This packet type *only* works through FBUS. MBUS never passes through the DSP, so it can do this sneaky interception thing.
It allows for MDI sniffing (which can be done a lot easier with the traditional firmware debug system) and some more interesting things like MDI injection, and even a way of taking over complete control of the DSP via the serial line.
The first six bytes are like a normal FBUS packet, and so are the last two (checksum). The difference lies in the fact that there is no sequence number, or source/destination subsystem. Just a 6 byte header.
The subtype is at offset 6 of the FBUS packet, just after the header.
| ID | Title | Description |
|---|---|---|
| 00 | Set DSP debug flags | 00000100 Disable MDI from MCU to DSP 00001000 Enable serial MDI sniff 00100000 Do not sniff MDI types 0x50, 0x9C 01000000 Do not sniff MDI types 0x05, 0x9A, 0x4D |
| 01 | Set ?? | 00/01/02 |
| 03 | Sent on boot | Receive only, sending this has no effect. |
| 04 | MDI sniff | Receive only, sending this has no effect. Offset 7 is direction; 0=MDISND(to DSP), 1=MDIRCV(from DSP) Offset 8 is MDI size (command word high) Offset 9 is MDI type (command word low) Offset 10... is packet in case of long MDI, and (one byte) parameter in case of short MDI |
| 05 | MDI send | Offset 7 is MDI type Offset 8... is packet in case of long MDI, and (one byte) parameter in case of short MDI |
Last updated: 2005-02-21 14:19
This site is the result of a great deal of assembly code reading, research, countless (mostly futile) searches for data sheets, cross-referencing and analysing. If you use this information in any way please mention wumpus <blacksphere@goliath.darktech.org> (and others in the credits section) in the credits of your program/document. And tell me :) If you have more information please contribute. If you just copy this, stick your name on it and call it yours I hope you get your genitals bitten off by a three headed monkey. Have a nice day.
No mobile phones were harmed in the production of this site.