TCC8900 FWDN for Linux

Oct 12, 2010   #firmware  #fwdn  #smartq  #v7 

* Originally written at SmartQ MID Unofficial Wiki *

I’m currently reverse engineering the FWDN tool from Telechips to create a Linux version of it. I have no computer running Windows XP at home, so it’s hard to use FWDN when needed (yeah, your lifesaver :-)).

Got some stuff documented already. Will keep this entry updated, and after getting a final version, will post the binaries and source and finish this.

This is W.I.P.!

UPDATE: Silly me: the FWDN protocol is documented inside Linux BSP package from TCC. OTL

Sketchboard

These are just temporary annotations and may contain wrong information! Still working on it!

Data is little-endian.

1
2
3
4
#define TCC8900_VENDOR_ID   0x140e
#define TCC8900_PRODUCT_ID  0xb071
#define TCC8900_OUT_EP      0x01
#define TCC8900_IN_EP       0x82

Example FWDN <-> SmartQ V7 comm.:

FWDC -> Firmware Downloader Command (from host to device)
0000: 46 57 44 43 04 01 20 00 00 00 00 00 00 00 00 00  FWDC.. .........
0010: 00 00 00 00 00 00 00 00
FWDR -> Firmware Downloader Response (from device to host)
0000: 46 57 44 52 04 01 01 00 00 00 00 00 00 00 00 00  FWDR............
0010: 00 00 00 00 00 00 00 00

Not sure if it is the correct headers meaning, but it works :-)

Packet format

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
struct packet_c {
    char magic[4]; // "FWDC"
    u_int16_t cmd;
    u_int16_t extra_cmd_size;
    u_int32_t data_size;
    u_int32_t param0;
    u_int32_t param1;
    u_int32_t param2;
}; // sizeof() = 24 bytes

struct packet_r {
    char magic[4]; // "FWDR"
    u_int16_t cmd;
    u_int8_t ack;
    u_int8_t extra_rsp_size;
    u_int32_t data_size;
    u_int32_t param0;
    u_int32_t param1;
    u_int32_t param2;
}; // sizeof() = 24 bytes
  • The cmd field in the response packet refers to which command from the host this response is for.

FWDR ACK values

00 - NACK
01 - ACK
02 - PARTIAL ACK/WAITING DATA

FWDC Command set

1
2
3
4
5
6
7
8
9
FWDC_INIT               0x0100 // first packet of transaction.
FWDC_GET_TARGET_SERIAL  0x0103
FWDC_SET_?              0x0104 // sends some sort of serial to device, not ours though.
FWDC_SEND_BOOTLOADER    0x0105
FWDC_?                  0x0200
FWDC_?                  0x0201
FWDC_?                  0x0210
FWDC_SEND_KERNEL        0x0212
FWDC_?                  0x0240 // close? return 0xa0 next packet, but never received by host.