So I was parusing kijiji looking for free printers to steal parts from when I happened upon an add for a Linksys Media Center Extender (WMCE54AG). This device was originally created to route audio and video from your XP Media Center to your TV so that you did not need a computer in your living room. I remember when these first came out I saw them at memoryexpress.com from a chunk of change. Well I scored this one in working condition minus the remote for $10 !!!
As with most project I was to into it and forgot pictures of the unit before it was stripped. Here are some I stole from the internets:
(The picture with the chips circled is a handy reference from here)
Main processor under the heatsink is a ATI Xilleon 225
-
ATI Xilleon 225
215H25AGA13
GC7312.1
0433SS -
Ethernet Controler, PCI interface
RTL8101L
48298Q1 -
Serial EEPROM from MAC storage
AT93C46 -
Mini-PCI A/G WiFi card
Atheros
AR5213A-00
A20254C
2304 -
128Mb SDRAM for the BlackFin DSP
SAMSUNG 440
K4S281632F-TC75 -
600MHz BlackFin DSP ($28 for one of these babbies in TQFP)
ANALOG DEVICES
ADSP-BF533
SKBCE10
559595.1 0.3
0445 SINGAPORE BLACK -
128Mb (8M x 16) GDDR SDRAM
HYNIX 430P
HY5DU281622ET-5 -
16M x 8 bit NAND flash memory
SAMSUNG 446
K9F2808U0C
YCB0
UPH737DCC -
2ch 1% regulation LDO
LT 0433
LTC1628CG
N27185 -
4Mb Flash
MXJ043504
29LV040QC-70
1F9588 -
8-bit AVR, maybe IR controler?
ATMEL
AT90SC3232CS
0443
4S5691
Another fun chip is on the back of the front controls. Its a 16bit I2C port expander from NXP It runs the front controls and the tri color LED ring on the navigational pad. I had some fun with blinking lights before continuing.
So I set out looking at the board and discovered some things. Their is a MFG/WDT jumper on the board, no idea what the WDT jumper does but I presume its something to do with the watchdog timer. Maybe during chip flashing they need to halt the Xillions WDT so it wont interfear. In the one corner I found a “Debug Port” with an IC not in place. Their where only two wires so I immediatly thought serial port and was right. I soldered in a header after carefully drilling the via’s out to accept a standard sized headder. The copper jumpers across the pins there is because I do not need to use the level shifting IC that they would have put on. My BusPirate runs at 3V3/5V0 so I just bridged the pins and hooked her up.
115200bps, 8N1 seemed like a good place to start and out poped the boot sequence! Initialy it loads the “bios” or “IPL” that inits the hardware and discovers boot devices which are the Flash and NAND Flash then asks for a command. Without interfearence it will boot the WindowsCE kernel and start up a bunch of tasks like re-mapping the address space to a virtual one then unloads the debug shell. I somewhat remember from my WinCE v5 licence days that the IDE had some shell debugging apps that would hook the kernel to keep the debug ports open but I will need to dig up my CD’s before I can be sure. For now I will just poke around.
So far I have leared this; The MFG jumper puts the unit into infinate self check and typing “y” at the ++CMD prompt will dump you to a PROM console those who have ran SGI/SUN machines may remember. Below are some test files with the output of a few boots.