logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Tuya WR1 RTL8710BN/W302 module info - external flash size: GD25Q16 2MB and 4MB+ mod

divadiow 420 19
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • Helpful post
    #1 21873564
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    Here are a few points of interesting regarding the Tuya WR1 module, two of which I hold in my possession after a seller on Taobao sent me these by 'mistake' instead of what I ordered, a WRG1 - RTL8711AM.

    The WR1 Tuya page is here https://developer.tuya.com/en/docs/iot/wifiwr1module?id=K9605tc0k90t3 but if it ever gets retired, I attach the PDF and here's some basic info:

    The WR1 is a low-power embedded Wi-Fi module developed by Hangzhou Tuya Information Technology Co., Ltd. The module consists of a highly integrated RTL8710BN chip and external flash memory. It comes with a built-in Wi-Fi network protocol and a large number of library functions.

    The WR1 also includes low power ARM CM4F, WLAN MAC, 1T1R WLAN, a maximum frequency of 125MHz, built-in 256K SRAM, 1Mbyte flash, and a wealth of peripheral resources.


    Technical diagram of an electronic module: top and bottom views with dimensions and pin labels.

    I de-canned one to see the chip and confirm external flash size. I intend to replace the flash chip with something 4mb+ so I can burn flash dumps that are 4mb, eg: https://github.com/libretiny-eu/libretiny/issues/23#issuecomment-1255291754

    We see from an AmebaZ datasheet that 128MB is the maximum external flash supported.
    Comparison table of RTL8711BG/BN features with QFN68, QFN48, and QFN32 columns

    First, some pics of my modules and a dump of the flash chip. This RTL8710BN is labelled as a W302. Flash chip HJ1847, 25Q16CT, AP17086.

    Two small PCB electronic modules with a trace antenna, on a blue background
    Two black PCB boards with pin labels lying on a blue work mat
    Close-up of an electronic module with a PCB antenna and IC on a blue background

    2mb chip detection in NeoProgrammer with CH341A/clamp - C84015 / GigaDevice GD25Q16x, so not the 1mb expected.
    NeoProgrammer screenshot showing SPI memory hex dump and log with “IC not responding” and “Success”

    Small electronic module on a blue mat, held with tweezers; “WIFI” label visible.

    boot log from Log_TX pad
    Code: Text
    Log in, to see the code


    Dump: https://github.com/openshwprojects/FlashDumps/commit/edf21874f3cf0201b3e963890143e755671e3052

    Next I will donate a 4mb chip from a BW16.
    Attachments:
    • UM0113 Realtek Ameba-Z DEV 1v0 User Manual.pdf (1.45 MB) You must be logged in to download this attachment.
    • WR1 Module Datasheet_Tuya Developer Platform_Tuya Developer Platform.pdf (686.39 KB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #2 21873594
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    transplant success. 4mb (32mbit) BoyaMicro chip donated from BW16

    PCB with micro‑USB port and shielded module, pointed at by a soldering iron tip
    Close-up of a PCB section with ICs and “WIFI” marking, partly covered with a white residue Close-up of a PCB with an antenna and a desoldered integrated circuit placed beside it

    Screenshot of BK7231 Easy UART Flasher showing “Write complete!” and a flashing log.
  • ADVERTISEMENT
  • #3 21873666
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    Nice hack, can it now fit a huge LFS web page? Well, probably depends on LFS offset.

    You can also get larger flash sizes, for example from old laptop scrap boards. Or just order new chips...
    Helpful post? Buy me a coffee.
  • #4 21873711
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    p.kaczmarek2 wrote:
    You can also get larger flash sizes, for example from old laptop scrap boards. Or just order new chips...


    Yes, I have higher capacity chips, but I've found those pulled from old laptops or other device PCBs tend to be the wider SOIC-8 type whereas external flash beside RTL, XF16 etc MCUs tend to be the narrow type.

    Two black SOIC-8 IC chips on a blue surface, a larger one on top and a smaller one below.
  • ADVERTISEMENT
  • #5 21877773
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    managed to shoehorn a 64mbit wide SOIC8 Winbond onto the BW16. All tools fail CRC at write completion. I guess it doesn't like something about it

    Close-up of a purple PCB with a Wi‑Fi module, CH340C chip, and soldered pin headers
  • Helpful post
    #6 21877780
    insmod
    Level 31  
    Posts: 1362
    Help: 161
    Rate: 426
    I've got 32mbit Winbond 25Q32 in one of my BW16 (not E), it works just fine, even if it's significantly slower.
  • #7 21877783
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    hmm OK. that's good to know. im cleaning it up and will attempt to clamp onto it to see what protection bits are set if any. it's fresh off an Ali SPI module though, blank, so should be clear.
  • Helpful post
    #8 21877785
    insmod
    Level 31  
    Posts: 1362
    Help: 161
    Rate: 426
    I've got mine from some old motherboard, i think. I don't remember getting it, just that i've found it in storage.

    Close-up of an electronic module with a printed antenna and ICs on a black PCB
  • #9 21877787
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    nice. I fished a load of bits out of the recycling centre the other day, laptop, new router, HP dock - all 512k, 1mb, 2mb, 64k chips though :(

    Added after 30 [minutes]:

    checks out OK soldered back to CH341 breakout
    Screenshot of NeoProgrammer with hex view and log showing SPI flash W25Q64CV programming

    Added after 6 [minutes]:

    @insmod do you recall noticing if your chip has quad mode enabled in SREG2? not found the answer yet if supported on RTLD. I assume yes.

    Screenshot of “SREG” window with SREG1–SREG3 checkboxes, “Winbond” dropdown, and Read/Write buttons

    Added after 5 [minutes]:

    oh. maybe it should be disabled

    Screenshot of a datasheet table for Flash, GPIO, and IPC, with a yellow-highlighted note about QSPI support.

    https://files.seeedstudio.com/products/102110.../UM0401_RTL872xD_Datasheet_v3.4_watermark.pdf

    Added after 41 [minutes]:

    typical. re-solder and it's fine.
    Screenshot of BK7231 Easy UART Flasher showing “Write complete!” and a flashing log.


    I notice though that 'erase all' for RTL8720D erases only 2mb, whereas the erase before flash will erase the size of file being flashed, up to 8mb.
    Screenshot of BK7231 Easy UART Flasher showing “Erased!” and an operation log for COM3
  • Helpful post
    #11 21878326
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    divadiow wrote:
    nice. I fished a load of bits out of the recycling centre the other day, laptop, new router, HP dock

    Maybe something worth showing in our teardowns section? https://www.elektroda.com/rtvforum/forum519.html With flash analysis



    divadiow wrote:

    I notice though that 'erase all' for RTL8720D erases only 2mb, whereas the erase before flash will erase the size of file being flashed, up to 8mb.
    Screenshot of BK7231 Easy UART Flasher showing “Erased!” and an operation log for COM3

    Fixes by @insmod merged, @insmod any other PRs of flasher can be merged?
    Helpful post? Buy me a coffee.
  • #12 21878335
    insmod
    Level 31  
    Posts: 1362
    Help: 161
    Rate: 426
    >>21878326
    Don't know, but probably both of them.
    They look good at first glance, but i didn't test them.

    For OBK:
    https://github.com/openshwprojects/OpenBK7231T_App/pull/2073 (RTL8720D ota fixes)
    https://github.com/openshwprojects/OpenBK7231T_App/pull/2074 (RTL8721DA bt proxy, for dual band gateway that i'm currently testing)
    https://github.com/openshwprojects/OpenBK7231T_App/pull/2069 (GCC, i think it's ready to merge, @divadiow did more tests and everything was fine)
  • #13 21878337
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    https://github.com/openshwprojects/OpenBK7231T_App/pull/2069#pullrequestreview-4061527287
    has merge conflicts
    Helpful post? Buy me a coffee.
  • #14 21878463
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    p.kaczmarek2 wrote:
    Maybe something worth showing in our teardowns section? https://www.elektroda.com/rtvforum/forum519.html With flash analysis


    Hmm. Could have done. Kinda made a mess of them all now and didn't keep track of which chips came from where. I did dump them all though. They'll be in flashdumps eventually probably.

    Stresses me out having too much junk and so little storage.

    Computer electronic circuit boards in an anti-static bag, with a black vented module in a case.

    I'll make a 'crap I found at the tip' thread for the next haul
  • #15 21878464
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    You can also try LLM-assisted flash dump analysis, if you still have flash chips there. CPU architecture, string constants, etc.
    Helpful post? Buy me a coffee.
  • #16 21878465
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    the 'tip' = slang for the rubbish dump, recycling centre aka 'the dump'

    Added after 1 [minutes]:

    p.kaczmarek2 wrote:
    You can also try LLM-assisted flash dump analysis, if you still have flash chips there. CPU architecture, string constants, etc.


    oh indeed. I do this a lot. feed GPT Ghidra too to run headless. it's VERY fun. I'm working on the XF16 jpeg demo at the moment like this


    Screenshot of a “Recent” list showing items like “Claude.ai Analysis Review” and “A9 Camera Sensor Mapping”

    Added after 11 [minutes]:


    Document icon and the text “Silent Kement” on a white background
    :D
  • #17 21878471
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    Just double check to avoid giving false advice, I saw these kind of tools like to fake results sometimes, or at least describe the used methodology upfront.

    What kind of AI tool is that? If you want, I can try to run my tools and we'll compare results.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #18 21878482
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    p.kaczmarek2 wrote:
    Just double check to avoid giving false advice, I saw these kind of tools like to fake results sometimes, or at least describe the used methodology upfront.

    oh for sure. I take everything it comes out with with a pin of salt. Evidenced facts accepted only, repeat analysis etc etc

    It's just one of my ChatGPT 5.4 Thinking project folder trees. XF16 analysis was feeding it SDK, Ghidra and XF16 dump...

    ChatGPT screenshot with chat list on the left and notes about I2C0/CSI pinmux changes and a ZIP file in the main text.
  • #19 21878545
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14454
    Help: 650
    Rate: 12453
    I don't use web services anymore. Can it use Python as a tool?>
    Helpful post? Buy me a coffee.
  • #20 21878948
    divadiow
    Level 38  
    Posts: 4890
    Help: 427
    Rate: 869
    p.kaczmarek2 wrote:
    Can it use Python as a tool?

    can GPT create its own Python for use in a session on a given task? yes, seems to be pretty flexible with creating whatever it needs to carry out a task
Reply | New topic
Report a violation of the law

Topic summary

✨ The Tuya WR1 module is a low-power embedded Wi-Fi device based on the RTL8710BN chip, featuring an ARM Cortex-M4F core, 256KB SRAM, 1MB internal flash, and external flash memory. It supports 1T1R WLAN at up to 125MHz and includes extensive peripheral resources and Wi-Fi protocol libraries. The module's external flash chip was identified as a GD25Q16 with a 2MB capacity. A physical teardown confirmed this and enabled a successful modification by replacing the original flash with a 4MB (32Mbit) BoyaMicro flash chip sourced from a BW16 module, demonstrating compatibility and upgrade potential for increased external flash storage.
Generated by the language model.
Today's popular

FAQ

TL;DR: The Tuya WR1 discussed here shipped with a 2MB SPI flash, not 1MB, and a successful 4MB swap proved the board can take larger parts. As one poster put it, "transplant success." This FAQ helps WR1/BW16 modders verify flash size, choose donor chips, and avoid CRC or erase-limit surprises during upgrades. [#21873594]

Why it matters: WR1 and BW16 owners can unlock larger firmware, OTA, and LFS storage only if they verify the real flash chip, package fit, and tool limits first.

Option Capacity mentioned Result in thread Practical note
Original WR1 flash 2MB / 16Mbit Detected and dumped successfully Shipped larger than Tuya basic spec claimed
BoyaMicro donor from BW16 4MB / 32Mbit Worked after transplant Best proven upgrade in this thread
Winbond 25Q32 32Mbit / 4MB Reported working on BW16 Slower, but functional
Winbond wide SOIC-8 64Mbit / 8MB Initially failed CRC, later worked after re-solder Package/mechanical fit matters

Key insight: The biggest lesson is not the nominal flash limit. It is that real-world success depended on three things: the chip package fitting the board, correct soldering, and flasher behavior beyond 2MB.

Quick Facts

  • The opened WR1 used an RTL8710BN marked W302 with external flash identified as 25Q16 / GD25Q16-class, 2MB, even though the quoted Tuya basics listed 1Mbyte flash. [#21873564]
  • The boot log showed XTAL:40000000, FLASHRATE:4, and OTA2 ADDR[80d0000], confirming normal image selection and startup on the tested WR1. [#21873564]
  • A 4MB (32Mbit) BoyaMicro chip taken from a BW16 was soldered onto the WR1 and the swap was reported as successful. [#21873594]
  • On RTL8720D tools, "erase all" erased only 2MB, while "erase before flash" erased up to the flashed file size, reported as up to 8MB. [#21877787]
  • Scrap chips often came in wide SOIC-8, while RTL-side external flash footprints were described as the narrow type, which directly affected donor compatibility. [#21873711]

What flash size does the Tuya WR1 RTL8710BN/W302 module actually use, and why did NeoProgrammer detect a GD25Q16 2MB chip instead of the 1MB listed in Tuya's basic specs?

The tested WR1 actually used a 2MB SPI flash. NeoProgrammer identified it as C84015 / GigaDevice GD25Q16-class, which is a 16Mbit part, and the poster confirmed that with a physical decap and flash dump. The 1MB figure came from the quoted Tuya basic information, but this specific hardware sample shipped with a larger external flash than that summary stated. [#21873564]

How do you replace the external SPI flash on a Tuya WR1 module with a 4MB BoyaMicro chip from a BW16?

You replace it by moving a compatible 4MB donor SPI flash onto the WR1 footprint. 1. Remove the original 2MB flash from the WR1. 2. Donor a 4MB (32Mbit) BoyaMicro chip from a BW16 and solder it in place. 3. Recheck the board by reading or flashing the new part. The reported result was simple and decisive: "transplant success." [#21873594]

Why would a 64Mbit wide SOIC-8 Winbond flash fail CRC after writing on a BW16, even though a 32Mbit Winbond 25Q32 works for other users?

The failure can come from soldering or board-level compatibility, not just capacity. The 64Mbit wide SOIC-8 Winbond first failed CRC in all tools after write completion, but after cleanup and re-soldering the same setup was reported as fine. Another user also said a 32Mbit Winbond 25Q32 worked in a BW16, though it was "significantly slower," so the edge case here was bad physical integration rather than a hard 64Mbit ban. [#21877787]

How large an LFS web page can a modded WR1 or BW16 store after upgrading the flash, and how does the LFS offset affect the usable space?

The thread does not give a fixed maximum LFS page size. It states that a larger flash can fit a "huge LFS web page," but only if the LFS offset leaves enough free flash after firmware and OTA regions. That means usable LFS space grows with a 4MB or larger chip, yet the actual page size still depends on where LFS starts in the flash map. [#21873666]

What's the difference between narrow and wide SOIC-8 SPI flash packages, and why does package width matter when swapping flash chips on RTL8710BN or RTL8720D boards?

Narrow and wide SOIC-8 packages use the same 8-pin style, but the body width differs, which changes pad alignment and physical fit. The poster noted that scrap laptop chips were often the wider SOIC-8 type, while flash beside RTL and XF16-class MCUs was usually the narrow type. That matters because a wider body can be awkward to place, harder to solder cleanly, and more likely to cause contact issues on compact module footprints. [#21873711]

What is LFS in the context of OpenBK or Realtek-based modules, and how is it used for storing web pages or files in flash?

"LFS" is a flash-resident file system that stores small files in non-volatile memory, with the key characteristic that firmware can serve web pages or assets directly from SPI flash. In this thread, LFS came up as the place a larger WR1 or BW16 flash could hold a much larger web UI, provided the chosen LFS offset leaves enough free space. [#21873666]

What do OTA1, OTA2, and the OTA2 ADDR lines in the RTL boot log mean on a Tuya WR1 or BW16 module?

They indicate dual-image firmware boot selection and the address of the alternate OTA slot. The WR1 boot log showed OTA2 ADDR[80d0000], OTAx SELE[fffffffc], and OTA1 USE, which means the boot ROM found the OTA layout and chose the OTA1 image for startup. You can treat that sequence as a healthy sign that image metadata was readable and boot selection worked as expected. [#21873564]

How do you read and identify the external flash chip on a WR1 using a CH341A, clip, and NeoProgrammer?

You clip onto the SPI flash, connect it to a CH341A, and let NeoProgrammer probe the device ID. In the thread, the poster used a CH341A with a clamp and got C84015, which NeoProgrammer mapped to a GD25Q16-class 2MB chip. That gave both a practical chip identification and direct evidence that the WR1 sample did not contain the expected 1MB part. [#21873564]

Why does the RTL8720D flasher's 'erase all' operation only erase 2MB while 'erase before flash' can erase up to the size of the file, such as 8MB?

Because the tool behavior was limited by software, not by the physical flash alone. The poster observed that erase all on RTL8720D erased only 2MB, while erase before flash erased the amount needed for the file being written, reported as up to 8MB. A later reply linked a fix in BK7231GUIFlashTool, which shows the limit was a flasher-side issue that needed code changes. [#21877819]

Which is a better donor flash for these Realtek modules: a BoyaMicro chip from a BW16, a Winbond 25Q32 from scrap hardware, or a new SPI flash chip bought online?

The best proven donor in this thread was the 4MB BoyaMicro chip from a BW16. It was transplanted onto a WR1 and worked immediately. A 32Mbit Winbond 25Q32 also worked for another BW16 user, but was reported as slower, while the wide 64Mbit Winbond initially produced CRC errors until re-soldered. New online parts were suggested, but not tested here, so the strongest thread-backed choice is the BoyaMicro BW16 donor. [#21873594]

What is quad mode in SREG2 on Winbond SPI flash, and how can it affect compatibility with RTL8720D or RTL8710BN boards?

Quad mode is a flash status-register setting that changes how the chip uses extra data lines for faster transfers. In the thread, the poster explicitly checked whether the Winbond chip had quad mode enabled in SREG2, then noted documentation suggesting it might need to be disabled. That makes quad-mode state a practical compatibility check when a larger replacement flash behaves oddly on RTL boards. [#21877787]

How can you tell from the boot log on the Log_TX pad that a Tuya WR1 has booted correctly and selected the expected firmware image?

You can tell by a clean sequence from ROM banner to Image 2 entry and Wi-Fi init. The shown log included <RTL8195A>ROM:[V0.1], IMG1 ENTER, FLASH CALIB[NEW OK], OTA1 USE, ===== Enter Image 2 ====, and WIFI initialized. Those lines show clock setup, flash calibration, OTA slot choice, second-stage firmware handoff, and successful subsystem startup. [#21873564]

What does the AmebaZ documentation say about the maximum external flash size supported by RTL8710BN-class hardware, and how practical are larger flash upgrades in real devices?

The poster stated that the AmebaZ datasheet gives a maximum supported external flash size of 128MB. In practice, this thread only demonstrated smaller upgrades: a 4MB BoyaMicro swap worked, and 32Mbit and 64Mbit Winbond experiments were discussed on BW16-class hardware. That makes large theoretical limits less important than package fit, solder quality, and flashing-tool support in real devices. [#21873564]

How do BK7231GUIFlashTool and related fixes improve flashing and erase behavior for larger RTL8720D flash sizes?

They remove tool-side limits that blocked correct handling of larger flashes. After the poster found that erase all stopped at 2MB while file-based erase could reach 8MB, another reply linked a BK7231GUIFlashTool fix pull request. Later discussion also mentioned RTL8720D OTA fixes and related merge work, which shows active maintenance around larger-flash handling and Realtek support. [#21877819]

What is Ghidra headless analysis with GPT or LLM-assisted flash dump analysis, and how can it help identify CPU architecture, strings, and firmware details from SPI flash dumps?

"LLM-assisted flash dump analysis" is a reverse-engineering workflow that feeds firmware dumps and tooling context into an AI system, with the key characteristic that it helps classify architecture, inspect strings, and guide deeper static analysis. In the thread, this was described as using GPT with Ghidra headless, SDK material, and flash dumps to analyze firmware details, while still requiring evidence checks because false advice can occur. [#21878482]
Generated by the language model.
ADVERTISEMENT