Difference between revisions of "DCT 5000"
(Fixing up broken links) |
(Fixing up broken links) |
||
Line 30: | Line 30: | ||
* Sony [[http://products.sel.sony.com/semi/PDF/CXA2094Q.pdf CXA2094]] | * Sony [[http://products.sel.sony.com/semi/PDF/CXA2094Q.pdf CXA2094]] | ||
* AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/19436.pdf 79C970AKC Ethernet]] | * AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/19436.pdf 79C970AKC Ethernet]] | ||
− | * 2) | + | * 2) InTel [ftp://download.intel.com/design/flcomp/datashts/29060615.pdf E28F320J5-120 flash] |
− | * 1) | + | * 1) InTel [ftp://download.intel.com/design/flcomp/datashts/29064514.pdf TE28F320C3 flash] |
* 1) AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/21534.pdf 29DL323CB flash]] | * 1) AMD [[http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/21534.pdf 29DL323CB flash]] | ||
* Crystal Semi [[http://www-test.cirrus.com/en/products/eol/detail/EOL22.html CS4620]] EOL :( | * Crystal Semi [[http://www-test.cirrus.com/en/products/eol/detail/EOL22.html CS4620]] EOL :( | ||
Line 48: | Line 48: | ||
* Altera [[http://www.altera.com/literature/ds/m7000.pdf 7128S CPLD]] '''''(mainboard U41)''''' | * Altera [[http://www.altera.com/literature/ds/m7000.pdf 7128S CPLD]] '''''(mainboard U41)''''' | ||
* Lattice [[http://www.latticesemi.com/products/cpld/ispMACH4A/ispMACH4A3/index.cfm M4A3-32/32-10VC CPLD]] ('''''mainboard U42 & U37''''') | * Lattice [[http://www.latticesemi.com/products/cpld/ispMACH4A/ispMACH4A3/index.cfm M4A3-32/32-10VC CPLD]] ('''''mainboard U42 & U37''''') | ||
− | * Macronix [[http://www.macronix.com/web/P_MKROM.nsf/20d0d6aadace5e08c82566710020a501/5206329c780458c2482568eb002a5f6c/$FILE/MX23L1611-2.0.pdf MX23L1611 Mask ROM]] - [[http://www.macronix.com/web/P_flash.nsf/bf3add4f68988391c825667100209fa5/6a8996488065a0af482569d1000ceb2d/$FILE/MX29L1611G-0.9.1.pdf Possible Flash | + | * Macronix [[http://www.macronix.com/web/P_MKROM.nsf/20d0d6aadace5e08c82566710020a501/5206329c780458c2482568eb002a5f6c/$FILE/MX23L1611-2.0.pdf MX23L1611 Mask ROM]] - [[http://www.macronix.com/web/P_flash.nsf/bf3add4f68988391c825667100209fa5/6a8996488065a0af482569d1000ceb2d/$FILE/MX29L1611G-0.9.1.pdf Possible Flash Equivalent]] |
* Winbond [[http://www.winbond.com/PDF/sheet/w24257aj-8n-a2.pdf 32 x 8 SRAM]] | * Winbond [[http://www.winbond.com/PDF/sheet/w24257aj-8n-a2.pdf 32 x 8 SRAM]] | ||
[[http://www.necelam.com/microprocessors/VR5432Processors.asp The processor info can be found here]] | [[http://www.necelam.com/microprocessors/VR5432Processors.asp The processor info can be found here]] | ||
Line 58: | Line 58: | ||
* [[http://www-2.cs.cmu.edu/afs/cs.cmu.edu/academic/class/15740-f97/public/doc/mips-isa.pdf Instruction set for MIPS IV ISA]] | * [[http://www-2.cs.cmu.edu/afs/cs.cmu.edu/academic/class/15740-f97/public/doc/mips-isa.pdf Instruction set for MIPS IV ISA]] | ||
− | + | Ken McGuire got his on 3/15/2003 and found the following: | |
− | * the serial port | + | * the serial port operates at 38400 baud. |
− | * Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 | + | * Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 seconds of holding) on the display and some stuff will come out the serial port. |
* the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run. | * the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run. | ||
* pressing select at each ot the menu items will do something, and produce data on the RS-232 port. | * pressing select at each ot the menu items will do something, and produce data on the RS-232 port. | ||
− | * there is a reset button inside that does the same as powering on. | + | * there is a reset button inside that does the same as powering on. labelled SW900. |
* holding just the menu button during reset gets the "boot" display without any serial port activity. | * holding just the menu button during reset gets the "boot" display without any serial port activity. | ||
* the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA. | * the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA. | ||
* there is no video out of any of the outputs, VGA, S-VID, video out. | * there is no video out of any of the outputs, VGA, S-VID, video out. | ||
* JTAG comes out to J7, a 10 pin header with half the pins grounded. | * JTAG comes out to J7, a 10 pin header with half the pins grounded. | ||
− | * | + | * pin-out at: [[http://www.paonia.com/~kenm/Pix/images/DCT5000/J7.jpg JTAG pin-out]] |
* J7 with connector (it's a .050" spacing): [[http://www.paonia.com/~kenm/Pix/images/DCT5000/J7conn.jpg J7conn picture]] | * J7 with connector (it's a .050" spacing): [[http://www.paonia.com/~kenm/Pix/images/DCT5000/J7conn.jpg J7conn picture]] | ||
Line 85: | Line 85: | ||
* 00 00 00 00 03 01 CF CA | * 00 00 00 00 03 01 CF CA | ||
− | [[ | + | [[User:T0mW|T0mW]] found that while holding the INFO button down while powering up, or RESET, it will give a verbose debug of the frequencies it is "hunting" on. |
− | or RESET, it will give a verbose debug of the | ||
− | + | MonMotha got his DCT5000 on 3/19/2003. I haven't done much with it other than take the top off, but I'll update this page as I go. So far I'm just attempting to find some of the missing doc links. | |
sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link http://24.125.76.224:8000/www.cableboxen.prjct to a page where a guy is working on mapping out how the DCT-2000 and 5000 work. | sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link http://24.125.76.224:8000/www.cableboxen.prjct to a page where a guy is working on mapping out how the DCT-2000 and 5000 work. | ||
Line 94: | Line 93: | ||
Here's a list of test points, add to them as they are discovered: | Here's a list of test points, add to them as they are discovered: | ||
− | * TP9 (next to the CPU, towards the back): Pin 76 of CPU - | + | * TP9 (next to the CPU, towards the back): Pin 76 of CPU - Sys Clock |
* TP11 (Next to U33): SDRAM Clock | * TP11 (Next to U33): SDRAM Clock | ||
* TP510: Ground | * TP510: Ground | ||
− | Notes [[ | + | Notes [[User:TimRiker|TimRiker]] "found": |
− | Connect a straight-through serial cable from the COM1 port on the host computer | + | Connect a straight-through serial cable from the COM1 port on the host computer to the RS-232 port on the target system. Make sure that the RS-232 connector is attached to internal connector labelled J800. 9600-8-n-1 |
− | to the RS-232 port on the target system. Make sure that the RS-232 connector is | ||
− | attached to internal connector | ||
Power ON the target board. When it boots, a # prompt appears. | Power ON the target board. When it boots, a # prompt appears. | ||
Line 117: | Line 114: | ||
</pre> | </pre> | ||
− | [[ | + | [[User:TimRiker|TimRiker]] is not sure if this is after installing a different ROM or something... Still looking. |
− | + | Ken McGuire searches through the binary images of Tim's ROM and [[http://www.elinux.org/datafiles/DTC5000.rom.bz2 the original ROM]] and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either. | |
Here's the DOCSIS configuration file of the box: | Here's the DOCSIS configuration file of the box: |
Revision as of 19:53, 27 June 2007
- http://www.gi.com/noflash/digicable_dct5000.html
- http://gicout60.gic.gi.com/customer_docs/
- http://www.linuxdevices.com/news/NS3134551333.html
note these are _not_ the 5200. no HD/PVR functionality in the base model
- cable in
- RF out
- conv in
- conv out
- 2 ieee-1394
- r-l-v in and out
- 1 rs-232
- vga out
- parallel
- ethernet PCNet
- 2 usb.
- data hs
- ir connector
- SPDIF
- S-Video
- smart card
- pcmcia slot. The card located under the mainboard has a legend on it: "DCT5000 PCMCIA Conn".
Includes US power cord, and 8" RF cable, 22 page hookup manual.
- nec vrc5476-83e North Bridge
- nec vr5432 CPU
- Sony [CXD3204 IEEE 1394]
- Sony [CXA2094]
- AMD [79C970AKC Ethernet]
- 2) InTel E28F320J5-120 flash
- 1) InTel TE28F320C3 flash
- 1) AMD [29DL323CB flash]
- Crystal Semi [CS4620] EOL :(
- Crystal Semi [CS4298 Programmer's manual] EOL
- ATI [Rage XL]
- ATI [Rage Theater]
- two RF modules
- Broadcom [BCM3120 Set-Top Box Tranceiver]
- Broadcom [BCM3300 Single Chip DOCSIS Cable Modem]
- Broadcom [7010 SetTop Box Decoder]
- 4) Mitsubishi[M2V64S30BTP RAM]
- 44 pin header. (ide we presume)
- 144 pin SO-DIMM slot. (ram?)
- ALI [M1543 Southbridge/SuperI/O]
- EPCOS [M3654K - 45.75MHz IF splitter] (front board F202)
- Altera [7128S CPLD] (mainboard U41)
- Lattice [M4A3-32/32-10VC CPLD] (mainboard U42 & U37)
- Macronix [MX23L1611 Mask ROM] - [Possible Flash Equivalent]
- Winbond [32 x 8 SRAM]
[The processor info can be found here]
Or direct links:
Ken McGuire got his on 3/15/2003 and found the following:
- the serial port operates at 38400 baud.
- Hold down the menu and info button, keep holding them while plugging in the box, "boot" will appear (after about 5 seconds of holding) on the display and some stuff will come out the serial port.
- the cursor and channel buttons will cycle through a menu: cold, hunt, disp, n dl, run.
- pressing select at each ot the menu items will do something, and produce data on the RS-232 port.
- there is a reset button inside that does the same as powering on. labelled SW900.
- holding just the menu button during reset gets the "boot" display without any serial port activity.
- the "pcmcia slot" connects to the motherboard via a 24 pin connector J402, so it's probably not true, or complete PCMCIA.
- there is no video out of any of the outputs, VGA, S-VID, video out.
- JTAG comes out to J7, a 10 pin header with half the pins grounded.
- pin-out at: [JTAG pin-out]
- J7 with connector (it's a .050" spacing): [J7conn picture]
Here is what comes out the serial port at boot time:
- DCT5000 Boot ROM v1.17
- Copyright (c) 1999 by General Instrument Corp.
- SUDB 0xBF000004
- 58 00 00 00 53 55 44 42 00 00 11 01 07 00 00 00
- E9 E2 EB E2 01 BC 20 02 74 7B 0B 00 03 10 20 20
- 20 20 20 20 20 20 30 30 30 2E 00 30 00 00 00 00
- 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 BF
- 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 BF
- 00 00 00 00 03 01 CF CA
T0mW found that while holding the INFO button down while powering up, or RESET, it will give a verbose debug of the frequencies it is "hunting" on.
MonMotha got his DCT5000 on 3/19/2003. I haven't done much with it other than take the top off, but I'll update this page as I go. So far I'm just attempting to find some of the missing doc links.
sorphin got both of his DCT-5000's on 3/18/2003, and is doing some digging, also found this link http://24.125.76.224:8000/www.cableboxen.prjct to a page where a guy is working on mapping out how the DCT-2000 and 5000 work.
Here's a list of test points, add to them as they are discovered:
- TP9 (next to the CPU, towards the back): Pin 76 of CPU - Sys Clock
- TP11 (Next to U33): SDRAM Clock
- TP510: Ground
Notes TimRiker "found":
Connect a straight-through serial cable from the COM1 port on the host computer to the RS-232 port on the target system. Make sure that the RS-232 connector is attached to internal connector labelled J800. 9600-8-n-1
Power ON the target board. When it boots, a # prompt appears.
Enter the following commands at the # prompt:
export BOOTFILE=vmlinus export BOOTHOST= export NETADDR= export NETMASK= export BROADCAST= export ETHERHWADDR=
TimRiker is not sure if this is after installing a different ROM or something... Still looking.
Ken McGuire searches through the binary images of Tim's ROM and [the original ROM] and doesn't find any of the above strings. Nothing comes out his DCT5000's J800 on power-up either.
Here's the DOCSIS configuration file of the box:
NetworkAccess = Yes Start ClassOfService ClassID = 1 MaxRateDown = 1500000 MaxRateUp = 128000 PriorityUp = 1 GuaranteedUp = 1280 MaxBurstUp = 0 PrivacyEnable = Yes EndOf ClassOfService MaxCPE = 4