This project was moved to GitHub: github.com/pepe2k/u-boot_mod

Hello!

I made a modification of U-Boot for TP-Link with AR9331 SoC routers.

My modification is based on wr703n-uboot-with-web-failsafe project (big thanks for the author for this code!) but has some improvements and other modifications.

After I found wr703n-uboot-with-web-failsafe project, I decided to start from it and make it better. Most of my work was focused on web failsafe mode - I rebuild it and now it works with all browsers and allow to upload not only firmware but also the U-Boot and ART data.

Changelog:

Jun 19 2013:

• fixed problem with booting in some cases on all supported models

• support for TL-MR10U ver. 1.x (tested on ver. 1.0)

• support fot TL-MR3220 ver. 2.x (tested on ver. 2.1)

• support for TL-WR720N ver. 3 (only for Chinese version!)

• support for new flash types/series: Macronix MX25L128 and SST 25VF064C

• version for TL-WR740N v4 was tested also on TL-WR741ND ver. 4.2 (it's almost the same hardware)

Apr 22 2013

• support for TL-WR740N ver. 4 (tested on ver. 4.23)

• NetConsole

• flash recognize by JEDEC ID (please, see README for full list)

• returned to instruction 0xD8 for flash erasing (64 KiB block erase)

• setmac command

• web pages lifting

• some bugs fixed

• predefined overclocking profiles in code (please, see ap121.h)

Mar 29 2013

• initial release

Modifications/changes:

• faster boot up

• removed unnecessary information from boot up sequence

• flash chip is automatically recognized

• eth interfaces MAC is now set from flash (no more "No valid address in Flash. Using fixed address")

• setmac option - you can change MAC address stored in flash

• automatic system boot can be now interrupted by any key (no more need to type "tpl")

• you can run web server, U-Boot console or NetConsole by pressing the reset button (for ~3 sec. to run web mode, for ~5 sec. to get in U-Boot console or for ~7 sec. to start U-Boot NetConsole)

• index.html (fw upgrade), art.html (ART upgrade), uboot.html (U-Boot upgrade)

• overclocking possibilities

• and other...

Supported flash chips (recognized automaticly by JEDEC ID):

4 MiB:

• Spansion S25FL032P (4 MiB, JEDEC ID: 01 0215)*

• Atmel AT25DF321 (4 MB, JEDEC ID: 1F 4700)

• EON EN25Q32 (4 MB, JEDEC ID: 1C 3016)*

• Micron M25P32 (4 MB, JEDEC ID: 20 2016)

• Windbond W25Q32 (4 MB, JEDEC ID: EF 4016)

• Macronix MX25L320 (4 MB, JEDEC ID: C2 2016)

8 MiB:

• Spansion S25FL064P (8 MB, JEDEC ID: 01 0216)

• Atmel AT25DF641 (8 MB, JEDEC ID: 1F 4800)

• EON EN25Q64 (8 MB, JEDEC ID: 1C 3017)*

• Micron M25P64 (8 MB, JEDEC ID: 20 2017)

• Windbond W25Q64 (8 MB, JEDEC ID: EF 4017)*

• Macronix MX25L640 (8 MB, JEDEC ID: C2 2017, C2 2617)

• SST 25VF064C (8 MB, JEDEC ID: BF 254B)

16 MiB:

• Winbond W25Q128 (16 MB, JEDEC ID: EF 4018)*

• Macronix MX25L128 (16 MB, JEDEC ID: C2 2018, C2 2618)

* - tested

If you want to use other type, please contact with me or add your flash chip into ar7240_flash.c file and compile the code.

U-Boot NetConsole

You can use it instead of serial console. All communication is made over UDP protocol (port 6666). Example:

Web server

Example page (index.html for firmware upload):

I need to warn you - for now, in web upgrade mode, there isn't any data validation!
So, please be very careful with U-Boot upgrade, if you choose wrong image, your router won't boot again...

Bootlogs

Here is an example boot log from this U-Boot version:

*****************************************
*      U-Boot 1.1.4  (Apr 22 2013)      *
*****************************************
 
AP121 (AR9331) U-Boot for TL-WR740N(D)v4
 
DRAM:  32 MB
FLASH: EON EN25Q64 (8 MB)
 
LED on during eth initialization...
 
Press reset button for at least:
- 3 sec. to run web failsafe mode
- 5 sec. to run U-Boot console
- 7 sec. to run U-Boot netconsole
 
Reset button is pressed for:  6 
 
Button was pressed for 6 sec...
Starting U-Boot console...
 
uboot> ?
 
?           - alias for 'help'
boot        - boot default - run command 'bootcmd'
bootd       - boot default, i.e., run 'bootcmd'
bootm       - boot application image from memory
cp          - memory copy
erase       - erase FLASH memory
help        - print embedded help
httpd       - start www server for firmware recovery
md          - memory display
mm          - memory modify (auto-incrementing)
mtest       - simple RAM test
mw          - memory write (fill)
nm          - memory modify (constant address)
printenv    - print environment variables
printmac    - print MAC address stored in flash
printmodel  - print router model stored in flash
reset       - perform RESET of the CPU
run         - run commands in an environment variable
setenv      - set environment variables
setmac      - save new MAC address in flash
tftpboot    - boot image via network using TFTP protocol
version     - print U-Boot version
 
uboot>

And long version (manually web server start, request for index.html and upload OpenWrt firmware):

*****************************************
*      U-Boot 1.1.4  (Apr 22 2013)      *
*****************************************
 
AP121 (AR9331) U-Boot for TL-WR740N(D)v4
 
DRAM:  32 MB
FLASH: EON EN25Q64 (8 MB)
 
LED on during eth initialization...
 
Hit any key to stop autobooting:  0 
 
uboot> httpd
 
Ethernet mode (duplex/speed): 1/100 Mbps
HTTP server is starting at IP: 192.168.1.1
HTTP server is ready!
 
Request for: /
Request for: /style.css
Data will be downloaded at 0x80080000 in RAM
Upgrade type: firmware
Upload file size: 3932160 bytes
Loading: #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #######################################
         #
 
HTTP upload is done! Upgrading...
 
****************************
*    FIRMWARE UPGRADING    *
* DO NOT POWER OFF DEVICE! *
****************************
 
Executing: erase 0x9F020000 +0x3C0000; cp.b 0x80080000 0x9F020000 0x3C0000
 
Erase flash from 0x9F020000 to 0x9F3DFFFF in bank #1
Erasing: #######################################
         #####################
 
Erased sectors: 60
 
Copying to flash...
Writting at address: 0x9F020000
 
Done!
 
HTTP ugrade is done! Rebooting...

I wrote an article about my project, but for now it is only in Polish (you can try to use Google Translator), you can find it here: Modified U-Boot for the TP-Link WR703N/MR3020/MR3040 (Atheros AR9331) with web upgrade mode

You can download ready U-Boot images (64 KiB, for different models) from here: http://www.tech-blog.pl/pliki/u-boot_fo … e2k.tar.gz

If you need other version, you should compile the code (please, see Makefile in top dir and make customization which you need) or send me a pm, I will do it for you.

You can download sources code here: http://www.tech-blog.pl/pliki/u-boot_so … e2k.tar.gz

Thanks for any feedback!

(Last edited by pepe2k on 24 Aug 2013, 21:20)

pepe2k thanks for your good works, I'll test it out on my router.

(Last edited by xopal on 31 Mar 2013, 13:46)

@pepe2k:
Thanks you do it,that's many guys need the project that you do.
I will add a recommend link in the wr703n-uboot-with-web-failsafe home page.

Thank you
Without your work I wouldn't even start this project!

well done! nice job! is there any chance to port this mod to support AR9344 CPU (TP-LINK 4300)?

I don't have WDR4300, but I'm thinking about buying WDR3600, so... maybe I will make version also for these models.

I'm going to upload new version with command to change MAC under U-Boot console and with some bugs fixed (most important - erase instruction in SPI flash operation is wrong - now it uses instruction to erase 64 KiB block but the range for erase area is calculated with sector size).

I'm trying also to remove version for different flash chips and make automatic flash recognition (based on JEDEC ID).

(Last edited by pepe2k on 8 Apr 2013, 09:02)

Any  posibility for overclocking? Im sure those Ar9331 can run pretty faster than 400mhz
Very nice job pepe2k!

(Last edited by dabyd64 on 13 Apr 2013, 01:07)

Nice!!! Great job!

Yes, but... on this platform the CPU and RAM frequencies are connected together and can't be set independently. So, if you set CPU to run at 420 MHz, the RAM chip should be able to run at 210 MHz (420 MHz in DDR mode).

mips in his project wr703n-uboot-with-web-failsafe was playing with different frequency settings, but only smaller than stock 400 MHz and the results weren't good if I remember. I also want to test some of the settings on MR3040 to check if underclocking can noticeably increase battery life. Maybe I will also try with overclocking

Thank you.

I'm going to post new version in next 2-3 days with WR740N support, flash chip recognition and some bugs removed.
I'm working also on version for WR1043ND and WDR3600.

This is how I tested version dedicated for WR740N

(Last edited by pepe2k on 16 Apr 2013, 12:37)

I will be looking forward to your mod on WDR3600/WDR4300, the SoC is clocked at 560MHZ but it is clearly capable of higher performance.
The chip is slightly warm and not hot at all.
On Mikrotik Router it was default clocked at 600MHZ.
I tried to use TP-Link SDK to mod the uboot but it doesn't work...

(Last edited by alphasparc on 16 Apr 2013, 15:08)

Nice work pepe2k.
I have two question.

Original bootloader on WR703n (TL-MR3020 ...) tests some GPIO pins levels during boot time to determine configuration. This prevents user from  free usage of GPIOs (it has to have expected level at boot time) . Does your version of bootloader still use these GPIO values or does it ignore it?

The new 1.7 version on WR703n has different bootloader that does not initialize LAN interface properly so it needs patched firmware to deal with that. Is it safe to assume that yours bootloader performs the LAN initialization in the same way as 1.6 or lower version of wr703n?   (so any firmware can be installed)

(Last edited by ivanm on 16 Apr 2013, 22:19)

No... I didn't even try to change this. I didn't know about that!
Do you you know which GPIOs are affected by this issue? I can try to find code responsible for this and maybe remove it.

But I'm not certain if it would be possible. Maybe some of this GPIOs are used to configure RAM and aren't checked by U-Boot but are need for AR9331 hardware initialization?

My version is based on mips project (wr703n-uboot-with-web-failsafe) and his version comes from original TP-Link sources... so, I think that this code is probably old (it was published on TP-Link GPL website before 1.7 version appeared on the market, I think) and not affected by this issue.

I have tested my U-Boot on WR703N 1.5 and 1.6 version (Rev 1.1 on PCB) - both are working OK and the LAN interface is initialized in U-Boot - I can make an upgrade with TFTP or using my web interface. Moreover, after upload OpenWrt AA 12.09-rc2 I can login using telnet/ssh and ping the router. So, I think that this issue isn't exist on my U-Boot version.

Please, wait for the new version of my mod if you want to use it. I'm almost done with it

Could you tell me what kind of flash does your 703N v1.7 have?

pepe2k,  here are my answers:

@ GPIO usage by the bootloader
the GPIO are discussed here:
https://forum.openwrt.org/viewtopic.php?id=36471
I've just checked the the AR9331 datasheet, it mentiones these GPIOs used by hw initialization:
GPIO0 : crystal frequency 25 /40 MHz
GPIO1 : booting from internal ROM / Flash
GPIO 12/28 : external memory type (SDR, DDR, DDR2)
GPIO16: download firmware from USB/MDIO
GPIO13: USB mode device /host
GPIO 11: JTAG / CPU ICE
So it looks like it bootloader has nothing to do with at least with these GPIOs.

@ Compatibility of new bootlader with <1.6 firmware
- it is good that yours new bootloader works with every firmware version. Once the original bootloader is replaced, people do not have to worry about original firmware version (1.7 firmware vs older).

@Could you tell me what kind of flash does your 703N v1.7 have?
- I still have original 4 MB. I've ordered 16 Mbyte winbond W25Q128 as this is the only 16 MB flash in SOIC8 package that I've found. I'm planing to burn your new bootloader + MAC section (first 128 kB) and then replace original 4 MB flash with this. Remaining parts (ART, firmware can be written from bootloader).
For burning new 16MB flash I'm planing to use Attiny microcontroller - 2 pins for uart to PC, 3 pins for SPI to serial Flash. I've use serial flash in my previous Attiny project, so I have all the libraries (SPI flash read, erase, write). Just need to finish PC part reading or writing binary file. I'll post it when its done.

pepe2k,
especially look at this post from Dioptimizer.

Yes, on page 81 in datasheet there is a BOOT_STRAP register description. This register is set mostly by the status on those GPIOs, as I can see. I'm not familiar with this platform, so most informations are my speculations from code and datasheet, like everyone here

But, the GPIOs which aren't used to initialize the hardware can be use as an input or output, I think.
In U-Boot code there is a function which initialize GPIOs - it operates on GPIO_OE register (page 65 in datasheet).

  Uploaded with ImageShack.us

As you can see, bits 0...29 can be set as 1 (related GPIO will work as an output) or 0 (input functionality).
I use this register to enable GPIOs for LED functioning in U-Boot, like in this fragment (initialize output for LEDs in MR3020):

#ifdef CONFIG_PID_MR302001

    /* LED's GPIOs on MR3020:
     *
     * 0    => WLAN
     * 17    => ETH
     * 26    => WPS
     * 27    => INTERNET
     *
     */

    /* set OE, added by zcf, 20110509 */
    ar7240_reg_wr(AR7240_GPIO_OE, (ar7240_reg_rd(AR7240_GPIO_OE) | 0xC020001));

    /* Disable clock obs, added by zcf, 20110509 */
    // TODO: ????
    //ar7240_reg_wr (AR7240_GPIO_FUNC, (ar7240_reg_rd(AR7240_GPIO_FUNC) & 0xffe7e07f));
#endif

0xC020001 => 1 set on bits 0, 17, 26, 27.

Yes, I found it in the code, but in my opinion there was a mistake or missing code, I couldn't understand some instructions... I change some of the code which operates on those registers (GPIO_FUNCTION1, BOOT_STRAP, GPIO_OE) based on information from datasheet. Please, refer to ap121.c file in my U-Boot mod sources.

@pepe2k
from this thread I understand, that overclocking ar71xx platform is possible, and 800/400/200 even runs stable ... It would be good to have this as a build option for your u-boot.

(Last edited by dimonix on 20 Apr 2013, 08:02)

Yes, I didn't say that it isn't possible. But... AR9331 is different from AR7161 (mentioned in topic which you pointed).
I found some information about PLL configuration in AR9331 datasheet. Maybe I will try to play with them.

Small sneak peak from new version:

Netconsole (U-Boot console over UDP datagrams):

OK, I think I know how to overclock this platform... I need to make more test but for now I know how to change (and which ones) registers to manipulate with clocks up and down.

412,5 MHz:

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:412.500MHz, DDR:412.500MHz, AHB:206.250MHz, Ref:25.000MHz

425 MHz:

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:425.000MHz, DDR:425.000MHz, AHB:212.500MHz, Ref:25.000MHz

LAN, WiFi, UART... everything seems to work OK. But I need to make some stability tests

437,5 MHz is the limit... for now
I don't know weather it is a CPU or a RAM problem.

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:437.500MHz, DDR:437.500MHz, AHB:218.750MHz, Ref:25.000MHz
...
[    1.430000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

OK, it was a RAM problem
Testing next CPU frequencies...

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:437.500MHz, DDR:218.750MHz, AHB:218.750MHz, Ref:25.000MHz

450 MHz (seems to be stable with RAM at 225 MHz DDR):

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:450.000MHz, DDR:225.000MHz, AHB:225.000MHz, Ref:25.000MHz

562,5 MHz (USB stopped working... AHB with divider = 4, RAM with divider = 2):

[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:49:30 UTC 2013
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:562.500MHz, DDR:281.250MHz, AHB:140.625MHz, Ref:25.000MHz
...
[  104.780000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[  106.040000] CPU 0 Unable to handle kernel paging request at virtual address 00100104, epc == 832035b4, ra == 83204a0c
[  106.040000] Oops[#1]:
...
[  106.300000] Kernel panic - not syncing: Fatal exception in interrupt

OK, 562,5 MHz is the maximum CPU frequency which the device boots on (U-Boot and OpenWrt AA with Luci).

The LAN, WLAN and UART on this frequency works but not the USB (don't know why and how to change it).
I didn't make any stress tests to check stability, I think that at 450~500 MHz could be stable but RAM and AHB clocks need to be lowered.

Time to sleep

(Last edited by pepe2k on 20 Apr 2013, 22:34)

@pepe2k

How did you do for OC the cpu , from openwrt kernel or u-boot ?

In U-Boot. I posted my results and how-to on our polish forum: http://openrouter.info/forum/viewtopic. … amp;t=2490 (you can use translator: http://translate.google.com/translate?h … 26t%3D2490).

I'm very busy now, so I will make translation later.

I don't know if there is a possibility to simply change CPU/RAM/AHB frequency values in kernel, during runtime. In U-Boot code there is a PLL initialization section (hornet_pll_init.S) written in assembler which is responsible for setting these values (it's a part of bootstrap code, executed before the U-Boot reallocates to RAM, I think).

I'm going to publish my modified U-Boot sources with options to compile using different CPU/RAM/AHB frequency settings:
CFG_PLL_400_400_200
CFG_PLL_412_412_206
CFG_PLL_425_425_212
CFG_PLL_500_250_250
CFG_PLL_562_281_140
CFG_PLL_525_262_131

@pepe2k,
do you think if it's possible to increase CPU clock without touching RAM/AHB?

I don't think so... maybe if you change oscillator from 25 MHz to 40 MHz?

The problem is in the available PLL dividers for CPU, RAM and AHB frequencies: only 1, 2, 3 and 4. All three clocks are generated from one base frequency (PLL) so the available options are very limited. I couldn't boot the device with PLL higher than 1125/2 MHz and with some other frequency sets like: CPU/RAM/AHB 550/275/275.

BTW. I don't know if I correctly understood PLL/CLOCK registers so maybe someone should also check and test my info.

(Last edited by pepe2k on 23 Apr 2013, 10:29)

PLL clock - 800 MHz (multiplier 32)
CPU divider - 1 (800MHz)
RAM divider - 2 (400MHz)
AHB divider - 4 (200MHz)
Does it look reasonable?

Could you document how to modify the assembly for overclocking? Can't understand mips assembly.
Thanks.

I don't think that this CPU will work with 2x higher clock...

PLL = (25 MHz * DIV_INT) / 2^OUTDIV

So, with OUTDIV = 1 (default value) we have:

PLL = (25 MHz * DIV_INT) / 2

To achieve PLL = 800 MHz, you will need to have DIV_INT = 64. I couldn't increase it higher than 45...
I tried also to change the OUTDIV from 1 to 0 but it didn't work. Also, with CPU > 525 MHz, the USB stopped working.

CPU = PLL / CPU_POST_DIV
DDR = PLL / DDR_POST_DIV
AHB = PLL / AHB_POST_DIV

For now, in my opinion overclocking this platform doesn't make any sense until someone find out how to increase CPU clock without touching RAM and AHB clocks which I think... isn't possible. I'm thinking rather about underclocking and decreasing power consumption.

BTW. As I said, these are just my guesses and the equations may be wrong.

I don't understand it too!

I have just uploaded new version of my U-Boot modification (first post is up to date). Just download sources and look into "u-boot/include/configs/ap121.h" file. I made there a lot of comments about PLL/CLOCK registers and their values.