Created: Sep 27 2007
Updated: Jun 17 2010

Modified CFE 3.7 bootloader

For overclocking the Linksys WRT54GL to 275MHz

DISCLAIMER: I don't guarantee that this will work. Note that flashing your CFE may brick your router to the point where you'll need a JTAG cable for recovery. The sole purpose of flashing with this bootloader is to achieve higher overclocks than the stock WRT54GL CFE bootloader (which limits you to 250MHz) will allow. I wouldn't overclock to 250-275MHz without the help of at least a small heatsink, and optionally a small 12V DC fan, which you can solder to the power supply (if it's too loud you can throw in a resistor). If you have a small heatsink that you want to use, I recommend Arctic Silver Thermal Adhesive if you want to permanently attach it.

All I've done towards this was adapt it for a Linksys WRT54GL CFE 3.7 image and add a couple of unrelated, but useful, nvram tweaks. You'll find the original page where the file is available for CFE 3.6, along with a lot of good information, at http://www.bitsum.com/openwiking/owbase/ow.asp?WRT54G.

The MAC addresses have been set to match those of the CFE 3.6 version, because I couldn't think of anything else better to set them to, so you'll want to change those with a hex-editor (at 0x10CC, 0x1156 and 0x1E00). The nvram settings that I added are:

boot_wait=on
reset_gpio=6

You may also want to copy the various nvram settings for memory from your current bootloader to the image before flashing.

The preferred method of flashing is with a JTAG cable. If you're too lazy to build a cable, you can use a read/write CFE module compiled and posted to the OpenWrt forums by CheshireCat, which you can also download below (the source is currently unavilable, if anybody has it, please send me a link for it). I've tested it with OpenWrt Whiterussian RC5-0.9 and Kamikaze up to 7.09 (with 2.4 kernels).

Send me an email if you have any questions or comments.

Modified CFE 3.7 bootloader

Filename: cfe37-mod.bin
Filesize: 256KB
md5sum: 1790f91f87a1c072e40f83e5b4a142d1

ChesireCat's rwcfe module

Filename: rwflash.o
Filesize: 2.8KB
md5sum: 25be73103ff218848b0a4a966344f6c4

root@OpenWrt:~# insmod rwflash.o
root@OpenWrt:~# cat /proc/mtd | grep cfe
dev:    size   erasesize  name
mtd0: 00040000 00010000 "cfe"
mtd4: 00040000 00010000 "rwcfe"

The mtd assignment for rwcfe (4 in this case) may vary. Now test the MD5 signatures of both to make sure they map the same partition:

root@OpenWrt:~# md5sum /dev/mtd/0 /dev/mtd/4

If they match you're ready to flash. If something goes wrong during this flash, or the bootloader isn't compatible with your model, you're going to end up needing a JTAG cable anyway. Continue:

root@OpenWrt:~# mtd write cfe37-mod.bin rwcfe

When that's done, double check the MD5 of the bin file against both the cfe and rwcfe partitions:

root@OpenWrt:~# md5sum /dev/mtd/0 /dev/mtd/4 cfe37-mod.bin

If they match, reboot. If your router comes back up and you're able to log in, congratulations, you haven't bricked it. Yet.

root@OpenWrt:~# nvram set clkfreq=275
root@OpenWrt:~# nvram commit

And reboot again. When it comes back up, make sure it's working as it should be:

root@OpenWrt:~# dmesg | grep CPU:
CPU: BCM5352 rev 0 at 275 MHz

root@OpenWrt:~# cat /proc/cpuinfo
system type             : Broadcom BCM5352 chip rev 0
processor               : 0
cpu model               : BCM3302 V0.8
BogoMIPS                : 274.43
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available

Again, if you're running it at these speeds for very long without at least a heatsink, it's more than likeky going to overheat and lock up. Proper cooling is a must.