Dwr-921 russian issues

BackON · June 16, 2020, 9:01pm

Hello

I got a DWR-921 C3 revision with russian firmware and uboot (no jboot) i tried to load firmware via TFTP bad doesnt load. The hardware is the same as C3

here is the serial log from boot

Flash component: SPI Flash
Date:Nov 17 2015  Time:18:08:01
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
raspi_read: from:40028 len:6


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
Bad Magic Number,444C4B36


U-Boot 1.1.3 (Nov 17 2015 - 18:08:01)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: ef 40 18 0 0 (40180000)
find flash: W25Q128BV
raspi_read: from:30000 len:1000
raspi_read: from:30000 len:1000
============================================
Ralink UBoot Version: 4.1.1.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 17 2015  Time:18:08:01
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
raspi_read: from:40028 len:6


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
Bad Magic Number,444C4B36

Original Firmware is here. http://ftp.dlink.ru/pub/Router/DWR-921/Firmware/

123serge123 · June 17, 2020, 11:05am

DWR-921 C3 revision isn't supported by openwrt. So it's unclear what you do and what you want to get.

BackON · June 17, 2020, 2:08pm

the wiki says that its supported

https://openwrt.org/toh/d-link/d-link_dwr-921

123serge123 · June 17, 2020, 7:45pm

But wiki says that this router uses jboot loader. So you can't use release image directly. At least rebuild for uboot loader.

BackON · June 17, 2020, 10:21pm

originally the router has a jboot but i made a mistake and i have restored the russian firmware that changes the bootloader. i dont know how to restore jboot. i cant downgrade to openwrt or WW firmware

123serge123 · June 18, 2020, 6:24am

I can try to rebuild openwrt firmware for uboot if you are ready to test it.

BackON · June 18, 2020, 2:54pm

i can try it without problem because i have this router with serial port opened

s_2 · June 19, 2020, 9:12am

Could you post the mtd partition layout from the bootlog?
According to the dts it is just three partitions, jboot 64k and config at the very end of the flash, which is afaik required for jboot to work.

Here is a dump of the jboot partition from my C3 if that helps, you could probably flash it via tftp from uboot and then proceed to flashing OpenWRT via the jboot recovery, but it's always good to have an spi programmer (ch341) just in case something goes wrong

BackON · June 19, 2020, 11:54am

here is the layout

B# cat /proc/mtd
dev: size erasesize name
mtd0: 01000000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00150000 00010000 "Kernel"
mtd5: 00e60000 00010000 "RootFS"
mtd6: 00fb0000 00010000 "Linux"

im gonna to try to flash the jboot

s_2 · June 19, 2020, 12:12pm

This is weird, either they have moved the config partition from the end of the flash to 0x30000 or it was completely overwritten

But then again, it might just be the uboot-environment. Could you run md 9f030000 from the uboot shell? There might be just ascii data containing the uboot environment.

I'll also dump my routers config partition and see what's actually inside. If this were actually required for jboot, that would mean they deliberately prevent people from going back to jboot, which is kinda awkward

What is "POST" by the way, some russian ISP that distribute those devices? So maybe we should have official OpenWRT images for those as well, if there are lots of devices out there with uboot now.

// edit: config actually contains important stuff like mac address etc.
Can you check whether your device's mac address is still found at 0x9fffe2b0 in the flash?

The output of /proc/mtd does not state the partition start offset, but it looks like "Linux" contains Kernel and rootfs, the latter using the space until the end of the flash... So they have probably overwritten the jboot stuff

BackON · June 19, 2020, 12:56pm

i made a full backup

when i put md 9f030000 in uboot show baddbadd continuosly

the mac addres i cant find anywhre only here show a mac when i put print env

bootcmd=tftp
bootdelay=2
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
filesize=93e2fb
fileaddr=80A00000
ipaddr=192.168.0.1
serverip=192.168.0.2
autostart=no
bootfile=firmware.bin
stdin=serial
stdout=serial
stderr=serial

s_2 · June 19, 2020, 1:06pm

like the real contents of the flash at that offset?
Interesting... so maybe they copied the config partition to 0x030000 and overwrote everything jboot (at the beginning) but just keeping the mac adress etc., since their os would read it from an mtd partition called config...

Now this really turns into crystal ball reading, but maybe md 9f03ffe2b0 from uboot would show your real mac address? (On my router it is located at 0xe2ba, but that is not an 32bit-aligned address uboot could read).

The one printed on the device label, 00:AA:BB:CC:DD:10 is just some default value in the uboot environment, which they are not using to store the real mac address.

123serge123 · June 19, 2020, 1:10pm

First attempt to build uboot firmware

I'm not sure of mac address. Pls check

BackON · June 19, 2020, 10:56pm

I have tested it now . Boots but shows a kernel panic.

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1564750 Bytes =  1.5 MB
   Load Address: 80000000
   Entry Point:  80000000
raspi_read: from:50040 len:17e04e
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.180 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620N ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is D-Link DWR-921 C3
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from 0x80481740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0007d350
[    0.000000] Readback ErrCtl register=0007d350
[    0.000000] Memory: 58820K/65536K available (3916K kernel code, 187K rwdata, 500K rodata, 1212K init, 215K bss, 6716K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015470] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087715] pid_max: default: 32768 minimum: 301
[    0.097129] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110158] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.129342] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.148817] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.160995] pinctrl core: initialized pinctrl subsystem
[    0.172552] NET: Registered protocol family 16
[    0.203546] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.214573] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.227165] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.238164] rt2880_gpio 10000638.gpio: registering 16 irq handlers
[    0.250739] rt2880_gpio 10000660.gpio: registering 32 gpios
[    0.261736] rt2880_gpio 10000660.gpio: registering 32 irq handlers
[    0.274333] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.285159] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.302383] clocksource: Switched to clocksource systick
[    0.314022] NET: Registered protocol family 2
[    0.323557] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.337333] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.349924] TCP: Hash tables configured (established 1024 bind 1024)
[    0.362692] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.374213] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.386899] NET: Registered protocol family 1
[    0.398086] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    0.410785] Crashlog allocated RAM at address 0x3f00000
[    0.422983] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.441466] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.452962] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.482490] io scheduler noop registered
[    0.490134] io scheduler deadline registered (default)
[    0.501238] gpio-export gpio_export: 1 gpio(s) exported
[    0.511786] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.527164] console [ttyS0] disabled
[    0.534215] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    0.553889] console [ttyS0] enabled
[    0.553889] console [ttyS0] enabled
[    0.567705] bootconsole [early0] disabled
[    0.567705] bootconsole [early0] disabled
[    0.591544] spi spi0.0: force spi mode3
[    0.608409] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.617848] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.630518] Creating 5 MTD partitions on "spi0.0":
[    0.640082] 0x000000000000-0x000000030000 : "uboot"
[    0.650726] 0x000000030000-0x000000040000 : "uboot-env"
[    0.662050] 0x000000040000-0x000000050000 : "config"
[    0.672893] 0x000000030000-0x000000fd0000 : "firmware"
[    0.692283] 0x000000ff0000-0x000001000000 : "config2"
[    0.704119] libphy: Fixed MDIO Bus: probed
[    0.720622] gsw: setting port4 to ephy mode
[    0.729034] mtk_soc_eth 10100000.ethernet eth0 (uninitialized): port 2 link up (100Mbps/Full duplex)
[    0.747271] mtk_soc_eth 10100000.ethernet: generated random MAC address 72:56:a3:dc:f0:7c
[    0.763586] port: invalid port id 4
[    0.770606] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    0.783062] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.800057] rt2880_wdt 10000120.watchdog: Initialized
[    0.811502] NET: Registered protocol family 10
[    0.824455] Segment Routing with IPv6
[    0.831853] NET: Registered protocol family 17
[    0.840818] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.866655] 8021q: 802.1Q VLAN Support v1.8
[    0.877722] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.892700] Please append a correct "root=" boot option; here are the available partitions:
[    0.909366] 1f00             192 mtdblock0
[    0.909371]  (driver?)
[    0.922412] 1f01              64 mtdblock1
[    0.922417]  (driver?)
[    0.935440] 1f02              64 mtdblock2
[    0.935445]  (driver?)
[    0.948470] 1f03           16000 mtdblock3
[    0.948475]  (driver?)
[    0.961497] 1f04              64 mtdblock4
[    0.961502]  (driver?)
[    0.974536] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.992044] Rebooting in 1 seconds..

123serge123 · June 20, 2020, 3:47am

Archive is updated. Try again.

BackON · June 21, 2020, 12:32am

the last version works. im going to test it

thanks

BackON · June 26, 2020, 5:01pm

can you publish the changes for the wiki maybe? for future info

system · July 6, 2020, 5:01pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.