OpenWrt Forum Archive

Topic: Let's Get More,Make WR703 With 16M Flash

The content of this topic has been archived between 6 Feb 2018 and 22 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

You have forgotten to dump and restore second 64 KiB block from original flash.
It contains MAC address and model number (which is also important).

My U-Boot modification size for this model is 64 KiB, but u-boot partition in OFW and in OpenWrt is 128 KiB, as you may noticed with "cat /proc/mtd".

How can i do that from existing dump?

sSpeaker wrote:

How can i do that from existing dump?

Use any HEX editor and extract 64 KiB from address 0x10000 to 0x1FFF0 (exactly 64 KiB = 0x10000).
Then, using tftpboot command in U-Boot download prepared file and put it on offset 0x9F010000, for example:

tftpboot 0x80080000 mac.bin
[...]
erase 0x9F010000 +0x10000
cp.b 0x80080000 0x9F010000 0x10000

Thanks. Now printmodel show correct version.

Hi Folks,

I am really confused after reading all of this. I want to modify one of my wr703n units to gain more storage space for baked in packages. It's no problem for me to cook an image, and I know how to make sysupgrade images 8 megs or whatever size I want, but beyond that I think I may have read way too much, because I am just lost and totally beyond confused now. 16 megs might be too much, I just need to be able to fit openvpn, luci and rt2800usb images on flash. Anything after that is just gravy.

I was not planning on messing with RAM at the moment, mostly because I doubt my soldering abilities with that many pins. I can backup all parts of the flash, ART and whatever, no issue.

So do I need to flash a custom uboot just to increase the flash capacity? How do you assemble the final flash image that you are going to burn with a programmer? I only have access to whatever I can run on Linux, I have no Windows license and I would rather not mess with that.

SLboat and the rest of you folks make this look so easy smile I'd like to make a writeup once I really get a grasp on what I have to do. Good news is that I haven't bought anything other than a bunch of routers... I plan on buying SLboat's programmer and some chips if I can ever get this figured out...

Thanks for any assistance you can offer.

TheFonRanger wrote:

So do I need to flash a custom uboot just to increase the flash capacity?

You don’t have to, as the OpenWRT kernel will recognize it by itself. However, stock uboot cannot reach beyond 4MiB, so unless you modify it, you loose the ability to recover the flash from uboot console. For an alternative uboot, take a look here: https://forum.openwrt.org/viewtopic.php?id=43237

How do you assemble the final flash image that you are going to burn with a programmer?

A complete flash image would look like that,

for stock firmware:
64KiB uboot + 64KiB data (PIN&MAC) + 3.75MiB kernel&fs + 64KiB config + 64KiB ART, exactly 4MiB in total; data & ART blocks are from backups of that same router;

for OpenWRT:
64KiB uboot + 64KiB data (PIN&MAC) + kernel&fs + empty space as needed + 64KiB ART at the end of flash, in total the size of your flash. The maximum size of kernel&fs is the size or your flash, less 128KiB uboot+data, less 64KiB ART. Data & ART blocks are from backups of that same router.

Hello,
I want to mod my router wr703N too
Can you send to me full image for 16mB only to flash with programmer before soldering?

Thank You!

vdat_bg wrote:

Hello,
I want to mod my router wr703N too
Can you send to me full image for 16mB only to flash with programmer before soldering?

Thank You!

Please understand that the image must contain parts from your original flash ROM. Specifically, the data and ART blocks. The latter is most critical.

Hello Rambler,
Thanks for Answer.
I know that I must replace last 64kB Art partition of flash with original.

But I need modified uboot and file system.

Can  You can provide to me a bin file where to replace my art partition?

Thank in advance

Vasil Atanasov

You need to replace the last 64KiB with “art” block (contains radio calibration data), AND you need to replace the second 64KiB with the corresponding data block of the original flash (it contains MAC address, device identification code, and PIN if applicable).

You should be able to assemble flash image yourself.

The parts you need:

    1. U-boot. That’s the first 64KiB block of the original flash, or an alternative uboot from pepe2k, namely uboot_for_tp-link_tl-wr703n.bin from here. Whichever you choose, I’ll call it uboot.bin in the following (exactly 65536 bytes).
    2. The second 64KiB block of the original flash. I’ll call it data.bin in the following.
    3. OpenWRT Attitude Adjustment image for your device, get it here. I shall call it factory.bin in the following.
    4. Optionally, create a file empty.bin which is 12648448 bytes in size and contains FF’s (actually, it may contain anything, it shouldn’t matter).
    5. The last 64KiB of the original flash, I’ll call it art.bin in the following.

Now, combine the parts into the final image.bin. On Windows, it would be

copy /b uboot.bin+data.bin+factory.bin+empty.bin+art.bin image.bin

(On linux, you do it similarly with the “cat” command.) The resulting image.bin should be exactly 16MiB, the size of your flash.

Alternatively, use your hex editor to create an empty image.bin with the size of 16MiB (16777216 bytes), then paste into it (overwrite bytes, NOT insert)
    1. uboot.bin at file offset 0;
    2. data.bin at 0x10000;
    3. factory.bin at 0x20000;
    4. art.bin at 0xFF0000.

Hello Rambler,
Thanks for detailed description of making bin file.
Today I tested the device with new flash and it works fine.


Best regards,
Vasil Atanasov

xopal wrote:
alphasparc wrote:

Hi guys can you explain how to move the art partition and expand the filesystem to fill the larger flash chip?
I wish to upgrade my TP-link WDR4300 from 8MB of flash to 64MB so I can install owncloud on it (Don't reallly like extroot).
Also where can I get a cheap reliable external flash programmer preferably on ebay or other reliable sources that uses paypal.
Thanks

Art partition for 16MB Flash :

16MB total size in hex = 1000000

64kb art partition size in hex = 10000

Art partition hex address = 1000000 - 10000 = FF0000


Art partition for 64MB Flash :

64MB total size in hex = 4000000

64kb art partition size in hex = 10000

Art partition hex address = 4000000 - 10000 = 3FF0000

Of course you need to modify u-boot environment to 64MB  this is critical if you work with uboot command.

For openwrt firmware I can confirm you, openwrt will automatically detect the flash size IF your flash ID is on his list , so you don't need to compile openwrt with certain template size.

But you can compile openwrt with 64MB template and put all your packages in it as much as flash chip can handle it.
Nice when you issuing the command "fistboot", you don't need to install a bunch of your packages list.

Anyone did 64MB flash? which model?IT's hard to get 128MB of DDR I RAM, 64MBx16.I think no way to support 256MB RAM, seems no such sops 66 single chip of 256MB RAM.

rambler wrote:

You need to replace the last 64KiB with “art” block (contains radio calibration data), AND you need to replace the second 64KiB with the corresponding data block of the original flash (it contains MAC address, device identification code, and PIN if applicable).

You should be able to assemble flash image yourself.

The parts you need:

    1. U-boot. That’s the first 64KiB block of the original flash, or an alternative uboot from pepe2k, namely uboot_for_tp-link_tl-wr703n.bin from here. Whichever you choose, I’ll call it uboot.bin in the following (exactly 65536 bytes).
    2. The second 64KiB block of the original flash. I’ll call it data.bin in the following.
    3. OpenWRT Attitude Adjustment image for your device, get it here. I shall call it factory.bin in the following.
    4. Optionally, create a file empty.bin which is 12648448 bytes in size and contains FF’s (actually, it may contain anything, it shouldn’t matter).
    5. The last 64KiB of the original flash, I’ll call it art.bin in the following.

Now, combine the parts into the final image.bin. On Windows, it would be

copy /b uboot.bin+data.bin+factory.bin+empty.bin+art.bin image.bin

(On linux, you do it similarly with the “cat” command.) The resulting image.bin should be exactly 16MiB, the size of your flash.

Alternatively, use your hex editor to create an empty image.bin with the size of 16MiB (16777216 bytes), then paste into it (overwrite bytes, NOT insert)
    1. uboot.bin at file offset 0;
    2. data.bin at 0x10000;
    3. factory.bin at 0x20000;
    4. art.bin at 0xFF0000.

Hi, first of all I'm completely new to all of this, so please excuse the stupid questions. I'm planing on doing the 16MByte Flash upgrade witch i got from SLboat. I have what I need to flash the chip, but how do i dump what I need from original flash?

Directory /dev/ contains pseudo-files that represent flash partitions (see http://wiki.openwrt.org/doc/techref/flash.layout). In particular (assuming you have OpenWRT on the router), /dev/mtd0 is uboot+data (128 KiB), /dev/mtd4 is ART (64 KiB). To backup them (again assuming you run OpenWRT), first login to the router with SSH and make copies of these partitions in RAM, such as

cat /dev/mtd0 > /tmp/mtd0.bin
cat /dev/mtd4 > /tmp/mtd4.bin

and then get them from /tmp to your PC with a SCP client.

Otherwise, once you've de-soldered the flash, and hopefully not killed it, you should be able to read its contents with your flash programmer.

slboat wrote:

http://see.sl088.com/w/images/e/e4/Slboat_eos_4245.JPG

could you tell me the name of this

(Last edited by hoatienii on 27 Aug 2014, 05:30)

hoatienii wrote:
slboat wrote:

http://see.sl088.com/w/images/e/e4/Slboat_eos_4245.JPG

could you tell me the name of this

And please tell me pinout of 16 to 8 adapter. Thanks!

cindy.wijaya wrote:
alphasparc wrote:

Do you know if there is anyway we can solder in a socket instead of the SMT Flash so we can make it removable like the BIOS chip in a motherboard?

I make it dualboot rom with very cheap tools less than $1

[spoiler="cheap rom programmer"]http://img837.imageshack.us/img837/5536/rscn0071.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img12.imageshack.us/img12/3456/dscn0045uz.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img822.imageshack.us/img822/9769/dscn0057ep.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img703.imageshack.us/img703/6122/dscn0059i.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img201.imageshack.us/img201/5589/rscn0050.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img706.imageshack.us/img706/3924/rscn0058.jpg[/spoiler]
[spoiler="cheap rom programmer"]http://img819.imageshack.us/img819/7461/rscn0060.jpg[/spoiler]


i create a little tool to automatic flash but i haven't write full instruction yet big_smile
[youtube]http://www.youtube.com/watch?feature=pl … 1hKTlWtBoY[/youtube]
http://openwrt.agromapia.com/software/oWRHeX.exe

please give me, schematic sop16 to sop8. thanks!

hi all-

A h/w question for slboat or others; has anyone done the RAM or flash mod on similar TP-Link models such as the MR3040?  It would be even better to get a router with the WR703's capability plus built-in Li-on battery pack to run completely standalone.

(Last edited by anonym00se on 31 Aug 2014, 01:35)

I've tried to upgrade the flash on my WR703N but for some unknown reason it doesn't work. I have a recent version of this router and I wanted to upgrade the flash and put OpenWRT on it.
This is what I've got from the chinese gibberish page:
S-Ver=3.17.1 Build 140120 Rel.56593n
The version is consistent with the flash dump: 0x001FD00: 07 03 01 01 00 00 00 01

I've got the new u-boot from here: https://github.com/pepe2k/u-boot_mod
I've downloaded my cross-compiler packages

ii  binutils-mips-linux-gnu                2.24.51.20140903-1                              
ii  cpp-4.4-mips-linux-gnu                4.4.5-8
ii  gcc-4.4-base-mips-cross              4.4.5-8                                          
ii  gcc-4.4-mips-linux-gnu                 4.4.5-8
ii  gcc-4.4-mips-linux-gnu-base        4.4.5-8                                          
ii  libc-bin-mips-cross                        2.11.2-10
ii  libc-dev-bin-mips-cross                 2.11.2-10                                        
ii  libc6-dev-mips-cross                     2.11.2-10
ii  libc6-mips-cross                        2.11.2-10                                        
ii  libgcc1-mips-cross                        1:4.4.5-8
ii  libgomp1-mips-cross                    4.4.5-8                                          
ii  linux-libc-dev-mips-cross              2.6.32-30

Then I've issued  'make tplink_wr703n'
Apart from a few warnings like:

  • Warning: .gnu_attribute 4,3 requires `softfloat' 

  • Warning: u-boot uses -mhard-float (set by cpu/mips/start.o), common/libcommon.a(exports.o) uses -msoft-float

everything went fine.

> Preparing compressed U-Boot image "u-boot.lzimg"...
    Image Name: u-boot image
        Created: Thu Oct  2 00:41:51 2014
    Image Type: MIPS Linux Firmware (lzma compressed)
     Data Size: 47242 Bytes = 46.13 kB = 0.05 MB
  Load Address: 0x80010000
   Entry Point: 0x80010000
> Preparing 64KB file filled with 0xFF...
> Copying U-Boot image...
> U-Boot image ready, size: 65536 bytes

I haven't changed the DEFAULT_FLASH_SIZE_IN_MB because I'm using a supported Winbond 25Q128FV chip which is automatically detected.
I've then combined the  uboot_for_tp-link_tl-wr703n.bin with the data and art areas from the original chip dump (as instructed by the wiki with the art at the end of the image) and flashed it into my new chip with an external programmer. After soldering the chip in place I can't get any reply from 192.168.1.1 (ICMP or UDP). I've tried keeping the reset pressed for various amounts of seconds with no result.

Also worth mentioning is that the blue LED only stays lit for half a second after each power up.
Any ideas what I've done wrong?
Should I try a precompiled u-boot like this one original_u-boot_images/tp-link_wr703n_v1_120228.bin instead?

(Last edited by zelea2 on 2 Oct 2014, 02:59)

Best would be to check the serial output now.

You don't need to compile from source.

To eliminate a source of possible error that you're having, you can download his pre-compiled binaries at http://www.tech-blog.pl/pliki/u-boot_fo … e2k.tar.gz .  I've used it successfully on my 3020's and 703N's.

xciton wrote:

To eliminate a source of possible error that you're having, you can download his pre-compiled binaries at http://www.tech-blog.pl/pliki/u-boot_fo … e2k.tar.gz .  I've used it successfully on my 3020's and 703N's.

That's what I've used in the end. The binaries seems a litle bit out of date (they are more that a year old) but at least they work.
I now have 16MB of flash and 64MB of RAM in all my three WR703N (various versions).

This means there is a problem with the default MIPS chain tools from debian unstable (if there is no bug in the current git image).

with a little upgrade,now it support bb version very well
http://see.sl088.com/w/images/d/d1/SLboat-Mac-Screen_2014-11-02_7.00.22.jpg

I'm trying to replace 2MB flash in a 702n router with 8MB chip. So I've done the following:

1. Cloned https://github.com/pepe2k/u-boot_mod.git, modified the makefile to work with openwrt toolchain, compiled uboot for wr703n, here's the md5:

 3eeecc9c1a2654e00aee6876f0dc23ed *uboot_for_tp-link_tl-wr703n.bin

2. Dumped original image with an SPI programmer.
3. Extracted code from 2MB chip by partitions mentioned in this topic:

dd bs=1 skip=0             count=$((64*1024))            if=702n.bin of=702.orig/uboot.bin
dd bs=1 skip=$((64*1024))  count=$((64*1024))            if=702n.bin of=702.orig/data.bin
dd bs=1 skip=$((128*1024)) count=$(((2*1024-64*3)*1024)) if=702n.bin of=702.orig/factory.bin
dd bs=1 skip=$(((2*1024-64)*1024))                       if=702n.bin of=702.orig/art.bin

4. Filled 8MB image with new uboot, original data, factory and art partitions:

dd                            of=702n8m.bin if=uboot/uboot_for_tp-link_tl-wr703n.bin
dd seek=$((64*1024))          of=702n8m.bin if=702.orig/data.bin
dd seek=$((128*1024))         of=702n8m.bin if=702.orig/factory.bin
dd seek=$(((8*1024-64)*1024)) of=702n8m.bin if=702.orig/art.bin

5. Flashed this image to a 8MB chip, soldered it...

And it doesn't work. The green LED (the one that's blue on 703) works at half brightness, network interface doesn't go up. If I solder original chip back it works.

So I have two questions at this point:
1. What am I missing, what am I doing wrong?
2. How to debug this?

(Last edited by hryamzik on 21 Apr 2015, 21:45)

You have to check u-boot log.
To do this first you have to make your router serial port mod.
Then connect with a USB serial (TTL)
open a terminal (minicom/putty) and set Baud rate: 115200, 8 bit data, 1 stop bit, flow control none.
then power up the router and see u-boot log.

You can make a try with your original u-boot instead modified one.

dd                            of=702n8m.bin if=702.orig/uboot.bin

/jags

(Last edited by jagspaul on 3 May 2015, 19:24)