So I was parusing kijiji looking for free printers to steal parts from when I happened upon an add for a Linksys Media Center Extender (WMCE54AG). This device was originally created to route audio and video from your XP Media Center to your TV so that you did not need a computer in your living room. I remember when these first came out I saw them at memoryexpress.com from a chunk of change. Well I scored this one in working condition minus the remote for $10 !!!
As with most project I was to into it and forgot pictures of the unit before it was stripped. Here are some I stole from the internets:
(The picture with the chips circled is a handy reference from here)
Main processor under the heatsink is a ATI Xilleon 225
ATI Xilleon 225
Ethernet Controler, PCI interface
Serial EEPROM from MAC storage
Mini-PCI A/G WiFi card
128Mb SDRAM for the BlackFin DSP
600MHz BlackFin DSP ($28 for one of these babbies in TQFP)
0445 SINGAPORE BLACK
128Mb (8M x 16) GDDR SDRAM
16M x 8 bit NAND flash memory
2ch 1% regulation LDO
8-bit AVR, maybe IR controler?
Another fun chip is on the back of the front controls. Its a 16bit I2C port expander from NXP It runs the front controls and the tri color LED ring on the navigational pad. I had some fun with blinking lights before continuing.
So I set out looking at the board and discovered some things. Their is a MFG/WDT jumper on the board, no idea what the WDT jumper does but I presume its something to do with the watchdog timer. Maybe during chip flashing they need to halt the Xillions WDT so it wont interfear. In the one corner I found a “Debug Port” with an IC not in place. Their where only two wires so I immediatly thought serial port and was right. I soldered in a header after carefully drilling the via’s out to accept a standard sized headder. The copper jumpers across the pins there is because I do not need to use the level shifting IC that they would have put on. My BusPirate runs at 3V3/5V0 so I just bridged the pins and hooked her up.
115200bps, 8N1 seemed like a good place to start and out poped the boot sequence! Initialy it loads the “bios” or “IPL” that inits the hardware and discovers boot devices which are the Flash and NAND Flash then asks for a command. Without interfearence it will boot the WindowsCE kernel and start up a bunch of tasks like re-mapping the address space to a virtual one then unloads the debug shell. I somewhat remember from my WinCE v5 licence days that the IDE had some shell debugging apps that would hook the kernel to keep the debug ports open but I will need to dig up my CD’s before I can be sure. For now I will just poke around.
So far I have leared this; The MFG jumper puts the unit into infinate self check and typing “y” at the ++CMD prompt will dump you to a PROM console those who have ran SGI/SUN machines may remember. Below are some test files with the output of a few boots.