Topic: 30/30/30 reflashing works for WRT54G3GV2-VF

I'm seeking confirmation that you can reflash a Linksys WRT54G3GV2-VF with a 30/30/30 hard reset.

My Linksys WRT54G3GV2-VF wouldn't boot after a sysupgrade. The power LED wouldn't stop blinking. After re-reading the wiki page, I was under the impression that I would have to open the case and attach a serial console.

Nevertheless, I tried this:
  - Push the reset button for 30 seconds with power on
  - Turn off power and keep reset pressed for another 30 seconds
  - Turn power back on and keep reset pressed for final 30 seconds
  - Just before releasing the reset button, start a TFTP client to put a (factory) image to (in binary mode)

The TFTP file transfer was successfull. The router booted with the newly installed firmware.

Can anybody confirm this works before I dare to put it into the wiki?

Thanks, maf

Re: 30/30/30 reflashing works for WRT54G3GV2-VF

My WRT54G3GV2-VF no longer boots after a reboot with the same symptoms.
The safe mode also does not work.
I am in an excellent position to test, but I have no idea what step 4 entails.

Can anybody point me in the right direction?



Re: 30/30/30 reflashing works for WRT54G3GV2-VF

Strange. Some messages of this thread have been lost. curiouswombat had confirmed this procedure on July 17th. And I think I put a note here when I edited the wiki page. Anyways...

You have to connect the router to a PC via ethernet. Assign an IP address in the subnet 192.168.1.* to the ethernet interface of the PC, start tftp on the PC, connect to the router, set binary mode, and transfer the image once the router accepts it. Something like

root@gyro:/home/malte/linksys# tftp
tftp> connect
tftp> binary
tftp> put openwrt-wrt54g3gv2-vf-squashfs-factory.bin
Transfer timed out.

tftp> put openwrt-wrt54g3gv2-vf-squashfs-factory.bin
Sent 3018784 bytes in 6.2 seconds
tftp> quit

This wiki page might be helpful.


Re: 30/30/30 reflashing works for WRT54G3GV2-VF


Right now I can probably get into the device with a serial cable (it replied to ping on

Of those two methods, TFTP in the bootloader and serial console in the booted OS, do either pose a risk of totally destroying the device beyond JTAG? Because it doesn't have JTAG.

For instance, reading that log, how does TFTP know where to write it? Or does it just replace the entire flash byte for byte?

Also, I swear I read that as the 30/30/30 reset may work but wasn't confirmed on Sat.

Re: 30/30/30 reflashing works for WRT54G3GV2-VF

Re-reading the wiki now I know what TFTP is, does this bit mean that all I have to do is boot the device 3 times and I can run TFTP?

The CFE sets "try1" to 0x0074 == 't' when it executes the image for the first time. If everything works fine the running system sets the value for "stable" to 0x0073 == 's'. When CFE does not find the 's' it continues with setting 't' to 'try2' and so on.

Finally when try1 to try3 are set and stable is still unset CFE assumes that the image is broken and won't start anymore. It now starts listening on TFTP for a new firmware image. Nevertheless you can still force the CFE to load the current image with the followin command: "boot -raw -z -addr=0x80001000 -max=0xf40000 flash0.os:".

When I try to set 'stable' manually it will accept it but check if there is a valid second image as fallback. If not CFE simply copies the first 8MB over the second 8MB destroying any jffs2 data the former running system might have written there.

The device already returns a ping from from boot and indefinitely.
So maybe this CFE bootloader is in it's own recovery mode now?

Re: 30/30/30 reflashing works for WRT54G3GV2-VF

OK, I tried to TFTP it hoping it was in this special CFE try1/2/3 fallback mode and it didn't work:

C:\OpenWRT\10.03.1>tftp -i PUT openwrt-wrt54g3gv2-vf-squashfs-factory.bin
Transfer successful: 3018784 bytes in 5 second(s), 603756 bytes/s

Power cycled, did nothing, still responds to on ping.

Will try the 30/30/30 reset.

Re: 30/30/30 reflashing works for WRT54G3GV2-VF

OK, it may have worked but I forgot you had to telnet in and set a password first.

Won't know now because I then did the 30/30/30 so one of them definitely worked.

But something definitely worked because it's alive again now.



Re: 30/30/30 reflashing works for WRT54G3GV2-VF

I'm sorry for never replying. I just had a look at my subscriptions: This is the second thread I'm subscribed to but haven't received a notification for lately

Are you all set now, roboj1m?