ADMtek is part of Infineon technologies AG based in Taiwan and makes home gateway chips.
ADM5120 / ADM5120P
Infineon calls this 'a highly integrated, high performance and flexible System-on-Chip Home Gateway controller'.
- 175MHz/227MIPS 4Kc CPU with an embedded cache, 8K-byte I-cache and 8K D-cache MIPS32
- An embedded memory management unit 32-entry TLB, with 16 organized entry pairs
- 5 IEEE 802.e Fast Ethernet PHY interfaces and 1 GMII(1)/MII interface
- Two SDRAM banks (up to 128MB)
- Two Flash banks (up to 4MB)
- AMBA-AHB internal bus
- Embedded ethernet switch engine
- 2 AMBA ABP UART interfaces
- AHB-to-PCI bridge that supports 3 master devices (1)
- GPIO (2))
- USB 1.1 host controller
- 1 Available in BGA (ADM5120) only, not PQFP (ADM5120P)
- 2 PQFP has 4 GPIO pins v.s. BGA has 8 pins.
ADM8668 - WildPass
WildPass is a highly integrated SoC which incorporates a powerful 200MHZ CPU with MMU support, a 802.11a/b/g MAC/Baseband, two 802.3 MACs and one 10/100BASE-Tx 802.3u compliant Auto-MDIX transceiver.
- CPU: 200MHZ MIPS4Kc with 8KB I-cache, 8KB D-Cache with MMU support, 6 DMA engines and Hardware NAT support
- WLAN (1 802.11a/b/g WMAC + BBP)
- USB 2.0 Host + PHY interface
- PCI bridge that can support 3 PCI devices
- IDE, PCM UART and SPI interfaces
- IEEE 802.11a/b/g,IEEE 803.11e(WMM), 802.11i(WPA2), 802.11h, IEEE 802.11d and 802.11d Standards compliant
- AHB devices: MIPS4KC, MC, port1, port2, WLAN, USB2.0 host, PCI, IDE.
- Debugging interface: JTAG for MIPS-multiICE,trace32
- Package: 352BGA and 289BGA (excludes PCI and IDE interface)
Products based on the ADM5120
|Company||Device||Flash||RAM||Ports||CPU pkg||MiniPCI/WiFi||Linux based||Sources|
|Arcadyan||HMS300||32Mb||64Mb||1Eth LAN, USB, IDE||?||?||?|
|Arcadyan||WG4005B||?||?||1Eth WAN, 4Eth LAN, USB||?||?||?|
|Canyon||CN-WF512||2Mb||16Mb||1Eth WAN,4Eth LAN||?||Yes?||Yes||SRC + TOOLS|
|Conceptronic||C54BRS4||2Mb||16Mb||1Eth WAN,4Eth LAN||BGA||Inprocomm||Yes||HTTP + FTP|
|Cellvision||NFS-101U,202U||4Mb||32Mb||1Eth LAN,2USB 2.0||BGA||ALI USB onboard||Yes|
|Compex||NP28G||4Mb||32Mb||4Eth LAN,1Eth WAN,4USB 2.0||BGA||VIA USB onboard,AR2414||Yes|
|Compex||NP27Gpics||4Mb||16Mb||4Eth LAN,1Eth WAN,2USB 1.1||BGA||USB onboard,AR2413||Yes|
|Compex||WP54G||4Mb||16Mb||2Eth LAN,1 miniPCI||BGA||AR2413||Yes|
|Compex||WPP54AG||4Mb||32Mb||2Eth LAN,1 miniPCI||BGA||AR5413||Yes|
|D-Link||DNS-120||4Mb||32Mb||1Eth LAN,2USB 2.0||BGA||ALI USB onboard||Yes|
|DIGITUS||DN-7013-N||4Mb||32Mb||1Eth LAN,2USB 2.0||BGA||ALI USB onboard||Yes|
|DIGITUS||DN-16021||4Mb||32Mb||INTERNET CAMERA,RJ 45||?||?||Yes|
|DIGITUS||DN-16022||4Mb||32Mb||INTERNET CAMERA,RJ 45||?||Yes||Yes|
|DIGITUS||DN-16030||4Mb||16Mb||INTERNET CAMERA,RJ 45||?||?||Yes|
|DIGITUS||DN-16031||4Mb||32Mb||INTERNET CAMERA,RJ 45||?||Yes?||Yes|
|Edimax||BR-6104K||2Mb||16Mb||1Eth WAN,4Eth LAN||PQFP||No||Yes||SRC + TOOLS|
|Edimax||BR-6104KP||2Mb||16Mb||1Eth WAN,4Eth LAN,2USB||PQFP||No||Yes|
|Edimax||BR-6104WG||2MB||16MB||1Eth WAN,4Eth LAN||BGA||Intersil PrismGT||Yes||SRC + TOOLS|
|Edimax||BR-6114WG||2Mb||16Mb||1Eth WAN,4Eth LAN||BGA||Inprocomm||Yes|
|Edimax||BR-6524K||?||16MB||2Eth WAN,4Eth LAN||?||No||Yes|
|Edimax||BR-6541K||?||16MB||4Eth WAN,1Eth LAN||?||No||Yes|
|Edimax||BR-6524WP||4Mb||32Mb||2Eth WAN,4Eth LAN,2USB||BGA||Inprocomm 801.11g||No|
|Edimax||BR-6541WP||4Mb||32Mb||4Eth WAN,1Eth LAN,2USB||BGA||Inprocomm 801.11g||No|
|Edimax||PS-3205UWg||2Mb||16Mb||1Eth,2USB,1LPT||BGA||LPT onboard, Inprocomm WiFi||?|
|Hawking||H2WR54G pics||4Mb||32Mb||2Eth WAN, 4Eth LAN||BGA||Inprocomm 802.11g Not soldered MiniPCI||Yes|
|JAHT||WA4054ex||2Mb||16Mb||1Eth WAN,4Eth LAN||BGA||Inprocomm||Yes|
|Micronet||SP888BP||?||?||1Eth Wan, 4Eth Lan 2USB||?||?||?|
|Netgear||PS121||8Mb||32Mb||1Eth Lan, 1USB||PQFP||No, it's only a printer server||?|
|NETmate||NMX-WB04G||?||?||1Eth Wan, 4Eth Lan||BGA||Yes||?|
|OvisLink||eLive MU5000FS||4Mb||32Mb||1Eth LAN,2USB||BGA||ALI USB onboard (old revisions), NEC USB onboard (new revisions)||Yes||GPL500FS|
|Planet||XRT-401D pics||2Mb||16Mb||1Eth WAN,4Eth LAN||PQFP||No||Yes|
|Planet||XRT-402D pic||2Mb||16Mb||2Eth WAN,4Eth LAN||BGA||Not soldered MiniPCI||Yes|
|QUBS||QB5004TWAN||2Mb?||16Mb?||1Eth WAN,4Eth LAN||?||Yes|
|SMC||SMC2804WBRP-G||?||?||1Eth WAN,4Eth LAN,1USB||BGA||Arcadyan WN4401A||No|
|SMC||SMC2804WBRP-G EU||2Mb||8Mb||1Eth WAN,4Eth LAN,1USB||BGA||SparkLAN WF-850FJ||No|
|Sweex||LB000021||2Mb||16Mb||1Eth WAN,4Eth LAN||PQFP||No||Yes|
|TRENDnet||TS-U200 review||4Mb||32Mb||1Eth LAN,2USB,CF I/II, Smart Media, Memory Sticks, SD, and MMC||BGA||NEC USB 2.0 Controller||Yes|
|TRENDnet||TS-U100||4Mb||32Mb||1Eth LAN, 2USB,||BGA||NEC USB 2.0 Controller||Yes||sources|
|ZyXEL||HS-100W||?||?||1Eth WAN,4Eth LAN||BGA||Conexant XG-601||?|
There's probably more....
- Conceptronix C100BRS4H: http://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017785.html
- Maybe also the Aopen AOI-892: http://usa.aopen.com/products/network/wireless/aoaaoi892.htm
- Maybe also Asiarf AWBRP24242: http://www.asiarf.com/Product/wlan/AWBRP24242.html
- Black Box LW6004A
- Tonze AW-6200TE
- Digitus DN-7013, D-Link DNS-120, Sitecom LN-350, Trendnet TS-U100 and OvisLink eLive MU5000FS are based on the same stuff by Cellvision NFS-101U
- LevelOne FBR-1405TX/v3 (only v3!); kernel image contains "ADM5120", couldn't find the specs though.
- T-Sinus 154 Komfort T-Sinus 154
- T-Sinus 154 DSL (BRN154DSL sig. in firmware)It is based on ARM9, SAMSUNG S3C2510 More info on OpenWRT forum
- Buffalo Tech Inc. BBR-4MG
- Infineon EASY5120PS-ATA - small VoIP gateway based on the Ifineon VINETIC codec and SLIC-DC ringer.
SMC2804WBRP-G, T-Sinus 154, Buffalo Tech BBR-4MG and Zyxel HS-100W uses realtime OS (SOHO.BIN) and BRN Boot Loader from the Broad Net Technology, Inc.
Most ADM5120 boards come with a build in bootloader.
On startup it waits a few moments before loading a compressed kernel image from Flash. If space is pressed (on the serial console) three times during that time the following menu is presented:
ADM5120 Boot: Linux Loader Menu ==================== (a) Download vmlinuz to flash ... (b) Download vmlinuz to sdram (for debug) ... (c) Exit Please enter your key :
The bootloader contains a simple menu-driven interface, CFI FLASH r/w driver, x-modem downloader and zlib 1.1.4 code.
Linux distributions contains a binary form of the bootloader in /Linux-SC/EdiLinux/image/
Some info about an extended bootloader is available at http://midge.vlad.org.ua/wiki/bootloader-with-tftp
The source code for the extended bootloader can be downloaded from http://midge.vlad.org.ua/misc/bootloader/
NOTE 1: This extended bootloader may be based on the same codebase that the standard Edimax-type bootloader is, but it is larger than the standard one. Anything larger than 32K will possibly overwrite other data on the flash device. This extended bootloader is larger than 32K when compiled. It is possible to build it so that it is less than 32K in length, but to do that TFTP must be disabled.
NOTE 2: At least one device, the Hawking H2WR54G, is shipped with the first flash sector locked and protected against erase/write. This sector cannot be unlocked without special equipment since a 12 volt input is needed on one of the pins for the unlock operation and there is no 12 volt supply available anywhere in the router.
The vmlinuz file is a binary vmlinux file (created using objcopy with -O binary) compressed with gzip. The Edimax GPL sourcecode contains all necessary tools to create a new boot image.
Although YAMON is mentioned in the prom init code it seems to be a result of a bad cut-and-paste job. (Seems, development board was a Mips_Atlas). The commandline is hardcoded. (Unfortunatly spreaded over several files).
The image is a compressed binary file and the kernel entry is expected at a fixed address (which is why anything but the original ADMtek 2.4.18 kernel won't run without tricks).
The kernel is loaded at
0x80002000 and the kernel_entry is expected at
It seems that all products using this cpu use a 2.4.18 based kernel with additional patches by ADMtek.
This code is available from several vendors of the products mentioned above i.e. for Edimax BR6104.
The userland is based on uClibc and busybox.
Patch for vanilla 2.4.31 can be found at http://joco.kezdionline.ro/linux-2.4.31-adm.diff.bz2. This patch have MTD and ebtables support.
Initial work is done to get the 2.6 kernel running on these boards. Sofar the basic board, serial, ethernet and PCI support is done. USB is still a work in progress but first signs of life have been detected.
The ethernet switch driver has a few private ioctls which allow the switch layout to be configured at runtime. See also ADM5120_switch.
- midge http://midge.vlad.org.ua - OpenWRT-like distribution for routers based on ADM5120
- AMiLDA http://www.amilda.org/ - User-friendly distribution aimed at replacing the original firmware (previously known as "EdiLinux").
The Adm5120 has a built-in switch, see the page ADM5120_switch to configure it.
PQFP JTAG pinout:
134 nTRSTN 135 TDI 136 TDO 137 TMS 139 TCK
Edimax BR-6104K, BR-6104KP and clones has 14-pin connector JP1 with conventional EJTAG 2.6 layout (aka "old VisionICE").
nTRST 1 2 GND TDI 3 4 GND TDO 5 6 GND TMS 7 8 GND TCK 9 10 GND nSRST 11 12 -key DINT 13 14 VCC
DINT pin is not used. nTRST is a "TAP Reset" signal and it's active level is "0" (the first "n" indicates negative logic). nSRST is optional. This signal resets TAP controller independently from the CPU logic. To conform to MIPS EJTAG specifications this pin should be pulled to the ground via resistor ~1KOhm to keep TAP in reset state w/o probe attached. If probe does not control this pin, you need just to feed logical "1" to nTRST pin or pull this to the +VCC via ~300Ohm resistor.
nSRST is a "system reset" signal and acts like conventional "Reset' button. Some routers
Unfortunately, openwince jtag can't identify this processor.
jtag> cable ppdev /dev/parport0 WIGGLER Initializing Macraigor Wiggler JTAG Cable on ppdev port /dev/parport0 jtag> detect IR length: 5 Chain length: 1 Device Id: 00000000000000000000000000000001 Unknown manufacturer! chain.c(110) Part 0 without active instruction chain.c(133) Part 0 without active instruction chain.c(110) Part 0 without active instruction
It seems, it's a real ID for this processor, other JTAG ulilities (i.e. detect subrotine from the wrt54g-debrick) returns the same value...
IMPCODE identification works:
jtag> instruction length 5 jtag> register IMP 32 jtag> instruction IMPCODE 00011 IMP jtag> instruction IMPCODE jtag> shift ir jtag> shift dr jtag> dr 01000001010000000100000000000000
31:29 EJTAGver 010 Version 2.6 28 R4k/R3k 0 R4k 24 DINTsup 1 supported 22:21 ASIDsize 10 8-bit ASID 16 MIPS16e 0 not supported 14 NoDMA 1 No EJTAG DMA support 0 MIPS32/64 0 MIPS32
EJTAG CONTROL register:
jtag> instruction length 5 jtag> register ECR 32 jtag> instruction CONTROL 01010 ECR jtag> instruction CONTROL jtag> shift ir jtag> shift dr jtag> dr 10000000011000000000000000000000
CPU Reset via PrRst bit in the CONTROL EJTAG register works.
There is a page at the OpenWrt Wiki that discusses JTAG cables. Specifically, how one Wiggler-style buffered cable can be used for both ADM5120-based routers (e.g. Edimax) and Broadcom-based routers (e.g. Linksys). Most of the discussion centers on difficulties that can arise when using a Wiggler-style cable with the Linksys de-brick utility, but the cable information is applicable to Edimax (ADM5120) devices as well.
- Discussion http://wiki.openwrt.org/zt8qmwz
- Successful debrick experience http://midge.vlad.org.ua/forum/viewtopic.php?t=121
In general, the state of EJTAG software is pretty bad. The openwince jtag software can be used to re-flash, but that project is a shambles. If you dig around enough through the patches and discussions there you can find enough to make it work.
ADM5120 AMBA UART is not compatible with NS16c550. It has a lot of 16550-like features, but is not register compatable. This UART is well-known in the ARM world as:
AMBA UART PrimeCell (PL010) Block Specification (ARM-0001-CUST-DSPC-A03)
See a include/asm-arm/hardware/serial_amba.h and drivers/char/serial_amba.c
Linux distributive for ADM5120 contains a sourcecode for the ADM5120 UART. U-Boot bootloader has support for this UART too.
USB controller is available as a device on the AMBA internal bus and slightly different from the standart OHCI controller. Driver is available under usb-shci name.
ADM5120 (BGA version only) has AMBA-to-PCI bridge:
Autoconfig PCI channel 0x801756e8 Scanning bus 00, I/O 0x11500000:0x115ffff0, Mem 0x11400000:0x11500000 00:00.0 Class 0600: 1317:5120 Mem unavailable -- skipping, bar_size=0x10000000 I/O unavailable -- skipping, bar_size=0x1000000
When experimenting with the ADM5120, you will find that powering off and on is the only way to reboot the switch. This can be annoying. The "Reset" knob is software controlled and acts like Ctrl-Alt-Del. Luckily, adding a reset switch is easy. Locate the 7414 chip (U3 on Edimax 6104). Connecting pin 1 of this chip to GND will reset the board. (Please note: most likely you can reset the board by connecting a whole lot of other pins to GND, some of which will reset the board for good. Be careful.) The 7414 forms the official reset circuit, with a resistor and a condensor (and a diode that I don't understand, BTW). The diode is parallel to the resistor. It is there to discharge the capacitor, so the circuit also works with a fast power down - power up cycle.
Flash Memory Downloader
The Edimax Monkey is a script for the Greasemonkey extension for the Firefox web browser. With it you can download the contents of flash memory from an Edimax or Edimax-like device through your web browser. There is no need to modify the device in any way. You don't even have to remove the cover so you will not void your warranty. It accesses hidden functionality on the GoAhead webserver embedded in many of these devices. If your device does not have this functionality built in there is no danger to try it anyway. The worst that can happen is an error message sent back to your web browser.
- Network Storage Adapter NFS-101U, DNS-120, DN-7013-N, TS-U100, MU-5000FS, EP-9812-U Firmware Analyses by Sleep Walker
- ADM5120 toolchain, kernel & root fs HOWTO by Tom Wilms
- AMiLDA is a user friendly linux distribution for many ADM5120-based devices.