HP M200 WIFI issues

Recently had to toy around with a couple of brand new HP V-M200 (model J9468A) access points that had serious issues with WIFI connectivity and maintaining solid U/D speeds. So I figured I’d share this since I seem not to be the only one :)

The V-M200 / M200 AP, the not-so-solid performer

ZXDSL 931WII hacking

The stock 931WII

Recently, I decided to upgrade my ADSL subscription to VDSL, and the deal included a ZTE ZXDSL 931WII CPE box (VDSL2 modem + NAT + WLAN AP). Attached with the box were instructions stating that configuration settings could be managed from a private web page provided by the ISP. And was one able to do so? Of course not. Much to my annoyance, it also turned out that all ‘outside the box’ local configuration had been disabled in the firmware (no response to LAN http, ssh or telnet). So, a quick call to the ISP helpdesk:

“Hi! I upgraded to blablabla and would like to configure it but there’s nothing else on the remote admin panel than a save -button”

“Ok let me check”

“It doesn’t accept any http or telnet connections to the local admin interface either..”

“What would you like to configure?”

“Well you know, the usual stuff people configure on their home router; static IPs, port forwarding, admin password etc..”

“Hmm well I can see that implementing the feature is pending, but I can check details about this with someone. Is it ok if I text you shortly? Kthxbye!” *CLICK*

Some minutes later, there’s a text on my mobile saying “There is no known schedule for adding remote configurability for the current firmware at this time”. W-T-F and thanks a fucking bunch! :D

Seriously: Do they think that I’m going to run this box in my home without having any access to feature configuration?

Sure I can understand that, given the increasingly technical times we live in, the need might arise for the ISP to be able to remotely check the CPE configuration of some less-technically-inclined subscriber using their ACS server. But why-oh-why disable all local configuration options? Surely, the option of configuring the hardware could be kept available to those who wish to do so?

Not happy with the situation at all, I decided it was time to take a look whether local configuration could be performed from inside the box.. I’d rather have a bit of my own fun with the box instead of paying xx€ for queuing +15 minutes on the phone just to be walked through a “Did you check cable connections” check list (or whatever). Should my “playtime” result with a bricked box, no problem. The ISP can then have the box back accompanied with a “the lights just went out” fault description and I’ll go buy something more decent :)

x0x, MCU problems

I have no idea what happened, but when I started experimenting with fuse settings after diagnosing the MCU running at wrong clock speed, the chip went dead. The programmer software (Ponyprog) just constantly reported the chip as “unknown device” despite detecting it ok previously. My bet is on a voltage spike or such, though ESD can be counted out right from the start.

Anyway, a replacement part arrived last week, after which I was able to complete mapping the fuse settings. Here’s the combination that works on my setup:

• bod0level = 0
• bod1level = 0
• bod2level = 1
• ckdiv8 = 1
• sut0 = 0
• sut1 = 0
• cksel0 = 1
• cksel1 = 1
• cksel2 = 1
• cksel3 = 1
• bootsz0 = 0
• bootsz1 = 0
• ocden = 1
• wdton = 1
• eesave = 1
• ckout = 1
• m161c = 1

Not that I tested every combination, but this was rather the first set with which the x0x powered up seemingly normal. Sequencer running ok, buttons responsive and all that.

Getting the MCU running revealed plenty of defunct leds on my custom keyboard though. The ones soldered directly to the board work fine, so it’s not difficult to gues that the problem lies somewhere with my custom cabling! No need to guess what I’ll be working on next..