Table of Contents
TP-LINK TL-WR703N
- Version 1.6
This page has some information how to upgrade the ram and flash memory of a TP-LINK TL-WR703N router.
Initial installation
Installed via web menu (default username and password are: admin), (following this advise): http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin, wait at least 5 minutes for this to complete.
Then the router reboots.
Configure OpenWRT: open Terminal, type:
telnet 192.168.1.1
This should give the openwrt text (Showing somewhere Bleeding Edge, r32130).
Set the password:
passwd
And follow the instructions to set your password. After this use ssh to connect as user root:
ssh root@192.168.1.1
To prevent conflicts with the main network infrastructure, change the default ip address of the device which is 192.168.1.1 into 192.168.1.10:
vi /etc/config/network
Then restart it and connect again:
reboot ssh root@192.168.1.10
Update to the latest version. Since I could only connect to local addresses, I used the webserver from OSX to serve the sysupgrade.bin file (However using scp rather than the OSX webserver would be making more sense.):
cd /tmp wget http://192.168.1.110/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin mtd write openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin firmware reboot
After the reboot all your settings are gone, so repeat steps from above: connect with telnet, set password, and change ip address.
Type logread to see system messages:
Increase ram memory
The original ram memory chip (Zentel A3S56D40FTP-G5) has a size of 4MB. To verify this, the free command should give you roughly this amount. To get an exact value, use the following command:
cat /proc/meminfo | grep MemTotal
And find this hex number: 4096 kB, which is 4MB.
Now remove power from the device and remove the original ram chip. I used an extremely thin sheet of metal which slides between the pads and the pins while heating them with the soldering iron. Remove extra tin with solder wick. Solder the new chip in location. The best method I found so far is to use a 0.4mm tip. While pressing from above with the soldering iron feed small amounts of tin to each pin. If accidentally too much tin has been supplied and there is a short circuit, remove the excessive tin with solder wick.
After upgrading the ram memory chip (Micron MT46V32M16P) it should be 16MB in total. The output from /proc/meminfo | grep MemTotal is now four times more, 16MB.
Increase flash memory
Before removing the flash memory, first make a backup of the art partition and the u-boot partition. The art partition holds parameters for your wifi hardware. U-boot partition holds parameters for your Ethernet MAC address and hardware revision number.
Backing up u-boot and art partitions
Logon to your TL-WR703N with ssh and issue following commands:
cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin
Then exit and copy the two files to your system with:
scp root@IPADDRESS:/tmp/mtd0.0x00000000.backup_u-boot.bin . scp root@IPADDRESS:/tmp/mtd4.0x003f0000.backup_art.bin .
While you are at it, also download the newest firmware from openwrt and u-boot which has better support for larger memory. See the script from below where to find these files.
Removing the old flash chip
Unsolder the 8-pin flash chip from the back of the board. Remove excessive solder with wick. Then search for your replacement chip:
- w25q128 (Which has 16MB instead of 4MB) See here for other references to this chip.
Creating a flash binary for the new chip
Once done, you can use the following script to build an image for the larger memory.
#!/bin/sh # This script generates a 16MB flash image for the TL-WR703N # # The following files are required: # original uboot, from issuing on the WR703N: cat /dev/mtd0 > /tmp/mtd0.0x00000000.backup_u-boot.bin # art partition from issuing on the WR703N: cat /dev/mtd4 > /tmp/mtd4.0x003f0000.backup_art.bin # # uboot_new from http://www.tech-blog.pl/pliki/u-boot_for_tp-link_AR9331_by_pepe2k.tar.gz # firmware from openwrt: https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/ # search for openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin # u-boot: uboot_bak="mtd0.0x00000000.backup_u-boot.bin" uboot_new="mtd0.0x00000000.uboot_for_tl-wr703n.bin" # firmware: firmware="openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin" # art: art="mtd4.0x003f0000.backup_art.bin" # result file: outf="wr703n_image_16MB.bin" # offsets: mac="0x1FC00" model="0x1FD00" wps="0x1FE00" if [ ! -f $art ]; then echo "file $art is not present, quitting." exit fi if [ ! -f $uboot_bak ]; then echo "file $uboot_bak is not present, quitting." exit fi if [ ! -f $uboot_new ]; then echo "file $uboot_new is not present, quitting." exit fi if [ ! -f $firmware ]; then echo "file $firmware is not present, quitting." exit fi echo "This script creates an image ready to flash onto the TL-WR703N..." # Create a 16MB file with 0xff in it (OSX has problems with sed and null characters, so use perl instead): echo " 1. creating an empty 16MB image filled with 0xFF..." rm $outf dd if=/dev/zero bs=1024 count=16384 2>/dev/null | perl -np -e 's/\0/\xff/g' | dd of=$outf conv=notrunc 2>/dev/null # Insert the new u-boot and the original art at the correct offset: echo " 2. Writing u-boot into the image from position 0x00000000 ..." dd if=$uboot_new of=$outf conv=notrunc 2>/dev/null # FYI: From http://www.geektalks.org/category/tplink-703n/ is documented where MAC address and Model number is stored # Copy from the original u-boot backup file the MAC address (Offset: 0x0001FC00, 6 bytes) echo " 3. Cloning original MAC address from file $uboot_bak into the image at position $mac ..." dd if=$uboot_bak of=$outf skip=$(($mac)) count=6 seek=$(($mac)) bs=1 conv=notrunc 2>/dev/null # Copy from the original u-boot backup file the model number (Offset: 0x0001FD00, 8 bytes) echo " 4. Cloning original model string from file $uboot_bak into the image at position $model ..." dd if=$uboot_bak of=$outf skip=$(($model)) count=8 seek=$(($model)) bs=1 conv=notrunc 2>/dev/null # (For the TL-MR3020 only) Extract from the original u-boot backup file the WPS pin (Offset: 0x0001FE00, 8 bytes) # dd if=$uboot_bak of=total.img skip=$(($wps)) count=8 seek=$(($wps)) bs=1 conv=notrunc 2>/dev/null # Insert art at correct offset: echo " 5. Cloning original art partition into the image at the end ..." dd if=$art of=$outf obs=16320k seek=1 conv=notrunc 2>/dev/null # Open the openwrt firmware openwrt-ar71xx-generic-tl-mr3420-v1-squashfs-factory.bin write all data(about 15.75M) as step 2 from 0x000000020000 to the file. echo " 6. Cloning the firmware (kernel and rootfs) partition into the image at the position 0x00020000 ..." dd if=$firmware of=$outf obs=128k seek=1 conv=notrunc 2>/dev/null echo "... Finished writing $outf. You can now flash the file onto a chip."
Flashing with buspirate
Use your Bus Pirate. If the buspirate is accessible on /dev/ttyUSB0, use following command:
flashrom -p buspirate_spi:dev=/dev/ttyUSB0,pullups=on,spispeed=1M -w wr703n_image_16MB.bin
If ttyUSB0 is not correct, find out with following command which device it should be:
dmesg | grep -A 4 Pirate | grep tty
Flashing with JTAG
If you have no buspirate at hand, you can also flash via JTAG. You can use several different JTAG interfaces with flashrom. I tried it with two, an openmoko debug board v3 and a Tiao usb jtag interface. Both use a ftdi2232 interface chip, but from a different generation.
For the system to recognize the interface please read more here. To actually write to the eeprom, use flashrom which depends on libftdi.
Connecting after flashing
After the chip has been soldered onto the board and powered on, connect with telnet:
telnet 192.168.1.1
Then set a password for root:
passwd
Now it is possible to connect with ssh:
ssh root@192.168.1.1
Network configurations
- http://wiki.openwrt.org/doc/recipes/bridgedclient Bridged Client
- http://wiki.openwrt.org/doc/recipes/routedclient Router Client
- http://wiki.openwrt.org/doc/recipes/relayclient Routed Client with relayd (Pseudobridge)
- http://wiki.openwrt.org/doc/recipes/bridgedap Bridged AP (Connect the tl-wr703n to a router with no wifi option and use wifi from the tl-wr703n to add other wireless devices to the network like mobile phones)
- http://wiki.openwrt.org/doc/howto/clientmode Client Mode Wireless
tl-wr703n bridge ap
For the following file: /etc/config/network
config interface 'loopback' option ifname 'lo' option proto 'static' option ipaddr '127.0.0.1' option netmask '255.0.0.0' config interface 'lan' option ifname 'eth0' option type 'bridge' option proto 'static' option ipaddr '192.168.1.10' option netmask '255.255.255.0'
For the following file: /etc/config/wireless
config wifi-device radio0
option type mac80211
option channel 11
option hwmode 11ng
option path 'platform/ar933x_wmac'
option htmode HT20
list ht_capab SHORT-GI-20
list ht_capab SHORT-GI-40
list ht_capab RX-STBC1
list ht_capab DSSS_CCK-40
# REMOVE THIS LINE TO ENABLE WIFI:
#option disabled 1
config wifi-iface
option device radio0
option network lan
option mode ap
option ssid PrivateNet
option encryption 'psk2'
option key 'Your wpa2 key between the quotes'
Information and links
- Complete schematic diagram of the TL-WR703N Including circuit board layout
- http://wiki.openwrt.org/toh/tp-link/tl-wr703n Main openwrt page about TL-WR703N
- http://wiki.openwrt.org/doc/howto/clientmode Explanation with images of different client modes
- https://forum.openwrt.org/viewtopic.php?id=41953 Setting up simple wlan connection problem
- http://forums.openpilot.org/blog/52/entry-92-unbrick-wr703n-wifi-router/ Adding a serial connection to your TL-WR703N
- http://wiki.xinchejian.com/wiki/Install_OpenWRT_on_TPlink_WR703N Basic setup guide with screen shots
- https://forum.openwrt.org/viewtopic.php?pid=179169#p179169 Upgrading flash memory schematic diagram
- Openmoko flash programmer Using the openmoko debug board to program Flash memory
- https://forum.openwrt.org/viewtopic.php?id=32512 Upgrading flash memory and adapting kernel to accept the larger address space
- http://www.tl-wr703n.blogspot.no/2012/07/promjena-flash-rom-memorije-4mb-8mb.html From 4MB to 8MB flash memory with download link to flash rom contents
- http://wiki.openwrt.org/doc/recipes/guest-wlan Configure a guest-wlan
- http://wiki.openwrt.org/doc/uci/network Explanation of all options in /etc/config/network
- http://wiki.openwrt.org/doc/uci/wireless Explanation of all options in /etc/config/wireless
- http://wiki.openwrt.org/doc/uci/dhcp Explanation of all options in /etc/config/dhcp
- http://wiki.openwrt.org/doc/uci/firewall Explanation of all options in /etc/config/firewall