Reference design

MG35 is probably based on the EM8510 Portable Media Player Development Kit, which contains a reference design. Or maybe on DVD-8500 Reference Design.

Is my player a Mediagate MG-35 clone?

We know some clones, ans it looks like the firmwares are interchangeable between these units (but if you are updating, you're doing it on your own risk!!! ):

• Network Media Player-35 by Freecom - firmware here.
• Movie Cowboy DC-MC35UL/N by Digital Cowboy - firmware here.
  • This is the model that comes with the USB host controller.

Main board chips

Note that some chips may be different to your MG-35, particularly flash and SDRAM, but the base configuration is the following:

1x Sigma Dev - EM8511-Rev.A = Digital media processor with MPEG-2/4 and DVD decoding.

The heart of this board is the Sigma Designs EM8511, a digital media processor incorporating a 200MHz ARM CPU, an integrated IDE controller, and the audio and video decoders. According to product brochure, 8511 it's  a non-Macrovision version of EM8510. If you google for "em8510 datasheet", among a lot of useless sites, you'll find a leaked datasheets (hint: it's on a wiki). On the same product brochure you can find the block diagram.

Other info:

200MHz CPU clock

100MHz System bus clock

The CPU info, as in /proc/cpuinfo is:

Processor       : ARM pt110 rev 0 (v4l)
BogoMIPS        : 80.69
Hardware        : JASPER
Revision        : 0000
Serial          : 0000000000000000

Documentation for the ARM core is here.

The following info courtesy of Mark Hotchkiss:

> The source code is compiled with -mtune=arm7tdmi -march=armv4 options. Aren't they
> contradictory?
 [...]I think the confusion comes from the crazy ARM version numbers and names.
The ARM architectures have different versions, and one of the "v4" implementations is the ARM7TDMI (which EM8510 is, I believe). So those switches seem more redundant than contradictory, as both of those switches select the same instruction set, 4T (which I'm told means that it is v4 with the additional "thumb" instructions). And then there are the marketing names, like "Cortex", in case it wasn't already confusing enough. The confusing part is that Arm7 is a "v4".

2x Samsung - K8D1716UTC = Flash Memory

2x Spansion - MBM29LV160TM = Flash Memory

16M Bit (2M x8/1M x16) Dual Bank NOR Flash Memory. Total 32Mbit = 4MB. PDF for Samsung and Spansion. The two flash chips are both in word mode with each handling 16-bits of the 32-bit bus. OE and We are fired to both chips no matter which word is accessed. This is fine for reads but requires care when writing - see the source of the mgnv utility for more information.

Notice the paint dots on the flash chips at the top right of the picture in the [JTAG section]. Both chips have a yellow dot and one has a dot of a different colour. These dots are to let the manufacturers track which chips are programmed and which are high word versus low word. This suggests that the manufacturers don't use in-circuit JTAG programming!

2x Samsung - K4S641632H-TC60 = SDRAM

8MB 166mHz SDRAM module. (16MB total).

1x Hynix - HY57V643220DT-6 = SDRAM

8MB 166mHz SDRAM module. Probably the video+overlay memory.

1x Wolfson - WM8728S = 192kHz Stereo DAC.

1x Davicom - DM9000E = 10/100 Ethernet Controller.

1x Altera - EPM3032A = CMOS EEPROM-based CPLD with JTAG-ICD support.

Programmable logic , 32 macrocells, 2 logic array blocks, 34 I/O pins. PDF here

1x Prolific - PL-2507 = USB2.0 to IDE bridge controller.

Functional description here

Front panel board - FIP

The FIP panel gets the keypreses from the device and remote buttons (it decodes the IR signals itself, through the INT0 pin) and sends them as commands to the main board over a I2C serial link.

Here are the signals on the J2 conector which connects the FIP panel to the main board:

FIP is ALWAYS powered on from a 5 volt supply on J2 pin 2. When the POWER button is pressed, or a POWER IR code is received, the mcu powers-up the rest of the MG35, probably through J2 pin 9 (I can't see any other way). While operating, the EM8511 needs to poll the front panel for commands through the serial I2C interface.

The 5 volts from the USB connector is brought in through J2 pin 3 so that the S3C9454 mcu knows when the MG35 is acting as a USB device. Nothing on the front-panel is powered from the USB.

The PWR, NET and HDD LEDs are controlled directly from the main PCB by the EM8511, the Ethernet controller and the disk-drive, respectively. There are three pins in J2 for this purpose. The "blue ring" LEDs are controlled by the S3C9454 mcu.

1x Samsung - S3C9454 = 8-bit single chip CMOS microcontroller

This MCU chip was found on a board with revision number P.1.3.5 Datasheet PDF here.

FIP commands to the main processor

The commands are two bytes binary, with the second byte being the ones-compliment of the first byte. Here are the command codes, as defined in the firmware:

// FIP keys

#define FIP_KEY_ENTER       0xEA15  

#define FIP_KEY_LEFT        0xEB14  

#define FIP_KEY_UP          0xED12  

#define FIP_KEY_DOWN        0xEC13  

#define FIP_KEY_RIGHT       0xE916  

#define FIP_KEY_POWER       0xFF00  

#define FIP_KEY_PLAY        0xB649  

#define FIP_KEY_STOP        0xB748  

#define FIP_KEY_MENU        0xA758  

#define FIP_KEY_TITLE       0xE817  

#define FIP_KEY_SETUP       0xEE11  

#define FIP_KEY_ANGLE       0xA659  

#define FIP_KEY_REPEAT      0xA857  

#define FIP_KEY_AB          0xF40B  

#define FIP_KEY_SLOW        0xB24D  

#define FIP_KEY_FILE_INFO   0xF609  

#define FIP_KEY_TIME_SEARCH 0xA55A  

#define FIP_KEY_BR_CONT     0xF30C  

#define FIP_KEY_MEDIA_TYPE  0xA35C  

#define FIP_KEY_MAIN_PAGE   0xE41B  

#define FIP_KEY_REW         0xEF10  

#define FIP_KEY_FF          0xB14E  

#define FIP_KEY_PREV        0xE01F  

#define FIP_KEY_NEXT        0xBc43  

#define FIP_KEY_VIDEO       0xF906  

#define FIP_KEY_AUDIO       0xF807  

#define FIP_KEY_SUBTITLE    0xFD02  

#define FIP_KEY_SCRSIZE     0xFC03  

#define FIP_KEY_1           0xE31C  

#define FIP_KEY_2           0xE21D  

#define FIP_KEY_3           0xE11E  

#define FIP_KEY_4           0xBF40  

#define FIP_KEY_5           0xBE41  

#define FIP_KEY_6           0xBD42  

#define FIP_KEY_7           0xBB44  

#define FIP_KEY_8           0xBa45  

#define FIP_KEY_9           0xB946  

#define FIP_KEY_0           0xB847  

#define FIP_KEY_VOL_UP      0xB54A  

#define FIP_KEY_VOL_DOWN    0xF708  

#define FIP_KEY_MUTE        0xA956  

#define FIP_KEY_CANCEL      0xFA05

Serial header J9

There are TWO console interfaces on connector J9. We don't know yet if the second serial port is supported by the firmware, but there is no reason why it couldn't be.

We can connect a RS232 level converter to this header, to have console access to the bootloader. For this purpose, use serial port 0 (pins 1 and 5, and probably 3 and 4 for power). This is important to de-brick a dead device, but only if the flash bootloader is still intact.

This are the voltages on the header (pin 1 is the one with the silk screen arrow on the top, it's nearest the corner of the PCB, and it has a square pan on the bottom side. The other pins are then numbered alternatively, so pin 9 and 10 are the two on the far end of the connector.):

Note: different board revisions seem to have different layouts, search for a pin labeled J9 - it is the pin 1 of the header.

Since the serial interface on the MG35 uses 0/3.3V logic, you'll need a level converter. DON NOT CONNECT J9 SIGNALS DIRECTLY TO THE SERIAL INTERFACE OF YOUR PC!!! YOU'LL PROBABLY DESTROY THE MG35!

A good converter to use is the one found here. it costs from about $10.00 USD (bare board) to about $25.00 USD (assembled and tested). The one offered comes with a max232 chip that needs a 5V supply, and since the MB connector provides 3.3V, you will want to populate the board with a MAX3232E IC since it operates at both 5V and 3.3V.

The following picture is not the above mentioned connector, but a connector purchased from e-bay on a sale that has since expired. Note that pin 1 on the MG-35 header is an Output and the cable shows the blue wire as RxD (meaning the converter input).

It is also possible to use a serial data cable from a mobile phone as a level converter. You can use the nice list of cell phone cable pinouts or dig for more pinouts . There is even a small tutorial for using a Nokia data cable to connect to WRT54G router, which has a serial interface similar to MG35. Another good resource for level converters is the NSLU2 serial port page.

Chances are that if you're interested in your MG35's serial interface, you'll also want to read the debricking page :-).

JTAG

Thanks to  heiko.berner's work, we now know a little more about JTAG on MG35. EM8511's pinout is the following:

TCK

B8

JTAG port clock input

B13 (Buffered crystal oscillator output) via R82

TDI

B6

JTAG port serial data input

GND

TDO

B7

JTAG port serial data output

TMS

A5

JTAG port test mode select

GND

RST#

B5 

JTAG port test reset input

GND

The last column shows that, unfortunately, most of the JTAG inputs are grounded. The serial output pin goes somewhere, but gets routed via an inner layer so it's difficult to find its destination. So the JTAG and scan-port have been disabled. JTAG can only be enabled by putting a carrier-card between the EM8511 chip and the PCB.

For those interested, below is the picture of the MG35 board, with the processor removed.

Old information follows (kept just for reference):

It is not yet sure we can de-brick the device using the JTAG connector. We don't know much about JTAG on this unit yet.

A wiggle cable can be built using the instructions found here. You can also try to use this one found on eBay (the link will eventually expire).

The plan is to use a JTAG wiggler to wiggle potential TCK and TMS pins while hunting for TDO. Once we find this, TDI should be easy. If we get the lot, we should be able to use openOCD and/or JTAG tools to explore the flash and (hopefully) reflash the bootloader.

J7 header

J7 is the JTAG interface for the Altera EPM3032A programmable logic device. Both TDI and TDO pins of CPLD connect directly to J7, so the processor is not on this scan chain. It's probably of no use for us, and I can't see why we would want to change the PLD, even if we had the source code. Here are the pinouts and voltages: 

3.05

Pin 1 is the one with the silk screen arrow on the top, it's nearest the corner of the PCB, and it has a square pan on the bottom side. The other pins are then numbered alternatively, so pin 9 and 10 are the two on the far end of the connector.):

Test points

Many thanks to Mark Hotchkiss who compiled the complete list of testpoints.

Many functions, like the Audio-Input port, are available through the test points. The "groups" (D and E) are only for the sake of labeling the test points, and not related to the functions on the test points. I have also traced all of the GPIO signals.

The vacuum-fluorescent display interface is available to anyone that can tack four wires onto test-points. Then again, the second serial port may be simpler for adding a display.

USB interface

It seems that the USB interface has direct access to the HDD, without passing through the firmware. We suspect the Prolific USB->IDE chip is wired directly onto the IDE bus and acts as sole master when USB is connected. It probably holds the EM8511 in reset at this time.

A small (16 MB !) Compact Flash can be mounted and accessed in the console, so we suspect that the 6GB minimum HD limitation might be due to the Prolific chip.

External IR receiver

There is a IR Remote Control Extender available from www.divxtech.com that works perfectly with the MG-35...Comes with a sixteen foot cord and costs $15.00 with free shipping to the U.S. Also, Ewaggle (the retail arm of Anywhereus) are now selling the "official" IR receivers for the MG-35. This one is on eBay, but will probably expire sometime in the future. A bit expensive, at 29USD + shipping ...

But before you rush out and buy one, I have just made my own for about £1.80 (3.50 USD). You need an IR receiver photodiode (Sharp GP1UX511QS, Farnell order code 1243868) and a 3.5mm stereo jack and lead (I cannibalized a 5m 3.5mm to phono lead, Farnell order code AV02584).

The IR receiver is about 6mm square with 3 wires; orientate this with the bulge to the front and the wires pointing down. Left is “signal”, middle “ground” and right is “5v supply”. Solder the leads from the plug so that the front contact of the plug is wired to the signal, the middle contact to the 5v supply and the rear contact to the ground. Tape up any exposed contacts to avoid shorts and you are done. The manufacture’s technical notes suggest you need a capacitor placed across 5v supply and ground to stabilize the supply. As yet mine works without this.

Plugging-in the remote IR does not disable the onboard receiver, and they appear to work fine in tandem. The finished device lacks the IR housing of the commercial device but it is light and tiny so it can be taped anywhere convenient as long as you have line of sight to the remote. I think this will be risk free even if you get the wiring wrong, but no guarantees.

As for remote, AmazonUK are currently offering a OneForAll Kameleon 6 way universal remote for £28.99 including shipping. OneForAll technical support say there is a setup code for the “Freecom mediaplayer”. You can probably use other types of universal learning remotes.

IR codes

These are codes for the MG-35, KM format and work well with my URC-8910 remote.

http://www.hifi-remote.com/forums/dload.php?action=file&file_id=2684

To do: post here the remote control codes read using Girder

Power supply

Specs: 5V 1.5A /12V 1.5A

There are some power supplies which similar specs, but nobody tried them yet. They are here and here.

Somebody also reported that the car adapter for the Modix HD-3510 works well, but we are not sure if it works for MG35.

The power connector type is Kycon KPP-4P and its spec sheet is here.

As posted at the Altech Q and A forum by Simon_the St:

"After going through 3 power supplies (not bad for a problem that's supposed not to exist) and a dealer that no longer wants to discuss power supply problems with anybody I decided to track down a third party replacement. The Power supply to the Lacie D2 and D2 Bigdisk is an exact match for the MG-350HD/MG-35

The Australian Part number is 710448A and a google search on that part number will show you the stockists.

I paid $46 which included same day delivery. After getting it home and checking the configuration one last time I plugged her in and everything works perfectly. I've been running it for over three weeks

now without any problems.

For those outside Australia I believe the corresponding part number is 710199 and a google search using that part number brings up retailer botn in North America and Europe."

Also, Rolf found the UK source.

No-case mod

Mark Hotchkiss removed the case and placed the MG35 on the back of hid TV. Here are his notes:

"Currently I have the two bare MG35 boards velcro-ed to the back of a TV. The component connectors protrude the most. I use a home-made IR extender. I have found that the main MG35 board will power-up without the front panel board. However, the IR doesn't work without the front panel, as it is decoded by the front panel's microcontroller.

My goal is to have a diskless MG35 board that can be mounted behind or inside a flat panel tv and is controlled through the Ethernet. Then I won't need the front panel, and everything can be controller remotely."

This page has been viewed times.