Adding Support for Verizon CR1000A

Trying to make that usrApp work

root@OpenWrt:/# ./mnt/usrApp 
RTK User Space SDK Initialize
RTCORE Driver Module Initialize
  IOAL init
  IOAL init
[2][] !rtkErr: unit 0 ioal_init fail
*** [RT_ERR] /home/chunpin_shao/verizon_chr2f_qcm_3.1phase1_release-Build_Number_73/openwrt/build_dir/target-aarch64-openwrt-linux_musl/rtl-9303-3.6.2.56/sdk/system/common/rtcore/user/rtcore_init.c:385: In function 'rtcore_init'
             Error Code: 0xFFFFFFFF

[2][] !rtkErr: rtcore_init failed!!

*** [RT_ERR] /home/chunpin_shao/verizon_chr2f_qcm_3.1phase1_release-Build_Number_73/openwrt/build_dir/target-aarch64-openwrt-linux_musl/rtl-9303-3.6.2.56/sdk/system/linux/usrAppStart.c:382: In function 'main'
             Error Code: 0xFFFFFFFF

It now moves a bit further in init sequence but still fails. Any hint what could be the reason?

Could that be the reason the AQR loading happens using /dev/spidev32765.0 ?

What my guess is, that the AQR firmware is loaded onto the RTL9301 bus via the SPI control interface.

I personally would start the other way around; load the vendor firmware, and try to talk via spi first. That'll let you ensure your binary works; then, swap it around :slight_smile:

Well, it could happen over the RTL9301-s MDIO interface as you can only load the AQR FW via SPI-NOR that AQR reads directly or via MDIO.

I already tried that. No luck. Spidev_test is a standard openwrt tool.

I get that, but that's what we'll have to get to work :slight_smile: the usrApp manages to do it; so that's what we'll need to figure out/replicate.

Ok, understood. Is the speed wrong? Any other suspects?

Update

trying go back to basics: in order to read register over spi i need to set MSB to 1 and I need to send 2 more dummy bytes to read data back . so for reading rtl9301 16-bit registers 'p' parameter for spidev_test would be 'x80x04x00x00'.

tried this with different speeds/modes/word sizes - getting only 0s back. on oem firmware too

I noticed that when I change bridge config on OEM GUI, it will push changes through /tmp/rtl9303_diag.fifo.

root@CR1000A:/rom/usr/bin# tail -f /tmp/rtl9303_diag.fifo 
port set port 8 state disable
port set port 20 state disable
port set port 24 state disable

which similar to the init.d: cat /etc/init.d/rtl-9303: (This could be a way to push config to switch when you figure out how to run usrApp)

boot() {
	mkfifo $DIAG_FIFO
	tail -f $DIAG_FIFO | /usr/bin/usrApp&
	sleep 2

	echo "port set port all state disable" > $DIAG_FIFO

	# Clean up vlan table and l2 table for caching
	# echo "vlan destroy all restore-default-vlan" > $DIAG_FIFO

Yes, we just need to replay this file once the usrApp works. I need fresh ideas on how to do that though.

Could you test the throughput between lan 10G/2.5G and wan 10G port? i have a suspicion it is limited to 1gbps....

also, new firmware https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.8.bin is available.

Afaik you need 16 bits for the address, but I'd bet/expect 16 additional bits are needed to make it a full 32 bits. The returned data will be 32bits for sure.

Being able to use the vendor binary on openwrt would also be useful, as you can then just print out a copy (by hacking the spi-dev driver) of whatever the vendor app is doing. Both options are fair, but both rely on a properly setup dts with properly setup spi busses. Did you try using the vendor DTS with openwrT? half the stuff won't work; but the SPI stuff should be fine?

Btw, I take it that /tmp/rtl9303_diag.fifo is created by the realtek app to create an interface to the rest of the OS?

Tried with both 16 (x80 04 00 00 00 00) and 32 bit (x80 00 00 04 00 00 00) getting only 0s in response.

I guess my next step is run remote debugging session to see why the usrApp fails. Any good setup guides for gdb and OpenWrt?

what you can also try first, before going down the GDB route;

write a little application, that creates a filedescriptor and listens on it (file-pipe?) idk. then, use that as output to the userApp. e.g. userapp -> /dev/myapp and printf anything that userapp sends.

To make it extra special, send whatever userapp inputs, also to the real spi device (and everything you read, back to the file-pipe)

Basically, doing a 'man-in-the-middle' thing. That way, you can see exactly what they are sending/receiving.

Not sure if this helps but this command basically dump the current switch config:

RTK.0> sys dump hwp all
    Profile Information (67D678):
      Profile-Name: RTL9303_8XGE
      Profile-ID: 9300015
      Profile-ID-Type: 0
      CPU Type: External
      SW Desc IDX: 0
      Slave Interrupt Pin: 255
      Chip count: 1
      Cascade Mode: No
        unit  0, 9303(1) (cpu)
          swcore support: 1
          swcore-CPU Interface(1:normal, 2:SPI, 3: PCIe): 2
          nic support: 1
          port count: 6
          macId: 8,20,24,25,27,28,
          CpuMacId: 28  (attr)
          Ether   cnt: 5, macId(m/M): 8/27 msk:0x0b100100 0x00000000 (A)
          Uplink  cnt: 3, macId(m/M):24/27 msk:0x0b000000 0x00000000 (A)
          2_5GE   cnt: 3, macId(m/M): 0/25 msk:0x03100000 0x00000000 (E)
          XGE     cnt: 2, macId(m/M): 8/27 msk:0x08000100 0x00000000 (E)
          Copper  cnt: 4, macId(m/M): 8/25 msk:0x03100100 0x00000000 (M)
          Serdes  cnt: 1, macId(m/M):27/27 msk:0x08000000 0x00000000 (M)
          port: 8, phyIdx0
          port:20, phyIdx1
          port:24, phyIdx2
          port:25, phyIdx3
          port:27, phyIdx255
          port:28, phyIdx255

          PHY Count:4
            type:25(CUST5       ) port:1 baseMac:8
            type:19(RTL8226B    ) port:1 baseMac:20
            type:19(RTL8226B    ) port:1 baseMac:24
            type:24(CUST4       ) port:1 baseMac:25
          PHY[0]: chipID 25, baseMacId  8, phy_max  1 
          PHY[1]: chipID 19, baseMacId 20, phy_max  1 
          PHY[2]: chipID 19, baseMacId 24, phy_max  1 
          PHY[3]: chipID 24, baseMacId 25, phy_max  1 

it helps - it at least shows that SPI is used. But I can't make SPI work; and from available realtek SDK sources the ioal_init() which fails is just a wrapper around drv_swcore_ioalCB_register() which i have no sources for.

I have very little time as of recently to dedicate to this project, so here is the latest:

  • RTL9301 doesn't work (this affects all lan side: 2x2.5G + 1x10G + 1MoCA)
  • everything else works (3x wifi, usb, wan 10G, serial, etc)

found this right before userApp crashes. what is this /dev/mem device?

root@OpenWrt:/mnt# strace ./usrApp 
....
openat(AT_FDCWD, "/dev/mem", O_RDWR|O_LARGEFILE) = -1 ENOENT (No such file or directory)
....

looks like /dev/mem will give you access to physical memory?

Which, by default, is not enabled on OpenWrt (or other mainstream general purpose distributions) for security reasons (but it can be for private testing and debugging).

Thanks, folks. I'm trying to find this option in menuconfig...

This didn't work for me.

It's a busybox applet - and busybox' configuration settings are guarded by the developer settings (as doing so holds a high risk of rendering the image unbootable or similar).