{"id":265,"date":"2024-03-10T23:28:55","date_gmt":"2024-03-10T22:28:55","guid":{"rendered":"http:\/\/sebastianschaper.net\/?p=265"},"modified":"2025-08-13T22:22:04","modified_gmt":"2025-08-13T21:22:04","slug":"davolink-dvw-632-aka-kevin-teardown-of-the-minions-router-part-1","status":"publish","type":"post","link":"http:\/\/sebastianschaper.net\/index.php\/archives\/265","title":{"rendered":"Davolink DVW-632 aka “Kevin”: Teardown of the Minions router (part\u00a01)"},"content":{"rendered":"\n

Every once in a while, a piece of hardware goes viral for standing out from the competition in a certain aspect. For consumer-grade wireless routers, it seems case designers have mostly been looking at Sci-Fi movies for inspiration over the past decades, until a company named Davolink chose to license a pair of well-known characters from a much different genre of movies:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Two models are available: The smaller model DVW-642 (“Bob”) is an AX1800 dual-band wireless router, while the much larger DVW-632 (“Kevin”) is an AX5400 tri-band device, which even supports the quite new 6 Ghz band known as Wi-Fi 6E. <\/p>\n\n\n\n

There is little information available on the hardware internals on these yet, the FCC filings available for Kevin do not even contain internal photos (yet?), there is only the label sample and a test setup showing a view on the PCB from the distance:
https:\/\/fccid.io\/RZEDVW-632\/<\/a><\/p>\n\n\n\n

However, a Reddit user simply asked Davolink support for information on the chipsets:<\/p>\n\n\n\n

https:\/\/www.reddit.com\/r\/HomeNetworking\/comments\/19bku93\/comment\/kitdu0x\/<\/a><\/p>\n\n\n\n

And it turns out Bob is based on a Realtek chipset, which currently does not have a high chance of getting OpenWrt support anytime soon.<\/p>\n\n\n\n

However, Kevin is supposed to be based on the quite new Qualcomm AX OpenWrt target, specifically using the IPQ5018 chipset – which is not exactly supported yet, however that one looks way more like a work-in-progress at the moment, considering there are similar chipsets in the target, which is already part of OpenWrt, and there is also ongoing discussion on devices using IPQ5018, e.g. from Linksys:
https:\/\/forum.openwrt.org\/t\/ipq5018-potential-future-support-for-linksys-mx2000-atlas-6-mx5500-atlas-6-pro\/164055\/<\/a><\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The case for Kevin opens very easily, only a few screws need to be removed to access the inner assembly, consisting of the PCB, massive heatsinks and a white plastic frame. After all, this design seems quite modular, suggesting the same hardware could be re-used for various other styles of profitable contemporary merchandise.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

There is a TTL UART header to the left, with Pin 4 being GND and both data lines in the center:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Unfortunately, there’s not really much to see during boot, and I found no way to interrupt the bootloader yet:<\/p>\n\n\n\n

\nFormat: Log Type - Time(microsec) - Message - Optional Info\nLog Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic\nS - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1.1-00075\nS - IMAGE_VARIANT_STRING=MAACANAZA\nS - OEM_IMAGE_VERSION_STRING=CRM\nS - Boot Config, 0x000002c5\nB -       127 - PBL, Start\nB -      1560 - bootable_media_detect_entry, Start\nB -      3647 - bootable_media_detect_success, Start\nB -      3651 - elf_loader_entry, Start\nB -      8822 - auth_hash_seg_entry, Start\nB -      9183 - auth_hash_seg_exit, Start\nB -    103041 - elf_segs_hash_verify_entry, Start\nB -    172705 - PBL, End\nB -    142069 - SBL1, Start\nB -    203435 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4\nB -    211548 - clock_init, Start\nD -      7564 - clock_init, Delta\nB -    219295 - boot_flash_init, Start\nD -     15006 - boot_flash_init, Delta\nB -    234362 - boot_config_data_table_init, Start\nD -      4697 - boot_config_data_table_init, Delta - (575 Bytes)\nB -    242139 - Boot Setting :  0x00030618\nB -    248483 - CDT version:2,Platform ID:8,Major ID:4,Minor ID:0,Subtype:4\nB -    255224 - sbl1_ddr_set_params, Start\nB -    256657 - Pre_DDR_clock_init, Start\nB -    262513 - Pre_DDR_clock_init, End\nB -    904721 - do ddr sanity test, Start\nD -        61 - do ddr sanity test, Delta\nB -    909388 - Image Load, Start\nD -    244854 - QSEE Image Loaded, Delta - (580996 Bytes)\nB -   1155096 - Image Load, Start\nD -     13908 - DEVCFG Image Loaded, Delta - (13592 Bytes)\nB -   1169065 - Image Load, Start\nD -    182085 - APPSBL Image Loaded, Delta - (433660 Bytes)\nB -   1351241 - QSEE Execution, Start\nD -        30 - QSEE Execution, Delta\nB -   1357707 - SBL1, End\nD -   1218292 - SBL1, Delta\nS - Flash Throughput, 2441 KB\/s  (1029495 Bytes,  421684 us)\nS - DDR Frequency, 800 MHz\nS - Core 0 Frequency, 800 MHz\n\n\nU-Boot 2016.01-svn6050 (Nov 28 2022 - 10:45:07 +0000)\n\ncmbblk is stable 5\nART partition read failed..\nMAC0 addr:0:11:22:33:44:55\nPHY ID1: 0x4d\nPHY ID2: 0xd0c0\nMAC1 addr:0:11:22:33:44:56\nPHY ID1: 0x4d\nPHY ID2: 0xd101\nboard_update_caldata: Unable to find slot-Id, Default CapIn\/CapOut values used\nQPIC controller support serial NAND\nSerial Nand Device Found With ID : 0xc8 0x41\nSerial NAND device Manufacturer:GD5F1GQ5REYIG\nDevice Size:256 MiB, Page size:2048, Spare Size:128, ECC:8-bit\nDAVO_TODO : [qpic_spi_nand_config:1462] dev->id=41c841c8 dev->vendor=c8\nsdhci: Node Not found, skipping initialization\nPCI Link Intialized\nPCI Link Intialized\n\nStarting kernel ...\n\n131072+0 records in\n131072+0 records out\n131072 bytes (128.0KB) copied, 0.822810 seconds, 155.6KB\/s\n131072+0 records in\n131072+0 records out\n131072 bytes (128.0KB) copied, 0.824732 seconds, 155.2KB\/s\n131072+0 records in\n131072+0 records out\n131072 bytes (128.0KB) copied, 0.775230 seconds, 165.1KB\/s\nLoading cnss2:  bdf_integrated=0x24 bdf_pci0=0x60 bdf_pci1=0xb0\nmount: can't find \/lib\/firmware\/IPQ5018\/BT_FW in \/etc\/fstab\nBT FW mount is failed\n WIFI FW mount is successful\nacfg_tool: Issuing blocking call to wait for events\n\n========= FW INFO =========\n2x2\njenkins\n2023-09-15 12:39:25\nDVW-632X\nr7331\n83e9805dded1d4e3e22fc60c1f146281\n1.00.04\nPrimary Boot 0\n===========================\n----------------------------------- start_event_vap() - start(wifi0)\n\/tmp\/config\/fastwifi_cfg.tgz: OK\ntmp\/fastwifi_wifi0\ntmp\/fastwifi_wifi1\ntmp\/fastwifi_wifi2\nvar\/run\/hostapd-ath0.conf\nvar\/run\/hostapd-ath01.conf\nvar\/run\/hostapd-ath1.conf\nvar\/run\/hostapd-ath11.conf\nvar\/run\/hostapd-ath2.conf\nvar\/run\/hostapd-ath21.conf\nStart wi-fi configuration wifi0\n----------------------------------- start_event_vap() - start(wifi1)\nStart wi-fi configuration wifi1\n----------------------------------- start_event_vap() - start(wifi2)\nStart wi-fi configuration wifi2\nstart config vap vap_bh0\nerror_handler received : -22\nFailed to send message to driver Error:-22\nstart config vap vap_bh1\nFollowing channels are blocked from Channel selection algorithm\n -band 2[52] [56] [60] [64] [100] [104] [108] [112] [116] [120] [124] [128] [132] [136] [140] [144] [149] [153] [157] [161] [165]\nskip wifi reload. fast boot in progress\nerror_handler received : -22\nFailed to send message to driver Error:-22\nstart config vap vap_bh2\nFollowing channels are blocked from Channel selection algorithm\n -band 3[1] [5] [9] [13] [17] [21] [25] [29] [33] [41] [45] [49] [57] [61] [65] [73] [77] [81] [89] [93] [97] [105] [109] [113] [121] [125] [129] [137] [141] [145] [153] [157] [161] [169] [173] [177] [185] [189] [193] [201] [205] [209] [213] [217] [221] [225] [229] [233]\nerror_handler received : -22\nFailed to send message to driver Error:-22\nOK\nstart config vap vap00\nOK\nstart config vap vap10\nOK\nstart config vap vap20\nOK\n----------------------------------- start_event_vap() - end(wifi0) -  18 seconds\nOK\n----------------------------------- start_event_vap() - end(wifi1) -  18 seconds\nOK\n WIFI FW mount is successful\nOK\n**** Platform Name: ap-mp03.5-c1 *****\nRun REPACD\nCopy ART caldata from \/dev\/mtdblock13 to \/tmp\/virtual_art.bin\n----------------------------------- start_event_vap() - end(wifi2) -  21 seconds\n#### easy mesh setup : controller ####\n----------------------------------- ezmesh stop_service() - start\n----------------------------------- ezmesh stop_service() - end - 0 seconds\n----------------------------------- ezmesh start_service() - start\nezmesh: starting daemon\n----------------------------------- ezmesh start_service() - end - 1 seconds\n----------------------------------- wsplcd stop_service() - start\n----------------------------------- wsplcd stop_service() - end - 0 seconds\n----------------------------------- wsplcd start_service() - start\nwsplcd: starting daemon\n----------------------------------- wsplcd start_service() - end - 8 seconds\n### Integrity check is passed for SHA-256 ###\n\n<\/code><\/pre>\n\n\n\n
We also see a GigaDevice GD5F1GQ5REY1G SPI NAND flash, with pins easily accessible without further disassembly. Here’s the datasheet:<\/p>\n\n\n\n
https:\/\/www.gigadevice.com.cn\/Public\/Uploads\/uploadfile\/files\/20230322\/DS-00888-GD5F1GQ5UExxG-Rev1.5.pdf<\/a><\/p>\n\n\n\n
So the next step from here would most probably be dumping the contents, although there is a good chance everything might be encrypted in there…<\/p>\n","protected":false},"excerpt":{"rendered":"
Every once in a while, a piece of hardware goes viral for standing out from the competition in a certain aspect. For consumer-grade wireless routers, it seems case designers have mostly been looking at Sci-Fi movies for inspiration over the past decades, until a company named Davolink chose to license a pair of well-known characters … Continue reading Davolink DVW-632 aka “Kevin”: Teardown of the Minions router (part\u00a01)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[25,47,46,22],"class_list":["post-265","post","type-post","status-publish","format-standard","hentry","category-hardware","tag-802-11ax","tag-minions","tag-openwrt","tag-teardown"],"_links":{"self":[{"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/posts\/265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/comments?post=265"}],"version-history":[{"count":7,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/posts\/265\/revisions"}],"predecessor-version":[{"id":281,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/posts\/265\/revisions\/281"}],"wp:attachment":[{"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/media?parent=265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/categories?post=265"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/sebastianschaper.net\/index.php\/wp-json\/wp\/v2\/tags?post=265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}