The reason why I started this thread is to combine all information regarding overclocking from the OpenWrt Forums as well as other sources.
This is a running thread so hopefully any new information can be added as part of discussion.
Why Overclock?
To squeeze more performance out of your device if your ISP subscription is 200Mbps and currently your router is hitting 180Mbps perharps you can reach 200Mbps with a little overclocking
Overclocking improves Wireless performance since WPA2-AES encryption is de-facto standard, computing power is required
Because you can, people have been overclocking ever since the old Intel Celeron Era, it is fun
Manufacturers do not test each chip individually so maximum stable clock difers from chip to chip as well from board revision to board revision.
You want to increase the clock rate and keep the stability.
General strategy for Overclocking
Increase by Minimum Stepping (Depending on SoC Architecture) Eg. +10MHZ
do memtester, do iperf test over LAN/WAN, do iperf test over WiFi
test using heavy bittorrent workloads
If it does not crash/reboot suddenly you can repeat step 1
If it crash, reverse the last working value and that is the safe limit
AR71xx MIPS Overclocking
AR71xx MIPS is very overclocking friendly, clockspeed is determined by a register value initialised in the uboot
There are 3 Clock Parameters
-CPU
-DDR
-AHB
There are currently 2 types of AR71xx MIPS:
The old eg. AR7240, AR7100, AR9132, AR7242, AR7241
For these Routers all 3 Parameters are tied together meaning
eg: CPU = 400MHZ, DDR = CPU = 400MHZ, AHB = DDR/2 = 200MHZ
The new eg, AR9344, AR9341
For these Routers all 3 Parameters are NOT tied together meaning
eg: CPU = 535MHZ, DDR = 400MHZ, AHB = DDR/2 = 200MHZ
General strategy for AR71xx MIPS Routers (for uncompressed uboot)
Backup your uboot
Open the uboot using a HEX Editor
Search for unique hex value string loading the clockspeed value in the uboot
Replace the string by incrementing the value and save to another copy
First you have to find your uboot, SSH into the router and
root@lede:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00050000 00010000 "u-boot"
mtd1: 00010000 00010000 "dtb"
mtd2: 002a0000 00010000 "kernel"
mtd3: 00ce0000 00010000 "rootfs"
mtd4: 009b0000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00010000 00010000 "caldata"
mtd7: 00f80000 00010000 "firmware"
mtd0 is usually the uboot
Then copy out mtd0 using dd to /tmp/ as in LEDE /tmp is a RAM mounted directory
root@lede:~# dd if=/dev/mtd0 of=/tmp/uboot.bin
256+0 records in
256+0 records out
Then using SCP copy out uboot.bin into a PC you can hex edit with
Flashing uboot
Please note that if the uboot is corrupted you need to reprogram the Flash Chip using an external programmer.
For AR9341 device with 25MHz crystal (like MR3420V2)
In HEX-editor search line "3C 0C 29 AC 3C 0D 2A 80 " and replace "AC" to "E0" for 600MHz.
"+1 hex" = "+1.25MHz CPU clock".
i.e. 29ACh=535MHZ, 29E0h=600MHz, 2A30h=700MH
For AR7241 device (like MR3420V1)
In HEX-editor search line "37 39 08 28 03 19 C0 25 " and replace "28" to "29" for 410MHz.
"+1 hex" = "+10MHz CPU clock".
i.e. 0828h=400MHZ, 0829h=410MHz, 082Ah=420MHZ
In the uboot there are 2 occurrence of this sequence you need to replace.
Disclaimer, I'm not a fan of driving devices outside their operating window anyways, but...
Especially today's higher end devices with arm or mips SOCs might already get quite hot under load with normal clock frequencies, sometimes even too hot for continuous load, so special care needs to be taken for the cooling.
In regards to RAM, especially embedded devices often use bottom of the range RAM, "because it's cheap(er)", so this isn't quite safe to clock either; likewise the vendors don't always put much emphasis on their PCB layout (length/ impedance matching of the RAM traces, etc.).
Finding the correct (respectively safe) operating points for modern hardware isn't really easy, to accomplish this, you really need to know how you can stress-test the SOC to the max (running benchmarks isn't always sufficient, as this doesn't necessarily stress all IP cores on the SOC at the same time/ to the maximum - additionally the results of these stress tests also needs to be checked for silent data corruption) and you also need to be know the quirks and shortcuts of your PCB design. To get reasonable results, you also need to evaluate many boards from several batches to get a reliable trend. At home overclocking is easier in the x86 arena, because the vendors see it as an advertising revenue and add safeguards to the boards and CPUs, preventing the worst, but for embedded devices this is usually missing.
i've tested 800/600/300 MHz clocks on TL-MR22U and the chip got just a bit warmer than usual, maybe if you have some QCA9531 board the same u-boot will work too: http://bit.do/cH6xC
of course don't flash this if you don't know what your'e doing
Thanks! I just flashed 720/450/225 and I see memtester errors. However, CPU has been rock solid in the past hour, running memtester, stress with >95% CPU usage at 720mhz. Trying out 720/400/200 now for WDR3600. By any chance, could you help make an image for 720/425/225 for WDR3600- just downclocking the memory a bit? I know I'm reviving an old thread and any help would be appreciated!
I don't know how to find cpu speed value in hex ? Pls explain for me.
My cpu router is Lantiq xway ar9 333mhz (buffalo wbmr-hp-g300h), it is possible to oc ?
The wr841nd v11 use the QCA9533-AL3A i seeking about the corrispondence 3C 0C 29 AC 3C 0D 2A 80
but on my uboot i find 3C 0C 00 3C 35 8C 10 3F.
Some help is appreciated.
that is such a stupid profile unless only concern is cpu overclock. i had to increase ram clock for 200 and ahb for 100MHz to get 20Mbps more out of usb port. what you gain with 50/25 mhz increase?