Difference between revisions of "Flameman/routerstation-pro"

From eLinux.org
Jump to: navigation, search
(mini pci)
Line 234: Line 234:
== mini pci ==
== mini pci ==
<table id="toc" class="toc"><tr><td><div id="toctitle"><h2>Contents</h2></div>
<li class="toclevel-1 tocsection-1"><a href="#Types"><span class="tocnumber">1</span> <span class="toctext">Types</span></a></li>
<li class="toclevel-1 tocsection-2"><a href="#Type_I.2FII.2C_100_pin"><span class="tocnumber">2</span> <span class="toctext">Type I/II, 100 pin</span></a></li>
<li class="toclevel-1 tocsection-3"><a href="#Type_III.2C_124_pin"><span class="tocnumber">3</span> <span class="toctext">Type III, 124 pin</span></a></li>
<li class="toclevel-1 tocsection-4"><a href="#Contributors"><span class="tocnumber">4</span> <span class="toctext">Contributors</span></a></li>
<li class="toclevel-1 tocsection-5"><a href="#Sources"><span class="tocnumber">5</span> <span class="toctext">Sources</span></a></li>
<li class="toclevel-1 tocsection-6"><a href="#Links"><span class="tocnumber">6</span> <span class="toctext">Links</span></a></li>
<h2> <span class="mw-headline" id="Types"> Types </span></h2>
<h2> <span class="mw-headline" id="Types"> Types </span></h2>
<table border="1" cellpadding="4" cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #aaa solid; border-collapse: collapse; font-size: 95%; color: #000;">
<table border="1" cellpadding="4" cellspacing="0" style="margin: 1em 1em 1em 0; background: #f9f9f9; border: 1px #aaa solid; border-collapse: collapse; font-size: 95%; color: #000;">

Revision as of 11:36, 16 August 2013

For more interesting projects done by Flameman&Legacy, be sure to check out their project index

this page is under development ...


The RouterStation Pro is an Atheros AR7161 MIPS.v2-based board. Geared towards networking applications, it has all of the usual features as well as three type IIIA mini-PCI slots and an on-board 3-port 10/100/1000 Ethernet switch, in addition to the 10/100/1000 Ethernet WAN port which supports Power-over-Ethernet.

Architecture: MIPS.v2, BigEndian
Vendor: Atheros
Bootloader: RedBoot
System-On-Chip: Atheros MIPS 24K
CPU Speed: 680 Mhz
Flash size: 16 MiB
Wireless: 3x 32-bit Mini-PCI slots (None included)
Switch: Ethernet Phy switch, ADMTEK "Infineon" ADM6996FC
Ethernet ports: 3x 10/100 BASE-TX (Cat. 5, RJ-45) Ethernet Interface with PoE on WAN
USB: Yes v2.0
Serial: Yes

Boot Process

The RouterStation uses RedBoot as its boot loader. In the default configuration (shipping as of December 2008), a basic Linux kernel and BusyBox userspace is loaded from flash. The RedBoot boot sequence can be interrupted and a kernel loaded via TFTP instead.

RedBoot uses the WAN port for its network interface.

Once the system is booted, login with username/password ubnt to access the shell.

memory layout

Board: Ubiquiti RouterStation PRO
 Arch: ar7100pro
  RAM: 0x80000000-0x88000000, [0x8003bf00-0x87fe1000] available
Flash: 0xbf000000-0xc0000000, in 256 blocks of 0x00010000 bytes each



do not use this

load -r -b 0x80040000 -h gentoo-ubiquiti

put a kernel.elf in the /tftpboot folder and just type

load kernel.elf

Just a quick note

more to myself than anyone else, but I wasn't able to easily find this information online, trolling through the OpenWRT and Ubiquiti forums.

I wanted to try booting different kernels on the device before committing to flashing, so that all I had to do was reboot the board and everything would come back up as normal. It seems obvious that this should be possible, and with a bit of digging around in RedBoot docs, trial and error, and a few lucky guesses I was able to figure out the incantation to make RedBoot load an uncompressed linux kernel (ELF) and boot it:

load -m tftp -h openwrt-ar71xx-generic-vmlinux.elf
exec -c "board=UBNT-RSPRO panic=1"

Note that this does not change the root filesystem, so if your modules aren't compatible, this won't work, but I suspect if you use an embedded initrd you can run the system entirely out of RAM without touching flash.


expected lzma compressed kernel ( -d means decompress )

RedBoot> cache off
RedBoot> fis load -d -e kernel
RedBoot> go

i am integrating to mips-v2 ar71xx, a lot of patches to be committed

networks idea

Routerstatio Pro physical networks go this way

    +-----------+       +-----------+
    |           | Eth0  |           |
    |           +-------+----------5+-WAN
    |           |       | AR8316    |
    |    CPU    |       |        +-4+-LAN1
    |           | Eth1  |        +-3+-LAN2
    |           +-------+0-------+-2+-LAN3
    |           |       |        +-1+ (not connected)
    +-----------+       +-----------+


miniPci problem

on routerboard pro all the 3 miniPci are is incompatible with many non-Atheros miniPCI cards, especially with

  • wifi cards ipw2x00
  • multi uart 16c650

not tested, but it seems they are supported

  • TP-Link TL-WN861N wireless minipci card
  • Ubiquiti SR2 WiFi Mini-PCI Radio

bad thing happening on pci

insmod ipw2200

ipw2200: Intel(R) PRO/Wireless 2200/2915 Network Driver, 1.2.2kmprq
ipw2200: Copyright(c) 2003-2006 Intel Corporation
PCI: Enabling device 0000:00:11.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:11.0 to 64
ipw2200: Detected Intel PRO/Wireless 2200BG Network Connection
PCI error 1 at PCI addr 0x10000024
Data bus error, epc == 87141c58, ra == 8714d360
Broadcom 43xx wireless support

pci 0000:00:13.0: BAR 0: assigned [mem 0x10000000-0x10001fff]
pci 0000:00:13.0: BAR 0: set to [mem 0x10000000-0x10001fff] (PCI address [0x10000000-0x10001fff])
PCI: mapping irq 74 to pin1@0000:00:13.0
Switching to clocksource MIPS
cfg80211: Calling CRDA to update world regulatory domain
Switched to NOHz mode on CPU #0
PCI error 1 at PCI addr 0x10001000
Data bus error, epc == 80204808, ra == 802f207c

it seems an hardware issue (may bepossible ???)

reason why

static struct resource ar71xx_pci_io_resource = 
       .name = "PCI IO space",
       .start = 0,
       .end = 0,
       .flags = IORESOURCE_IO,
static struct resource ar71xx_pci_mem_resource = 
       .name = "PCI memory space",
       .start = AR71XX_PCI_MEM_BASE,
       .end = AR71XX_PCI_MEM_BASE + AR71XX_PCI_MEM_SIZE - 1,
       .flags = IORESOURCE_MEM
static struct pci_controller ar71xx_pci_controller = 
       .pci_ops = &ar71xx_pci_ops,
       .mem_resource = &ar71xx_pci_mem_resource,
       .io_resource = &ar71xx_pci_io_resource,

  • pci_io_resource size is equal to 0
  • the PCI driver for ar71xx currently (1) doesn't support I/O allocations, only memory allocations
  • therefore any card requiring I/O won't work for now on ar71xx.
  • I/O can only be accessed indirectly on ar71xx, so the driver needs special handling for I/O accesses.

(1) currently The PCI controller in ar71xx SoCs only provides access to PCI memory space and PCI configuration space, but not to PCI IO space, it is an hardware limitation of ar71xx SoC, missing hardware able to handle PCI IO space, hardware hack is required with special handling for IO space accesses. Which, in case it is enough to fix the problem, nobody hasn't done yet, and it seems impossible to be fixed.

see http://en.wikipedia.org/wiki/Conventional_PCI#PCI_command_codes

  • 0010 I/O Read - performs a read from I/O space. All 32 bits of the read address are provided, so that a device can (for compatibility reasons) implement less than 4 bytes worth of I/O registers. If the byte enables request data not within the address range supported by the PCI device (e.g. a 4-byte read from a device which only supports 2 bytes of I/O address space), it must be terminated with a target abort. Multiple data cycles are permitted, using linear (simple incrementing) burst ordering.The PCI standard is discouraging the use of I/O space in new devices, preferring that as much as possible be done through main memory mapping.
  • 0011 I/O Write - performs a write to I/O space.
  • 0110 Memory Read - performs a read cycle from memory space. Because the smallest memory space a PCI device is permitted to implement is 16 bits, the two least significant bits of the address are not needed; equivalent information will arrive in the form of byte select signals. They instead specify the order in which burst data must be returned. If a device does not support the requested order, it must provide the first word and then disconnect. If a memory space is marked as "prefetchable", then the target device must ignore the byte select signals on a memory read and always return 32 valid bits.
  • 0111 Memory Write - operates similarly to a memory read. The byte select signals are more important in a write, as unselected bytes must not be written to memory.Generally, PCI writes are faster than PCI reads, because a device can buffer the incoming write data and release the bus faster. For a read, it must delay the data phase until the data has been fetched.

currently working mini pci board

the PCI controller in ar71xx SoCs only provides access to PCI memory space and PCI configuration space, but not to PCI IO space. you need to write special handling for IO space accesses, which handle the pci io request mapping it into a memory request: this piece of code is missing.

so currently, generally

  • wont work: any mini pci card that needs PCI IO space
  • will work: any mini pci card that ONLY needs PCI mem space

may be working board

  • Sokeris VPN1411 encryption miniPCI card seems to be PCI_MEM_ONLY, it performs as crypto-hw-hifn-795x for OpenSSL VPN & IPSec hw acceleration

tested board

  • wifi tp-link, which is atheros-wifi, it uses pci_mem only


currently not working mini pci board

  • wont work uart: PCI one chip solution OXFORD OXuPCI954, for uart 16c950 [1]
  • wont work sata: PCI one chip solution VIA VT6421A

if you ever thought to build your own miniPCI card

From this bad experience i also understand that the PCI bus specifiction requires appropriate electrical signals for interface logic, so if you want to interface some chip to PCI bus you must use only PCI compliance chips!!!

One solution is to use commercial ASIC PCI bridge. Another is to implement PCI interface with PCI compliance programmable logic chip. For additional information about PCI interfaces look at PLD vendors site.

So the conclusion is: if you don't need high transfer data rate use serial or parallel port, or USB bus.

mini pci


Type Pins
I 100
II 100
III 124

Type I/II, 100 pin

Pin Name
2 +5v
3 3.3v
5 Reserved
6 Reserved
7 3.3AUX
8 C/BE[1]#
10 RST#
11 Ground
12 3.3v
13 REQ#
14 GNT#
15 3.3v
16 Ground
17 AD[31]
18 PME#
19 AD[29]
20 Reserved
21 Ground
22 AD[30]
23 AD[27]
24 3.3v
25 AD[25]
26 AD[28]
27 Reserved
28 AD[28]
29 C/BE[3]#
30 AD[24]
31 AD[23]
33 Ground
34 Ground
35 AD[21]
36 AD[22]
37 AD[19]
38 AD[20]
39 Ground
40 PAR
41 AD[17]
42 AD[18]
43 C/BE[2]#
44 AD[16]
45 IRDY#
46 Ground
47 3.3v
48 Frame#
50 TRDY#
51 SERR#
52 STOP#
53 Ground
54 +3.3v
55 PERR#
57 C/BE[1]#
58 Ground
59 AD[14]
60 AD[15]
61 Ground
62 AD[13]
63 AD[12]
64 AD[11]
65 AD[10]
66 Ground
67 Ground
68 AD[09]
69 AD[08]
70 C/BE[0]#
71 AD[07]
72 3.3v
73 3.3v
74 AD[06]
75 AD[05]
76 AD[04]
77 Reserved
78 AD[02]
79 AD[03]
80 AD[00]
81 5v
82 Reserved_WIP 1
83 AD[01]
84 Reserved_WIP 1
85 Ground
86 Ground
88 M66EN
96 Reserved
97 Audio_GND
98 Ground

1) WIP=Work in progress

Type III, 124 pin

Pin Name Description
1 TIP 1 Conductor, local loop wire pair
2 RING 1 Conductor, local loop wire pair
3 8PMJ-3 Pin 3 of an 8-pin modular jack
4 8PMJ-1 Pin 1 of an 8-pin modular jack
5 8PMJ-6 Pin 6 of an 8-pin modular jack
6 8PMJ-2 Pin 2 of an 8-pin modular jack
7 8PMJ-7 Pin 7 of an 8-pin modular jack
8 8PMJ-4 Pin 4 of an 8-pin modular jack
9 8PMJ-8 Pin 8 of an 8-pin modular jack
10 8PMJ-5 Pin 5 of an 8-pin modular jack
11 LED1_GRNP Interface for external LEDs
12 LED2_YELP Interface for external LEDs
13 LED1_GRNN RF Silent input
14 LED2_YELN Interface for external LEDs
15 CHSGND Chassis Ground
17 INTB# Interrupt Request B
18 5V 5 V Supply voltage
19 3.3V 3.3 V Supply voltage
20 INTA# Interrupt Request A
23 GROUND Ground
24 3.3VAUX 3.3 V supply-uninterrupted
25 CLK PCI Clock
26 RST# PCI Reset
27 GROUND Ground
28 3.3V 3.3 V Supply voltage
29 REQ# PCI Bus Request
30 GNT# PCI Bus Grant
31 3.3V 3.3 V Supply voltage
32 GROUND Ground
33 AD[31] Multiplexed Address/Data Bus
34 PME# Power Management Event
35 AD[29] Multiplexed Address/Data Bus
37 GROUND Ground
38 AD[30] Multiplexed Address/Data Bus
39 AD[27] Multiplexed Address/Data Bus
40 3.3V 3.3 V Supply voltage
41 AD[25] Multiplexed Address/Data Bus
42 AD[28] Multiplexed Address/Data Bus
44 AD[26] Multiplexed
- Key -
- - -
45 C/BE[3]# Byte Enable
46 AD[24] Multiplexed Address/Data Bus
47 AD[23] Multiplexed Address/Data Bus
48 IDSEL Initialization Device Select
49 GROUND Ground
50 GROUND Ground
51 AD[21] Multiplexed Address/Data Bus
52 AD[22] Multiplexed Address/Data Bus
53 AD[19] Multiplexed Address/Data Bus
54 AD[20] Multiplexed Address/Data Bus
55 GROUND Ground
56 PAR Parity Bit
57 AD[17] Multiplexed Address/Data Bus
58 AD[18] Multiplexed Address/Data Bus
59 C/BE[2]# Byte Enable
60 AD[16] Multiplexed Address/Data Bus
61 IRDY# Initiator Ready
62 Ground Ground
63 3.3V 3.3 V Supply voltage
64 FRAME# Indicates Bulk Transfer
65 CLKRUN# Stops clock on certain mobile PCI devices
66 TRDY# Target Ready
67 SERR# Catastrophic system error
68 STOP# Target wishes to end transfer
69 GROUND Ground
70 3.3V 3.3 V Supply voltage
71 PERR# Indicates Parity Error
72 DEVSEL# PCI Device Select
73 C/BE[1]# Byte Enable
74 GROUND Ground
75 AD[14] Multiplexed Address/Data Bus
76 AD[15] Multiplexed Address/Data Bus
77 GROUND Ground
78 AD[13] Multiplexed Address/Data Bus
79 AD[12] Multiplexed Address/Data Bus
80 AD[11] Multiplexed Address/Data Bus
81 AD[10] Multiplexed Address/Data Bus
82 GROUND Ground
83 GROUND Ground
84 AD[09] Multiplexed Address/Data Bus
85 AD[08] Multiplexed Address/Data Bus
86 C/BE[0]# Byte Enable
87 AD[07] Multiplexed Address/Data Bus
88 3.3V 3.3 V Supply voltage
89 3.3V 3.3 V Supply
90 AD[06] Multiplexed Address/Data Bus
91 AD[05] Multiplexed Address/Data Bus
92 AD[04] Multiplexed Address/Data Bus
94 AD[02] Multiplexed Address/Data Bus
95 AD[03] Multiplexed Address/Data Bus
96 AD[00] Multiplexed Address/Data Bus
97 5V 5 V Supply voltage
99 AD[01] Multiplexed Address/Data Bus
101 GROUND Ground
102 GROUND Ground
103 AC_SYNC AC97 Sync
104 M66EN Enables 66 MHz PCI bus
105 AC_SDATA_IN AC97 Data Input
106 AC_SDATA_OUT AC97 Data Output
107 AC_BIT_CLK AC97 Bit Clock
108 AC_CODEC_ID0# Identifier for AC97 CODEC
109 AC_CODEC_ID1# Identifier for AC97 CODEC
110 AC_RESET# AC97 Reset
111 MOD_AUDIO_MON Modern Audio Monitor
113 AUDIO_GND Analog Ground for line-level audio
114 GROUND Ground
115 SYS_AUDIO_OUT Telephone Audio Out
116 SYS_AUDIO_IN Telephone Audio In
117 SYS_AUDIO_OUT GND Analog Ground for telephone audio
118 SYS_AUDIO_IN GND Analog Ground for telephone audio
119 AUDIO_GND Analog Ground for line-level audio
120 AUDIO_GND Analog Ground for line-level audio
122 MPCIACT# MiniPCI Function Active
123 VCC5VA 5V Analog
124 3.3VAUX 3.3 V supply-uninterrupted

an idea to install openWrt

Setup instructions

You will need the following:

  • A serial cable - female to female (or female to male + gender changer). The cable must be straight through, *not* a null modem cable.
  • USB flash drive or hard disk that is able to be powered from the board's USB port.
  • tftp server installed on your workstation.


The following instructions assume that /dev/sdb corresponds to the USB disk when it is plugged into your workstation. If this is not the case in your setup, please be careful to substitute the correct device name in all commands where appropriate.

   Build an image using "routerstationpro" as the MACHINE. For example, you can build core-image-minimal.
   Partition the USB drive so that primary partition 1 is type Linux (83). Minimum size depends on your root image size - core-image-minimal probably only needs 8-16MB, while other images will need more.# fdisk /dev/sdb
   Command (m for help): pDisk /dev/sdb: 4011 MB, 4011491328 bytes
   124 heads, 62 sectors/track, 1019 cylinders, total 7834944 sectors
   Units = sectors of 1 * 512 = 512 bytes
   Sector size (logical/physical): 512 bytes / 512 bytes
   I/O size (minimum/optimal): 512 bytes / 512 bytes
   Disk identifier: 0x0009e87dDevice Boot Start End Blocks Id System
   /dev/sdb1 62 1952751 976345 83 Linux
   Format partition 1 on the USB as ext3# mke2fs -j /dev/sdb1
   Mount partition 1 and then extract the contents of tmp/deploy/images/core-image-XXXX.tar.bz2 into it (preserving permissions).# mount /dev/sdb1 /media/sdb1
   # cd /media/sdb1
   # tar -xvjpf tmp/deploy/images/core-image-XXXX.tar.bz2
   Unmount the USB drive and then plug it into the board's USB port
   Connect the board's serial port to your workstation and then start up your favourite serial terminal so that you will be able to interact with the serial console. If you don't have a favourite, picocom is suggested:$ picocom /dev/ttyUSB0 -b 115200
   Connect the network into eth0 (the one that is NOT the 3 port switch). If you are using power-over-ethernet then the board will power up at this point.
   Start up the board, watch the serial console. Hit Ctrl+C to abort the autostart if the board is configured that way (it is by default). The bootloader's fconfig command can be used to disable autostart and configure the IP settings if you need to change them (default IP is
   Make the kernel (tmp/deploy/images/vmlinux-routerstationpro.bin) available on the tftp server.
   If you are going to write the kernel to flash, remove the current kernel and rootfs flash partitions. You can list the partitions using the following bootloader command:RedBoot> fis list
   You can delete the existing kernel and rootfs with these commands:RedBoot> fis delete kernel
   RedBoot> fis delete rootfs

Booting a Kernel Directly

Load the kernel using the following bootloader command:

RedBoot> load -m tftp kernel-ubiquiti.bin

You should see a message on it being successfully loaded.

Execute the kernel:

RedBoot> exec -c "console=ttyS0,115200 root=/dev/sda1 rw rootdelay=2 board=UBNT-RSPRO"

NOTE: Specifying the command line with -c is important as linux-yocto does not provide a default command line.

NOTE: you MUST declare board=UBNT-RSPRO, case the kernel needs this information to enable specific hw initialization, if you do not provide board=UBNT-RSPRO the kernel will consider "generic" profile (no usb, no ethernet, etc)

Writing a Kernel to Flash

Go to your tftp server and gzip the kernel you want in flash. It should halve the size.

Load the kernel using the following bootloader command:

RedBoot> load -r -b 0x80600000 -m tftp -h kernel-ubiquiti.bin.gz

This command should output something similar to the following:Raw file loaded 0x80600000-0x8087c537, assumed entry at 0x80600000

Calculate the length by subtracting the first number from the second number and then rounding the result up to the nearest 0x1000.

Using the length calculated above, create a flash partition for the kernel

RedBoot> fis create -b 0x80600000 -l 0x240000 kernel

NOTE: Change 0x240000 to your rounded length and change "kernel" to whatever you want to name your kernel

Booting a Kernel from Flash

To boot the flashed kernel perform the following steps.

At the bootloader prompt, load the kernel

RedBoot> fis load -d -e kernel

NOTE: Change the name "kernel" above if you chose something different earlier. Also, -e means 'elf' and -d means 'decompress'.

Execute the kernel using the exec command as above.

Automating the Boot Process

After writing the kernel to flash and testing the load and exec commands manually, you can automate the boot process with a boot script.

RedBoot> fconfig

NOTE: Answer the questions not specified here as they pertain to your environment.

Run script at boot: trueBoot 
   .. fis load -d -e kernel
    .. exec
    Enter script, terminate with empty line>> fis load -d -e kernel
>> exec -c "console=ttyS0,115200 root=/dev/sda1 rw rootdelay=2 board=UBNT-RSPRO"

Answer the remaining questions and write the changes to flash:

Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xbfff0000-0xc0000000: .
... Program from 0x87ff0000-0x88000000 at 0xbfff0000: .
Power cycle the board.

other os

openwrt (linux)

freebsd/mips ???