Unleash the power of technology

一直想整台路由器清理下杂乱的线路，前段时间看中了D-Link DIR-300/600这两款无线路由，配置如下。

在本地市场看的是DIR-300 A1和DIR-600 B2。

第一眼很震撼DIR-300的5dB天线，跟DIR-600的2dB天线相比，堪称楷模。联系到后者2倍于前者的芯片频率，以及更先进的无线标准，前者2倍于后者的价格简直是个笑话。

虽然没有当场刷机验证配置，但是网上已有成功的先例。而且其Web界面顶上大大的B1字样，更让我确信这台机器没有大的改动。

原厂固件下在更新固件的地方上传dlink-revb-factory-webflash.bin就好了。只是DD-WRT默认的IP是192.168.1.1，所以更新完毕不会自动跳转。

第一次Web界面登录会提示修改默认的用户名和密码，但是这里的用户名不能用于telnet——telnet还得用root登录——很诡异。4M的Flash应该只能刷micro，但这里却是std。按说std提供了telnet和SSHd，但是我却怎么都打不开SSHd，也许是被躲猫猫了吧。

DD-WRT v24-sp2 std (c) 2009 NewMedia-NET GmbH
Release: 10/10/09 (SVN revision: 13064)

DD-WRT login: root
Password:
==========================================================

____  ___    __        ______ _____         ____  _  _
| _ \| _ \   \ \      / /  _ \_   _| __   _|___ \| || |
|| | || ||____\ \ /\ / /| |_) || |   \ \ / / __) | || |_
||_| ||_||_____\ V  V / |  _ < | |    \ V / / __/|__   _|
|___/|___/      \_/\_/  |_| \_\|_|     \_/ |_____|  |_|

DD-WRT v24-sp2

http://www.dd-wrt.com

==========================================================

BusyBox v1.13.4 (2009-10-10 11:34:10 CEST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

root@DD-WRT:~# cat /proc/cpuinfo
system type             : Ralink SoC
processor               : 0
cpu model               : MIPS 24K V4.12
BogoMIPS                : 212.99
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available

root@DD-WRT:~# dmesg
<5>Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #968 Sat Oct 10 11:32:30 CEST 2009
<4>
<4> The CPU frequency set to 320 MHz
<6>32M RAM Detected!
<4>CPU revision is: 0001964c
<4>Determined physical RAM map:
<4> memory: 02000000 @ 00000000 (usable)
<7>On node 0 totalpages: 8192
<7>  Normal zone: 64 pages used for memmap
<7>  Normal zone: 0 pages reserved
<7>  Normal zone: 8128 pages, LIFO batch:0
<7>  Movable zone: 0 pages used for memmap
<4>Built 1 zonelists in Zone order.  Total pages: 8128
<5>Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
<4>Primary instruction cache 16kB, physically tagged, 4-way, linesize 32 bytes.
<4>Primary data cache 16kB, 4-way, linesize 32 bytes.
<6>Synthesized TLB refill handler (20 instructions).
<6>Synthesized TLB load handler fastpath (32 instructions).
<6>Synthesized TLB store handler fastpath (32 instructions).
<6>Synthesized TLB modify handler fastpath (31 instructions).
<6>Cache parity protection disabled
<4>cause = 800000, status = 1100ff00
<4>PID hash table entries: 128 (order: 7, 512 bytes)
<4>calculating r4koff… 0030d400(3200000)
<4>CPU frequency 320.00 MHz
<4>Using 160.000 MHz high precision timer.
<6>console [ttyS1] enabled
<6>Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
<6>Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
<6>Memory: 29480k/32768k available (2159k kernel code, 3288k reserved, 320k data, 120k init, 0k highmem)
<7>Calibrating delay loop… 212.99 BogoMIPS (lpj=1064960)
<4>Mount-cache hash table entries: 512
<6>NET: Registered protocol family 16
<6>Generic PHY: Registered new driver
<6>NET: Registered protocol family 2
<6>Time: MIPS clocksource has been installed.
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 1024 (order: 1, 8192 bytes)
<6>TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP: Hash tables configured (established 1024 bind 1024)
<6>TCP reno registered
<4>Load RT2880 Timer Module(Wdg/Soft)
<6>devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
<6>devfs: boot_options: 0×1
<6>squashfs: version 3.0 (2006/03/15) Phillip Lougher
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<4>Ralink gpio driver initialized
<6>Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
<6>serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
<6>serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
<4>rt3052 access driver initialization.
<6>PPP generic driver version 2.4.2
<6>PPP Deflate Compression module registered
<6>PPP BSD Compression module registered
<6>MPPE/MPPC encryption/compression module registered
<6>NET: Registered protocol family 24
<6>PPPoL2TP kernel driver, V1.0
<6>tun: Universal TUN/TAP device driver, 1.6
<6>tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
<5>ralink flash device: 0×1000000 at 0xbf000000
<6>Ralink SoC physically mapped flash: Found 1 x16 devices at 0×0 in 16-bit bank
<7>Ralink SoC physically mapped flash: Found an alias at 0×400000 for the chip at 0×0
<7>Ralink SoC physically mapped flash: Found an alias at 0×800000 for the chip at 0×0
<7>Ralink SoC physically mapped flash: Found an alias at 0xc00000 for the chip at 0×0
<4> Amd/Fujitsu Extended Query Table at 0×0040
<5>number of CFI chips: 1
<5>cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
<0>
<4>found squashfs at 124000
<5>Creating 6 MTD partitions on “Ralink SoC physically mapped flash”:
<5>0×00000000-0×00030000 : “uboot”
<5>0×00030000-0×00040000 : “uboot-config”
<5>0×00040000-0×00050000 : “factory-defaults”
<5>0×00050000-0x003f0000 : “linux”
<5>0×00124000-0x003f0000 : “rootfs”
<4>mtd: partition “rootfs” doesn’t start on an erase block boundary — force read-only
<5>0x003f0000-0×00400000 : “nvram”
<4>u32 classifier
<4>    Actions configured
<4>Netfilter messages via NETLINK v0.30.
<4>nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
<4>ctnetlink v0.93: registering with nfnetlink.
<6>IPv4 over IPv4 tunneling driver
<6>GRE over IPv4 tunneling driver
<6>ip_tables: (C) 2000-2006 Netfilter Core Team
<6>IPP2P v0.8.2 loading
<5>ClusterIP Version 0.8 loaded successfully
<6>TCP bic registered
<6>TCP cubic registered
<6>TCP westwood registered
<6>TCP highspeed registered
<6>TCP hybla registered
<6>TCP htcp registered
<6>TCP vegas registered
<6>TCP scalable registered
<6>NET: Registered protocol family 1
<6>NET: Registered protocol family 17
<4>Welcome to PF_RING 3.2.1
<4>(C) 2004-06 L.Deri <deri@ntop.org>
<6>NET: Registered protocol family 27
<4>PF_RING: bucket length    128 bytes
<4>PF_RING: ring slots       4096
<4>PF_RING: sample rate      1 [1=no sampling]
<4>PF_RING: capture TX       No [RX only]
<4>PF_RING: transparent mode Yes
<4>PF_RING initialized correctly.
<4>PF_RING: registered /proc/net/pf_ring/
<6>802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
<6>All bugs added by David S. Miller <davem@redhat.com>
<4>GDMA1_MAC_ADRH — : 0×00000000
<4>GDMA1_MAC_ADRL — : 0×00000000
<4>Ralink APSoC Ethernet Driver Initilization. v2.00  256 rx/tx descriptors allocated, mtu = 1500!
<4>NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
<4>GDMA1_MAC_ADRH — : 0x0000d6c3
<4>GDMA1_MAC_ADRL — : 0xcf062360
<1>PROC INIT OK!
<0>decode /dev/mtdblock4
<4>VFS: Mounted root (squashfs filesystem) readonly.
<6>Mounted devfs on /dev
<6>Freeing unused kernel memory: 120k freed
<4>rt2860v2_ap: module license ‘unspecified’ taints kernel.
<4>GDMA1_MAC_ADRH — : 0x00001caf
<4>GDMA1_MAC_ADRL — : 0xf74b5f2e
<4>
<4>phy_tx_ring = 0x01d2e000, tx_ring = 0xa1d2e000, size: 16 bytes
<4>
<4>phy_rx_ring = 0x01d2f000, rx_ring = 0xa1d2f000, size: 16 bytes
……

可以看出，内核将频率设为320Mhz，跟Web界面检测出来的384Mhz不一致，这个应该是准确值。RAM也显示出来了。至于Flash容量，还没找到检测的方法。

刷DD-WRT容易，刷回原厂固件却并不顺利。DD-WRT的Web界面固件更新处并不能刷原厂固件。此时就需要DIR-600的特殊能力了，这得益于Ralink芯片内置的一个ROM——容纳了一个bootloader和一个有Web界面的应急系统。

切断路由电源，按住Reset键不放，接上电源，待电源灯闪烁后松开Reset键。此时，路由器进入应急模式，IP为192.168.0.1。由于没有DHCP，所以要手动将电脑的IP设在192.168.0.0/24之内。连上路由Web界面，就可以上传任何支持的固件。