From DD-WRT Wiki

Revision as of 13:01, 13 November 2007 by S2s2 (Talk | contribs)
Jump to: navigation, search



See the instructions on flashing the Buffalo WHR-HP-G54 and similar routers.

Built-In Amplifier & Enhanced Receive Sensitivity

[There seems to be some misinformation coming from those who don't actually have access to, or own, a WHR-HP-G54, and so cannot see the following information for themselves. Please stop modifying this Wiki page. "Nvram get boardflags" returns the current boardflags value, which defaults with current firmwares to 0x2758. There is an open issue in Bugtracker about this.]

The WHR-HP-G54 has an additional amplifier in the unit (the HP stands for High-Power) and increased receiver sensitivity. Buffalo sells this router with the tag line "MIMO Performance" for this reason.

It is necessary to manually set boardflags=0x3758 to activate the built-in amplifier and the increased receive sensitivity on the unit, regardless of the DD-WRT firmware version.

At the command prompt (telnet or SSH):

nvram set boardflags=0x3758
nvram commit

To see your current boardflags value:
nvram get boardflags

0x0758 - no amp and receive sensitivity normal
0x1758 - enhanced receive sensitivity
0x2758 - amp on, normal receive
0x3758 - both 'on' - this is the one you want!

Setting TX Power to 12 mW is equivalent to the 100% setting in the original Buffalo firmware (cred: tparris).

For related forum discussion, see these threads: [1] and [2] on power output, and [3] on boardflags

Comparison to the WHR-G54S

The WHR-HP-G54 is able to broadcast farther and receive from farther away than the WHR-G54S due to the on-board amplifier and BCMxxxxE/EL-series Broadcom 'BroadRange Technology' chipset. A post on the forum has more lengthy information and a review.

Command Outputs

cat /proc/cpuinfo Output

system type             : Broadcom BCM5352 chip rev 0
processor               : 0
cpu model               : BCM3302 V0.8
BogoMIPS                : 199.47
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available

dmesg Output

CPU revision is: 00029008
Linux version 2.4.33-pre2 (root@linux) (gcc version 4.1.0) #774 Tue May 16 20:11                                                               :46 CEST 2006
Setting the PFC value as 0x15
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd cons                                                               ole=ttyS0,115200
CPU: BCM5352 rev 0 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: no core
PCI: Fixing up bus 0
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en                                                               abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 3) is a 16550A
PCI: Setting latency timer of device 00:01.0 to 64
imq driver loaded.
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Physically mapped flash: Found an alias at 0x400000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0
Physically mapped flash: Found an alias at 0xc00000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1400000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1c00000 for the chip at 0x0
 Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 824
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000ce170-0x0028c9f6 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o                                                               nly
0x003f0000-0x00400000 : "nvram"
0x00290000-0x003f0000 : "ddwrt"
sflash: found no supported devices
Initializing Cryptographic API
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (512 buckets, 4096 max) - 336 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.8.1_rc1 loading
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
diag boardtype: 00000467
PCI: Setting latency timer of device 00:05.0 to 64
eth1: Broadcom BCM4318 802.11 Wireless Controller
vlan0: add 01:00:5e:00:00:01 mcast address to master interface
vlan0: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device vlan0 entered promiscuous mode
device eth1 entered promiscuous mode
HTB init, kernel part version 3.17
HTB init, kernel part version 3.17
vlan1: Setting MAC address to  00 0d 0b 04 ec a1.
vlan1: add 01:00:5e:00:00:01 mcast address to master interface
HTB init, kernel part version 3.17
HTB init, kernel part version 3.17

Note: dmesg performed on DD-WRT v23sp1 mini.


The WHR-HP-G54 has the following GPIOs operational:

  • 0 - Input - AOSS button on top - State 00 is down, state 01 is up
  • 1 - Output - Bridge LED - Lights 3rd LED on front panel
  • 2 - Output - WLAN LED
  • 3 - Output - Extra LED between bridge and WLAN (newer routers no longer have this LED)
  • 4 - Input - Reset Button
  • 5 - Input - Bridge/Auto Switch - State 01 is auto, state 00 is brd
  • 6 - Output - AOSS LED - Lights small orange LED on top
  • 7 - Output - DIAG LED - Lights red LED on front below the LED activated by 1
  • 9 - Output - Power LED

Note: nvram show | grep gpio shows 14 available as well. It is unknown what it does. Pin 8 also does not appear to do anything.

It seems that one must reverse enable and disable for the command to work, i.e. if you want to turn on a LED, use disable, off, use enable.


While the device does not natively support Power Over Ethernet, a linksys WAPPOE (5 volt, not the 12 volt kind) will work just fine.

Also easily powered with a simple 7805 (+5VDC) voltage regulator ($1.59 at Radio Shack) and your standard homemade PoE injector feed and tap (using pins 4+5 and 7+8, the blue and brown pairs). Heatsinking of the regulator is suggested due to ~700mA @ 5V max current draw. It doubles as a nice little heater for outdoor installs in locales that have cold weather. Heat dissipation can be reduced to a minimum by adjusting your input voltage at the feed end of the CAT5 cable so that the regulator still supplies a stable 5V when operating under load (router plugged in and turned on), then bump it up a little to account for periods of slightly more draw (CPU load fluctuations, or when flashing or saving nvram settings, etc). Insufficient feed voltage and current does not fry the router, but the Ethernet switch will not initialize (among other oddities) until the supply is enough - overvoltage is not a concern with the 7805 as there is no way for it to ever go above 5V output, and the maximum current output is 1A just like the original power brick. The 7805 regulator will handle up to 35V input, but heat dissipation is relative to the extra input voltage it has to absorb, so tuning your feed voltage to the length of your particular CAT5 cable length is a good idea. Always measure all voltages under load, as they drop quite a bit once things are actually using power.

The power connector is called a "Size M" at Radio Shack, tip size 5.5mm OD x 2.1mm ID, so you don't have to chop off the original if you want to keep the brick supply for bench testing/repairs.

External Links