NETGEAR WNR854T

Candidate for “legacy” or “notfullyworking” status.

https://forum.openwrt.org/viewtopic.php?pid=270546#p270546

T:Thumb E:Enhanced DSP Extensions J:Jazelle (Java opt) + L:Little Endian

It is adviced to have a working serial cable and a terminal program ready in case a recovery via U-Boot is required.

This section deals with how you install OpenWrt from a device freshly opened. Plus the steps required such as reset to factory defaults if the device has already been configured

• Download http://backfire.openwrt.org/10.03/orion/openwrt-wnr854t-squashfs-webupgrade.img
• Please note somewhere your current Mac Adresses (for LAN, WAN and Wifi), or export your current config.
• Open the firmware update page at http://192.168.1.1/UPG_upgrade.htm
• Upload openwrt-wnr854t-squashfs-webupgrade.img
• Wait until the device reboots
• Telnet to 192.168.1.1 and set a root password
• opkg update
• opkg install luci
• /etc/init.d/uhttpd enable
• /etc/init.d/uhttpd start
• Browse to http://192.168.1.1

Sysupgrade is supported on the WNR854T.

• Browse to the System → Flash Firmware page
• Upload openwrt-orion-squashfs.img
• Wait for reboot

• Login as root via SSH on 192.168.1.1
• Use the following commands to upgrade.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/orion/openwrt-orion-squashfs.img
sysupgrade /tmp/openwrt-orion-squashfs.img

This SoC does not support Marvell CESA (Cryptographic Engines and Security Accelerator)

Remove one of the two screws under the box (the one on the right side) and open the right side case. There is a third screw under the serial sticker which can be kept untouched.

This model has an unpopulated 9-pin header that exposes a 3.3V serial port. Some pins are listed below (Board view, component side):

Serial connection parameters are : 115200,8N1

Working very nice with CP2102 USB-to-UART USB bridge (dual voltage 3.3V / 5V) Connect only RX TX and GND pins

Can recover your device if reset doesn't works, just type ENTER and you are connected to the Shell.

You can press ENTER with a serial terminal on boot to access UBOOT menu

Check ip of router and server with printenv in uboot Default server address is set to 192.168.1.2

Prepare a FTPD server with a Kernel Image (atftpd is easy to setup) then type :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-uImage
Marvell>> bootm 0x400000

tftpboot load the kernel image from network to memory and bootm will execute it.

If your flashed kernel is broken, and the bootm procedure is working, you can flash this kernel. Here is the procedure :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-uImage
TFTP from server 192.168.10.110; our IP address is 192.168.10.190
Filename 'openwrt-wnr854t-uImage'.
Load address: 0x400000
Loading: #################################################################
         #################################################################
         ###################################################
 done
 Bytes transferred = 923332 (e16c4 hex)   <<< NOTE the kernel hex size here

Marvell>> protect off 0xff800000 0xff8fffff
 Un-Protected 8 sectors
Marvell>> erase 0xff800000 0xff8fffff
 Erased 8 sectors
Marvell>> cp.b 0x400000 0xff800000 0xf0000
 Copy to Flash... done
Marvell>> protect on 0xff800000 0xff8fffff
 Protected 8 sectors
Marvell>> reset

Then, if your filesystem is also broken, kernel will stop with a “Not Syncing error”.

You can also flash the kernel + the rootfs in a single command :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-squashfs.img
Bytes transferred = 2621440 (280000 hex)
Marvell>> erase 0xff800000 0xffafffff
Marvell>> cp.b 0x400000 0xff800000 0x280000

CON3 (2×5 pins, close to the miniPCI slot) is the JTAG connector (forum post):

The posting claims that OpenOCD works for this device.

You can find more informations about JTAG interface on similar marvell platforms : SheevaPlug & GuruPlug

The default network configuration is:

The following list is a sub-set of the capabilities of the 88E6131 Switch IC's:

• Egress tagging/untagging - selectable per port or by 802.1Q VLAN ID
• Port Based VLANs - supported in any combination or 802.1 VLAN support for 4096 VIDs
• Port States and BPDU handling for spanning tree
• 802.1X Source MAC address authentication
• Quality of Service - switch architecture provides non-blocking switching in all traffic environments
• Link Aggregation (802.3ad) - allows two or more links to be trunked to increase the total bandwidth and provide a fail safe if one of the links fails
• A high speed, non-blocking, QoS switch fabric with support for four traffic classes based on:
  • Port
  • IEEE 802.1p
  • IPv4’s TOS or Diff-Serv
  • IPv6’s Traffic Class
  • 802.1Q VID
  • DA MAC address
  • SA MAC Address
• Back-pressure flow control on half-duplex ports
• Pause-frame flow control on full-duplex ports
• Lookup engine supports 1024 MAC address entries with learning and aging
• Auto-MDI/MDIX and polarity correction

The included Marvell Draft N mini-pci card is not supported, there is a module named mwl8k for it, which is under development in drivers/net/wireless/ (We need a working fmimage_8361.fw, fmimage_8363.fw is shipped with linux, but 61 doesnt work with it).

We recommand Atheros AR5416/5008 (BGN) and AR9160 (ABGN) (both uses ath9k module) wifi cards which are fully compatible : 3 antennas and Front wifi Led support.

AR5414A/5006XS (ABG 108Mb) is also working fine with madwifi module but doesn't have led support and wifi options are not fully supported by LuCi web interface. There are some problems with the ath5k module, about a “unable to warm reset MAC” on the current build and led doesn't works (Feb 2011)

AR5213A (ABG 108Mb) is working too with madwifi module (led is not linked too).

You can enable/disable the wifi led with io package (tested on atheros 5213A):

root@OpenWrt:/# io -w 0xe8004014 4 root@OpenWrt:/# io -w 0xe8004014 0

Where 0xe8000000 is the base address of Atheros Card (check dmesg)

ath_pci: wifi0: Atheros 5212: mem=0xe8000000, irq=36

The device has one reset button.

The button handling is not currently in “Trunk”, here are some links to implement it with kmod-button-hotplug or with a direct interrupt :

• Kernel Patch for Leds and Button handling
• Hotplug Button script and dependencies (Link down)

The two firsts leds (green) are also added with this patch and will add led interfaces in /sys/class/leds

The LAN leds are not controlled by CPU GPIOs, and Wifi LED is linked to the MiniPCI Led Pin 11 (which is a Wifi Card controlled GPIO)

Nothing to report except you can change MiniPCI Card.

Apparently some WNR854T suffer from a problem where the device suddenly breaks down (after a couple of weeks or months), and only the power LED remains on.

See the Fix a WNR854T with the GLOD Problem article for hardware fix. But before doing something like that, please try another 12V Power Unit.

• Flashing guide in the forum: https://forum.openwrt.org/viewtopic.php?pid=93330#p93330
• Marvell 88F5xx81 support thread: https://forum.openwrt.org/viewtopic.php?id=12358

• Orion GIT : http://git.kernel.org/?p=linux/kernel/git/nico/orion.git
• Marvell's GIT (Linux support for the Marvell Orion SoC family): http://git.marvell.com/?p=orion.git;a=summary
• Netgear GPL sources : http://kb.netgear.com/app/answers/detail/a_id/2649/~/gpl-open-source-code-for-programmers

• Tanguy's WNR854T page

• Link to the WRT350Nv2 which use same orion platform (v2 only) (88F5181L SoC)
• Freecom DT2 NAS Router on a 88F5182 SATA Platform. Nice page with some openwrt packages.
• DIR-665 A1 which uses marvell successor cpu (Kirkwood 88F6281)

Unable to find the MV88F5181 Datasheet, here are the datasheets for the MV88F5182 :

• Marvell MV88F5182 SoC Datasheet
• Marvell MV88F5182 Opensource Manual
• Marvell MV88F5182 User Manual

The MV88F5281 seems closer to the MV88F5181 (same number of gpios)
There is also the Chip Pinout in this datasheet :

• Marvell MV88F5281 SoC Datasheet

Nice to have patches when compiling from source yourself.

• #7209 patch Upsteamable patch to mwl8k.
• #8160 patch LEDs and input support. Test with diag.sh.
• #8183 patch Allow flexible kernel mtd sizes.
• #8325 patch Mirror bridge switch configuration from software to hardware.
• #8729 patch Leds, button and board id
• patch DMA for Marvell CESA.

Same procedure as here just to test hardware cryptographic engine presence or absence.

• o default libopenssl, O compiled with crypto acceleration support
• a menuconfig kmod-crypto-aes, A kernel_menuconfig AES cipher algorithms
• f menuconfig kmod-crypto-arc4, F kernel_menuconfig ARC4 cipher algorithm
• b menuconfig kmod-crypto-cbc, B kernel_menuconfig CBC support
• d menuconfig kmod-crypto-des, D kernel_menuconfig DES and Triple DES EDE cipher algorithms
• h menuconfig kmod-crypto-hash, H kernel_menuconfig HASH
• x menuconfig kmod-crypto-hmac, X kernel_menuconfig HMAC support
• m menuconfig kmod-crypto-md5, M kernel_menuconfig MD5 digest algorithm
• c menuconfig kmod-crypto-mv-cesa, C kernel_menuconfig (default) Marvell's Cryptographic Engine
• s menuconfig kmod-crypto-sha1, S kernel_menuconfig SHA1 digest algorithm
• T kernel_menuconfig SHA224 and SHA256 digest algorithm
• U kernel_menuconfig SHA384 and SHA512 digest algorithms

You can change default Mac-address in u-boot environment, with setenv ethaddr 12:34:56:78:51:81 and then saveenv.

Here is the default one, if you lose it :

baudrate=115200
loads_echo=0
ipaddr=192.168.1.1
serverip=192.168.1.2
rootpath=/mnt/ARM_FS/
cpuName=926
uboot_ver=v1.08 GE RT
CASset=min
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
bootargs=console=ttyS0,115200
ethaddr=00:00:00:00:51:81
usb0Mode=host
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
bootargs2=$(bootargs)
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootcmd=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootnfs=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootdelay=3
disaMvPnp=no
overEthAddr=no
ethact=egiga0

(dump from oldwiki)

The hardware in this router is very similar to the Buffalo WZR-AG300, although that has two N cards and the user space differs. However, the Airlink 101 AR625W is a carbon of this router, and is identical in almost every detail.

The board is labeled as WRTM-177GN_V01. It contains:

• a Marvell 88F5180NB1 (under a black heatsink).
• a Marvell 88E6131-LAR1 (black heatsink).
• two Marvell 88E1112 GbE PHY (small silver heatsink). They seems to be connected to the rightmost Ethernet ports.
• two Nanya NT5DS8M16FS-5T RAM IC (one on each side of the PCB).
• an Intel JS28F640 flash
• an ALVCH162260 (close to the flash above)
• an oversized miniPCI card containing a Marvell 88W8361P-BEM1 (stepping A3P) and an Etrontech EM638325TS-6G (RAM?). It's got its own FCC ID: PY306200049.

The PCB layout is similar to the Sparklan WRTM-320 except for the voltage regulators.

How to add tags