Adding Support for Verizon CR1000A

2GB RAM and 4GB eMMC


  • MXL3711 - MoCA 2.5
  • Optional Bluetooth (not sure what chip)

Thanks! added to list. I don't think the bluetooth chip is populated on most of the newer version board.

Here's a decompiled /sys/firmware/fdt for anybody wanting to take a crack at it:

Is there a way to enable serial through fw_setenv command? I want try to tftp boot this with the Buffalo WXR-5950AX12 or QNAP 301W image. And then learn how to build openwrt by myself. Never done that before.

root@CR1000A:/# fw_printenv atf
## Error: "atf" not defined
root@CR1000A:/# fw_printenv 
bootargs=console=ttyMSM0,115200n8 vmalloc=900M cnss2.bdf_pci0=0xa4

Check the @meisterlone's steps above. I've started adding support to openwrt but it will be slow as I never did it before and have almost no free time as of recently :persevere:

1 Like

this is a .dts I've recreated from proc/device-tree via dtc tool

Ok, I think I made some progress in this:
minimal dts:
initramfs image:

Any volunteers? :slight_smile:


So this is interesting, I was going over the FCC photo's and didn't see it. Why in the world would they be using this chip though? It's a 12 port SERDES SoC (system on a chip) that can do everything the main SoC can do (probably slower though), but then there's the rtl9311 with dual mips cores.

Anyway, we are working heavily on supporting the realtek SoC (as a SoC) in this thread Support for RTL838x based managed switches and have my WIP branch here (which is always in flux :slight_smile: anyway.

I'd be curious how they strapped this rtl9301 though; as you can, with pull-ups/downs configure the chip to be a 'dumb' switch. But then, how it would look in the DTS, I don't know.

I think from a linux PoV, you'd just have a 'dumb' switch chip. Then, if offloading those L2 and L3 features are desires, that'l be interesting. Normally, we configure the RTL9301 via lexra-bus register addresses. In this case, we'd need to write to some other bus. THe RTL9301 can be connected via a slave SPI interface. Is thats how they are talking to the chip? I wonder how registers are accessed. Probalby via their 16bit address, which is all we have access too. Thinking too much out loud now :slight_smile: but that's something we'd have to think about in writing the proper rtl9301 DSA driver, that it can be talked to via SPI or via registers.

1 Like

Hi All I am new here but excited to help out with this awesome project. I will take a look at this tonight and give it a try! Great work!

Little update, attempt 1 gave me invalid firmware error. Will continue to troubleshoot.

Screenshot from 2023-04-03 21-35-40

Well, you would need the access to serial port first for now; and follow instructions from @meisterlone.
But get the jailbreak first using @spol-eff approach with custom config file

The image is basically a livecd-style image which could be loaded from network. This way it won't brick your device.

Eventually (with @spol-eff help :slightly_smiling_face:) we could make a way to load the openwrt image via OEM interface. But we are far away from there yet

1 Like

Oop yeah I got excited and realized I missed quite a few steps. Currently connecting to TFTP. I will let you know if it works once I actually get there!

Be extra careful. Only @meisterlone could currently recover his device from brick.

1 Like

Looks like I ended up bricking my router... I got the ssh to work which was awesome and was able to change the color of the status led which was cool!

I set up a TFTP server on port tftpd-hpa
and copied the .bin to there
also set my static IP to

Then I ran fw_setenv TestMode mfg as root
Then unplugged the router from WAN to local network and to WAN to laptop with TFTP server.
Nothing happened. After waiting a while I unplugged and plugged back in. Still nothing so thats about it
I tried to plug back in to main wifi network as before but it does not show up on router so prob bricked it.
Anything you guys can learn from this or was I just being dumb? Regardless I had fun messing around with it!

You didnt brick it yet. You need to clear this variable via serial console to load OEM kernel. Check conversation above.

You basically made it stop in uboot. You should connect to jtag, set the tftp server and issue those uboot commands. You could tftp unencrypted OEM kernel from there or try openwrt firmware version i posted.

I'm slowly adding more stuff (for Ethernet mostly) from OEM dts to my dts and will have a new one tomorrow, hopefully

Yeah the guides here assume you have serial access. I recommend this one

DSD TECH SH-U09G USB to TTL Serial Cable Built-in FTDI FT232RL IC 1.8M/5.9FT (

Once you have that plugged in, you'll have a command prompt in uboot.

setenv TestMode


Then your router should be back to normal.

1 Like

Ok so with minor change to uart for serial output your build runs on the router.

BusyBox v1.36.0 (2023-04-02 22:25:00 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 OpenWrt SNAPSHOT, r22461-49eff508c4
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
root@OpenWrt:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
root@OpenWrt:/# ls -l /sys/class/net/
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lo -> ../../devices/virtual/net/lo

However without any ethernet ports, as expected. The Wifi will not be too diifficult get up but I suspect the ethernet is going to be a headache

[    5.125502] kmodloader: 1 module could not be probed
[    5.125616] kmodloader: - qca-nss-dp - 0
[   31.205213] l11: disabling

Maybe some help from guys at this thread,
IPQ807X NSS Build - Community Builds, Projects & Packages - OpenWrt Forum

They seemed to have figured out qca_nss_dp for that router.

1 Like

the NSS Build is not supported. If the aim to have this device openwrt supported you should be using the openwrt snapshot that has ipq807x support and includes the nss_dp . You will need to create your own dtsi ... imho as you have an aquantia try to start building with a qnap image ...