D-Link DAP-1522 with 18.06.0 - failed upgrade

Installing and Using OpenWrt
1

Hello all,

Two days ago I tried flashing a D-Link DAP-1522 HW revision A1 with openwrt 18.06.0, more exactly with:

openwrt-18.06.0-ramips-rt288x-dlink_dap-1522-a1-squashfs-factory.bin

The original firmware was the latest from D-link:

v1.42.B01

After waiting for about 4 minutes I tried to connect to the device but I couldn't find it at 192.168.1.1 and after trying a few more time (let's say 5 more minutes) I power cycled it.

To cut it short, I eventually entered the recovery mode (reset button down on powerup) and I eventually was able to find the emergency webserver at 192.168.0.50 which is the default address with the original firmware, not the expected 192.168.1.1.

I tried to upload a number of original D-Link firmware versions but none worked. After this I managed to connect to the serial port and below is the output I got on a "normal" boot, with the original spacing and no cable connected to the switch:

U-Boot 1.1.3 (Sep "5 2208 - 10:37:42) Build 001--ALPHA_v011                                
                                                                                           
Board: RT2880 DRAM:  32 MB                                                                 
        twe0 set to <NULL>                                                                 
        toe0 set to <NULL>                                                                 
        Set up sector start address BC400000                                               
============================================                                               
ASIC -VerB/C (MAC to MAC Mode)                                                             
DRAM COMPONENT=256Mbits                                                                    
Votal memory = 32Mbytes
Date:Sep  5 2008  Time:10:37:42
=======================================?==== 
Eth0 (10/100-M)



Hit any key to stop autoboot:  0 
## Booting image at bc440000 ...
                                  Image Name:   7zip Linux Kernel
   Created:      1970-01-01   0:00:00 UTC
   Image Type:  $OIPS"Linux Kernel Image (lzma compressed)
   Data Size:    -1 Bytes = 4096 MB
   Load Address: 8a͘00000
   Entry Point:  8a000000
   Uncompressing Kernel Image with LZMA ...   
OK

Starting kernel ...

[    0.042000] Linux version 4.14.54 (buildbot@builds-03.infra.lede-project.org) (gcc version 7.3.0 (OpenWrt GCC 78
[    0.000000] SoC Type: Ralink RT2880 id:2 rev:0
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0041�06c (MIPS 4KEc)
[    0.000000] MIPS: machine is D-Link DAP-1522 A1
[    0.000022] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 08000000 (usable)
[    0.000000] Wasting 1048576 bytes for tracking 32768 unused pages
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 byves
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000009ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000009ffffff]
[    0.000000] Initoem setup node 0 [mem 0x0000000000000000-0x0000000009ffffff]
[    0.000000] random: get_random_bytes called from 0x8840c72c with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 40640
[   "0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID"hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 25632K/163840K aviilable (3511K kernel code, 172K rwdata, 452K rodata, 1232K init, 214K bss)
[    0.000000] SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] Failed to request intc memory
[   00.000000] Kernel panic - not syncing: Failed to request resources for ralink,rt2880-sysc
[    >.000000] Rebooting in 1 seconds..
[    0.000000] Reboot failed -- System halted

In recovery mode I get:

U-Boot 1.1.3 (Sep  5 2008 - 10:37:42)"Build 001--ALPHA_v011                                
                                                                                           
Board: RT2880 DRAM:  32 MB                                                                 
        twe0 set to <NULL>                                                                 
        toe0 set to <NULL>                                                                 
        Set up sector start address BC400000                                               
============================================                                               
ASIC -VerB/C (MAC to MAC Mode)                                                             
DRAM COMPONENT=256Mbits                                                                    
DRAM BUS=16BIT 
Total memory = 32Mbytes
Date:Sep  5 2008  Time:10:37:42
============================================ 

Eth0 (10/106-M)



Hit any key to stop autoboot:  1 ** abort **

Emergency web server start...
 STOQ_RT2880_ETH 

 Waitting  RT2880_RX_DMA_BUSY status Start.
 RTL8366SR init... 
 Phy:0xf00 0xde1  0x1140
 Phy init success!!
 Enable GMAC Phy(0x3F01DC45) !!
 Waitting  to GMAC1 link up  Start!!
 Header<Rayload scatter function is Disable !! 

 ETH_STATE_ACTIVE!!

The same output as above but a bit more mangled is seen if I press any key in the serial terminal. I tried 'q', 'f', '1' and a few other keys with the same result.
A '>' character seems to be added every few seconds if I enter the recovery mode via keypress. AND if I press any key on power up/boot, the device enters recovery mode.

I don't have any JTAG hardware and probably soldering to the JTAG header is likely not possible with what I have.

The device is connected to a PC via a gigabit switch and I reduced the PC's MTU to 1500 in order to avoid TCP window full errors in wireshark. I also tried a direct connection (no switch) with the same result: flashing via webserver is not possible.
The serial port output in that case is:

httpd: rx=0

and occasionally numbers like 1400 and 700 (ballpark) are flashing by. When I left it running overnight nothing went through in the end.

I would like to know if my device is bricked or not at this stage.
If there is anything else I could try, I'm open to suggestions.

2

I wish i read this earlier, tried to flash 18.06.1 and i have the same issue as you. What did you do to fix it?

3

It's not fixed.
Based on wireshark's errors/warnings it looks like the box is not processing the packets at all, perhaps a different approach is needed.

4

Looks like wrong memory calculation (the DAP-1522 has only 32MB)

Issue fixed in https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=93bfafb8dc209f153022796d9e747149e66cc29e

Related bug reports:
FS#1586 - DAP-1522 A1 factory to snapshot kernel panic and system halt
FS#1511 - Belkin F5D8235 v1 (most likely all rt288x devices) are broken on Linux 4.14

Have you tried snapshot already?

5

Do I need to serial access the router to reflash the latest firmware? I'm not sure how to proceed. Any help will be greatly appreciated!

6

The important question is: how can a borked device be reflashed with any other firmware?

7
8

Harlan can you provide a picture of the pin out of the serial connector, i dont really want to muck around with it too much figuring it out

9

My device is reassembled and put away for now.
Here's a link to the picture I used:
Serial port
The pinout can be found there as well:
Serial pinout

Just be aware the ground connection is not a hole. Solder to the solder patch present and don't try to clear the hole. I burned the pad away doing that and I had to get the ground connector soldered to the power jack.
Or just do that from the start if it's easier for you.

In my case I couldn't do anything useful once I was in failsafe mode - entered via the serial port. No telnet connection could be established.

What else can be done if the box doesn't respond properly to any of the methods mentioned above?

10

So you couldnt tftp recover the router? even whilst in failsafe? Looking at the wikidev page here:
https://wikidevi.com/wiki/D-Link_DAP-1522_rev_A1#help
There seems to be an option for "tftpboot- boot image via network using TFTP protocol"
Based on my one experience i had flashing TP-Link W8980 using the serial method it seems as though the steps are similar. Refer here for the steps: https://openwrt.org/toh/tp-link/td-w8970_v1#installation_using_serial
Steps

  1. Download the openwrt-lantiq-xrx200-TDW8970-uImage-sysupgrade.image
  2. Switch on the device and press 't' on the serial console until you get a prompt, then run commands similar to these:
  3. Set the device's IP if you don't want the default 192.168.1.1: (so you don't have to move your TFTP server onto a different subnet)
    setenv ipaddr 192.168.1.1
  4. Set the address of your TFTP server:
    setenv serverip 192.168.1.2
  5. Set the board type (not sure if this is necessary):
    setenv bootargs 'board=WD8970'
  6. Download the image into RAM (not flash):
    tftpboot 0x81000000 openwrt-lantiq-xrx200-TDW8970-sysupgrade.image
  7. Erase the rootfs flash area:
    sf erase 0x20000 0x7a0000
  8. Write image to flash:
    sf write 0x81000000 0x20000 0x$(filesize)
  9. Reboot into OpenWrt:
    reset

The commands 'setenv', 'erase' 'tftpboot' seem to be listed in the wikidev page too.

If someone can shed some light on the specific hex address to erase and flash that would be awesome!

11

I do not get the prompt back in the serial console once it enters failsafe mode.

12

I can confirm that using the webserver recovery method I was able to flash the D-Link firmware back. SUPRISINGLY the IP address for the web server recovery was 192.168.1.10 so you might want to give that a try. I can also confirm that flashing to the latest snapshot i.e. r8086-1801e60 works fine. Obviously no Luci in a snapshot build. But happy days!

13

So turns out it is not worth installing openwrt on this machine, low flash and low ram, also low wireless 5ghz throughput. :frowning:

1 Like
14

Yesterday I decided to have another try at recovery. Since last time I put it back in its case and I just put it in failsafe mode with the reset button on power-up.
To clarify, I used the emergency webserver method.

It failed miserably on the first try but on the second try I was able to flash v1.31 of the original d-link firmware. I chose that because it's a smaller binary.

It took only a few seconds to notice something is different this time (LED behavior), then the web page updated with a countdown timer which then asked me to power cycle.

The physical switch was in AUTO mode and I used port #2 - but it probably didn't matter.
After the first succesful boot with the original fw it was in bridge mode because it had no internet access.

My guess its that some uninitialized memory was now holding a correct or acceptable value this time and it didn't hang on this boot.
So keep trying if this happens to you, and it may work eventually. The box was unpowered for something like two weeks before this try.

Second, 192.168.1.10 didn't work. Mine kept its address after flashing - the one I set last time - which coincided with the d-link default. It still had it after the recovery, together with other info set by me.

Third, I decided to test the bandwith in bridge mode on 5GHz just because I got it working - now upgraded to latest d-link fw v1.42B01 . The router it connected to is running openwrt and I had two machines to run the iperf client and server:

  • PC1 -- router/AP 5GHz <--wireless--> DAP-1522 brige mode (auto selecting freq) -- PC2

iperf with multiple streams consistently got me around 947Mbps average which is not too shabby. UDP tests were just as consistent.
Enabling QoS by port and using the voice port (#4) got even better latency.

I might even try a newer build of openwrt at some point - I really don't learn that fast :slight_smile:

15

I had similar issues with DAP-1522 (and did not read this thread before). Following the steps for D-Link recovery mode allowed me to access the emergency web server in order to upload a different firmware again - see https://openwrt.org/docs/guide-user/troubleshooting/vendor_specific_rescue#rescue_firmware_partition

Steps

  • connect cable to LAN port #1
  • disconnect device from power
  • hold reset button & connect device to power again (still trigger reset button)
  • power LED is flashing
  • release reset button when LED of LAN port #1 is on

Emergency Web Server is available at http://192.168.0.50/

  • LAN configuration needs to be defined manually (e.g. 192.168.0.2, mask 255.255.255.0)
  • device does not respond to ICMP ping on 192.168.0.5 - but web server will respond