2GB RAM and 4GB eMMC
- MXL3711 - MoCA 2.5
- Optional Bluetooth (not sure what chip)
Thanks! added to list. I don't think the bluetooth chip is populated on most of the newer version board.
Here's a decompiled
/sys/firmware/fdt for anybody wanting to take a crack at it: https://transfer.sh/ws8JTs/cr1000.dts
Is there a way to enable serial through fw_setenv command? I want try to tftp boot this with the Buffalo WXR-5950AX12 or QNAP 301W image. And then learn how to build openwrt by myself. Never done that before.
root@CR1000A:/# fw_printenv atf ## Error: "atf" not defined root@CR1000A:/# fw_printenv adminpass=########### baseMAC=######### baudrate=115200 bootargs=console=ttyMSM0,115200n8 vmalloc=900M cnss2.bdf_pci0=0xa4 bootcmd=bootipq ethact=eth0 ethaddr=############ fdt_high=0x4A400000 fdtcontroladdr=4a972e10 fileaddr=44000000 filesize=1c8 flash_type=5 ipaddr=192.168.1.1 machid=8010012 macno=7 model=CR1000A netmask=255.255.255.0 serialno=############ serverip=192.168.1.100 soc_hw_version=200d0200 soc_version_major=2 soc_version_minor=0 ssid=Verizon_6YHQZF stderr=serial@78B3000 stdin=serial@78B3000 stdout=serial@78B3000 wifipass=bee-yon3-befit hwver=0.0.6 dump_to_flash=0x0010f54e bootdelay=1
Check the @meisterlone's steps above. I've started adding support to openwrt but it will be slow as I never did it before and have almost no free time as of recently
this is a .dts I've recreated from proc/device-tree https://transfer.sh/U20W59/cr1000a.dts via dtc tool
Ok, I think I made some progress in this:
minimal dts: https://transfer.sh/ALuy5N/ipq8072-cr1000a.dts
initramfs image: https://transfer.sh/uxee14/openwrt-ipq807x-generic-verizon_cr1000a-initramfs-uImage.itb
So this is interesting, I was going over the FCC photo's and didn't see it. Why in the world would they be using this chip though? It's a 12 port SERDES SoC (system on a chip) that can do everything the main SoC can do (probably slower though), but then there's the rtl9311 with dual mips cores.
Anyway, we are working heavily on supporting the realtek SoC (as a SoC) in this thread Support for RTL838x based managed switches and have my WIP branch here https://gitlab.com/olliver/openwrt/openwrt/-/commits/dev/realtek-wip/ (which is always in flux anyway.
I'd be curious how they strapped this rtl9301 though; as you can, with pull-ups/downs configure the chip to be a 'dumb' switch. But then, how it would look in the DTS, I don't know.
I think from a linux PoV, you'd just have a 'dumb' switch chip. Then, if offloading those L2 and L3 features are desires, that'l be interesting. Normally, we configure the RTL9301 via lexra-bus register addresses. In this case, we'd need to write to some other bus. THe RTL9301 can be connected via a slave SPI interface. Is thats how they are talking to the chip? I wonder how registers are accessed. Probalby via their 16bit address, which is all we have access too. Thinking too much out loud now but that's something we'd have to think about in writing the proper rtl9301 DSA driver, that it can be talked to via SPI or via registers.
Hi All I am new here but excited to help out with this awesome project. I will take a look at this tonight and give it a try! Great work!
Little update, attempt 1 gave me invalid firmware error. Will continue to troubleshoot.
Well, you would need the access to serial port first for now; and follow instructions from @meisterlone.
But get the jailbreak first using @spol-eff approach with custom config file
The image is basically a livecd-style image which could be loaded from network. This way it won't brick your device.
Eventually (with @spol-eff help ) we could make a way to load the openwrt image via OEM interface. But we are far away from there yet
Oop yeah I got excited and realized I missed quite a few steps. Currently connecting to TFTP. I will let you know if it works once I actually get there!
Be extra careful. Only @meisterlone could currently recover his device from brick.
Looks like I ended up bricking my router... I got the ssh to work which was awesome and was able to change the color of the status led which was cool!
I set up a TFTP server on port 192.168.0.1 tftpd-hpa
and copied the .bin to there
also set my static IP to 192.168.0.1
Then I ran fw_setenv TestMode mfg as root
Then unplugged the router from WAN to local network and to WAN to laptop with TFTP server.
Nothing happened. After waiting a while I unplugged and plugged back in. Still nothing so thats about it
I tried to plug back in to main wifi network as before but it does not show up on router so prob bricked it.
Anything you guys can learn from this or was I just being dumb? Regardless I had fun messing around with it!
You didnt brick it yet. You need to clear this variable via serial console to load OEM kernel. Check conversation above.
You basically made it stop in uboot. You should connect to jtag, set the tftp server and issue those uboot commands. You could tftp unencrypted OEM kernel from there or try openwrt firmware version i posted.
I'm slowly adding more stuff (for Ethernet mostly) from OEM dts to my dts and will have a new one tomorrow, hopefully
Yeah the guides here assume you have serial access. I recommend this one
DSD TECH SH-U09G USB to TTL Serial Cable Built-in FTDI FT232RL IC 1.8M/5.9FT (amazon.com)
Once you have that plugged in, you'll have a command prompt in uboot.
Then your router should be back to normal.
Ok so with minor change to uart for serial output your build runs on the router.
BusyBox v1.36.0 (2023-04-02 22:25:00 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r22461-49eff508c4 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever root@OpenWrt:/# ls -l /sys/class/net/ lrwxrwxrwx 1 root root 0 Jan 1 1970 lo -> ../../devices/virtual/net/lo
However without any ethernet ports, as expected. The Wifi will not be too diifficult get up but I suspect the ethernet is going to be a headache
[ 5.125502] kmodloader: 1 module could not be probed [ 5.125616] kmodloader: - qca-nss-dp - 0 [ 31.205213] l11: disabling
Maybe some help from guys at this thread,
IPQ807X NSS Build - Community Builds, Projects & Packages - OpenWrt Forum
They seemed to have figured out qca_nss_dp for that router.
the NSS Build is not supported. If the aim to have this device openwrt supported you should be using the openwrt snapshot that has ipq807x support and includes the nss_dp . You will need to create your own dtsi ... imho as you have an aquantia try to start building with a qnap image ...