OpenWrt Forum Archive

Topic: TL-WR741ND 64M Memory mod.

The content of this topic has been archived between 6 Feb 2018 and 4 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Dioptimizer wrote:

One might first ask on the forum before using 256mb (32mb) flash chip.

It is too easy and not funny wink

Dioptimizer wrote:

The problem is that the SPI address space on all ar71xx/ar924x/ar91xx/ar933x/ar934x physically limited up to 128mbit (16mb).
If you've heard info about 32mb router, it is based on two chips using 16mb spi0.0 and spi0.1 (two banks), example: WZRHPG300NH, WZR-HP-G450H.

By the way it can be implemented in the kernel without need change the uboot loader.

It mean we can workaround 16M limit by patching kernel?

kimstik wrote:

It mean we can workaround 16M limit by patching kernel?

Imagine a window of 16Mb. How else can fit extra 16Mb data in this window? One thing is when you are using flash-memory likeness NAND-Flash or MMC/SD-Card where the structure of the data is divided into blocks - and the window can be updated. NOR flash memory is arranged on the other, it needs the window to full volume data.

1. At least i can use 16M now
2. This is clear that 24bit addressing space can hold only 16M.
I have no datasheet for this cpu. And i surprised that serial flash is mapped to CPU address space. Can we have unmapped RXTX byte access to SPI transiver ?
As you said 32M devices use 2 SPI spi0.0 and spi0.1. Mean we can logically use 2 banks into our 32bit addressing space.

kimstik wrote:

I have no datasheet for this cpu.

AR9331 datasheet
Link are taken from Wiki

kimstik wrote:

Can we have unmapped RXTX byte access to SPI transiver ?

I do not know about it, even if it were possible, it should be supported by SPI driver. But at this moment the driver does not support this.

kimstik wrote:

As you said 32M devices use 2 SPI spi0.0 and spi0.1. Mean we can logically use 2 banks into our 32bit addressing space.

Working with SPI looks different. There is one SPI address-window, also if you look at the same table, you can see two more reserved addresses (0x1EFFFFFF, 0x1BFFFFFF). At these locations is the same address-window - reflection or mirror. The number of reserved addresses in proportion to the available internal CS# line (i.e. CS0 = 0x1F .. CS1 = 0x1E .. CS2 = 0x1B .. - it is for example, addresses can be in any order).

What is it for?

This is needed for the use case if we using at the same time all the available capacity (16Mb+16Mb+16Mb) for the bus SPI. In the bootloader to the second bank specified address window 0x1E000000-0x1EFFFFFF - this all need for order to avoid conflict at the OS level!
I.e. when the system turns to another address space, the u-boot switches spi0.# according to the selected bank.

If you need extra storage capacity on the router you could use the USB port, any flash memory. But as I understand it may seem that it is trite.
Have you considered this variant?
Original url: … p.mmc.hack

In general, NOR flash memory - the most primitive memory for fast loading information in the memory of device. This flash-memory is not the best/cheapest variant to increase capacity on the router. For example, on a platform of ALFA-AP96 (first generation processors AR71XX) - NOR flash memory is used as a kind of "missile carrier" after the kernel is loaded into memory  - GPIOs of spi0.0 reprogrammed into pins for NAND-flash.

(Last edited by Dioptimizer on 24 Feb 2013, 18:26)

The first 4 megabytes are an exact copy of the working device. The strange thing is that the device is not found MTD partitions.


Hi, I did the same thing (flash upgrade to 8M).
Did you know that ar7240 can run at 400MHZ right?
I found an uboot in a chinese forum that works with my wr740n v2, modded to use 8MB flash, and...also overclocking abilities!!

The maximum stable frequency for me is 430MHz (DDR goes up to 430MHZ too).
At 440MHz it worked but the LAN did not longer work in the uboot or openwrt. But I was able to boot at even 480MHz! LAN sad so stuck at 430MHz.
Remember that no LAN = no way to transfer data to the router = no way to recover = BRICKED!!.
From 350 to 430MHz, it went from 235 Bogomips, to 286! big_smile

How to overclock:
Open the modded uboot with an Hex editor, go to address 0x1FD00.
The uboot is modded, it has 4 OC profiles. Any of them can be enabled by setting to "1" an hex value.
The last byte of each profile is the multiplier. DON'T CHANGE THE "08" !!

If you saw the bootlog, it says "Ref:5MHz".
So, we have to use a multiplier in base of that speed to get the AHB clock speed.
In the way it works, the DDR and CPU speed is the double of the AHB.
Example: 40 multiplier.
AHB speed: 40*5= 200MHz.
CPU and DDR will be 200*2=400MHz

Remember that the bin file works in hexadecimal!! decimal 40 = 28 hex !

Here a nice pic I made for better explanation. Click on it for a bigger image!

And here you got the bootloader. I set it to 410MHz, which I think is a safe value.
Still a big performance improvement from the stock 350MHz!
Remember that I'm sharing it because it worked like a charm for me. But no warranties of any kind, try at your own risk!
Good luck! smile.

(Last edited by dabyd64 on 26 Feb 2013, 17:07)

yes, I put in red because 740/741 v4 uses ar9331, while previous versions use ar7240.
I don't want to see people bricking their routers tongue.

741nd v2 is ap91, but this uboot for ap99 worked well .
Then the modded uboot I found was your work? I found it on, but translating from chinese, I hardly understood anything else than ap99 and overclock big_smile.
Great work, awesome!

dabyd64 wrote:

Then the modded uboot I found was your work?!

It's not my modification, source and bootloader owned by tthrx of this forum. But he does not appear for a long time on this forum, tell him thank you.
The only thing I can say is that overclocking does not make sense, because it does not affect on the speed over WAN/LAN Ethernet, Wifi, USB - overclocking affects only on the computing power.

Plus the need to replace the heatsink on the CPU, as the processor will greatly heater.

(Last edited by Dioptimizer on 25 Feb 2013, 10:50)

I like this mod and am thinking of doing it. Quick question though, do you see an improvement in performance in any way? Can the router effectively use all the RAM?

The first improvement will be on concurrent connections, if you use emule, bittorrent and other programs that may create 1000's of connections.
Also it will give better performance if you install additional heavy programs on the router, ex. Transmission (bitorrent client), samba, etc.
My unmodded wr740n with 32MB RAM crashes after ~30 minutes if I start Transmission and let it download some torrents.
In my computer it works well, but having the computer running all the day is not something that I'd call efficient.
So my RAM is on the way, I'm waiting for it to upgrade my routers.
For just surfing and downloading few files with Jdownloader, it works perfect with the stock RAM, so for that scenario it won't give a difference on performance.

(Last edited by dabyd64 on 28 Feb 2013, 10:35)

gogydm wrote:

I like this mod and am thinking of doing it. Quick question though, do you see an improvement in performance in any way? Can the router effectively use all the RAM?

That mostly depends on what you are running on the router.

Hi does anyone know how to flash the uboot without desoldering the flash and using a programmer.
I checked tp-link's bootloader does not have a flash uboot function unlike on ralink routers.

The uboot doesn't have a dedicated function to flash boot, but you can do it anyway.
you have to transfer the uboot by tftp

tftpboot 0x81000000 boot_file.bin
protect off all
erase 0x9f000000 +0x20000
cp.b 0x81000000 0x9f000000 0x20000
protect on 0x9f000000 0x20000

Or, if you are trying to use a new flash and want to transfer uboot to the new chip, use the CS trick.
That means, do a sandwich putting the new flash over the old chip, and connect all the pins except the CS pins, those must be lifted and solder a tiny wire to each one. … 69#p179169

This is how I made it:
Then, boot with the jumper set to the old flash:

cp 0x9f000000 0x81000000 0x20000

Now, change the jumper to select the new flash.DON'T power off the router

protect off all
erase 0x9f000000 +0x20000
cp.b 0x81000000 0x9f000000 0x20000
protect on 0x9f000000 0x20000

Done! You copied the uboot to the new flash. And the last "protect" command will lock the uboot data so you can't erase by mistake if you flash new data using uboot, and put wrong addresses.

(Last edited by dabyd64 on 1 Mar 2013, 16:40)

How do you determine the address of various routers or is it fixed?

It depends on the device, of course. Search on internet, read the openwrt/ddwrt wiki...
Lately most TP-Link devices use those addresses.
The wr703n, wr740n, wr741, wr841(not sure that all versions of it), mr3420, mr3220, wr842...and more,   use these.
Of course, if you are not using a tp-link device, or you're unsure, don't try.
What's your device?

(Last edited by dabyd64 on 1 Mar 2013, 23:04)

I succeeded except that the bootloader generated isn't 0x20000 in size.
So when we do the erase erase 0x9f000000 +0x20000 the mac address got wiped.
Luckily I had a backup.
The bootloader generated is usually less than half the size of the factory bootloader.
I tried to modify the #define CPU_PLL but it wouldn't compile if I change the value from 5XX_XXX_XXX to 6XX_XXX_XXX
Always glad to learn something new.

(Last edited by alphasparc on 3 Mar 2013, 19:15)

The uboot is 64KB uboot+64KB env. data. So all is 128KB (0x20000).
The MAC is stored there, too.
Don't worry about the size of  the compiled bootloader.A big part of the 128KB is free, but you have to erase the full uboot, to ensure that nothing of the old data remains there, which could cause conflict or bugs with the new uboot.

Has anybody done ram mode for v4.20?
I tried chip HY5DU121622CTP-D43, but it doesn't work.

I did on both wr741 v2 and v4, with exactly that chip. Worked from the first boot, nothing was modified on the software.

(Last edited by dabyd64 on 23 May 2014, 01:24)

I changed chip to D5116AFTA-6B-E and it works. Perhaps the previous chip was burned.

anarchy99 wrote:

hmm.. ok, not sure i completely understand why but i guess the bus width is different?

I'm not sure, you didn't post any details, so it was safer to say NO than YES smile