From LinuxMIPS
Jump to navigationJump to search


ADMtek is part of Infineon technologies AG based in Taiwan and makes home gateway chips.

ADM5120 / ADM5120P

Infineon calls this 'a highly integrated, high performance and flexible System-on-Chip Home Gateway controller'.

ADM5120 Home Gateway Controller Datasheets: v1.13, v1.14, v1.16 and misc datasheets.


  • 175MHz/227MIPS 4Kc CPU with an embedded cache, 8K-byte I-cache and 8K D-cache MIPS32
  • An embedded memory management unit 32-entry TLB, with 16 organized entry pairs
  • 5 IEEE 802.e Fast Ethernet PHY interfaces and 1 GMII(1)/MII interface
  • Two SDRAM banks (up to 128MB)
  • Two Flash banks (up to 4MB)
  • AMBA-AHB internal bus
  • Embedded ethernet switch engine
  • 2 AMBA ABP UART interfaces
  • AHB-to-PCI bridge that supports 3 master devices (1)
  • GPIO (2))
  • USB 1.1 host controller


1 Available in BGA (ADM5120) only, not PQFP (ADM5120P)
2 PQFP has 4 GPIO pins v.s. BGA has 8 pins.

ADM8668 - WildPass

WildPass is a highly integrated SoC which incorporates a powerful 200MHZ CPU with MMU support, a 802.11a/b/g MAC/Baseband, two 802.3 MACs and one 10/100BASE-Tx 802.3u compliant Auto-MDIX transceiver.

  • CPU: 200MHZ MIPS4Kc with 8KB I-cache, 8KB D-Cache with MMU support, 6 DMA engines and Hardware NAT support
  • WLAN (1 802.11a/b/g WMAC + BBP)
  • USB 2.0 Host + PHY interface
  • PCI bridge that can support 3 PCI devices
  • IDE, PCM UART and SPI interfaces
  • IEEE 802.11a/b/g,IEEE 803.11e(WMM), 802.11i(WPA2), 802.11h, IEEE 802.11d and 802.11d Standards compliant
  • AHB devices: MIPS4KC, MC, port1, port2, WLAN, USB2.0 host, PCI, IDE.
  • Debugging interface: JTAG for MIPS-multiICE,trace32
  • Package: 352BGA and 289BGA (excludes PCI and IDE interface)

Products based on the ADM5120

Company Device Flash RAM Ports CPU pkg MiniPCI/WiFi Linux based Sources
Arcadyan HMS300 32Mb 64Mb 1Eth LAN, USB, IDE ? ? ?
Arcadyan WG4005B ? ? 1Eth WAN, 4Eth LAN, USB ? ? ?
Canyon CN-WF512 2Mb 16Mb 1Eth WAN,4Eth LAN ? Yes? Yes SRC + TOOLS
Conceptronic C54BRS4 2Mb 16Mb 1Eth WAN,4Eth LAN BGA Inprocomm Yes HTTP + FTP
Cellvision NFS-101U,202U 4Mb 32Mb 1Eth LAN,2USB 2.0 BGA ALI USB onboard Yes
Compex NP28G 4Mb 32Mb 4Eth LAN,1Eth WAN,4USB 2.0 BGA VIA USB onboard,AR2414 Yes
Compex NP27Gpics 4Mb 16Mb 4Eth LAN,1Eth WAN,2USB 1.1 BGA USB onboard,AR2413 Yes
Compex WP54G 4Mb 16Mb 2Eth LAN,1 miniPCI BGA AR2413 Yes
Compex WPP54AG 4Mb 32Mb 2Eth LAN,1 miniPCI BGA AR5413 Yes
D-Link DNS-120 4Mb 32Mb 1Eth LAN,2USB 2.0 BGA ALI USB onboard Yes
DIGITUS DN-7013-N 4Mb 32Mb 1Eth LAN,2USB 2.0 BGA ALI USB onboard Yes
DIGITUS DN-16031 4Mb 32Mb INTERNET CAMERA,RJ 45 ? Yes? Yes
Edimax BR-6104K 2Mb 16Mb 1Eth WAN,4Eth LAN PQFP No Yes SRC + TOOLS
Edimax BR-6104KP 2Mb 16Mb 1Eth WAN,4Eth LAN,2USB PQFP No Yes
Edimax BR-6104WG 2MB 16MB 1Eth WAN,4Eth LAN BGA Intersil PrismGT Yes SRC + TOOLS
Edimax BR-6114WG 2Mb 16Mb 1Eth WAN,4Eth LAN BGA Inprocomm Yes
Edimax BR-6524K ? 16MB 2Eth WAN,4Eth LAN ? No Yes
Edimax BR-6541K ? 16MB 4Eth WAN,1Eth LAN ? No Yes
Edimax BR-6524WP 4Mb 32Mb 2Eth WAN,4Eth LAN,2USB BGA Inprocomm 801.11g No
Edimax BR-6541WP 4Mb 32Mb 4Eth WAN,1Eth LAN,2USB BGA Inprocomm 801.11g No
Edimax PS-3205U 2Mb 16Mb 1Eth,2USB,2LPT PQFP No Yes
Edimax PS-3205UWg 2Mb 16Mb 1Eth,2USB,1LPT BGA LPT onboard, Inprocomm WiFi ?
Edimax EW-7207APg 2Mb 16Mb 5Eth BGA Inprocomm Yes
Hawking H2WR54G pics 4Mb 32Mb 2Eth WAN, 4Eth LAN BGA Inprocomm 802.11g Not soldered MiniPCI Yes
JAHT WA4054ex 2Mb 16Mb 1Eth WAN,4Eth LAN BGA Inprocomm Yes
Linksys PSUS4 4Mb 32Mb 4Eth,1USB PQFP No ? ?
Linksys WRP200 ? ? 4Eth,2Phone ? ? ? ?
Micronet SP888BP ? ? 1Eth Wan, 4Eth Lan 2USB ? ? ?
Netgear PS121 8Mb 32Mb 1Eth Lan, 1USB PQFP No, it's only a printer server ?
NETmate NMX-WB04G ? ? 1Eth Wan, 4Eth Lan BGA Yes ?
OvisLink eLive MU5000FS 4Mb 32Mb 1Eth LAN,2USB BGA ALI USB onboard (old revisions), NEC USB onboard (new revisions) Yes GPL500FS
Planet XRT-401D pics 2Mb 16Mb 1Eth WAN,4Eth LAN PQFP No Yes
Planet XRT-402D pic 2Mb 16Mb 2Eth WAN,4Eth LAN BGA Not soldered MiniPCI Yes
QUBS QB5004TWAN 2Mb? 16Mb? 1Eth WAN,4Eth LAN ? Yes
SMC SMC2804WBRP-G ? ? 1Eth WAN,4Eth LAN,1USB BGA Arcadyan WN4401A No
SMC SMC2804WBRP-G EU 2Mb 8Mb 1Eth WAN,4Eth LAN,1USB BGA SparkLAN WF-850FJ No
Sweex LB000021 2Mb 16Mb 1Eth WAN,4Eth LAN PQFP No Yes
TRENDnet TS-U200 review 4Mb 32Mb 1Eth LAN,2USB,CF I/II, Smart Media, Memory Sticks, SD, and MMC BGA NEC USB 2.0 Controller Yes
TRENDnet TS-U100 4Mb 32Mb 1Eth LAN, 2USB, BGA NEC USB 2.0 Controller Yes sources
ZyXEL HS-100W ? ? 1Eth WAN,4Eth LAN BGA Conexant XG-601 ?

There's probably more....

SMC2804WBRP-G, T-Sinus 154, Buffalo Tech BBR-4MG and Zyxel HS-100W uses realtime OS (SOHO.BIN) and BRN Boot Loader from the Broad Net Technology, Inc.

Dissecting the SMC2804WBRP-G



Most ADM5120 boards come with a build in bootloader.

On startup it waits a few moments before loading a compressed kernel image from Flash. If space is pressed (on the serial console) three times during that time the following menu is presented:

ADM5120 Boot:                                                                  
Linux Loader Menu                                                              
(a) Download vmlinuz to flash ...                                              
(b) Download vmlinuz to sdram (for debug) ...                                  
(c) Exit                                                                       
Please enter your key :

The bootloader contains a simple menu-driven interface, CFI FLASH r/w driver, x-modem downloader and zlib 1.1.4 code.

Linux distributions contains a binary form of the bootloader in /Linux-SC/EdiLinux/image/

Some info about an extended bootloader is available at

The source code for the extended bootloader can be downloaded from

NOTE 1: This extended bootloader may be based on the same codebase that the standard Edimax-type bootloader is, but it is larger than the standard one. Anything larger than 32K will possibly overwrite other data on the flash device. This extended bootloader is larger than 32K when compiled. It is possible to build it so that it is less than 32K in length, but to do that TFTP must be disabled.

NOTE 2: At least one device, the Hawking H2WR54G, is shipped with the first flash sector locked and protected against erase/write. This sector cannot be unlocked without special equipment since a 12 volt input is needed on one of the pins for the unlock operation and there is no 12 volt supply available anywhere in the router.

Linux Support

The vmlinuz file is a binary vmlinux file (created using objcopy with -O binary) compressed with gzip. The Edimax GPL sourcecode contains all necessary tools to create a new boot image.

Although YAMON is mentioned in the prom init code it seems to be a result of a bad cut-and-paste job. (Seems, development board was a Mips_Atlas). The commandline is hardcoded. (Unfortunatly spreaded over several files).

The image is a compressed binary file and the kernel entry is expected at a fixed address (which is why anything but the original ADMtek 2.4.18 kernel won't run without tricks).

The kernel is loaded at 0x80002000 and the kernel_entry is expected at 0x800026d8.

Linux 2.4

It seems that all products using this cpu use a 2.4.18 based kernel with additional patches by ADMtek.

This code is available from several vendors of the products mentioned above i.e. for Edimax BR6104.

The userland is based on uClibc and busybox.

Patch for vanilla 2.4.31 can be found at This patch have MTD and ebtables support.

Linux 2.6

Initial work is done to get the 2.6 kernel running on these boards. Sofar the basic board, serial, ethernet and PCI support is done. USB is still a work in progress but first signs of life have been detected.

A snapshot patch and a compiled vmlinuz image (tested on the BR6104) with a simple busybox based initramfs are available.

The ethernet switch driver has a few private ioctls which allow the switch layout to be configured at runtime. See also ADM5120_switch.



The Adm5120 has a built-in switch, see the page ADM5120_switch to configure it.


ADM5120 SoC supports JTAG (IEEE 1149.1) and MIPS EJTAG 2.6 interfaces.

PQFP JTAG pinout:

134 nTRSTN
135 TDI
136 TDO
137 TMS
139 TCK

Edimax BR-6104K, BR-6104KP and clones has 14-pin connector JP1 with conventional EJTAG 2.6 layout (aka "old VisionICE").

nTRST  1  2 GND
TDI    3  4 GND
TDO    5  6 GND
TMS    7  8 GND
TCK    9 10 GND
nSRST 11 12 -key
DINT  13 14 VCC

DINT pin is not used. nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). nSRST is optional. This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.

nSRST is a "system reset" signal and acts like conventional "Reset' button. Some routers

Unfortunately, openwince jtag can't identify this processor.

jtag> cable ppdev /dev/parport0 WIGGLER
Initializing Macraigor Wiggler JTAG Cable on ppdev port /dev/parport0
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001
  Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction

It seems, it's a real ID for this processor, other JTAG ulilities (i.e. detect subrotine from the wrt54g-debrick) returns the same value...

IMPCODE identification works:

jtag> instruction length 5
jtag> register IMP 32
jtag> instruction IMPCODE 00011 IMP
jtag> instruction IMPCODE
jtag> shift ir
jtag> shift dr
jtag> dr


31:29 EJTAGver 010 Version 2.6
   28 R4k/R3k    0 R4k
   24 DINTsup    1 supported
22:21 ASIDsize  10 8-bit ASID
   16 MIPS16e    0 not supported
   14 NoDMA      1 No EJTAG DMA support
    0 MIPS32/64  0 MIPS32


jtag> instruction length 5
jtag> register ECR 32
jtag> instruction CONTROL 01010 ECR
jtag> instruction CONTROL
jtag> shift ir
jtag> shift dr
jtag> dr

CPU Reset via PrRst bit in the CONTROL EJTAG register works.

(E)JTAG Cables

There is a page at the OpenWrt Wiki that discusses JTAG cables. Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys). Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.

EJTAG software

Macraigor OCD Commander is a simple JTAG debugger with MIPS support, OCD Flash programmer DEMO version. Requires Wiggler probe (Wiggler clone).

In general, the state of EJTAG software is pretty bad. The openwince jtag software can be used to re-flash, but that project is a shambles. If you dig around enough through the patches and discussions there you can find enough to make it work.


ADM5120 AMBA UART is not compatible with NS16c550. It has a lot of 16550-like features, but is not register compatable. This UART is well-known in the ARM world as:

AMBA UART PrimeCell (PL010) Block Specification (ARM-0001-CUST-DSPC-A03)

See a include/asm-arm/hardware/serial_amba.h and drivers/char/serial_amba.c

Linux distributive for ADM5120 contains a sourcecode for the ADM5120 UART. U-Boot bootloader has support for this UART too.


USB controller is available as a device on the AMBA internal bus and slightly different from the standart OHCI controller. Driver is available under usb-shci name.


ADM5120 (BGA version only) has AMBA-to-PCI bridge:

Autoconfig PCI channel 0x801756e8
Scanning bus 00, I/O 0x11500000:0x115ffff0, Mem 0x11400000:0x11500000
00:00.0 Class 0600: 1317:5120
       Mem unavailable -- skipping, bar_size=0x10000000
       I/O unavailable -- skipping, bar_size=0x1000000

Reset switch

When experimenting with the ADM5120, you will find that powering off and on is the only way to reboot the switch. This can be annoying. The "Reset" knob is software controlled and acts like Ctrl-Alt-Del. Luckily, adding a reset switch is easy. Locate the 7414 chip (U3 on Edimax 6104). Connecting pin 1 of this chip to GND will reset the board. (Please note: most likely you can reset the board by connecting a whole lot of other pins to GND, some of which will reset the board for good. Be careful.) The 7414 forms the official reset circuit, with a resistor and a condensor (and a diode that I don't understand, BTW). The diode is parallel to the resistor. It is there to discharge the capacitor, so the circuit also works with a fast power down - power up cycle.

Flash Memory Downloader

The Edimax Monkey is a script for the Greasemonkey extension for the Firefox web browser. With it you can download the contents of flash memory from an Edimax or Edimax-like device through your web browser. There is no need to modify the device in any way. You don't even have to remove the cover so you will not void your warranty. It accesses hidden functionality on the GoAhead webserver embedded in many of these devices. If your device does not have this functionality built in there is no danger to try it anyway. The worst that can happen is an error message sent back to your web browser.