D-Link DCH-M225 A1

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The D-Link DCH-M225 is a combination wifi extender and audio speaker driver (with a 3.5mm socket to connect a speaker via analog cable).

→ Install OpenWrt (generic explanation)

Please add the installation procedure here.

D-Link DCH-M225 A1 Flash Layout
Layer0	raw NOR flash memory chip (W25Q64BV spi0.0: W25Q64BV) 8192 KiB
Layer1	mtd0 *raspi* 8192 KiB
Layer2	mtd7 *u-boot* 192 KiB	mtd4 *devdata* 64 KiB		mtd3 *devconf* 64 KiB	mtd10 *upgrade_rec* 1024 KiB	mtd2 *upgrade* 6720 KiB			mtd5 *langpack* 128 KiB
Layer3		mtd8 *bootenv* 32 KiB	32 KiB		mtd9 *rootfs_rec* 1024 KiB	1152 KiB	mtd1 *rootfs* 5356 KiB	212 KiB
Size in KiB	192 KiB	32 KiB		64 KiB	1024 KiB		5356 KiB
Name	*u-boot*	*bootenv*		*devconf*	*rootfs_rec*		*rootfs*		*langpack*
mountpoint	none	none		none	none		`/`		none
filesystem	none	none		none	none		SquashFS		none

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00010000 "raspi"
mtd1: 0053b000 00010000 "rootfs"
mtd2: 00690000 00010000 "upgrade"
mtd3: 00010000 00010000 "devconf"
mtd4: 00010000 00010000 "devdata"
mtd5: 00020000 00010000 "langpack"
mtd6: 00800000 00010000 "flash"
mtd7: 00030000 00010000 "u-boot"
mtd8: 00008000 00010000 "boot env"
mtd9: 00100000 00010000 "rootfs_rec"
mtd10: 00100000 00010000 "upgrade_rec"''

# cat /proc/partitions
major minor  #blocks  name

  31        0       8192 mtdblock0
  31        1       5356 mtdblock1
  31        2       6720 mtdblock2
  31        3         64 mtdblock3
  31        4         64 mtdblock4
  31        5        128 mtdblock5
  31        6       8192 mtdblock6
  31        7        192 mtdblock7
  31        8         32 mtdblock8
  31        9       1024 mtdblock9
  31       10       1024 mtdblock10

The instructions below need to be verified

Note: Reset router to factory defaults if it has been previously configured. Do this by holding the reset button with a paper clip for 15 seconds.

Download the firmware file to a PC with a web browser
Connect to the dlink-XXXX SSID using WPS by pressing the button, or using the WPA key marked on the bottom of the device
Browse to %http://192.168.0.50/UpdateFirmware.html% and login as Admin with a blank password
Click on “Select File”, locate the firmware file and click “Upload”
Confirm that you want to upgrade the firmware
Wait for the device to reboot
Connect to the OpenWrt SSID (no password required)
Telnet to 192.168.1.1 and set a root password, or browse to %http://192.168.1.1% if LuCI is installed.

→ generic.flashing.tftp

TFTP installation is not possible as the U-Boot bootloader is unable to support wifi, and there are no other interfaces on the device.

→ generic.sysupgrade

These are generic instructions. Update with your router's specifics.

Browse to %http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/% LuCI Upgrade URL
Upload image file for sysupgrade to LuCI
Wait for reboot

If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. There are two command line methods for upgrading:

sysupgrade
mtd

Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

sysupgrade

Login as root via SSH on 192.168.1.1, then enter the following commands:

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

mtd

If sysupgrade does not support this router, use mtd.

Login as root via SSH on 192.168.1.1, then enter the following commands:

cd /tmp
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

→ generic.debrick

→ failsafe_and_factory_reset

Enter failsafe “Emergency Room” mode by “using the reset+ power (holding the pin in the reset hole for about 5s while powering the unit), an open wifi network appears and the recovery menu can be accessed using a browser on ip 192.168.0.50.” - https://forum.openwrt.org/t/ethernet-less-dlink-dch-m225-after-install-accessing-problem/8558/9

This method has been confirmed:

Hold the reset button down (with a paperclip or pin).
Power up the device, the light turns red.
After 5 seconds, the light goes out, and the reset button can be released.
Connect a computer's wifi to SSID “DCH_M225_WIFIRECOVERY” - this is an open access point so no password is required.
Browse to 192.168.0.50, to access the “Emergency Room” web page:
Click on “Choose File” and navigate to a firmware image stored on the computer.
Click on “Upload firmware NOW”.

In case your computer doesn't have a browser (eg it's a headless device such as another OpenWRT router) you can send the firmware image using curl with something like (untested):

curl --include --form files=@“name-of-image.bin” --form CMD=“SYS_UPG” http://192.168.0.50/do_cmd.htm

After about 90 seconds, the firmware should have been saved to flash and the device should have rebooted. The recovery wifi SSID will no longer be present, so re-connect using the SSID as per the new image.

This procedure is intended to be used for installing a factory image, but may also work to install an OpenWRT image (has not been tested).

Some versions or revisions of this router seem to include “Spotify Connect”, and this allows a local attacker to execute arbitrary OS commands as root, see https://gist.github.com/jezzaaa/38c752d0a129576b2cc523ce6325050f.

Some versions or revisions of this router do not include “Spotify Connect”. However, telnetd can by enabled by flashing a modified firmware:

Step 1: Install the required tools on your computer

sudo apt-get update
sudo apt-get -y install git build-essential zlib1g-dev liblzma-dev python-magic zip unzip

mkdir -p ~/fmk
cd ~/fmk
git clone https://code.google.com/p/firmware-mod-kit/
cd firmware-mod-kit/src
./configure
make

Step 2: Download the firmware (you should find it through Google)

Step 3: Unpack, modify firmware to enable telnetd, then repack firmware

# Extract the trx file
~/fmk/firmware-mod-kit/extract-firmware.sh DCH-M225_REVA_FIRMWARE_105b01.bin 

# Replace "killall telnetd" with "telnetd &" on S80telnetd.sh
sudo vi ~/fmk/rootfs/etc/init0.d/S80telnetd.sh

# Create the new firmware archive
~/fmk/firmware-mod-kit/build-firmware.sh

Flash the new firmare and you should be able to telnet into the device without any password.

The device appears to be based on a Ralink reference, and the Ralink/VxWorks firmware provides the “Emergency Room” feature described above at the root of the web tree. However there is a full router implementation that is hidden from use, supporting wifi, firewall rules, DMZ port forwarding, and so on. It can be accessed at http://192.168.0.50/wz.htm.

The firmware also allows telnet, login default account is “admin” with no password. It provides command-line access to set and save most, if not all, of the parameters available in the web interface. It also shows console log output. Type “help” or “?” for help.

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name	Description	Default configuration
apcli0	LAN & WiFi	None
br0	bridge	192.168.1.1/24
ra0	WAN port	DHCP
eth2	WiFi	Disabled

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The D-Link DCH-M225 has the following buttons:

Button	Event
Reset	reset
WPS	?

DANGER: HIGH VOLTAGE inside!
Opening this device exposes
parts under high voltage (110/230 VAC)!

Risk of deadly electrical shock
Risk of irreversable damage to other components attached, e.g. your PC connected via serial

Make sure to keep your fingers, conductive tools and serial cables away from the high voltage at all times!

Capacitors can still retain dangerous voltages
after disconnection from mains!

Continue at your own risk!

Note: Opening the case exposes lethal voltage. Do not plug in to power without adequately protecting you and others from electric shock.
Note: This will void your warranty!

There is one screw covered by a small white round disc held in place by adhesive. Remove the disk and remove the screw.
Insert a plastic spudger into the gap diagonally opposite the screw hole, and gently prise the side outward to enable the clip to release.
Slide the two halves apart.

There are two boards, connected by four pins for power and one plastic stand-off:

the power supply board
the router board

→ port.serial general information about the serial port, serial port cable, etc.

There are four solder points on the router board, diagonally opposite the largest black chip on the outer side. The square hole (pin 1) is for Rx, then there's a space, then +3V, GND and Tx. The Rx hole is furthest from the corner.

Pin	Shape	Function
1	[O]	RxD
-
2	(O)	+3V
3	(O)	GND
4	(O)	TxD

The +3V is generally not needed (except perhaps when you need to provide power to a serial port converter) and should not be used, to avoid damage caused by voltage mismatch.

Serial connection parameters for D-Link DCH-M225 A1	57600, 8N1

→ port.jtag general information about the JTAG port, JTAG cable, etc.

There is no JTAG interface on this device.

→ bootloader

This device runs a form of U-Boot. However the only recovery option available appears to need a key entry on a serial connection, making this impossible without opening the case.

One option may be to install a version of U-Boot that has better recovery offerings. However, due to the lack of an Ethernet port, this may not be possible, as it's not expected that U-Boot will be able to configure a wifi.

None so far.

] U-Boot 1.1.3 (Nov 7 2013 - 18:27:54) (ALPHA) SVN revision: 967 Target board: WAP-N22 Board: Ralink APSoC DRAM: 64 MB enable ephy clock...done. rf reg 29 = 5 SSC disabled. spi_wait_nsec: 29 spi device id: ef 40 17 0 0 (40170000) find flash: W25Q64BV raspi_read: from:30000 len:1000 raspi_read: from:30000 len:1000 ============================================ Ralink UBoot Version: 4.1.1.0 -------------------------------------------- ASIC 7620_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:Nov 7 2013 Time:18:27:54 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ## Powering down port 1 ~ 4 Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. A: Load Runtime code then write to Flash via Serial. 0 System Boot NORMAL system code via Flash from 0xBC150000. ## Booting image at bc150000 ... raspi_read: from:150000 len:40 raspi_read: from:150000 len:65b060 addr:80c00000 We have SEAMA, Image Size = 6664224 Verifying Checksum ... Uncompressing SEAMA linux.lzma ... OK ## Transferring control to Linux (at address ff000000) ... ## Giving linux memsize in MB, 64 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.33.2 (jeffery_chi@prosche) (gcc version 4.3.3 (GCC) ) #1 Fri Feb 19 14:02:29 CST 2016 The CPU feqenuce set to 580 MHz MIPS CPU sleep mode enabled. PCIE: bypass PCIe DLL. PCIE: Elastic buffer control: Addr:0x68 -> 0xB4 disable all power about PCIe bootconsole [early0] enabled CPU revision is: 00019650 (MIPS 24Kc) Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock1 noinitrd PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 61480k/65536k available (2506k kernel code, 4036k reserved, 620k data, 172k init, 0k highmem) SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Hierarchical RCU implementation. NR_IRQS:128 [debug] (r4k_clockevent_init line: 193) [debug] 128 11490c80 (r4k_clockevent_init line: 197) [debug] (r4k_clockevent_init line: 206) [debug] irq: 5 , (null) , (r4k_clockevent_init line: 216) MTK/Ralink System Tick Counter init... cd:802f2668, m:214748, s:32 4,[debug] (r4k_clockevent_init line: 251) 5,[debug] (r4k_clockevent_init line: 256) setup_irq 5 [debug] (r4k_clockevent_init line: 262) console [ttyS1] enabled, bootconsole disabled console [ttyS1] enabled, bootconsole disabled Calibrating delay loop... 386.04 BogoMIPS (lpj=772096) Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_GPIOMODE = 1a331d RALINK_GPIOMODE = 18331d PPLL_CFG1=0xe5c000 MT7620 PPLL lock PPLL_DRV =0x80080504 start PCIe register access RALINK_PCI_PCICFG_ADDR = 1000f0 *************** MT7620 PCIe RC mode ************* PCIE0 no card, disable it(RST&CLK) bio: create slab <bio-0> at 0 Advanced Linux Sound Architecture Driver Version 1.0.21. cfg80211: Calling CRDA to update world regulatory domain Switching to clocksource Ralink external timer NET: Registered protocol family 2 IP route cache hash table entries: 8192 (order: 3, 32768 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 120 alg: No test for lzma (lzma-generic) alg: No test for stdrng (krng) io scheduler noop registered (default) Ralink gpio driver initialized rt3883_access_init: rt3883 access driver initialization. i2cdrv_major = 218 Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A brd: module loaded elbox physmap platform flash device: 00800000 at bf000000 elbox-flash elbox-flash.0: map_probe failed deice id : ef 40 17 0 0 (40170000) W25Q64BV(ef 40170000) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536 seama skip the header xxxxxxxx: squashfs filesystem found at offset 2555968, magic 73717368 Creating 10 MTD partitions on "raspi": 0x000000270060-0x0000007ab060 : "rootfs" 0x000000150000-0x0000007e0000 : "upgrade" 0x000000040000-0x000000050000 : "devconf" 0x000000030000-0x000000040000 : "devdata" 0x0000007e0000-0x000000800000 : "langpack" 0x000000000000-0x000000800000 : "flash" 0x000000000000-0x000000030000 : "u-boot" 0x000000030000-0x000000038000 : "boot env" 0x000000050000-0x000000150000 : "rootfs_rec" 0x000000050000-0x000000150000 : "upgrade_rec" rdm_major = 220 SMACCR1 -- : 0x0000000c SMACCR0 -- : 0x432880dc Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx descriptors allocated, mtu = 1500! SMACCR1 -- : 0x0000000c SMACCR0 -- : 0x43288045 PROC INIT OK! rt3052 access driver initialization. i2c /dev entries driver Ralink I2C Init rt_dma rt_dma.0: revision: 3, channels: 16 WM8960 I2C Codec 0-001a: No platform data supplied mt7620-i2s mt7620-i2s.0: loaded External REFCLK asoc: WM8960 <-> mt7620-i2s mapping ok [audio]mt7620 init done!! ALSA device list: #0: mt7620-wm8960 (WM8960) skb rate limit initialization. TCP cubic registered NET: Registered protocol family 10 NET: Registered protocol family 17 VFS: Mounted root (squashfs filesystem) readonly on device 31:1. Freeing unused kernel memory: 172k freed init started: BusyBox v1.14.1 (2016-02-19 14:02:33 CST) starting pid 21, tty '': '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 [/etc/init.d/S10init.sh] [/etc/init.d/S15pts.sh] [/etc/init.d/S16ipv6.sh] [/etc/init.d/S19init.sh] [/etc/init.d/S20init.sh] DEFNODE[/etc/defnodes/S11devdata.xml] DEFNODE[/etc/defnodes/S12flashspeed.php] DEFNODE[/etc/defnodes/S13dfs.php] DEFNODE[/etc/defnodes/S14setchlist.php] DEFNODE[/etc/defnodes/S20device.xml] DEFNODE[/etc/defnodes/S22timezone.php] [/etc/scripts/setdate.sh] 01/01/2000 ... Sat Jan 1 10:00:04 GMT 2000 DEFNODE[/etc/defnodes/S30device.php] DEFNODE[/etc/defnodes/S30device.xml] DEFNODE[/etc/defnodes/S31diagnostic.xml] DEFNODE[/etc/defnodes/S31locale.php] DEFNODE[/etc/defnodes/S33wifi.php] DEFNODE[/etc/defnodes/S40device.xml] DEFNODE[/etc/defnodes/S90sessions.php] DEFNODE[/etc/defnodes/S90upnpigd.php] DEFNODE[/etc/defnodes/S90upnpwfa.php] DEFNODE[/etc/defnodes/S91upnpigd2.php] SERVD: start service [LOGD] [/etc/init.d/S45gpiod.sh] [/etc/init.d/rcS] done! [/etc/init0.d/S21layout.sh]: start ... Factory reset time : 5 secs 00: [WPS Button] using GPIO #11, input mode. 01: [Lineout Detect] using GPIO #14, input mode. 02: [Factory Reset Button] using GPIO #26, input mode. 03: [Power_Status LED Green] using GPIO #29, output mode. 04: [Power_Status LED RED] using GPIO #24, output mode. SERVD: start service [LAYOUT] Fail: ioctl[SIOCGIFFLAGS] [/etc/init0.d/S40event.br.sh]: start ... logd: invalid option -- p logd version 0.1 Usage: logd [OPTION] -h show this help message -l {helper} specify the log helper (PHP). -f {flag_name} :Alphanetworks System Log message flag name. sysact : system activity debug : debug information attack : attacks drop : dropped packet notice : notice SERVD: event [SEALPAC.LOAD/default] [/etc/init0.d/S40gpioevent.sh]: start ... device eth2 entered promiscuous mode Raeth v3.0 (Tasklet) phy_tx_ring = 0x00e00000, tx_ring = 0xa0e00000 phy_rx_ring0 = 0x00e01000, rx_ring0 = 0xa0e01000 SMACCR1 -- : 0x00006c19 SMACCR0 -- : 0x8fc5bc09 CDMA_CSG_CFG = 81000000 GDMA1_FWD_CFG = 20710000 SEAMA: need meta for searching image. br0: port 1(eth2) entering forwarding state [/etc/init0.d/S40ttyevent.sh]: start ... [/etc/init0.d/S41autowan.sh]: start ... [/etc/init0.d/S41event.sh]: start ... [/etc/init0.d/S41factorydefault.sh]: start ... [: missing ] [/etc/init0.d/S41inf.br.sh]: start ... [/etc/init0.d/S43arpmonitor.sh]: start ... [/etc/init0.d/S43checkfw.sh]: start ... SERVD: start service [LOGD] SERVD: service [LOGD] is already started. SERVD: start service [PHYINF.ETH-1] SERVD: service [PHYINF.ETH-1] return error 108. SERVD: start service [BRIDGE] SERVD: start service [INFSVCS.BRIDGE-1] SERVD: event [BRIDGE-1.CONNECTED] not found! SERVD: event [UPDATERESOLV/default] SERVD: event [INET.CONNECTED] not found! rt2860v2_ap: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint === pAd = c112b000, size = 939832 === <-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 AP Driver version-2.7.1.6_edcca_monitor_20131227 SERVD: event [INFSVCS.BRIDGE-1.UP/default] SERVD: event [STATUS.READY] not found! SERVD: start service [PHYINF.WIFI] SERVD: start service [INET.BRIDGE-1] [/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1... [/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1 done !!! SERVD: start service [INET.BRIDGE-2] [/var/servd/INET.BRIDGE-2_start.sh]: starting BRIDGE-2... BRIDGE-2 a is link local interface. ip: invalid argument 'BRIDGE-2' to 'table' SERVD: event [BRIDGE-2.UP/default] [/var/servd/INET.BRIDGE-2_start.sh]: starting BRIDGE-2 done !!! SERVD: start service [INET.BRIDGE-3] [/var/servd/INET.BRIDGE-3_start.sh]: starting BRIDGE-3... [/var/servd/INET.BRIDGE-3_start.sh]: starting BRIDGE-3 done !!! SERVD: stop service [HTTP] SERVD: service [HTTP] is already stopped. SERVD: start service [HTTP] SERVD: event [HTTP.UP] not found! SERVD: start service [HTTP.BRIDGE-1] SERVD: start service [UPNP.BRIDGE-1] BAND24G-1.1 ra0 [/etc/init0.d/S80telnetd.sh]: start ... SERVD: event [UPNP.ALIVE.BRIDGE-1/default] SERVD: start service [NEAP.BRIDGE-1] SERVD: service [NEAP.BRIDGE-1] return error 108. SERVD: start service [NAMERESOLV.BRIDGE-1] killall: telnetd: no process killed [/etc/init0.d/S91proclink.sh]: start ... [/etc/init0.d/S93cpuload.sh]: start ... SERVD: start service [STUNNEL] [/etc/init0.d/rcS] done! Please press Enter to activate this console. SERVD: stop service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] is already stopped. SERVD: start service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] return error 108. SERVD: stop service [MULTICAST] SERVD: service [MULTICAST] is already stopped. SERVD: start service [MULTICAST] SERVD: service [MULTICAST] return error 108. SERVD: stop service [DEVICE.TIME] SERVD: service [DEVICE.TIME] is already stopped. SERVD: start service [DEVICE.TIME] NTP is disabled ... SERVD: stop service [AUDIORENDER.DLNA] SERVD: service [AUDIORENDER.DLNA] is already stopped. SERVD: start service [AUDIORENDER.DLNA] SERVD: stop service [AUDIORENDER.AIRPLAY] SERVD: service [AUDIORENDER.AIRPLAY] is already stopped. SERVD: start service [AUDIORENDER.AIRPLAY] SERVD: stop service [AUDIORENDER.SPOTIFY] SERVD: service [AUDIORENDER.SPOTIFY] is already stopped. SERVD: start service [AUDIORENDER.SPOTIFY] SERVD: stop service [LLD2] SERVD: service [LLD2] is already stopped. SERVD: start service [LLD2] SERVD: stop service [DNS] SERVD: service [DNS] is already stopped. SERVD: start service [DNS] SERVD: service [DNS] return error 108. SERVD: start service [PHYINF.WIFI.MODULE] insmod: can't insert '/lib/modules/rt2860v2_ap.ko': File exists SERVD: start service [PHYINF.BAND24G-1.1] Country code is AU, set AU to driver. rtcfg (ralink conf): Not supported wireless mode: [].Use 'bng' as default wireless mode. RX DESC a0e30000 size = 3072 RTMP_TimerListAdd: add timer obj c11d3c78! RTMP_TimerListAdd: add timer obj c1195680! RTMP_TimerListAdd: add timer obj c1197f28! RTMP_TimerListAdd: add timer obj c1197fdc! RTMP_TimerListAdd: add timer obj c1198090! RTMP_TimerListAdd: add timer obj c1198144! RTMP_TimerListAdd: add timer obj c11981f8! RTMP_TimerListAdd: add timer obj c11982ac! RTMP_TimerListAdd: add timer obj c1198360! RTMP_TimerListAdd: add timer obj c1198414! RTMP_TimerListAdd: add timer obj c11984c8! RTMP_TimerListAdd: add timer obj c119857c! RTMP_TimerListAdd: add timer obj c1198630! RTMP_TimerListAdd: add timer obj c11986e4! RTMP_TimerListAdd: add timer obj c1198798! RTMP_TimerListAdd: add timer obj c119884c! RTMP_TimerListAdd: add timer obj c1198900! RTMP_TimerListAdd: add timer obj c11989b4! RTMP_TimerListAdd: add timer obj c1195658! RTMP_TimerListAdd: add timer obj c11956a8! RTMP_TimerListAdd: add timer obj c1197f00! RTMP_TimerListAdd: add timer obj c1197fb4! RTMP_TimerListAdd: add timer obj c1198068! RTMP_TimerListAdd: add timer obj c119811c! RTMP_TimerListAdd: add timer obj c11981d0! RTMP_TimerListAdd: add timer obj c1198284! RTMP_TimerListAdd: add timer obj c1198338! RTMP_TimerListAdd: add timer obj c11983ec! RTMP_TimerListAdd: add timer obj c11984a0! RTMP_TimerListAdd: add timer obj c1198554! RTMP_TimerListAdd: add timer obj c1198608! RTMP_TimerListAdd: add timer obj c11986bc! RTMP_TimerListAdd: add timer obj c1198770! RTMP_TimerListAdd: add timer obj c1198824! RTMP_TimerListAdd: add timer obj c11988d8! RTMP_TimerListAdd: add timer obj c119898c! RTMP_TimerListAdd: add timer obj c1195630! RTMP_TimerListAdd: add timer obj c1197f50! RTMP_TimerListAdd: add timer obj c1198004! RTMP_TimerListAdd: add timer obj c11980b8! RTMP_TimerListAdd: add timer obj c119816c! RTMP_TimerListAdd: add timer obj c1198220! RTMP_TimerListAdd: add timer obj c11982d4! RTMP_TimerListAdd: add timer obj c1198388! RTMP_TimerListAdd: add timer obj c119843c! RTMP_TimerListAdd: add timer obj c11984f0! RTMP_TimerListAdd: add timer obj c11985a4! RTMP_TimerListAdd: add timer obj c1198658! RTMP_TimerListAdd: add timer obj c119870c! RTMP_TimerListAdd: add timer obj c11987c0! RTMP_TimerListAdd: add timer obj c1198874! RTMP_TimerListAdd: add timer obj c1198928! RTMP_TimerListAdd: add timer obj c11989dc! RTMP_TimerListAdd: add timer obj c1139894! RTMP_TimerListAdd: add timer obj c1139480! RTMP_TimerListAdd: add timer obj c1139868! RTMP_TimerListAdd: add timer obj c1139be8! RTMP_TimerListAdd: add timer obj c113994c! RTMP_TimerListAdd: add timer obj c1139978! RTMP_TimerListAdd: add timer obj c1139b34! RTMP_TimerListAdd: add timer obj c1139b60! RTMP_TimerListAdd: add timer obj c113cdb4! RTMP_TimerListAdd: add timer obj c113c9a0! RTMP_TimerListAdd: add timer obj c113cd88! RTMP_TimerListAdd: add timer obj c113d108! RTMP_TimerListAdd: add timer obj c113ce6c! RTMP_TimerListAdd: add timer obj c113ce98! RTMP_TimerListAdd: add timer obj c113d054! RTMP_TimerListAdd: add timer obj c113d080! RTMP_TimerListAdd: add timer obj c11402d4! RTMP_TimerListAdd: add timer obj c113fec0! RTMP_TimerListAdd: add timer obj c11402a8! RTMP_TimerListAdd: add timer obj c1140628! RTMP_TimerListAdd: add timer obj c114038c! RTMP_TimerListAdd: add timer obj c11403b8! RTMP_TimerListAdd: add timer obj c1140574! RTMP_TimerListAdd: add timer obj c11405a0! RTMP_TimerListAdd: add timer obj c11437f4! RTMP_TimerListAdd: add timer obj c11433e0! RTMP_TimerListAdd: add timer obj c11437c8! RTMP_TimerListAdd: add timer obj c1143b48! RTMP_TimerListAdd: add timer obj c11438ac! RTMP_TimerListAdd: add timer obj c11438d8! RTMP_TimerListAdd: add timer obj c1143a94! RTMP_TimerListAdd: add timer obj c1143ac0! RTMP_TimerListAdd: add timer obj c1146d14! RTMP_TimerListAdd: add timer obj c1146900! RTMP_TimerListAdd: add timer obj c1146ce8! RTMP_TimerListAdd: add timer obj c1147068! RTMP_TimerListAdd: add timer obj c1146dcc! RTMP_TimerListAdd: add timer obj c1146df8! RTMP_TimerListAdd: add timer obj c1146fb4! RTMP_TimerListAdd: add timer obj c1146fe0! RTMP_TimerListAdd: add timer obj c114a234! RTMP_TimerListAdd: add timer obj c1149e20! RTMP_TimerListAdd: add timer obj c114a208! RTMP_TimerListAdd: add timer obj c114a588! RTMP_TimerListAdd: add timer obj c114a2ec! RTMP_TimerListAdd: add timer obj c114a318! RTMP_TimerListAdd: add timer obj c114a4d4! RTMP_TimerListAdd: add timer obj c114a500! RTMP_TimerListAdd: add timer obj c114d754! RTMP_TimerListAdd: add timer obj c114d340! RTMP_TimerListAdd: add timer obj c114d728! RTMP_TimerListAdd: add timer obj c114daa8! RTMP_TimerListAdd: add timer obj c114d80c! RTMP_TimerListAdd: add timer obj c114d838! RTMP_TimerListAdd: add timer obj c114d9f4! RTMP_TimerListAdd: add timer obj c114da20! RTMP_TimerListAdd: add timer obj c1150c74! RTMP_TimerListAdd: add timer obj c1150860! RTMP_TimerListAdd: add timer obj c1150c48! RTMP_TimerListAdd: add timer obj c1150fc8! RTMP_TimerListAdd: add timer obj c1150d2c! RTMP_TimerListAdd: add timer obj c1150d58! RTMP_TimerListAdd: add timer obj c1150f14! RTMP_TimerListAdd: add timer obj c1150f40! RTMP_TimerListAdd: add timer obj c1197b08! RTMP_TimerListAdd: add timer obj c11976f4! RTMP_TimerListAdd: add timer obj c1197adc! RTMP_TimerListAdd: add timer obj c1197e5c! RTMP_TimerListAdd: add timer obj c1197bc0! RTMP_TimerListAdd: add timer obj c1197bec! RTMP_TimerListAdd: add timer obj c1197b34! RTMP_TimerListAdd: add timer obj c1197b60! RTMP_TimerListAdd: add timer obj c1197b8c! RTMP_TimerListAdd: add timer obj c11aa60c! RTMP_TimerListAdd: add timer obj c11aa710! RTMP_TimerListAdd: add timer obj c11aa634! RTMP_TimerListAdd: add timer obj c1199b9c! RTMP_TimerListAdd: add timer obj c11998a8! [DHCP6C]: Cable Network pt_listen_usock pt_listen_usock init usock pt_listen_usock init do sloop TODO: Apply volume 52390 to audio driver set volume cmd i2cset -f -y 0 0x1a 0x5 0x70 set volume cAPSDCapable[0]=0 mdAPSDCapable[1]=0 iAPSDCapable[2]=0 2cAPSDCapable[3]=0 seAPSDCapable[4]=0 t APSDCapable[5]=0 -fAPSDCapable[6]=0 -APSDCapable[7]=0 y APSDCapable[8]=0 0 APSDCapable[9]=0 0xAPSDCapable[10]=0 1aAPSDCapable[11]=0 0APSDCapable[12]=0 x7APSDCapable[13]=0 0APSDCapable[14]=0 x7APSDCapable[15]=0 0 default ApCliAPSDCapable[0]=0 23:2c:ae:e8:52:5b:f1:3c:fa:77:a0:d7:ce:7a:82:05: 92:72:12:9e:c2:b0:70:88:66:51:db:c8:9c:fc:95:7b: AlphaWpsHelper=/etc/scripts/wps_sta.sh AlphaStateHelper=/etc/scripts/wps_sta_stat.sh 1. Phy Mode = 9 2. Phy Mode = 9 E2PROM: D0 target power=0xff1c E2PROM: 40 MW Power Delta= 0 3. Phy Mode = 9 RTMP_TimerListAdd: add timer obj c1136950! AntCfgInit: primary/secondary ant 0/1 Initialize RF Central Registers for E2 !!! Initialize RF Central Registers for E3 !!! Initialize RF Channel Registers for E2 !!! Initialize RF Channel Registers for E3 !!! Initialize RF DCCal Registers for E2 !!! Initialize RF DCCal Registers for E3 !!! D1 = 1, D2 = 10, CalCode = 21 !!! RT6352_Temperature_Init : BBPR49 = 0x1 RT6352_Temperature_Init : TemperatureRef25C = 0xfffffff7 Current Temperature from BBP_R49=0xfffffff9 TX BW Filter Calibration !!! RX BW Filter Calibration !!! LOFT Calibration Done! IQCalibration Start! IQCalibration Done! CH = 0, (gain= 0, phase= 0) IQCalibration Start! IQCalibration Done! CH = 1, (gain= f, phase=3c) TX IQ Calibration Done! RXIQ si=469, sq=485, riq=-6, bbpval 469, vga_idx 0 RXIQ si=4145, sq=4340, riq=-20, bbpval 4145, vga_idx 5 RXIQ si=6726, sq=6992, riq=-51, bbpval 6726, vga_idx 6 RXIQ si=10591, sq=11029, riq=-77, bbpval 10591, vga_idx 7 Sigma_i=1029, Sigma_q=1050, R_iq=-770 RXIQ Sigma_i=1029, Sigma_q=1050, R_iq=-770 RXIQ G_imb=2, Ph_rx=-1 RXIQ si=9448, sq=9880, riq=-279, bbpval 9448, vga_idx 0 RXIQ si=13524, sq=14164, riq=-402, bbpval 13524, vga_idx 1 Sigma_i=1162, Sigma_q=1190, R_iq=-4020 RXIQ Sigma_i=1162, Sigma_q=1190, R_iq=-4020 RXIQ G_imb=3, Ph_rx=-6 RTMPSetPhyMode: channel is out of range, use first channel=0 MCS Set = ff ff 00 00 01 rt635x_tssi0_dc is 0x00000000 rt635x_tssi1_dc is 0x00000001 SYNC - BBP R4 to 20MHz.l ========>ssid match Black Adder,AP using channel 1 extch=NONE RTMP_TimerListAdd: add timer obj c1199e7c! rt635x_tssi0_dc is 0x00000000 rt635x_tssi1_dc is 0x00000001 @@@ ed_monitor_init : ===> @@@ ed_monitor_init : <=== @@@ APPeerBeaconAction : BssChannelAPCount=2, ed_ap_threshold=1, go to ed_monitor_exit()!! @@@ ed_monitor_exit : ===> @@@ ed_monitor_exit : <=== Main bssid = 6c:19:8f:c5:bc:08 <==== rt28xx_init, Status=0 CMD_RTPRIV_IOCTL_INF_STATS_GET: can not find mbss I/F 0x1300 = 00064380 device ra0 entered promiscuous mode br0: port 2(ra0) entering forwarding state [ephp.c read_cond_list 1197] PHP operator precedence issue at: /etc/scripts/wifirnodes.php, cond_qty: 3, and_qty: 1, or_qty: 1 updatewifistats -s /etc/scripts/upwifistatshlper.sh -m RT2800 -i ra0 -x /phyinf:2 -r /runtime/phyinf:2 & SERVD: event [BRIDGE-1.DHCP.RENEW/default] SERVD: start service [PHYINF.BAND24G-1.2] SERVD: service [PHYINF.BAND24G-1.2] return error 8. SERVD: start service [PHYINF.BAND24G-1.3] device apcli0 entered promiscuous mode br0: port 3(apcli0) entering forwarding state [ephp.c read_cond_list 1197] PHP operator precedence issue at: /etc/scripts/wifirnodes.php, cond_qty: 3, and_qty: 1, or_qty: 1 SERVD: event [BRIDGE-1.DHCP.RENEW/default] SERVD: start service [INFSVCS.BRIDGE-2] [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] SERVD: event [BRIDGE-2.CONNECTED] not found! SERVD: event [UPDATERESOLV/default] SERVD: event [INET.CONNECTED] not found! SERVD: event [INFSVCS.BRIDGE-2.UP] not found! SERVD: stop service [HTTP] SERVD: event [HTTP.DOWN] not found! SERVD: start service [HTTP] SERVD: event [HTTP.UP] not found! SERVD: stop service [NAMERESOLV] SERVD: service [NAMERESOLV] is already stopped. SERVD: start service [NAMERESOLV] Interface Name (lo) !!! Interface Name (eth2) !!! Save Need Skip MAC Address = 6C:19:8F:C5:BC:09. !!! Bridge Address = 6C:19:8F:C5:BC:09. !!! Interface Name (br0) !!! Interface Name (ra0) !!! Save Need Skip MAC Address = 6C:19:8F:C5:BC:08. !!! Interface Name (apcli0) !!! RTMP_TimerListAdd: add timer obj c11fd6f8! RTMP_TimerListAdd: add timer obj c11fd8ac! /home/jeffery_chi/work/branches/m225_rlz_0515/progs.priv/rt2860v2/build/rt2860v2_ap/../rt2860v2/ap/ap_data.c:4471 assert pEntry->Aid == pRxWI->WirelessCliIDfailed RTMP_TimerListAdd: add timer obj c1208520! SERVD: stop service [MDNSRESPONDER] SERVD: service [MDNSRESPONDER] is already stopped. SERVD: start service [MDNSRESPONDER] RTMP_TimerListAdd: add timer obj c1208558! mdnsresponder server start ! SERVD: stop service [MULTICAST] SERVD: service [MULTICAST] is already stopped. SERVD: start service [MULTICAST] SERVD: service [MULTICAST] return error 108. SERVD: start service [HTTP.BRIDGE-2] SERVD: start service [UPNP.BRIDGE-2] aaaaaaaa SERVD: event [UPNP.ALIVE.BRIDGE-2/default] SERVD: start service [NAMERESOLV.BRIDGE-2] SERVD: stop service [IP6TDEFCHAIN] SERVD: service [IP6TDEFCHAIN] is already stopped. SERVD: start service [IP6TDEFCHAIN] SERVD: service [IP6TDEFCHAIN] return error 108. SERVD: stop service [LLD2] [/var/servd/BRIDGE-1-udhcpc.sh]: bound br0 192.168.1.204 255.255.255.0 192.168.1.11 43200 lan ... SERVD: start service [LLD2] SERVD: stop service [DNS] SERVD: service [DNS] is already stopped. SERVD: start service [DNS] SERVD: service [DNS] return error 108. SERVD: stop service [HTTP] SERVD: event [HTTP.DOWN] not found! SERVD: start service [HTTP] ip: invalid argument 'BRIDGE-1' to 'table' SERVD: event [BRIDGE-1.DOWN/default] SERVD: event [BRIDGE-1.DOWN/default] startup_server:IPV6, is multicast SERVD: event [HTTP.UP] not found! SERVD: stop service [NAMERESOLV] SERVD: start service [NAMERESOLV] SERVD: stop service [INFSVCS.BRIDGE-1] SERVD: event [INFSVCS.BRIDGE-1.DOWN/default] SERVD: event [UPDATERESOLV/default] SERVD: event [INET.DISCONNECTED] not found! SERVD: event [STATUS.NOTREADY] not found! SERVD: event [INFSVCS.BRIDGE-1.DOWN/default] SERVD: event [STATUS.NOTREADY] not found! SERVD: event [BRIDGE-1.DISCONNECTED] not found! SERVD: stop service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] is already stopped. SERVD: start service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] return error 108. SERVD: stop service [MULTICAST] SERVD: service [MULTICAST] is already stopped. SERVD: start service [MULTICAST] SERVD: service [MULTICAST] return error 108. SERVD: stop service [DNS4.BRIDGE-1] SERVD: service [DNS4.BRIDGE-1] is already stopped. SERVD: stop service [DDNS4.BRIDGE-1] SERVD: service [DDNS4.BRIDGE-1] is already stopped. SERVD: stop service [SSH4.BRIDGE-1] SERVD: service [SSH4.BRIDGE-1] is already stopped. SERVD: stop service [UPNP.BRIDGE-1] [/etc/scripts/delpathbytarget.sh] [runtime/services/http] [server] [uid] [SSDP.BRIDGE-1] []... [/etc/scripts/delpathbytarget.sh] [runtime/services/http] [server] [uid] [UPNP.BRIDGE-1] []... SERVD: event [UPNP.BYEBYE.BRIDGE-1/default] SERVD: stop service [HTTP.BRIDGE-1] [/etc/scripts/delpathbytarget.sh] [/runtime/services/mdnsresponder] [server] [uid] [MDNSRESPONDER.HTTP] []... [/etc/scripts/delpathbytarget.sh] [runtime/services/http] [server] [uid] [HTTP.BRIDGE-1] []... SERVD: stop service [NEAP.BRIDGE-1] SERVD: service [NEAP.BRIDGE-1] is already stopped. SERVD: stop service [NAMERESOLV.BRIDGE-1] [/etc/scripts/delpathbytarget.sh] [runtime/services/nameresolv] [entry] [uid] [NAMERESOLV.BRIDGE-1] []... SERVD: stop service [DNS] SERVD: service [DNS] is already stopped. SERVD: start service [DNS] SERVD: service [DNS] return error 108. SERVD: stop service [MDNSRESPONDER] SERVD: event [BRIDGE-1.UP/default] SERVD: event [BRIDGE-1.UP/checkfw] SERVD: event [STATUS.AMBERBLINK/default] mdnsresponder server stop ! SERVD: start service [MDNSRESPONDER] dns server not ready ... mdnsresponder server start ! SERVD: stop service [HTTP] SERVD: event [HTTP.DOWN] not found! SERVD: start service [HTTP] ip: invalid argument 'BRIDGE-1' to 'table' startup_server:IPV6, is multicast SERVD: event [HTTP.UP] not found! SERVD: stop service [NAMERESOLV] SERVD: start service [NAMERESOLV] SERVD: start service [INFSVCS.BRIDGE-1] SERVD: event [BRIDGE-1.CONNECTED] not found! SERVD: event [UPDATERESOLV/default] SERVD: event [INET.CONNECTED] not found! SERVD: event [INFSVCS.BRIDGE-1.UP/default] SERVD: event [STATUS.READY] not found! SERVD: start service [HTTP.BRIDGE-1] SERVD: start service [UPNP.BRIDGE-1] SERVD: event [UPNP.ALIVE.BRIDGE-1/default] SERVD: start service [NEAP.BRIDGE-1] SERVD: service [NEAP.BRIDGE-1] return error 108. SERVD: start service [NAMERESOLV.BRIDGE-1] SERVD: start service [STUNNEL] SERVD: service [STUNNEL] is already started. SERVD: stop service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] is already stopped. SERVD: start service [IPTDEFCHAIN] SERVD: service [IPTDEFCHAIN] return error 108. SERVD: stop service [MULTICAST] SERVD: service [MULTICAST] is already stopped. SERVD: start service [MULTICAST] SERVD: service [MULTICAST] return error 108. SERVD: stop service [AUDIORENDER.DLNA] SERVD: start service [AUDIORENDER.DLNA] SERVD: stop service [AUDIORENDER.AIRPLAY] SERVD: start service [AUDIORENDER.AIRPLAY] SERVD: stop service [AUDIORENDER.SPOTIFY] SERVD: event [BRIDGE-1.UP/default] SERVD: event [BRIDGE-1.UP/checkfw] SERVD: event [STATUS.AMBERBLINK/default] Check FW Now ... got sig 15, exit the program! pt_listen_usock deinit killall: cannot kill pid 837: No such process SERVD: start service [AUDIORENDER.SPOTIFY] SoundUnInitDriverSERVD: event [BRIDGE-1.UP/default] SERVD: event [BRIDGE-1.UP/checkfw] SERVD: event [BRIDGE-1.UP/GOT_IP] Check FW Now ... SERVD: stop service [LLD2] SERVD: start service [LLD2] SERVD: event [DHCPS4.RESTART] not found! SERVD: stop service [DNS] SERVD: service [DNS] is already stopped. SERVD: start service [DNS] Rcv Wcid(32) AddBAReq Start Seq = 00000002 RTMP_TimerListAdd: add timer obj c120b010! SERVD: service [DNS] return error 108. SERVD: stop service [HTTP] SERVD: event [HTTP.DOWN] not found! SERVD: start service [HTTP] startup_server:IPV6, is multicast SERVD: event [HTTP.UP] not found! Connecting to wrpd.dlink.com (54.214.42.102:80) SERVD: stop service [NAMERESOLV] Connecting to wrpd.dlink.com (54.214.42.102:80) SERVD: start service [NAMERESOLV] SERVD: start service [INFSVCS.BRIDGE-1] SERVD: service [INFSVCS.BRIDGE-1] is already started. SERVD: start service [INFSVCS.BRIDGE-1] SERVD: service [INFSVCS.BRIDGE-1] is already started. SERVD: stop service [DHCPS4.BRIDGE-1] SERVD: service [DHCPS4.BRIDGE-1] is already stopped. SERVD: stop service [MDNSRESPONDER] mdnsresponder server stop ! SERVD: start service [MDNSRESPONDER] mdnsresponder server start ! Check FW Now ... pt_listen_usock pt_listen_usock init usock pt_listen_usock init do sloop TODO: Apply volume 52390 to audio driver set volume cmd i2cset -f -y 0 0x1a 0x5 0x70 set volume cmd i2cset -f -y 0 0x1a 0x7 0x70 Connecting to wrpd.dlink.com (54.244.254.194:80) [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] kick alias IP SERVD: stop service [MDNSRESPONDER] mdnsresponder server stop ! SERVD: start service [MDNSRESPONDER] mdnsresponder server start ! [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[] [DHCP6C]: child : [DHCP6C]: BRIDGE-3/br0, M=[], O=[]

Default login: Admin Password: blank

COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING

Space for additional notes, links to forum threads or other resources.

...

Add tags below, then remove this fixme.

How to add tags

MT7620A, 8Flash, 64RAM, 802.11bgn, Mains powered

mt7620a 8Flash 64RAM 802.11bgn Mains powered

D-Link DCH-M225 A1

Supported Versions

Hardware Highlights

Installation

Flash Layout

MTD Layout

OEM easy installation

OEM installation using the TFTP method

Upgrading OpenWrt

LuCI Web Upgrade Process

Terminal Upgrade Process

sysupgrade

mtd

Debricking

Failsafe mode

Telnet Access

Ralink Firmware

Basic configuration

Specific Configuration

Network interfaces

Buttons

Hardware

Info

Opening the case

Serial

JTAG

Bootloader mods

Hardware mods

Bootlogs

OEM bootlog

OEM Default Login

OpenWrt bootlog

Notes

Tags