D-Link DIR-300 Rev.A1 (Airlink AR335W/AR430W)

NOTE: Because of Ticket 6807 OpenWrt 10.03 'Backfire' wasn't working. In r20733 (2010-04-07) this issue has been fixed. So avoid OpenWrt 10.03 and use OpenWrt 8.09 'Kamikaze', a trunk version newer then r20733 or the newest OpenWrt 10.03.1 'Backfire'. Enjoy.

These devices are listed in the Table of Hardware:

Before you install, you might need to back up the original firmware. It can be done in multiple ways, including but not limited to using UART and/or Telnet. The most important partition is Board/RadioCfg, which is physically located at last 64KiB of flash chip.

# cat /proc/mtd
dev: size erasesize name
mtd0: 00400000 00010000 "spiflash"
mtd1: 001ce000 00010000 "rootfs"
mtd2: 003b0000 00010000 "upgrade"
mtd3: 00010000 00010000 "rgdb"
mtd4: 00020000 00010000 "RedBoot"
mtd5: 00010000 00010000 "Board/RadioCfg"
mtd6: 00010000 00010000 "LangPack"
mtd7: 00400000 00010000 "flash"

Partition sizes correspond to DIR-300 v1.05_a319 firmware. While upgrade partition has multiple sections, only rootfs has got its own mtd device file.

When original firmware is flashed onto the router, first 96B are stripped, since it's a header of some kind. The rest of it is written directly to upgrade partition. Knowing this allows restoring original firmware from an alternative firmware, such as OpenWrt. A command such as tail -c +97 dir300a.bin > upgrade.bin allows to prepare file suitable for writing directly onto mtd partition.

The data on the end of upgrade partition is likely remaining from past installation of some alt firmware and not used for anything.

First let's have a quick view at the Flash Layout with the stock firmware and once OpenWrt has been installed onto the device. This helper understanding what mtd/sysupgrade does.
The D-Link DIR-300 Rev.A1 uses this flash Layout:

Notes: As opposed to other devices, there is no OpenWrt firmware partition, so you cannot address it with mtd -r write xxx.bin firmware. The explanation for this is, that the “FIS” (File Information System) must be adjusted every time the flash is written. Unfortunately, mtd cannot do that, and thus cannot be used to do updates. Instead, RedBoot is used for updates.

If you need to backup SPI flash you don't need mtd2(rootfs_data) partition. You need to join 0,1,3,4,5,6 with cat command like:

cat /dev/mtd0 > /tmp/dir300_full_flash.bin
cat /dev/mtd1 >> /tmp/dir300_full_flash.bin
cat /dev/mtd3 >> /tmp/dir300_full_flash.bin
cat /dev/mtd4 >> /tmp/dir300_full_flash.bin
cat /dev/mtd5 >> /tmp/dir300_full_flash.bin
cat /dev/mtd6 >> /tmp/dir300_full_flash.bin

Then you can save your SPI flash somewhere safe with:

scp /tmp/dir300_full_flash.bin user@othersite:/path

Some users have reported that the JFFS version of OpenWrt can remove the boardconfig area of the flash. If you need to restore to the original firmware or to the emergency redboot web flash page at any point, instructions are here

Note My DIR-300 takes ridiculously long to boot. I measured about 70 seconds after power connection has been established until I can connect to the bootloader and about 160 seconds until I can telnet/ssh to the OpenWrt! Maybe this is normal, maybe I miss-configured the replacement bootloader at the first time installation. FYI.

In order to replace the original firmware with OpenWrt, you will need to replace the BootLoader as well. RedBoot is OpenSource software and we are going to replace the original one with a modified one here or from the DD-Wrt-Project. For the first time installation of OpenWrt on the D-Link DIR-300 (Rev.A1) or on the Airlink AR335W/AR430W you need to obtain 4 files from the Internet and have a tfpd (i.e. daemon, not client) running.

First you should install a tfpt-daemon and change into its root directory. After installation it will be automatically started. In Ubuntu do:

sudo aptitude install tftpd-hpa
cd /var/lib/tftpboot

Now download the four files directly into this directory. You only need sudo, because as a normal user you cannot write in here:

sudo wget http://www.dd-wrt.com/dd-wrtv2/downloads/v24/Atheros%20WiSoc/Airlink%20101%20AR430W/ap61.ram
sudo wget http://www.dd-wrt.com/dd-wrtv2/downloads/v24/Atheros%20WiSoc/Airlink%20101%20AR430W/ap61.rom

sudo wget http://downloads.openwrt.org/snapshots/trunk/atheros/openwrt-atheros-vmlinux.lzma
sudo wget http://downloads.openwrt.org/snapshots/trunk/atheros/openwrt-atheros-root.squashfs

Let's assume, you have only one NIC in you PC, while keeping you browser with this page open so you can read on, you will need to give yourself the IP 192.168.20.80. Now before you proceed, due to compatibility issues, you need to create the ~/.telnetrc. It has to contain the following:

192.168.20.81
        mode line

Connect your NIC to the WAN-Port of the DIR-300 and then restart the Router. While it reboots, after about 5 sec, there is a window of about 1 sec, during which you should be able to login to the original BootLoader of the DIR-300. Simply repeat this, until success:

telnet 192.168.20.81 9000

This is not a big deal, and you should be successful at first try. You will be presented with the original RedBoot prompt eagerly awaiting your input:

Redboot>

Now we will get and execute the modified (and temporary) RedBoot from the DD-Wrt-Project:

Redboot> load ap61.ram go

or split over two commands (if you get an error with the above)

Redboot> load ap61.ram
Redboot> go

You will get no feedback and nothing has been written onto the flash yet, but the new temporary BootLoader should be running. To communicate with it, you need to change your own IP from 192.168.20.80 to 192.168.1.2 and reconnect the ethernet cable to one of the LAN-Ports of the Router. Then telnet to it:

telnet 192.168.1.1 9000

The modified (and temporary) BootLoader awaits you.

DD-WRT>

Now you need to make things permanent. For this we will use the other file, the ap61.rom:

DD-WRT>fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x807f0000-0x80800000 at 0xbffe0000: .

DD-WRT>ip_address -h 192.168.1.2
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2

DD-WRT>load -r -b %{FREEMEMLO} ap61.rom
Using default protocol (TFTP)
Raw file loaded 0x80080000-0x800a8717, assumed entry at 0x80080000

DD-WRT>fis create -l 0x30000 -e 0xbfc00000 RedBoot
An image named 'RedBoot' exists - continue (y/n)? y
... Erase from 0xbfc00000-0xbfc30000: ...
... Program from 0x80080000-0x800a8718 at 0xbfc00000: ...
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x807f0000-0x80800000 at 0xbffe0000: .

DD-WRT>fconfig bootp false
bootp: Setting to false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x80ff0000-0x81000000 at 0xbffe0000: . 
DD-WRT>reset

The Router will reboot, it should take about a minute. You login again to the modified (but this time persistent) BootLoader, load and fis the OpenWrt-Images onto the flash and configure the BootLoader:

DD-WRT>fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x807f0000-0x80800000 at 0xbffe0000: .

DD-WRT>ip_address -h 192.168.1.2
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2

DD-WRT>load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x801007ff, assumed entry at 0x80040800

DD-WRT>fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
... Erase from 0xbfc30000-0xbfcf0000: ............
... Program from 0x80040800-0x80100800 at 0xbfc30000: ............
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x80ff0000-0x81000000 at 0xbffe0000: .

DD-WRT>load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x802207ff, assumed entry at 0x80040800''

DD-WRT>fis create rootfs
... Erase from 0xbfcf0000-0xbffe0000: ...............................................
... Program from 0x80040800-0x80220800 at 0xbfcf0000: ..............................
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x80ff0000-0x81000000 at 0xbffe0000: .

DD-WRT>fconfig boot_script_timeout 5

DD-WRT>fconfig boot_script true
Run script at boot: true 

DD-WRT>fconfig
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load -l vmlinux.bin.l7
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address: 192.168.1.1
Local IP address: 192.168.1.10
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.228
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xbffe0000-0xbfff0000: .
... Program from 0x80ff0000-0x81000000 at 0xbffe0000: .''

DD-WRT>reset

And we are done. This time the reboot could take up to 4-5 minutes, so be patient.

If you don't trust the script below (it loads some binary from some blog, use the step by step guideline above

For linux there is shell script called dir300-flash; it wraps the manual steps for replacing the original bootloader and/or flashing firmware images into a single command line. The script requires a tftp-daemon to be already running. See –help for further details. Usage:

$ sudo ./dir300-flash.sh eth0 openwrt-atheros-vmlinux.lzma openwrt-atheros-root.squashfs Please connect now the WAN port of the DIR-300 wireless router directly to the interface “eth0” and then power the wireless router on. Waiting for the wireless router..... done Testing for the factory bootloader... yes Uploading the temporary bootloader RAM image... done Starting the temporary bootloader... done Waiting for the temporary bootloader to come up.... done Uploading the new bootloader ROM image... done Warning: Do not power off or disconnect as this may break the wireless router! Setting up bootloader configuration... done Flashing the new bootloader... done Resetting the wireless router... done Waiting for the new bootloader............. done Uploading the new kernel image... done Flashing the new kernel image... done Uploading the new root filesystem... done Flashing the new root filesystem... done Resetting the wireless router... done

For reflashing via the bootloader do: You have to compile by your own - Not enough memory to boot the openwrt. Example of configuration where device boot fine - No gui/www, no dhcp server, only ssh.

CONFIG_TARGET_ath25=y
CONFIG_TARGET_ath25_Default=y
CONFIG_TARGET_BOARD="ath25"
# CONFIG_ATH_USER_REGD is not set
# CONFIG_IPV6 is not set
CONFIG_KERNEL_COREDUMP=y
CONFIG_KERNEL_DEBUG_INFO=y
CONFIG_KERNEL_DEBUG_KERNEL=y
CONFIG_KERNEL_ELF_CORE=y
# CONFIG_KERNEL_IPV6 is not set
CONFIG_KERNEL_SWAP=y
# CONFIG_PACKAGE_ATH_DFS is not set
# CONFIG_PACKAGE_MAC80211_MESH is not set
# CONFIG_PACKAGE_dnsmasq is not set
# CONFIG_PACKAGE_firewall is not set
# CONFIG_PACKAGE_iptables is not set
# CONFIG_PACKAGE_kmod-ipt-conntrack is not set
# CONFIG_PACKAGE_kmod-ipt-core is not set
# CONFIG_PACKAGE_kmod-ipt-nat is not set
# CONFIG_PACKAGE_kmod-ipt-offload is not set
# CONFIG_PACKAGE_kmod-nf-conntrack is not set
# CONFIG_PACKAGE_kmod-nf-flow is not set
# CONFIG_PACKAGE_kmod-nf-ipt is not set
# CONFIG_PACKAGE_kmod-nf-ipt6 is not set
# CONFIG_PACKAGE_kmod-nf-nat is not set
# CONFIG_PACKAGE_kmod-nf-reject is not set
# CONFIG_PACKAGE_kmod-ppp is not set
# CONFIG_PACKAGE_libip4tc is not set
# CONFIG_PACKAGE_libip6tc is not set
# CONFIG_PACKAGE_libpthread is not set
# CONFIG_PACKAGE_libxtables is not set
# CONFIG_PACKAGE_odhcpd-ipv6only is not set
# CONFIG_PACKAGE_opkg is not set
# CONFIG_PACKAGE_ppp is not set
CONFIG_PACKAGE_kmod-lib-crc-ccitt=y

On tftp server, two files are needed:

openwrt-ath25-generic-kernel.lzma
openwrt-ath25-generic-squashfs-rootfs.bin

Connect to telnet to 192.168.1.10 port 9000

fis init
ip_address -h 192.168.1.2
load -r -b %{FREEMEMLO} openwrt-ath25-generic-kernel.lzma
fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
load -r -b %{FREEMEMLO} openwrt-ath25-generic-squashfs-rootfs.bin
fis create rootfs

For reflashing via the bootloader do:

fis init
ip_address -h 192.168.1.2
load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
fis create rootfs

If your router have already had DD-WRT installed, there will be a chance that the existing bootloader is MicroRedboot. In that case, the router boots rather fast, you cannot telnet to 192.168.1.1 9000 at start up. You will have to use Reset button to access Redboot. See http://www.dd-wrt.com/wiki/index.php/Micro_Redboot for more detail.

If you have already followed this guide and your router is running OpenWrt, but because of some reason you still want to reflash using the bootloader you can access Redboot after 10-11 seconds from powering the device up with the following command:

telnet 192.168.1.10 9000

Use the openwrt-atheros-combined.squashfs.img to upgrade OpenWrt. The file can be found here. http://downloads.openwrt.org/backfire/10.03.1/atheros/ (this is the latest version at the time of wiki edit. There may be newer versions, so look around)

1. Go to System > Flash firmware
2. Point to openwrt-atheros-combined.squashfs.img that you have downloaded
3. Upload image
4. Flash it

1. download the combined firmware from OpenWrt to your router:

   cd /tmp
   wget http://downloads.openwrt.org/snapshots/trunk/atheros/openwrt-atheros-combined.squashfs.img
   wget http://downloads.openwrt.org/snapshots/trunk/atheros/md5sums

2. utilize sysupgrade:

   sysupgrade /tmp/openwrt-atheros-combined.squashfs.img

Since this part is identical for all devices, see Basic configuration.

download putty.exe to c:\ create a file on c:\ called redboot.txt, with the following content:

^C

create a file on c:\ called redboot.bat with the following content:

rem echo off :start rem ------------------------------------------------ ping 192.168.20.81 -n 1 -w 1 >NUL IF ERRORLEVEL 1 goto start rem putty rem ------------------------------------------------ break putty.exe telnet://192.168.20.81:9000 -m redboot.txt exit

start the bat file and power on the router.....here comes redboot

→ JP1

|Power| |Wan| |Ethernet x4 ports| |Ant| |TXD| |GND| |VCC| | . | |RXD|

speed 9600,n,8.

If you just see non-printable characters in the console, you may want to change baudrate. In some case, where MicroRedboot is install, the speed is 115200.

→ J6

The router follows the MIPS 2.6 EJTAG Specification and has the same PIN information. But on the board the PINS are laid out as

The default network configuration is:

To enable WiFi, you need to install packages xxx and xxx.

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

→ failsafe_and_factory_reset

• Unplug the router's power cord
• Connect any router LAN port directly to your PC
• Configure your PC with a static IP address: 192.168.1.2
• Plug the power on to the router
• Wait until the “SYS” LED starts flashing repeatedly
• Press the button (on the side of the router) -- the “SYS” LED will now start flashing at a faster rate
• Login to the router by using telnet to connect to the IP address 192.168.1.1 -- there will be an immediate unauthenticated login to a root shell

Commands:

• mount_root - will mount the normal root filesystem
• firstboot - all settings will be reset

Assuming OpenWrt is already installed, log on the the device via SSH, then do:

cat /dev/mtdblock0 > /tmp/RedBoot.bin

Copy the file (with scp, for example) to your local computer and generate a MD5-checksum for it.

md5sum RedBoot.bin

if it equals with B9D638E537D01D3ED651FAB2AF63FC22 it is probalby safe to go on. Load the file into a hex editor and

- change offset 0x17 from 0x03 to 0x01 - change offset 0x23 from 0x5c to 0x28

MD5 checksums: DIR-300 183MHz: B9D638E537D01D3ED651FAB2AF63FC22 DIR-300 200MHz: 713806dbb99cb0e633a385eb1a8b5440

Copy the modded RedBoot.bin back to the /tmp folder of your router and flash it back:

mtd -f write /tmp/RedBoot.bin RedBoot

Reboot, then check CPU frequency:

cat /proc/cpuinfo

There is a working mod to add a SD-card slot to your DIR-300. Follow the instructions here.

How to add tags