OpenWrt Forum Archive

Topic: Yet another Newbie with a WRTSL54GS and the urge to hack

The content of this topic has been archived between 1 Apr 2018 and 27 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I think I did have to wire the TX on the cable to the RX on the board, and vice versa.  I tried it straight through the first time, didn't get any response on the terminal.

Another source for a usb-serial cable is to buy a Deluo USB GPS for Laptop for $65 (we got them when they were $50, though).  You can cut the cable, wire the gps side into 1 serial port (3.3V, TX, RX, GND),  and the other side of the cable can be used to hook up the console.  This probably doesn't help if you aren't interested in putting GPS on your router, though.

netprince wrote:

I think I did have to wire the TX on the cable to the RX on the board, and vice versa.  I tried it straight through the first time, didn't get any response on the terminal.

LOL, I'm so glad I wasn't the only one that did that...  Yes, they need to be reversed, Tx on the cable goes to Rx on the WRT, etc.

Just to finish out this thread, I confirm that crossing TX and RX is required.

I updated the Wiki Hardware page for the WRTSL54GS to include the wiring diagram.

Okay, one detail.

I have soldered up connectors on 3 WRT54GL units now.  That went fine.  I borrowed a soldering station with a fine-tip, a holding bracket and worked my way through it.  I have never been trained on soldering but my I am very nearsighted and have steady hands so it wasn't too difficult.

HOWEVER, I cannot figure out how to solder to the SL mainboard?  It looks like there is solder already in the holes.  Should I attempt to hold a soldering iron to one side of the board and suck the solder out from the other? I have tried this a couple of times with no success so far.  Perhaps I should just drill out the holes instead?

I just used the solder in the holes to attach my wires.  I held the board vertical, braced it between two shoes.  I held the soldering iron on one side to heat up the solder, then pushed the wire in on the other side...

First step I always do is to tin the wires I'm working with with a nice coat of solder.  On my SL, as you said, the holes already had solder all the way through.  In my case, I just applied the tip against the hole with the wire also resting against the tip, as as the solder flowed, the wire inserted fairly easily.

I just used wire that I had on hand, which unfortunately was stranded rather than solid core, which I think would have worked slightly better as far as inserting into the holes on the board.

I really need to invest in in one of those 'helping hands' stands with a magnifying glass...  smile

I read this a while ago and thought that there must be a better way (well, really, I want to connect to things that don't have a USB port on the other end). I contacted Ron Diol, who runs CompSys and builds all sorts of neat little PC cards, including several with MAX232 adapters.

I suggested that there might be a small market for such a board that took in TTL RS232 signals, did the level convert, and brought it out on a stereo jack for installations like this one. He apparently agreed, because he just released the STR232 adapter that does that (see http://www.compsys1.com/workbench/On_to … pter.html). The stereo jack has 4mm of depth, which isn't a lot, but seems to be the longest on the market (similar to the part listed just above).

No financial interest on my part, just happy that I didn't have to do it myself!

Hey guys I am trying to resurrect my bricked WRTSL54GS using the method posted here. I have the FTDI TTL cable and I have installed the audio jack and the appropriate connections on JP4. I have the latest VCP drivers installed and Windows XP recognizes it as COM4.

I am trying to connect via putty using the guide described Click here however when I launch Putty it just stays there. I do not see anything scrolling at all. What should be the baud rate for this router/cable? I have tried changing it in Device Manager to 115200 but still get no CFE.

Thanks in advance.

115,200, 8N1 are the correct settings.  You may want to check continuity on your connections, and verify that Tx and Rx are correct, if they were swapped, you'd get nothing.  Might be worth swapping them anyway, just to check.

its complicated

Well how rude of me to not come back and thank JW for his help sad. Karma had me brick my router again today and I was back at this thread. So JW thanks for your help smile My problem was sloppy soldering on the router TX port. It had come out once again, so I had to solder once again today. Since I didn't save any notes at that time, I thought I'd write this here for us and anyone new wanting to try this. Please post any corrections for everyone's benefit (Thanks in advance)

I will add it from the step where the FTDI cable is plugged in on the stereo jack and USB end connected to the PC. Also the LAN cable from LAN port 1 to PC which has been set to a static IP 192.168.1.X where X is greater than 1 and less than 255 (it cannot be 192.168.1.1),subnet mask, gateway etc just like it is explained here. Configure Putty as it is explained (115,200, 8N1 ). No power to the router yet

1) Fire up putty. Load the serial configured settings. Keep Ctrl key pressed and start hitting the "c" key repeatedly in the putty window. Now plug the power to the router. It should immediately bring you to CFE. You have less than a second to interrupt CFE hence the sequence of Ctrl+C before plugging in the power. If you are not quick enough it would have booted completely and you will be presented with this and no shell/prompt in case of a bricked router, with the window just waiting and no control in the putty window possible.

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Mar 27 14:46:33 CST 2006 (root@michael_linux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
.....Edited for brevity......
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3896 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000

In this case you have to restart the router and attempt Ctrl+C again.

2) Once CFE has been correctly interrupted there will be a prompt to enter commands.

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Mar 27 14:46:33 CST 2006 (root@michael_linux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
et1: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.38.0
CPU type 0x29006: 264MHz
Total memory: 32768 KBytes

Total memory used by CFE:  0x80300000 - 0x803A38A0 (669856)
Initialized Data:          0x803397B0 - 0x8033BEC0 (10000)
BSS Area:                  0x8033BEC0 - 0x8033D8A0 (6624)
Local Heap:                0x8033D8A0 - 0x803A18A0 (409600)
Stack Area:                0x803A18A0 - 0x803A38A0 (8192)
Text (code) segment:       0x80300000 - 0x803397B0 (235440)
Boot area (physical):      0x003A4000 - 0x003E4000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.5
The boot is CFE

mac_init(): Find mac [xx-xx-xx-xx-xx-xx] in location 0
Nothing...

No eou key find
Device eth0:  hwaddr xx-xx-xx-xx-xx-xx, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C
CFE> ^C
CFE> ^C
CFE> ^C

3) Here you can run commands. To get an available menu type "help" at the prompt.

CFE> help
Available commands:

rndis               Broadcom USB RNDIS utility.
et                  Broadcom Ethernet utility.
modify              Modify flash data.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
........edited to suppress....
CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
flash0.boot          New CFI flash at 1C000000 offset 00000000 size 256KB
flash0.trx           New CFI flash at 1C000000 offset 00040000 size 1KB
flash0.os            New CFI flash at 1C000000 offset 0004001C size 7904KB
flash0.nvram         New CFI flash at 1C000000 offset 007F8000 size 32KB
flash1.boot          New CFI flash at 1C000000 offset 00000000 size 256KB
[b]flash1.trx           New CFI flash at 1C000000 offset 00040000 size 7904KB[/b]
flash1.nvram         New CFI flash at 1C000000 offset 007F8000 size 32KB
flash0               New CFI flash at 1C000000 size 8192KB
eth0                 Broadcom BCM47xx 10/100 Mbps Ethernet Controller
eth1                 Broadcom USB RNDIS Network Adapter (P-t-P)
eth2                 Broadcom BCM47xx 10/100 Mbps Ethernet Controller
*** command status = 0

We want to program flash1.trx

4) Have uploaded a copy of linksys stock firmware WRTSL54GS_2.06.0_US.bin here. Download and store this locally somewhere and navigate to that directory in a new Windows Command Prompt. E,g

C:\Router\Firmwares> dir
7,058,432         WRTSL54GS_2.06.0_US.bin

Now be ready with this tftp command but do not hit ENTER key yet.

C:\Router\Firmwares>tftp -i 192.168.1.1 put WRTSL54GS_2.06.0_US.bin


5) On the router CFE enter to the following command to make it listen for a firmware image through its tftp server, but first erase nvram

CFE> nvram erase

Hit Enter and then

CFE> flash -ctheader : flash1.trx

After hitting enter in CFE prompt, imeddiately toggle to the windows command prompt where you have the tftp put command laid out and hit enter. If it is not entered within 3-4 seconds, then the router will stop listening for a firmware and both windows will see a timeout.

If it is timed correctly then you will see success messages in both windows. In the windows command prompt

C:\Router\Firmwares>tftp -i 192.168.1.1 put WRTSL54GS_2.06.0_US.bin
Transfer successful: 7058432 bytes in 9 seconds, 784270 bytes/s

In the CFE prompt

CFE> flash -ctheader : flash1.trx
Reading :: CODE Pattern is CORRECT!
upgrade_ver[v2.6.0] upgrade_ver[20600] 4712_ver[15000]
Done. 7058432 bytes read
fname=flash1.trx
CODE Pattern is correct! (W54U)
Programming...done. 7058400 bytes written

The programming done indicates that the firmware was successfully written to flash1.

6) Last step is to reboot the router via this command

CFE> go

You will start seeing messages in the putty console as it verifies and boots into the stock OS/firmware (including the CFE).

Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 2969600 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029006
......edited for brevity....
diag_led_4704: Stop GPIO 0
diag_led_4704: Stop GPIO 1
info, udhcp client (v0.9.8) started
No interface specified. Quitting...
antdiv is 0 (off)
txant is 3
Hit enter to continue...SES_EVTI_NULL!!!
Hit enter to continue...

7) Hit enter and you are now in the linux shell. Now you can flash any firmware through webGUI or tftp and have full control on the router pre-boot.

(Last edited by loonix on 28 May 2011, 21:24)

The discussion might have continued from here.