This page has some information how to upgrade the ram and flash memory of a TP-LINK TL-WR703N router.
Installed via web menu (default username and password are: admin), (following this advise): http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin, wait at least 5 minutes for this to complete.
Then the router reboots.
Configure OpenWRT: open Terminal, type:
telnet 192.168.1.1
This should give the openwrt text (Showing somewhere Bleeding Edge, r32130).
Set the password:
passwd
And follow the instructions to set your password. After this use ssh to connect as user root:
ssh root@192.168.1.1
To prevent conflicts with the main network infrastructure, change the default ip address of the device which is 192.168.1.1 into 192.168.1.10:
vi /etc/config/network
Then restart it and connect again:
reboot ssh root@192.168.1.10
Update to the latest version. Since I could only connect to local addresses, I used the webserver from OSX to serve the sysupgrade.bin file (However using scp rather than the OSX webserver would be making more sense.):
cd /tmp wget http://192.168.1.110/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin mtd write openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin firmware reboot
After the reboot all your settings are gone, so repeat steps from above: connect with telnet, set password, and change ip address.
Type logread to see system messages:
The original ram memory chip (Zentel A3S56D40FTP-G5) has a size of 4MB. To verify this, the free command should give you roughly this amount. To get an exact value, use the following command:
cat /proc/meminfo | grep MemTotal
And find this hex number: 4096 kB, which is 4MB.
Now remove power from the device and remove the original ram chip. I used an extremely thin sheet of metal which slides between the pads and the pins while heating them with the soldering iron. Remove extra tin with solder wick. Solder the new chip in location. The best method I found so far is to use a 0.4mm tip. While pressing from above with the soldering iron feed small amounts of tin to each pin. If accidentally too much tin has been supplied and there is a short circuit, remove the excessive tin with solder wick.
After upgrading the ram memory chip (Micron MT46V32M16P) it should be 16MB in total. The output from /proc/meminfo | grep MemTotal is now four times more, 16MB.
Before removing the flash memory, first make a backup of the art partition and the u-boot partition. The art partition holds parameters for your wifi hardware. U-boot partition holds parameters for your Ethernet MAC address and hardware revision number.
Logon to your TL-WR703N with ssh and issue following commands:
cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin
Then exit and copy the two files to your system with:
scp root@IPADDRESS:/tmp/mtd0.0x00000000.backup_u-boot.bin . scp root@IPADDRESS:/tmp/mtd4.0x003f0000.backup_art.bin .
While you are at it, also download the newest firmware from openwrt and u-boot which has better support for larger memory. See the script from below where to find these files.
Unsolder the 8-pin flash chip from the back of the board. Remove excessive solder with wick. Then search for your replacement chip:
Once done, you can use the following script to build an image for the larger memory.
#!/bin/sh # This script generates a 16MB flash image for the TL-WR703N # # The following files are required: # original uboot, from issuing on the WR703N: cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin # art partition from issuing on the WR703N: cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin # # uboot_new from http://www.tech-blog.pl/pliki/u-boot_for_tp-link_AR9331_by_pepe2k.tar.gz # firmware from openwrt: https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/ # search for openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin # u-boot: uboot_bak="mtd0.0x00000000.backup_u-boot.bin" uboot_new="mtd0.0x00000000.uboot_for_tl-wr703n.bin" # firmware: firmware="openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin" # art: art="mtd4.0x003f0000.backup_art.bin" # result file: outf="wr703n_image_16MB.bin" # offsets: mac="0x1FC00" model="0x1FD00" wps="0x1FE00" if [ ! -f $art ]; then echo "file $art is not present, quitting." exit fi if [ ! -f $uboot_bak ]; then echo "file $uboot_bak is not present, quitting." exit fi if [ ! -f $uboot_new ]; then echo "file $uboot_new is not present, quitting." exit fi if [ ! -f $firmware ]; then echo "file $firmware is not present, quitting." exit fi echo "This script creates an image ready to flash onto the TL-WR703N..." # Create a 16MB file with 0xff in it (OSX has problems with sed and null characters, so use perl instead): echo " 1. creating an empty 16MB image filled with 0xFF..." rm $outf dd if=/dev/zero bs=1024 count=16384 2>/dev/null | perl -np -e 's/\0/\xff/g' | dd of=$outf conv=notrunc 2>/dev/null # Insert the new u-boot and the original art at the correct offset: echo " 2. Writing u-boot into the image from position 0x00000000 ..." dd if=$uboot_new of=$outf conv=notrunc 2>/dev/null # FYI: From http://www.geektalks.org/category/tplink-703n/ is documented where MAC address and Model number is stored # Copy from the original u-boot backup file the MAC address (Offset: 0x0001FC00, 6 bytes) echo " 3. Cloning original MAC address from file $uboot_bak into the image at position $mac ..." dd if=$uboot_bak of=$outf skip=$(($mac)) count=6 seek=$(($mac)) bs=1 conv=notrunc 2>/dev/null # Copy from the original u-boot backup file the model number (Offset: 0x0001FD00, 8 bytes) echo " 4. Cloning original model string from file $uboot_bak into the image at position $model ..." dd if=$uboot_bak of=$outf skip=$(($model)) count=8 seek=$(($model)) bs=1 conv=notrunc 2>/dev/null # (For the TL-MR3020 only) Extract from the original u-boot backup file the WPS pin (Offset: 0x0001FE00, 8 bytes) # dd if=$uboot_bak of=total.img skip=$(($wps)) count=8 seek=$(($wps)) bs=1 conv=notrunc 2>/dev/null # Insert art at correct offset: echo " 5. Cloning original art partition into the image at the end ..." dd if=$art of=$outf obs=16320k seek=1 conv=notrunc 2>/dev/null # Open the openwrt firmware openwrt-ar71xx-generic-tl-mr3420-v1-squashfs-factory.bin write all data(about 15.75M) as step 2 from 0x000000020000 to the file. echo " 6. Cloning the firmware (kernel and rootfs) partition into the image at the position 0x00020000 ..." dd if=$firmware of=$outf obs=128k seek=1 conv=notrunc 2>/dev/null echo "... Finished writing $outf. You can now flash the file onto a chip."
Use your Bus Pirate. If the buspirate is accessible on /dev/ttyUSB0, use following command:
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,pullups=on,spispeed=1M -w wr703n_image_16MB.bin
If ttyUSB0 is not correct, find out with following command which device it should be:
dmesg | grep -A 4 Pirate | grep tty
If you have no buspirate at hand, you can also flash via JTAG. You can use several different JTAG interfaces with flashrom. I tried it with two, an openmoko debug board v3 and a Tiao usb jtag interface. Both use a ftdi2232 interface chip, but from a different generation.
For the system to recognize the interface please read more here. To actually write to the eeprom, use flashrom which depends on libftdi.
After the chip has been soldered onto the board and powered on, connect with telnet:
telnet 192.168.1.1
Then set a password for root:
passwd
Now it is possible to connect with ssh:
ssh root@192.168.1.1
For the following file: /etc/config/network
config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config interface 'lan' option ifname 'eth0' option type 'bridge' option proto 'static' option ipaddr '192.168.1.10' option netmask '255.255.255.0'
For the following file: /etc/config/wireless
config wifi-device radio0
option type mac80211
option channel 11
option hwmode 11ng
option path 'platform/ar933x_wmac'
option htmode HT20
list ht_capab SHORT-GI-20
list ht_capab SHORT-GI-40
list ht_capab RX-STBC1
list ht_capab DSSS_CCK-40
# REMOVE THIS LINE TO ENABLE WIFI:
#option disabled 1
config wifi-iface
option device radio0
option network lan
option mode ap
option ssid PrivateNet
option encryption 'psk2'
option key 'Your wpa2 key between the quotes'