Differences

This shows you the differences between two versions of the page.

--- projects:routers:tp-link:tl-wr703n [2014/01/25 23:17] – [tl-wr703n bridge ap] admin
+++ projects:routers:tp-link:tl-wr703n [2024/09/04 23:12] (current) – [Information and links] admin
@@ Line 2: / Line 2: @@
   * Version 1.6
+This page has some information how to upgrade the ram and flash memory of a TP-LINK TL-WR703N router.
 ==== Initial installation ====
 Installed via web menu (default username and password are: admin), (following [[http://wiki.xinchejian.com/wiki/Install_OpenWRT_on_TPlink_WR703N|this advise]]): [[http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin]], wait at least 5 minutes for this to complete.\\
@@ Line 22: / Line 23: @@
   mtd write openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin firmware
   reboot
-After the reboot all your settings are gone, so repeat steps from above: connect with telnet, set password, and change ip address.\\ Check logread for the system messages:
+After the reboot all your settings are gone, so repeat steps from above: connect with telnet, set password, and change ip address.\\ Type logread to see system messages:
 <hidden><code bash>
 root@OpenWrt:~# logread
@@ Line 146: / Line 147: @@
 ==== Increase ram memory ====
 The original ram memory chip (Zentel A3S56D40FTP-G5) has a size of 4MB. To verify this, the free command should give you roughly this amount. To get an exact value, use the following command:
-  dmesg | more
+  cat /proc/meminfo | grep MemTotal
-And find this hex number: 0x01000000, which is in decimal 4MB.\\ \\ Now remove power from the device and remove the original ram chip. I used an extremely thin sheet of metal which slides between the pads and the pins while heating them with the soldering iron. Remove extra tin with solder wick. Solder the new chip in location. The best method I found so far is to use a 0.4mm tip. While pressing from above with the soldering iron feed small amounts of tin to each pin. If accidentally too much tin has been supplied and there is a short circuit, remove the excessive tin with solder wick.\\ \\
+And find this hex number: 4096 kB, which is 4MB.\\ \\ Now remove power from the device and remove the original ram chip. I used an extremely thin sheet of metal which slides between the pads and the pins while heating them with the soldering iron. Remove extra tin with solder wick. Solder the new chip in location. The best method I found so far is to use a 0.4mm tip. While pressing from above with the soldering iron feed small amounts of tin to each pin. If accidentally too much tin has been supplied and there is a short circuit, remove the excessive tin with solder wick.\\ \\
-After upgrading the ram memory chip (Micron MT46V32M16P) it should be 16MB in total. The output from dmesg is 0x04000000 which is correctly 16MB.
+After upgrading the ram memory chip (Micron MT46V32M16P) it should be 16MB in total. The output from /proc/meminfo | grep MemTotal is now four times more, 16MB.
 ==== Increase flash memory ====
-Electrically upgrading the flash memory requires to have a compatible chip. I planned to upgrade with this chip:
+Before removing the flash memory, first make a backup of the art partition and the u-boot partition. The art partition holds parameters for your wifi hardware. U-boot partition holds parameters for your Ethernet MAC address and hardware revision number.
-  * w25q128 (16MB instead of 4) See [[https://forum.openwrt.org/viewtopic.php?pid=183882#p183882|here]] for other references to this chip.
+=== Backing up u-boot and art partitions ===
+Logon to your TL-WR703N with ssh and issue following commands:
+  cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin
+  cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin
+Then exit and copy the two files to your system with:
+  scp root@IPADDRESS:/tmp/mtd0.0x00000000.backup_u-boot.bin .
+  scp root@IPADDRESS:/tmp/mtd4.0x003f0000.backup_art.bin .
+While you are at it, also download the newest firmware from openwrt and u-boot which has better support for larger memory. See the script from below where to find these files.
-I try to program this chip before soldering it onto the board. For this I decided to use a JTAG interface. Many interfaces exist, I have two, an openmoko debug board v3 and a [[http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User%27s_Manual|Tiao usb jtag interface]]. Both use a ftdi2232 interface chip, but from a different generation.
+=== Removing the old flash chip ===
+Unsolder the 8-pin flash chip from the back of the board. Remove excessive solder with wick. Then search for your replacement chip:
+  * w25q128 (Which has 16MB instead of 4MB) See [[https://forum.openwrt.org/viewtopic.php?pid=183882#p183882|here]] for other references to this chip.
-For the system to recognize the interface please read more [[software:linux:jtag|here]]. To actually read from and write to the eeprom, use [[http://flashrom.org/FT2232SPI_Programmer|flashrom]] which depends on libftdi.
+=== Creating a flash binary for the new chip ===
+Once done, you can use the following script to build an image for the larger memory.
+<code bash>
+#!/bin/sh
+# This script generates a 16MB flash image for the TL-WR703N
+#
+# The following files are required:
+#   original uboot, from issuing on the WR703N: cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin
+#   art partition from issuing on the WR703N: cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin
+#
+#   uboot_new from http://www.tech-blog.pl/pliki/u-boot_for_tp-link_AR9331_by_pepe2k.tar.gz
+#   firmware from openwrt: https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/
+#     search for openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
+# u-boot:
+uboot_bak="mtd0.0x00000000.backup_u-boot.bin"
+uboot_new="mtd0.0x00000000.uboot_for_tl-wr703n.bin"
+# firmware:
+firmware="openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin"
+# art:
+  art="mtd4.0x003f0000.backup_art.bin"
+# result file:
+ outf="wr703n_image_16MB.bin"
+# offsets:
+  mac="0x1FC00"
+model="0x1FD00"
+  wps="0x1FE00"
+if [ ! -f $art ]; then
+echo "file $art is not present, quitting."
+exit
+fi
+if [ ! -f $uboot_bak ]; then
+echo "file $uboot_bak is not present, quitting."
+exit
+fi
+if [ ! -f $uboot_new ]; then
+echo "file $uboot_new is not present, quitting."
+exit
+fi
+if [ ! -f $firmware ]; then
+echo "file $firmware is not present, quitting."
+exit
+fi
+echo "This script creates an image ready to flash onto the TL-WR703N..."
+#   Create a 16MB file with 0xff in it (OSX has problems with sed and null characters, so use perl instead):
+echo "  1. creating an empty 16MB image filled with 0xFF..."
+rm $outf
+dd if=/dev/zero bs=1024 count=16384 2>/dev/null | perl -np -e 's/\0/\xff/g' | dd of=$outf conv=notrunc 2>/dev/null
+#   Insert the new u-boot and the original art at the correct offset:
+echo "  2. Writing u-boot into the image from position 0x00000000 ..."
+dd if=$uboot_new of=$outf conv=notrunc 2>/dev/null
+#   FYI: From http://www.geektalks.org/category/tplink-703n/ is documented where MAC address and Model number is stored
+#   Copy from the original u-boot backup file the MAC address (Offset: 0x0001FC00, 6 bytes)
+echo "  3. Cloning original MAC address from file $uboot_bak into the image at position $mac ..."
+dd if=$uboot_bak of=$outf skip=$(($mac)) count=6 seek=$(($mac)) bs=1 conv=notrunc 2>/dev/null
+#   Copy from the original u-boot backup file the model number (Offset: 0x0001FD00, 8 bytes)
+echo "  4. Cloning original model string from file $uboot_bak into the image at position $model ..."
+dd if=$uboot_bak of=$outf skip=$(($model)) count=8 seek=$(($model)) bs=1 conv=notrunc 2>/dev/null
+#   (For the TL-MR3020 only) Extract from the original u-boot backup file the WPS pin (Offset: 0x0001FE00, 8 bytes)
+# dd if=$uboot_bak of=total.img skip=$(($wps)) count=8 seek=$(($wps)) bs=1 conv=notrunc 2>/dev/null
+#   Insert art at correct offset:
+echo "  5. Cloning original art partition into the image at the end ..."
+dd if=$art of=$outf obs=16320k seek=1 conv=notrunc 2>/dev/null
+#   Open the openwrt firmware openwrt-ar71xx-generic-tl-mr3420-v1-squashfs-factory.bin write all data(about 15.75M) as step 2 from 0x000000020000 to the file.
+echo "  6. Cloning the firmware (kernel and rootfs) partition into the image at the position 0x00020000 ..."
+dd if=$firmware of=$outf obs=128k seek=1 conv=notrunc 2>/dev/null
+echo "... Finished writing $outf. You can now flash the file onto a chip."
+</code>
+=== Flashing with buspirate ===
+Use your [[http://www.flashrom.org/Bus_Pirate|Bus Pirate]]. If the buspirate is accessible on /dev/ttyUSB0, use following command:
+  flashrom -p buspirate_spi:dev=/dev/ttyUSB0,pullups=on,spispeed=1M -w wr703n_image_16MB.bin
+If ttyUSB0 is not correct, find out with following command which device it should be:
+  dmesg | grep -A 4 Pirate | grep tty
+=== Flashing with JTAG ===
+If you have no buspirate at hand, you can also flash via JTAG. You can use several different JTAG interfaces with flashrom. I tried it with two, an openmoko debug board v3 and a [[http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User%27s_Manual|Tiao usb jtag interface]]. Both use a ftdi2232 interface chip, but from a different generation.
+For the system to recognize the interface please read more [[software:linux:jtag|here]]. To actually write to the eeprom, use [[http://flashrom.org/FT2232SPI_Programmer|flashrom]] which depends on libftdi.
+==== Connecting after flashing ====
+After the chip has been soldered onto the board and powered on, connect with telnet:
+  telnet 192.168.1.1
+Then set a password for root:
+  passwd
+Now it is possible to connect with ssh:
+  ssh root@192.168.1.1
 ===== Network configurations =====
   * [[http://wiki.openwrt.org/doc/recipes/bridgedclient]] Bridged Client
@@ Line 207: / Line 305: @@
 </code>
 ===== Information and links =====
-  * [[http://squonk42.github.com/TL-WR703N/|Complete schematic diagram of the TL-WR703N]] Including circuit board layout
+  * [[https://squonk42.github.io/TL-WR703N/|Complete schematic diagram of the TL-WR703N]] Including circuit board layout
   * [[http://wiki.openwrt.org/toh/tp-link/tl-wr703n]] Main openwrt page about TL-WR703N
   * [[http://wiki.openwrt.org/doc/howto/clientmode]] Explanation with images of different client modes

Auditeon

User Tools

Site Tools

Differences

Page Tools