Adding Support for Verizon CR1000A

tesf23 · 2023-03-20T15:27:42.670Z

tesf23:

RTL9301

RTL9301 seems like a 24/48 x Copper + 4 x 10G layer 3 switch chip. I wonder if this router can support the l3 offload function with this chip, that will be crazy.

Here is the info(openwrt support for the SW chip): https://github.com/openwrt/openwrt/pull/4535
Looks like it's already supported by openwrt and L3 offload.

lytr · 2023-03-20T15:29:13.272Z

How much RAM and storage?

tesf23 · 2023-03-20T15:29:44.328Z

2GB RAM and 4GB eMMC

a_guy · 2023-03-20T15:54:43.563Z

Add

MXL3711 - MoCA 2.5
Optional Bluetooth (not sure what chip)

tesf23 · 2023-03-20T16:16:03.739Z

Thanks! added to list. I don't think the bluetooth chip is populated on most of the newer version board.

spol-eff · 2023-03-20T19:18:43.303Z

Here's a decompiled /sys/firmware/fdt for anybody wanting to take a crack at it: https://transfer.sh/ws8JTs/cr1000.dts

tesf23 · 2023-03-24T15:46:54.192Z

Is there a way to enable serial through fw_setenv command? I want try to tftp boot this with the Buffalo WXR-5950AX12 or QNAP 301W image. And then learn how to build openwrt by myself. Never done that before.

root@CR1000A:/# fw_printenv atf
## Error: "atf" not defined
root@CR1000A:/# fw_printenv 
adminpass=###########
baseMAC=#########
baudrate=115200
bootargs=console=ttyMSM0,115200n8 vmalloc=900M cnss2.bdf_pci0=0xa4
bootcmd=bootipq
ethact=eth0
ethaddr=############
fdt_high=0x4A400000
fdtcontroladdr=4a972e10
fileaddr=44000000
filesize=1c8
flash_type=5
ipaddr=192.168.1.1
machid=8010012
macno=7
model=CR1000A
netmask=255.255.255.0
serialno=############
serverip=192.168.1.100
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
ssid=Verizon_6YHQZF
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
wifipass=bee-yon3-befit
hwver=0.0.6
dump_to_flash=0x0010f54e
bootdelay=1

a_guy · 2023-03-24T16:11:44.042Z

Check the @meisterlone's steps above. I've started adding support to openwrt but it will be slow as I never did it before and have almost no free time as of recently

a_guy · 2023-03-26T21:56:57.928Z

this is a .dts I've recreated from proc/device-tree https://transfer.sh/U20W59/cr1000a.dts via dtc tool

a_guy · 2023-04-02T22:59:55.440Z

Ok, I think I made some progress in this:
minimal dts: https://transfer.sh/ALuy5N/ipq8072-cr1000a.dts
initramfs image: https://transfer.sh/uxee14/openwrt-ipq807x-generic-verizon_cr1000a-initramfs-uImage.itb

Any volunteers?

olliver · 2023-04-03T12:13:18.659Z

tesf23:

RTL9301 seems like a 24/48 x Copper + 4 x 10G layer 3 switch chip.

So this is interesting, I was going over the FCC photo's and didn't see it. Why in the world would they be using this chip though? It's a 12 port SERDES SoC (system on a chip) that can do everything the main SoC can do (probably slower though), but then there's the rtl9311 with dual mips cores.

Anyway, we are working heavily on supporting the realtek SoC (as a SoC) in this thread Support for RTL838x based managed switches and have my WIP branch here https://gitlab.com/olliver/openwrt/openwrt/-/commits/dev/realtek-wip/ (which is always in flux anyway.

I'd be curious how they strapped this rtl9301 though; as you can, with pull-ups/downs configure the chip to be a 'dumb' switch. But then, how it would look in the DTS, I don't know.

I think from a linux PoV, you'd just have a 'dumb' switch chip. Then, if offloading those L2 and L3 features are desires, that'l be interesting. Normally, we configure the RTL9301 via lexra-bus register addresses. In this case, we'd need to write to some other bus. THe RTL9301 can be connected via a slave SPI interface. Is thats how they are talking to the chip? I wonder how registers are accessed. Probalby via their 16bit address, which is all we have access too. Thinking too much out loud now but that's something we'd have to think about in writing the proper rtl9301 DSA driver, that it can be talked to via SPI or via registers.

Mai-Lofi · 2023-04-04T00:23:36.626Z

Hi All I am new here but excited to help out with this awesome project. I will take a look at this tonight and give it a try! Great work!

Mai-Lofi · 2023-04-04T01:38:22.431Z

Little update, attempt 1 gave me invalid firmware error. Will continue to troubleshoot.

Screenshot from 2023-04-03 21-35-40

a_guy · 2023-04-04T01:54:12.249Z

Well, you would need the access to serial port first for now; and follow instructions from @meisterlone.
But get the jailbreak first using @spol-eff approach with custom config file

The image is basically a livecd-style image which could be loaded from network. This way it won't brick your device.

Eventually (with @spol-eff help ) we could make a way to load the openwrt image via OEM interface. But we are far away from there yet

Mai-Lofi · 2023-04-04T01:59:55.639Z

Oop yeah I got excited and realized I missed quite a few steps. Currently connecting to TFTP. I will let you know if it works once I actually get there!

a_guy · 2023-04-04T02:07:50.453Z

Be extra careful. Only @meisterlone could currently recover his device from brick.

Mai-Lofi · 2023-04-04T17:47:43.527Z

Looks like I ended up bricking my router... I got the ssh to work which was awesome and was able to change the color of the status led which was cool!
imin

I set up a TFTP server on port 192.168.0.1 tftpd-hpa
TFTP_DIRECTORY="/srv/tftp"
and copied the .bin to there
also set my static IP to 192.168.0.1

Then I ran fw_setenv TestMode mfg as root
Then unplugged the router from WAN to local network and to WAN to laptop with TFTP server.
Nothing happened. After waiting a while I unplugged and plugged back in. Still nothing so thats about it
I tried to plug back in to main wifi network as before but it does not show up on router so prob bricked it.
Anything you guys can learn from this or was I just being dumb? Regardless I had fun messing around with it!

a_guy · 2023-04-04T18:06:43.081Z

You didnt brick it yet. You need to clear this variable via serial console to load OEM kernel. Check conversation above.

a_guy · 2023-04-04T18:56:03.461Z

You basically made it stop in uboot. You should connect to jtag, set the tftp server and issue those uboot commands. You could tftp unencrypted OEM kernel from there or try openwrt firmware version i posted.

I'm slowly adding more stuff (for Ethernet mostly) from OEM dts to my dts and will have a new one tomorrow, hopefully

meisterlone · 2023-04-05T19:49:18.806Z

Yeah the guides here assume you have serial access. I recommend this one

DSD TECH SH-U09G USB to TTL Serial Cable Built-in FTDI FT232RL IC 1.8M/5.9FT (amazon.com)

Once you have that plugged in, you'll have a command prompt in uboot.

do
setenv TestMode
saveenv

reboot

Then your router should be back to normal.