TP-link Archer C7 v4/v5 root partition increase fails after flash resolder

niktr · March 23, 2026, 6:30am

Hi,
I resoldered flash on my TP-link Archer C7 v4/v5 (https://openwrt.org/toh/tp-link/archer_c7) to 128MB size aiming to have more space for SW. And faced with the problem when I can't actually properly allocate full flash size.
I was trying ImageBuilder with ROOTFS_PARTSIZE option and shifting reg ranges for user-config and later partitions in DTS (ath79/dts/qca9563_tplink_archer-c7-v4.dts). None helped. Still has ~7MB.
Would you please point me how to actually use full 128MB size of flash?
Thanks.

frollic · March 23, 2026, 6:36am

Use standard layout, allocate the extra space as extroot ?
Then you won't have to use custom images.

niktr · March 23, 2026, 6:58am

I do not see extra space as device. Should I?
Thus can't allocate it anyhow.

frollic · March 23, 2026, 7:23am

After doing what ?

When doing it your way, have you also moved the ART partition (and what not) to the far end of the flash ?

Btw, this will most likely not work, since IB knows what the real size is supposed to be,

niktr · March 23, 2026, 8:38am

After any combination of two steps described in initial message. IE dts and ROOTFS_PARTSIZE change.

I have not moved ART partition for v5 and have it moved for v4. Moving calibration data is dangerous and need to be revisited. But as written below this change was not reflected in final FW at all. The part I moved for v5 was default-config which is mtd10.
The only changes I made for v5 in 25.12.1

diff ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v5.dts.orig ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v5.dts
92c92
< 	partition@ff0000 {
---
> 	partition@7ff0000 {
94c94
< 		reg = <0xff0000 0x010000>;
---
> 		reg = <0x7ff0000 0x010000>;

The only changes I made for v4 in 25.12.1

diff ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts.orig ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts
226c226
< 			partition@FF0000 {
---
> 			partition@7FF0000 {
228c228
< 				reg = <0xFF0000 0x010000>;
---
> 				reg = <0x7FF0000 0x010000>;

But those changes have not been reflected in built FW at all as per squashfs-factory.bin file header (squashfs-sysupgrade.bin does not have this info in header). I tried to randomly change addressing for other partitions. Did not succeed also.
Seems like I missing another place to play around addressing (Or maybe caching issues. But I was starting from scratch several times. Thus not very likely.)

Indeed it did not work.

Initially I was inspired by this topic Upgrade TP-link_TL-WDR4300 from 8M to 16M flash - #4 by Hostle but obviously did not quite succeed.

Hostle · March 23, 2026, 11:29am

how are you editing the dts ? sounds like your changes are getting wiped before the build. Make edits to the dts in the build_dir (this saves you from recompiling kernel each time and your changes should stick), and check the dts right after the build to see if changes are still present . I think you'll need a full build system setup also, image builder is not well suited for this task

hailfinger · March 23, 2026, 12:17pm

128 MB or 128 Mbit? The latter would only be 16 MB.

niktr · March 23, 2026, 1:24pm

there is an openwrt-imagebuilder-25.12.1-ath79-generic.Linux-x86_64/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts patch for which showed in privious message
also there is a prebuilt DTB file which came with IB archive openwrt-imagebuilder-25.12.1-ath79-generic.Linux-x86_64/build_dir/target-mips_24kc_musl/linux-ath79_generic/image-qca9563_tplink_archer-c7-v4.dtb which I decoded to DTS with dtc -I dtb -O dts ./build_dir/target-mips_24kc_musl/linux-ath79_generic/image-qca9563_tplink_archer-c7-v4.dtb > ~/image-qca9563_tplink_archer-c7-v4.dts made respective changes to ~/image-qca9563_tplink_archer-c7-v4.dts and built it back to DTB with dtc -O dtb -o ./build_dir/target-mips_24kc_musl/linux-ath79_generic/image-qca9563_tplink_archer-c7-v4.dtb ~/image-qca9563_tplink_archer-c7-v4.dts
Maybe squashfs-factory.bin wrong place to look for a proper MTD? But I would expect it has partitioning from exact custom build in a header.

frollic · March 23, 2026, 1:28pm

there's also Increasing flash size without build my own firmware.

niktr · March 23, 2026, 1:31pm

Original Archer C7 v4/v5 already come with 16MB. No point in resoldering one to another the same size. Resoldered flash is 128MB or 1Gbit. To be precise W25Q01JVZEIM. In router dmesg it shows up properly as 128MB.

niktr · March 23, 2026, 1:35pm

Thanks. I saw this also.
Will give it another try.

Hostle · March 23, 2026, 3:18pm

I think image builder ignores changes ... i may be wrong, I never use it so my knowledge of it is little. But if the changes are not taking, I would explore the full build system, this is typical usage. For better or worse the edits will take if done correctly using the build system

niktr · March 23, 2026, 5:14pm

Seems like you are right. All my experiments with IB failed. Whether my success criteria (header of squashfs-factory.bin file) wrong or IB is useless for such customization. From other hand - why to put DTB and DTS files if those makes no effect.
I started building from scratch per https://openwrt.org/docs/guide-developer/toolchain/use-buildsystem with respective changes to openwrt/target/linux/ath79/dts/qca9563_tplink_archer-c7-v4.dts file. It takes time. Will see if it helps.

hex · March 23, 2026, 5:17pm

niktr:

diff ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v5.dts.orig ./target/linux/ath79/dts/qca9563_tplink_archer-c7-v5.dts
92c92
< 	partition@ff0000 {
---
> 	partition@7ff0000 {
94c94
< 		reg = <0xff0000 0x010000>;
---
> 		reg = <0x7ff0000 0x010000>;

Don't you also need to change the size of the firmware partition? As in changing the following in the v5 dts

reg = <0x0c0000 0xf00000>;

to

reg = <0x0c0000 0x7f00000>;

Or am I misunderstanding the goal here?

frollic · March 23, 2026, 5:17pm

Not tried it myself, perhaps you could create a patch file for the DTS, place it in the patches folder ?

niktr · March 23, 2026, 5:28pm

Probably so. Definitely need to change partitions sizes also.
But current problem how I see it is what none changes in DTS applied to FW.

hex · March 23, 2026, 6:07pm

Do you have an example of what you're looking at?

niktr · March 23, 2026, 6:27pm

Shortened version of header. Per my understanding "partition radio base" should be starting from 0x7ff0000 after changing DTS.

head -n 30 openwrt-25.12.1-ath79-generic-tplink_archer-c7-v4-squashfs-factory.bin
fwup-ptn partition-table base 0x00800 size 0x00800	
fwup-ptn soft-version base 0x01000 size 0x00019	
fwup-ptn support-list base 0x01019 size 0x0028c	
fwup-ptn os-image base 0x012a5 size 0x29b65e	
fwup-ptn file-system base 0x29c903 size 0x480004	
fwup-ptn extra-para base 0x71c907 size 0x0000b	
partition factory-boot base 0x00000 size 0x20000
partition fs-uboot base 0x20000 size 0x20000
partition os-image base 0x40000 size 0x29b65e
partition file-system base 0x2e0000 size 0xbe0000
partition default-mac base 0xf00000 size 0x00200
partition pin base 0xf00200 size 0x00200
partition device-id base 0xf00400 size 0x00100
partition product-info base 0xf00500 size 0x0fb00
partition soft-version base 0xf10000 size 0x00100
partition extra-para base 0xf11000 size 0x01000
partition support-list base 0xf12000 size 0x0a000
partition profile base 0xf1c000 size 0x04000
partition default-config base 0xf20000 size 0x10000
partition user-config base 0xf30000 size 0x40000
partition qos-db base 0xf70000 size 0x40000
partition certificate base 0xfb0000 size 0x10000
partition partition-table base 0xfc0000 size 0x10000
partition log base 0xfd0000 size 0x20000
partition radio base 0xff0000 size 0x10000
soft_ver:1.0.0
�SupportList:
{product_name:Archer C7,product_ver:4.0.0,special_id:00000000}
{product_name:Archer C7,product_ver:4.0.0,special_id:41550000}
{product_name:Archer C7,product_ver:4.0.0,special_id:45550000}

General question. Maybe a bit late but still.
How do I check the partition (addresses) table OpenWRT FW without flashing it to actual device? Maybe simulation?

niktr · March 23, 2026, 6:45pm

Built succeed.

PRO: target-mips_24kc_musl/linux-ath79_generic/image-qca9563_tplink_archer-c7-v4.dtb has my changes. This might mean what IB method with manual change to DTB works
PRO: proved what IB does not look into DTS files it has and does not rebuild DTBs. (Maybe need some extra flag to make image???)
CON: squashfs-factory.bin still has wrong address in header -> most likely criteria I am looking at is wrong. Thought I still can't understand where address value for it is taken from
CON: I do not know how to perform at least sanity check of the FW partitioning without actually flashing it to device
CON: ART partition need to be filled properly before flashing to device. Not clear how do I check this before flash

hex · March 23, 2026, 7:10pm

Extract the DTB from the image you built and decompile it back into DTS? Something like binwalk -e on the OpenWRT image and another binwalk on the decompressed LZMA data to get the offset and size of the flattened device tree, then do a dd with the offset and size, then decompile with dtc.
For example, with the factory image for Archer C7 v5 downloaded from the Firmware Selector,

binwalk -e factory.bin
cd factory.bin.extracted
binwalk 227B

The 227B here is the hexadecimal offset of the LZMA data section in factory.bin. If you only see a .7z file, decompress that and binwalk the product instead. At this point, you should see a flattened device tree. Take note of its offset and size. Then run

dd if=227B of=extracted.dtb bs=1 skip=<offset> count=<size>
dtc -I dtb -O dts extracted.dtb -o extracted.dts

Now you read extracted.dts.

Not sure if there's an easier way though.