The Buffalo WBMR-G54 is a residential ADSL2+ router modem with 4 Fast Ethernet ports and a 802.11b/g access point.

Use the Attitude Adjustment (12.09) generic image for the TI AR7 chips (openwrt-ar7-squashfs.bin).

1. → obtain.firmware
2. → Install OpenWrt

Please check out the article Flash Layout. It contains an example and a couple of explanations.

It is advised to first take a look at this document regarding flashing a generic device to understand the general concepts. If the device is connected via the serial port (see the Serial section of this page), more information about the process can be seen.

This process becomes easier to perform if the serial connection of the device is connected to the computer, this way the process can be monitored.

The bootloader of the WBMR-G54, Adam2, waits for 7 seconds before starting to load the operating system:

ADAM2 Revision 0.22.02_b04_Mar  9 2005
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
Usage: setmfreq [-d] [-s sys_freq, in MHz] [cpu_freq, in MHz]
Memory optimization Complete!

Adam2_AR7RD > 
Press any key to abort OS load, or wait 7 seconds for OS to boot...

This countdown is stopped if a key is pressed through the serial connection, or if an FTP session is initiated to the device.

* of course, your computer must not have the same IP address as the router, so anything between 192.168.1.2 and 192.168.1.254 is fine

1) Power off the device

Simply unplug it.

2) Set your computer's Ethernet connection at 10 Mb/s, half duplex.

For some reason, it seems that setting this configuration leads to more probable flashing success. In any case, it will only slow down things a little bit. In Windows, this can be done in the Control Panel. In GNU/Linux distributions, install the "ethtool" package and issue, as root:

ethtool -s eth0 speed 10 duplex half

If you are using another interface (eth1, eth2, …) just replace eth0 with your settings.

3) Configure your computer's network device

Use the values above and apply them to your network card. For instance in GNU/Linux, as root:

ifconfig eth0 192.168.1.10/24

4) Go to the directory where the .img file is

In GNU/Linux, for instance:

cd /home/mysuer/Downloads

5) Power on the device and initiate an FTP session.

For some unknown reason it seems that in GNU/Linux the process is more prone tu succeed if the FTP session is initiated as root, so log in as root (issue the "su" command or "sudo su", according to your system.

Plug in the power supply to turn on the router. Then you have 7 seconds to start the FTP session:

ftp 192.168.1.1

If the FTP session is correctly initialized, you will be prompted for the username:

Connected to 192.168.1.1.
220 ADAM2 FTP Server ready.
Name (192.168.1.1:user):

Type "adam2" and press Enter. You will be prompted for the password: type "adam2" and press Enter:

Connected to 192.168.1.1.
220 ADAM2 FTP Server ready.
Name (192.168.1.1:user): adam2
331 Password required for adam2.
Password: *****
230 User adam2 successfully logged in.
Remote system type is UNIX.

Now you have an FTP session established with the router.

6) Upload the firmware

To start uploading the firmware, issue these commands:

quote "SETENV mtd1,0x90010000,0x903f0000"
quote "MEDIA FLSH"
binary
debug
hash
put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd4"

The process should look like this:

ftp> quote "SETENV mtd1,0x90010000,0x903f0000"
200 SETENV command successful
ftp> quote "MEDIA FLSH"
200 Media set to FLSH.
ftp> binary
200 Type set to I.
ftp> debug
Debugging on (debug=1).
ftp> hash
Hash mark printing on (1024 bytes/hash mark).
ftp> put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd4"
local: trunk-web.bin remote: openwrt-ar7-squashfs.bin mtd4
---> PORT 192,168,1,100,179,221
200 Port command successful.
---> STOR openwrt-ar7-squashfs.bin mtd4

Now the firmware is being uploaded to the flash memory of the router. The process takes around one minute

7) Wait for the firmware to be written to the flash

After one minute of uploading and writing the firmware to the flash memory, the router starts to check it. The FTP transfer window will start showing lots of

#, like this:

150 Opening BINARY mode data connection for file transfer.
################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
226 Transfer complete.
2883588 bytes sent in 38.27 secs (73.6 kB/s)

If after 2 or 3 minutes you see no hashes, just a few of them appear but they stop without printing the "226 Transfer complete." message, then something wrong happened (most probably, the image you tried to upload was not the right one). Go to step 1 and repeat the process, double checking you are uploading the right file. Retrying should not damage the device nor brick it.

If you see all the hashes and the "226 Transfer complete." message, the firmware has been successfully uploaded. The device should reboot itself immediately, but you can issue the following commands to reboot it and terminate the FTP session:

quote REBOOT
quit

After flashing the firmware and rebooting the device, do not change the IP address on the computer. In a minute or so you should be able to ping 192.168.1.1.

OEM bootlog not available!

0.000000] Linux version 3.3.8 (lino@ris) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sun Mar 3 21:03:17 CET 2013 [ 0.000000] gpiochip_add: registered GPIOs 0 to 31 on device: ar7-gpio [ 0.000000] ar7-gpio: registered 32 GPIOs [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00018448 (MIPS 4KEc) [ 0.000000] TI AR7 (TNETD7300), ID: 0x0005, Revision: 0x22 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 01000000 @ 14000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00014000 -> 0x00015000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00014000 -> 0x00015000 [ 0.000000] On node 0 totalpages: 4096 [ 0.000000] free_area_init_node: node 0, pgdat 9439cac0, node_mem_map 943f8000 [ 0.000000] Normal zone: 32 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 4064 pages, LIFO batch:0 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 [ 0.000000] Kernel command line: console=ttyS0,38400n8 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 64 (order: -4, 256 bytes) [ 0.000000] Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes [ 0.000000] Memory: 12120k/16384k available (2328k kernel code, 4264k reserved, 347k data, 168k init, 0k highmem) [ 0.000000] NR_IRQS:256 [ 0.000000] Clocks: prediv: 1, postdiv: 1, mul: 10 [ 0.000000] Calibrating delay loop... 148.88 BogoMIPS (lpj=744448) [ 0.080000] pid_max: default: 32768 minimum: 301 [ 0.090000] Mount-cache hash table entries: 512 [ 0.110000] NET: Registered protocol family 16 [ 0.160000] bio: create slab at 0 [ 0.180000] Switching to clocksource MIPS [ 0.200000] NET: Registered protocol family 2 [ 0.220000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.240000] TCP established hash table entries: 512 (order: 0, 4096 bytes) [ 0.260000] TCP bind hash table entries: 512 (order: -1, 2048 bytes) [ 0.280000] TCP: Hash tables configured (established 512 bind 512) [ 0.300000] TCP reno registered [ 0.310000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.330000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.350000] NET: Registered protocol family 1 [ 0.430000] unable to register fixed phy for cpmac-high: 0 [ 0.460000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.480000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.510000] msgmni has been set to 23 [ 0.520000] io scheduler noop registered [ 0.530000] io scheduler deadline registered (default) [ 0.550000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.570000] serial8250: ttyS0 at MMIO 0x8610e00 (irq = 15) is a TI-AR7 [ 0.590000] console [ttyS0] enabled, bootconsole disabled [ 0.630000] serial8250: ttyS1 at MMIO 0x8610f00 (irq = 16) is a TI-AR7 [ 0.660000] physmap platform flash device: 02000000 at 10000000 [ 0.680000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000ec Chip ID 0x0022a2 [ 0.710000] physmap-flash.0: Found an alias at 0x400000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0x800000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0xc00000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0x1000000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0x1400000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0x1800000 for the chip at 0x0 [ 0.710000] physmap-flash.0: Found an alias at 0x1c00000 for the chip at 0x0 [ 0.710000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.730000] Fixing Samsung's Amd/Fujitsu Extended Query version to 1.3 [ 0.750000] Amd/Fujitsu Extended Query version 1.3. [ 0.760000] number of CFI chips: 1 [ 0.780000] 4 ar7part partitions found on MTD device physmap-flash.0 [ 0.800000] Creating 4 MTD partitions on "physmap-flash.0": [ 0.820000] 0x000000000000-0x000000010000 : "loader" [ 0.840000] 0x0000003f0000-0x000000400000 : "config" [ 0.870000] 0x000000010000-0x0000003f0000 : "linux" [ 0.890000] 0x0000000f3930-0x0000003f0000 : "rootfs" [ 0.910000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.950000] mtd: partition "rootfs" set to be root filesystem [ 0.970000] mtd: partition "rootfs_data" created automatically, ofs=290000, len=160000 [ 1.000000] 0x000000290000-0x0000003f0000 : "rootfs_data" [ 1.040000] Fixed MDIO Bus: probed [ 1.310000] EXTERNAL SWITCH!!! [ 1.490000] cpmac-mii: probed [ 1.570000] eth0: ADM6996M model PHY found. [ 1.590000] cpmac: device eth0 (regs: 08612800, irq: 41, phy: cpmac-1:00, mac: 00:16:01:a1:c1:9d) [ 1.690000] cpmac: device eth1 (regs: 08610000, irq: 27, phy: cpmac-1:1f, mac: 00:16:01:a1:c1:9d) [ 1.720000] Registered led device: status [ 1.730000] vlynq0: regs 0x08611800, irq 29, mem 0x04000000 [ 2.660000] vlynq1: regs 0x08611c00, irq 33, mem 0x0c000000 [ 3.580000] TCP cubic registered [ 3.590000] NET: Registered protocol family 17 [ 3.600000] 8021q: 802.1Q VLAN Support v1.8 [ 3.630000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3. [ 3.680000] Freeing prom memory: 1020k freed [ 3.700000] Freeing unused kernel memory: 168k freed [ 11.180000] JFFS2 notice: (413) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 8 of xref (0 dead. [ 13.960000] Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993 [ 13.980000] Backport based on wireless-testing.git master-2012-09-07 [ 14.000000] compat.git: wireless-testing.git [ 14.120000] cfg80211: Calling CRDA to update world regulatory domain [ 14.140000] cfg80211: World regulatory domain updated: [ 14.150000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 14.180000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.200000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 14.230000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 14.250000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.270000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 15.110000] NET: Registered protocol family 8 [ 15.120000] NET: Registered protocol family 20 [ 15.520000] PPP generic driver version 2.4.2 [ 15.970000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 16.450000] NET: Registered protocol family 24 [ 16.520000] nf_conntrack version 0.5.0 (207 buckets, 828 max) [ 17.260000] acx-mac80211, version: v0.6.0 (git: unknown) [ 17.280000] this driver is still EXPERIMENTAL [ 17.280000] acx: please read the README file and/or go to http://acx100.sourceforge.net/wiki for further information [ 17.320000] built with CONFIG_ACX_MAC80211_PCI [ 17.340000] compiled to use 32bit I/O access. I/O timing issues might occur, such as non-working firmware upload. Report them [ 17.370000] acx: running on a little-endian CPU [ 17.370000] PCI/VLYNQ module initialized, waiting for cards to probe... [ 17.410000] Not using the 00000009 VLYNQ device's driver for VLYNQ device: 00000000 [ 17.410000] Not using the 00000009 VLYNQ device's driver for VLYNQ device: 00000000 [ 17.490000] registered device TI Avalanche SAR [ 17.510000] Sangam detected [ 17.520000] requesting firmware image "ar0700xx.bin" [ 18.250000] avsar firmware released [ 20.040000] tn7dsl_set_modulation : Setting mode to 0xffff [ 20.060000] Creating new root folder avalanche in the proc for the driver stats [ 20.090000] Texas Instruments ATM driver: version:[7.03.01.00] [ 33.090000] device eth0 entered promiscuous mode [ 33.140000] br-lan: port 1(eth0) entered forwarding state [ 33.150000] br-lan: port 1(eth0) entered forwarding state [ 33.290000] device eth1 entered promiscuous mode [ 33.300000] br-lan: port 2(eth1) entered forwarding state [ 33.320000] br-lan: port 2(eth1) entered forwarding state [ 33.390000] device eth0.1 entered promiscuous mode [ 33.400000] br-lan: port 3(eth0.1) entered forwarding state [ 33.420000] br-lan: port 3(eth0.1) entered forwarding state [ 33.740000] PHY: cpmac-1:00 - Link is Up - 100/Full [ 34.300000] br-lan: port 2(eth1) entered disabled state [ 34.760000] device eth0.2 entered promiscuous mode [ 34.770000] br-lan: port 4(eth0.2) entered forwarding state [ 34.790000] br-lan: port 4(eth0.2) entered forwarding state [ 35.150000] br-lan: port 1(eth0) entered forwarding state [ 35.420000] br-lan: port 3(eth0.1) entered forwarding state [ 36.790000] br-lan: port 4(eth0.2) entered forwarding state

→ generic.failsafe

→ hardware.button on howto use and configure the hardware button(s).

The Linksys WRT54GL has one button on the back, labeled "Reset".

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Note: This will void your warranty!

• To remove the cover do a/b/c

Main PCB

Photo of PCB

This device has a 5-pins header providing a serial port, labeled JP6. The pins are, left to right:

Pin 1 → RXD (data from outside to the board) Pin 2 → ? (unknown, probably not used) Pin 3 → VCC (+3.3 V) Pin 4 → GND (ground) Pin 5 → TXD (data from the board to the outside)

The communication settings of the serial port are 38400 bps, 8 stop bits, 1 bit of parity, no hardware control flow, no software control flow.

The serial port can not be directly connected to a PC serial port, due to the different voltages they use. To connect the board to a computer via the serial port, a TTL to RS232 voltage level converter is required. There are many USB to TTL adaptors available, like those based on the MAX232 or the CP210 chips.

The port.serial page features general information about the serial port, serial port cables, etc.

The following picture shows the serial console pins connected to a USB to TTL adaptor.

There are several points in the board that might correspond to the JTAG pins, but no information is available about them.

→ generic.debrick

The Mini PCI wireless card that comes with the device is protected by a metal case, which is soldered to the board. This piece can be removed, freeing the card. To do so, the four pins that go through the board must be desoldered. A regular 25 watts soldering iron is enough to do it, but using a [[http://en.wikipedia.org/wiki/Desoldering|desoldering pump] makes the process easier.

The following three images show the location of the 4 points that must be unsolder to remove the metal case.