disabling unused clocks
[    1.392557] Freeing unused kernel image (initmem) memory: 10748K
[    1.399316] This architecture does not have kernel memory protection.
[    1.406504] Run /init as init process
[    1.410587]   with arguments:
[    1.413884]     /init
[    1.416409]   with environment:
[    1.419911]     HOME=/
[    1.422534]     TERM=linux
[    1.784944] init: Console is alive
[    1.789188] init: - watchdog -
[    1.804396] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.814823] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    1.823943] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.834311] init: - preinit -
[    4.178528] random: crng init done
ls: /sys/class/net/lan*: No such file or directory
BusyBox v1.37.0 (2025-09-17 08:35:36 UTC) multi-call binary.

Usage: basename FILE [SUFFIX] | -a FILE... | -s SUFFIX FILE...

Strip directory path and SUFFIX from FILE

        -a              All arguments are FILEs
        -s SUFFIX       Remove SUFFIX (implies -a)
mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env2 not found!
mtd_get_mac_ascii: partition u-boot-env not found!
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level

[    8.673750] procd: - early -
[    8.677273] procd: - watchdog -
[    9.267780] procd: - watchdog -
[    9.271754] procd: - ubus -
[    9.330718] procd: - init -
Please press Enter to activate this console.

login[532]: root login on 'console'


BusyBox v1.37.0 (2025-09-17 08:35:36 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r31082+1-122135b964
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

 OpenWrt recently switched to the "apk" package manager!

 OPKG Command           APK Equivalent      Description
 ------------------------------------------------------------------
 opkg install <pkg>     apk add <pkg>       Install a package
 opkg remove <pkg>      apk del <pkg>       Remove a package
 opkg upgrade           apk upgrade         Upgrade all packages
 opkg files <pkg>       apk info -L <pkg>   List package contents
 opkg list-installed    apk info            List installed packages
 opkg update            apk update          Update package lists
 opkg search <pkg>      apk search <pkg>    Search for packages
 ------------------------------------------------------------------

For more https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet

root@(none):~# [    9.785938] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.860222] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.575390] urngd: v1.0.2 started.

root@(none):~# ubinfo -a
UBI version:                    1
Count of UBI devices:           0
UBI control device major/minor: 10:127
root@OpenWrt:
root@OpenWrt:~# cat /proc/kmsg &
root@OpenWrt:~# 
root@OpenWrt:~# cat /proc/cpuinfo 
system type             : Realtek RTL9607C rev B (6831)
machine                 : Realtek RTL9607C Eng Board
processor               : 0
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 761.03
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt eva
Options implemented     : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 1
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 761.03
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt eva
Options implemented     : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 2
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 765.54
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt eva
Options implemented     : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 3
cpu model               : MIPS interAptiv (multi) V2.0
BogoMIPS                : 761.03
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt eva
Options implemented     : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_f
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 1
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available


Been a while since the last message (IRL is partially to blame) in this thread so i might add some progress news and what not..

  1. Big kudos to @kenjiuno for verifying the theory i had for a while, RTL9607C and RTL8198D are indeed very much the same SoCs. This is what the bootlog prints out for RTL8198D based machine [ 0.000000] SoC Type: Realtek RTL9607C subtype 1B rev B (6831). The subtype, which is quite a recent addition to the pull request, is 1B does line up with the table, showing that it is RTL8198DE. The main difference is of course that RTL9607C is for XPON ONTs while RTL8198D is for general wireless routers.

  2. I have tested the PCI driver i have written before (based on the pci driver from GPL code) for a couple days already, but it continues to now work at all. The boot process stops midway without any errors or indicators. The driver code is pretty much the same as the one i posted in the previous message. From what i have checked, this line of code is what is causing the boot stop (at least for PCIE0)? if((ioread32(p->hostcfg_base + 0x0728) & 0x1f) == 0x11)
    I can't really put my head around why it could be doing it. Hey @undisputed-seraphim, did you have any luck with your pci driver loading on rtl8198c so far by any chance?

  3. The pull request for Realtek ECC driver has been finally merged, so that allows us to make attach the ubi_device and potentially open the door for flashing the sysupgrade image? The build recipe for sysupgrade stuff is still an unknown element to me...

  4. At this current moment https://svanheule.net/realtek/ is not available so... I plan to have a separate github repo/site for all RTL9607C registers and internals and what else could be documented but that will take some time because there is a lot of things.

  5. It would also be nice to have a github repo that builds the initramfs images automatically for rtl9607c (just like https://github.com/cjdelisle/OpenWRT-EN751221-Builds) so that people don't have to spend time building it, which shouldn't be hard to do.

Hi yes my pci driver works, however I am missing the interrupt mappings so devices can be detected but they can not run properly. I am stuck at that problem because I do not know how interrupt mappings work, sadly

Oh, i see
is it something different from a pcibios_map_irq function or is it more related to interrupt-map property in the device tree? I assumed that interrupts = <GIC_SHARED 32 IRQ_TYPE_LEVEL_HIGH>; would be enough cause pci driver doesn't involve interrupts much. In that case, wouldn't something like this work? (from mt7621.dtsi, cause its the only one where its managed by GIC)

interrupt-map-mask = <0 0 0 0>;
interrupt-map = <0 0 0 0 &gic GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH>;

Otherwise, i have no clue.

...and also means something is wrong with my pci driver too if yours work. And also the fact that pci driver is run at late_initcall instead of arch_initcall but that shouldn't affect anything i think.

Hi!

Where could it be found?

AFAIK it's okay for one port to fail check after initialization, at least I saw this on reference software and everything worked fine

Hey, welcome to OpenWrt forum :slight_smile:

I believe this is the pci driver in mention

Noted but i didn't do much pci drivers stuff since then because i just couldn't pinpoint the cause of the boot hang and there were a lot of variables in play.

For once, maybe my patch to make rtl9607c work with upstream gpio-realtek-otto driver was incomplete or something. In RTL9607C there is a register called IO_GPIO_EN at 0xbb000038 which seems to be controlling GPIO pins and IER register for "interrupt enable register for CPU0/1".

Maybe my rewritten pci driver has a flaw or i skipped over something that i thought was unimportant but was actually crucial, who knows.
It failing at if((ioread32(p->hostcfg_base + 0x0728) & 0x1f) == 0x11) just doesn't make sense when i know p->hostcfg_base is properly defined during probe so.. my take is that it is likely a GPIO issue which happens after the gpiod_set_raw_value, otherwise i don't know what could it be..

I will try and look at pci/gpio drivers again in the future when i have time.

While i am here, I went on and updated some portions of original post of this topic.
TLDR:

  • ECC PR has long been merged, so the old text is obsolete.
  • I have added thermal and i2c support for this SoC.
  • I included the list essential drivers and components with links to them to make them easier to find for anyone interested.

I've spent some time debugging PCIe driver. That's what has been changed:

  • fixed tmp = (p->port) ? RTL_ENABLE_PCIE0 : RTL_ENABLE_PCIE1;, what leaded to hangs
  • changed of_property_read_u8 to of_property_read_u32 for port property (I think it was only my problem with dts format - 0 was always returned, what also leaded to hangs)
  • removed all mb(), as ioread/write doesn't need it
  • changed ioport_resource addresses (still don't know how to handle it correct)

For now boot hangs after first read from PCI device config address - I believe that it is because of reset gpio wasn't set

What leads to another topic - GPIO. According to this scheme, otto driver should work (plus I corrected controllers addresses). But I still can't manage device's leds using /sys/class/gpio. Maybe because of strange GPIO base - 512:

root@OpenWrt:~# ls /sys/class/gpio/
export       gpiochip512  gpiochip544  gpiochip576  unexport

Anyway, everything I've got is here (head commit) - https://github.com/ProMix0/openwrt/tree/rtl9607c-dev