Motorola WR850G

OpenWRT versions

The WR850G is supported by White Russian and Kamikaze versions of OpenWRT.

The Broadcom wireless is not yet robustly supported by an open source driver. The proprietary driver is only available for Linux kernel 2.4. If you need to use wireless, you need to use a version of OpenWRT based on the 2.4 kernel. White Russian is based on the 2.4 kernel and there is a version of Kamikaze based on the 2.4 kernel. Beware: the main version of Kamikaze is based on the 2.6 kernel and does not support the Broadcom wireless.

Kamikaze 7.07 and 7.09 misidentify several models of this router (see It is probable that the only consequences are that the lights on the unit are not correctly used.

Hardware versions

The WR850G has three different versions (v1, v2, v3).

WR850G v1

The WR850G v1 is based on the Broadcom 4710 board. It has a 125MHz CPU, 4Mb flash and 16Mb SDRAM. The wireless NIC is a mini-PCI card.

WR850gV1 open box

WR850G v2

The WR850G v2 is based on the Broadcom 4712 board. It has a 200MHz CPU, 4Mb flash and 16Mb SDRAM (memory addressing wraps address to ram, so when it boots, the simple memory size routine doesn't check for address wrapping, so it reports 32Mb). The wireless NIC is integrated to the board.

Note: In at least three (feagle814's, rgh12's, tl's) WR850G v2, there is 16MB of RAM onboard. DO NOT try the 32mb enablement hack on the WR850G v2 without first verifying how much RAM you really have (see earlier paragraph on the address wrap problem)!

ISSI I!S42S16400B1-7T is a 8MB chip (1Mbx16x4, 64Mb total [divided by 8 = 8megabytes]). G-Link GL!T5640L16-6TC is also an 8MB chip. If you have the ISSI I!S42S16800xx-7t it is a 16MB chip (2Mbx16x4 128Mb total [divided by 8 = 16megabytes]). There are two RAM chips installed on the v2 router, the other one is on the back side of the circuitboard. Since the Linksys wrt54gs has 32megabytes of ram (2 chips also) installed in it, and if you wanted to use the same packages as it does, then you must either change the 8MB chips to 16MB chips, or live with the fact that you will be somewhat restricted in what you can do with the smaller amount of memory available (possibly limiting what packages you can safely run). If you are really lucky, you may not have to do anything at all (if you have the 16MB chips installed already).

The WR850G v2 is housed in gray plastic and sports a reverse SMA antenna connector.

/!\ Warning: It has been reported at least once that the WR850GV2 may not rewrite NVRAM once it has been erased, causing damage to the router. However, frop and Eagle_Fire have never had issues clearing the NVRAM of a WR850Gv2 - please note that the lan_ipaddr may revert to upon reset of NVRAM.

There are at least 2 different "v2" versions. One (part number 498417-001-00) has a gray plastic case, 5VDC power supply and mini-PCI card. This one appears to be a "version 1b". The other (part number 513315-001-00) has a gray plastic case, 12VDC power supply and integrated NIC.

WR850gV2 open box

FCC ID: ACQWR850GV2. You can look up information about this product at the FCC site

WR850G v3

The WR850G v3 is based on the Broadcom 4712 board. It has a 200MHz CPU, 4Mb flash and 16Mb SDRAM. The wireless NIC is integrated to the board.

G-Link GL!T5640L16-6TC is a 8MB chip. Your router should have two of these. Check the bottom of the PCB for the second one.

The WR850G v3 version is housed in black pastic and has a hard wired non removable (without desoldering) antenna.

WR850gV3 open box

Obtaining Official Motorola Firmware

If you ever need to revert your router to official Motorola firmware, it can be downloaded from their website. The downloaded

files are self-extracting
's; any unzipping software should be able to handle them. They contain a
firmware file, as well as

Loading Firmware

First read Installing.

Motorola firmware loading (either via TFTP through BOOT_WAIT or via the Motorola Firmware's firmware upgrade web interface page) requires that the firmware binary have an extra header. See the Installing section on TRX vs. BIN.

OpenWRT firmware loading (through the webif or webif2 web interface page) requires that this extra header be absent.

Motorola's firmware is distributed with the header.

OpenWRT firmware is distributed in both forms. The file ending in .trx is generic and does not have the Motorola header. The file containing a Motorola model name and ending in .bin has the header.

If you are going to use OpenWRT to burn firmware, and the firmware binary has the Motorola header, you must first strip the header from the firmware binary that you downloaded. You can either do this with dd(1)

 $ dd if=WR850G_V403.trx of=WR850G_V403.stripped.trx ibs=1 skip=8 

or with motorola-bin (but only versions released after 2007 October)

 $ motorola-bin --strip WR850G_V403.trx  WR850G_V403.stripped.trx

As of 2007 October 28, the latest OpenWRT binary without the Motorola header is openwrt-brcm-2.4-squashfs.trx.|The same firmware with the Motorola header is].

Using Boot Wait

  • Install Motorola Firmware Version 4.03 onto the router. (see above)
  • Login to the router's web page and go to
  • Type in:
    nvram set boot_wait=on
  • Type in:
    nvram commit
  • Reboot and do tftp.

/!\ Some users report that boot_wait only functions for one reboot after setting it from the web interface. To be sure that is the case reboot the WR850G after to "boot_wait=on" procedure. If the box is up again then issue "nvram get boot_wait" on the very same /frame_debug.asp page. At least the WR850G v2 does act like this.

To ensure the boot_wait will remain "on" then the first thing you should do after upgrade to OpenWRT is to log into it with telnet and issue:

nvram set boot_wait=on; nvram commit

The WR850G boot utility always comes up as To test this, try, set a static IP on your router and plug in to a wired port with your PC in the IP range 192.168.10.x, then in a Windows command prompt, get "ping -t" going and power cycle the router, you should get about 4 pings on from the bootloader if boot_wait is set.

Loading from Motorola 4.03

My WR850g had been upgraded to:
WR850G 4.03 Firmware
Part Number 515750-001
Product WR850G
Release Version 4.03
Date 05/04

With firmware version 4.03 the control page has an option upgrade firmware. The file for the Motorola wr850g is openwrt-wr850g-squashfs.bin however the upgrade routine requires that you rename the file to *.trx in order for it to be uploaded. After the upload the modem light blinks red for about a minute.
Now you need to wait 3 to 5 minutes for the firmware to initialize. Do NOT act hastily and unplug the router. Follow the Motorola instructions and go and make tea.
The IP address used prior to loading OpenWrt is retained. I put the original IP address (I had used in the brower and it pulled up the openwrt welcome page. A lot easier than bootwait.

Loading from OpenWrt

Use the web interface. Go to System and Firmware Upgrade. Browse for the new firmware and click upgrade.

Known problems with OpenWRT on Motorola routers

diag misidentifies some models


/proc/diag/model will tell you what model diag and hence OpenWRT thinks you have.

It is not known for sure what consequences misidentification has. The most probably effect will be to cause the lights to be misused. It might also cause the vlan to be misconfigured (see below).

As a temporary work-around, you can issue these shell commands on the router:

# nvram set MOTO_BOARD_TYPE=WR_FEM1 ; nvram commit 

WLAN and LAN4 ports swapped

On one Motorola WR850g v2 router, installing Kamikaze 7.07 resulted in the WAN port acting as a LAN port and the LAN4 port acting as the WAN port.

/etc/config/network was set up incorrectly for this router:


    config switch eth0
            option vlan0        "1 2 3 4 5*"
            option vlan1        "0 5"


    config switch eth0
            option vlan0        "0 1 2 3 5*"
            option vlan1        "4 5"

There is a suspicion that the diag bug may cause this problem.

When upgrading the firmware, one should probably disconnect the WAN port in case it becomes a LAN port after the upgrade.

Finding the serial ports on the WR850G

The primary reason for finding serial ports on the router is to help in debricking. There is no way to load firmware from the serial port. However, given a simple typing mistake for an nvram value, you will be able to have a console shell to help fix a typo problem. I have used my v1 serial port thousands of times already from nvram mistakes. The most major, deleting all nvram variables (do not try this –kko).

The debrick tool modification of adding a serial port is only needed when you erase or program the flash with an image, then read the image and these two don't match. If you don't see that problem forget about the modification - You don't need it. Reference

If you want to use the serial port on the router by sending messages via the network see Redirecting a TCP port to COM port


Version 1 of the WR850G has no onboard UART. This means that all you have available are control and data lines on a header labeled J5. There is no connector on these pins, so one would need to be added. A conversion board may then be made with a UART connected to this header and will give you a serial port. This information derived from Technik:

  • Open the WR850G. Serial data and control is labeled J5, pinout as follows:
  • Note: This is a male, 2x20 pin connector

 D0 - O o - A0
 D1 - o o - A1
 D2 - o o - A2
 D3 - o o - CHSL
 D4 - o o - /CS
 D5 - o o - /RD
 D6 - o o - /WR
 D7 - o o - MR
VCC - o o - INT1
GND - o o - SIN

  • Here is a circuit to connect to this header for a serial port. Note pin 2 here connects to pin 1 above.

WR850G v2 & v3

First serial port:

  • Open the WR850G. The plastic is hard and the clips are strong - use force! Serial is labeled RJP1, pinout as follows:

      o o - RX
GND - o o
      o o
VCC - o o - TX

Second serial port:

While the first serial port is easy to find (and described in the "non-experimental" installation section above), the second serial port is quite well hidden. On the bottom of the board near the serial connector you'll notice there are two small black components labeled "0". Next to them there are solder pads where you'd expect two more "0" components to go - but they're missing! On the set of pads away from the serial connector, the second serial port signals are exposed. Get out your fine-tipped soldering iron and solder some fine wires to the pads opposite the serial connector. RR93 is data out of the WR, and RR94 is data in.

Off Site Pictures

Reverting an OpenWRT WR850G to the Official Motorola Firmware

  • Note: These instructions are Windows-centered
  • Obtain a Motorola

firmware file (see above, Obtaining Official Motorola Firmware)

  • Edit the file to remove Motorola's 8 byte header (everything before "HDR0"). This can be done with a hex editor (such as HHD for Windows) or with the Unix

command: (be sure to see the note below)

 $ dd if=WR850G_V403.trx of=WR850G_V403.stripped.trx ibs=1 skip=8 

Note: At least some bootloader version does not work with such a stripped file but will instead take the unstripped .trx-file. If flashing does not work in the later steps, try again without this step.

  1. Make sure your "boot_wait" NVRAM value is set to "on" and saved (I use "Putty" for telneting/ssh).
  2. Set your local machine's IP address to (or anything between and and mask to
  3. Open up a console window and change to the directory the Motorola firmware is in.
  4. Type in: "TFTP"
  5. Type in: "bin" "trace" "rexmt 1" "timeout 30" "PUT filename.bin" where "filename.bin" is the name of your Motorola firmware.
  6. Unplug your WR850G, plug it back in and wait a second.
  7. Your TFTP transfer should finish in a few seconds. WAIT AT LEAST 60 SECONDS FOR THE FLASH TO PROGRAM!
  8. Unplug your WR850G and plug it back in. You now will have the old firmware.
  9. Reset your local machine's IP address and mask back to where it was (DHCP on my machine, for example).

(Originally posted by killerbobjr modifyed for AMD by sapier)

Debricking a WR850G that has "boot_wait" set to "on"

  1. Follow either the intructions above to revert to original firmware or Installing install a new openwrt firmware.

Debricking a WR850G that did _NOT_ have "boot_wait" set to "on"

/!\ WARNING: Using this "pin shorting" method is no longer officially supported by OpenWrt. You risk damage to your router if you try this method. The preferred method of debricking is with a serial console.

  • Note: These instructions are Windows-centered
  • Unplug the Wr850G and open it up – unscrew the one torx screw in the back (you can use a hex key driver if that's handy), then pop open the cover. You will have to CAREFULLY pry the top off with quite a bit of force. Use your fingers. If it feels like you're about to break it, don't worry, it's pretty tough – just try to not bend the top, which will stress crack the plastic.
  • Locate the flash chip (right next to the internal antenna). On mine it's an Intel T!E28F320. All the V3 WR850G's have this. If it's an older V2 or V1, it might have an AMD chip.
  • Set your local machine's IP address to (or anything between and and mask to
  • Open up a console window and change to the directory the firmware is in.
  • Type in: "TFTP"
  • Type in: "bin" "trace" "rexmt 1" "timeout 90" "PUT filename.bin" where "filename.bin" is the name of your Motorola firmware.
  • Get a sewing needle or pin.
  • If you have an Intel flash chip, count down on the LEFT side (lettering on the chip should be upright) to lead 15. CAREFULLY insert the sewing needle between leads 15 and 16* – it should NOT require any force.
  • If you have an AMD chip, still on the LEFT side of the chip as at the intel version, shortcircuit pins 9 and 10 but be CAREULL too and don't shortcircuit more than one pair at once! (I can confirm this is working on WR850G v1 with the AMD Chip) – SOLiBRA 31Z)
  • My router has a SST 39VF3201 chip, and I was able to get it to accept firmware by shorting pins 2 and 3. I had to get the datasheet from the SST web site and find out which pins are the address lines.
  • Now plug in your WR850G while holding the needle in place.
  • Wait two to three seconds, then remove the needle.
  • Your TFTP transfer should finish in a few seconds. WAIT AT LEAST 60 SECONDS FOR THE FLASH TO PROGRAM!
  • Unplug your WR850G and plug it back in. You now will have debricked the WR850G.
  • Reset your local machine's IP address and mask back to where it was (DHCP on my machine).
  • If you have loaded the OpenWrt firmware, telnet in and change the "lan_ipaddr" NVRAM value to and reboot your router.
  • The reason we use leads 15-16 is because those address lines are right at the beginning of the kernel firmware area in the flash chip, and if the CFE/bootloader detects a corrupted kernel, it will automatically go into a TFTP receiving mode. AMD don't know if it's the same reason but I think it's.

(Originally posted by killerbobjr )

JTAG for V3 Debricking

If it is not be possible to set boot_wait=on using a serial console at the CFE> prompt, it will be necessary to use the JTAG interface to restore the CFE or NVRAM. The HairyDairyMaid debrick utility can be used to accomplish this. Once the NVRAM has been cleared, the CFE will usually restore what it needs (like the MAC addresses set to 00-11-22-33-44-56 or such). If the CFE is toast, you will need to download a fresh CFE.BIN and flash that. The first image that is sent via tftp needs to be a .trx file. After that is loaded, use the web interface to upload your .bin file of choice.

EDGE OF BOARD -->     |
UNUSED    X  X  N/C   |
TDI       X  X  N/C   |
TDO       X  X  N/C   |
TMS       X  X  N/C   |
TCK       X  X  N/C   |
N/C       X  X  N/C   |

Opening the WR850G case

This is a very tricky-to-open case, really.

The easy way

  • Take that 1 screw off, preferably with a torx screwdriver (size T8).
  • There are 5 hooks what are keeping the WR850G case together. Hooks itself are put to the case cover and the hook sockets are on the bottom half of the case. Find out the place of an hook socket and press it. If the place is right then you should hear the hook to pop out the hook socket. Note: The force needed will not break the case nor the socket hooks. The front 2 hooks are the hardest to open.

The hard way

  • Take that 1 screw off, preferably with a torx screwdriver (size T8).
  • Then you could pry the rest of it open with a screw driver while breaking the plastic hooks.


  • Use a strong thin narrow blade (for ex. a sparkplug gapper or razor blade) to press the plastic hook in while you pry it open with a screw driver. Make the sparkplug gapper look like a 2 prong fork at the end separated by about 2mm. Each prong should be about 1.5mm.

Note: you must apply a lot of force, you will feel like it's going to break but it will finally pop open, ideally. YMMV.

GPIO info

Light layout is 7 lights: Power, Modem, Wireless, 4x LAN. All capable of bi-color, at least the LEDs are.


  • gpio 0 is the reset button (0=pressed, 1=not)
  • gpio 1 uart enable (if connected)
  • gpio 2 unknown (possibly 4port switch LEDs, 1 turns all on)
  • gpio 3 controls the "Power" "red flashing" light (0=on/flashing, 1=off)
  • gpio 4 controls the "Power" "green" light (0=off, 1=on)
  • gpio 5 controls the "Wireless" "red" light (0=on, 1=off)
  • gpio 6 controls the "Modem" network interface (0=off, 1=on)
  • gpio 7 controls the "Wireless" "green" light (0=on, 1=off)

WR850G v2 & v3

  • gpio 0 is the "Wireless" light. (0=green, 1=off)
  • gpio 1 is the "Power" light color. (0=red, 1=green)
  • gpio 2 appears disconnected (pin is floating)
  • gpio 3 always returns 1, setting value doesn't alter that.
  • gpio 4 appears to be input -short the pin to ground it reports 00 -unshort/floating it comes back to 01
  • gpio 5 is the reset button (0=pressed, 1=not)
  • gpio 6 controls the green half of the "Modem" light (0=on, 1=off, hi-z=switch-controlled) - not sure if this will fry the switch if overridden. Couple seconds didn't hurt it.
  • gpio 7 controls the red half of the "Modem" light (0=on, 1=switch-controlled)

ansher reported he experimented with gpio3 and that the value did not change when set but did change after the next poll.
He also reports the pin numbers as;

  • PIN GPIO Router solder point
  • 2 GPIO2 empty pad below RC117 (bottom solder pad)
  • 3 VSS (GND)
  • 4 VDD (3.3V)
  • 5 GPIO3 emty pad below RC117 (top solder pad)
  • 6 VSS2 (GND)
  • 7 GPIO4 RR153 (top pad)

LAN port layout

WR850G v1

5 LAN ports are internally numbered differently despite the equipment case saying something else: LAN port 4=0; LAN port 3=1; LAN port 2=2; LAN port 1=3; WAN port=4

Question: If this comment from just above here is true

  • It's a good idea when choosing a vlan layout to keep port 1 in vlan0. At least the WRT54GS v1.0 will not accept new firmware via TFTP if port 1 is in another VLAN.

Does the WR850G need to keep LAN port 0, 1 or 3 in VLAN0?

Software and Misc Items


The nvram variable for dhcp_start should be a number as opposed to an ip address.
Presumably The number is the offset from lan_ipaddr and dhcp_end should also be a number.

Loading Firmware

It seems that the WR850G frequently will not function right after an upload. Although not confirmed, it is as if there is a heat issue. Let it sit for a while to cool & then it is OK.


Depending on which model you have, you will either have the broadcom "robo" switch or the admtek ADM6996L ("adm"). RC5 will automatically try both and provide you with a set of directories under /proc/switch/eth0/. The /proc/switch/eth0/vlan/*/ports behave exactly like the vlan*port variables documented on the wiki.

V2 Memory

Motorola WR850g v2 16MB RAM flash 4MB

Booting reports
CFE for Motorola WR850G v2.03, Release date: Jan. 13, 2004
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller
CPU type 0x29007: 200MHz
Total memory: 0x2000000 bytes (32MB) * The 16MB is counted twice in error! *

Free reports

  • 14,348 total memory 9,588 used 4,760 free

du -s reports

  • 19,788


Back to top

oldwiki/openwrtdocs/hardware/motorola/wr850g.txt · Last modified: 2011/10/04 12:37 by orca