Overclocking router devices

The reason why I started this thread is to combine all information regarding overclocking from the OpenWrt Forums as well as other sources.
This is a running thread so hopefully any new information can be added as part of discussion.

Why Overclock?

  • To squeeze more performance out of your device if your ISP subscription is 200Mbps and currently your router is hitting 180Mbps perharps you can reach 200Mbps with a little overclocking
  • Overclocking improves Wireless performance since WPA2-AES encryption is de-facto standard, computing power is required
  • Because you can, people have been overclocking ever since the old Intel Celeron Era, it is fun

Manufacturers do not test each chip individually so maximum stable clock difers from chip to chip as well from board revision to board revision.
You want to increase the clock rate and keep the stability.

General strategy for Overclocking

  1. Increase by Minimum Stepping (Depending on SoC Architecture) Eg. +10MHZ
  • do memtester, do iperf test over LAN/WAN, do iperf test over WiFi
  • test using heavy bittorrent workloads
  • If it does not crash/reboot suddenly you can repeat step 1
  • If it crash, reverse the last working value and that is the safe limit

AR71xx MIPS Overclocking
AR71xx MIPS is very overclocking friendly, clockspeed is determined by a register value initialised in the uboot
There are 3 Clock Parameters
-CPU
-DDR
-AHB

There are currently 2 types of AR71xx MIPS:

The old eg. AR7240, AR7100, AR9132, AR7242, AR7241
For these Routers all 3 Parameters are tied together meaning
eg: CPU = 400MHZ, DDR = CPU = 400MHZ, AHB = DDR/2 = 200MHZ

The new eg, AR9344, AR9341
For these Routers all 3 Parameters are NOT tied together meaning
eg: CPU = 535MHZ, DDR = 400MHZ, AHB = DDR/2 = 200MHZ

General strategy for AR71xx MIPS Routers (for uncompressed uboot)

  • Backup your uboot
  • Open the uboot using a HEX Editor
  • Search for unique hex value string loading the clockspeed value in the uboot
  • Replace the string by incrementing the value and save to another copy
  • Overwrite the uboot with the modified copy
5 Likes

Backing up uboot

First you have to find your uboot, SSH into the router and
root@lede:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "u-boot"
mtd1: 00010000 00010000 "dtb"
mtd2: 002a0000 00010000 "kernel"
mtd3: 00ce0000 00010000 "rootfs"
mtd4: 009b0000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00010000 00010000 "caldata"
mtd7: 00f80000 00010000 "firmware"

mtd0 is usually the uboot

Then copy out mtd0 using dd to /tmp/ as in LEDE /tmp is a RAM mounted directory
root@lede:~# dd if=/dev/mtd0 of=/tmp/uboot.bin
256+0 records in
256+0 records out

Then using SCP copy out uboot.bin into a PC you can hex edit with

Flashing uboot

Please note that if the uboot is corrupted you need to reprogram the Flash Chip using an external programmer.

In LEDE important partitions like uboot are protected by default, this is a good thing.
To flash the uboot your have to disable Read-Only protection in the flash layout
In TP-Link Routers the file that controls this is tplinkpart.c
https://git.lede-project.org/?p=source.git;a=blob_plain;f=target/linux/ar71xx/files/drivers/mtd/tplinkpart.c;hb=refs/heads/master

parts[0].name = "u-boot";
parts[0].offset = 0;
parts[0].size = offset;
parts[0].mask_flags = MTD_WRITEABLE; <-- Remove this line and compile to Enable Write

After that sysupgrade using the firmware you compile and the partition will be Write Enabled.

Overwriting new uboot

After that you can use tools such as mtd to write the new uboot
mtd -r write uboot_new.bin u-boot

1 Like

are you sure the "increase by 10" methodology works for all routers (or just ar*)?

I know that on some Broadcom devices ( r7000, ac68u) we had to step in 200mhz increments as that's what the chipset supported.

with that said, I have an r7000 that has a 200mhz oc for a few years now, no issue. (so I baked it into the cfe)

For AR9341 device with 25MHz crystal (like MR3420V2)
In HEX-editor search line "3C 0C 29 AC 3C 0D 2A 80 " and replace "AC" to "E0" for 600MHz.
"+1 hex" = "+1.25MHz CPU clock".
i.e. 29ACh=535MHZ, 29E0h=600MHz, 2A30h=700MH

2 Likes

For AR7241 device (like MR3420V1)
In HEX-editor search line "37 39 08 28 03 19 C0 25 " and replace "28" to "29" for 410MHz.
"+1 hex" = "+10MHz CPU clock".
i.e. 0828h=400MHZ, 0829h=410MHz, 082Ah=420MHZ

In the uboot there are 2 occurrence of this sequence you need to replace.

1 Like

Disclaimer, I'm not a fan of driving devices outside their operating window anyways, but...

Especially today's higher end devices with arm or mips SOCs might already get quite hot under load with normal clock frequencies, sometimes even too hot for continuous load, so special care needs to be taken for the cooling.

In regards to RAM, especially embedded devices often use bottom of the range RAM, "because it's cheap(er)", so this isn't quite safe to clock either; likewise the vendors don't always put much emphasis on their PCB layout (length/ impedance matching of the RAM traces, etc.).

Finding the correct (respectively safe) operating points for modern hardware isn't really easy, to accomplish this, you really need to know how you can stress-test the SOC to the max (running benchmarks isn't always sufficient, as this doesn't necessarily stress all IP cores on the SOC at the same time/ to the maximum - additionally the results of these stress tests also needs to be checked for silent data corruption) and you also need to be know the quirks and shortcuts of your PCB design. To get reasonable results, you also need to evaluate many boards from several batches to get a reliable trend. At home overclocking is easier in the x86 arena, because the vendors see it as an advertising revenue and add safeguards to the boards and CPUs, preventing the worst, but for embedded devices this is usually missing.

1 Like

FYI this is from my Production Router

[    0.000000] Clocks: CPU:430.000MHz, DDR:430.000MHz, AHB:215.000MHz, Ref:5.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 8889583473 ns
[    0.000012] sched_clock: 32 bits at 215MHz, resolution 4ns, wraps every 9988295677ns
[    0.007780] Calibrating delay loop... 286.46 BogoMIPS (lpj=572928)
[    0.046408] pid_max: default: 32768 minimum: 301
[    0.051166] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.057761] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.067641] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.078161] NET: Registered protocol family 16
[    0.084094] MIPS: machine is TP-LINK TL-WR1043ND
[    0.361311] clocksource: Switched to clocksource MIPS

[    0.000000] Clocks: CPU:700.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
[    0.000008] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
[    0.008839] Calibrating delay loop... 349.18 BogoMIPS (lpj=698368)
[    0.043898] pid_max: default: 32768 minimum: 301
[    0.049259] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.056772] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.067120] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.078788] NET: Registered protocol family 16
[    0.085120] MIPS: machine is TP-LINK TL-MR3420 v2
1 Like

i've tested 800/600/300 MHz clocks on TL-MR22U and the chip got just a bit warmer than usual, maybe if you have some QCA9531 board the same u-boot will work too: http://bit.do/cH6xC

of course don't flash this if you don't know what your'e doing

If you share binaries, please add also information where the code come from: https://github.com/pepe2k/u-boot_mod :slight_smile:

1 Like

Thanks! I just flashed 720/450/225 and I see memtester errors. However, CPU has been rock solid in the past hour, running memtester, stress with >95% CPU usage at 720mhz. Trying out 720/400/200 now for WDR3600. By any chance, could you help make an image for 720/425/225 for WDR3600- just downclocking the memory a bit? I know I'm reviving an old thread and any help would be appreciated!

Is possible overclock the wr841nd v11?

Hi @gwlim

I don't know how to find cpu speed value in hex ? Pls explain for me.
My cpu router is Lantiq xway ar9 333mhz (buffalo wbmr-hp-g300h), it is possible to oc ?

Yep, this using ar9533 cpu. same of ar9341/44. Or you can using @pepe2k u-boot mod.

The wr841nd v11 use the QCA9533-AL3A i seeking about the corrispondence 3C 0C 29 AC 3C 0D 2A 80
but on my uboot i find 3C 0C 00 3C 35 8C 10 3F.
Some help is appreciated.

I don't know XWAY CPU Register values, you have to find it.

and about the QCA9533-AL3A?

Solved, I install https://breed.hackpascal.net/ bootloader. Now my wr841nd v11 run at 800Mhz cpu, 450 ram, 225 ahb. mips 531,66.
thank's to @hackpascal

@peppeve Can you guide me, please? My router is wr841n v11.

that is such a stupid profile unless only concern is cpu overclock. i had to increase ram clock for 200 and ahb for 100MHz to get 20Mbps more out of usb port. what you gain with 50/25 mhz increase?

Originally the cpu was clocked to 650Mhz and 432 bogo mips now there is a big increment in lan speed.

Sun Oct 15 07:03:11 2017 kern.info kernel: [ 0.000000] Clocks: CPU:850.000MHz, DDR:450.000MHz, AHB:283.333MHz, Ref:25.000MHz
Sun Oct 15 07:03:11 2017 kern.info kernel: [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4497083404 ns
Sun Oct 15 07:03:11 2017 kern.info kernel: [ 0.000007] sched_clock: 32 bits at 425MHz, resolution 2ns, wraps every 5052902398ns
Sun Oct 15 07:03:11 2017 kern.info kernel: [ 0.008845] Calibrating delay loop... 566.06 BogoMIPS (lpj=2830336)