Realtek SOC
Contents
Realtek RTL8181
The Realtek RTL8181 is a highly integrated System-on-a-Chip with a high-performance 32-bit RISC microcontroller, two Ethernet MACs and a WLAN 802.11b controller embedded onto a single chip. RTL8181P BGA version has a PCI Bridge which supports one external PCI/MiniPCI device.
The embedded Lexra LX5280 32-bit RISC CPU runs at up to 200MHz and features separate 8KB instruction and data caches.
Devices are based on the RTL8181:
- Edimax print server
- Edimax
- Edimax
- Edimax
- MNWAPB 902.11b AccessPoint
- Minitar firmware sourcecode: ,
- Ovislink 1120
Firmware
Most of the RTL8181-based devices comes with a simple bootloader and Linux as firmware. See the Minitar sourcecode and RTL8181-linux project. Seems, RTL8181 shares some code with ADM5120. They both use CSYS header format and some applications (i.e. setup), but RTL8181 firmware is Big-Endian.
firmware for
There is firmware available (ONLY !! for Planet WAP-1963A and Ovislink 1120 - see README) .
RTL8186 JTAG
RTL8186 supports MIPS EJTAG 2.0:
- ManufID: 6
- PartNumber: 5280
33 - JTAG_TDI 8 - JTAG_TMS 146 - JTAG_TRSTN 116 - JTAG_TDO 145 - JTAG_TCK (shared with WLAN LED 1) 147 - JTAG ENABLE (must set to High)
More RTL8181 EJTAG links:
- - EJTAG driver
- at
- at
Realtek RTL8180
Don't confuse the RTL8181 with the RTL8180. It's just plain WLAN 802.11b chip, that also happens to be the one embedded on the RTL8181.
Realtek RTL8186
The RTL8186 () is a SoC with integrated MIPS core Lexra LX5280 32-bit RISC, two UARTs, two Ethernet MACs, 4xPCM audio channels, IPSec crypto engine and a WLAN 802.11g controller.
Devices based on the RTL8186:
- AP Router WR254
- Alfa Network AIP-W608H (Flash: 2MB, RAM: 16MB)
- Belkin Wireless G Router (Flash: ? RAM: 16MB)
- Canyon (third version, FW v1.37 to v1.49)
- D-Link (Flash: 2 MB, RAM: 8 MB)
- D-Link (Flash: 4 MB, RAM: 16 MB)
- Encore Wireless Lan Extender
- Edimax
- EnGenius
- LinkSys
- Minitar MNWAPG and MNWAPGA
- OvisLink WL-5460AP,
- Planet WRT-414, WRT-416, WAP-4033, WAP-4033PE, WAP-4035 - some photos available !
- Planex
- ZyXEL P-330W (Flash: 2 MB, RAM: 16 MB). GPL Source Code . Other firmware
- C-NET CWR854 according to the REDME file of the firmware it has RTL8186 SoC (2MB Flash, 8MB RAM)
- TRENDnet TEW-430APB (2MB Flash, 8MB RAM)
- Topcom Skyr@cer WBR 7001g
- Techniclan WAR-54G v2 (2MB Flash, 8MB RAM)
More info:
- () (seems to be dead, ).
- Some photos, firmware disassembly instructions, Polish version of firmware for BR-6204WG.
Firmware
- C3 firmware D-Link DWL-G700AP, Encore ENRXIWI-G, Abocom, etc How to crack the license --> in the firmware section. See also
- AP Router (Ovislink WL-5460AP, Abocom WAP253 & WR254, Edimax EW-7209APg and others)
- - tested only on WL5460
- APPro 54G is available for Planet WAP-4035 . Demo is available .
- Edimax , mesh firmware with sources for
- Ovislink WL-5460AP
- , , (Alternative firmware and software with open source for platforms based on the SoC Realtek RTL8186)
- (GigaFast WF719-CAPR 802.11g, Blanc Wireless G router BW54R11, ...)
- - req: 16MB RAM and 2MB Flash
Realtek RTL8650/RTL8651(B)
The is a highly integrated multi-layer switching gateway controller.
- Lexra LX4180 32-bit RISC CPU, Embedded 4K I-Cache, 4K D-Cache, 8K I-RAM, 4K D-RAM, 96MHz, w/o MMU
- 6-port layer 2/3/4 switch MAC, 5 Fast Ethernet transceivers, and an MII interface
- USB v1.1 host controller
- 33MHz PCI v2.2 host interface for glueless connection of up to two devices (RTL8651 only)
- PCMCIA or memory interface
- Two 16C550-compatible UARTs
- 22 GPIOs
- 208-pin PQFP package for RTL8650; 292-pin TFBGA package for RTL8651
The second generation B version, is based on the Lexra LX5280 core running at 200Mhz, with MMU, same as in the RTL8181 and RTL8186.
Devices are based on the RTL8650/RTL8651:
- Belkin F5D9230-4 V2000^ (V1000?): RTL8651B SoC + Airgo True MIMO chip (appears to be the same board as the Linksys WRT54GX series)
- D-Link DI-604+: RTL8650B
- D-Link DI-624M,DI-634M: RTL8651B SoC + Atheros MIMO chipset
- D-Link DI-624S: RTL8651B SoC + Atheros SuperG chipset + USB2.0 controller
- D-Link DI-604UP, DI-524UP: RTL8650B SoC
- D-Link DIR-120: RTL8650B SoC
- D-Link DIR-300: RTL8650B SoC
- , RTL8650B SoC
- Linksys BEFSR41 v4: RTL8650B
- Linksys WAP54GX V1.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRT54GX2 V1.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRT54GX V2.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRV200: RTL8651B SoC
- Netgear FVS114: RTL8650B SoC
- Netgear RP614v4: RTL8650B SoC
- Sitecom WL-173: RTL8650B SoC
^Belkin does not acknowledge the existence of the V2000
RTL865xB supports MIPS EJTAG 2.0:
- ManufID: 6
- PartNumber: 5280
JTAG (manual hack method by ZFT Lab.):
70 - JTAG_TDI 68 - JTAG_TMS 53 - JTAG_TRSTN 71 - JTAG_TDO 69 - JTAG_TCK ?? - JTAG ENABLE (need help)
- Free software and more info for hardware hack (serial, usb, gpio, jtag): and
- More info:
- The open source SDK toolkit for Linksys WRT54GX v2 MIMO router : ,
- The open source SDK for D-Link DI-624m MIMO router : (contains atheros driver)
- The open source for D-Link DI-624S storage router:
- The open source for D-Link DI-524UP:
- Toolchain for DI624M: