Collected notes on the router, it's operation, and hacks. on Sunday 09 April 2006 by mattei in Notebook > Technical hits: 8383
Hardware
The RealTek 8186 SoC is the successor to the RTL8181 802.11b AP SoC. Features include:
Embedded LX5280 32-bit RISC processor
MIPS R3000 ISA-1 compatible
16-entry Memory Management Unit
Up to 200MHz operation
WLAN controller
Fast Ethernet controller
UART
Memory controller
Supports two 16/32-bit SDRAM banks, up to 32MB per bank
Supports two 16-bit NOR flash banks, up to 8MB per bank
Supports two 8-bit NAND flash banks, up to 32MB per bank
IPSEC Cryptography engine
Supports DES, 3DES and AES-128 encryption/decryption, ESP
Supports HMAC-MD5 and HMAC-SHA-1 authentication
32-bit pseudo random number generator
PCM engine
4 audio channels
Supports bus master mode
Supports G..711 u-law and a-law
Watchdog/Timer/Counter
EJTAG
The chip is offered in two packages: a 208-pin QFP and a 292-pin TFBGA. In addition to the features common to both, a second UART, I2C interface, PCI interface, and physical PCM interface are available on the 292-pin RTL8186P. The QFP model shares pins for one ethernet MAC and the PCM interface, with their use configured by register. Most APs/routers, like the GigaFast WF719-CAPR, use the 208-pin RTL8186 QFP with both ethernet MACs enabled, disabling the PCM engine.
Programming model
Address Mapping
Segment
Size
Caching
Virtual address range
Physical address range
Mode
KUSEG
2048M
cacheable
0x0000_0000-0x7fff_ffff
set in TLB
user/kernel
KSEG0
512M
cacheable
0x8000_0000-0x9fff_ffff
0x0000_0000-0x1fff_ffff
kernel
KSEG1
512M
uncacheable
0xa000_0000-0xbfff_ffff
0x0000_0000-0x1fff_ffff
kernel
KSEG2
512M
cacheable
0xc000_0000-0xfeff_ffff
set in TLB
kernel
KSEG2
512M
cacheable
0xff00_0000-0xffff_ffff
0xff00_0000-0xffff_ffff
kernel
When a virtual address is located in KSEG0, KSEG1, or the upper half of KSEG2, its physical address will be mapped directly from virtual address space using an offset. If a virtual address is located in KUSEG or the lower half of KSEG2, its physical address is determined from a Translation Lookahead Buffer (TLB) entry. The RTL8186 has a 16-entry TLB.
SDRAM is mapped from physical address 0x0000_0000 to a maximum 0x03ff_ffff (64MB). Flash/ROM is mapped from physical address 0x1fc0_0000 to a maximum 0x1fff_ffff (4MB). If total flash/ROM size is greater than 4MB, the remainder is mapped from 0x1e40_0000 to a maximum 0x1eff_ffff (12MB).
Memory Map
Virtual address
Physical address
0x8000_0000
Cacheable region (64MB)
SDRAM (64MB)
0x0000_0000
0x83FF_FFFF
0xA000_0000
Non-cacheable region (64MB)
0xA3FF_FFFF
0x03FF_FFFF
0xBFC0_0000
Non-cacheable region
Flash/ROM (4MB)
0x1FC0_0000
0xBFFF_FFFF
0x1FFF_FFFF
0xBE40_0000
Non-cacheable region
Flash/ROM (12MB)
0x1E40_0000
0xBEFF_FFFF
0x1EFFF_FFFF
After reset, instructions are fetched from the first virtual address of flash/ROM memory. The system can be configured to boot from NOR or NAND-type flash. When NOR-type flash is used, the system will boot from KSEG1 at virtual address 0xbfc0_0000. When NAND-type flash is used, the memory controller will copy the first block (16KB) at 0xbfc0_0000 to the start of SDRAM and begin execution at virtual address 0x8000_0000.
Input/Output device and register addresses are located in KSEG1, a non-cachable region.
IO and Register Address Mapping
Virtual address range
Size (bytes)
Mapped device
0xBD01_0000 - 0xBD01_0FFF
4K
Special function registers*
0xBD01_1000 - 0xBD01_1FFF
4K
Memory controller registers
0xBD10_0000 - 0xBD17_FFFF
512K
IPSec Crypto engine registers
0xBD18_0000 - 0xBD1F_FFFF
512K
TKIP MIC calculator registers
0xBD20_0000 - 0xBD27_FFFF
512K
Ethernet0
0xBD28_0000 - 0xBD2F_FFFF
512K
PCM
0xBD30_0000 - 0xBD3F_FFFF
1M
Ethernet1
0xBD40_0000 - 0xBD4F_FFFF
1M
WLAN controller
0xBD50_0000 - 0xBD5F_FFFF
1M
IO address mapping of PCI devices
0xBD60_0000 - 0xBD67_FFFF
512K
Memory map of PCI device 0, 1
0xBD68_0000 - 0xBD6F_FFFF
512K
Memory map of PCI device 2
0xBB00_0000 - 0xBB07_FFFF
512K
Memory map of PCI device 3
0xBD71_0000 - 0xBD71_FFFF
64K
PCI device 0 configuration space
0xBD72_0000 - 0xBD72_FFFF
64K
PCI device 1 configuration space
0xBD74_0000 - 0xBD74_FFFF
64K
PCI device 2 configuration space
0xBD78_0000 - 0xBD78_FFFF
64K
PCI device 3 configuration space
*Includes interrupt control, timer, watchdog, UART, and GPIO.