NETGEAR WNR854T

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram.
DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

1) This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation.
This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

2) OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

Candidate for “legacy” or “notfullyworking” status.

https://forum.openwrt.org/viewtopic.php?pid=270546#p270546

Version/Model S/N OpenWrt Version Supported Model Specific Notes
WNR854T PY306200049 10.03 MiniPCI Wifi Card (big size) with 2 soldered points
CPU Ram Flash Network USB Serial JTag
ARMv5TEJ@500MHz 32MB 8MB 5 x 1 gbE No Yes Yes

T:Thumb E:Enhanced DSP Extensions J:Jazelle (Java opt) + L:Little Endian

It is adviced to have a working serial cable and a terminal program ready in case a recovery via U-Boot is required.

This section deals with how you install OpenWrt from a device freshly opened. Plus the steps required such as reset to factory defaults if the device has already been configured

Sysupgrade is supported on the WNR854T.

LuCI Web Upgrade Process
  • Browse to the System → Flash Firmware page
  • Upload openwrt-orion-squashfs.img
  • Wait for reboot
Terminal Upgrade Process
  • Login as root via SSH on 192.168.1.1
  • Use the following commands to upgrade.
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/orion/openwrt-orion-squashfs.img
sysupgrade /tmp/openwrt-orion-squashfs.img
Architecture ARM 926 (v5TEJ)
Vendor Marvell Feroceon (Orion-1*)
System-On-Chip MV88F5181 (Rev B1)
Bootloader U-Boot
CPU Speed 500 MHz
Flash-Chip Intel JS28F640
Flash size 8 MiB
RAM 2 x Nanya NT5DS8M16FS-5T (32 MiB)
Wireless Marvell 88W8361P-BEM1 802.11b/g/n (mini-PCI)
Switch Marvell 88E6131-LAR1
Ethernet 2 x 88E1112 GbE PHY
USB CPU Support but no pinout ?
Serial Yes
JTAG Yes

This SoC does not support Marvell CESA (Cryptographic Engines and Security Accelerator)

Netgear WNR854T - Enclosure

Remove one of the two screws under the box (the one on the right side) and open the right side case. There is a third screw under the serial sticker which can be kept untouched.

WNR854T

This model has an unpopulated 9-pin header that exposes a 3.3V serial port. Some pins are listed below (Board view, component side):

Pin 1 Tx 3.3V Pin 2
Pin 3 3.3V Pin 4
Pin 5 GND Pin 6
Pin 7 Rx GND Pin 8
Pin 9

Serial connection parameters are : 115200,8N1

Working very nice with CP2102 USB-to-UART USB bridge (dual voltage 3.3V / 5V) Connect only RX TX and GND pins

Can recover your device if reset doesn't works, just type ENTER and you are connected to the Shell.

You can press ENTER with a serial terminal on boot to access UBOOT menu

Check ip of router and server with printenv in uboot Default server address is set to 192.168.1.2

Prepare a FTPD server with a Kernel Image (atftpd is easy to setup) then type :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-uImage
Marvell>> bootm 0x400000

tftpboot load the kernel image from network to memory and bootm will execute it.

If your flashed kernel is broken, and the bootm procedure is working, you can flash this kernel. Here is the procedure :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-uImage
TFTP from server 192.168.10.110; our IP address is 192.168.10.190
Filename 'openwrt-wnr854t-uImage'.
Load address: 0x400000
Loading: #################################################################
         #################################################################
         ###################################################
 done
 Bytes transferred = 923332 (e16c4 hex)   <<< NOTE the kernel hex size here

Marvell>> protect off 0xff800000 0xff8fffff
 Un-Protected 8 sectors
Marvell>> erase 0xff800000 0xff8fffff
 Erased 8 sectors
Marvell>> cp.b 0x400000 0xff800000 0xf0000
 Copy to Flash... done
Marvell>> protect on 0xff800000 0xff8fffff
 Protected 8 sectors
Marvell>> reset

Then, if your filesystem is also broken, kernel will stop with a “Not Syncing error”.

You can also flash the kernel + the rootfs in a single command :

Marvell>> tftpboot 0x400000 openwrt-wnr854t-squashfs.img
Bytes transferred = 2621440 (280000 hex)
Marvell>> erase 0xff800000 0xffafffff
Marvell>> cp.b 0x400000 0xff800000 0x280000

CON3 (2×5 pins, close to the miniPCI slot) is the JTAG connector (forum post):

Pin 1 Vcc nTRST Pin 2
Pin 3 GND TDI Pin 4
Pin 5 GND TMS Pin 6
Pin 7 TDO TCK Pin 8
Pin 9 sRST RTCK Pin 10

The posting claims that OpenOCD works for this device.

You can find more informations about JTAG interface on similar marvell platforms : SheevaPlug & GuruPlug

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
lanX LAN ports (1 to 4) br-lan
wan WAN port DHCP
wlan0 WiFi Disabled

The following list is a sub-set of the capabilities of the 88E6131 Switch IC's:

  • Egress tagging/untagging - selectable per port or by 802.1Q VLAN ID
  • Port Based VLANs - supported in any combination or 802.1 VLAN support for 4096 VIDs
  • Port States and BPDU handling for spanning tree
  • 802.1X Source MAC address authentication
  • Quality of Service - switch architecture provides non-blocking switching in all traffic environments
  • Link Aggregation (802.3ad) - allows two or more links to be trunked to increase the total bandwidth and provide a fail safe if one of the links fails
  • A high speed, non-blocking, QoS switch fabric with support for four traffic classes based on:
    • Port
    • IEEE 802.1p
    • IPv4’s TOS or Diff-Serv
    • IPv6’s Traffic Class
    • 802.1Q VID
    • DA MAC address
    • SA MAC Address
  • Back-pressure flow control on half-duplex ports
  • Pause-frame flow control on full-duplex ports
  • Lookup engine supports 1024 MAC address entries with learning and aging
  • Auto-MDI/MDIX and polarity correction

The included Marvell Draft N mini-pci card is not supported, there is a module named mwl8k for it, which is under development in drivers/net/wireless/ (We need a working fmimage_8361.fw, fmimage_8363.fw is shipped with linux, but 61 doesnt work with it).

We recommand Atheros AR5416/5008 (BGN) and AR9160 (ABGN) (both uses ath9k module) wifi cards which are fully compatible : 3 antennas and Front wifi Led support.

AR5414A/5006XS (ABG 108Mb) is also working fine with madwifi module but doesn't have led support and wifi options are not fully supported by LuCi web interface. There are some problems with the ath5k module, about a “unable to warm reset MAC” on the current build and led doesn't works (Feb 2011)

AR5213A (ABG 108Mb) is working too with madwifi module (led is not linked too).

You can enable/disable the wifi led with io package (tested on atheros 5213A):

root@OpenWrt:/# io -w 0xe8004014 4 root@OpenWrt:/# io -w 0xe8004014 0

Where 0xe8000000 is the base address of Atheros Card (check dmesg)

ath_pci: wifi0: Atheros 5212: mem=0xe8000000, irq=36

The device has one reset button.

BUTTON Event
Reset reset

The button handling is not currently in “Trunk”, here are some links to implement it with kmod-button-hotplug or with a direct interrupt :

The two firsts leds (green) are also added with this patch and will add led interfaces in /sys/class/leds

The LAN leds are not controlled by CPU GPIOs, and Wifi LED is linked to the MiniPCI Led Pin 11 (which is a Wifi Card controlled GPIO)

Nothing to report except you can change MiniPCI Card.

Apparently some WNR854T suffer from a problem where the device suddenly breaks down (after a couple of weeks or months), and only the power LED remains on.

See the Fix a WNR854T with the GLOD Problem article for hardware fix. But before doing something like that, please try another 12V Power Unit.

  • Link to the WRT350Nv2 which use same orion platform (v2 only) (88F5181L SoC)
  • Freecom DT2 NAS Router on a 88F5182 SATA Platform. Nice page with some openwrt packages.
  • DIR-665 A1 which uses marvell successor cpu (Kirkwood 88F6281)
Unable to find the MV88F5181 Datasheet, here are the datasheets for the MV88F5182 :
The MV88F5281 seems closer to the MV88F5181 (same number of gpios)
There is also the Chip Pinout in this datasheet :

Nice to have patches when compiling from source yourself.

Same procedure as here just to test hardware cryptographic engine presence or absence.

OpenWRT Version Features code OpenSSL Version MD5 SHA-1 SHA-256 SHA-512 DES 3DES AES-128 AES-192 AES-256 RSA Sign RSA Verify DSA Sign DSA Verify
Attitude r25661 default libopenssl oC 1.0.0d 26144300 7654230 5116210 1558070 4094630 1445240 2511210 2128140 1873440 5.1 191.7 19.3 15.9
Attitude r26358 accelerated libopenssl OaAfbdDhHxXmMcCsSTU 1.0.0d 21206450 7789990 5474620 1647680 3339680 1182570 4511460 4581880 4087070 5.8 204.8 20.4 16.7
r26588 only kmod-crypto-hash Oh 1.0.0d 21976010 7905690 5491800 2373350 3337420 1188390 5577360 4867940 4359760 5.8 205.2 20.6 16.8
r26588 only kmod-crypto-hash, sha1, md5 kernel modules OChsm 1.0.0d 22273550 7945620 5482870 2359650 3345180 1189280 5565680 4875680 4351140 5.8 204.6 20.6 16.7
r26588 all kmod crypto OCahsmx 1.0.0d 23025910 7937200 5468980 2371300 3304450 1188050 4118600 3218580 2857920 5.8 205.7 20.7 16.8
r26588 kmod mv_cesa + kmod aes OCca 1.0.0d 22025970 7871740 5465690 2359320 3299060 1191220 4608690 4000820 3556600 5.8 205.1 20.6 16.8

Codified features list

  • o default libopenssl, O compiled with crypto acceleration support
  • a menuconfig kmod-crypto-aes, A kernel_menuconfig AES cipher algorithms
  • f menuconfig kmod-crypto-arc4, F kernel_menuconfig ARC4 cipher algorithm
  • b menuconfig kmod-crypto-cbc, B kernel_menuconfig CBC support
  • d menuconfig kmod-crypto-des, D kernel_menuconfig DES and Triple DES EDE cipher algorithms
  • h menuconfig kmod-crypto-hash, H kernel_menuconfig HASH
  • x menuconfig kmod-crypto-hmac, X kernel_menuconfig HMAC support
  • m menuconfig kmod-crypto-md5, M kernel_menuconfig MD5 digest algorithm
  • c menuconfig kmod-crypto-mv-cesa, C kernel_menuconfig (default) Marvell's Cryptographic Engine
  • s menuconfig kmod-crypto-sha1, S kernel_menuconfig SHA1 digest algorithm
  • T kernel_menuconfig SHA224 and SHA256 digest algorithm
  • U kernel_menuconfig SHA384 and SHA512 digest algorithms

You can change default Mac-address in u-boot environment, with setenv ethaddr 12:34:56:78:51:81 and then saveenv.

Here is the default one, if you lose it :

baudrate=115200
loads_echo=0
ipaddr=192.168.1.1
serverip=192.168.1.2
rootpath=/mnt/ARM_FS/
cpuName=926
uboot_ver=v1.08 GE RT
CASset=min
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:eth0:none
image_name=uImage
bootargs=console=ttyS0,115200
ethaddr=00:00:00:00:51:81
usb0Mode=host
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
bootargs2=$(bootargs)
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootcmd=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootnfs=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock1 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
bootdelay=3
disaMvPnp=no
overEthAddr=no
ethact=egiga0

(dump from oldwiki)

The hardware in this router is very similar to the Buffalo WZR-AG300, although that has two N cards and the user space differs. However, the Airlink 101 AR625W is a carbon of this router, and is identical in almost every detail.

The board is labeled as WRTM-177GN_V01. It contains:

  • a Marvell 88F5180NB1 (under a black heatsink).
  • a Marvell 88E6131-LAR1 (black heatsink).
  • two Marvell 88E1112 GbE PHY (small silver heatsink). They seems to be connected to the rightmost Ethernet ports.
  • two Nanya NT5DS8M16FS-5T RAM IC (one on each side of the PCB).
  • an Intel JS28F640 flash
  • an ALVCH162260 (close to the flash above)
  • an oversized miniPCI card containing a Marvell 88W8361P-BEM1 (stepping A3P) and an Etrontech EM638325TS-6G (RAM?). It's got its own FCC ID: PY306200049.

The PCB layout is similar to the Sparklan WRTM-320 except for the voltage regulators.

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/12/05 11:52
  • by tmomas