Realtek SOC
Realtek RTL8181
The Realtek RTL8181 is a highly integrated System-on-a-Chip with a high-performance 32-bit RISC microcontroller, two Ethernet MACs and a WLAN 802.11b controller embedded onto a single chip. RTL8181P BGA version has a PCI Bridge which supports one external PCI/MiniPCI device.
The embedded Lexra LX5280 32-bit RISC CPU runs at up to 200MHz and features separate 8KB instruction and data caches.
- RTL8181 DataSheet
- Linux on Realtek RTL8181
- RealAP - Linux mini-distribution for RTL8181 based devices
Devices are based on the RTL8181:
- Known RTL8181-based consumer devices
- Edimax PS-1205UWg print server
- Edimax EW-7206APg
- Edimax EW-7207APb
- Edimax BR-6104WB
- Minitar MNWAPB 902.11b AccessPoint
- Minitar Hacking
- Minitar firmware sourcecode: sdk-1.4, sdk-1.6 (mirror)
- Ovislink 1120
- Planet WAP-1963A
- Planet WAP-1963
- WL-1302 / WL-1302C
Firmware
Most of the RTL8181-based devices comes with a simple bootloader and Linux as firmware. See the Minitar sourcecode and RTL8181-linux project. Seems, RTL8181 shares some code with ADM5120. They both use CSYS header format and some applications (i.e. setup), but RTL8181 firmware is Big-Endian.
AP Router firmware for Ovislink 1120
There is APPro firmware available (ONLY !! for Planet WAP-1963A and Ovislink 1120 - see README) here.
RTL8186 JTAG
RTL8186 supports MIPS EJTAG 2.0:
- ManufID: 6
- PartNumber: 5280
33 - JTAG_TDI 8 - JTAG_TMS 146 - JTAG_TRSTN 116 - JTAG_TDO 145 - JTAG_TCK (shared with WLAN LED 1) 147 - JTAG ENABLE (must set to High)
More RTL8181 EJTAG links:
- http://wireless.org.au/~jhecker/rtljtag/
- http://www.amelek.gda.pl/rtl8181/jtag/ - Openwince EJTAG driver
- JTAG at hardware-hacking.com
- MIPS EJTAG at hardware-hacking.com
Realtek RTL8180
Don't confuse the RTL8181 with the RTL8180. It's just plain WLAN 802.11b chip, that also happens to be the one embedded on the RTL8181.
Realtek RTL8186
The RTL8186 (datasheet) is a SoC with integrated MIPS core Lexra LX5280 32-bit RISC, two UARTs, two Ethernet MACs, 4xPCM audio channels, IPSec crypto engine and a WLAN 802.11g controller.
Devices based on the RTL8186:
- AP Router WR254 Product page
- Alfa Network AIP-W608H (Flash: 2MB, RAM: 16MB)
- Belkin Wireless G Router F5D7230-4 Version 9000 (Flash: ? RAM: 16MB)
- Canyon CN-WF514 (third version, FW v1.37 to v1.49)
- D-Link DWL-G700AP (Flash: 2 MB, RAM: 8 MB)
- D-Link DAP-1160 (Flash: 4 MB, RAM: 16 MB)
- Encore Wireless Lan Extender ENRXWI-G
- Edimax BR-6204Wg BR-6304Wg EW-7206APg EW-7209APg
- EnGenius EOC-3220 EOC-3220(EXT) EOC-3220+ ESR-1220
- LinkSys WMB54G
- Minitar MNWAPG and MNWAPGA
- OvisLink WL-5460AP, Product page
- Planet WRT-414, WRT-416, WAP-4033, WAP-4033PE, WAP-4035 - some photos available here!
- Planex BLW-54CW3
- ZyXEL P-330W (Flash: 2 MB, RAM: 16 MB). GPL Source Code here. Other firmware here
- C-NET CWR854 Datasheet according to the REDME file of the firmware it has RTL8186 SoC (2MB Flash, 8MB RAM)
- TRENDnet TEW-430APB Datasheet (2MB Flash, 8MB RAM)
- Topcom Skyr@cer WBR 7001g Product page
- Techniclan WAR-54G v2 Product page (2MB Flash, 8MB RAM)
More info:
- Wive-NG rtl8186 routers firmware
- http://www.netgate.com/~jim/RTL8186/
- http://izwbit.wil.pk.edu.pl/ftp/rtl8186/ (mirror) (seems to be dead, 2007-02-10).
- http://www.laurentp.republika.pl/edimax/index.html Some photos, firmware disassembly instructions, Polish version of firmware for BR-6204WG.
Firmware
- C3 firmware Click here D-Link DWL-G700AP, Encore ENRXIWI-G, Abocom, etc How to crack the license --> Click here in the firmware section. See also Cracking C3 Firmware
- AP Router here (Ovislink WL-5460AP, Abocom WAP253 & WR254, Edimax EW-7209APg and others)
- AP router 6.1/7 license Generator
- AP-Router v5.3b Licencse generator soon - tested only on WL5460
- APPro 54G is available for Planet WAP-4035 here. Demo is available here.
- Edimax sources, mesh firmware with sources for EW-7209APg
- Ovislink WL-5460AP sources
- RTL8186 SoC Project, RTL8186 SoC Page, RTL8186 SoC WiKi (Alternative firmware and software with open source for platforms based on the SoC Realtek RTL8186)
- Linux4RTL (GigaFast WF719-CAPR 802.11g, Blanc Wireless G router BW54R11, ...)
- Rtl8186 based AP firmware - req: 16MB RAM and 2MB Flash
Realtek RTL8650/RTL8651(B)
The RTL8650/RTL8651 is a highly integrated multi-layer switching gateway controller.
- Lexra LX4180 32-bit RISC CPU, Embedded 4K I-Cache, 4K D-Cache, 8K I-RAM, 4K D-RAM, 96MHz, w/o MMU
- 6-port layer 2/3/4 switch MAC, 5 Fast Ethernet transceivers, and an MII interface
- USB v1.1 host controller
- 33MHz PCI v2.2 host interface for glueless connection of up to two devices (RTL8651 only)
- PCMCIA or memory interface
- Two 16C550-compatible UARTs
- 22 GPIOs
- 208-pin PQFP package for RTL8650; 292-pin TFBGA package for RTL8651
The second generation B version, RTL8650B/RTL8651B is based on the Lexra LX5280 core running at 200Mhz, with MMU, same as in the RTL8181 and RTL8186.
Devices are based on the RTL8650/RTL8651:
- AP Router WAP354: RTL8651B
- Belkin F5D9230-4 V2000^ (V1000?): RTL8651B SoC + Airgo True MIMO chip (appears to be the same board as the Linksys WRT54GX series)
- D-Link DI-604+: RTL8650B
- D-Link DI-624M,DI-634M: RTL8651B SoC + Atheros MIMO chipset
- D-Link DI-624S: RTL8651B SoC + Atheros SuperG chipset + USB2.0 controller
- D-Link DI-604UP, DI-524UP: RTL8650B SoC More
- D-Link DIR-120: RTL8650B SoC
- D-Link DIR-300: RTL8650B SoC
- Edimax BR-6214K, RTL8650B SoC
- Linksys BEFSR41 v4: RTL8650B
- Linksys WAP54GX V1.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRT54GX2 V1.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRT54GX V2.0: RTL8651B SoC + Airgo True MIMO chip
- Linksys WRV200: RTL8651B SoC
- Netgear FVS114: RTL8650B SoC
- Netgear RP614v4: RTL8650B SoC
- Netgear WPNT834
- Sitecom WL-173: RTL8650B SoC
^Belkin does not acknowledge the existence of the V2000
RTL865xB supports MIPS EJTAG 2.0:
- ManufID: 6
- PartNumber: 5280
JTAG (manual hack method by ZFT Lab.):
70 - JTAG_TDI 68 - JTAG_TMS 53 - JTAG_TRSTN 71 - JTAG_TDO 69 - JTAG_TCK ?? - JTAG ENABLE (need help)
- Free software and more info for hardware hack (serial, usb, gpio, jtag): BeeRouter by ZFT Lab. and Midge for RTL865xB
- More info: http://www.csie.nctu.edu.tw/~cfliu/work/8650.htm
- The open source SDK toolkit for Linksys WRT54GX v2 MIMO router : WRT54GX-v2-2.00.08.tgz, WRT54GX-v2_v2.00.14.tar.gz
- The open source SDK for D-Link DI-624m MIMO router : DI-624M-Src.tgz (contains atheros driver)
- The open source for D-Link DI-624S storage router: [1]
- The open source for D-Link DI-524UP: [2]
- Toolchain for DI624M:DI-624M-toolchain.tgz