Buffalo WHR-G54S

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

The WHR-G54S is a 802.11g wireless router with a 5 port programmable ethernet switch which supports VLANs.

SoC CPU speed Ram Flash Network USB Serial JTag
Broadcom 5352 200 MHz 16MiB 4MiB 5 x 1 Yes Yes ?

The WHR-G54S runs a tftp server at 192.168.11.1 on the LAN interface during the boot process. OpenWrt should be installed via TFTP, follow the instructions in the HOWTO section.

If the device has been installed with OpenWrt in the past, it is possible that (somehow) the tftp server address is set to 192.168.1.1 (mine was)

In the past there have been some reported problems with the 2.6 kernel versions but these appear to be resolved. Although Attitude Adjustment 12.09-rc1 does appear to run on this router it is extremely slow.

Now officially Trunk and AA are not supported for this router (from Attitude Adjustment announcement) “Lower end devices with only 16 MiB RAM will easily run out of Memory, for bcm47xx based devices is Backfire with brcm-2.4 recommended” Backfire 10.03.1 (suggested previous to my edit of this wiki) provides a more acceptable level of performance.

The base trunk as of r36656 will OOM this router at boot time, even without wireless drivers loading (https://dev.openwrt.org/ticket/13558)

In any case the generic brcm47xx image should be used. The filename for that image will be something like openwrt-brcm47xx-squashfs.trx

This device can be upgraded via LuCI.

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself.

Port Switch port
Internet (WAN) 4
LAN 1 0
LAN 2 1
LAN 3 2
LAN 4 3

CFE version 1.0.37-1.07 for BCM947XX (32bit,SP,LE) Build Date: 2005\uffff\uffff 10\uffff\uffff 17\uffff\uffff \uffff\uffff\uffff\uffff\uffff\uffff 04:38:11 JST (root@ifedora) Copyright (C) 2000,2001,2002,2003 Broadcom Corporation. Initializing Arena Initializing Devices. * cmdset: AMD Standard * Insaner_1 = (0xa8) * flashutl_cmd: type (0004), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0003), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0002), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * Flash Info. -> manufacturer (00), device (FF) * Flash Info. -> manufacturer2 (0000), device2 (0000) * Insaner_2 = (0xa8) * cmdset: AMD Standard * Insaner_1 = (0xa8) * flashutl_cmd: type (0004), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0003), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0002), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * Flash Info. -> manufacturer (00), device (FF) * Flash Info. -> manufacturer2 (0000), device2 (0000) * Insaner_2 = (0xa8) * cmdset: AMD Standard * Insaner_1 = (0xa8) * flashutl_cmd: type (0004), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0003), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * flashutl_cmd: type (0002), read_id (0090) -> vendid (00C2), devid (22A8), devid2 (0000) * Flash Info. -> manufacturer (00), device (FF) * Flash Info. -> manufacturer2 (0000), device2 (0000) * Insaner_2 = (0xa8) et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.39.0 * memc_config: (00048000) CPU type 0x29008: 200MHz Total memory: 16384 KBytes Total memory used by CFE: 0x80400000 - 0x804A29A0 (666016) Initialized Data: 0x80438650 - 0x8043B1F0 (11168) BSS Area: 0x8043B1F0 - 0x8043C9A0 (6064) Local Heap: 0x8043C9A0 - 0x804A09A0 (409600) Stack Area: 0x804A09A0 - 0x804A29A0 (8192) Text (code) segment: 0x80400000 - 0x80438650 (230992) Boot area (physical): 0x004A3000 - 0x004E3000 Relocation Factor: I:00000000 - D:00000000 Device eth0: hwaddr 00-16-01-11-45-00, ipaddr 192.168.11.1, mask 255.255.255.0 gateway not set, nameserver not set Wait a few seconds for an image Reading :: Failed.: Timeout occured >>> boot -raw -z -addr=0x80001000 -max=0x3a0000 flash0.os: Loader:raw Filesys:raw Dev:flash0.os File: Options:(null) Loading: ...... 1732608 bytes read Entry at 0x80001000 Closing network. Starting program at 0x80001000 CPU revision is: 00029008 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.20 (root@localhost.localdomain) (gcc version 3.3.3) #4 2005\uffff\uffff\uffff 8\uffff\uffff\uffff 11\uffff\uffff\uffff \uffff\uffff\uffff\uffff\uffff\uffff\uffff\uffff\uffff 21:50:46 JST Setting the PFC to its default value Determined physical RAM map: memory: 01000000 @ 00000000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200 CPU: BCM5352 rev 0 at 200 MHz Calibrating delay loop... 199.47 BogoMIPS Memory: 14148k/16384k available (1507k kernel code, 2236k reserved, 104k data, 64k init, 0k highmem) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX PCI: no core PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 mel_initsw: GPIO initialize done.. BUFFALO SWICH&LED DRIVER ver 1.00 Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xb8000300 (irq = 3) is a 16550A ttyS01 at 0xb8000400 (irq = 0) is a 16550A HDLC line discipline: version $Revision$, maxframe=4096 N_HDLC line discipline registered. PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 Flash device: 0x400000 at 0x1c000000 Physically mapped flash: cramfs filesystem found at block 1024 Creating 4 MTD partitions on "Physically mapped flash": 0x00000000-0x00040000 : "boot" 0x00040000-0x003e0000 : "linux" 0x00100000-0x003e0000 : "rootfs" 0x003e0000-0x00400000 : "nvram" sflash: found no supported devices NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack ip_tables: (C) 2000-2002 Netfilter core team *** #define HZ is (100). ipt_time loading NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.7 Ben Greear All bugs added by David S. Miller VFS: Mounted root (cramfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 64k freed init started: BusyBox v1.00 (2005.08.11-13:00+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 mount: Mounting none on / failed: Permission denied MidLayer.c(1878) ML_Initialize :***** Please push init button if you want to init_reboot ****** insmod: /lib/modules/2.4.20: No such file or directory Using /lib/modules/kernel/drivers/net/et/et.o Warning: loading et will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules eth0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.130.1.10 Please press Enter to activate this console. create procpoint for station information eth%d eth1: Broadcom BCM4318 802.11 Wireless Controller 3.130.1.10 et0: link up (interface up) register_vlan_device: ALREADY had VLAN registered register_vlan_device: ALREADY had VLAN registered Performing WLC_COMMIT wlc_set_rate_override:35629: band 11a wl0: Channel Select: 10 BusyBox v1.00 (2005.08.11-13:00+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. # ls bin dev etc lib mnt proc tmp usr var www # * VPN Masqurade -- IPsec Support reg isakmp:done reg ESP protocol: reg ESP conntrack:done ip_nat_ipsec : isakmp : done. ip_nat_ipsec : esp : done.


Setting the PFC value as 0x15 Determined physical RAM map: memory: 01000000 @ 00000000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/pre init noinitrd console=ttyS0,115200 CPU: BCM5352 rev 0 at 200 MHz Using 100.000 MHz high precision timer. Calibrating delay loop... 199.47 BogoMIPS Memory: 14268k/16384k available (1412k kernel code, 2116k reserved, 100k data, 8 0k init, 0k highmem) Dentry cache hash table entries: 2048 (order: 2, 16384 bytes) Inode cache hash table entries: 1024 (order: 1, 8192 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) Buffer cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX PCI: no core PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB. Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher pty: 256 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en abled ttyS00 at 0xb8000300 (irq = 3) is a 16550A ttyS01 at 0xb8000400 (irq = 0) is a 16550A b44.c:v0.93 (Mar, 2004) PCI: Setting latency timer of device 00:01.0 to 64 eth0: Broadcom 47xx 10/100BaseT Ethernet 00:0d:0b:e8:a9:1e Physically mapped flash: Found an alias at 0x400000 for the chip at 0x0 Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0 Physically mapped flash: Found an alias at 0xc00000 for the chip at 0x0 Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0 Physically mapped flash: Found an alias at 0x1400000 for the chip at 0x0 Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0 Physically mapped flash: Found an alias at 0x1c00000 for the chip at 0x0 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Flash device: 0x400000 at 0x1c000000 Creating 4 MTD partitions on "Physically mapped flash": 0x00000000-0x00040000 : "pmon" 0x00040000-0x003f0000 : "linux" 0x000c0000-0x003f0000 : "rootfs" 0x003f0000-0x00400000 : "nvram" Initializing Cryptographic API NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 2048) ip_conntrack version 2.1 (5953 buckets, 5953 max) - 328 bytes per conntrack ip_tables: (C) 2000-2002 Netfilter core team NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (jffs2 filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 80k freed Algorithmics/MIPS FPU Emulator v1.5 diag boardtype: 00000467 Probing device eth0: found! b44: eth0: Link is up at 100 Mbps, full duplex. b44: eth0: Flow control is off for TX and off for RX. jffs2.bbc: SIZE compression mode activated. PCI: Setting latency timer of device 00:05.0 to 64 eth1: Broadcom BCM4318 802.11 Wireless Controller 3.90.37.0 Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky BFL_ENETADM not set in boardflags. Use force=1 to ignore. device eth0 entered promiscuous mode vlan0: add 01:00:5e:00:00:01 mcast address to master interface vlan0: dev_set_promiscuity(master, 1) vlan0: dev_set_allmulti(master, 1)


Architecture MIPS
Vendor Broadcom
bootloader CFE
System-On-Chip Broadcom 5352
CPU/Speed BCM3302 V0.8 / 200 MHz
Flash-Chip ?
Flash size 4 MiB
RAM-Chips IS42S16400B-7TL / SDR-143
RAM size 16 MiB
Wireless Broadcom 4306 802.11bg
Ethernet w/ vlan support swconfig
Internet n/a
USB No
Serial Yes
JTAG Yes

Note: This will void your warranty!

  • Remove the Torx screw under the bottom label
  • Gently tear off the bottom cover

There is a serial port on the main circuit board which uses 3.3 Volt RS232 interface. Please make sure you have the correct equipment to interface to a 3.3V serial port.

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

The Bufalo WHR-G54S has one push buttons (AOSS), one Reset Button and a toggle switch (used to toggle btween router and bridge mode when using the Buffalo original firmware). The author has not tested these yet.

During powerup the Router is configured as 192.168.11.1 for a few seconds and listens for a TFTP transfer. This can be used to re-load firmware.

Enabling wireless on this device causes the realtime load average, wifi, and active connections graphs to stop working as well as causes multiple entries of the following in syslog Dec 21 23:14:02 BuffAP kern.err kernel: [ 401.460000] NOHZ: local_softirq_pending 08 see https://dev.openwrt.org/ticket/10651

Additionally, trying to go into recovery mode presents you with a router that will not have networking see https://dev.openwrt.org/ticket/7502

And, Finally, trunk builds as of 19 May 2013 (r36676) will cause OOM if you enable wireless using either the open or proprietary drivers. No bug filed yet.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2019/10/02 16:31
  • by tmomas