Sysclk LWLA1016/Protocol
The basic structure of the SysClk LWLA1016 protocol is similar to the Sysclk LWLA1034/Protocol. As one would expect, it looks very much like an earlier iteration of the LWLA1034 protocol. It appears to lack the specialized commands the LWLA1034 has for reading memory and capture setup/status. Most of the functionality seems to be implemented on top of basic register reads and writes, using the same commands as the LWLA1034 for those.
FPGA Configuration
As with the LWLA1034, the FPGA bitstream is loaded via bulk transfer to USB end point 4. The format seems to be exactly the same, too.
Application Behavior
The vendor software transfers a new bitstream to the FPGA
- on application start,
- ... (TODO).
Selecting specific device configurations may require downloading other bitstream variants to the device. TODO: Make sure all modes are covered.
Firmware Extraction
At least one firmware blob belonging to the LWLA1016 can be found even in the LWLA1034 installer executable. There is also a second bitstream near to it which probably belongs to the LWLA1016 as well. However, the firmware extraction tool should work with whatever installer is actually shipped with the LWLA1016, which is unlikely to be the LWLA1034 one.
Control Commands
As with the LWLA1034, control commands are sent via bulk transfer to USB end point 2, with the response (if any) coming in from end point 6.
For the most part, the LWLA1016 protocol seems to consist of basic register read and write commands. Unlike with the LWLA1034, it looks like capture setup, capture status polling and reading from memory are implemented on top of simple register reads and writes.
Command 0001: Read Register
Apparently identical to command 1 in the LWLA1034 protocol.
Registers
Some of the register addresses appearing in the protocol also occur in the LWLA1034 protocol, although it seems that their purpose may not be the same. Other registers appear to be specific to the LWLA1016.
| Address | Value |
|---|---|
| 1010 | ??? |
| 1070 | ??? |
| 107C | ??? |
| 10B0 | ??? |
| 10B8 | ??? |
| 10BC | ??? |
Command 0002: Write Register
Apparently identical to command 2 in the LWLA1034 protocol.
Registers
Some of the register addresses appearing in the protocol also occur in the LWLA1034 protocol, although it seems that their purpose may not be the same. Other registers appear to be specific to the LWLA1016.
| Address | Value |
|---|---|
| 1000 | ??? |
| 1010 | ??? |
| 107C | ??? |
| 10B0 | ??? |
| 10B4 | ??? |
| 10B8 | ??? |
| 10BC | ??? |
Command 0003: Read ???
This command reads something from the device. It does not occur in the LWLA1034 protocol.
Command
Fixed (?) length of 4 words (8 bytes).
Response
The response to the command as sent by the vendor software consists of 8 words (16 bytes).