2GB RAM and 4GB eMMC
Add
- MXL3711 - MoCA 2.5
- Optional Bluetooth (not sure what chip)
Thanks! added to list. I don't think the bluetooth chip is populated on most of the newer version board.
Here's a decompiled /sys/firmware/fdt for anybody wanting to take a crack at it: https://transfer.sh/ws8JTs/cr1000.dts
Is there a way to enable serial through fw_setenv command? I want try to tftp boot this with the Buffalo WXR-5950AX12 or QNAP 301W image. And then learn how to build openwrt by myself. Never done that before.
root@CR1000A:/# fw_printenv atf
## Error: "atf" not defined
root@CR1000A:/# fw_printenv
adminpass=###########
baseMAC=#########
baudrate=115200
bootargs=console=ttyMSM0,115200n8 vmalloc=900M cnss2.bdf_pci0=0xa4
bootcmd=bootipq
ethact=eth0
ethaddr=############
fdt_high=0x4A400000
fdtcontroladdr=4a972e10
fileaddr=44000000
filesize=1c8
flash_type=5
ipaddr=192.168.1.1
machid=8010012
macno=7
model=CR1000A
netmask=255.255.255.0
serialno=############
serverip=192.168.1.100
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
ssid=Verizon_6YHQZF
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
wifipass=bee-yon3-befit
hwver=0.0.6
dump_to_flash=0x0010f54e
bootdelay=1
Check the @meisterlone's steps above. I've started adding support to openwrt but it will be slow as I never did it before and have almost no free time as of recently 
1 Like
this is a .dts I've recreated from proc/device-tree https://transfer.sh/U20W59/cr1000a.dts via dtc tool
Ok, I think I made some progress in this:
minimal dts: https://transfer.sh/ALuy5N/ipq8072-cr1000a.dts
initramfs image: https://transfer.sh/uxee14/openwrt-ipq807x-generic-verizon_cr1000a-initramfs-uImage.itb
Any volunteers? 
3 Likes
So this is interesting, I was going over the FCC photo's and didn't see it. Why in the world would they be using this chip though? It's a 12 port SERDES SoC (system on a chip) that can do everything the main SoC can do (probably slower though), but then there's the rtl9311 with dual mips cores.
Anyway, we are working heavily on supporting the realtek SoC (as a SoC) in this thread Support for RTL838x based managed switches and have my WIP branch here https://gitlab.com/olliver/openwrt/openwrt/-/commits/dev/realtek-wip/ (which is always in flux anyway.
I'd be curious how they strapped this rtl9301 though; as you can, with pull-ups/downs configure the chip to be a 'dumb' switch. But then, how it would look in the DTS, I don't know.
I think from a linux PoV, you'd just have a 'dumb' switch chip. Then, if offloading those L2 and L3 features are desires, that'l be interesting. Normally, we configure the RTL9301 via lexra-bus register addresses. In this case, we'd need to write to some other bus. THe RTL9301 can be connected via a slave SPI interface. Is thats how they are talking to the chip? I wonder how registers are accessed. Probalby via their 16bit address, which is all we have access too. Thinking too much out loud now but that's something we'd have to think about in writing the proper rtl9301 DSA driver, that it can be talked to via SPI or via registers.
2 Likes
Hi All I am new here but excited to help out with this awesome project. I will take a look at this tonight and give it a try! Great work!
Little update, attempt 1 gave me invalid firmware error. Will continue to troubleshoot.
Well, you would need the access to serial port first for now; and follow instructions from @meisterlone.
But get the jailbreak first using @spol-eff approach with custom config file
The image is basically a livecd-style image which could be loaded from network. This way it won't brick your device.
Eventually (with @spol-eff help 
) we could make a way to load the openwrt image via OEM interface. But we are far away from there yet
1 Like
Oop yeah I got excited and realized I missed quite a few steps. Currently connecting to TFTP. I will let you know if it works once I actually get there!
Be extra careful. Only @meisterlone could currently recover his device from brick.
1 Like
Looks like I ended up bricking my router... I got the ssh to work which was awesome and was able to change the color of the status led which was cool!
I set up a TFTP server on port 192.168.0.1 tftpd-hpa
TFTP_DIRECTORY="/srv/tftp"
and copied the .bin to there
also set my static IP to 192.168.0.1
Then I ran fw_setenv TestMode mfg as root
Then unplugged the router from WAN to local network and to WAN to laptop with TFTP server.
Nothing happened. After waiting a while I unplugged and plugged back in. Still nothing so thats about it
I tried to plug back in to main wifi network as before but it does not show up on router so prob bricked it.
Anything you guys can learn from this or was I just being dumb? Regardless I had fun messing around with it!
You didnt brick it yet. You need to clear this variable via serial console to load OEM kernel. Check conversation above.
You basically made it stop in uboot. You should connect to jtag, set the tftp server and issue those uboot commands. You could tftp unencrypted OEM kernel from there or try openwrt firmware version i posted.
I'm slowly adding more stuff (for Ethernet mostly) from OEM dts to my dts and will have a new one tomorrow, hopefully
Yeah the guides here assume you have serial access. I recommend this one
DSD TECH SH-U09G USB to TTL Serial Cable Built-in FTDI FT232RL IC 1.8M/5.9FT (amazon.com)
Once you have that plugged in, you'll have a command prompt in uboot.
do
setenv TestMode
saveenv
reboot
Then your router should be back to normal.
1 Like
Ok so with minor change to uart for serial output your build runs on the router.
BusyBox v1.36.0 (2023-04-02 22:25:00 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r22461-49eff508c4
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
root@OpenWrt:/# ls -l /sys/class/net/
lrwxrwxrwx 1 root root 0 Jan 1 1970 lo -> ../../devices/virtual/net/lo
However without any ethernet ports, as expected. The Wifi will not be too diifficult get up but I suspect the ethernet is going to be a headache
[ 5.125502] kmodloader: 1 module could not be probed
[ 5.125616] kmodloader: - qca-nss-dp - 0
[ 31.205213] l11: disabling
Maybe some help from guys at this thread,
IPQ807X NSS Build - Community Builds, Projects & Packages - OpenWrt Forum
They seemed to have figured out qca_nss_dp for that router.
1 Like
the NSS Build is not supported. If the aim to have this device openwrt supported you should be using the openwrt snapshot that has ipq807x support and includes the nss_dp . You will need to create your own dtsi ... imho as you have an aquantia try to start building with a qnap image ...