OpenWrt Forum Archive

Topic: D-Link DWR 921 support

The content of this topic has been archived between 8 Apr 2018 and 6 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Please add a new dataentry to the ToH only if the device is already officially supported, i.e. there is a firmware image available to download.

I bought a TP-Link MR3020 (compatible with OpenWRT) modem and a 4G stick to use while I'm testing the DWR-922. This week I want to change the bootloader of 922 and do some testing with OpenWRT + 4G.

Hi fid0dido,

I´ve compiled the packages and executed binboy with Zimage and rootfs. The output is a file firmware.bin with 3.19mb.

One question. The original Jboot from DWR is possible to load this fw or need to compile and use Uboot?

Thanks.

Hi comdek,
as first tentative you can upload the firmware.bin using the Jboot.

Please share the first bootlog.

Bye.

I try just now to replace the bootloader with uboot but:

# ./mtd_debug erase /dev/mtd0 0 0x50000                                         
ramtd_erase: addr:0 len:0                                                       
Not allow to erase BOOT section[addr:0 len :50000]                             
MEMERASE: Invalid argument                                                     

I need to find some alternative way ...

Today I connected the RS232 pins and boot with OEM firmware.

Below is the booting sequence:

CTG560DL_0T3 Jboot B893
JRecovery Version R1.2 2014/07/28 12:43
spi device id: ef 40 18 0 0 (40180000)
SPI FLASH: W25Q128FV 16M
.
..................
Starting kernel @80000000...

LINUX started...

 THIS IS ASIC
Linux version 2.6.36 (jay@RD1) (gcc version 4.3.5 (Buildroot 2011.05) ) #6 Fri Mar 6 19:59:24 CST 2015
CMD_LINE:console=ttyS1,57600n8 root=/dev/mtdblock3

 The CPU feqenuce set to 580 MHz
 PCIE: bypass PCIe DLL.
 PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
 disable all power about PCIe
 PCIE: PLL power down for MT7620N
CPU revision is: 00019650 (MIPS 24Kc)
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock3
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00067af0
Readback ErrCtl register=00067af0
Memory: 61240k/65536k available (2788k kernel code, 4296k reserved, 668k data, 164k init, 0k highmem)
Hierarchical RCU implementation.
        RCU debugfs-based tracing is enabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Console: colour dummy device 80x25
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 119
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
Ralink gpio driver initialized
Enable Ralink GDMA Controller Module
GDMA IP Version=3
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
brd: module loaded
deice id : ef 40 18 0 0 (40180000)
W25Q128BV(ef 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (0M) .erasesize = 0x00000010 (0K) .numeraseregions = 4096
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000001000000 : "Whole"
0x000000000000-0x000000010000 : "Bootloader"
0x000000010000-0x000000150000 : "Kernel"
0x000000180000-0x000000f10000 : "RootFS"
0x000000f10010-0x000000ff0000 : "UI"
mtd: partition "UI" doesn't start on an erase block boundary -- force read-only
0x000000ff0000-0x000001000000 : "Config"
rdm_major = 253
SMACCR1 -- : 0x0000000c
SMACCR0 -- : 0x432880e1
Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
SMACCR1 -- : 0x0000000c
SMACCR0 -- : 0x432880e4
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
u32 classifier
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (956 buckets, 3824 max)
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 164k freed
Inter-|   Receive    Raeth v3.0 (  NAPI
  ,SkbRecycle  )

phy_tx_ring = 0x03f76000, tx_ring = 0xa3f76000

phy_rx_ring0 = 0x03f77000, rx_ring0 = 0xa3f77000
SMACCR1 -- : 0x0000000c
SMACCR0 -- : 0x432880e4
  CDMA_CSG_CFG = 81000000
  GDMA1_FWD_CFG = 20710000
                             |  Transmit
 face |bytes    packets errs drop fifo frame compressed multicast|bytes    packets errs drop fifo colls carrier compressed
    lo:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
  eth2:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
  sit0:       0       0    0    0    0     0          0         0        0       0    0    0    0     0       0          0
 flash_open: flash_fd=3
Mount D Section.
mount: /dev/mtdblock4 is write-protected, mounting read-only
addrconf_dad_completed 7
 flash_open: flash_fd=10
switch register base addr to system register 0xb0000000
write offset 0x60, value 0x1080dd
Tue Jan  1 00:00:00 UTC 2013
timezone:0
dsttime:0
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2010, value=810000c0
switch reg write offset=2110, value=810000c0
switch reg write offset=2210, value=810000c0
switch reg write offset=2310, value=810000c0
switch reg write offset=2410, value=810000c0
switch reg write offset=2510, value=810000c0
switch reg write offset=2610, value=81000000
switch reg write offset=2710, value=81000000
switch reg write offset=2604, value=20ff0003
switch reg write offset=2704, value=20ff0003
switch reg write offset=2014, value=10001
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10002
switch reg write offset=2514, value=10001
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
Set port eth2.1.0
vconfig: ioctl error for add: File exists
device eth2 entered promiscuous mode
set hello timer failed: Invalid argument
device eth2.1 entered promiscuous mode
br0: port 1(eth2.1) entering forwarding state
br0: port 1(eth2.1) entering forwarding state
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel phy 0, reg 0, val 0x800
doesn't support the ebtables 'filter' tablphy 1, reg 0, val 0x800
e.
, Enable: 1
Set: phy[0].reg[0] = 0800phy 2, reg 0, val 0x800

Set: phy[1].reg[0] = 0800
Set: phy[2].rphy 3, reg 0, val 0x800
eg[0] = 0800
Set: phy[3].reg[0] = 0800
phy 4, reg 0, val 0x800
Set: phy[4].reg[0] = 0800
phy 5, reg 0, val 0x800
Set: phy[5].reg[0] = 0800
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'filter' table.
modprobe: module ebtables not found
modprobe: failed to load module ebtables
The kernel doesn't support the ebtables 'broute' table.
 framtd_erase: addr:ff0000 len:0
lash_open: flash_fd=10
ramtd_write: to:ff0000 len:10
ramtd_write: to:ff0010 len:6aa
ramtd_write: to:ff0000 len:1
phy 0, reg 0, val 0x3300
Set: phy[0].reg[0] = 3300
phy 1, reg 0, val 0x3300
Set: phy[1].reg[0] = 3300
phy 2, reg 0, val 0x3300
Set: phy[2].reg[0] = 3300
phy 3, reg 0, val 0x3300
Set: phy[3].reg[0] = 3300
phy 4, reg 0, val 0x3300
Set: phy[4].reg[0] = 3300
phy 5, reg 0, val 0x3300
Set: phy[5].reg[0] = 3300
init sys
init vlan
init lan
init stp
init wan
init ondemand
init multiwan
ifconfig: down: error fetching interface information: Device not found
ifconfig: ether: Unknown host
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: down: error fetching interface information: Device not found
ifconfig: ether: Unknown host
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: down: error fetching interface information: Device not found
ifconfig: ether: Unknown host
ifconfig: SIOCGIFFLAGS: No such device
init multi_ondemand
init load_balance
init routing
init nat
nat initial
init dhcpsrv
==== NAT START (WAN:ALL Func:ALL) ====
cat: /var/nat/nat.wan: No such file or directory
server_config.pool_check = 1

server_config.pool_check = 1

 start = 192.168.0.2, end = 192.168.0.254, lan_ip = 192.168.0.1, interface=br0, ifindex=0

 start = 192.168.0.2, end = 192.168.0.254, lan_ip = 192.168.0.1, interface=br0, ifindex=0

0

Unable to open /var/run/udhcpd.leases for reading
udhcpd (v0.9.9-pre) started
Unable to open /var/run/udhcpd.leases for reading
init dnsrelay
init spap
init ddns
init snmp
init route_protocol
/var/nat/nat-draft.uyg: /var/nat/nat-draft.uyg: 131: cannot create /proc/sys/net/ipv4/route/secret_interval: Directory nonexistent
rm: cannot remove '/etc/ripd.conf': No such file or directory
cat: /var/run/ripd.pid: No such file or directory
BusyBox v1.3.2 (2015-01-21 17:10:44 CST) multi-call binary

Usage: kill [-l] [-signal] process-id [process-id ...]

cat: /var/run/zebra.pid: No such file or directory
BusyBox v1.3.2 (2015-01-21 17:10:44 CST) multi-call binary

Usage: kill [-l] [-signal] process-id [process-id ...]

init time
timezone:180
dsttime:0
init rbydom
init rbyip
init qos
=====Cross-Layer QoS START[0]=====
init keepalive
init user
SINGLE DMZ start
init ftp_alg
init rtsp_alg
init schedule
init mupnpd
init watchdog
init reboot
init wireless_mode
gre_post
Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).
modprobe: module ip6_tables not found
modprobe: failed to load module ip6_tables
ip6tables v1.4.10: can't initialize ip6tables table `filter': iptables who? (do you need to insmod?)
Perhaps ip6tables or your kernel needs to be upgraded.
server_config.pool_check = 1

server_config.pool_check = 1

 start = 192.168.0.2, end = 192.168.0.254, lan_ip = 192.168.0.1, interface=br0, ifindex=0

 start = 192.168.0.2, end = 192.168.0.254, lan_ip = 192.168.0.1, interface=br0, ifindex=0

0

udhcpd (v0.9.9-pre) started
init wlanap
init wps_status
init wps_btn
init wpa
init pwd
init ipv6
init v6filter
modprobe: module ip6_tables not found
modprobe: failed to load module ip6_tables
modprobe: module ip6table_filter not found
modprobe: failed to load module ip6table_filter
modprobe: module ip6table_mangle not found
modprobe: failed to load module ip6table_mangle
modprobe: module ip6t_rt not found
modprobe: failed to load module ip6t_rt
modprobe: module ip6t_REJECT not found
modprobe: failed to load module ip6t_REJECT
init ddnsv6
init tr069
init failover
init 3g_status
init wan_alias
init sip_alg
init ssh
killall: dropbear: no process killed
init igmp
init resedevice eth2.2 entered promiscuous mode
t_btn
init ate
killall: ated: no process killed
init wan_led
init recent
init iom
/usr/bin/ataskset: /usr/bin/ataskset flash_open: flash_fd=4
: 6: taskset: not found
 flash_open: flash_fd=4

# rt2860v2_ap: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
Ralink APSoC Hardware Watchdog Timer
Started WatchDog Timer.
Started WatchDog Timer. LoadVlaue: 36600 sysclk: 145000000 TIMEOUT: 60
Length of MAC:6
 mac:6c:72:20:9f:db:d7:
----


=== pAd = c0a33000, size = 1145800 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
AP Driver version-2.7.1.6
RX DESC a323a000  size = 2048
RTMP_TimerListAdd: add timer obj c0acb618!
RTMP_TimerListAdd: add timer obj c0a96730!
RTMP_TimerListAdd: add timer obj c0a96704!
RTMP_TimerListAdd: add timer obj c0a966d8!
RTMP_TimerListAdd: add timer obj c0a3b2dc!
RTMP_TimerListAdd: add timer obj c0a3aed0!
RTMP_TimerListAdd: add timer obj c0a3b2ac!
RTMP_TimerListAdd: add timer obj c0a3b654!
RTMP_TimerListAdd: add timer obj c0a3b3a4!
RTMP_TimerListAdd: add timer obj c0a3b3d4!
RTMP_TimerListAdd: add timer obj c0a3b594!
RTMP_TimerListAdd: add timer obj c0a3b5c4!
RTMP_TimerListAdd: add timer obj c0a3e784!
RTMP_TimerListAdd: add timer obj c0a3e378!
RTMP_TimerListAdd: add timer obj c0a3e754!
RTMP_TimerListAdd: add timer obj c0a3eafc!
RTMP_TimerListAdd: add timer obj c0a3e84c!
RTMP_TimerListAdd: add timer obj c0a3e87c!
RTMP_TimerListAdd: add timer obj c0a3ea3c!
RTMP_TimerListAdd: add timer obj c0a3ea6c!
RTMP_TimerListAdd: add timer obj c0a41c2c!
RTMP_TimerListAdd: add timer obj c0a41820!
RTMP_TimerListAdd: add timer obj c0a41bfc!
RTMP_TimerListAdd: add timer obj c0a41fa4!
RTMP_TimerListAdd: add timer obj c0a41cf4!
RTMP_TimerListAdd: add timer obj c0a41d24!
RTMP_TimerListAdd: add timer obj c0a41ee4!
RTMP_TimerListAdd: add timer obj c0a41f14!
RTMP_TimerListAdd: add timer obj c0a450d4!
RTMP_TimerListAdd: add timer obj c0a44cc8!
RTMP_TimerListAdd: add timer obj c0a450a4!
RTMP_TimerListAdd: add timer obj c0a4544c!
RTMP_TimerListAdd: add timer obj c0a4519c!
RTMP_TimerListAdd: add timer obj c0a451cc!
RTMP_TimerListAdd: add timer obj c0a4538c!
RTMP_TimerListAdd: add timer obj c0a453bc!
RTMP_TimerListAdd: add timer obj c0a4857c!
RTMP_TimerListAdd: add timer obj c0a48170!
RTMP_TimerListAdd: add timer obj c0a4854c!
RTMP_TimerListAdd: add timer obj c0a488f4!
RTMP_TimerListAdd: add timer obj c0a48644!
RTMP_TimerListAdd: add timer obj c0a48674!
RTMP_TimerListAdd: add timer obj c0a48834!
RTMP_TimerListAdd: add timer obj c0a48864!
RTMP_TimerListAdd: add timer obj c0a4ba24!
RTMP_TimerListAdd: add timer obj c0a4b618!
RTMP_TimerListAdd: add timer obj c0a4b9f4!
RTMP_TimerListAdd: add timer obj c0a4bd9c!
RTMP_TimerListAdd: add timer obj c0a4baec!
RTMP_TimerListAdd: add timer obj c0a4bb1c!
RTMP_TimerListAdd: add timer obj c0a4bcdc!
RTMP_TimerListAdd: add timer obj c0a4bd0c!
RTMP_TimerListAdd: add timer obj c0a4eecc!
RTMP_TimerListAdd: add timer obj c0a4eac0!
RTMP_TimerListAdd: add timer obj c0a4ee9c!
RTMP_TimerListAdd: add timer obj c0a4f244!
RTMP_TimerListAdd: add timer obj c0a4ef94!
RTMP_TimerListAdd: add timer obj c0a4efc4!
RTMP_TimerListAdd: add timer obj c0a4f184!
RTMP_TimerListAdd: add timer obj c0a4f1b4!
RTMP_TimerListAdd: add timer obj c0a52374!
RTMP_TimerListAdd: add timer obj c0a51f68!
RTMP_TimerListAdd: add timer obj c0a52344!
RTMP_TimerListAdd: add timer obj c0a526ec!
RTMP_TimerListAdd: add timer obj c0a5243c!
RTMP_TimerListAdd: add timer obj c0a5246c!
RTMP_TimerListAdd: add timer obj c0a5262c!
RTMP_TimerListAdd: add timer obj c0a5265c!
RTMP_TimerListAdd: add timer obj c0a98b34!
RTMP_TimerListAdd: add timer obj c0a98728!
RTMP_TimerListAdd: add timer obj c0a98b04!
RTMP_TimerListAdd: add timer obj c0a98eac!
RTMP_TimerListAdd: add timer obj c0a98bfc!
RTMP_TimerListAdd: add timer obj c0a98c2c!
RTMP_TimerListAdd: add timer obj c0a98b64!
RTMP_TimerListAdd: add timer obj c0a98b94!
RTMP_TimerListAdd: add timer obj c0a98bc4!
RTMP_TimerListAdd: add timer obj c0aa1f84!
RTMP_TimerListAdd: add timer obj c0aa20a0!
RTMP_TimerListAdd: add timer obj c0aa1fb0!
RTMP_TimerListAdd: add timer obj c0a99254!
RTMP_TimerListAdd: add timer obj c0a3856c!
RTMP_TimerListAdd: add timer obj c0a3ba14!
RTMP_TimerListAdd: add timer obj c0a3eebc!
RTMP_TimerListAdd: add timer obj c0a42364!
RTMP_TimerListAdd: add timer obj c0a4580c!
RTMP_TimerListAdd: add timer obj c0a48cb4!
RTMP_TimerListAdd: add timer obj c0a4c15c!
RTMP_TimerListAdd: add timer obj c0a4f604!
RTMP_TimerListAdd: add timer obj c0a98f68!
RTMP_TimerListAdd: add timer obj c0a992bc!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
4a:b1:4f:18:b1:78:7e:c1:9a:e5:d7:c7:f1:9a:5c:ae:
48:d8:b3:9d:b0:97:08:1f:4d:8b:2b:4a:31:7b:a0:58:

1. Phy Mode = 9
2. Phy Mode = 9
E2PROM: D0 target power=0xff20
E2PROM: 40 MW Power Delta= 0
3. Phy Mode = 9
RTMP_TimerListAdd: add timer obj c0a3812c!
AntCfgInit: primary/secondary ant 0/1
Initialize RF Central Registers for E2 !!!
Initialize RF Central Registers for E3 !!!
Initialize RF Channel Registers for E2 !!!
Initialize RF Channel Registers for E3 !!!
Initialize RF DCCal Registers for E2 !!!
Initialize RF DCCal Registers for E3 !!!
D1 = -1, D2 = 9, CalCode = 23 !!!
RT6352_Temperature_Init : BBPR49 = 0xffffffff
RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff5
Current Temperature from BBP_R49=0xffffffef
 TX BW Filter Calibration !!!
 RX BW Filter Calibration !!!
LOFT Calibration Done!
IQCalibration Start!
IQCalibration Done! CH = 0, (gain= 0, phase=3e)
IQCalibration Start!
IQCalibration Done! CH = 1, (gain= f, phase=3e)
TX IQ Calibration Done!
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff 00 00 01
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
SYNC - BBP R4 to 20MHz.l
RTMP_TimerListAdd: add timer obj c0a99860!
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
Main bssid = 6c:72:20:9f:db:d7
<==== rt28xx_init, Status=0
0x1300 = 00064380
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
device ra0 entered promiscuous mode
br0: port 3(ra0) entering forwarding state
br0: port 3(ra0) entering forwarding state
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
qmi_wwan 1-1:1.3: usbnet0: register 'qmi_wwan' at usb-rt3xxx-1, WWAN/QMI device/v3.9r3e, 2e:41:c7:25:49:91
qmi_wwan 1-1:1.4: usbnet1: register 'qmi_wwan' at usb-rt3xxx-1, WWAN/QMI device/v3.9r3e, ae:a7:2c:cc:8b:54
qmi_wwan 1-1:1.5: usbnet2: register 'qmi_wwan' at usb-rt3xxx-1, WWAN/QMI device/v3.9r3e, 5a:65:30:39:c1:b5
usbcore: registered new interface driver qmi_wwan
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
option 1-1:1.0: GSM modem (1-port) converter detected
usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
option 1-1:1.2: GSM modem (1-port) converter detected
usb 1-1: GSM modem (1-port) converter now attached to ttyUSB1
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
Algorithmics/MIPS FPU Emulator v1.5

With Reset button pressed

CTG560DL_0T3 Jboot B893
JRecovery Version R1.2 2014/07/28 12:43
spi device id: ef 40 18 0 0 (40180000)
SPI FLASH: W25Q128FV 16M
.
Reset button had been pressed
.Reset button had been pressed
IP=192.168.123.254 NA=6C:72:20:9F:DB:D7

#
#
# ls
error command : 'ls'
# help
command list...
reboot
info
load <adr>
go <adr>
dm <adr>
wm <adr> <val>
rm <adr>
copy <src> <dst> <size>
ip [ip]
mac [mac]
ping <ip>
areacode

# info
MODEL_NAME: DWR-922
ROMID: DLK6E2427001
ECN_NO: 201503259999
FMID: 6E24
PV: 1
IP: 192.168.123.254
BEID: 6C:72:20:9F:DB:D7
PSEC: BCFFE000 80655E90
#

There is no tftp command in the boot.

You can only upload a firmware build with the binboy, but from what I can see:
./binboy-static
USAGE:
* /full/path/binboy @linux
* /full/path/binboy @rootfs
* /full/path/binboy @mydlink
* /full/path/binboy @all

It is required a "mydlink" image and I do not know where to get it.

Alternative shall be replace the boot loader, but currently the only solution I can see is usinf a soic clip + flashrom.

fidodido wrote:

Hi comdek,
as first tentative you can upload the firmware.bin using the Jboot.

Please share the first bootlog.

Bye.

Fidodido,

I tried to upload the compiled bin but Jboot gives ERROR only. I think the Jboot waits a DWR922 firmware.


To make a backup (memory dump) from OEM firmware, I make this:
(The httpd server don´t support download >5mb size, so I break the flash in 4 parts of 4mb (total 16mb flash).

"Find the www directory"
cd /ram/tmp/www3
./mtd_debug read /dev/mtd0 0x00000000 0x00400000 dump1.bin
./mtd_debug read /dev/mtd0 0x00400000 0x00400000 dump2.bin
./mtd_debug read /dev/mtd0 0x00800000 0x00400000 dump3.bin
./mtd_debug read /dev/mtd0 0x00c00000 0x00400000 dump4.bin

download using web access http://192.168.0.1/dumpX.bin
Join the files using  any HEX Editor.

I don´t tried the mtd_debug write yet, but I think the bootloader position is write-protected.

(Last edited by comdek on 29 Jul 2017, 17:07)

In case you can compile the following boot loader:

git@github.com:tessel/uboot-mt7620.git

Please use DDR 512Mbit

replacing the bootloader is a risky operation.

You should do it only if you know what you are doing, and if you know how to recover!

fidodido wrote:

There is no tftp command in the boot.

You can only upload a firmware build with the binboy, but from what I can see:
./binboy-static
USAGE:
* /full/path/binboy @linux
* /full/path/binboy @rootfs
* /full/path/binboy @mydlink
* /full/path/binboy @all

It is required a "mydlink" image and I do not know where to get it.

Alternative shall be replace the boot loader, but currently the only solution I can see is usinf a soic clip + flashrom.

Tomorrow I´ll compile the uboot and try write using mtd_debug, if no success I´ll try write directly in flash in the next week. I´ve a Pickit 2, but don´t know if supports 25Q128 flash.

fidodido wrote:

In case you can compile the following boot loader:

git@github.com:tessel/uboot-mt7620.git

Please use DDR 512Mbit

Thanks

Yes the bootloader partition is not writable from the oem kernel.
This is the reason why I say: "currently the only solution I can see is usinf a soic clip + flashrom."

Fid0dido,

My mtd_debug works to erase and write the bootloader, but a make a BIG mistake in write, forgot the "0x" in uboot size. After reset the router was bricked, shit. I did not see the size of the  programmed file, because of sleep.

RT305XL login: root
Password:


# ./mtd_debug info /dev/mtd0
mtd.type = MTD_NORFLASH
mtd.flags = MTD_CAP_NORFLASH
mtd.size = 16777216 (16M)
mtd.erasesize = 4096 (4K)
mtd.writesize = 1
mtd.oobsize = 0
regions = 2

region[0].offset = 0x00000000
region[0].erasesize = 65536 (64K)
region[0].numblocks = 255
region[0].regionindex = -2094348768
region[1].offset = 0x00ff0000
region[1].erasesize = 4096 (4K)
region[1].numblocks = 16
region[1].regionindex = -2094348768

# cd /tmp/www3
# ./mtd_debug erase /dev/mtd0 0 0x50000
Erased 327680 bytes from address 0x00000000 in flash

# ./mtd_debug write /dev/mtd0 0 1779C uboot.bin
Copied 1779 bytes from uboot.bin to address 0x00000000 in flash

Well, let´s try to write the uboot directly in flash in next week. I´ll use Pickit 2 + flashrom (https://www.flashrom.org)

About the uboot compiling. The output is 2 files: uboot.img and uboot.bin. The comments in final of the compilations says to use the .img file, but opening the uboot.bin, it is very similar with OEM bootloader dump.

(Last edited by comdek on 30 Jul 2017, 02:20)

Hi comdek,
sorry to listen that you have bricked your router.
Don't worry, there is always a (not easy) way to recover!

Can you tell me what (toolchain) you use to compile the mtd_debug and uboot?

I see you get the root passwd from the router.
can you share it?

In the meantime I made some progress in booting lede, but I cannot compleate the boot and I need to fix some issue.
I'm also looking to alternative to replace the bootloader, but it is now in a very early stage.

I will keep you informed.

If you need help to recover your router write here.
Bye.

fidodido wrote:

Hi comdek,
sorry to listen that you have bricked your router.
Don't worry, there is always a (not easy) way to recover!

Can you tell me what (toolchain) you use to compile the mtd_debug and uboot?

I see you get the root passwd from the router.
can you share it?

In the meantime I made some progress in booting lede, but I cannot compleate the boot and I need to fix some issue.
I'm also looking to alternative to replace the bootloader, but it is now in a very early stage.

I will keep you informed.

If you need help to recover your router write here.
Bye.

Hi fidodido,

To compile the mtd_utils I used this library:
git clone git://git.infradead.org/mtd-utils.git
./autogen.sh
make mtd_debug

Used the default gcc libs of CentOS 7

If you want, here is the mtd_debug compiled that I used :
https://drive.google.com/open?id=0B6W6o … UpuWEdTUDQ


About the recovery I´ll try use a FT232 interface to connect in the flash :
https://www.flashrom.org/FT2232SPI_Programmer

The password of root is amittima.

Comdek,
the pwd is the same for the dwr512 and doesn't work on my router.

Can I ask you the HW revision of your router?

In the meantime I managed to complete the lede boot on the dwr-921 HWrev C1.

Currently I'm using the binboy to generate the image, but this cannot work with the lede system.
We need to decode the oem image header or find a proper way to replace the bootloader with uboot.

Starting kernel @80000000...

[    0.000000] Linux version 4.4.50 (lippo@nice) (gcc version 5.4.0 (LEDE GCC 5.4.0 r4650+5-5d7e23f) ) #0 Mon Mar 13 19:23:08 2017
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620N ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is D-Link DWR-921
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0007bfff
[    0.000000] Readback ErrCtl register=0007bfff
[    0.000000] Memory: 60648K/65536K available (2967K kernel code, 145K rwdata, 708K rodata, 204K init, 203K bss, 4888K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000009] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015448] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.080594] pid_max: default: 32768 minimum: 301
[    0.089885] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.102931] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.121715] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.141341] pinctrl core: initialized pinctrl subsystem
[    0.152260] NET: Registered protocol family 16
[    0.164236] rt2880-pinmux pinctrl: invalid group "wdt rst" for function "gpio"
[    0.178506] rt2880-pinmux pinctrl: invalid group "jtag" for function "gpio"
[    0.206514] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.217526] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.229918] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.240883] rt2880_gpio 10000638.gpio: registering 16 irq handlers
[    0.253312] rt2880_gpio 10000660.gpio: registering 32 gpios
[    0.264283] rt2880_gpio 10000660.gpio: registering 32 irq handlers
[    0.276709] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.287510] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.301014] clocksource: Switched to clocksource systick
[    0.312779] NET: Registered protocol family 2
[    0.322273] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.336044] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.348636] TCP: Hash tables configured (established 1024 bind 1024)
[    0.361358] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.372894] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.385602] NET: Registered protocol family 1
[    0.398264] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    0.411047] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.423139] Crashlog allocated RAM at address 0x3f00000
[    0.448757] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.460274] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.482330] io scheduler noop registered
[    0.489978] io scheduler deadline registered (default)
[    0.500487] ralink-usb-phy usbphy: invalid resource
[    0.510590] rt2880-pinmux pinctrl: pin 15 is not set to gpio mux
[    0.522436] rt2880-pinmux pinctrl: request() failed for pin 15
[    0.533990] rt2880-pinmux pinctrl: pin-15 (pio:15) status -22
[    0.545428] rt2880-pinmux pinctrl: pin 38 is not set to gpio mux
[    0.557358] rt2880-pinmux pinctrl: request() failed for pin 38
[    0.568950] rt2880-pinmux pinctrl: pin-38 (pio:38) status -22
[    0.580386] rt2880-pinmux pinctrl: pin 39 is not set to gpio mux
[    0.592320] rt2880-pinmux pinctrl: request() failed for pin 39
[    0.603912] rt2880-pinmux pinctrl: pin-39 (pio:39) status -22
[    0.615350] rt2880-pinmux pinctrl: pin 40 is not set to gpio mux
[    0.627280] rt2880-pinmux pinctrl: request() failed for pin 40
[    0.638873] rt2880-pinmux pinctrl: pin-40 (pio:40) status -22
[    0.650309] rt2880-pinmux pinctrl: pin 41 is not set to gpio mux
[    0.662242] rt2880-pinmux pinctrl: request() failed for pin 41
[    0.673834] rt2880-pinmux pinctrl: pin-41 (pio:41) status -22
[    0.685271] rt2880-pinmux pinctrl: pin 42 is not set to gpio mux
[    0.697202] rt2880-pinmux pinctrl: request() failed for pin 42
[    0.708795] rt2880-pinmux pinctrl: pin-42 (pio:42) status -22
[    0.720231] rt2880-pinmux pinctrl: pin 43 is not set to gpio mux
[    0.732164] rt2880-pinmux pinctrl: request() failed for pin 43
[    0.743756] rt2880-pinmux pinctrl: pin-43 (pio:43) status -22
[    0.755180] gpio-export gpio-export: 1 gpio(s) exported
[    0.765804] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.779413] console [ttyS0] disabled
[    0.786453] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    0.806128] console [ttyS0] enabled
[    0.806128] console [ttyS0] enabled
[    0.819949] bootconsole [early0] disabled
[    0.819949] bootconsole [early0] disabled
[    0.840309] spi spi0.0: force spi mode3
[    0.848449] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.857883] 4 ofpart partitions found on MTD device spi0.0
[    0.868813] Creating 4 MTD partitions on "spi0.0":
[    0.878364] 0x000000000000-0x000000010000 : "bootloader"
[    0.890597] 0x000000010000-0x000000180000 : "kernel"
[    0.902280] 0x000000180000-0x000000fe0000 : "rootfs"
[    0.913881] mtd: device 2 (rootfs) set to be root filesystem
[    0.925351] 1 squashfs-split partitions found on MTD device rootfs
[    0.937680] 0x000000432000-0x000000fe0000 : "rootfs_data"
[    0.950147] 0x000000ff0000-0x000001000000 : "config"
[    0.964749] mtk_soc_eth 10100000.ethernet eth0 (uninitialized): port 3 link up (100Mbps/Full duplex)
[    0.983171] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    0.995703] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.012733] rt2880_wdt 10000120.watchdog: Initialized
[    1.024242] NET: Registered protocol family 10
[    1.037354] NET: Registered protocol family 17
[    1.046362] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.071524] 8021q: 802.1Q VLAN Support v1.8
[    1.096404] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.111631] Freeing unused kernel memory: 204K (803bd000 - 803f0000)
[    3.496230] init: Console is alive
[    3.503283] init: - watchdog -
[    5.412675] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.537915] usbcore: registered new interface driver usbfs
[    5.549005] usbcore: registered new interface driver hub
[    5.559720] usbcore: registered new device driver usb
[    5.575169] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.589775] ehci-platform: EHCI generic platform driver
[    5.610522] phy phy-usbphy.0: remote usb device wakeup disabled
[    5.622328] phy phy-usbphy.0: UTMI 16bit 30MHz
[    5.631207] ehci-platform 101c0000.ehci: EHCI Host Controller
[    5.642691] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    5.658591] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    5.674558] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    5.688063] hub 1-0:1.0: USB hub found
[    5.695947] hub 1-0:1.0: 1 port detected
[    5.706328] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.724878] init: - preinit -
[    7.042183] 8021q: adding VLAN 0 to HW filter on device eth0
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.344457] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.382297] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.475252] procd: - early -
[    8.481077] procd: - watchdog -
[    9.050834] procd: - ubus -
[    9.223626] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.242069] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.260032] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.281146] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.299120] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.317195] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.335281] random: ubusd: uninitialized urandom read (4 bytes read, 18 bits of entropy available)
[    9.353581] procd: - init -
Please press Enter to activate this console.
[    9.701532] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.748149] Initializing XFRM netlink socket
[    9.759818] NET: Registered protocol family 15
[    9.797724] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.819656] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f
[    9.835671] Backport generated by backports.git backports-20160324-13-g24da7d3c
[    9.916910] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.939954] nf_conntrack version 0.5.0 (950 buckets, 3800 max)
[   10.011549] usbcore: registered new interface driver usbserial
[   10.023341] usbcore: registered new interface driver usbserial_generic
[   10.036472] usbserial: USB Serial support registered for generic
[   10.069650] xt_time: kernel timezone is -0000
[   10.080910] usbcore: registered new interface driver cdc_ether
[   10.103628] PPP generic driver version 2.4.2
[   10.114956] NET: Registered protocol family 24
[   10.142926] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "config"
[   10.157203] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5390, rev 0500 detected
[   10.172650] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected
[   10.268205] usbcore: registered new interface driver option
[   10.279484] usbserial: USB Serial support registered for GSM modem (1-port)
[   10.305494] kmodloader: done loading kernel modules from /etc/modules.d/*
[   11.292465] random: jshn: uninitialized urandom read (4 bytes read, 22 bits of entropy available)
[   11.452127] random: jshn: uninitialized urandom read (4 bytes read, 22 bits of entropy available)
[   11.534807] random: jshn: uninitialized urandom read (4 bytes read, 22 bits of entropy available)
[   19.496587] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   19.556103] jffs2_build_filesystem(): unlocking the mtd device... done.
[   19.569344] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   22.244919] 8021q: adding VLAN 0 to HW filter on device eth0
[   22.316696] device eth0.1 entered promiscuous mode
[   22.326311] device eth0 entered promiscuous mode
[   22.419281] br-lan: port 1(eth0.1) entered forwarding state
[   22.430495] br-lan: port 1(eth0.1) entered forwarding state
[   24.422712] br-lan: port 1(eth0.1) entered forwarding state



BusyBox v1.26.2 () built-in shell (ash)

     _________
    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (SNAPSHOT, r3584-19eba67)
    \________\/    -----------------------------------------------------------

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@LEDE:/# 

The HW version is C1. There is a no 4 ethernet ports, have the RJ11 telephony port and the GSM Module is D16Q5 model, compared with DWR-921 C1.


https://preview.ibb.co/dzzrUk/3.jpg
https://preview.ibb.co/nqriaQ/4.jpg

(Last edited by comdek on 1 Aug 2017, 02:38)

About the recovery, I connected the PICkit 2 in flash pins and execute flashrom to write the bin.

As I'm running linux in VirtualBox, it's taking a long time to erase and reprogram all memory with OEM firmware (16mb). 2 hours already gone, Let's wait ...


https://thumb.ibb.co/netJ9k/1.png

https://thumb.ibb.co/d3X0N5/2.jpg

PICkit2 Pin 1 - VPP/MCLR -> CS
PICkit2 Pin 2 - VDD -> Vcc
PICkit2 Pin 3 - GND -> Vss
PICkit2 Pin 4 - PGD -> SO
PICkit2 Pin 5 - PDC -> SCLK
PICkit2 Pin 6 - AUX -> SI

Here is the flash dump from DWR922 C1 (bootloader and whole flash):

https://drive.google.com/open?id=0B6W6o … FNsNkR6eU0

The flash reprogramming has not worked, is taking a lot of time and does not end. I will try to mount a linux-based PC without using the VM. If it does not work with PICkit2, I'll use Raspberry to reflash (is compatible with flashrom).

Fidodido,

If if possible, make a backup of all memory using mtd_debug read as I posted in the past topics. If you share the bootloader, I appreciate it, because then I test the DWR922 to see if it is the same hardware of 921.

@fidodido: I'm not sure what to do with the following pages:

1) https://wiki.openwrt.org/inbox/d-link/d-link_dwr-921
From the pagetitle "D-Link DWR-921_to be removed" I would guess that this page should be removed?
2) https://wiki.openwrt.org/inbox/d-link/d-link_dwr-921_c1
This page has version c1 in the pagename, but lists B + C1 details. Please mind that there's already a page for B1 version: https://wiki.openwrt.org/inbox/d-link/d-link_dwr-921_b1

Please let me know your thoughts on this.