Davolink DVW-632 aka “Kevin”: Teardown of the Minions router (part 1)

Every once in a while, a piece of hardware goes viral for standing out from the competition in a certain aspect. For consumer-grade wireless routers, it seems case designers have mostly been looking at Sci-Fi movies for inspiration over the past decades, until a company named Davicom chose to license a pair of well-known characters from a much different genre of movies:

Two models are available: The smaller model DVW-642 (“Bob”) is an AX1800 dual-band wireless router, while the much larger DVW-632 (“Kevin”) is an AX5400 tri-band device, which even supports the quite new 6 Ghz band known as Wi-Fi 6E.

There is little information available on the hardware internals on these yet, the FCC filings available for Kevin do not even contain internal photos (yet?), there is only the label sample and a test setup showing a view on the PCB from the distance:
https://fccid.io/RZEDVW-632/

However, a Reddit user simply asked Davolink support for information on the chipsets:

https://www.reddit.com/r/HomeNetworking/comments/19bku93/comment/kitdu0x/

And it turns out Bob is based on a Realtek chipset, which currently does not have a high chance of getting OpenWrt support anytime soon.

However, Kevin is supposed to be based on the quite new Qualcomm Max OpenWrt target, specifically using the IPQ5018 chipset – which is not exactly supported yet, however that one looks way more like a work-in-progress at the moment, considering there are similar chipsets in the target, which is already part of OpenWrt, and there is also ongoing discussion on devices using IPQ5018, e.g. from Linksys:
https://forum.openwrt.org/t/ipq5018-potential-future-support-for-linksys-mx2000-atlas-6-mx5500-atlas-6-pro/164055/

The case for Kevin opens very easily, only a few screws need to be removed to access the inner assembly, consisting of the PCB, massive heatsinks and a white plastic frame. After all, this design seems quite modular, suggesting the same hardware could be re-used for various other styles of profitable contemporary merchandise.

There is a TTL UART header to the left, with Pin 4 being GND and both data lines in the center:

Unfortunately, there’s not really much to see during boot, and I found no way to interrupt the bootloader yet:


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1.1-00075
S - IMAGE_VARIANT_STRING=MAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002c5
B -       127 - PBL, Start
B -      1560 - bootable_media_detect_entry, Start
B -      3647 - bootable_media_detect_success, Start
B -      3651 - elf_loader_entry, Start
B -      8822 - auth_hash_seg_entry, Start
B -      9183 - auth_hash_seg_exit, Start
B -    103041 - elf_segs_hash_verify_entry, Start
B -    172705 - PBL, End
B -    142069 - SBL1, Start
B -    203435 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B -    211548 - clock_init, Start
D -      7564 - clock_init, Delta
B -    219295 - boot_flash_init, Start
D -     15006 - boot_flash_init, Delta
B -    234362 - boot_config_data_table_init, Start
D -      4697 - boot_config_data_table_init, Delta - (575 Bytes)
B -    242139 - Boot Setting :  0x00030618
B -    248483 - CDT version:2,Platform ID:8,Major ID:4,Minor ID:0,Subtype:4
B -    255224 - sbl1_ddr_set_params, Start
B -    256657 - Pre_DDR_clock_init, Start
B -    262513 - Pre_DDR_clock_init, End
B -    904721 - do ddr sanity test, Start
D -        61 - do ddr sanity test, Delta
B -    909388 - Image Load, Start
D -    244854 - QSEE Image Loaded, Delta - (580996 Bytes)
B -   1155096 - Image Load, Start
D -     13908 - DEVCFG Image Loaded, Delta - (13592 Bytes)
B -   1169065 - Image Load, Start
D -    182085 - APPSBL Image Loaded, Delta - (433660 Bytes)
B -   1351241 - QSEE Execution, Start
D -        30 - QSEE Execution, Delta
B -   1357707 - SBL1, End
D -   1218292 - SBL1, Delta
S - Flash Throughput, 2441 KB/s  (1029495 Bytes,  421684 us)
S - DDR Frequency, 800 MHz
S - Core 0 Frequency, 800 MHz


U-Boot 2016.01-svn6050 (Nov 28 2022 - 10:45:07 +0000)

cmbblk is stable 5
ART partition read failed..
MAC0 addr:0:11:22:33:44:55
PHY ID1: 0x4d
PHY ID2: 0xd0c0
MAC1 addr:0:11:22:33:44:56
PHY ID1: 0x4d
PHY ID2: 0xd101
board_update_caldata: Unable to find slot-Id, Default CapIn/CapOut values used
QPIC controller support serial NAND
Serial Nand Device Found With ID : 0xc8 0x41
Serial NAND device Manufacturer:GD5F1GQ5REYIG
Device Size:256 MiB, Page size:2048, Spare Size:128, ECC:8-bit
DAVO_TODO : [qpic_spi_nand_config:1462] dev->id=41c841c8 dev->vendor=c8
sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized

Starting kernel ...

131072+0 records in
131072+0 records out
131072 bytes (128.0KB) copied, 0.822810 seconds, 155.6KB/s
131072+0 records in
131072+0 records out
131072 bytes (128.0KB) copied, 0.824732 seconds, 155.2KB/s
131072+0 records in
131072+0 records out
131072 bytes (128.0KB) copied, 0.775230 seconds, 165.1KB/s
Loading cnss2:  bdf_integrated=0x24 bdf_pci0=0x60 bdf_pci1=0xb0
mount: can't find /lib/firmware/IPQ5018/BT_FW in /etc/fstab
BT FW mount is failed
 WIFI FW mount is successful
acfg_tool: Issuing blocking call to wait for events

========= FW INFO =========
2x2
jenkins
2023-09-15 12:39:25
DVW-632X
r7331
83e9805dded1d4e3e22fc60c1f146281
1.00.04
Primary Boot 0
===========================
----------------------------------- start_event_vap() - start(wifi0)
/tmp/config/fastwifi_cfg.tgz: OK
tmp/fastwifi_wifi0
tmp/fastwifi_wifi1
tmp/fastwifi_wifi2
var/run/hostapd-ath0.conf
var/run/hostapd-ath01.conf
var/run/hostapd-ath1.conf
var/run/hostapd-ath11.conf
var/run/hostapd-ath2.conf
var/run/hostapd-ath21.conf
Start wi-fi configuration wifi0
----------------------------------- start_event_vap() - start(wifi1)
Start wi-fi configuration wifi1
----------------------------------- start_event_vap() - start(wifi2)
Start wi-fi configuration wifi2
start config vap vap_bh0
error_handler received : -22
Failed to send message to driver Error:-22
start config vap vap_bh1
Following channels are blocked from Channel selection algorithm
 -band 2[52] [56] [60] [64] [100] [104] [108] [112] [116] [120] [124] [128] [132] [136] [140] [144] [149] [153] [157] [161] [165]
skip wifi reload. fast boot in progress
error_handler received : -22
Failed to send message to driver Error:-22
start config vap vap_bh2
Following channels are blocked from Channel selection algorithm
 -band 3[1] [5] [9] [13] [17] [21] [25] [29] [33] [41] [45] [49] [57] [61] [65] [73] [77] [81] [89] [93] [97] [105] [109] [113] [121] [125] [129] [137] [141] [145] [153] [157] [161] [169] [173] [177] [185] [189] [193] [201] [205] [209] [213] [217] [221] [225] [229] [233]
error_handler received : -22
Failed to send message to driver Error:-22
OK
start config vap vap00
OK
start config vap vap10
OK
start config vap vap20
OK
----------------------------------- start_event_vap() - end(wifi0) -  18 seconds
OK
----------------------------------- start_event_vap() - end(wifi1) -  18 seconds
OK
 WIFI FW mount is successful
OK
**** Platform Name: ap-mp03.5-c1 *****
Run REPACD
Copy ART caldata from /dev/mtdblock13 to /tmp/virtual_art.bin
----------------------------------- start_event_vap() - end(wifi2) -  21 seconds
#### easy mesh setup : controller ####
----------------------------------- ezmesh stop_service() - start
----------------------------------- ezmesh stop_service() - end - 0 seconds
----------------------------------- ezmesh start_service() - start
ezmesh: starting daemon
----------------------------------- ezmesh start_service() - end - 1 seconds
----------------------------------- wsplcd stop_service() - start
----------------------------------- wsplcd stop_service() - end - 0 seconds
----------------------------------- wsplcd start_service() - start
wsplcd: starting daemon
----------------------------------- wsplcd start_service() - end - 8 seconds
### Integrity check is passed for SHA-256 ###

We also see a GigaDevice GD5F1GQ5REY1G SPI NAND flash, with pins easily accessible without further disassembly. Here’s the datasheet:

https://www.gigadevice.com.cn/Public/Uploads/uploadfile/files/20230322/DS-00888-GD5F1GQ5UExxG-Rev1.5.pdf

So the next step from here would most probably be dumping the contents, although there is a good chance everything might be encrypted in there…

Using the D-Link DWA-X1850 Wi-Fi 6 USB adapter on Linux (RTL8832AU 802.11ax)

After the introduction of wireless routers, phones and PCIe cards featuring the next generation of Wi-Fi, known as 802.11ax (or simply Wi-Fi 6), finally the first USB 3.0 adapters have arrived on the market:

The ASUS USB-AX56 adapter has two external antennas, while the D-Link DWA-X1850 comes in a more compact case with built-in antennas.
Both support 2 streams dual band on 2.4GHz and 5GHz, labelled “AX1800”, which translates as:

  • 40 MHz channel width on 2.4GHz, using MCS index 11 and short GI (0.8µs), resulting in a nominal rate of 573.5 Mbps
  • 80 MHz channel width on 5 GHz, also MCS 11 with short GI (0.8µs), resulting in the nominal rate of 1201 Mbps

Combining both rates, these are marketed as AX1800, although you typically can’t bond connections and will rather end up with a Link Rate of 1201 Mbit/s only, which may be somewhere around 500 Mbit/s of real throughput (all while assuming you are located very close to the router, and none of your neighbours are transmitting on the same wifi channel, of course).

While the Link Rate will degrade quickly when a few walls need to be penetrated, the receive sensitivity of this new generation of chips can still be considered superior to previous ac adapters, although the limitation to 2 streams might be an issue. Especially if your router supports AC with 3×3 or 4×4, older adapters like the infamous “Death Star” D-Link DWA-192 might still be a better choice.
It uses RTL8814AU and supports AC1900, i.e.

  • 3 spatial streams with 40 MHz channel width on 2.4GHz, using MCS index 9 and short GI (0.4µs), resulting in 600Mbps
  • 3 spatial streams with 80 MHz channel width on 5GHz, using MCS index 9 and short GI (0.4µs), resulting in 1300Mbps

This may seem like not much of a difference, but keep in mind that MCS11 will degrade more quickly with a few walls in between, and when the connection is at MCS9, 2 streams of AX will only be a rate of 960.Mbps compared to 1300 with 3 streams AC.

But back to the first USB AX adapters hitting the markets right now:
Both the ASUS USB-AX56 and D-Link DWA-X1850 are based on the Realtek RTL8832AU chipset, which is the 2-stream variant of the RTL8852AU – this is the most important information when it comes to finding a driver that works on Linux.

When searching github, you will find the repository
https://github.com/shiqishao/RTL8852AU_WiFi_linux_v1.15.0.1-0-g487ee886.20210714
which contains the driver source code from Realtek. There are also a few documents that explain how to introduce your device’s USB VID and PID into the driver:
The relevant file to modify here is os_dep/linux/usb_intf.c, the USB VID e.g. for D-Link is 0x2001, the PID for the DWA-X1850 adapter is 0x3321. For the ASUS USB-AX56, it would be 0B05:1997.

You can find this already patched in my fork of the repo on github:
https://github.com/s-2/RTL8852AU_WiFi_linux_v1.15.0.1-0-g487ee886.20210714

// Update: The most current maintained fork of this driver is now available from the repo of lwfinger, please use this instead: https://github.com/lwfinger/rtl8852au

Now just clone that repo, make and sudo make install, then re-plug the dongle.
After being plugged in, the DWA-X1850 is in USB Mass Storage mode, which can be switched to network adapter mode by ejecting the virtual drive (eventually, it seems this device should be added to the USB modeswitch project).

The blue status LED is currently not working, maybe this needs some addition GPIO definition which is specific to this device.

Also keep in mind that this driver, although being built from source, uses the Realtek proprietary structure, which may not be what the Linux Wireless developers are aiming for.

A corresponding Linux Wireless compatible driver would be “rtw89”, which currently supports only the PCIe version of RTL8852, but I’m sure this may soon be updated to include the USB variants, and one day be available with Ubuntu and other common distributions. For now, at least we have the Realtek driver.

Interfacing the MH-Z14A carbon dioxide sensor with OLED display and ToF Laser distance sensor on STM32

When it comes to indoor air quality, especially during the cold days, we usually think of trying to keep the humidity at an acceptable level to prevent irritation of the respiratory tract occurring from dry air caused by ventilation, which reduces the relative humidity of outside air (that was well-saturated with moisture while it was still cold) by heating it up indoors.

However generally avoiding ventilation will sooner or later result in poor air quality, which is way more difficult to measure than humidity itself: indoor pollutants, mostly from human metabolism (but also furniture and everything else in your house) can vary among countless groups of complex substances that would be impossible to quantify analytically by reasonable means.

The carbon dioxide level is thus often used as an indicator of how much the air is “used up” by human respiration, so you can get a good estimate about air quality in your room or office by just monitoring that single component:

While fresh air is close to the average outdoor level of around 400ppm CO2, you should try to keep your indoor level below 1000ppm to prevent fatigue and reduced cognitive performance.
Exceeding 4000ppm can show significant negative effects on concentration and feeling comfortable.

Devices that measure and display the CO2 concentration (just like we are used to from countless thermometers displaying humidity) are still rare and very expensive, also they would require a little more power than a humidity meter running for years on two AA batteries.

Among the first devices bringing a low-cost solution to the mass market was the weather station from netatmo: The pack contains several sensors connected to a base station that will collect all CO2 measurements and transmit them over WiFi – directly to the netatmo cloud servers. The only way to see your local air quality in the same room is by touching the top of the base, which will then illuminate in one of three colours to give a vague estimate of the situation. Everything else works exclusively through the cloud service: They will monitor human activity (and even sound levels!) in your house and show you fancy-looking graphs on the app or website in return.

If that does not sound like the solution you would want to be running and connected to the internet 24/7, you will quickly stumble upon those MH-Z14 / MH-Z14A sensors that sell on AliExpress for less than $20 USD, shipping included.

They come with their own microcontroller and several interface options like Analog, PWM and UART.

The UART interface is somewhat straightforward, especially if you keep sending the same command over and over to query the current value (so there’s no need to calculate the checksum but rather use the static one that matches the command, as given in the datasheet): Send 9 bytes at 9600 baud and receive 9 bytes with the measurement. There’s not even the need to verify the checksum of the received reply – if you’re lazy, you can just read the value from the third and fourth byte of the reply.

For the beginning, you can just wire it up to some USB CP2102 UART module – the sensor module is perfectly fine with using the 5V from your USB port.

Which results in this little proof-of-concpet Python script that will write the current value to the console each five seconds (make sure to pip install pyserial first and adjust your /dev/ttyUSB or COM port number):

import serial, time

z14 = serial.Serial(port="COM13",baudrate=9600)

while True:
	z14.write(bytearray.fromhex("FF 01 86 00 00 00 00 00 79"))
	result = z14.read(size=9)
	print(result[2] * 256 + result[3])
	time.sleep(5)

You will notice it takes a few minutes for the sensor to warm up and deliver plausible results.

Also, there seems to be a difference between ZH14 and ZH-14A modules regarding calibration: The 14A variant performs automatic calibration within each interval of 24 hours – in other words, you have to make sure to let in some fresh air from outside at least once per day, so it can calibrate the lowest reading within the previous 24 hours to be around 400ppm! This seems quite annoying, but also makes using the sensor a lot easier on the other hand.

Now a console window scrolling the latest sensor reading may seem quite appealing to the average nerd, but if you want to go for a more netatmo-ish style of standalone device, how about adding a microcontroller with an oled display and a tocuh sensor? The display would show a tiny version of the CO2 graph, similar to the netatmo apps, on the device itself after you activate it with a touch.

And to make it even cooler, I used one of those new-fangled VL53L0X Time-of-flight laser distance sensors from ST – those are basically the successor of the tiny sensors you have in smartphones to detect user presence (to disable the touch screen while holding the phone close to the head) and allow for range measurements of up to two meters. So you don’t even need to touch the device itself, but could rather hover your hand over the device to switch on the measurements display, or use gesture recognition (upwards or downwards motion) for additional functions.

Here’s some example using an STM32F103C8T6 board (mostly since those are less than $2 on AliExpress for an ARM Cortex MCU and also code for VL53L0x is readily available from ST; also there are Chinese clones of the ST-Link / v2 debugger availably for very little money, compared to e.g. JTAGICE debuggers for AVR controllers, or platforms like ESP8266 or Arduino where you have no live debugging by default at all). Also it has built-in USB that you can use for USB to serial or even mass storage (how about donwloading your measurements from a dynamically created .csv-file for example?).

Using STM32 CubeMX from ST you can graphically set your desired pin functions and generate all the hardware-related code, similar to the web-based tool availbale from Microchip / Atmel at http://start.atmel.com for the AVR and ATSAM MCUs).

Here’s my CubeMX file (I actually used both I2C cores for separating the OLED and the ToF sensor for mere simplicity in wiring).

But after all, you should of course use the platform you feel most experienced with, considering that SSD1306 OLED drivers are available almost everywhere, and you can check the VL53L0x library from Pololu for a more lightweight alternative to ST’s bloated C library to control the laser distance sensor.

Next thing would be to make decent case for it: currently my prototype resides in a 3D-printed cylinder without any bottom plate, and I still need to figure out how to fit a battery in there and how to charge it (or probably just run a cable to the nearest usb port).


The final goal would be connecting it to the USB port of some OpenWRT router for data logging and network access, but then again you might as well go for ESP8266 in the first place… And after all, summer is coming closer, making this the ideal project for some spare time in next winter…

pictures will follow 🙂