Portal (Razer / Ignition Design Labs) - bringing up modern OpenWrt

For Developers
1

I have recently purchased a Portal router, with the intention of porting mainline OpenWrt to it.

The Portal has a rather strange architecture, in that it actually has 2 separate SoCs: a QCA9563 handling normal router functions and providing the web interface, and a QCA9531 (FCC docs show QCA4531, but I have taken mine apart, and it definitely says 9531 both on the chip itself and in the boot log - aparently these two are identical chips intended for different use cases) responsible for the DFS "Fastlane" function and cloud/app-based manageability. Both SoCs run separate instances of OpenWrt 15.05 Chaos Calmer, with a custom web interface on the 9563, "uath"-based (=vendor?) wireless drivers, and a custom daemon on each SoC (called "rwdagent" on the 9563 and "rwdmanager" on the 9531) seemingly managing communications between the two SoCs. So far, I have been able to gain root access and install LuCi on both SoCs, and disable rwdmanager's "phone home" features.

The 9563 is located on the router's main logic board, and the boot log indicates that this board self-identifies as an "AP152" reference design (which it's definitely not, it's clearly a custom board). The 9531 (4531 in FCC docs) is on an M.2 daughterboard, which self-identifies as an "AP143". The communications between the 2 boards appear to go over an Ethernet link wired to unused pins on the M.2 connector, even though the PCI-E lanes also appear to be connected.

Any ideas where to get started with bringing up a modern OpenWrt on this device? Are such dual-SoC setups even supported in any useful way?

1 Like
2

Getting the GPL Corresponding Source would be another source of information about the physical and logical layout and connectivity.

Understanding if the OEM firmware is running OpenWrt or QSDK (which identifies as OpenWrt Barrier Breaker or Chaos Calmer, depending on version) is valuable. QSDK has diverged significantly from OpenWrt and incorporates Qualcomm Atheros proprietary drivers and code that is generally not available to individuals,

I can't meaningfully comment on dual-SoC operation under OpenWrt.

3

Apparently it is QSDK indeed; the wireless drivers are definitely these: https://git.kos.org.cn/openkos/qca-wifi/tree/555ae6815659d38b0090395ed7d40ea6dd7a5ef9/qca-wifi/qca-wifi-10.2.4.58.1

As for GPL sources, they have this: https://portalwifi.com/legal (Open Source tab), which simply links to OpenWrt.org. Not even close to compliance.

4

did anyone managed to adapt these drivers to current snapshot and is willing to provide changes? i did make some progress but gave up once i realised they do not fit my requirements

5

I would actually prefer to run the normal in-tree "ath" drivers, not the vendor "qca" ones. Although I'm not sure if Portal's DFS magic is possible with the in-tree drivers.

7

Hello, I own two Portal Wifi, and I'm unable to setup OpenVPN client successfully. So I'm wondering how can I gain root access to it... Can you give me a clue?

8

Root may be gained by serial connection although I don't know the pinout or which set to connect to.

9

Hi,

I do own 3 devices. One of them soldered in to get TTL/RS232 interface (I forgot whether it is TTL of RS232, sorry - you just need to measure it on your own).
Recently I got myself a digital oscilloscope (electronics parts at least) - had no time to use it yet.

You can easily gain root access to the main chip. The software is outdated and you can break into. Or you can log into and then just gain access to it through the WWW (manufactured by some Japanese company).
Sources are not revealed (they are NOT compliant). Manufacturer company was sold to razer - there is a chance that if we push razer, they would fulfill the license and open the source. Especially if you live in US :slight_smile: Until now they did not agreed to reveal even the root password (and it is difficult to break - has salt and more... my GPU spent a week trying to find a match but failed so I stayed with my custom login using SSH keys). I wasn't brave enough to change root password as I am not aware of the communication between both chips.

Software is OpenWRT 15.05 with modified kernel (unfortunately). To play with existing kernel you need to add a key to /etc/opkg/keys/, filename de98a2dd1d0f8a07, content
untrusted comment: openwrt.org 15.05 release key
RWTemKLdHQ+KBxOILy8gyk+5PaDVdfyJ32TFnY/jnQOrBAd1wobbLNYz
:smiley:

There is a partition /dev/mtdblock6 which is restored when you press "reset" for about 10-15 seconds. In fact there are 2 partitions.
One partition holds kernel. I am not sure if we can easily add secondary kernel.
u-boot is there but I have not played with it much.
Boot args are in MTD1 (cat /dev/mdt1ro works as partition is padded with zeros :slight_smile: ).

We should be looking at AP152 reference board. I guess that there are more devices with same hardware.

I wonder what is the u-boot serverip=192.168.1.102 :slight_smile:

Whatever you do with your device - I recommend you to make a copy of whole MTD memory. Store it somewhere - every device should have its own unique settings (stored on one partition) so you should probably keep a separate backup of every device.

When I connected to the TTL/RS232 interface - I got a lot of errors. At least one part of the device should be using 115200 boundrate but I had either high noise or some other issues. Anyway - the output is messy (maybe you can get proper signal with better tools than I had).

I tried to control the LED - it seems that you cannot control the brightness :frowning: so there is only red, green and blue available (or mix). Access through /sys/class/leds :slight_smile: Also /lib/functions/leds.sh helps.

Let me know if you can find anything about the device. I tried to understand how to add OpenWRT support for it but I lack the knowledge (and time to work on it :frowning: )

This topic seems to describe similar (same?) board:

And someone added some code for the board here:

10

Is that the case? From LinkedIn Ignition Design Labs is acquired by Skspruce. You can see the product link for the Portal here:

The website also lists the Razer Sila too. If you visit their Chinese website, they mentioned they acquired Ignition Design Labs in November 2018: "2018年11月，公司成功并购美国硅谷IDL公司"

Perhaps if we want the source code, contacting Skspruce might be a good idea. It's apparently founded in SV too, so the US regulations should apply. However, it seems like the English website is basically abandoned since 2019, and their main operations are in Chengdu as their Chinese site remains very active.

Edit: Skspruce is now SOS Forfeited in California since 2020; it's likely a Chinese-only company now