The BR6104 is based on the ADM5106 SoC (ARM7TDMI) and Broad Net Technology real-time OS (SOHO.BIN).
BR6104K is actually the same model as BR6104KP, but without USB connector, 48MHz oscillator e.t.c. soldered on the board, and without printer support in the firmware. It is possible to add missed USB parts and have a full BR6104KP model. The instructions are there. Edimax BR6104K/KP is rebranded Sweex LB000021 so PCBs are identical (PCB REV B. uses one DRAM chip, REV A two ones).
The BR6104KP is the same as the BR6104K but has two USB 1.1 master ports that can be used to connect a printer and use it as a print server. Also you can use USB Flash disk for root filesystem (needed patch for usb root device).
The BR6104P is based on the ADM5106 ARM7 SoC.
The BR6104S is based on the Samsung ARM SoC.
The BR6104W is based on the ARM7 SoC.
The BR6014Wg is based on the ADM5120 (BGA) and has one WAN port and 4 port LAN swith. Additionally, it has a WiFi 802.11G MiniPCI card: AirVast WN360g, which based on the Intersil / GlobespanVirata / Conexant PRISM GT chipset.
Routers's PCB has a place for the second MiniPCI slot, but socket is not soldered.
The BR6104WP is based on ARM7 CPU.
Adding a serial port
On the board there is a 8pin connector called JP2 that can be used as serial port. You can connect a serial level shifter (such as the MAX232 familly) to these pins. Its pins are:
1.RX 2.+3.3V 3.nc 4.nc 5.nc 6.nc 7.TX 8.GND
Use the 3.3V as supply for the MAX chip, don't use the 5V from the USB. (You wan't to convert to the processors' levels, not the USBs')
It is possible to use Siemens mobile phone datacable as converter.
Set you terminals' speed to 115200 (8N1). When powering press SPACE three times to get into the boot menu.
ADM5120 Boot: Linux Loader Menu ==================== (a) Download vmlinuz to flash ... (b) Download vmlinuz to sdram (for debug) ... (c) Exit Please enter your key :
Here you can choose to:
- Upload new firmware to Flash (option a), this might be dangerous. Image must be with CSYS header.
- Upload new vmlinuz to RAM (option b), nice for trying your own. Image must be usual vmlinuz.
- Exit (option c), continue to load the vmlinuz already in Flash.
The uploading is done with the XModem protocol.
Tip: I experienced a lot of problems with the XModem transfers, which seemed to have something to do with the start of the transfer. For me, it helps to type some junk into the router, before starting up the XModem protocol. So I type "a" for upload to flash, then hold the arrow-up key for a couple of seconds, then start the transfer. However, this might be voodoo, your mileage may vary.
ADM5120 SoC supports JTAG (IEEE 1149.1) and MIPS EJTAG 2.6 interfaces.
PQFP JTAG pinout:
134 TRSTN 135 TDI 136 TDO 137 TMS 139 TCK
Edimax BR-6104K, BR-6104KP and clones has 14-pin connector JP1 with conventional EJTAG 2.6 layout (aka "old VisionICE"). BR6104K has a 1KOhm resisor pulling TRTSN to ground to disable JTAG entirely, therefore remove it or add a 300.400Ohm resistor between VCC and TRSTN pin.
TRSTN 1 2 GND TDI 3 4 GND TDO 5 6 GND TMS 7 8 GND TCK 9 10 GND SRST 11 12 DINT 13 14 VCC
SRST and DINT pins are not used.
Unfortunately, openwince jtag can't identify this processor.
jtag> cable ppdev /dev/parport0 WIGGLER Initializing Macraigor Wiggler JTAG Cable on ppdev port /dev/parport0 jtag> detect IR length: 5 Chain length: 1 Device Id: 00000000000000000000000000000001 Unknown manufacturer! chain.c(110) Part 0 without active instruction chain.c(133) Part 0 without active instruction chain.c(110) Part 0 without active instruction
It seems, it's a real ID for this processor, other JTAG ulilities (i.e. detect subrotine from the wrt54g-debrick) returns the same value...
IMPCODE identification works:
jtag> instruction length 5 jtag> register IMP 32 jtag> instruction IMPCODE 00011 IMP jtag> instruction IMPCODE jtag> shift ir jtag> shift dr jtag> dr 01000001010000000100000000000000
31:29 EJTAGver 010 Version 2.6 28 R4k/R3k 0 R4k 24 DINTsup 1 supported 22:21 ASIDsize 10 8-bit ASID 16 MIPS16e 0 not supported 14 NoDMA 1 No EJTAG DMA support 0 MIPS32/64 0 MIPS32
EJTAG CONTROL register:
jtag> instruction length 5 jtag> register ECR 32 jtag> instruction CONTROL 01010 ECR jtag> instruction CONTROL jtag> shift ir jtag> shift dr jtag> dr 10000000011000000000000000000000
CPU Reset via PrRst bit in the CONTROL EJTAG register works.
When experimenting with the ADM5120, you will find that powering off and on is the only way to reboot the switch. This can be annoying. The "Reset" knob is software controlled and acts like Ctrl-Alt-Del. Luckily, adding a reset switch is easy. Locate the 7414 chip (U3 on Edimax 6104). Connecting pin 1 of this chip to GND will reset the board. (Please note: most likely you can reset the board by connecting a whole lot of other pins to GND, some of which will reset the board for good. Be careful.) The 7414 forms the official reset circuit, with a resistor and a condensor (and a diode that I don't understand, BTW).
Edimax recently released the sources to their kernel sources (2.4.18) and other tools such as Busybox.
- http://www.edimax.co.uk/download/Linux-SC.zip (slow as hell)
- http://obm.edimax.com.tw/Edimax-Tools.tgz Toolchains