ZyXEL Keenetic KN-1012

abgn+ac+ax (AX3000)
AX3000 Mesh Wi-Fi 6 Multi-Gigabit Router
Homepage	Product page
Wikipedia	ZyXEL
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	ZyXEL Keenetic Hero
Model Part Number	KN-1012
FCC ID	none specified
Type	wireless router
CPU1 Y	MediaTek MT7981B
CPU1 Type	ARM Cortex-A53
CPU1 Speed	1.3 GHz ( 2 cores ) 64-bit
Flash1 Chip	Fudan Micro FM25G02B
Flash1 Size	256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (SPI NAND)
RAM1 Size	512 MiB536,870,912 B <br />4,194,304 Kib <br />524,288 KiB <br />4,096 Mib <br />0.5 GiB <br />
RAM1 Chip	Brand? Model?
ETH chip1	MediaTek MT7981B
Switch	MediaTek MT7531
Ethernet Port Count	1-2.5GbE-WAN 4-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab/3bz
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	SFP
SFP ports	1
Power	12 VDC, 2.5 A
Serial Port (UART)	yes, (115200 8N1)
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Radio 1
Chip1	MediaTek MT7981B
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x3:2
Wireless Standard	IEEE 802.11b/g/n/ax
802.11ax	up to 574 Mbps
802.11n	up to 300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	MediaTek MT7981B
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x3:2
Wireless Standard	IEEE 802.11a/n/ac/ax
AX-QAM	up to 2402 Mbps
802.11ax	up to 1201 Mbps
802.11ac	up to 867 Mbps
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.

For a list of all currently documented ZyXEL devices with specifications, see ZyXEL.

• 574 Mbps - 2SS 2.4GHz 802.11ax (40MHz chan., 1024QAM),

• 2402 Mbps - 2SS 5GHz 802.11ax (160MHz chan., 1024QAM) = AX3000 class

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)

Target: mediatek
Subtarget: filogic
Package architecture: aarch64_cortex-a53
Supported Since Commit
Support started version: unknown
Current supported version: snapshot

Unsupported Functions:
Copper side of the combo port (lan4 RJ45) until a pending kernel fix is merged
LAN Hardware: MediaTek MT7531
LAN Comment: lan4 is a combo port: RJ45 through an Airoha EN8811H 2.5G PHY or an SFP cage, one at a time, chosen at boot by whether a module is present
WLAN Hardware: MediaTek MT7981B
WLAN Comment: 2T2R on both bands
Installation method(s):
see git-commit
Install Comment:
Vendor TFTP recovery: server 192.168.1.2 on a LAN port, image renamed to KN-1012_recovery.bin, hold Reset at power-on
Recovery method(s):
see git-commit
Recovery Comment:
Same TFTP recovery with the .bin from the official recovery package
Comment:
Same hardware is sold as Netcraze NC-1012

git • >>

mediatek: filogic: add support for Keenetic KN-1012 Keenetic KN-1012 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router with a combo SFP/copper port, based on MT7981B. The copper side of the combo port does not come up on this tree yet. It needs the pending phylink change that defers the PHY attach for PHYs marked needs-host-firmware until their driver has bound, https://lore.kernel.org/r/20260914211137.2760618-1-f@lex.la/, and that property on the PHY node, which goes in together with the change. Everything else on the board, the SFP side of the same port included, works without them. Specification: - SoC  : MediaTek MT7981B - RAM  : 512 MiB - Flash  : SPI-NAND 256 MiB (chip varies by production run, Fudan Micro FM25G02B seen) - WLAN  : 2.4/5 GHz 2T2R (MediaTek MT7981B (SoC)) - Ethernet  : 4x 10/100/1000 Mbps + 1x combo port - switch  : MediaTek MT7531 - combo port  : SFP cage and an Airoha EN8811H 2.5G copper PHY share one SerDes, selected by a GPIO mux - USB  : USB 2.0 through a GL850G-OHY60 hub, two switchable power rails - LEDs/Keys (GPIO): 6x/4x - UART  : through-hole on PCB (J500), unconfirmed - assignment  : 5V, TX, RX, NC, GND - settings  : 115200n8 - Power  : 12 VDC, 2.5 A, center positive The vendor bootloader stays in place, so U-Boot is chainloaded from it as the payload it accepts as a kernel. It reads the GPIO reporting whether an SFP module is present and boots the device tree matching the medium, so one image serves both the copper PHY and the SFP cage. The chainloader itself is wrapped into a FIT shaped like the vendor kernel image, kernel@1 / fdt@1 / config@1 with the "Linux 4.9" description, because the stock loader accepted a payload generated by mkits.sh with its default node names and descriptions but never ran it. Both vendor firmware slots (firmware_1, storage_a, firmware_2, storage_b) are concatenated into one virtual flash, its first 8 MiB the kernel partition and the rest UBI, so the second slot no longer holds a vendor- bootable image; u-state stays read-only. The factory image is bounded to the first firmware slot, where the stock recovery writes it; whether the recovery writes past that slot is untested. Flash instruction using the vendor recovery mode: 1. Connect the TFTP host to one of the LAN ports, address 192.168.1.2 2. Rename the factory image to "KN-1012_recovery.bin" and put it in the TFTP directory 3. Power off the device, hold the "Reset" button, power it on and keep the button held for ~10 seconds 4. The bootloader downloads the image over TFTP and writes it to flash 5. Wait for the device to reboot, it comes up on 192.168.1.1 Reverting to stock image: 1. Download the official recovery package for the model and take the .bin image out of it 2. Follow the same steps as above with that image in place of the OpenWrt one MAC addresses: use source LAN rf-eeprom 0x4 WAN rf-eeprom 0xa, also the address on the label 2g rf-eeprom 0x4, the first MAC slot of the WiFi EEPROM 5g rf-eeprom 0x4 with the locally administered bit set and bit 7 flipped Left alone, mt76 would read the second EEPROM slot at 0xa for phy1 and collide with the WAN address, so the board joins the Keenetic family entry in 11_fix_wifi_mac, which derives phy1 from the 0x4 slot the way mt76 would on its own: LA bit set, bit 7 flipped. The P and N of the SerDes lane from the switch to the EN8811H are swapped on this board, like on the BPI-R3 mini, so the copper PHY node sets rx-polarity to PHY_POL_INVERT, the current form of the airoha,pnswap-rx property the BPI-R3 mini still carries. Without it the copper side links up at any speed but transmits nothing, while receive works. The copper PHY's INTB is on pio 0 and the PHY node declares it; the vendor tree hangs the same line on the switch node and calls it level low. This uses edge falling, as the BPI-R3 mini does for its EN8811H PHYs. On this tree the line is not used yet: phylib sets phydev->irq to PHY_POLL when the port attaches the PHY with the generic driver still bound at switch probe, and nothing restores it when the EN8811H driver binds later. With the phylink change named at the top and the phylib change that keeps the interrupt across the driver swap, https://lore.kernel.org/r/20260919015326.499479-1-f@lex.la/, forced renegotiations on this board delivered the link-down and link-up events over INTB and left no interrupt unhandled. The copper port stays down on this tree because the switch attaches the PHY at probe, before the EN8811H driver can load its firmware from the root filesystem, and phylink refuses 2500base-x against the generic driver, so DSA drops the port. The copper results above were taken with the phylink change named at the top applied; SFP, lan1 to lan3, WAN and wifi do not depend on it. The SFP side was booted with a DAC in the cage: the loader picked the SFP configuration, the module EEPROM read over I2C, lan4 came up over the cage without the PHY race and the cage's indicator LED lit; on copper that LED stays off. Link and traffic over the SFP path stand on the earlier two-tree form of the image, 1 Gbit/s against a 1 Gbit/s partner, with the module pulled bringing the board back on copper. The board support (pin map, SFP node, copper PHY description, image recipe parameters and LED assignments) is based on the out-of-tree port by Maxim Anisimov, branch main_keenetic_kn1012 of Linaro1985/openwrt. The chainloader and the U-Boot side are new relative to that port, as is the split into a shared dtsi with a device tree overlay per medium, which the chainloader applies. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin Link: https://github.com/openwrt/openwrt/pull/24820 Signed-off-by: Jonas Jelonek