OpenWrt Forum Archive

Topic: TP-Link TL-WR841N Flash Upgrade with Raspberry Pi as Programmer

The content of this topic has been archived on 12 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

It has already been described how to upgrade to 8MB or 16MB flash using the EZP2010 USB programmer. For those who do not own such a programmer (EZP2010) or an AVR ISP at 3.3V, but a Raspberry Pi, this way works:

Chip replacement: I used a Winbond 25Q128 SPI flash from an Arduino flash extension. For connecting the flash to the Raspberry, an IC test clip is quite convenient. The cabling is as follows:

W25Qx 8-pin SOIC   Raspberry Pi 3 J8        
  1 (/CS)            24 (SPI0 CS0/CE0)
  2 (DO, MISO)       21 (SPI0 MISO)
  3 (/WP)            17 (3.3V)
  4 (GND)            25 (GND)
  5 (IO, MOSI)       19 (SPI0 MOSI)
  6 (CLK)            23 (SPI0 SCLK)
  7 (/HOLD)          17 (3.3V)
  8 (Vcc)            17 (3.3V)

See the W25Qx datasheet for pin numbering. Other Raspberry Pi models may require other pins, check their description.

We use flashrom for programming but we have to solve some dependencies on Raspbian beforehand:

$ sudo apt-get install libusb-0.1 libusb-dev libusb-1.0

Download, compile and install flashrom:

$ wget
$ tar xvjf flashrom-0.9.9.tar.bz2
$ cd flashrom-0.9.9
$ make -j4
$ sudo make install

You may delete flashrom-0.9.9 and flashrom-0.9.9.tar.bz2 afterwards.
To access the SPI bus, enable it in raspi-config (Advanced Options, SPI) and reboot.

Desolder the flash from the router and connect it to the raspberry (leaving the flash on the board and reading did not work for me). Perform a test:

$ flashrom --p linux_spi:dev=/dev/spidev0.0
flashrom v0.9.9-r1955 on Linux 4.4.34-v7+ (armv7l)
flashrom is free software, get the source code at <LINK>

Calibrating delay loop... OK.
Found GigaDevice flash chip "GD25Q32(B)" (4096 kB, SPI) on linux_spi.
No operations were specified.

If this worked, we can now read the flash's content and safe it:

$ flashrom --p linux_spi:dev=/dev/spidev0.0 -r openwrt.bin

For the 4MB original flash, this took about two minutes. If we use this image to write it on the larger flash, we get Error: Image size (4194304 B) doesn't match the flash chip's size (16777216 B)! Therefore, we just make the file to fit the expected size. In my setup, the old flash is 4096kB and the new is 16384kB. Thus, we have to enlarge the openwrt.bin by 16384kB - 4096kB = 12288kB:

$ truncate -s +12288K openwrt.bin

Now, connect the new flash to the raspberry and write the enlarged file:

$ flashrom --p linux_spi:dev=/dev/spidev0.0 -w openwrt.bin

This took about 32 minutes. Maybe a memory layout can be used to just write the first 4 MB. Maybe dd is also an option to make this faster. However, using the openwrt.bin which was read with flashrom and dd'ed on the new chip did not work as the router did not boot afterwards. I guess you also have to get the image with dd in the first place.

After soldering the new flash to the router and booting it, we can verify:

root@openWRT:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                   12.6M    708.0K     11.9M   6% /
/dev/root                 2.3M      2.3M         0 100% /rom
tmpfs                    14.0M     40.0K     13.9M   0% /tmp
/dev/mtdblock3           12.6M    708.0K     11.9M   6% /overlay
overlayfs:/overlay       12.6M    708.0K     11.9M   6% /
tmpfs                   512.0K         0    512.0K   0% /dev

Happy Modding!

You miss to move the ART-partition to the end of the flash memory, which is where it is expected. I think the boot-log should give an indication of that location. This wiki entry explains it pretty good.

(Last edited by MBS on 22 Jan 2017, 02:19)

The discussion might have continued from here.