* Originally written at SmartQ MID Unofficial Wiki *
I’m currently reverse engineering the FWDN tool from Telechips to create a Linux version of it. I have no computer running Windows XP at home, so it’s hard to use FWDN when needed (yeah, your lifesaver :-)).
Got some stuff documented already. Will keep this entry updated, and after getting a final version, will post the binaries and source and finish this.
This is W.I.P.!
UPDATE: Silly me: the FWDN protocol is documented inside Linux BSP package from TCC. OTL
Sketchboard
These are just temporary annotations and may contain wrong information! Still working on it!
Data is little-endian.
<td>
<div class="c codecolorer">
<span class="co2">#define TCC8900_VENDOR_ID 0x140e</span><br /> <span class="co2">#define TCC8900_PRODUCT_ID 0xb071</span><br /> <span class="co2">#define TCC8900_OUT_EP 0x01</span><br /> <span class="co2">#define TCC8900_IN_EP 0x82</span>
</div>
</td>
</tr>
Example FWDN <-> SmartQ V7 comm.:
Not sure if it is the correct headers meaning, but it works
Packet format
<td>
<div class="c codecolorer">
<span class="kw4">struct</span> packet_c <span class="br0">{</span><br /> <span class="kw4">char</span> magic<span class="br0">[</span><span class="nu0">4</span><span class="br0">]</span><span class="sy0">;</span> <span class="co1">// "FWDC"</span><br /> u_int16_t cmd<span class="sy0">;</span><br /> u_int16_t extra_cmd_size<span class="sy0">;</span><br /> u_int32_t data_size<span class="sy0">;</span><br /> u_int32_t param0<span class="sy0">;</span><br /> u_int32_t param1<span class="sy0">;</span><br /> u_int32_t param2<span class="sy0">;</span><br /> <span class="br0">}</span><span class="sy0">;</span> <span class="co1">// sizeof() = 24 bytes</span><br /> <br /> <span class="kw4">struct</span> packet_r <span class="br0">{</span><br /> <span class="kw4">char</span> magic<span class="br0">[</span><span class="nu0">4</span><span class="br0">]</span><span class="sy0">;</span> <span class="co1">// "FWDR"</span><br /> u_int16_t cmd<span class="sy0">;</span><br /> u_int8_t ack<span class="sy0">;</span><br /> u_int8_t extra_rsp_size<span class="sy0">;</span><br /> u_int32_t data_size<span class="sy0">;</span><br /> u_int32_t param0<span class="sy0">;</span><br /> u_int32_t param1<span class="sy0">;</span><br /> u_int32_t param2<span class="sy0">;</span><br /> <span class="br0">}</span><span class="sy0">;</span> <span class="co1">// sizeof() = 24 bytes</span>
</div>
</td>
</tr>
- The cmd field in the response packet refers to which command from the host this response is for.
FWDR ACK values
FWDC Command set
<td>
<div class="c codecolorer">
FWDC_INIT <span class="nu12">0x0100</span> <span class="co1">// first packet of transaction.</span><br /> FWDC_GET_TARGET_SERIAL <span class="nu12">0x0103</span><br /> FWDC_SET_<span class="sy0">?</span> <span class="nu12">0x0104</span> <span class="co1">// sends some sort of serial to device, not ours though.</span><br /> FWDC_SEND_BOOTLOADER <span class="nu12">0x0105</span><br /> FWDC_<span class="sy0">?</span> <span class="nu12">0x0200</span><br /> FWDC_<span class="sy0">?</span> <span class="nu12">0x0201</span><br /> FWDC_<span class="sy0">?</span> <span class="nu12">0x0210</span><br /> FWDC_SEND_KERNEL <span class="nu12">0x0212</span><br /> FWDC_<span class="sy0">?</span> <span class="nu12">0x0240</span> <span class="co1">// close? return 0xa0 next packet, but never received by host.</span>
</div>
</td>
</tr>