Welcome
Username:

Password:


Remember me

[ ]
[ ]
[ ]
Online
Guests: 4, Members: 0 ...

most ever online: 27
(Members: 0, Guests: 27) on 01 Jul : 17:15

Members: 12
Newest member: tlew
GigaFast WF719-CAPR 802.1b/g wireless router
Collected notes on the router, it's operation, and hacks.
on Sunday 09 April 2006
by mattei author list
in Notebook > Technical
hits: 8383


Hardware

The RealTek 8186 SoC is the successor to the RTL8181 802.11b AP SoC. Features include:

  • Embedded LX5280 32-bit RISC processor
    • MIPS R3000 ISA-1 compatible
    • 16-entry Memory Management Unit
    • Up to 200MHz operation
  • WLAN controller
  • Fast Ethernet controller
  • UART
  • Memory controller
    • Supports two 16/32-bit SDRAM banks, up to 32MB per bank
    • Supports two 16-bit NOR flash banks, up to 8MB per bank
    • Supports two 8-bit NAND flash banks, up to 32MB per bank
  • IPSEC Cryptography engine
    • Supports DES, 3DES and AES-128 encryption/decryption, ESP
    • Supports HMAC-MD5 and HMAC-SHA-1 authentication
    • 32-bit pseudo random number generator
  • PCM engine
    • 4 audio channels
    • Supports bus master mode
    • Supports G..711 u-law and a-law
  • Watchdog/Timer/Counter
  • EJTAG

The chip is offered in two packages: a 208-pin QFP and a 292-pin TFBGA. In addition to the features common to both, a second UART, I2C interface, PCI interface, and physical PCM interface are available on the 292-pin RTL8186P. The QFP model shares pins for one ethernet MAC and the PCM interface, with their use configured by register. Most APs/routers, like the GigaFast WF719-CAPR, use the 208-pin RTL8186 QFP with both ethernet MACs enabled, disabling the PCM engine.


Programming model

Address Mapping
Segment Size Caching Virtual address range Physical address range Mode
KUSEG 2048M cacheable 0x0000_0000-0x7fff_ffff set in TLB user/kernel
KSEG0 512M cacheable 0x8000_0000-0x9fff_ffff 0x0000_0000-0x1fff_ffff kernel
KSEG1 512M uncacheable 0xa000_0000-0xbfff_ffff 0x0000_0000-0x1fff_ffff kernel
KSEG2 512M cacheable 0xc000_0000-0xfeff_ffff set in TLB kernel
KSEG2 512M cacheable 0xff00_0000-0xffff_ffff 0xff00_0000-0xffff_ffff kernel

When a virtual address is located in KSEG0, KSEG1, or the upper half of KSEG2, its physical address will be mapped directly from virtual address space using an offset. If a virtual address is located in KUSEG or the lower half of KSEG2, its physical address is determined from a Translation Lookahead Buffer (TLB) entry. The RTL8186 has a 16-entry TLB.

SDRAM is mapped from physical address 0x0000_0000 to a maximum 0x03ff_ffff (64MB). Flash/ROM is mapped from physical address 0x1fc0_0000 to a maximum 0x1fff_ffff (4MB). If total flash/ROM size is greater than 4MB, the remainder is mapped from 0x1e40_0000 to a maximum 0x1eff_ffff (12MB).

Memory Map
Virtual address Physical address
0x8000_0000 Cacheable region (64MB) SDRAM (64MB) 0x0000_0000
0x83FF_FFFF
0xA000_0000 Non-cacheable region (64MB)
0xA3FF_FFFF 0x03FF_FFFF
 
0xBFC0_0000 Non-cacheable region Flash/ROM (4MB) 0x1FC0_0000
0xBFFF_FFFF 0x1FFF_FFFF
 
0xBE40_0000 Non-cacheable region Flash/ROM (12MB) 0x1E40_0000
0xBEFF_FFFF 0x1EFFF_FFFF

After reset, instructions are fetched from the first virtual address of flash/ROM memory. The system can be configured to boot from NOR or NAND-type flash. When NOR-type flash is used, the system will boot from KSEG1 at virtual address 0xbfc0_0000. When NAND-type flash is used, the memory controller will copy the first block (16KB) at 0xbfc0_0000 to the start of SDRAM and begin execution at virtual address 0x8000_0000.

Input/Output device and register addresses are located in KSEG1, a non-cachable region.

IO and Register Address Mapping
Virtual address range Size (bytes) Mapped device
0xBD01_0000 - 0xBD01_0FFF 4K Special function registers*
0xBD01_1000 - 0xBD01_1FFF 4K Memory controller registers
0xBD10_0000 - 0xBD17_FFFF 512K IPSec Crypto engine registers
0xBD18_0000 - 0xBD1F_FFFF 512K TKIP MIC calculator registers
0xBD20_0000 - 0xBD27_FFFF 512K Ethernet0
0xBD28_0000 - 0xBD2F_FFFF 512K PCM
0xBD30_0000 - 0xBD3F_FFFF 1M Ethernet1
0xBD40_0000 - 0xBD4F_FFFF 1M WLAN controller
0xBD50_0000 - 0xBD5F_FFFF 1M IO address mapping of PCI devices
0xBD60_0000 - 0xBD67_FFFF 512K Memory map of PCI device 0, 1
0xBD68_0000 - 0xBD6F_FFFF 512K Memory map of PCI device 2
0xBB00_0000 - 0xBB07_FFFF 512K Memory map of PCI device 3
0xBD71_0000 - 0xBD71_FFFF 64K PCI device 0 configuration space
0xBD72_0000 - 0xBD72_FFFF 64K PCI device 1 configuration space
0xBD74_0000 - 0xBD74_FFFF 64K PCI device 2 configuration space
0xBD78_0000 - 0xBD78_FFFF 64K PCI device 3 configuration space
*Includes interrupt control, timer, watchdog, UART, and GPIO.


[b]



article index
page 1 : Introduction
page 2 - current : RealTek 8186 SoC
page 3 : The firmware
page 4 : Interfacing with the board
page 5 : RTL8186 (Lexra5280) Toolchain
page 6 : Device drivers
News for 2010
MoTuWeThFrSaSu
 12345
6789101112
13141516171819
20212223242526
27282930 
 
Counter
This page today ...
total: 0
unique: 0

This page ever ...
total: 7827
unique: 2991

Site ...
total: 35823
unique: 13222
Site content Copyright mattei.