Difference between revisions of "DCT 5000"

From eLinux.org
Jump to: navigation, search
(More [ ] fixing)
 
(3 intermediate revisions by 3 users not shown)
Line 27: Line 27:
 
* nec vrc5476-83e North Bridge
 
* nec vrc5476-83e North Bridge
 
* nec vr5432 CPU
 
* nec vr5432 CPU
* Sony [[http://products.sel.sony.com/semi/PDF/CXD3204R.pdf CXD3204 IEEE 1394]]
+
* Sony [http://products.sel.sony.com/semi/PDF/CXD3204R.pdf CXD3204 IEEE 1394]
* Sony [[http://products.sel.sony.com/semi/PDF/CXA2094Q.pdf CXA2094]]
+
* Sony [http://products.sel.sony.com/semi/PDF/CXA2094Q.pdf CXA2094]
* AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/19436.pdf 79C970AKC Ethernet]]
+
* AMD [http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/19436.pdf 79C970AKC Ethernet]
 
* 2) InTel [ftp://download.intel.com/design/flcomp/datashts/29060615.pdf E28F320J5-120 flash]
 
* 2) InTel [ftp://download.intel.com/design/flcomp/datashts/29060615.pdf E28F320J5-120 flash]
 
* 1) InTel [ftp://download.intel.com/design/flcomp/datashts/29064514.pdf TE28F320C3 flash]
 
* 1) InTel [ftp://download.intel.com/design/flcomp/datashts/29064514.pdf TE28F320C3 flash]
* 1) AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/21534.pdf 29DL323CB flash]]
+
* 1) AMD [http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/21534.pdf 29DL323CB flash]
* Crystal Semi [[http://www-test.cirrus.com/en/products/eol/detail/EOL22.html CS4620]] EOL :(
+
* Crystal Semi [http://www-test.cirrus.com/en/products/eol/detail/EOL22.html CS4620] EOL :(
* Crystal Semi [[http://www.alsa-project.org/alsa/ftp/manuals/cirrus/4298.pdf CS4298 Programmer's manual]] EOL
+
* Crystal Semi [http://www.alsa-project.org/alsa/ftp/manuals/cirrus/4298.pdf CS4298 Programmer's manual] EOL
* ATI [[http://www.ati.com/technology/hardware/ragexlxc/features.html Rage XL]]
+
* ATI [http://www.ati.com/technology/hardware/ragexlxc/features.html Rage XL]
* ATI [[http://www.ati.com/technology/hardware/ragetheater/ Rage Theater]]
+
* ATI [http://www.ati.com/technology/hardware/ragetheater/ Rage Theater]
 
* two RF modules
 
* two RF modules
* Broadcom  [[http://www.broadcom.com/pbs/BCM3120.pdf BCM3120 Set-Top Box Tranceiver]]
+
* Broadcom  [http://www.broadcom.com/pbs/BCM3120.pdf BCM3120 Set-Top Box Tranceiver]
* Broadcom [[http://www.broadcom.com/pbs/BCM3300.pdf BCM3300 Single Chip DOCSIS Cable Modem]]
+
* Broadcom [http://www.broadcom.com/pbs/BCM3300.pdf BCM3300 Single Chip DOCSIS Cable Modem]
* Broadcom [[http://www.broadcom.com/pbs/BCM7010.pdf 7010 SetTop Box Decoder]]
+
* Broadcom [http://www.broadcom.com/pbs/BCM7010.pdf 7010 SetTop Box Decoder]
* 4) Mitsubishi[[http://www.mitsubishichips.com/data/datasheets/memory/mempdf/ds/M2V64S20B.pdf M2V64S30BTP RAM]]
+
* 4) Mitsubishi[http://www.mitsubishichips.com/data/datasheets/memory/mempdf/ds/M2V64S20B.pdf M2V64S30BTP RAM]
 
* 44 pin header. (ide we presume)
 
* 44 pin header. (ide we presume)
 
* 144 pin SO-DIMM slot. (ram?)
 
* 144 pin SO-DIMM slot. (ram?)
* ALI [[http://www.ali.com.tw/eng/product/corelogic/m1543c.htm M1543 Southbridge/SuperI/O]]
+
* ALI [http://www.ali.com.tw/eng/product/corelogic/m1543c.htm M1543 Southbridge/SuperI/O]
* EPCOS [[http://www.epcos.com/inf/40/ds/mm/M3654K.pdf M3654K - 45.75MHz IF splitter]] '''''(front board F202)'''''
+
* EPCOS [http://www.epcos.com/inf/40/ds/mm/M3654K.pdf M3654K - 45.75MHz IF splitter] '''''(front board F202)'''''
* Altera [[http://www.altera.com/literature/ds/m7000.pdf 7128S CPLD]] '''''(mainboard U41)'''''
+
* Altera [http://www.altera.com/literature/ds/m7000.pdf 7128S CPLD] '''''(mainboard U41)'''''
* Lattice [[http://www.latticesemi.com/products/cpld/ispMACH4A/ispMACH4A3/index.cfm M4A3-32/32-10VC CPLD]] ('''''mainboard U42 & U37''''')
+
* Lattice [http://www.latticesemi.com/products/cpld/ispMACH4A/ispMACH4A3/index.cfm M4A3-32/32-10VC CPLD] ('''''mainboard U42 & U37''''')
* Macronix [[http://www.macronix.com/web/P_MKROM.nsf/20d0d6aadace5e08c82566710020a501/5206329c780458c2482568eb002a5f6c/$FILE/MX23L1611-2.0.pdf MX23L1611 Mask ROM]] - [[http://www.macronix.com/web/P_flash.nsf/bf3add4f68988391c825667100209fa5/6a8996488065a0af482569d1000ceb2d/$FILE/MX29L1611G-0.9.1.pdf Possible Flash Equivalent]]
+
* Macronix [http://www.macronix.com/web/P_MKROM.nsf/20d0d6aadace5e08c82566710020a501/5206329c780458c2482568eb002a5f6c/$FILE/MX23L1611-2.0.pdf MX23L1611 Mask ROM] - [http://www.macronix.com/web/P_flash.nsf/bf3add4f68988391c825667100209fa5/6a8996488065a0af482569d1000ceb2d/$FILE/MX29L1611G-0.9.1.pdf Possible Flash Equivalent]
* Winbond [[http://www.winbond.com/PDF/sheet/w24257aj-8n-a2.pdf 32 x 8 SRAM]]
+
* Winbond [http://www.winbond.com/PDF/sheet/w24257aj-8n-a2.pdf 32 x 8 SRAM]
[[http://www.necelam.com/microprocessors/VR5432Processors.asp The processor info can be found here]]
+
[http://www.necelam.com/microprocessors/VR5432Processors.asp The processor info can be found here]
  
 
Or direct links:
 
Or direct links:
* [[http://www.necelam.com/docs/files/U13504EJ3V0DS00.pdf Datasheet]]
+
* [http://www.necelam.com/docs/files/U13504EJ3V0DS00.pdf Datasheet]
* [[http://www.necelam.com/docs/files/1375_V1.pdf Users manual vol. 1]]
+
* [http://www.necelam.com/docs/files/1375_V1.pdf Users manual vol. 1]
* [[http://www.necelam.com/docs/files/1375_V2.pdf Users manual vol. 2]]
+
* [http://www.necelam.com/docs/files/1375_V2.pdf Users manual vol. 2]
* [[http://www-2.cs.cmu.edu/afs/cs.cmu.edu/academic/class/15740-f97/public/doc/mips-isa.pdf Instruction set for MIPS IV ISA]]
+
* [http://www-2.cs.cmu.edu/afs/cs.cmu.edu/academic/class/15740-f97/public/doc/mips-isa.pdf Instruction set for MIPS IV ISA]
  
 
Ken McGuire got his on 3/15/2003 and found the following:
 
Ken McGuire got his on 3/15/2003 and found the following:
Line 69: Line 69:
 
* there is no video out of any of the outputs, VGA, S-VID, video out.
 
* there is no video out of any of the outputs, VGA, S-VID, video out.
 
* JTAG comes out to J7, a 10 pin header with half the pins grounded.
 
* JTAG comes out to J7, a 10 pin header with half the pins grounded.
* pin-out at: [[http://www.paonia.com/~kenm/Pix/images/DCT5000/J7.jpg JTAG pin-out]]
+
* pin-out at: [http://www.paonia.com/~kenm/Pix/images/DCT5000/J7.jpg JTAG pin-out]
* J7 with connector (it's a .050" spacing): [[http://www.paonia.com/~kenm/Pix/images/DCT5000/J7conn.jpg J7conn picture]]
+
* J7 with connector (it's a .050" spacing): [http://www.paonia.com/~kenm/Pix/images/DCT5000/J7conn.jpg J7conn picture]
  
 
Here is what comes out the serial port at boot time:
 
Here is what comes out the serial port at boot time:
Line 89: Line 89:
 
MonMotha got his DCT5000 on 3/19/2003.  I haven't done much with it other than take the top off, but I'll update this page as I go.  So far I'm just attempting to find some of the missing doc links.
 
MonMotha got his DCT5000 on 3/19/2003.  I haven't done much with it other than take the top off, but I'll update this page as I go.  So far I'm just attempting to find some of the missing doc links.
  
sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link http://24.125.76.224:8000/www.cableboxen.prjct to a page where a guy is working on mapping out how the DCT-2000 and 5000 work.
+
sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link [http://24.125.76.224:8000/www.cableboxen.prjct] to a page where a guy is working on mapping out how the DCT-2000 and 5000 work.
  
 
Here's a list of test points, add to them as they are discovered:
 
Here's a list of test points, add to them as they are discovered:
Line 116: Line 116:
 
[[User:TimRiker|TimRiker]] is not sure if this is after installing a different ROM or something... Still looking.
 
[[User:TimRiker|TimRiker]] is not sure if this is after installing a different ROM or something... Still looking.
  
Ken McGuire searches through the binary images of Tim's ROM and [[http://www.elinux.org/datafiles/DTC5000.rom.bz2 the original ROM]] and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either.
+
Ken McGuire searches through the binary images of Tim's ROM and [http://www.eLinux.org/datafiles/DTC5000.rom.bz2 the original ROM] and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either.
  
 
Here's the DOCSIS configuration file of the box:
 
Here's the DOCSIS configuration file of the box:
Line 136: Line 136:
 
</pre>
 
</pre>
  
[[Category:Categories]]
+
[[Category:Hardware Hacking]]

Latest revision as of 22:49, 13 July 2012

note these are _not_ the 5200. no HD/PVR functionality in the base model

  • cable in
  • RF out
  • conv in
  • conv out
  • 2 ieee-1394
  • r-l-v in and out
  • 1 rs-232
  • vga out
  • parallel
  • ethernet PCNet
  • 2 usb.
  • data hs
  • ir connector
  • SPDIF
  • S-Video
  • smart card
  • pcmcia slot. The card located under the mainboard has a legend on it: "DCT5000 PCMCIA Conn".

Includes US power cord, and 8" RF cable, 22 page hookup manual.

The processor info can be found here

Or direct links:

Ken McGuire got his on 3/15/2003 and found the following:

  • the serial port operates at 38400 baud.
  • Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 seconds of holding) on the display and some stuff will come out the serial port.
  • the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run.
  • pressing select at each ot the menu items will do something, and produce data on the RS-232 port.
  • there is a reset button inside that does the same as powering on. labelled SW900.
  • holding just the menu button during reset gets the "boot" display without any serial port activity.
  • the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA.
  • there is no video out of any of the outputs, VGA, S-VID, video out.
  • JTAG comes out to J7, a 10 pin header with half the pins grounded.
  • pin-out at: JTAG pin-out
  • J7 with connector (it's a .050" spacing): J7conn picture

Here is what comes out the serial port at boot time:

  • DCT5000 Boot ROM v1.17
  • Copyright (c) 1999 by General Instrument Corp.
  • SUDB 0xBF000004
  • 58 00 00 00 53 55 44 42 00 00 11 01 07 00 00 00
  • E9 E2 EB E2 01 BC 20 02 74 7B 0B 00 03 10 20 20
  • 20 20 20 20 20 20 30 30 30 2E 00 30 00 00 00 00
  • 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 BF
  • 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 BF
  • 00 00 00 00 03 01 CF CA

T0mW found that while holding the INFO button down while powering up, or RESET, it will give a verbose debug of the frequencies it is "hunting" on.

MonMotha got his DCT5000 on 3/19/2003. I haven't done much with it other than take the top off, but I'll update this page as I go. So far I'm just attempting to find some of the missing doc links.

sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link [1] to a page where a guy is working on mapping out how the DCT-2000 and 5000 work.

Here's a list of test points, add to them as they are discovered:

  • TP9 (next to the CPU, towards the back): Pin 76 of CPU - Sys Clock
  • TP11 (Next to U33): SDRAM Clock
  • TP510: Ground

Notes TimRiker "found":

Connect a straight-through serial cable from the COM1 port on the host computer to the RS-232 port on the target system. Make sure that the RS-232 connector is attached to internal connector labelled J800. 9600-8-n-1

Power ON the target board. When it boots, a # prompt appears.

Enter the following commands at the # prompt:

export BOOTFILE=vmlinus
export BOOTHOST=
export NETADDR=
export NETMASK=
export BROADCAST=
export ETHERHWADDR=

TimRiker is not sure if this is after installing a different ROM or something... Still looking.

Ken McGuire searches through the binary images of Tim's ROM and the original ROM and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either.

Here's the DOCSIS configuration file of the box:

NetworkAccess = Yes

Start ClassOfService
ClassID = 1
MaxRateDown = 1500000
MaxRateUp = 128000
PriorityUp = 1
GuaranteedUp = 1280
MaxBurstUp = 0
PrivacyEnable = Yes
EndOf ClassOfService

MaxCPE = 4