TP-Link TD-W8970B Flash mod

Hi there,

I just want to know if you can put 64Mb internal Flash in TP-Link TD-WW8970B?

Regards,
Flávio Queirós

Likely quite a challenge as the addressing for SPI-NOR is typically different over 16 MB. If that is the case, it would probably require a new boot loader and new or differently configured drivers for the flash.

Can you explain a little deep what you are saying?

See, for example https://www.micron.com/products/nor-flash/serial-nor-flash/mt25q

Typically you go from three- to four-byte addressing, so one or more of the following likely wouldn't be able to even read from the chip:

  • First-stage boot loader
  • U-Boot
  • OS

2(3 * 8) = 16,777,216

1 Like

What i want to know is how much flash can the router handle?

Simply? No more that it shipped with.

Any more than that will be a “project” which could consume tens or hundreds of hours, potentially with no improvement. Lack of access to first-stage boot loader at all, or code to replace the SBL (“U-Boot”) may make anything over 16 MB effectively impossible for anyone without OEM-level access to closed or proprietary sources.

1 Like

Ok, jeff! But in the openwrt page dedicated to TP-Link TD-W8970B is a 16Mb Flash mod. Because of that i open this forum thread!!!

The 16 MB change is already complex, and will require you to run self-built firmware. Past 16 MB will likely be even more complex, probably requiring low-level modifications to the boot loaders and OS drivers, which may not be possible.

If you research all that is involved and have specific questions, those can be addressed. In general, this falls under “If you have to ask if you can, you can’t.”

1 Like

Ok, Thanks very much for the replies and knowledge!!!
Regards,
Flavio Queiroz

Here's the kinds of complexities one would have to deal with crossing 16 MB.

The first two are the ones that are, in my opinion, most challenging (to "impossible") to resolve.

PBL -- Primary Boot Loader

When the chip starts, it will find "the" flash, and load the secondary boot loader (SBL, often U-Boot) from the flash, then jump to the SBL's entry point.

If the flash chip is not recognized by the PBL based on its manufacturer and device ID (MID, DID), this may fail entirely.

If the flash chip doesn't have a "compatibility" mode that makes it look like a sub-16 MB chip, the PBL may be unable to read data from it at all.

Changing the PBL in any way may be impossible as it is often part of the gates in the chip itself in a way that is not really "writable".

SBL -- Secondary Boot Loader, "U-Boot"

The SBL needs to be able to set up the chip's internal registers, read the kernel from the flash, pass parameters to it, and start the kernel.

Same issues with recognizing the flash and addressing. Source code, low-level experience with embedded devices, and a good knowledge of the SoC in hand would generally be needed to change the SBL.

Kernel split

OpenWrt generally splits the firmware into kernel, ROM, and overlay. If the kernel was separate in low-address memory, this would need to be changed. If everything was pushed up to high addresses, the SBL probably would need to load another boot loader that could then load from high addresses.

Changing from unified kernel/ROM/overlay to separate kernel and ROM/overlay, or using a custom third-stage boot loader would require changes to the sysupgrade process and make TFTP recover or the like a multi-step process (as would be the first flashes of the device).

Driver Firmware Load

The drivers load firmware from flash. Unknown if they could load from a higher address space. Likely best to leave them where they are.

OS Flash ("MTD") Drivers

It is possible that the MTD drivers would recognize the chip from its MID and DID and adapt. If not, they you'd need to customize either or both the driver and the chip definitions for the driver.

2 Likes