warehack.ing/skywalker-1
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Starlight documentation site (32 pages, 9 sidebar groups)

Browse Source 
Astro 5 + Starlight 0.37 site at site/ with teal/steel theme.
Content sourced from 14 reverse engineering docs, master reference,
and custom firmware source. Includes Tabs, Badge, Steps, Aside,
FileTree, and CardGrid components throughout. DiSEqC SVGs with
click-to-zoom via starlight-image-zoom. All internal links validated.
Pagefind search indexes all 32 pages.
This commit is contained in:
Ryan Malloy 2026-02-12 16:32:12 -07:00
parent f1d4f4f010
commit b21f4957f6
42 changed files with 15635 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@ -7,3 +7,8 @@ firmware/fx2lib/
# Build artifacts
firmware/build/
tools/__pycache__/
# Documentation site
site/node_modules/
site/dist/
site/.astro/

110
site/astro.config.mjs Normal file
View File

@ -0,0 +1,110 @@
import { defineConfig } from 'astro/config';
import starlight from '@astrojs/starlight';
import starlightImageZoom from 'starlight-image-zoom';
import starlightLinksValidator from 'starlight-links-validator';
export default defineConfig({
telemetry: false,
devToolbar: {
enabled: false,
},
integrations: [
starlight({
title: 'SkyWalker-1 Docs',
description:
'Reverse-engineered documentation for the Genpix SkyWalker-1 DVB-S USB 2.0 satellite receiver',
plugins: [starlightImageZoom(), starlightLinksValidator()],
social: [
{
icon: 'github',
label: 'GitHub',
href: 'https://github.com/placeholder/skywalker-1',
},
],
customCss: ['./src/styles/custom.css'],
sidebar: [
{
label: 'Hardware',
items: [
{ label: 'Overview', slug: 'hardware/overview' },
{ label: 'GPIO Pin Map', slug: 'hardware/gpio-pinmap' },
{ label: 'RF Specifications', slug: 'hardware/rf-specifications' },
],
},
{
label: 'USB Interface',
items: [
{ label: 'Interface', slug: 'usb/interface' },
{ label: 'Vendor Commands', slug: 'usb/vendor-commands' },
{ label: 'Boot Sequence', slug: 'usb/boot-sequence' },
{ label: 'Config Status', slug: 'usb/config-status' },
],
},
{
label: 'BCM4500',
items: [
{ label: 'Demodulator', slug: 'bcm4500/demodulator' },
{ label: 'Tuning Protocol', slug: 'bcm4500/tuning-protocol' },
{ label: 'GPIF Streaming', slug: 'bcm4500/gpif-streaming' },
{ label: 'Signal Monitoring', slug: 'bcm4500/signal-monitoring' },
],
},
{
label: 'LNB & DiSEqC',
items: [
{ label: 'LNB Control', slug: 'lnb-diseqc/lnb-control' },
{ label: 'DiSEqC Protocol', slug: 'lnb-diseqc/diseqc-protocol' },
{ label: 'Legacy Switch', slug: 'lnb-diseqc/legacy-switch' },
],
},
{
label: 'I\u00B2C Bus',
items: [
{ label: 'Bus Architecture', slug: 'i2c/bus-architecture' },
{
label: 'STOP Corruption Bug',
slug: 'i2c/stop-corruption-bug',
},
],
},
{
label: 'Firmware',
items: [
{
label: 'Version Comparison',
slug: 'firmware/version-comparison',
},
{ label: 'Rev.2 Analysis', slug: 'firmware/rev2-analysis' },
{ label: 'Kernel FW01', slug: 'firmware/kernel-fw01' },
{ label: 'FW2.13 Variants', slug: 'firmware/fw213-variants' },
{ label: 'Custom v3.01', slug: 'firmware/custom-v301' },
{ label: 'Storage Formats', slug: 'firmware/storage-formats' },
],
},
{
label: 'Driver',
items: [
{ label: 'Linux Kernel', slug: 'driver/linux-kernel' },
{ label: 'DVB-S2', slug: 'driver/dvb-s2' },
],
},
{
label: 'Tools',
items: [
{ label: 'Firmware Loader', slug: 'tools/firmware-loader' },
{ label: 'Tuning', slug: 'tools/tuning' },
{ label: 'EEPROM Utilities', slug: 'tools/eeprom-utilities' },
{ label: 'Debugging', slug: 'tools/debugging' },
{ label: 'TS Analyzer', slug: 'tools/ts-analyzer' },
],
},
{
label: 'Reference',
items: [
{ label: 'Master Reference', slug: 'reference/master-reference' },
],
},
],
}),
],
});

7465
site/package-lock.json generated Normal file
View File

File diff suppressed because it is too large Load Diff

19
site/package.json Normal file
View File

@ -0,0 +1,19 @@
{
"name": "skywalker-1-docs",
"type": "module",
"version": "0.0.1",
"scripts": {
"dev": "astro dev",
"start": "astro dev",
"build": "astro build",
"preview": "astro preview",
"astro": "astro"
},
"dependencies": {
"astro": "^5.17.2",
"@astrojs/starlight": "^0.37.6",
"sharp": "^0.33.0",
"starlight-image-zoom": "^0.13.2",
"starlight-links-validator": "^0.19.2"
}
}

BIN
site/public/downloads/DiSEqC for the Skywalker-1.pdf Normal file
View File

Binary file not shown.

323
site/src/assets/diagrams/DiSEqC for the Skywalker-1_page_1.svg Normal file
View File

@ -0,0 +1,323 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" version="1.1" width="612" height="792" viewBox="0 0 612 792">
<defs>
<clipPath id="clip_1">
<path transform="matrix(1,0,0,-1,0,792)" d="M35.16 711.6H83.184V756.72H35.16Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_2">
<path transform="matrix(1,0,0,-1,0,792)" d="M35.16 711.6H83.184V756.72H35.16Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_3">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_4">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_5">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
</defs>
<g>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="447.79 452.7105 454.51148 458.22596 462.18165 466.40266 470.68797 472.505 474.90095 479.09785 481.85557 483.6726 487.36299 490.97294 494.57487 501.77067 505.62184 507.4067 511.00865 514.97238">DiSEqC for SkyWalker</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="517.78">-</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="520.3">1</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="524.38"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-735.96" x="72.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-39.024" x="72.024"> </tspan></text>
<path transform="matrix(1,0,0,-1,0,792)" stroke-width=".75" stroke-linecap="round" stroke-linejoin="round" fill="none" stroke="#a7bfde" d="M274.25 791.55 74.9 706.1"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M95.582 791.6H.14999L.16739 716.12C13.738 702.45 47.336 686.5 81.629 709.54 116.2 732.84 109.05 778.06 95.582 791.6Z" fill="#a7bfde" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M53.411 700.86C78.232 700.34 98.749 718.85 99.24 742.2 99.731 765.56 80.01 784.92 55.189 785.44 30.368 785.96 9.8512 767.45 9.3599 744.1 8.8687 720.74 28.59 701.38 53.411 700.86Z" fill="#d3dfee" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M58.478 702.21C77.252 701.81 92.771 715.8 93.142 733.46 93.514 751.12 78.597 765.75 59.822 766.14 41.048 766.54 25.529 752.55 25.158 734.89 24.786 717.23 39.703 702.6 58.478 702.21Z" fill="#7ba0cd" fill-rule="evenodd"/>
<g clip-path="url(#clip_1)">
<g clip-path="url(#clip_2)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9.96" font-family="Calibri,Bold" font-weight="bold"><tspan y="-730.92" x="59.16"> </tspan></text>
</g>
</g>
<path transform="matrix(1,0,0,-1,0,792)" stroke-width=".75" stroke-linecap="round" stroke-linejoin="round" fill="none" stroke="#a7bfde" d="M.4 81.15 508.95 28.3"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M507.9 78.95C493.87 78.95 482.5 67.579 482.5 53.55 482.5 39.521 493.87 28.15 507.9 28.15 521.93 28.15 533.3 39.521 533.3 53.55 533.3 67.579 521.93 78.95 507.9 78.95Z" fill="#a7bfde" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M509 73.5C496.46 73.5 486.3 63.382 486.3 50.9 486.3 38.418 496.46 28.3 509 28.3 521.54 28.3 531.7 38.418 531.7 50.9 531.7 63.382 521.54 73.5 509 73.5Z" fill="#d3dfee" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M509.32 67.5C498.51 67.5 489.75 58.725 489.75 47.9 489.75 37.075 498.51 28.3 509.32 28.3 520.14 28.3 528.9 37.075 528.9 47.9 528.9 58.725 520.14 67.5 509.32 67.5Z" fill="#7ba0cd" fill-rule="evenodd"/>
<g clip-path="url(#clip_3)">
<g clip-path="url(#clip_4)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-43.944" x="506.74">1</tspan></text>
</g>
<g clip-path="url(#clip_5)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-43.944" x="512.26"> </tspan></text>
</g>
</g>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-706.78" x="72.024"> </tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="72.024 81.86604 86.274608 93.47713 101.64841 109.946048 117.99097">DiSEqC </tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="121.1 125.53664 133.5675 140.03995 143.04451 148.16912 156.59311 164.04836 167.03888 176.15084 183.46569 191.8616 200.48217 204.93283 212.24767 215.33647 222.53899 230.85066 238.30591 249.45366 256.99314 261.31745 269.62913 276.91587">for the GenPix Skywalker</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="283.49">-</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="288.17 296.4817 299.5705 308.71055 318.5245 327.6786 330.7674 340.60945 347.08189 351.49046 358.94569 366.4009">1 BDA Driver</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="372.91"> </tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="376.03 381.6741 389.8173 397.13215 402.25675 409.6137 418.09388 426.4196 433.87483 442.25669">(Extended)</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="14.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-687.94" x="447.91"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-671.86" x="72.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="12.96" font-family="Cambria,Bold" font-weight="bold"><tspan y="-654.46" x="72.024 76.560009 88.094409 95.779689 99.84913 106.69201 118.31713 125.16001 133.06562 137.74419 144.67778 149.40818 153.56833 160.89073 168.71857 171.56977 180.07152 187.7568 191.94289 199.62818 206.57474 210.56642 214.63587 222.51554 229.35842">Implementation Guidelines</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="12.96" font-family="Cambria,Bold" font-weight="bold"><tspan y="-654.46" x="235.49"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="12.96" font-family="Cambria,Bold" font-weight="bold"><tspan y="-654.46" x="238.37 242.59496 249.89144 255.866 258.8727 267.27079 275.05976 282.74504 286.7367 290.80613 296.88438 303.97349 308.65205 312.8381 320.1605 327.98835">for Applications</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="12.96" font-family="Cambria,Bold" font-weight="bold"><tspan y="-654.46" x="334.15"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-638.98" x="108.02"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="92.664 96.504009">I.</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Arial,Bold" font-weight="bold"><tspan y="-623.38" x="99.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="108.02 115.09664 122.559688 126.379528 134.16272 136.59152 140.19057 146.41712 151.4624 153.8912 157.9208 164.51169 170.40706 172.83586 178.44417 184.92464 190.78688 201.39632 207.24752 210.60367 217.08414 222.94638 228.03583 234.48319">GUID for the SkyWalker1 </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="236.93 243.31111 249.05191 253.12567 258.9879 265.71128 272.19175 278.054">Extended</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="284.69"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="287.09 293.68089 298.72618 304.96379 311.55467 317.4169 322.50636 326.44764">property</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-623.38" x="332.23"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-612.1" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-603.1" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406 176.42406 181.22406 186.02407 190.82407 195.62407 200.42407 205.22408 210.02408 214.82408 219.62409 224.42409 229.22409 234.0241 238.8241 243.6241 248.4241 253.2241 258.0241 262.8241 267.62409 272.42408">//Used to extend the feature of the BDA</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-603.1" x="277.25"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404">//{0B5221EB</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="142.82">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="147.62 152.42 157.22 162.02">F4C4</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="166.82">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="171.62 176.42 181.22 186.02">4976</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="190.82">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="195.65 200.45 205.25 210.05">B959</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="214.85">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-593.98" x="219.65 224.45 229.25 234.05 238.85 243.65001 248.45001 253.25002 258.05003 262.85 267.65 272.44999 277.24998">EF74427464D9}</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9.96" font-family="Courier New"><tspan y="-593.98" x="282.05"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-584.98" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402">#define</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-584.98" x="123.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-584.98" x="128.42 133.22 138.02 142.82 147.62001 152.42002 157.22002 162.02002 166.82003 171.62003 176.42003 181.22003 186.02004 190.82004 195.62004 200.42005 205.22005 210.02005 214.82006 219.62006 224.42006 229.22006 234.02007 238.82007 243.62007 248.42008 253.22008 258.02009 262.82008 267.62007 272.42005 277.22004 282.02003 286.82 291.62 296.41999 301.21998 306.01997 310.81996">STATIC_KSPROPSETID_BdaExtendedProperty </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-584.98" x="315.65">\</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-584.98" x="320.45"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-575.86" x="90.024 94.824008 99.62401 104.42401"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-575.86" x="109.22 114.020008 118.82001 123.62001 128.42002 133.22002 138.02002 142.82003 147.62003 152.42003 157.22003 162.02004 166.82004 171.62004 176.42005 181.22005 186.02005 190.82006 195.62006 200.42006 205.22006 210.02007 214.82007 219.62007 224.42008 229.22008 234.02008 238.82009 243.62009 248.42009 253.2201 258.02009 262.82008 267.62007 272.42005 277.22004 282.02003 286.82 291.62 296.41999 301.21998 306.01997 310.81996 315.61994 320.41993 325.2199 330.0199 334.8199 339.61988 344.41987 349.21986 354.01985 358.81983 363.6198 368.4198 373.2198 378.01979 382.81977 387.61976 392.41975 397.21974 402.0197 406.8197 411.6197 416.41969 421.21968 426.01966 430.81965 435.61964 440.41963 445.2196 450.0196 454.81959 459.61958">0x0B5221EB, 0xF4C4, 0x4976, 0xB9, 0x59, 0xEF, 0x74, 0x42, 0x74, 0x64, 0xD9</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-575.86" x="464.5"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406">DEFINE_GUIDSTRUCT(</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="176.42 181.22 186.02 190.82 195.62001 200.42002 205.22002 210.02002 214.82003">"0B5221EB</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="219.65">-</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="224.45 229.25 234.05 238.85">F4C4</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="243.65">-</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="248.45 253.25 258.05 262.84999">4976</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="267.65">-</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="272.45 277.25 282.05 286.84999">B959</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="291.65">-</tspan></text>
<text fill="#a31515" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="296.45 301.25 306.05 310.84999 315.64997 320.44996 325.24995 330.04994 334.8499 339.6499 344.4499 349.24989 354.04988">EF74427464D9"</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="358.87 363.66999 368.46998 373.26997 378.06996 382.86994 387.66993 392.4699 397.2699 402.0699 406.86988 411.66987 416.46986 421.26985 426.06983 430.8698 435.6698 440.4698 445.26979 450.06977 454.86976 459.66975 464.46974 469.2697 474.0697 478.8697 483.66969 488.46968 493.26966 498.06965 502.86964 507.66963 512.4696 517.2696 522.0696">, KSPROPSETID_BdaExtendedProperty);</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-566.86" x="526.9"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-557.74" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402">#define</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-557.74" x="123.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-557.74" x="128.42 133.22 138.02 142.82 147.62001 152.42002 157.22002 162.02002 166.82003 171.62003 176.42003 181.22003 186.02004 190.82004 195.62004 200.42005 205.22005 210.02005 214.82006 219.62006 224.42006 229.22006 234.02007 238.82007 243.62007 248.42008 253.22008 258.02009 262.82008 267.62007 272.42005 277.22004 282.02003 286.82 291.62 296.41999 301.21998 306.01997 310.81996 315.61994 320.41993 325.2199 330.0199 334.8199 339.61988 344.41987 349.21986 354.01985 358.81983 363.6198 368.4198 373.2198 378.01979 382.81977 387.61976 392.41975 397.21974 402.0197 406.8197 411.6197 416.41969 421.21968 426.01966 430.81965 435.61964 440.41963 445.2196 450.0196 454.81959 459.61958 464.41957 469.21955 474.01954 478.81953 483.6195 488.4195 493.21949 498.01948 502.81947 507.61946 512.41946">KSPROPSETID_BdaExtendedProperty DEFINE_GUIDNAMED(KSPROPSETID_BdaExtendedProperty)</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-557.74" x="517.3"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-546.58" x="90.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="88.824 92.664 96.504009">II.</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Arial,Bold" font-weight="bold"><tspan y="-532.51" x="99.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="108.02 114.401119 120.141918 124.215679 130.07791 136.69087 143.28176 149.144 155.75696 158.18576 164.876 169.9213 176.15889 182.74977">Extended Prope</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="188.66 193.70529 197.77906 203.6413 205.93762 212.04274 215.5093 220.57666">rty List</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="224.69"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="226.97 231.51848 239.08089 245.79322 249.14937 255.01161 257.4404 265.2236 268.69017 274.35368 280.7348 287.19319 293.5412">(Only DiSEqC </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="295.97 301.03736 307.62825 314.08665 320.67753 326.9593 331.97148 336.04524 338.47404 341.94059 346.96379 349.39259 355.25483 361.00666 365.0804 370.8433 377.5556 384.14649 389.9204">support is extended</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="396.55">)</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-532.51" x="400.99"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-517.75" x="72.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-505.87" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406 176.42406 181.22406 186.02407 190.82407 195.62407 200.42407">//Extended Property List</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-505.87" x="205.25"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402">typedef</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="123.62"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="128.42 133.22 138.02 142.82">enum</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="147.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="152.42 157.22 162.02 166.82 171.62001 176.42002 181.22002 186.02002 190.82003 195.62003 200.42003 205.22003 210.02004 214.82004 219.62004 224.42005 229.22005 234.02005 238.82006 243.62006 248.42006">__KSPROPERTY_EXTENDED</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-496.75" x="253.25"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-487.75" x="90.024">{</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-487.75" x="94.824"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-478.63" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003">/* DiSEqC Co</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-478.63" x="165.62 170.42 175.22 180.02 184.82 189.62001 194.42002 199.22002">mmand */</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-478.63" x="204.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-469.51" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003 165.62003 170.42003 175.22003 180.02004 184.82004 189.62004 194.42005 199.22005 204.02005 208.82006 213.62006 218.42006 223.22006 228.02007 232.82007 237.62007 242.42008 247.22008 252.02008 256.82008 261.62007 266.42005 271.22004 276.02003 280.82 285.62 290.41999 295.21998 300.01997 304.81996 309.61994 314.41993 319.2199 324.0199 328.8199 333.61988 338.41987 343.21986 348.01985 352.81983 357.6198 362.4198 367.2198 372.01979 376.81977 381.61976 386.41975 391.21974 396.0197 400.8197 405.6197 410.41969">//Used to send the Digital Sattelite Equipment Control (DiSEqC) </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-469.51" x="415.27"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-460.51" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003 165.62003 170.42003 175.22003 180.02004 184.82004 189.62004 194.42005 199.22005 204.02005 208.82006 213.62006 218.42006 223.22006">//Commands by application</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-460.51" x="228.05"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-451.39" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003 165.62003 170.42003 175.22003 180.02004 184.82004 189.62004 194.42005 199.22005 204.02005 208.82006 213.62006 218.42006 223.22006 228.02007 232.82007">KSPROPERTY_BDA_DISEQC = 0, </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-451.39" x="237.65 242.45 247.25 252.05 256.85 261.65 266.44999 271.24998 276.04997 280.84996 285.64994 290.44993 295.2499 300.0499 304.84989 309.64988 314.44987 319.24986 324.04985 328.84983 333.6498 338.4498">//Extension Property 1</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-451.39" x="343.27"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-442.27" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406 176.42406 181.22406 186.02407">}KSPROPERTY_EXTENDED;</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-442.27" x="190.82"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-418.39" x="84.984 88.824008 92.66401 96.50401">III.</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Arial,Bold" font-weight="bold"><tspan y="-418.39" x="99.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-418.39" x="108.02 114.401119 121.069278 127.693279 137.40848 143.27072 148.36017 154.21137 158.28513 161.75168 167.88991 174.60224 177.03104 180.63008 186.8456 191.89089 194.31969 198.34929 204.94017 210.83554 213.26435 218.87265 222.2288 232.05442 238.6453 242.04561 247.90785 250.33666 257.3912 263.6288 270.2307 276.09297 278.52177 285.7088 292.29969 297.35603 302.42338">Enumeration for the Simple Tone Burst</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-418.39" x="306.41"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-403.63" x="72.024"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402">typedef</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="123.62"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="128.42 133.22 138.02 142.82">enum</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="147.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="152.42 157.22 162.02 166.82 171.62001 176.42002 181.22002 186.02002 190.82003 195.62003 200.42003 205.22003 210.02004 214.82004 219.62004 224.42005 229.22005 234.02005">enSimpleToneBurst </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-391.63" x="238.85"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-382.63" x="90.024">{</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-382.63" x="94.824"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-373.49" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002">SEC_MINI_A,</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-373.49" x="160.82"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-364.49" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002">SEC_MINI_B</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-364.49" x="156.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-355.25" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406 176.42406">}SIMPLE_TONE_BURST;</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-355.25" x="181.22"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-331.37" x="85.704 89.568 96.50112">IV.</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Arial,Bold" font-weight="bold"><tspan y="-331.37" x="99.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-331.37" x="108.02 115.8032 119.26976 124.93328 131.3144 137.78385 144.13185 146.56066 152.88657 159.1352 168.8504 178.67601 184.58242 191.1733 197.76418 200.19298 205.81233 209.8861 214.93138 221.52227 226.70003 230.65235 237.24323 242.28852 248.15076">DiSEqC Command Structure </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-331.37" x="250.61"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-316.73" x="72.024"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402">typedef</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="123.62"> </tspan></text>
<text fill="#0000ff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="128.42 133.22 138.02 142.82 147.62001 152.42002">struct</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="157.22"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="162.02 166.82 171.62001 176.42002 181.22002 186.02002 190.82003 195.62003 200.42003 205.22003 210.02004 214.82004 219.62004 224.42005 229.22005 234.02005">__DISEQC_COMMAND</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-304.73" x="238.85"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-295.61" x="90.024">{</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-295.61" x="94.824"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="90.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003 165.62003 170.42003 175.22003 180.02004 184.82004 189.62004 194.42005 199.22005 204.02005 208.82006 213.62006 218.42006 223.22006 228.02007 232.82007 237.62007 242.42008 247.22008 252.02008 256.82008 261.62007 266.42005 271.22004 276.02003 280.82 285.62 290.41999 295.21998 300.01997 304.81996 309.61994">UCHAR ucMessage[MAX_DISEQC_COMMAND_LENGTH];</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="314.45"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="324.07 328.87">/*</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="333.67 338.47 343.27 348.06999 352.86997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="357.67">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="362.47"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699 410.46989 415.26988 420.06986 424.86985">0 : Framing, </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-286.61" x="429.67"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="324.07 328.87 333.66999 338.46998 343.26997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="348.07">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="352.87"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="357.67 362.47 367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699 410.46989 415.26988">1 : Address, </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-277.49" x="420.07"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="324.07 328.87 333.66999 338.46998 343.26997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="348.07">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="352.87"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="357.67 362.47 367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699 410.46989 415.26988">2 : Command, </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-268.49" x="420.07"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="324.07 328.87 333.66999 338.46998 343.26997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="348.07">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="352.87"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="357.67 362.47 367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699 410.46989 415.26988">3 : Data[0], </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-259.37" x="420.07"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="324.07 328.87 333.66999 338.46998 343.26997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="348.07">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="352.87"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="357.67 362.47 367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699 410.46989 415.26988">4 : Data[1], </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-250.37" x="420.07"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="324.07 328.87 333.66999 338.46998 343.26997">Byte </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="348.07">-</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="352.87"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="357.67 362.47 367.27 372.06999 376.86997 381.66996 386.46995 391.26994 396.06993 400.8699 405.6699">5 : Data[2]</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-241.25" x="410.47"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="90.024"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="108.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="144.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="180.02"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="216.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="252.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="288.05"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="324.07 328.87">*/</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-232.25" x="333.67"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-223.13" x="90.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-223.13" x="108.02 112.82 117.62 122.420009 127.22001 132.02 136.82 141.62001 146.42002 151.22002 156.02002 160.82003 165.62003 170.42003 175.22003 180.02004 184.82004 189.62004 194.42005 199.22005 204.02005 208.82006">UCHAR ucMessageLength;</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-223.13" x="213.65 218.45 223.25 228.05 232.85 237.65001 242.45001 247.25002 252.05002 256.85 261.65 266.44999 271.24998 276.04997 280.84996 285.64994 290.44993 295.2499 300.0499 304.84989 309.64988 314.44987 319.24986 324.04985 328.84983 333.6498 338.4498 343.2498 348.04978 352.84977 357.64976 362.44975 367.24974 372.0497 376.8497 381.6497 386.44969 391.24967 396.04966 400.84965 405.64964 410.44963 415.2496 420.0496 424.84959 429.64958 434.44956 439.24955">/* The Valid values for DiSEqC Command are 3...6</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-223.13" x="444.07"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-214.13" x="216.05 220.85 225.65001 230.45001 235.25002 240.05002 244.85002 249.65003 254.45003 259.25004 264.05003 268.85 273.65 278.44999 283.24998 288.04997 292.84996 297.64994 302.44993 307.2499 312.0499 316.84989 321.64988 326.44987 331.24986 336.04985 340.84983 345.6498 350.4498 355.2498 360.04978 364.84977 369.64976 374.44975 379.24974 384.0497 388.8497 393.6497 398.44969 403.24967 408.04966 412.84965 417.64964 422.44963 427.2496 432.0496 436.84959 441.64958 446.44956 451.24955 456.04954 460.84953 465.6495 470.4495 475.24949 480.04948 484.84947 489.64945 494.44944 499.24943 504.0494 508.8494 513.6494 518.4494 523.2494 528.0494 532.84939">If this value is 1 then the Byte 0 is taken as Simple "Tone Burst" </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-204.98" x="216.05 220.85 225.65001 230.45001 235.25002 240.05002 244.85002">Control</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-204.98" x="249.65"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-204.98" x="254.45 259.25 264.05 268.84999 273.64997 278.44996 283.24995 288.04994 292.8499 297.6499">Command */</tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-204.98" x="302.45"> </tspan></text>
<text fill="#008000" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-195.98" x="90.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-186.74" x="90.024 94.824008 99.62401 104.42401 109.224018 114.02402 118.82402 123.62402 128.42403 133.22403 138.02404 142.82404 147.62404 152.42404 157.22405 162.02405 166.82405 171.62406 176.42406 181.22406 186.02407 190.82407 195.62407 200.42407 205.22408 210.02408 214.82408 219.62409 224.42409 229.22409 234.0241 238.8241 243.6241">}DISEQC_COMMAND,*PDISEQC_COMMAND;</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-186.74" x="248.45"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-162.86" x="72.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-162.86" x="216.05"> </tspan></text>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 762.96H24.72V768H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 767.28H29.04V768H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 762.96H25.439999V767.28H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 766.56H29.039999V767.27999H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 762.96H27.6V766.56H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 764.4H29.04V766.56H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 762.96H28.32V764.4H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 763.68H29.04V764.39999H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 762.96H29.039999V763.68H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 762.96H29.039999V763.68H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 767.28H583.06V768H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 766.56H583.06V767.27999H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 764.4H583.06V766.56H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 763.68H583.06V764.39999H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 762.96H583.06V763.68H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 762.96H588.12V768H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 767.28H588.124V768H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 762.96H587.4V767.28H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 766.56H587.404V767.27999H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 762.96H586.68V766.56H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 764.4H586.684V766.56H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 762.96H584.52V764.4H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 763.68H584.524V764.39999H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 762.96H583.80398V763.68H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 762.96H583.80398V763.68H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 28.92H24.72V762.95999H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 28.92H25.439999V762.95999H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 28.92H27.6V762.95999H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 28.92H28.32V762.95999H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.92H29.039999V762.95999H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 28.92H588.12V762.95999H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 28.92H587.4V762.95999H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 28.92H586.68V762.95999H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 28.92H584.52V762.95999H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.92H583.80398V762.95999H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 23.88H24.72V28.919999H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 23.88H29.04V24.59997H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 24.6H25.439999V28.92H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 24.6H29.039999V25.32003H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 25.32H27.6V28.92H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 25.32H29.04V27.48H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 27.48H28.32V28.92H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 27.48H29.04V28.20003H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.2H29.039999V28.919972H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.2H29.039999V28.919972H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 23.88H583.06V24.59997H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 24.6H583.06V25.32003H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 25.32H583.06V27.48H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 27.48H583.06V28.20003H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 28.2H583.06V28.919972H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 23.88H588.12V28.919999H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 23.88H588.124V24.59997H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 24.6H587.4V28.92H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 24.6H587.404V25.32003H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 25.32H586.68V28.92H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 25.32H586.684V27.48H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 27.48H584.52V28.92H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 27.48H584.524V28.20003H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.2H583.80398V28.919972H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.2H583.80398V28.919972H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 59 KiB

186
site/src/assets/diagrams/DiSEqC for the Skywalker-1_page_2.svg Normal file
View File

@ -0,0 +1,186 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" version="1.1" width="612" height="792" viewBox="0 0 612 792">
<defs>
<clipPath id="clip_1">
<path transform="matrix(1,0,0,-1,0,792)" d="M35.16 711.6H83.184V756.72H35.16Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_2">
<path transform="matrix(1,0,0,-1,0,792)" d="M35.16 711.6H83.184V756.72H35.16Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_3">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_4">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
<clipPath id="clip_5">
<path transform="matrix(1,0,0,-1,0,792)" d="M493.54 36.48H525.34V59.064H493.54Z" clip-rule="evenodd"/>
</clipPath>
</defs>
<g>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="447.79 452.7105 454.51148 458.22596 462.18165 466.40266 470.68797 472.505 474.90095 479.09785 481.85557 483.6726 487.36299 490.97294 494.57487 501.77067 505.62184 507.4067 511.00865 514.97238">DiSEqC for SkyWalker</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="517.78">-</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="520.3">1</tspan></text>
<text fill="#365f91" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-748.44" x="524.38"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-735.96" x="72.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-39.024" x="72.024"> </tspan></text>
<path transform="matrix(1,0,0,-1,0,792)" stroke-width=".75" stroke-linecap="round" stroke-linejoin="round" fill="none" stroke="#a7bfde" d="M274.25 791.55 74.9 706.1"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M95.582 791.6H.14999L.16739 716.12C13.738 702.45 47.336 686.5 81.629 709.54 116.2 732.84 109.05 778.06 95.582 791.6Z" fill="#a7bfde" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M53.411 700.86C78.232 700.34 98.749 718.85 99.24 742.2 99.731 765.56 80.01 784.92 55.189 785.44 30.368 785.96 9.8512 767.45 9.3599 744.1 8.8687 720.74 28.59 701.38 53.411 700.86Z" fill="#d3dfee" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M58.478 702.21C77.252 701.81 92.771 715.8 93.142 733.46 93.514 751.12 78.597 765.75 59.822 766.14 41.048 766.54 25.529 752.55 25.158 734.89 24.786 717.23 39.703 702.6 58.478 702.21Z" fill="#7ba0cd" fill-rule="evenodd"/>
<g clip-path="url(#clip_1)">
<g clip-path="url(#clip_2)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9.96" font-family="Calibri,Bold" font-weight="bold"><tspan y="-730.92" x="59.16"> </tspan></text>
</g>
</g>
<path transform="matrix(1,0,0,-1,0,792)" stroke-width=".75" stroke-linecap="round" stroke-linejoin="round" fill="none" stroke="#a7bfde" d="M.4 81.15 508.95 28.3"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M507.9 78.95C493.87 78.95 482.5 67.579 482.5 53.55 482.5 39.521 493.87 28.15 507.9 28.15 521.93 28.15 533.3 39.521 533.3 53.55 533.3 67.579 521.93 78.95 507.9 78.95Z" fill="#a7bfde" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M509 73.5C496.46 73.5 486.3 63.382 486.3 50.9 486.3 38.418 496.46 28.3 509 28.3 521.54 28.3 531.7 38.418 531.7 50.9 531.7 63.382 521.54 73.5 509 73.5Z" fill="#d3dfee" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M509.32 67.5C498.51 67.5 489.75 58.725 489.75 47.9 489.75 37.075 498.51 28.3 509.32 28.3 520.14 28.3 528.9 37.075 528.9 47.9 528.9 58.725 520.14 67.5 509.32 67.5Z" fill="#7ba0cd" fill-rule="evenodd"/>
<g clip-path="url(#clip_3)">
<g clip-path="url(#clip_4)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-43.944" x="506.74">2</tspan></text>
</g>
<g clip-path="url(#clip_5)">
<text fill="#ffffff" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-43.944" x="512.26"> </tspan></text>
</g>
</g>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-709.56" x="89.544 96.50396">V.</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Arial,Bold" font-weight="bold"><tspan y="-709.56" x="99.024"> </tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-709.56" x="108.02 115.692798 122.283679 128.168 133.21329 139.11969 143.14929 146.63793 152.75408 159.4664">Operation:</tspan></text>
<text fill="#4f81bd" xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Cambria,Bold" font-weight="bold"><tspan y="-709.56" x="162.5"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="11.04" font-family="Calibri"><tspan y="-694.78" x="72.024"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="112.46 114.74">I.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-681.22" x="117.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="126.02 130.448 135.236 137.26999 140.75299 145.18999 149.87 154.55">To send </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="156.62 159.635 164.297 168.734">the </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="170.9 174.97699 177.02 184.211 189.00801 191.05103 195.48802 197.52202 202.31903 206.99904 210.14005 213.59604 216.61104 218.64504 222.45204 227.26705 234.45804 241.64904 245.96004">Simple burst comman</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="250.73">d</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-681.22" x="255.53"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-668.5" x="144.02 148.34001">a.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-668.5" x="150.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-668.5" x="162.02 166.817 169.95801 174.377 178.688 181.703 186.14 188.174 191.189 195.968 200.405 202.439 207.974 210.242 214.328 218.756 224.759 229.673 234.11 238.907 244.901 252.59601 260.264 265.42103 271.18104 276.71604 278.84904 283.04304 286.05805 289.16304 293.84303 297.67704 300.69206 305.35408 308.49507">Create the DISEQC_COMMAND Structure</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-668.5" x="313.13"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-655.9" x="144.02 148.70001">b.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-655.9" x="150.98"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-655.9" x="162.02 166.097 170.534 173.549 175.583 178.59799 183.368 187.805 189.83899 194.528 198.362 206.057 210.593 214.076 217.559 221.87001 226.08202 230.51902 233.28202 237.84502 240.60802 242.75002 245.76502 250.544 252.578 257.024 259.067 262.082 266.74403 271.298 274.439 276.473 280.64903 285.07704 289.87403 294.32 302.015 304.28303 310.04304 312.31105 316.76603 321.92304 323.95704 328.75404 331.89503 333.92903 337.99705 342.42506 347.22206 351.66804 359.36305 361.73905 367.49906 369.76707 374.22206">Set the ucMessage[0] to either SEC_MINI_A or SEC_MINI_B</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-655.9" x="379.39"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-643.3" x="144.02 147.86">c.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-643.3" x="150.14"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-643.3" x="162.02 166.097 170.534 173.549 175.583 178.59799 183.368 187.805 189.83899 194.528 198.362 206.057 210.593 214.076 217.559 221.87001 226.08202 230.51902 234.35301 238.90702 243.58702 247.79003 250.90402 255.58403 257.61805 261.92906 265.44807 267.48207">Set the ucMessageLength as 1</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-643.3" x="272.21"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-631.66" x="162.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="110.18 112.46 114.74">II.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-619.42" x="117.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="126.02 130.448 135.236 137.26999 140.75299 145.18999 149.87 154.55">To send </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="156.62 159.635 164.297 168.734 170.76799 176.402 178.445 182.522 186.95 191.63 196.427">the DiSEqC </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="198.53 202.364 207.152 214.34299 221.53398 225.84499">comman</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="230.57">d</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="235.25">s</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-619.42" x="238.85"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-606.82" x="144.02 148.34001">a.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-606.82" x="150.62"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-606.82" x="162.02 166.817 169.95801 174.377 178.688 181.703 186.14 188.174 191.189 195.968 200.405 202.439 207.974 210.242 214.328 218.756 224.759 229.673 234.11 238.907 244.901 252.59601 260.264 265.42103 271.18104 276.71604 278.84904 283.04304 286.05805 289.16304 293.84303 297.67704 300.69206 305.35408 308.49507">Create the DISEQC_COMMAND Structure</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-606.82" x="313.13"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="144.02 148.70001">b.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-594.1" x="150.98"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="162.02 166.097 170.534 173.549 175.583 178.59799 183.368 187.805">Set the </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="189.86 193.937 197.078 201.389 208.58 210.731 215.41101 219.61402 221.64801 225.716 230.04502 232.08803 236.87604 241.31304 243.34703 246.36203 251.14102">Framing value to </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="253.25 257.93 261.764 269.459 273.88703 277.47804 281.06904 285.38005 289.59205 294.02903 296.79203 301.355 304.118">ucMessage[0] </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="306.17 310.607 312.875 317.087 319.355 321.389 325.835">e.g. E0</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-594.1" x="330.55"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="144.02 147.86">c.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-581.5" x="150.14"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="162.02 166.097 170.534 173.549 175.583 178.59799 183.368 187.805">Set the </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="189.86 195.395 199.823 203.89099 205.961 209.768 214.223">Device </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="216.41 221.567 226.24701 231.03502 234.17603 238.59502 242.18602 245.66902">Address </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="247.73 250.745 255.52399 257.55799 262.24699 266.081 273.776 278.204 281.795 285.278 289.58903 293.80104 298.238 301.001 305.564 308.327 310.361 314.79798 317.06599 321.27799 323.546 325.58 330.14299">to ucMessage[1] e.g. 01</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-581.5" x="334.87"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-568.9" x="144.02 148.70001">d.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-568.9" x="150.98"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-568.9" x="162.02 166.097 170.534 175.322 180.00202 182.03601 185.05101 189.72202 194.15901 196.19301 200.99 205.787 212.978 220.16899 224.48 229.205 233.867 235.901 238.646 243.461 246.602 248.636 251.732 256.412 260.84898 262.88298 268.41798 272.84599 276.91398 278.98399 282.917 287.35398">Send the Command for the Device </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-568.9" x="289.49 292.505 297.28404 299.31803 304.00703 307.84104 315.53605 319.96406 323.44706 326.93006 331.24107 335.56108 339.99806 342.76106 347.32405">to ucMessage[2]</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-568.9" x="350.23"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="144.02 148.46">e.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-556.3" x="150.74"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="162.02">I</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="164.3 167.06">f </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="169.1 172.24102 176.66 181.34001 186.02002 188.06304 191.29404 195.73104 197.76503 201.24803 205.68503 208.70003 210.83303 213.84803 218.51003 222.94702 224.98102 230.51602 234.82703 237.84203 242.15303 244.29503 248.97504 253.05204 256.06706 260.49507 263.97807 266.12907 270.80906 274.64308 282.43708 286.87406 290.35707 293.84007 298.15107 302.47108 306.90806 309.67106 314.23405 316.99705">require set the Data bytes ucMessage[3],</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="319.37"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="321.41 326.09 329.924 337.61903 342.04704 345.53004 349.01304 353.44105 357.64405 362.08103">ucMessage[</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="364.87">4</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="369.43">]</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="372.19">,</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="374.47"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="376.51 381.19 385.02403 392.71903 397.255 400.738 404.329 408.64 412.85203 417.289">ucMessage[</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="420.07">5</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="424.63">]</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-556.3" x="427.51"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-543.58" x="144.02 146.78">f.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Arial"><tspan y="-543.58" x="149.06"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-543.58" x="162.02 166.097 170.534 173.549 175.583 178.59799 183.368 187.805 189.83899 194.528 198.362 206.057 210.593 214.076 217.559 221.87001 226.08202 230.51902 234.35301 238.90702 243.58702 247.79003 250.90402 255.58403 257.61805 261.92906 265.77207 269.60609 274.3941 277.5351 282.1971 284.2401 288.9201 293.1231 295.1661 299.2431 301.5111 306.6771 310.9881 313.0581 315.07414 319.75413 321.78813 326.4771 330.31114 338.10514 342.5421 346.02513 349.50813 353.93614 358.13914 362.5761 366.4101 370.84709 375.52708 379.83808 382.8531 387.5151 389.5491 393.6171 397.9461 399.9891 404.7771 409.21409 412.69709 414.73109 419.04209 422.18309 426.62007 428.65406 433.21705 435.25105 438.26606 443.05409 445.08808 449.65107">Set the ucMessageLength accordingly.Valid ucMessageLength values are 3 to 6.</tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="9" font-family="Calibri"><tspan y="-543.58" x="452.23"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-532.63" x="108.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Courier New"><tspan y="-532.63" x="144.02"> </tspan></text>
<text xml:space="preserve" transform="matrix(1 0 -0 1 0 792)" font-size="8.04" font-family="Calibri"><tspan y="-521.47" x="90.024"> </tspan></text>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 762.96H24.72V768H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 767.28H29.04V768H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 762.96H25.439999V767.28H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 766.56H29.039999V767.27999H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 762.96H27.6V766.56H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 764.4H29.04V766.56H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 762.96H28.32V764.4H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 763.68H29.04V764.39999H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 762.96H29.039999V763.68H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 762.96H29.039999V763.68H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 767.28H583.06V768H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 766.56H583.06V767.27999H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 764.4H583.06V766.56H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 763.68H583.06V764.39999H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 762.96H583.06V763.68H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 762.96H588.12V768H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 767.28H588.124V768H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 762.96H587.4V767.28H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 766.56H587.404V767.27999H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 762.96H586.68V766.56H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 764.4H586.684V766.56H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 762.96H584.52V764.4H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 763.68H584.524V764.39999H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 762.96H583.80398V763.68H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 762.96H583.80398V763.68H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 28.92H24.72V762.95999H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 28.92H25.439999V762.95999H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 28.92H27.6V762.95999H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 28.92H28.32V762.95999H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.92H29.039999V762.95999H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 28.92H588.12V762.95999H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 28.92H587.4V762.95999H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 28.92H586.68V762.95999H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 28.92H584.52V762.95999H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.92H583.80398V762.95999H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 23.88H24.72V28.919999H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24 23.88H29.04V24.59997H24Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 24.6H25.439999V28.92H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M24.72 24.6H29.039999V25.32003H24.72Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 25.32H27.6V28.92H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M25.44 25.32H29.04V27.48H25.44Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 27.48H28.32V28.92H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M27.6 27.48H29.04V28.20003H27.6Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.2H29.039999V28.919972H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M28.32 28.2H29.039999V28.919972H28.32Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 23.88H583.06V24.59997H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 24.6H583.06V25.32003H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 25.32H583.06V27.48H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 27.48H583.06V28.20003H29.04Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M29.04 28.2H583.06V28.919972H29.04Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M587.4 23.88H588.12V28.919999H587.4Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 23.88H588.124V24.59997H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M586.68 24.6H587.4V28.92H586.68Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 24.6H587.404V25.32003H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M584.52 25.32H586.68V28.92H584.52Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 25.32H586.684V27.48H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.8 27.48H584.52V28.92H583.8Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 27.48H584.524V28.20003H583.06Z" fill="#ffffff" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.2H583.80398V28.919972H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
<path transform="matrix(1,0,0,-1,0,792)" d="M583.06 28.2H583.80398V28.919972H583.06Z" fill="#eaf1dd" fill-rule="evenodd"/>
</g>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 27 KiB

BIN
site/src/assets/skywalker-1-hero.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 43 KiB

6
site/src/content.config.ts Normal file
View File

@ -0,0 +1,6 @@
import { defineCollection } from 'astro:content';
import { docsSchema } from '@astrojs/starlight/schema';
export const collections = {
docs: defineCollection({ schema: docsSchema() }),
};

188
site/src/content/docs/bcm4500/demodulator.mdx Normal file
View File

@ -0,0 +1,188 @@
---
title: BCM4500 Demodulator Interface
description: Broadcom BCM4500 I2C addressing, register access protocol, and indirect register programming.
---
import { Tabs, TabItem, Badge, Aside, Steps } from '@astrojs/starlight/components';
The Broadcom BCM4500 is a 128-pin MQFP satellite demodulator that handles RF demodulation, forward error correction, and MPEG-2 transport stream output. The FX2 communicates with it exclusively over the shared I2C bus using an indirect register protocol.
## I2C Addressing
| Parameter | Value |
|-----------|-------|
| 7-bit I2C address | 0x08 |
| 8-bit write address | 0x10 |
| 8-bit read address | 0x11 |
| Bus speed | 400 kHz |
| FX2 I2C controller registers | I2CS (0xE678), I2DAT (0xE679), I2CTL (0xE67A) |
| Alternate probe addresses (v2.13) | 0x3F, 0x7F |
The custom firmware and kernel driver use the 7-bit address 0x08. The stock firmware writes `addr << 1` = 0x10 for write and `(addr << 1) | 1` = 0x11 for read, following standard I2C convention.
<Aside type="note" title="Alternate Addresses">
The v2.13 firmware probes I2C addresses 0x7F and 0x3F at startup (INT0 handler) to detect which demodulator variant is present. These may be alternative I2C address configurations or addresses for different demodulator sub-systems on hardware variants.
</Aside>
## Direct Registers
These registers are accessed via standard I2C write/read to the BCM4500's device address:
| Register | Function | Used By |
|----------|----------|---------|
| 0xA2 | Status register (polled for readiness during boot) | Boot probe, signal strength |
| 0xA4 | Lock/ready register; bit 5 (0x20) = signal locked | Signal lock check |
| 0xA6 | Indirect page/address select | Indirect register protocol |
| 0xA7 | Indirect data register (read/write) | Indirect register protocol |
| 0xA8 | Indirect command register | Indirect register protocol |
| 0xF9 | Demod status (v2.13 only) | GET_DEMOD_STATUS (0x99) / INT0 polling |
## Indirect Register Protocol
The BCM4500 uses an indirect register access scheme through three directly-addressable registers (0xA6, 0xA7, 0xA8). All tuning configuration, initialization data, and signal monitoring are performed through this protocol.
### Indirect Write Sequence
<Steps>
1. **Page select** -- I2C WRITE to 0x08, register 0xA6 with the page number (typically 0x00).
2. **Data write** -- I2C WRITE to 0x08, register 0xA7 with N data bytes. The auto-increment feature allows writing multiple bytes in a single I2C transaction.
3. **Execute** -- I2C WRITE to 0x08, register 0xA8 with value 0x03 (indirect write command).
4. **Poll completion** -- I2C READ register 0xA8 until bit 0 clears (command complete).
5. **Verify** -- Optionally I2C READ register 0xA7 to read back and compare.
</Steps>
```c title="Indirect Write Protocol"
// Step 1: Page select
I2C WRITE: [START] [0x10] [0xA6] [0x00] [STOP]
// Step 2: Data write (multi-byte, auto-increment)
I2C WRITE: [START] [0x10] [0xA7] [data0] [data1] ... [dataN] [STOP]
// Step 3: Execute indirect write
I2C WRITE: [START] [0x10] [0xA8] [0x03] [STOP]
// Step 4: Poll until complete
I2C READ: [START] [0x10] [0xA8] [Sr] [0x11] [result] [STOP]
// Repeat until (result & 0x01) == 0
```
### Indirect Read Sequence
<Steps>
1. **Address select** -- I2C WRITE to 0x08, register 0xA6 with the target register address.
2. **Placeholder write** -- I2C WRITE to 0x08, register 0xA7 with value 0x00.
3. **Execute** -- I2C WRITE to 0x08, register 0xA8 with value 0x01 (indirect read command).
4. **Wait** -- Short delay (~1 ms) for the BCM4500 to fetch the data.
5. **Read result** -- I2C READ from 0x08, register 0xA7 to get the result byte.
</Steps>
### Auto-Increment Behavior
The BCM4500's data register (0xA7) supports auto-increment for multi-byte writes within a single I2C transaction. When writing N data bytes to 0xA7 without issuing STOP between bytes, the BCM4500 internally advances its data buffer pointer:
```
I2C transaction (single write, multiple data bytes):
START -> 0x10 (write) -> 0xA7 (reg) -> data[0] -> data[1] -> ... -> data[N-1] -> STOP
```
The firmware uses this for initialization blocks and tuning data, reducing I2C bus overhead compared to byte-by-byte writes.
### Stock Firmware Init Block Write Pattern
The stock firmware uses a specific pattern for writing initialization blocks, extracted from `FUN_CODE_0ddd`:
```c title="Init Block Write Sequence"
// 1. Page select = 0
I2C WRITE: [0x10] [0xA6] [0x00]
// 2. Multi-byte data (auto-increment)
I2C WRITE: [0x10] [0xA7] [data0] [data1] ... [dataN]
// 3. Trailing zero (stock firmware quirk)
I2C WRITE: [0x10] [0xA7] [0x00]
// 4. Commit indirect write
I2C WRITE: [0x10] [0xA8] [0x03]
// 5. Poll for completion
I2C READ: [0xA8] until bit 0 clear
```
<Aside type="note" title="Trailing Zero">
The trailing zero write (step 3) appears in all stock firmware versions. Its purpose is unclear -- it may zero-pad the data buffer or serve as an end-of-data marker within the BCM4500's indirect register engine.
</Aside>
## Demodulator Scan
The tune function tries up to 3 different I2C address configurations per attempt, with 3 outer retries (up to 9 total I2C programming attempts). This supports hardware variants where the BCM4500 may appear at different bus addresses.
The v2.13 firmware adds boot-time probing: the INT0 handler polls addresses 0x7F and 0x3F up to 40 times, setting a flag if neither responds. This flag prevents tuning attempts on boards with absent demodulators.
## FEC Architecture
The BCM4500 contains two FEC decoder paths:
<Tabs>
<TabItem label="Turbo FEC">
**Advanced Modulation Turbo FEC Decoder**
Iterative turbo code decoder with the following code rates:
| Modulation | Supported Rates |
|-----------|----------------|
| QPSK | 1/4, 1/2, 3/4 |
| 8PSK | 2/3, 3/4, 5/6, 8/9 |
| 16QAM | 3/4 |
Outer code: Reed-Solomon (t=10).
These turbo codes are Broadcom/EchoStar proprietary and are not part of any open standard. They were used by Dish Network for high-definition satellite broadcasts.
</TabItem>
<TabItem label="Legacy FEC">
**Legacy DVB/DIRECTV/DCII-Compliant FEC Decoder**
Concatenated decoder with:
| Stage | Type | Rates |
|-------|------|-------|
| Inner | Viterbi (convolutional code) | 1/2, 2/3, 3/4, 5/6, 7/8 |
| Outer | Reed-Solomon | Standard DVB-S parameters |
This decoder handles standard DVB-S QPSK, DVB-S BPSK, DSS QPSK, and all Digicipher II modes.
</TabItem>
</Tabs>
<Aside type="caution" title="No DVB-S2 Support">
There is no LDPC or BCH decoder hardware in the BCM4500. DVB-S2 requires both of these, making it physically impossible to add DVB-S2 support through firmware updates.
</Aside>
## Modulation Mode Constants
The firmware uses a 10-entry dispatch table for modulation types. See [Tuning Protocol](/bcm4500/tuning-protocol/) for the full tuning sequence.
| Index | Modulation | FEC Path |
|-------|-----------|----------|
| 0 | DVB-S QPSK | Legacy (Viterbi + RS) |
| 1 | Turbo QPSK | Turbo |
| 2 | Turbo 8PSK | Turbo |
| 3 | Turbo 16QAM | Turbo |
| 4 | DCII Combo | Legacy |
| 5 | DCII I-stream | Legacy |
| 6 | DCII Q-stream | Legacy |
| 7 | DCII Offset QPSK | Legacy |
| 8 | DSS QPSK | Legacy (Viterbi + RS) |
| 9 | DVB-S BPSK | Legacy (Viterbi + RS) |
Indices 8 and 9 (DSS and DVB BPSK) share the same firmware handler. The FEC lookup uses the same table as DVB-S QPSK but ORs the result with 0x80 to distinguish them.

241
site/src/content/docs/bcm4500/gpif-streaming.mdx Normal file
View File

@ -0,0 +1,241 @@
---
title: GPIF Streaming
description: GPIF engine configuration, waveform descriptors, and transport stream data path from BCM4500 to USB host.
---
import { Tabs, TabItem, Badge, Aside, Steps } from '@astrojs/starlight/components';
The GPIF (General Programmable Interface) engine in the Cypress FX2 provides a hardware-managed data path from the BCM4500 demodulator to the USB host. After initial setup, no firmware intervention occurs in the data path -- the GPIF engine reads transport stream data directly into the EP2 FIFO, and the AUTOIN mechanism automatically commits full packets to the USB controller.
## Data Flow Architecture
```
Cypress FX2 (CY7C68013A)
+-----------------------------+
| |
BCM4500 P3.5 TS_EN | GPIF Engine EP2 FIFO | USB 2.0 HS
Demodulator <-----------------+ (Master Read) (AUTOIN) +------------> Host
(I2C:0x08) GPIF Data Bus | 0xE4xx wfm 4x buf | EP2 (0x82)
-------------------> CTL/RDY pins 8-bit | Bulk IN
8-bit parallel TS | | 7 URBs x 8KB
+-----------------------------+
```
<Aside type="note" title="Zero-Copy Path">
The data path is fully hardware-managed. The GPIF engine reads data directly into the EP2 FIFO buffer. The EP2FIFOCFG AUTOIN bit causes the hardware to automatically commit full packets to the USB controller for transfer to the host. The FLOWSTATE engine re-triggers GPIF transactions when buffer space becomes available. The firmware only needs to start/stop the GPIF engine.
</Aside>
## Key Register Configuration
All values are identical across the three stock firmware versions (v2.06, Rev.2 v2.10, v2.13):
| Register | Address | Value | Function |
|----------|---------|-------|----------|
| IFCONFIG | 0xE601 | 0xEE | Internal 48 MHz clock, GPIF master, async, debug output |
| EP2FIFOCFG | 0xE618 | 0x0C | AUTOIN=1, ZEROLENIN=1, 8-bit data path |
| REVCTL | 0xE60B | 0x03 | NOAUTOARM + SKIPCOMMIT |
| CPUCS | 0xE600 | bits [4:3]=10 | 48 MHz CPU clock |
| FLOWSTATEA | 0xE668 | OR 0x09 | FSEN (flow state enable) + FS[3] |
| GPIFIE | 0xE65C | OR 0x3D | Waveform, TC, DONE, FIFO flag, WF2 interrupts |
### IFCONFIG Decode (0xEE = 1110_1110)
| Bit | Name | Value | Meaning |
|-----|------|-------|---------|
| 7 | IFCLKSRC | 1 | Internal clock source |
| 6 | 3048MHZ | 1 | 48 MHz IFCLK frequency |
| 5 | IFCLKOE | 1 | IFCLK pin drives output (clock to BCM4500) |
| 4 | IFCLKPOL | 0 | Non-inverted clock polarity |
| 3 | ASYNC | 1 | Asynchronous GPIF (RDY pin handshaking) |
| 2 | GSTATE | 1 | Debug state output on PORTE |
| 1:0 | IFCFG | 10 | GPIF internal master mode |
The FX2 operates as a GPIF master, reading data from the BCM4500's parallel transport stream output. Asynchronous mode means the GPIF uses RDY pin handshaking rather than clock-edge sampling.
### EP2FIFOCFG Decode (0x0C = 0000_1100)
| Bit | Name | Value | Meaning |
|-----|------|-------|---------|
| 4 | INFM1 | 0 | Packet count not decremented |
| 3 | AUTOIN | 1 | Auto-commit IN packets when FIFO buffer full |
| 2 | ZEROLENIN | 1 | Allow zero-length IN packets |
| 1 | (reserved) | 0 | -- |
| 0 | WORDWIDE | 0 | 8-bit data path (not 16-bit) |
The AUTOIN bit is critical: when the GPIF fills an EP2 FIFO buffer to the configured packet size, the FX2 hardware automatically arms the buffer for USB transfer.
## GPIF Waveform Configuration
The GPIF waveform descriptors occupy 128 bytes at 0xE400-0xE47F and are loaded from a compressed init table during firmware startup. The waveform programs a straightforward read cycle:
```
States 0-5: CTL outputs = 0x01 (control line asserted), 1 IFCLK each
State 6: CTL = 0x07, length = 0 (idle/terminate)
Opcode: 0x00 (SDP = sample data point)
Output: 0xF0 (FIFO write flags)
```
This encodes a simple "assert read strobe, capture data, de-assert" cycle that reads one byte per GPIF transaction from the BCM4500's parallel port into the EP2 FIFO.
## FIFO Reset Sequence
All endpoint FIFOs are reset during initialization using the Cypress-prescribed procedure:
```c title="FIFO Reset (FUN_CODE_10d9)"
FIFORESET = 0x80; // NAKALL: NAK all host transfers during reset
// 3-NOP SYNCDELAY
FIFORESET = 0x02; // Reset EP2 FIFO
// 3-NOP SYNCDELAY
FIFORESET = 0x04; // Reset EP4 FIFO
// 3-NOP SYNCDELAY
FIFORESET = 0x06; // Reset EP6 FIFO
// 3-NOP SYNCDELAY
FIFORESET = 0x08; // Reset EP8 FIFO
// 3-NOP SYNCDELAY
FIFORESET = 0x00; // Release NAKALL
```
The triple-NOP delays (mandatory SYNCDELAY) between writes are required by the FX2 architecture: XRAM register writes take 2 cycles to propagate, and back-to-back writes to the same register need at least 3 instruction cycles.
## ARM_TRANSFER Command (0x85)
The host issues vendor command 0x85 to start or stop the MPEG-2 transport stream. The handler checks the [configuration status byte](/usb/config-status/) bit 0 (demodulator active) before proceeding.
<Tabs>
<TabItem label="Start Streaming">
When `wValue=1` and the demodulator is active:
<Steps>
1. **Set streaming flag** -- config_byte bit 7 = 1 (bmArmed).
2. **Load GPIF transaction count** -- GPIFTCB3:2 = 0x8000 (2 GB, effectively infinite).
3. **Reset address and byte count** -- Clear GPIF address registers and EP2 FIFO byte count.
4. **Assert TS_EN** -- P3.5 LOW (BCM4500 transport stream output enabled).
5. **Wait for initial GPIF transaction** -- Poll GPIFTRIG bit 7 (DONE) until set.
6. **De-assert TS_EN** -- P3.5 HIGH.
7. **Trigger continuous GPIF read** -- GPIFTRIG = 0x04 (read direction, EP2 select).
8. **Set streaming indicator** -- P0.7 LOW.
</Steps>
```asm title="Start Streaming (Rev.2 at CODE:0D84)"
ORL 0x4e, #0x80 ; config_byte |= 0x80 (streaming flag)
MOV DPTR, #0xE630 ; GPIFTCB3
MOV A, #0x80
MOVX @DPTR, A ; GPIFTCB3 = 0x80 (huge transaction count)
; ... address/FIFO reset ...
ANL 0xb0, #0xDF ; P3 &= 0xDF -> P3.5 = 0 (TS_EN assert)
; Poll GPIFTRIG.DONE ...
ORL 0xb0, #0x20 ; P3 |= 0x20 -> P3.5 = 1
MOV 0xbb, #0x04 ; GPIFTRIG = 0x04 (read EP2)
ANL 0x80, #0x7F ; P0 &= 0x7F -> P0.7 = 0 (streaming)
```
</TabItem>
<TabItem label="Stop Streaming">
When `wValue=0` and currently streaming (config_byte bit 7 set):
<Steps>
1. **Set stopped indicator** -- P0.7 HIGH.
2. **Force-flush buffer** -- EP2FIFOBCH = 0xFF (skip current FIFO packet).
3. **Wait for GPIF idle** -- Poll GPIFTRIG bit 7 (DONE) until set.
4. **Discard partial packet** -- OUTPKTEND = 0x82 (skip bit set, EP2 select).
5. **Clear streaming flag** -- config_byte bit 7 = 0.
6. **De-assert control lines** -- P3 bits 7:5 = 1 (all BCM4500 controls idle).
</Steps>
```asm title="Stop Streaming (Rev.2 at CODE:0DE1)"
ORL 0x80, #0x80 ; P0 |= 0x80 -> P0.7 = 1 (stopped)
MOV DPTR, #0xE6F5 ; EP2FIFOBCH
MOV A, #0xFF
MOVX @DPTR, A ; Force flush
; Poll GPIFTRIG.DONE ...
MOV DPTR, #0xE648 ; OUTPKTEND
MOV A, #0x82 ; Skip=1, EP2
MOVX @DPTR, A ; Discard partial packet
ANL 0x4e, #0x7F ; config_byte &= 0x7F (clear streaming)
ORL 0xb0, #0xE0 ; P3 |= 0xE0 (de-assert all controls)
```
</TabItem>
</Tabs>
## Interrupt Handling
INT4 and INT6 (GPIF/FIFO events) share a common handler that sets a software flag and clears EXIF.4:
```asm title="GPIF Interrupt Handler (Rev.2 at CODE:2084)"
PUSH A
PUSH DPH
PUSH DPL
SETB 0x01 ; Set GPIF event flag (_0_1)
ANL 0x91, #0xEF ; Clear EXIF.4 (INT4/INT6 IRQ flag)
MOV DPTR, #0xE65D ; GPIFIRQ
MOV A, #0x01
MOVX @DPTR, A ; Clear GPIFIRQ bit 0
POP DPL
POP DPH
POP A
RETI
```
The main loop polls this flag, enters CPU idle mode (PCON.0) between events, and checks EP2CS for buffer availability before re-arming the GPIF. The FLOWSTATE engine (FSEN=1) automatically re-triggers GPIF transactions when EP2 buffers become available.
## GPIF Interrupt Enable (GPIFIE)
| Bit | Name | Enabled | Purpose |
|-----|------|---------|---------|
| 0 | GPIFWF | Yes | Waveform completion interrupt |
| 1 | (reserved) | No | -- |
| 2 | GPIFTCEXP | Yes | Transaction count expired |
| 3 | GPIFGPIFDONE | Yes | GPIF operation done |
| 4 | GPIFFF | Yes | FIFO flag interrupt |
| 5 | GPIFWF2 | Yes | Waveform 2 completion |
## Throughput Analysis
| Metric | Value |
|--------|-------|
| USB 2.0 HS bulk (theoretical) | 480 Mbps |
| USB 2.0 HS bulk (practical) | ~280 Mbps (~35 MB/s) |
| GPIF engine (theoretical) | 48 MHz x 8 bits = 384 Mbps |
| Typical DVB-S TS rate | 1--5 MB/s |
| Maximum DVB-S2 rate (hypothetical) | ~7.25 MB/s (58 Mbps) |
The USB/GPIF path has approximately 5x headroom even at the maximum theoretical data rate. The bottleneck for all supported modes is the satellite link, not the USB data path.
## Timing
| Parameter | Value |
|-----------|-------|
| GPIF clock | 48 MHz internal |
| CPU clock | 48 MHz |
| GPIF mode | Asynchronous (RDY pin handshaking) |
| NOP delays | 3 NOPs between XRAM writes (~62.5 ns at 48 MHz) |
| EP2 buffer commit | Automatic via AUTOIN on FIFO fullness |
| GPIF re-trigger | Automatic via FLOWSTATE when EP2 buffer space available |
## Cross-Version Comparison
The GPIF streaming path is functionally identical across all three firmware versions. Only code addresses differ due to recompilation:
| Aspect | v2.06 | v2.13 FW1 | Rev.2 v2.10 |
|--------|-------|-----------|-------------|
| ARM_TRANSFER handler | CODE:0110 | CODE:0110 | CODE:00FA |
| GPIF control function | CODE:1919 | CODE:1800 | CODE:0D7C |
| Config byte IRAM | 0x6D | 0x4F | 0x4E |
| EP2FIFOCFG value | 0x0C | 0x0C | 0x0C |
| IFCONFIG value | 0xEE | 0xEE | 0xEE |
| FLOWSTATEA setting | OR 0x09 | OR 0x09 | OR 0x09 |

117
site/src/content/docs/bcm4500/signal-monitoring.mdx Normal file
View File

@ -0,0 +1,117 @@
---
title: Signal Monitoring
description: SNR, signal strength, and lock status readback from the BCM4500 demodulator.
---
import { Badge, Aside } from '@astrojs/starlight/components';
Signal monitoring uses two vendor commands: GET_SIGNAL_LOCK (0x90) for lock status and GET_SIGNAL_STRENGTH (0x87) for SNR and diagnostic data. Both read BCM4500 direct registers via I2C.
## Signal Lock (GET_SIGNAL_LOCK, 0x90)
Returns 1 byte from BCM4500 direct register 0xA4.
| Bit | Mask | Meaning |
|-----|------|---------|
| 5 | 0x20 | Signal locked |
| Other bits | -- | Additional status (undocumented) |
The kernel driver interprets **any non-zero value** as locked and reports the full lock status:
```c title="Kernel Lock Status Flags"
FE_HAS_LOCK | FE_HAS_SYNC | FE_HAS_VITERBI | FE_HAS_SIGNAL | FE_HAS_CARRIER
```
### Lock States
| Value | State | Description |
|-------|-------|-------------|
| 0x00 | <Badge text="Unlocked" variant="danger" /> | No signal or signal not acquired |
| 0x20 | <Badge text="Locked" variant="success" /> | Signal locked, FEC decoding active |
| Other non-zero | <Badge text="Locked" variant="success" /> | Signal acquired, partial status bits |
<Aside type="note" title="Lock Polling">
After sending a [TUNE_8PSK](/bcm4500/tuning-protocol/) command, the host should poll GET_SIGNAL_LOCK repeatedly until a non-zero value is returned or a timeout expires. Typical lock acquisition takes 100-500 ms depending on signal quality and modulation type.
</Aside>
## Signal Strength (GET_SIGNAL_STRENGTH, 0x87)
Returns 6 bytes. The first two bytes contain a 16-bit SNR value; the remaining bytes are diagnostic register data from the BCM4500.
### Response Format
| Byte | Content | Notes |
|------|---------|-------|
| 0 | SNR low byte (LSB) | 16-bit little-endian |
| 1 | SNR high byte (MSB) | dBu x 256 units |
| 2 | Reserved | BCM4500 diagnostic register |
| 3 | Reserved | BCM4500 diagnostic register |
| 4 | Reserved | BCM4500 diagnostic register |
| 5 | Reserved | BCM4500 diagnostic register |
### SNR Scaling
The Windows BDA driver provides the scaling formula:
```c title="SNR to Signal Strength Conversion"
uint16_t snr_raw = (buf[1] << 8) | buf[0];
if (snr_raw <= 0x0F00) {
signal_strength = snr_raw * 17; // Maps 0--0x0F00 to 0--65535
} else {
signal_strength = 0xFFFF; // 100% at SNR >= 0x0F00
}
```
| SNR Raw Value | Signal Strength | Quality |
|--------------|----------------|---------|
| 0x0000 | 0 (0%) | No signal |
| 0x0400 | ~27% | Poor |
| 0x0800 | ~53% | Fair |
| 0x0C00 | ~80% | Good |
| 0x0F00 | 100% | Maximum |
| > 0x0F00 | 100% (clamped) | Maximum |
### Firmware Implementation Differences
The signal strength readback involves I2C transactions to the BCM4500's [indirect register protocol](/bcm4500/demodulator/). The implementation varies between firmware versions:
| Aspect | v2.06 | Rev.2 v2.10 | v2.13 |
|--------|-------|-------------|-------|
| Registers polled | 0xA2, 0xA8, 0xA4 | 0xA2, 0xA8, 0xA4 | Consolidated (1 register) |
| Max poll iterations | 6 | 6 | Simplified |
| Read-back verification | No | Yes (explicit) | No |
| Call chain | 3-register loop | 3-register + verify | Single register path |
All versions ultimately return the same 6-byte response format to the host.
## BCM4500 Status Registers
These direct registers are used for signal monitoring:
| Register | Address | Function | Access |
|----------|---------|----------|--------|
| Status | 0xA2 | BCM4500 readiness status | Polled during boot and signal checks |
| Lock | 0xA4 | Lock/ready; bit 5 = locked | Read by GET_SIGNAL_LOCK (0x90) |
| Command | 0xA8 | Indirect command status; bit 0 = busy | Polled during register operations |
| Demod Status | 0xF9 | Extended demod status | Read by GET_DEMOD_STATUS (0x99, v2.13 only) |
### Register 0xA2 -- Status
Read during boot probing and signal strength readback. Returns 0x02 when the BCM4500 is powered on but no signal is locked. Exact bit field definitions are not documented in the public BCM4500 datasheet.
### Register 0xA4 -- Lock
The primary lock indicator. The kernel driver reads this as a single byte via GET_SIGNAL_LOCK (0x90). Bit 5 (0x20) is the definitive lock status flag.
### Register 0xA8 -- Command
Used by the [indirect register protocol](/bcm4500/demodulator/) to track command completion. Bit 0 clear indicates the previous indirect read/write command has completed. This register is polled after every indirect register operation.
### Register 0xF9 -- Demod Status (v2.13 only)
Read by the GET_DEMOD_STATUS vendor command (0x99). Also polled by the v2.13 INT0 handler for demodulator availability detection. This register is not accessed by v2.06 or Rev.2 firmware.
<Aside type="tip" title="Custom Firmware Commands">
The custom firmware v3.01.0 adds RAW_DEMOD_READ (0xB1) and I2C_DIAG (0xB6) commands that can read any BCM4500 indirect register for diagnostic purposes. See [Vendor Commands](/usb/vendor-commands/) for details.
</Aside>

258
site/src/content/docs/bcm4500/tuning-protocol.mdx Normal file
View File

@ -0,0 +1,258 @@
---
title: Tuning Protocol
description: Complete TUNE_8PSK command protocol including parameter encoding, modulation dispatch, and BCM4500 I2C programming.
---
import { Tabs, TabItem, Badge, Steps, Aside } from '@astrojs/starlight/components';
The TUNE_8PSK vendor command (0x86) is the primary mechanism for programming the BCM4500 demodulator to receive a satellite signal. The command carries a 10-byte payload encoding frequency, symbol rate, modulation type, and FEC rate. The firmware parses this payload, dispatches to a modulation-specific handler, programs the BCM4500 via I2C, and the host then polls for signal lock.
## Command Format
```
USB SETUP:
bmRequestType = 0x40 (Vendor, Host-to-Device, OUT)
bRequest = 0x86 (TUNE_8PSK)
wValue = 0x0000
wIndex = 0x0000
wLength = 10
```
### EP0 Payload Layout
| Byte | Content | Encoding |
|------|---------|----------|
| [0] | Symbol Rate byte 0 | Little-endian LSB |
| [1] | Symbol Rate byte 1 | |
| [2] | Symbol Rate byte 2 | |
| [3] | Symbol Rate byte 3 | Little-endian MSB |
| [4] | Frequency byte 0 | Little-endian LSB |
| [5] | Frequency byte 1 | |
| [6] | Frequency byte 2 | |
| [7] | Frequency byte 3 | Little-endian MSB |
| [8] | Modulation Type | 0--9 (see table below) |
| [9] | Inner FEC Rate | Index into modulation-specific table |
**Symbol Rate** is in samples per second (sps). The Windows driver converts from ksps: `ulTempSymbolRate = pDeviceParameter->ulSymbolRate * 1000`. Valid range: 256,000 -- 30,000,000 sps.
**Frequency** is the IF frequency in kHz (950,000 -- 2,150,000), computed by the host as `(RF_freq - LO_freq) * multiplier`.
## Firmware Parameter Parsing
The firmware reads the 10-byte payload from EP0BUF (XRAM 0xE740--0xE749) and stores:
| Source | Destination | Notes |
|--------|-------------|-------|
| EP0BUF[8] (modulation) | IRAM 0x4D | Direct copy |
| EP0BUF[9] (FEC rate) | IRAM 0x4F | Direct copy |
| EP0BUF[4--7] (frequency) | XRAM 0xE0DB--0xE0DE | Byte-reversed (LE to BE) |
| EP0BUF[0--3] (symbol rate) | XRAM 0xE0CB--0xE0CE | Byte-reversed (LE to BE) |
The byte reversal converts host little-endian to BCM4500 big-endian, allowing values to be written directly to the demodulator via I2C without further conversion.
```asm title="EP0BUF Read (Rev.2 at CODE:0802)"
; Read modulation type and FEC rate
MOV DPTR, #0xE748 ; EP0BUF[8] = modulation type
MOVX A, @DPTR
MOV 0x4D, A ; Store to IRAM 0x4D
INC DPTR ; DPTR = 0xE749
MOVX A, @DPTR ; EP0BUF[9] = FEC rate
MOV 0x4F, A ; Store to IRAM 0x4F
```
## Modulation Dispatch
After parsing, the firmware validates the modulation type (bounds check against 10) and dispatches via a 20-byte jump table (10 entries x 2 bytes) at CODE:0873. Values >= 10 are rejected silently.
### Dispatch Table (Rev.2)
| Entry | Target | Modulation |
|-------|--------|-----------|
| 0 | 0x08B7 | DVB-S QPSK |
| 1 | 0x08DF | Turbo QPSK |
| 2 | 0x08FA | Turbo 8PSK |
| 3 | 0x0915 | Turbo 16QAM |
| 4 | 0x0947 | DCII Combo |
| 5 | 0x094F | DCII I-stream |
| 6 | 0x0957 | DCII Q-stream |
| 7 | 0x095F | DCII Offset QPSK |
| 8 | 0x0887 | DSS QPSK |
| 9 | 0x0887 | DVB BPSK (shares DSS handler) |
Each handler validates the FEC index, looks up a preconfigured byte from an XRAM table, and writes configuration to four XRAM registers.
## Modulation Handler Details
<Tabs>
<TabItem label="DVB-S / DSS / BPSK">
### DVB-S QPSK (Index 0)
| Parameter | Value |
|-----------|-------|
| FEC table base | XRAM 0xE0F9 |
| Max FEC index | 7 |
| Modulation type register | 0x09 |
| Turbo flag | 0x00 (off) |
| Demod mode | 0x10 (standard) |
| bmDCtuned | Cleared |
**FEC rates available** (table at 0xE0F9): 1/2, 2/3, 3/4, 5/6, 7/8, auto, none.
### DSS QPSK (Index 8) and DVB-S BPSK (Index 9)
DSS and DVB BPSK share the same handler at 0x0887. They use the same FEC table as DVB-S QPSK (0xE0F9) but OR the lookup value with 0x80 to distinguish them:
```c title="DSS/BPSK FEC Encoding"
XRAM[0xE0EB] = XRAM[0xE0F9 + FEC_index] | 0x80;
// Out-of-range default: 0x8C
```
</TabItem>
<TabItem label="Turbo Modes">
### Turbo QPSK (Index 1)
| Parameter | Value |
|-----------|-------|
| FEC table base | XRAM 0xE0B7 |
| Max FEC index | 5 |
| Modulation type register | 0x09 |
| Turbo flag | 0x01 (on) |
| Demod mode | 0x10 |
| bmDCtuned | Cleared |
### Turbo 8PSK (Index 2)
| Parameter | Value |
|-----------|-------|
| FEC table base | XRAM 0xE0B1 |
| Max FEC index | 5 |
| Modulation type register | 0x09 |
| Turbo flag | 0x01 (on) |
| Demod mode | 0x10 |
| bmDCtuned | Cleared |
### Turbo 16QAM (Index 3)
| Parameter | Value |
|-----------|-------|
| FEC table base | XRAM 0xE0BC |
| Max FEC index | 1 |
| Modulation type register | 0x09 |
| Turbo flag | 0x01 (on) |
| Demod mode | 0x10 |
| bmDCtuned | Cleared |
</TabItem>
<TabItem label="DCII Modes">
All four DCII variants share a common post-processing path but set different demod mode values:
| Modulation | Index | Demod Mode (0xE0F5) |
|-----------|-------|---------------------|
| DCII Combo | 4 | 0x10 |
| DCII Offset QPSK | 7 | 0x11 |
| DCII I-stream (split) | 5 | 0x12 |
| DCII Q-stream (split) | 6 | 0x16 |
**Common DCII parameters:**
| Parameter | Value |
|-----------|-------|
| FEC table base | XRAM 0xE0BD |
| Max FEC index | 9 |
| FEC code rate register | 0xFC (fixed for all DCII) |
| Turbo flag | 0x00 (off) |
| bmDCtuned | **Set** (0x40 OR'd into config status) |
The DCII modulation type register (0xE0EC) is loaded from the lookup table at `0xE0BD + FEC_index`, unlike other modulations which use the fixed value 0x09.
</TabItem>
</Tabs>
## XRAM Configuration Summary
After modulation dispatch, four XRAM registers hold the BCM4500 configuration:
| XRAM Address | Register Name | DVB-S QPSK | Turbo (Q/8/16) | DCII | DSS/BPSK |
|-------------|---------------|-----------|---------------|------|----------|
| 0xE0EB | FEC Code Rate | Table lookup | Table lookup | 0xFC (fixed) | Lookup OR 0x80 |
| 0xE0EC | Modulation Type | 0x09 | 0x09 | From DCII table | 0x09 |
| 0xE0F5 | Demod Mode | 0x10 | 0x10 | 0x10/0x11/0x12/0x16 | 0x10 |
| 0xE0F6 | Turbo Flag | 0x00 | 0x01 | 0x00 | 0x00 |
## FEC Rate Lookup Tables
These tables are populated at boot from the CODE-space init table:
| XRAM Base | Modulation | Max Index | Code Rates |
|-----------|-----------|-----------|------------|
| 0xE0F9 | DVB-S QPSK, DSS, BPSK | 7 | 1/2, 2/3, 3/4, 5/6, 7/8, auto, none |
| 0xE0B7 | Turbo QPSK | 5 | Turbo-specific rates |
| 0xE0B1 | Turbo 8PSK | 5 | Turbo-specific rates |
| 0xE0BC | Turbo 16QAM | 1 | Single code rate |
| 0xE0BD | DCII (all variants) | 9 | Combined code + modulation |
## Complete Tuning Sequence
The full sequence from host command to signal acquisition:
<Steps>
1. **LNB Configuration** (separate vendor commands, before TUNE_8PSK)
- SET_LNB_VOLTAGE (0x8B): GPIO P0.4, no I2C. wValue=1 for 18V (H/Circular-L), wValue=0 for 13V (V/Circular-R).
- SET_22KHZ_TONE (0x8C): GPIO P0.3, no I2C. wValue=1 for high band, wValue=0 for low band.
- SEND_DISEQC_COMMAND (0x8D): If multi-switch is needed.
2. **TUNE_8PSK (0x86)** -- Host sends 10-byte payload via USB control transfer.
3. **EP0BUF Parsing** -- Firmware reads modulation/FEC to IRAM, byte-reverses frequency/symbol rate to XRAM.
4. **Modulation Dispatch** -- FEC lookup via jump table, XRAM configuration registers set.
5. **GPIO P3.6** -- DVB mode select pin driven based on modulation type.
6. **BCM4500 I2C Programming** (3 outer retries, each trying up to 3 I2C addresses):
- Poll BCM4500 ready: I2C READ registers 0xA2, 0xA8, 0xA4.
- Write page: I2C WRITE register 0xA6 with 0x00.
- Write config data: I2C WRITE register 0xA7 with frequency, symbol rate, FEC, modulation, and demod parameters.
- Execute: I2C WRITE register 0xA8 with 0x03 (indirect write command).
- Poll completion: I2C READ registers 0xA8, 0xA2.
- Verify: I2C READ register 0xA7 (read-back compare).
7. **Signal Acquisition** (host polling):
- GET_SIGNAL_LOCK (0x90): Poll until non-zero.
- GET_SIGNAL_STRENGTH (0x87): Read [SNR value](/bcm4500/signal-monitoring/).
</Steps>
## I2C Programming Details
The core I2C write function (`FUN_CODE_1670` on Rev.2) implements the [BCM4500 indirect register protocol](/bcm4500/demodulator/):
```c title="BCM4500 Indirect Write (Decompiled)"
void bcm4500_indirect_write(byte *data, byte count) {
// Wait for BCM4500 ready (poll regs 0xA2, 0xA8, 0xA4)
bus_wait_ready();
// Write page address (0x00) to register 0xA6
i2c_write(1, 0, 0xA6, 0x10); // [0x00]
// Write data to register 0xA7
i2c_write(count, 0, 0xA7, 0x10); // [data0..dataN]
// Write command (0x03 = indirect write) to 0xA8
i2c_write(1, 0, 0xA8, 0x10); // [0x03]
// Poll completion (regs 0xA8, 0xA2)
poll_write_complete();
// Verify: read back from 0xA7 and compare
verify_readback();
}
```
The demod scan function (`FUN_CODE_1dd0`) wraps this in a 3-address iteration loop, supporting hardware variants where the BCM4500 may respond at different I2C addresses. The outer tune function retries the entire scan up to 3 times.
<Aside type="note" title="Version Differences">
The tuning logic is functionally identical across all three firmware versions. Differences are limited to code addresses (due to recompilation), the config status byte IRAM location, and minor implementation details in the signal strength polling path. v2.13 adds a 20-attempt retry loop with checksum verification on the I2C programming step.
</Aside>

169
site/src/content/docs/driver/dvb-s2.mdx Normal file
View File

@ -0,0 +1,169 @@
---
title: DVB-S2 Incompatibility
description: Why the SkyWalker-1 cannot support DVB-S2 and what the BCM4500 demodulator actually provides.
---
import { Badge, Aside, Tabs, TabItem } from '@astrojs/starlight/components';
<Aside type="danger">
**DVB-S2 is not supported on the SkyWalker-1.** This is a fundamental hardware limitation of the Broadcom BCM4500 demodulator silicon, not a firmware limitation. No firmware update can add DVB-S2 capability. The BCM4500 was designed and fabricated before the DVB-S2 standard was ratified (March 2005) and contains no LDPC or BCH decoder hardware.
</Aside>
## The Core Problem
DVB-S2 (ETSI EN 302 307) requires two forward error correction technologies that do not exist in the BCM4500:
| FEC Component | BCM4500 Has | DVB-S2 Requires |
|---------------|-------------|-----------------|
| Inner code | Viterbi (convolutional) + Turbo | **LDPC** (Low-Density Parity-Check) |
| Outer code | Reed-Solomon (t=10) | **BCH** (Bose-Chaudhuri-Hocquenghem) |
| Block size | Streaming (Viterbi) or short turbo blocks | **64,800 or 16,200 bits** |
| Decoder type | Trellis-based / iterative turbo | **Iterative belief propagation** |
LDPC decoding requires dedicated silicon: large block RAM for message passing (the LDPC block is 64,800 bits), iterative belief propagation logic, and a fundamentally different decoder architecture. This cannot be emulated in firmware on the BCM4500's simple 8-bit on-chip microcontroller, which handles only configuration, acquisition, and monitoring -- not data-path processing.
## BCM4500 FEC Architecture
The BCM4500 contains exactly two FEC decoder paths (from the [BCM4500 datasheet](https://elcodis.com/parts/5786421/BCM4500.html)):
<Tabs>
<TabItem label="Legacy FEC">
### Viterbi + Reed-Solomon (Legacy)
Used for DVB-S QPSK, DSS QPSK, DVB-S BPSK, and Digicipher II modes.
| Parameter | Value |
|-----------|-------|
| Inner decoder | Viterbi (convolutional) |
| Code rates | 1/2, 2/3, 3/4, 5/6, 7/8 |
| Outer decoder | Reed-Solomon |
| Signal path | Soft decisions fed to Viterbi, then RS outer code |
| Modulations | BPSK, QPSK |
**Firmware evidence** (XRAM 0xE0F9): FEC lookup table with max index 7. Modulation dispatch sets `XRAM 0xE0F6 = 0x00` (turbo flag OFF), `XRAM 0xE0F5 = 0x10` (standard demod mode).
**Windows driver**: `m_CurResource.ulInnerFecType = BDA_FEC_VITERBI` -- explicitly rejects any FEC type other than Viterbi.
</TabItem>
<TabItem label="Turbo FEC">
### Turbo Code Decoder (Proprietary)
Used for Turbo QPSK, Turbo 8PSK, and Turbo 16QAM -- proprietary "advanced modulation" modes developed by Broadcom for EchoStar/Dish Network.
| Parameter | Value |
|-----------|-------|
| Inner decoder | Iterative turbo code |
| QPSK rates | 1/4, 1/2, 3/4 |
| 8PSK rates | 2/3, 3/4, 5/6, 8/9 |
| 16QAM rates | 3/4 |
| Outer decoder | Reed-Solomon (t=10) |
| Modulations | QPSK, 8PSK, 16QAM |
**Firmware evidence** (XRAM 0xE0B7, 0xE0B1, 0xE0BC): Turbo FEC lookup tables. All turbo modes set `XRAM 0xE0F6 = 0x01` (turbo flag ON).
These turbo codes are NOT the same as DVB-S2's LDPC codes. The turbo decoder uses parallel concatenated convolutional codes, while LDPC uses sparse parity-check matrix belief propagation. Different algorithms, different silicon.
</TabItem>
<TabItem label="Digicipher II">
### DCII Decoder
Used for DCII combo, split I/Q, and offset QPSK modes.
| Parameter | Value |
|-----------|-------|
| FEC table | XRAM 0xE0BD, max index 9 |
| Fixed FEC code | `0xFC` written to XRAM 0xE0EB |
| Modulations | QPSK variants (combo, split, offset) |
</TabItem>
</Tabs>
The BCM4500 datasheet states explicitly: "Optimized soft decisions are then fed into either a DVB/DIRECTV/DCII-compliant FEC decoder, or an advanced modulation turbo decoder." These are the only two FEC paths. There is no third path for LDPC/BCH.
## Zero DVB-S2 Evidence in Firmware or Driver
Exhaustive search across all firmware versions and Windows driver source:
| What Was Searched | Result |
|-------------------|--------|
| All firmware binaries (v2.06, Rev.2, v2.13) via Ghidra | No LDPC/BCH/DVB-S2 references |
| Windows driver `SkyWalker1Control.h` | Modulation constants 0--9 only, none for DVB-S2 |
| Windows driver `SkyWalker1TunerFilter.cpp` | Rejects non-Viterbi FEC types |
| Windows driver `SkyWalker1Control.cpp` | Hardcodes `ADV_MOD_DVB_QPSK` (value 0) |
| Firmware dispatch table (CODE:0873) | 10 entries max, values >= 10 rejected |
| All FEC lookup tables in XRAM | Only Viterbi rates and turbo rates, no LDPC rates |
| I2C register addresses | BCM4500-specific protocol only (page 0x00, regs 0xA6/A7/A8) |
**Specific proof points:**
- `SkyWalker1TunerFilter.cpp`, line 1070: `if(ulNewInnerFecType == BDA_FEC_VITERBI)` -- only Viterbi accepted; any other FEC type returns `STATUS_INVALID_PARAMETER`
- `SkyWalker1Control.cpp`, line 292: `ucCommand[8] = ADV_MOD_DVB_QPSK;` -- always sends modulation type 0
- Firmware jump table at CODE:0866: bounds check rejects modulation values >= 10
## Is the USB Data Path a Bottleneck?
**No.** The GPIF/USB 2.0 streaming architecture has roughly 5x headroom for DVB-S2 data rates. The bottleneck is the demodulator silicon, not the transport path.
| Metric | Value |
|--------|-------|
| DVB-S2 max net rate (8PSK 9/10, 30 Msps) | ~58 Mbps (~7.25 MB/s) |
| Typical HD transponder (8PSK 3/4, 27.5 Msps) | ~44 Mbps |
| USB 2.0 practical bulk throughput | ~280 Mbps (~35 MB/s) |
| GPIF engine theoretical throughput (48 MHz, 8-bit) | 384 Mbps (48 MB/s) |
| Current DVB-S typical TS rate | 1--5 MB/s |
DVB-S2 uses the same MPEG-TS output format (188-byte packets) as DVB-S, so the GPIF waveform and AUTOIN configuration would work unchanged.
However, this is a moot point: even if the BCM4500 were physically replaced with a DVB-S2-capable chip, the entire FX2 firmware would need rewriting (I2C register protocol, tuning sequence, modulation dispatch, FEC configuration), since every DVB-S2 demodulator uses a completely different register interface.
## Broadcom's DVB-S2 Silicon Timeline
Broadcom addressed DVB-S2 by designing entirely new chips -- they did not add LDPC to the BCM4500:
| Chip | Year | DVB-S2 | Key Addition |
|------|------|--------|-------------|
| **BCM4500** | ~2003 | No | Turbo FEC + Viterbi/RS |
| **BCM4501** | 2006 | **Yes** | First dual-tuner DVB-S2; LDPC/BCH decoder |
| **BCM4505** | 2007 | **Yes** | Single-channel, 65nm, LDPC/BCH + legacy |
| **BCM4506** | 2007 | **Yes** | Dual-channel, 65nm, LDPC/BCH + legacy |
The BCM4501 datasheet explicitly states it includes "four 8-bit ADCs, all-digital variable rate QPSK/8PSK receivers, advanced modulation LDPC/BCH, and DVB-S-compliant forward error correction decoder." Adding LDPC/BCH required new silicon.
<Aside type="note">
Broadcom restricted sales of the BCM4501/4505/4506 to set-top box manufacturers (EchoStar, DIRECTV). They did not sell to PC peripheral makers. This is why Genpix could not simply drop in a BCM4501 as a replacement.
</Aside>
## What Genpix Did: The SkyWalker-3
Genpix released the SkyWalker-3 as a DVB-S2-capable successor using a completely different demodulator (likely STMicroelectronics STV0903):
| Feature | SkyWalker-1 (BCM4500) | SkyWalker-3 (likely STV0903) |
|---------|----------------------|---------------------------|
| DVB-S QPSK | Yes | Yes |
| DVB-S2 QPSK | **No** | Yes |
| DVB-S2 8PSK | **No** | Yes |
| Turbo QPSK | Yes | **No** |
| Turbo 8PSK | Yes | **No** |
| Turbo 16QAM | Yes | **No** |
| DCII | Yes | Yes |
| DSS | Yes | Yes |
| Symbol rate (DVB-S) | 256 Ksps -- 30 Msps | 1 -- 45 Msps |
| Symbol rate (DVB-S2) | N/A | 5 -- 33 Msps |
| FEC inner (DVB-S) | Viterbi | Viterbi |
| FEC inner (DVB-S2) | N/A | LDPC |
| FEC outer (DVB-S2) | N/A | BCH |
The trade-off is clear: the SkyWalker-3 gained DVB-S2 but **lost turbo-FEC support entirely**. The turbo codes were proprietary to Broadcom/EchoStar, and the STV0903 does not implement them. This means the SkyWalker-3 cannot receive Dish Network's legacy turbo-coded 8PSK transmissions.
## Summary
| Question | Answer |
|----------|--------|
| Is DVB-S2 a hardware or firmware limitation? | **Hardware** -- BCM4500 has no LDPC/BCH decoder |
| Could a firmware update add DVB-S2? | **No** -- LDPC requires dedicated silicon |
| Which Broadcom chip first added LDPC? | **BCM4501** (2006) |
| Any DVB-S2 hints in firmware/driver? | **None** -- zero references anywhere |
| Is the USB data path a bottleneck? | **No** -- ~5x headroom for DVB-S2 rates |
| What did Genpix do for DVB-S2? | Released SkyWalker-3 with STV0903 demodulator |
| What was lost in the SkyWalker-3? | Turbo-FEC support (Broadcom/EchoStar proprietary) |

272
site/src/content/docs/driver/linux-kernel.mdx Normal file
View File

@ -0,0 +1,272 @@
---
title: Linux Kernel Driver
description: Architecture and command analysis of the dvb_usb_gp8psk kernel module for Genpix satellite receivers.
---
import { Steps, Badge, Aside, Tabs, TabItem } from '@astrojs/starlight/components';
The `dvb_usb_gp8psk` module is a Linux kernel DVB-USB driver supporting multiple Genpix satellite receiver models. It communicates with the FX2 microcontroller via USB vendor control requests to manage tuning, demodulation, LNB control, DiSEqC switching, and transport stream capture.
**Source files**: `drivers/media/usb/dvb-usb/gp8psk.c`, `gp8psk.h`, `gp8psk-fe.c`
## USB Device Table
| USB ID | Device Name | cold_ids | warm_ids | FW01 Needed? |
|--------|-------------|----------|----------|-------------|
| `v09C0p0200` | Rev.1 Cold | Yes | -- | **Yes** |
| `v09C0p0201` | Rev.1 Warm | -- | Yes | No (FW02 needed) |
| `v09C0p0202` | Rev.2 | -- | Yes | No |
| `v09C0p0203` | SkyWalker-1 | -- | Yes | No |
| `v09C0p0204` | SkyWalker-1 (alt) | -- | Yes | No |
| `v09C0p0206` | SkyWalker CW3K | -- | Yes | No |
<Aside type="note">
PID `0x0205` (SkyWalker-2) is absent from the kernel 6.16.5 build. PID `0x0203` was not present in earlier kernel versions (e.g., v6.6.1) -- it was added later as the SkyWalker-1 gained community attention.
</Aside>
## Driver Architecture
The driver consists of three source files:
| File | Purpose |
|------|---------|
| `gp8psk.c` | USB device management, firmware loading, power control, vendor command wrappers |
| `gp8psk.h` | Vendor command constants, firmware version thresholds, USB PID definitions |
| `gp8psk-fe.c` | DVB frontend implementation: tuning, signal monitoring, LNB/DiSEqC callbacks |
The driver registers with the DVB-USB framework (`dvb_usb_device_properties`) which handles:
- USB device enumeration and firmware download (for cold devices)
- DVB adapter and frontend creation
- URB management for bulk transport stream capture
- Power management callbacks
## USB Transfer Parameters
```c title="Driver USB configuration"
gp8psk_properties {
.usb_ctrl = CYPRESS_FX2;
.firmware = "dvb-usb-gp8psk-01.fw";
.num_adapters = 1;
.generic_bulk_ctrl_endpoint = 0x01;
// Streaming:
.endpoint = 0x82; // IN bulk
.stream = USB_BULK;
.count = 7; // URBs
.buffersize = 8192; // bytes per URB
}
```
The driver allocates 7 URBs of 8192 bytes each (56 KB total) for transport stream reception on endpoint `0x82` (IN bulk). Vendor commands use endpoint `0x01` with a 2000 ms timeout.
### Retry Logic
IN operations retry up to 3 times if partial data is received. The command buffer is 80 bytes maximum:
```c title="Vendor command wrapper"
static int gp8psk_usb_in_op(struct dvb_usb_device *d,
u8 req, u16 value, u16 index, u8 *b, int blen)
{
int ret;
int try;
for (try = 0; try < 3; try++) {
ret = usb_control_msg(d->udev,
usb_rcvctrlpipe(d->udev, 0),
req, USB_TYPE_VENDOR | USB_DIR_IN,
value, index, b, blen, 2000);
if (ret == blen) break;
}
return ret;
}
```
## Complete Vendor Command Map
| Cmd | Name | Dir | wValue | wLength | Purpose |
|-----|------|-----|--------|---------|---------|
| `0x80` | GET_8PSK_CONFIG | IN | `0x0000` | 1 | Read config status byte |
| `0x81` | SET_8PSK_CONFIG | OUT | varies | 0 | STALL (not implemented) |
| `0x83` | I2C_WRITE | OUT | dev_addr | N | Write to BCM4500 via I2C |
| `0x84` | I2C_READ | IN | dev_addr | N | Read from BCM4500 via I2C |
| `0x85` | ARM_TRANSFER | OUT | 0/1 | 0 | Start/stop TS streaming |
| `0x86` | TUNE_8PSK | OUT | `0x0000` | 10 | Send tuning parameters |
| `0x87` | GET_SIGNAL_STRENGTH | IN | `0x0000` | 6 | Read SNR values |
| `0x88` | LOAD_BCM4500 | OUT | 1 | 0 | Initiate demod FW download |
| `0x89` | BOOT_8PSK | IN | 0/1 | 1 | Power on/off demodulator |
| `0x8A` | START_INTERSIL | IN | 0/1 | 1 | Enable/disable LNB supply |
| `0x8B` | SET_LNB_VOLTAGE | OUT | 0/1 | 0 | Set 13V (0) or 18V (1) |
| `0x8C` | SET_22KHZ_TONE | OUT | 0/1 | 0 | Enable/disable 22 kHz tone |
| `0x8D` | SEND_DISEQC | OUT | msg[0] | 3-6 | Send DiSEqC message |
| `0x8E` | SET_DVB_MODE | OUT | 1 | 0 | Enable DVB-S mode |
| `0x8F` | SET_DN_SWITCH | OUT | cmd | 0 | Legacy Dish switch command |
| `0x90` | GET_SIGNAL_LOCK | IN | `0x0000` | 1 | Read lock status |
| `0x92` | GET_FW_VERS | IN | `0x0000` | 6 | Read firmware version |
| `0x94` | USE_EXTRA_VOLT | OUT | 0/1 | 0 | Enable +1V LNB boost |
| `0x95` | GET_FPGA_VERS | IN | `0x0000` | 1 | Read hardware platform ID |
| `0x99` | GET_DEMOD_STATUS | IN | `0x0000` | 1 | Read BCM4500 reg 0xF9 (v2.13+) |
| `0x9A` | INIT_DEMOD | OUT | `0x0000` | 0 | Re-init demodulator (v2.13+) |
| `0x9C` | DELAY_COMMAND | OUT | param | 0 | Tuning delay with polling (v2.13+) |
| `0x9D` | CW3K_INIT | OUT | 0/1 | 0 | CW3K model initialization |
## Configuration Status Byte
`GET_8PSK_CONFIG` (`0x80`) returns a bit-mapped status register:
```
Bit 0 (0x01): bm8pskStarted - Device booted and running
Bit 1 (0x02): bm8pskFW_Loaded - BCM4500 firmware loaded
Bit 2 (0x04): bmIntersilOn - LNB power supply enabled
Bit 3 (0x08): bmDVBmode - DVB mode enabled
Bit 4 (0x10): bm22kHz - 22 kHz tone active
Bit 5 (0x20): bmSEL18V - 18V LNB voltage selected
Bit 6 (0x40): bmDCtuned - DC offset tuning complete
Bit 7 (0x80): bmArmed - MPEG-2 stream transfer armed
```
## Boot Sequence
<Steps>
1. **Read config** (`GET_8PSK_CONFIG 0x80`): Check bit 0 (`bm8pskStarted`)
2. **Boot device** if not started: Send `BOOT_8PSK 0x89` with `wValue=1`, then read firmware version via `GET_FW_VERS 0x92`
3. **Load BCM4500 firmware** if bit 1 not set: Only for Rev.1 Warm (PID `0x0201`). Send `LOAD_BCM4500 0x88` followed by firmware chunks. Skipped for SkyWalker-1 (bit already set from EEPROM boot).
4. **Enable LNB** if bit 2 not set: Send `START_INTERSIL 0x8A` with `wValue=1`
5. **Set DVB mode**: Send `SET_DVB_MODE 0x8E` with `wValue=1` (STALL on some revisions)
6. **Cancel pending stream**: Send `ARM_TRANSFER 0x85` with `wValue=0`
7. **Ready for tuning**
</Steps>
## Tuning Flow
```c title="10-byte tuning payload"
Bytes 0-3: Symbol Rate (u32 LE, in sps)
Bytes 4-7: Frequency (u32 LE, in kHz)
Byte 8: Modulation (0-9, see modulation types)
Byte 9: FEC Rate (index into firmware FEC table)
```
### Modulation Types
| Value | Constant | Mode |
|-------|----------|------|
| 0 | `ADV_MOD_DVB_QPSK` | DVB-S QPSK |
| 1 | `ADV_MOD_TURBO_QPSK` | Turbo QPSK |
| 2 | `ADV_MOD_TURBO_8PSK` | Turbo 8PSK |
| 3 | `ADV_MOD_TURBO_16QAM` | Turbo 16QAM |
| 4 | `ADV_MOD_DCII_C_QPSK` | Digicipher II Combo |
| 5 | `ADV_MOD_DCII_I_QPSK` | Digicipher II I-stream |
| 6 | `ADV_MOD_DCII_Q_QPSK` | Digicipher II Q-stream |
| 7 | `ADV_MOD_DCII_C_OQPSK` | Digicipher II Offset QPSK |
| 8 | `ADV_MOD_DSS_QPSK` | DSS/DIRECTV QPSK |
| 9 | `ADV_MOD_DVB_BPSK` | DVB-S BPSK |
### Signal Quality
`GET_SIGNAL_STRENGTH` (`0x87`) returns 6 bytes:
```
Bytes 0-1: SNR value (u16 LE, in dBu*256 units)
Bytes 2-5: Reserved / diagnostics
```
SNR scaling in the kernel: `snr_value * 17` maps to the 0--65535 range. 100% signal quality corresponds to SNR >= `0x0F00`.
## Firmware Version Handling
The driver defines two version constants in `gp8psk-fe.h`:
```c title="Firmware version thresholds"
#define GP8PSK_FW_REV1 0x020604 // v2.06.4
#define GP8PSK_FW_REV2 0x020704 // v2.07.4
```
<Tabs>
<TabItem label="< FW_REV1">
Oldest firmware. No extended commands available.
</TabItem>
<TabItem label=">= FW_REV1">
v2.06.4 baseline. All standard commands operational. Uses `GET_SIGNAL_STRENGTH` for BER monitoring.
</TabItem>
<TabItem label=">= FW_REV2">
v2.07.4+. Enables additional code paths:
- `GET_DEMOD_STATUS` (`0x99`) for demod health check
- `INIT_DEMOD` (`0x9A`) for demod re-initialization
- `DELAY_COMMAND` (`0x9C`) for tuning acquisition delays
- Different signal quality calculation
</TabItem>
</Tabs>
## Command Correlation with Firmware
Not all vendor commands work on all firmware versions. The STALL behavior varies:
| Command | v2.06 FW | v2.13 FW | Rev.2 FW | Custom v3.01 |
|---------|----------|----------|----------|-------------|
| `0x80` GET_8PSK_CONFIG | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| `0x86` TUNE_8PSK | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| `0x87` GET_SIGNAL_STRENGTH | <Badge text="OK" variant="success" /> | <Badge text="Changed" variant="caution" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| `0x88` LOAD_BCM4500 | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> |
| `0x99` GET_DEMOD_STATUS | <Badge text="STALL" variant="danger" /> | <Badge text="OK" variant="success" /> | <Badge text="Proto" variant="caution" /> | N/A |
| `0x9A` INIT_DEMOD | <Badge text="STALL" variant="danger" /> | <Badge text="OK" variant="success" /> | <Badge text="Proto" variant="caution" /> | N/A |
| `0x9C` DELAY_COMMAND | <Badge text="STALL" variant="danger" /> | <Badge text="OK" variant="success" /> | N/A | N/A |
<Aside type="note">
Command `0x88` (`LOAD_BCM4500`) routes to the STALL handler in **all** extracted firmware versions. The kernel only sends it for Rev.1 Warm devices (PID `0x0201`) after confirming `bm8pskFW_Loaded` is not set. On SkyWalker-1 hardware, the BCM4500 firmware is in ROM, so this bit is always set at boot.
</Aside>
## Kernel Module Parameters
The gp8psk module inherits standard DVB-USB parameters:
| Parameter | Default | Description |
|-----------|---------|-------------|
| `debug` | 0 | Enable debug logging (bitmask) |
| `force_pid_filter` | 0 | Force PID filtering on/off |
| `generic_bulk_ctrl_endpoint` | `0x01` | Control endpoint |
Enable verbose logging with:
```bash
modprobe dvb_usb_gp8psk debug=0xff
```
Or at runtime:
```bash
echo 0xff > /sys/module/dvb_usb_gp8psk/parameters/debug
```
## DVB Frontend Properties
The gp8psk frontend (`gp8psk-fe.c`) registers with the following capabilities:
```c title="Frontend info structure"
.name = "Genpix 8psk-to-USB2 DVB-S"
.frequency_min_hz = 800 * MHz
.frequency_max_hz = 2250 * MHz
.frequency_stepsize_hz = 100 * kHz
.symbol_rate_min = 256000 // 256 Ksps
.symbol_rate_max = 30000000 // 30 Msps
.caps = FE_CAN_INVERSION_AUTO |
FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 |
FE_CAN_FEC_3_4 | FE_CAN_FEC_5_6 |
FE_CAN_FEC_7_8 | FE_CAN_FEC_AUTO |
FE_CAN_QPSK
```
<Aside type="note">
The frontend capabilities only advertise `FE_CAN_QPSK` -- the turbo 8PSK, turbo 16QAM, and DCII modes are not exposed through the standard DVB API. Accessing these modes requires direct vendor command access or the Windows BDA driver.
</Aside>
## Related Pages
- [Vendor Commands](/usb/vendor-commands/) -- Complete command reference
- [Kernel FW01](/firmware/kernel-fw01/) -- Firmware format and loading analysis
- [DVB-S2 Investigation](/driver/dvb-s2/) -- Why DVB-S2 cannot be added
- [Custom Firmware v3.01](/firmware/custom-v301/) -- Open-source replacement with extended commands

287
site/src/content/docs/firmware/custom-v301.mdx Normal file
View File

@ -0,0 +1,287 @@
---
title: Custom Firmware v3.01.0
description: Open-source SDCC + fx2lib replacement firmware with diagnostic commands, spectrum sweep, and blind scan.
---
import { Steps, Badge, Aside, Tabs, TabItem, FileTree } from '@astrojs/starlight/components';
The custom v3.01.0 firmware is an open-source replacement for the stock SkyWalker-1 FX2 firmware, built with the SDCC compiler and fx2lib library. It implements all stock vendor commands for kernel driver compatibility and adds new diagnostic, spectrum sweep, and blind scan capabilities. <Badge text="Custom" variant="success" />
## Project Structure
<FileTree>
- firmware/
- skywalker1.c Main firmware source (1351 lines)
- Makefile SDCC build rules
- skywalker1.ihx Compiled Intel HEX output
- tools/
- fw_load.py FX2 RAM loader utility
- eeprom_flash.py EEPROM flash tool
</FileTree>
## Architecture Overview
| Property | Value |
|----------|-------|
| Toolchain | SDCC 4.x + fx2lib |
| Target | Cypress CY7C68013A (FX2LP) |
| Load method | RAM upload via `fw_load.py` (USB 0xA0 vendor request) |
| Binary size | ~3 KB |
| Source lines | 1351 |
| DiSEqC data pin | P0.7 (matches v2.06 hardware) |
| BCM4500 I2C address | `0x08` (7-bit); wire address `0x10`/`0x11` |
<Aside type="tip">
To build the firmware from source:
```bash
cd firmware/
make # Produces skywalker1.ihx
```
To load into FX2 RAM (does not persist across power cycles):
```bash
python tools/fw_load.py firmware/skywalker1.ihx
```
To make the firmware persistent, flash it to the onboard EEPROM using `eeprom_flash.py`.
</Aside>
## Stock-Compatible Commands
All stock vendor commands (`0x80`--`0x94`) are implemented for full compatibility with the Linux `dvb_usb_gp8psk` kernel driver:
| Command | Name | Implementation |
|---------|------|---------------|
| `0x80` | GET_8PSK_CONFIG | Returns `config_status` byte (1 byte) |
| `0x85` | ARM_TRANSFER | Calls `gpif_start()` / `gpif_stop()` |
| `0x86` | TUNE_8PSK | Parses 10-byte EP0 payload, programs BCM4500 |
| `0x87` | GET_SIGNAL_STRENGTH | Reads 6 BCM4500 indirect registers |
| `0x89` | BOOT_8PSK | Full BCM4500 boot sequence (see below) |
| `0x8A` | START_INTERSIL | Enables/disables LNB power supply |
| `0x8B` | SET_LNB_VOLTAGE | Sets P0.4 for 13V/18V selection |
| `0x8C` | SET_22KHZ_TONE | Sets P0.3 for 22 kHz oscillator gate |
| `0x8D` | SEND_DISEQC | DiSEqC tone burst via Timer2 bit-bang |
| `0x90` | GET_SIGNAL_LOCK | Reads BCM4500 lock register `0xA4` |
| `0x92` | GET_FW_VERS | Returns version `0x030100`, build date |
| `0x94` | USE_EXTRA_VOLT | Writes `0x62`/`0x6A` to XRAM `0xE0B6` |
## Custom Diagnostic Commands
Seven new vendor commands (`0xB0`--`0xB6`) extend the firmware with capabilities absent from all stock versions: <Badge text="New" variant="success" />
| Command | Name | Direction | Payload | Purpose |
|---------|------|-----------|---------|---------|
| `0xB0` | SPECTRUM_SWEEP | OUT+Bulk | 10 bytes EP0 | Step through frequencies, return power readings via EP2 |
| `0xB1` | RAW_DEMOD_READ | IN | 2 bytes | Read arbitrary BCM4500 indirect register |
| `0xB2` | RAW_DEMOD_WRITE | OUT | 3 bytes | Write arbitrary BCM4500 indirect register |
| `0xB3` | BLIND_SCAN | OUT+EP0 | 16 bytes EP0 | Sweep symbol rates at a frequency, report lock |
| `0xB4` | I2C_SCAN | IN | N bytes | Scan I2C bus for responsive devices |
| `0xB5` | GET_BOOT_STAGE | IN | 2 bytes | Read `config_status` + `boot_stage` |
| `0xB6` | GET_GPIO_STATE | IN | 3 bytes | Read IOA, IOB, IOD port registers |
### Spectrum Sweep (0xB0)
Steps through frequencies from start to stop, reading BCM4500 signal energy at each step. Results are packed as u16 LE values into EP2 bulk endpoint.
```c title="Spectrum sweep EP0 payload (10 bytes)"
EP0BUF[0..3] start_freq (u32 LE, kHz)
EP0BUF[4..7] stop_freq (u32 LE, kHz)
EP0BUF[8..9] step_khz (u16 LE, default 1000 if 0)
```
At each step, the firmware programs the BCM4500 frequency register via indirect write, waits 10 ms for settling, reads the SNR register pair, and packs the result into EP2 FIFO. When the buffer reaches 512 bytes, it is committed to the host.
### Blind Scan (0xB3)
Sweeps symbol rates from `sr_min` to `sr_max` at a given frequency, checking for signal lock at each step.
```c title="Blind scan EP0 payload (16 bytes)"
EP0BUF[0..3] freq_khz (u32 LE)
EP0BUF[4..7] sr_min (u32 LE, sps)
EP0BUF[8..11] sr_max (u32 LE, sps)
EP0BUF[12..15] sr_step (u32 LE, sps, default 1000000 if 0)
```
Returns 8 bytes on lock (`freq_khz[4] + sr_locked[4]`), or 1 byte `0x00` if no lock found.
### Raw Demod Access (0xB1 / 0xB2)
Direct access to any BCM4500 indirect register, bypassing the stock firmware's limited register set:
```c title="Raw demod read (0xB1)"
// wValue = register page, wIndex = register number
// Returns 1 byte in EP0
bcm_indirect_read(page, &val);
EP0BUF[0] = val;
```
```c title="Raw demod write (0xB2)"
// wValue = register page, wIndex = register number
// EP0 data = 1 byte value
bcm_indirect_write(page, val);
```
## BCM4500 Boot Sequence
The `bcm4500_boot()` function replicates the stock firmware's initialization with added diagnostic instrumentation. The `boot_stage` variable tracks progress for debugging failed boots.
<Steps>
1. **GPIO setup** (`boot_stage = 1`): Set P3.7/P3.6/P3.5 HIGH (control lines idle), assert BCM4500 RESET (P0.5 LOW)
2. **Power on** (`boot_stage = 2`): Enable power supply (P0.1 HIGH, P0.2 LOW), wait 30 ms for settling, release RESET (P0.5 HIGH), wait 50 ms for BCM4500 POR
3. **I2C probe** (`boot_stage = 3`): Read BCM4500 status register `0xA2` to verify the chip is alive on the I2C bus
4. **Init block 0** (`boot_stage = 4`): Write 7-byte configuration block to BCM4500 page 0 indirect registers
5. **Init block 1** (`boot_stage = 5`): Write 8-byte configuration block
6. **Init block 2** (`boot_stage = 6`): Write 3-byte configuration block
7. **Success** (`boot_stage = 0xFF`): Set `BM_STARTED | BM_FW_LOADED` in config status
</Steps>
### BCM4500 Init Data
Three initialization blocks extracted from stock v2.06 firmware (`FUN_CODE_0ddd`):
```c title="BCM4500 register initialization data"
static const __code BYTE bcm_init_block0[] = {
0x06, 0x0b, 0x17, 0x38, 0x9f, 0xd9, 0x80
};
static const __code BYTE bcm_init_block1[] = {
0x07, 0x09, 0x39, 0x4f, 0x00, 0x65, 0xb7, 0x10
};
static const __code BYTE bcm_init_block2[] = {
0x0f, 0x0c, 0x09
};
```
Each block is written to BCM4500 page 0 via the indirect register protocol: page select to `0xA6`, data bytes to `0xA7`, trailing zero to `0xA7`, commit `0x03` to `0xA8`, then poll for completion.
### Debug Boot Modes
The BOOT_8PSK command (`0x89`) accepts debug wValue parameters that execute partial boot sequences for incremental hardware debugging:
| wValue | Stage | What It Does | Success Marker |
|--------|-------|-------------|----------------|
| `0x80` | None | No-op, return current state | -- |
| `0x81` | GPIO only | GPIO setup + power + reset, no I2C | `0xA1` |
| `0x82` | GPIO + probe | GPIO + I2C read of status register | `0xA2` |
| `0x83` | GPIO + probe + block 0 | GPIO + I2C + first init block | `0xA3` |
| `0x84` | I2C only | Probe without GPIO (chip must be powered) | `0xA4` |
| `0x85` | GPIO + probe (no bus reset) | Same as `0x82` without I2CS bmSTOP | `0xA5` |
| `0x01` | Full boot | Complete `bcm4500_boot()` sequence | `0xFF` |
| `0x00` | Shutdown | Power off BCM4500 | -- |
<Aside type="note">
Debug mode `0x85` was created to isolate a critical bug: sending an I2C STOP when no transaction is active corrupts the FX2 I2C controller state, causing subsequent START+ACK detection to fail. The spurious STOP was present in early custom firmware revisions and was the root cause of BCM4500 boot failures. Removing it fixed the issue.
</Aside>
## I2C Implementation
The custom firmware implements I2C from scratch rather than using fx2lib's I2C functions, providing full timeout protection:
```c title="I2C timeout constant"
#define I2C_TIMEOUT 6000 // ~5ms at 48MHz (4 clocks/cycle, ~12 MIPS)
```
Key I2C functions:
| Function | Purpose |
|----------|---------|
| `i2c_wait_done()` | Poll `I2CS.bmDONE` with 6000-count timeout |
| `i2c_wait_stop()` | Poll `I2CS.bmSTOP` clear with timeout |
| `i2c_combined_read()` | Write-then-read with repeated START (no intermediate STOP) |
| `i2c_write_timeout()` | Single-byte write with timeout on each phase |
| `i2c_write_multi_timeout()` | Multi-byte write with timeout |
<Aside type="caution">
Stock firmware has no I2C timeout -- if the BCM4500 holds SCL low (clock stretching), the FX2 spins forever. The custom firmware's 6000-count timeout provides ~5 ms margin at 48 MHz, which is more than 200x the time needed for a single I2C byte at 400 kHz.
</Aside>
### BCM4500 Register Access
The BCM4500 uses an indirect register protocol through three I2C registers:
| Register | Address | Purpose |
|----------|---------|---------|
| BCM_REG_PAGE | `0xA6` | Page/register select |
| BCM_REG_DATA | `0xA7` | Data read/write |
| BCM_REG_CMD | `0xA8` | Command trigger (`0x01` = read, `0x03` = write) |
```c title="Indirect register read sequence"
// 1. Write [page, 0x00, 0x01] to A6/A7/A8 in one I2C transaction
// 2. Wait for command completion (poll A8 bit 0 == 0)
// 3. Read result from A7
```
## GPIF Streaming
Transport stream data from the BCM4500 flows through the FX2's GPIF engine into USB endpoint EP2:
```c title="GPIF configuration"
IFCONFIG = 0xEE; // Internal 48MHz, GPIF master, async, clock output
EP2FIFOCFG = 0x0C; // AUTOIN, ZEROLENIN, 8-bit
FLOWSTATE |= 0x09; // Enable flow state + FS[3]
GPIFTCB3 = 0x80; // Transaction count = 0x80000000 (effectively infinite)
```
The `gpif_start()` function arms the GPIF for continuous read into EP2, while `gpif_stop()` flushes the FIFO and de-asserts the BCM4500 control lines on P3.
## GPIO Pin Map
```c title="GPIO pin definitions (v2.06 hardware)"
#define PIN_PWR_EN 0x02 // P0.1 -- power supply enable
#define PIN_PWR_DIS 0x04 // P0.2 -- power supply disable
#define PIN_22KHZ 0x08 // P0.3 -- 22kHz oscillator gate
#define PIN_LNB_VOLT 0x10 // P0.4 -- LNB voltage select
#define PIN_BCM_RESET 0x20 // P0.5 -- BCM4500 hardware reset
#define PIN_DISEQC 0x80 // P0.7 -- DiSEqC data
```
Initial state after `TD_Init()`:
- `IOA = 0x84` (P0.7 HIGH, P0.2 HIGH -- power disabled, streaming off)
- `OEA = 0xBE` (P0.1 through P0.5 and P0.7 as outputs)
## Differences from Stock Firmware
| Feature | Stock v2.06 | Custom v3.01 |
|---------|-------------|--------------|
| Toolchain | Unknown (proprietary) | SDCC + fx2lib (open source) |
| I2C timeout | None (infinite spin) | 6000-count (~5 ms) |
| Boot diagnostics | None | Incremental debug modes |
| New commands | None | 7 commands (`0xB0`--`0xB6`) |
| Spectrum sweep | Not possible | `0xB0` with configurable step |
| Blind scan | Not possible | `0xB3` with SR sweep |
| Raw register access | Not possible | `0xB1`/`0xB2` |
| I2C bus scan | Not possible | `0xB4` |
| GPIO read | Not possible | `0xB6` |
| Anti-tampering | Present (v2.13) | Removed |
| Source available | No | Yes (`firmware/skywalker1.c`) |
## Tuning Implementation
The `do_tune()` function parses the same 10-byte EP0 payload as the stock firmware:
```c title="Tune command payload parsing"
// Byte-reverse symbol rate and frequency from LE to BE
for (i = 0; i < 4; i++) {
tune_data[i] = EP0BUF[3 - i]; // Symbol rate (BE)
tune_data[4 + i] = EP0BUF[7 - i]; // Frequency (BE)
}
tune_data[8] = EP0BUF[8]; // Modulation type (0-9)
tune_data[9] = EP0BUF[9]; // FEC index
tune_data[10] = 0x10; // Demod mode (standard)
tune_data[11] = 0x00; // Turbo flag
```
Modulation-specific handling:
- Modulation types 1--3 (turbo modes): Set turbo flag `tune_data[11] = 0x01`
- Modulation type 5: DCII I-stream, demod mode `0x12`
- Modulation type 6: DCII Q-stream, demod mode `0x16`
- Modulation type 7: DCII offset QPSK, demod mode `0x11`

213
site/src/content/docs/firmware/fw213-variants.mdx Normal file
View File

@ -0,0 +1,213 @@
---
title: FW2.13 Sub-Variant Comparison
description: Binary and functional comparison of v2.13 firmware sub-variants FW1, FW2, and FW3.
---
import { Tabs, TabItem, Badge, Aside } from '@astrojs/starlight/components';
The v2.13 firmware was distributed as three sub-variants via the `SW1_update_2_13_x.exe` Windows updater tool. Ghidra analysis reveals that these target fundamentally different hardware interfaces, not just minor revisions.
## Overview
| Aspect | FW1 (v2.13.1) | FW2 (v2.13.2) | FW3 (v2.13.3) |
|--------|---------------|---------------|---------------|
| Version ID | `0x020D01` | `0x020D01` | `0x020D01` |
| Build date | 2010-03-12 | 2010-03-12 | 2010-03-12 |
| Functions | 82 | 83 | 83 |
| Binary size | 9,322 bytes | 9,377 bytes | 9,369 bytes |
| Stack pointer | `0x50` | `0x50` | **`0x52`** |
| P0 init | `0xA4` | `0xA4` | **`0xA0`** |
| Status register | INTMEM `0x4F` | INTMEM `0x4F` | **INTMEM `0x51`** |
| Demod interface | **I2C bus** | **Parallel bus (P0/P1)** | **Parallel bus (enhanced)** |
| Config source | Hardcoded | External (`0xE080`--`0xE08E`) | External (`0xE080`--`0xE08E`) |
<Aside type="note">
All three sub-variants report the same version ID (`0x020D01`) to the host. The updater program selects the correct sub-variant based on hardware detection (likely a GPIO strap or I2C device ID read at flash time).
</Aside>
## Hardware Interface Evolution
<Tabs>
<TabItem label="FW1 -- I2C Bus">
### FW1 (v2.13.1) <Badge text="I2C" variant="note" />
FW1 targets the original SkyWalker-1 PCB with an **I2C-connected demodulator**. The FX2 communicates with the demod entirely through standard I2C master-mode transactions.
**Evidence from `FUN_CODE_0eea`:**
- Uses `FUN_CODE_23ae` (I2C START), `FUN_CODE_23ee` (I2C byte write), `FUN_CODE_23d0` (I2C address)
- Standard I2C retry with NACK detection
- Timer2-based I2C timeout (TR2 check in vendor handler)
- Reads back via `FUN_CODE_2164`
**Unique functions:**
- `FUN_CODE_0fc7` -- I2C write-with-retry (20 attempts via I2C bus)
- `FUN_CODE_1405` -- Tuner/demodulator identification via I2C + P1 port reads with signature matching
- `FUN_CODE_14b9` -- Calibrated delay function with CPUCS clock divider awareness
**Demodulator type detection** (from `FUN_CODE_1405`):
| Type Code | P1 Signature |
|-----------|--------------|
| Type 3 | `0xA5` or `0xB5` |
| Type 4 | `0x5A` |
| Type 5 | `0x5B` |
| Type 6 | `0x5C` |
</TabItem>
<TabItem label="FW2 -- Parallel Bus">
### FW2 (v2.13.2) <Badge text="Parallel" variant="caution" />
FW2 targets a revised PCB with a **parallel-bus connected demodulator**. The demod data port is connected directly to the FX2's P1, with P0 bits controlling bus signals.
**Evidence from `FUN_CODE_0eea`:**
- Reads demod type from address table (BANK1 pointer + offset)
- Uses `FUN_CODE_11b6` for demod selection
- Toggles P0 bits 6/7 for bus control (P0.6 = chip select, P0.7 = read strobe)
- Reads data from **P1 port** (8-bit parallel data bus)
- Single-phase read: one P1 read per bus cycle
**Bus protocol (decompiled):**
```c title="FW2 parallel bus read"
uVar1 = P1; // Read data with one bus state
P0 |= 0x40; // Change control line
uVar2 = P1; // Read again with new state
FUN_CODE_1b2a(uVar2, uVar1); // Process both samples
```
**Configuration loading:**
- Loads 15 configuration bytes from external memory (`0xE080`--`0xE08E`) into demod registers (`0xE6C0`--`0xE6CD`)
- Same device signature matching as FW1 but via parallel bus (`P1 ^ 0x1D` check)
</TabItem>
<TabItem label="FW3 -- Enhanced Parallel">
### FW3 (v2.13.3) <Badge text="Enhanced" variant="success" />
FW3 targets a further revised PCB with the same parallel-bus architecture as FW2 but with a **different bus timing protocol**. Uses dual-phase reads with OR-accumulation.
**Evidence from `FUN_CODE_0eea`:**
- Initializes OR-accumulators: `DAT_INTMEM_3f = 0; DAT_INTMEM_40 = 0`
- Sets P0 | 0x80 once at start (not per-iteration like FW2)
- Two separate P1 reads per cycle with different P0.6 states
- OR-accumulates results before processing
**Bus protocol (decompiled):**
```c title="FW3 dual-phase parallel bus read"
DAT_INTMEM_3f = 0;
DAT_INTMEM_40 = 0; // Clear accumulators
// Phase 1: P0.6 high
P0 |= 0x44;
bVar2 = P1;
DAT_INTMEM_3f |= bVar2; // OR-accumulate
// Phase 2: P0.6 low
P0 &= ~0x40;
bVar2 = P1;
DAT_INTMEM_40 |= bVar2; // OR-accumulate
FUN_CODE_1b2a(0, DAT_INTMEM_3f, DAT_INTMEM_40);
```
**Why OR-accumulation?** This pattern suggests the demod chip variant has either:
- Open-drain outputs requiring multiple read cycles
- Bus settling time issues on the newer PCB layout
- A chip revision that serializes data across multiple bus phases
</TabItem>
</Tabs>
## Binary Distance Matrix
Byte-level differences between sub-variants:
| Pair | Different Bytes | Percentage Different |
|------|----------------:|---------------------:|
| FW1 vs FW2 | 3,993 | 42.8% |
| FW1 vs FW3 | 3,789 | 40.6% |
| FW2 vs FW3 | **1,525** | **16.5%** |
FW2 and FW3 are 83.5% identical at the byte level, confirming they share the same parallel-bus architecture. FW1 diverges significantly because it uses a completely different bus interface (I2C vs. parallel).
## Memory Comparison at Key Offsets
### Identical Regions
These regions are byte-identical across all three sub-variants:
| Address Range | Content |
|---------------|---------|
| `0x0000`--`0x000F` | RESET vector (`LJMP 0x170D`), INT0 handler |
| `0x0B88`--`0x0B9F` | Init table (same XRAM register initialization) |
| `0x06D9`--`0x06F0` | Generic memory access utilities |
| `0x1740`--`0x174F` | Bit manipulation lookup table |
### Critical Divergence: `CODE:0EEA`
This is where the three sub-variants diverge most dramatically:
```
FW1: 8f44 8c45 8d46 8b47 754a14 e544 b451...
(I2C transfer parameters in registers)
FW2: 753e14 e50d 240a f582 e435 0cf5 83e0...
(reads from DPTR+offset table)
FW3: 753e14 e4f5 3ff5 40 e50d 240a f582...
(similar to FW2 + accumulator initialization)
```
FW1's `FUN_CODE_0eea` is a standard I2C master transfer function. FW2/FW3's version is a parallel bus demodulator interface.
### Thunk Target Divergence (`CODE:1500`)
```
FW1: 02 2252 00 02 22dd 00 02 22c7 00 02 226a 00
FW2: 02 228d 00 02 2318 00 02 2302 00 02 22a5 00
FW3: 02 228d 00 02 2318 00 02 2302 00 02 22a5 00
```
FW2 and FW3 share identical interrupt handler targets. FW1 jumps to different addresses, reflecting its different internal function layout.
## Detailed Differences
### Stack Pointer and Status Register
| Property | FW1 | FW2 | FW3 |
|----------|-----|-----|-----|
| SP value | `0x50` | `0x50` | `0x52` |
| Status IRAM | `0x4F` | `0x4F` | `0x51` |
| I2C buffer IRAM | `0x48`/`0x49` | `0x48`/`0x49` | `0x4A`/`0x4B` |
FW3 pushes the stack pointer up by 2 bytes to make room for the additional status register at IRAM `0x51`. The 2-byte SP difference exactly accounts for moving the status register from `0x4F` to `0x51`.
### P0 Init Value
| Variant | P0 Init | Binary | Difference |
|---------|---------|--------|------------|
| FW1/FW2 | `0xA4` | `1010 0100` | Bit 2 = 1 |
| FW3 | `0xA0` | `1010 0000` | Bit 2 = 0 |
P0 bit 2 controls a GPIO signal likely related to demodulator interface mode or reset polarity on the FW3 target PCB.
### Vendor Handler Differences
| Feature | FW1 | FW2/FW3 |
|---------|-----|---------|
| Case `0x3D3` | TR2 timer check (I2C timeout) | OR operation (parallel bus) |
| Case `0x421`-`0x423` | Simple check | P2.1 write + rotate-left (bus direction) |
| Error path | `func_0x06e4` | `DAT=0x0` |
FW1's timer-based case is used for I2C bus timeout recovery. FW2/FW3's rotate-left and P2.1 write is a parallel bus data direction control.
## Hardware Progression Theory
The three sub-variants represent an evolutionary progression:
1. **FW1 (v2.13.1)**: Original design with I2C-connected demodulator. Simple interface but limited in bandwidth. The FX2 acts purely as an I2C master bridge.
2. **FW2 (v2.13.2)**: Redesigned with parallel-bus demodulator for higher throughput. P1 carries 8-bit data, P0 provides control signals. External calibration data at `0xE080`--`0xE08E`.
3. **FW3 (v2.13.3)**: Refined parallel interface for a newer demod silicon revision. Dual-phase reads with OR-accumulation handle bus timing differences. Additional IRAM state tracking (SP bumped to `0x52`).
All three support the same modulation types (DVB-S QPSK, Turbo QPSK/8PSK/16QAM, DCII, DSS) and the same demod type codes (3--6). The differences are purely hardware interface, not feature set.

184
site/src/content/docs/firmware/kernel-fw01.mdx Normal file
View File

@ -0,0 +1,184 @@
---
title: Kernel FW01 Analysis
description: Analysis of the dvb-usb-gp8psk-01.fw firmware format, loading mechanism, and why SkyWalker-1 does not need it.
---
import { Steps, Badge, Aside, Tabs, TabItem, FileTree } from '@astrojs/starlight/components';
The Linux kernel `dvb_usb_gp8psk` driver references two firmware files: `dvb-usb-gp8psk-01.fw` (FX2 microcontroller code) and `dvb-usb-gp8psk-02.fw` (BCM4500 demodulator code). Neither file was ever open-sourced or included in the `linux-firmware` repository. The SkyWalker-1 does not need them.
## Firmware File Status
| File | Purpose | Available? | Needed by SkyWalker-1? |
|------|---------|------------|----------------------|
| `dvb-usb-gp8psk-01.fw` | FX2 RAM code | **Not in linux-firmware** | No |
| `dvb-usb-gp8psk-02.fw` | BCM4500 demod code | **Not in linux-firmware** | No |
Standard locations checked:
| Path | Result |
|------|--------|
| `/lib/firmware/dvb-usb-gp8psk-01.fw` | Not found |
| `/lib/firmware/dvb-usb-gp8psk-02.fw` | Not found |
| `linux-firmware` WHENCE manifest | No gp8psk entry |
| Kernel `scripts/get_dvb_firmware` | No gp8psk handler |
| `pacman -F dvb-usb-gp8psk-01.fw` | No package provides it |
<Aside type="note">
The gp8psk firmware was presumably distributed by Genpix Electronics with their Windows BDA driver installer. It was never contributed to the Linux firmware collection.
</Aside>
## Why SkyWalker-1 Works Without Firmware Files
The answer is in the kernel driver's device table. Only Rev.1 Cold devices (PID `0x0200`) have a `cold_ids` entry, which triggers firmware download:
```c title="Kernel device properties (from gp8psk.c)"
.devices = {
{ .name = "Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver",
.cold_ids = { &gp8psk_usb_table[GENPIX_8PSK_REV_1_COLD], NULL },
.warm_ids = { &gp8psk_usb_table[GENPIX_8PSK_REV_1_WARM], NULL },
},
{ .name = "Genpix SkyWalker-1 DVB-S receiver",
.cold_ids = { NULL }, // <-- NO cold_ids: skip firmware
.warm_ids = { &gp8psk_usb_table[GENPIX_SKYWALKER_1], NULL },
},
// ...
}
```
When `cold_ids` is NULL, the DVB-USB framework skips firmware download entirely. The SkyWalker-1 boots from its onboard EEPROM and enumerates directly as a "warm" device.
| Device | PID | Needs FW01? | Needs FW02? | Boot Source |
|--------|-----|-------------|-------------|-------------|
| Rev.1 Cold | `0x0200` | **Yes** | -- | RAM (empty) |
| Rev.1 Warm | `0x0201` | No | **Yes** | RAM (FW01 loaded) |
| Rev.2 | `0x0202` | No | No | EEPROM |
| SkyWalker-1 | `0x0203` | No | No | EEPROM |
| SkyWalker CW3K | `0x0206` | No | No | EEPROM |
## FW01 Loading Mechanism
For Rev.1 Cold devices, the firmware loading follows this sequence:
<Steps>
1. **DVB-USB framework** matches the USB VID:PID against `cold_ids` and calls `dvb_usb_download_firmware()`
2. **Kernel requests firmware** via `request_firmware("dvb-usb-gp8psk-01.fw", ...)` from the userspace firmware loader
3. **Cypress FX2 loader** (`usb_cypress_load_firmware()`) halts the FX2 CPU by writing `0x01` to CPUCS register (`0xE600`) via the 0xA0 vendor request
4. **Hexline records** are parsed and written to FX2 RAM via USB control transfers (0xA0 vendor request)
5. **FX2 CPU restarted** by writing `0x00` to CPUCS. The device re-enumerates with a new PID (0x0201, "warm")
6. **DVB-USB framework** re-matches the new PID against `warm_ids` and proceeds to frontend attach
</Steps>
The 0xA0 vendor request is handled by the FX2's built-in silicon boot ROM, which provides RAM read/write access regardless of whether user firmware is running. This is the same mechanism used by the custom firmware's `fw_load.py` tool.
## FW01 Binary Hexline Format
The kernel's `dvb_usb_get_hexline()` parser expects a compact binary representation of Intel HEX records. This is **not** standard Intel HEX text (`:10000000...`), nor the kernel's `ihex_binrec` format from `<linux/ihex.h>`.
### Record Structure
```
Offset Size Field
------ ---- -----
0 1 len - Number of data bytes
1 1 addr_lo - Target address low byte
2 1 addr_hi - Target address high byte
3 1 type - Record type
4 len data[] - Payload bytes
4+len 1 chk - Checksum byte
Total per record: len + 5 bytes
```
### Record Types
| Type | Name | Purpose |
|------|------|---------|
| `0x00` | Data | Code/data bytes for FX2 RAM |
| `0x01` | EOF | End of file |
| `0x04` | Extended Address | Sets upper 16 bits of target address |
## FW02 Chunk Format (BCM4500 Firmware)
FW02 is only relevant for Rev.1 Warm devices (PID `0x0201`). It uses a custom chunk protocol:
```
Chunk format:
Byte 0: payload_length (N)
Bytes 1-3: header/address bytes
Bytes 4..N+3: payload data
Terminator: single byte 0xFF
Maximum chunk size: 64 bytes (USB control transfer limit)
```
The loading sequence:
<Steps>
1. **Initiate transfer**: Send `LOAD_BCM4500` command (`0x88`, `wValue=1`)
2. **Download chunks**: Iterate through firmware data, sending each chunk via `dvb_usb_generic_write()` on bulk endpoint `0x01`
3. **Detect end**: Stop when a byte with value `0xFF` is encountered
</Steps>
```c title="BCM4500 firmware loading (from gp8psk.c)"
ptr = fw_data;
while (ptr[0] != 0xFF) {
chunk_size = ptr[0] + 4;
if (chunk_size > 64) {
// Error: chunk too large
}
usb_control_msg(device, USB_SNDCTRLPIPE, 0, ...,
buf, chunk_size, 2000);
ptr += chunk_size;
}
```
<Aside type="note">
On the SkyWalker-1, command `0x88` (`LOAD_BCM4500`) routes to the STALL handler in all firmware versions -- the BCM4500 firmware is burned into ROM. The kernel driver only attempts this command for Rev.1 Warm devices after checking that `bm8pskFW_Loaded` (bit 1 of `GET_8PSK_CONFIG`) is not set.
</Aside>
## C2 EEPROM Format vs Kernel Hexline
The firmware as stored in the SkyWalker-1's EEPROM uses Cypress C2 format, which is structurally different from the kernel's binary hexline format. They carry identical payload data but are different containers.
| Property | C2 (EEPROM) | Hexline (Kernel FW01) |
|----------|-------------|-----------------------|
| Header | 8-byte C2 with VID/PID/DID | None |
| Address encoding | Big-endian 16-bit per segment | Little-endian split (lo, hi) per record |
| Data chunking | 1023-byte segments | Typically 16-byte records |
| Record overhead | 4 bytes per segment | 5 bytes per record |
| Terminator | `0x80xx` + entry point | Type `0x01` EOF record |
| Entry point | Explicit in terminator | Implicit (CPUCS at `0xE600`) |
A C2 file can theoretically be converted to hexline format by:
1. Stripping the 8-byte C2 header
2. Splitting each segment into 16-byte records with type `0x00`
3. Appending an EOF record (len=0, type=`0x01`)
For the v2.06 EEPROM (9,472 code bytes), this would produce approximately 12,442 bytes in hexline format.
See the [Storage Formats](/firmware/storage-formats/) page for detailed C2 format documentation.
## Kernel dmesg Output
When the SkyWalker-1 is connected, the kernel logs:
```
gp8psk: FW Version = 2.06.4 (0x20604) Build 2007/07/13
gp8psk: usb in 149 operation failed.
gp8psk: failed to get FPGA version
gp8psk_fe: Frontend attached
gp8psk: found Genpix USB device pID = 203 (hex)
```
The "failed to get FPGA version" error is command `0x95` (`GET_FPGA_VERS`, decimal 149) returning an error on some units. Despite the name, there is no FPGA on the SkyWalker-1 -- this command reads a hardware platform ID from the EEPROM. The driver logs the failure but continues normally.

210
site/src/content/docs/firmware/rev2-analysis.mdx Normal file
View File

@ -0,0 +1,210 @@
---
title: Rev.2 Firmware Analysis
description: Deep analysis of the Rev.2 v2.10.4 firmware variant with 107 functions and transitional architecture.
---
import { Badge, Aside, Tabs, TabItem } from '@astrojs/starlight/components';
The Rev.2 v2.10.4 firmware targets the Rev.2 hardware variant (PID `0x0202`) and contains **107 functions** -- the most of any firmware version. Despite this, it produces the smallest binary (8,843 bytes) due to aggressive function decomposition into small helper routines.
## Architectural Position
Rev.2 sits architecturally between v2.06 and v2.13:
| Aspect | v2.06 | Rev.2 v2.10 | v2.13 |
|--------|-------|-------------|-------|
| INT0 behavior | USB re-enumeration | USB re-enumeration | Demod polling |
| Descriptor base | `0x1200` | `0x0E00` | `0x0E00` |
| Stack pointer | `0x72` | `0x4F` | `0x50` |
| Vendor command range | `0x80`--`0x9D` (30) | `0x80`--`0x9A` (27) | `0x80`--`0x9D` (30) |
| Demod probe at boot | No | No | Yes |
| Retry loops | No | No | Yes |
| Function count | 61 | **107** | 82-88 |
| Binary size | 9,472 bytes | **8,843 bytes** | 9,322 bytes |
<Aside type="note">
The Rev.2 already adopted v2.13's descriptor base offset (`0x0E00`) and similar stack pointer pattern, but retained v2.06's INT0 USB re-enumeration behavior. It lacks v2.13's demodulator polling, retry logic, and the three additional vendor commands (`0x9B`--`0x9D` are out of range).
</Aside>
## Why 107 Functions?
The high function count is driven by three factors:
1. **Granular decomposition**: Rev.2 breaks large operations into many small helper functions (10-30 bytes each), where v2.06 inlines the same logic and v2.13 recombines it differently.
2. **Massive configuration dispatcher**: `FUN_CODE_0800` is 874 bytes and contains an embedded copy of the main loop, causing Ghidra to count additional entry points as separate functions.
3. **Extra I2C/demodulator helper chains**: GPIO control primitives, hardware-polling wait loops, and I2C bus management exist as individual callable units rather than being inlined.
## Function Inventory Overview
The 107 functions are organized into logical groups:
### Vector Table and ISR Region (0x0000--0x0055)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x0000` | `RESET_vector` | 3 | Jump to `main` at `0x155F` |
| `0x0003` | `INT0_ISR` | 12 | INT0 handler -- USB re-enumeration |
| `0x000F` | `INT0_ISR_bit_clear` | 36 | CPUCS pulse, IRQ clear, delay |
| `0x0033` | `INT2_USB_GPIF_vector` | 3 | Clears CCON.4 (PCA timer) |
| `0x0036` | `i2c_exchange_byte` | 5 | I2C byte exchange primitive |
| `0x003B` | `I2C_ISR` | 8 | I2C interrupt handler |
| `0x0043` | `INT4_FX2_vector` | 8 | Sets `_0_1` flag, clears EXIF.4 |
| `0x004B` | `INT5_FX2_vector` | 3 | Empty (RETI) |
| `0x0053` | `INT6_FX2_vector` | 3 | Sets `_0_1` flag, clears EXIF.4 |
### Vendor Command Dispatch (0x0056--0x0319)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x0056` | `vendor_cmd_dispatch` | 342 | Range check `0x80`--`0x9A`, jump table at `0x0076` |
| `0x01AC` | GET_8PSK_CONFIG handler | 361 | Reads config byte, calls LNB probe |
| `0x0315` | `vendor_cmd_stall` | 2 | Stall handler (empty RET) |
| `0x0319` | Standard USB request handler | 869 | Switch for `bRequest` `0x00`--`0x0B` |
### Configuration and Tuning (0x0800--0x09A8)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x0800` | Config/tuning dispatcher | **874** | 128-entry switch on demod type, embedded main loop |
| `0x09A9` | Main init + main loop | 699 | Hardware init, infinite poll loop |
### BCM4500 and GPIF (0x0C64--0x0F00)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x0C64` | BCM4500 firmware loader | 280 | I2C block transfer with address tracking |
| `0x0D7C` | GPIF/slave FIFO config | 128 | Enable/disable streaming mode |
| `0x0F00` | I2C multi-byte read | 256 | Parameter setup for bus transfer |
### DiSEqC Implementation (0x07D1, 0x1D5E--0x1E3D)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x07D1` | `DiSEqC byte transmit` | 45 | 8 data bits + odd parity via **P0.4** |
| `0x1D5E` | DiSEqC message sender | 59 | Iterates bytes, calls bit-bang per byte |
| `0x1E3D` | DiSEqC byte wrapper | 54 | Sets P0.2, adds inter-byte delay |
| `0x213C` | DiSEqC bit symbol | 22 | Carrier on/off via P0.3, data via P0.4 |
| `0x20E2` | 22 kHz tone burst | 23 | P0.3 ON, 25 ticks, P0.3 OFF |
| `0x225F` | Timer2 tick wait | 6 | TF2 poll and clear (500 us tick) |
<Aside type="note">
Rev.2 uses **P0.4** as the DiSEqC data pin, unlike v2.06 (P0.7) and v2.13 (P0.0). The carrier pin P0.3 remains the same across all versions. This pin reassignment reflects the different PCB layout of the Rev.2 board.
</Aside>
### LNB and GPIO Control (0x1F5C--0x2038)
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x1F5C` | LNB voltage I2C select | 41 | Probes I2C device `0x60` or address from `0xE0B6` |
| `0x1FCF` | GPIO pin controller | 46 | Sets P0.6, P0.0, P3.4 based on parameter bits |
| `0x2038` | GPIO clock strobe | 51 | Calls pin controller 3 times (setup, clock, cleanup) |
| `0x21B1` | LNB voltage select | 17 | Sets/clears P0.4, updates config bit 5 |
| `0x21C2` | 22 kHz tone enable | 17 | Sets/clears P0.3, updates config bit 4 |
| `0x21D3` | DiSEqC port direction | 17 | Sets/clears P3.6, updates config bit 3 |
### I2C Bus Management (0x19F4--0x1B90)
Rev.2 decomposes I2C operations into particularly fine-grained functions:
| Address | Name | Size | Role |
|---------|------|-----:|------|
| `0x19F4` | I2C bus controller | 92 | Manages SDA/SCL via XRAM `0xE678` |
| `0x1A50` | I2C address select + start | 83 | START condition generation |
| `0x1AA3` | I2C stop + cleanup | 82 | STOP condition and bus release |
| `0x1AF5` | I2C address write helper | 9 | Writes device address byte |
| `0x1B01` | I2C byte-level transfer | 67 | Single byte send/receive |
| `0x1B44` | I2C ACK/NAK handling | 76 | Acknowledge detection |
| `0x1B90` | I2C bus reset/recovery | 74 | Error recovery sequence |
| `0x1F06` | I2C completion wait | 43 | Polls XRAM `0xE678` bit 0 with 16-bit timeout |
| `0x1F85` | I2C completion wait (2-flag) | 37 | Polls bits 0 and 2 |
| `0x2000` | I2C busy wait | 30 | Polls XRAM `0xE678` bit 6 with timeout |
## Rev.2-Specific Features
### GPIO Pin Controller (`FUN_CODE_1fcf`)
A unique function that provides parameterized GPIO control through a bit-field interface:
```c title="GPIO pin controller (decompiled)"
void gpio_pin_controller(BYTE param) {
if (param & 0x02) P0 |= 0x01; // P0.0
else P0 &= ~0x01;
if (param & 0x04) P0 |= 0x40; // P0.6
else P0 &= ~0x40;
if (param & 0x08) P3 |= 0x10; // P3.4
else P3 &= ~0x10;
}
```
This function is called via `FUN_CODE_2038` (GPIO clock strobe) which invokes it three times per cycle -- setup, clock edge, and cleanup -- suggesting it controls a clocked peripheral interface.
### Descriptor Version Checker (`FUN_CODE_1f31`)
Walks a USB descriptor chain checking whether `descriptor_byte + 1 == 0x03`, enabling hardware-revision-aware code paths. This mechanism appears in a simplified form in v2.13 as the `_1_3` flag check.
### Prototype Commands 0x99/0x9A
Commands 0x99 and 0x9A exist in Rev.2 as partial prototype implementations, before becoming fully functional in v2.13:
| Command | Rev.2 Behavior | v2.13 Behavior |
|---------|---------------|---------------|
| `0x99` | Prototype -- limited status read | Full GET_DEMOD_STATUS (reads BCM4500 reg `0xF9`) |
| `0x9A` | Prototype -- basic init call | Full INIT_DEMOD (3-attempt re-init with flag check) |
## Cross-Version Function Mapping
Key Rev.2 functions and their counterparts in other versions:
| Rev.2 Function | Role | v2.06 | v2.13 |
|----------------|------|-------|-------|
| `0x155F` main | RESET entry, IRAM clear | `0x188D` | `0x170D` |
| `0x09A9` main init | Init + main loop | `0x09A7` | `0x0800` |
| `0x10D9` USB setup | Descriptor/peripheral init | `0x13C3` | `0x11AB` |
| `0x0056` vendor dispatch | Vendor command dispatcher | `0x0056` | `0x0056` |
| `0x0C64` BCM4500 loader | Firmware block transfer | `0x0DDD` | `0x0CA4` |
| `0x0D7C` GPIF/FIFO | Streaming management | `0x1919` | `0x1800` |
| `0x1BDA` delay | Clock-compensated delay | `0x1DFB` | `0x14B9` |
## GPIO Differences from SkyWalker-1
The Rev.2 board has a different GPIO assignment from the standard SkyWalker-1:
| Pin | Rev.2 v2.10 | v2.06 / v2.13 |
|-----|-------------|---------------|
| P0.0 | LNB control (cmd `0x97`) | DiSEqC data (v2.13) / unused (v2.06) |
| P0.4 | LNB voltage **+ DiSEqC data** | LNB voltage only |
| P0.5 | GPIO status input (cmd `0x98`) | BCM4500 RESET |
| P0.6 | GPIO control (cmd `0x97`) | Unused |
| P0.7 | Streaming indicator | DiSEqC data (v2.06) / streaming (v2.13) |
The most significant difference is that Rev.2 multiplexes DiSEqC data onto the LNB voltage pin (P0.4), and the BCM4500 RESET function on P0.5 is replaced by a GPIO status input.
## Main Loop Structure
The Rev.2 main loop follows the same pattern as other versions but with the event handling delegated to `FUN_CODE_201e`:
```c title="Main loop poll (simplified)"
void main_loop(void) {
// Process init table from CODE:0B48
// Call USB/peripheral setup
// Enable interrupts
while (1) {
if (sudav_flag) {
handle_setupdata();
sudav_flag = 0;
}
FUN_CODE_201e(); // Delegated I2C config read/write
if (gpif_flag) {
handle_gpif_event();
gpif_flag = 0;
} else {
PCON |= 0x01; // CPU idle
}
}
}
```

256
site/src/content/docs/firmware/storage-formats.mdx Normal file
View File

@ -0,0 +1,256 @@
---
title: Firmware Storage Formats
description: Cypress C2 EEPROM boot format, kernel hexline format, and flat binary extraction.
---
import { Tabs, TabItem, Aside, FileTree, Badge } from '@astrojs/starlight/components';
The SkyWalker-1 firmware exists in multiple container formats depending on context: the onboard EEPROM uses the Cypress C2 IIC boot format, the Linux kernel expects a custom binary hexline format, and analysis tools work with flat extracted binaries.
## Format Overview
<Tabs>
<TabItem label="C2 EEPROM">
### Cypress C2 IIC Second-Stage Boot Format <Badge text="Device Storage" variant="note" />
This is the native format stored in the SkyWalker-1's onboard I2C EEPROM. The FX2's internal boot ROM reads this format on power-up.
The `0xC2` marker byte in the header identifies this as "external memory, large code model" -- it tells the boot ROM to load code from the EEPROM into internal RAM using the segment map that follows.
</TabItem>
<TabItem label="Hexline">
### Kernel Binary Hexline Format <Badge text="Linux Driver" variant="caution" />
Used only by `dvb-usb-gp8psk-01.fw` for Rev.1 Cold devices. This is a compact binary representation of Intel HEX records parsed by `dvb_usb_get_hexline()` in the kernel. It is NOT standard Intel HEX text.
</TabItem>
<TabItem label="Flat Binary">
### Flat Extracted Binary <Badge text="Analysis" variant="success" />
Raw 8051 machine code extracted from C2 segments. No headers or framing -- just code bytes at their target RAM addresses. Used for Ghidra analysis and binary diffing.
</TabItem>
</Tabs>
## C2 EEPROM Format
### Header Structure (8 bytes)
```
Offset Size Field Value (SkyWalker-1)
------ ---- ---------- -------------------
0x00 1 marker 0xC2 (external memory, large code model)
0x01 2 VID 0xC009 -> 0x09C0 (little-endian, Genpix)
0x03 2 PID 0x0302 -> 0x0203 (little-endian, SkyWalker-1)
0x05 2 DID 0x0000 (device ID, unused)
0x07 1 config 0x40 (400 kHz I2C bus speed)
```
The VID and PID in the C2 header determine the USB identifiers that the FX2 enumerates with after boot. This is how the kernel driver identifies the device model.
### Config Byte (offset 0x07)
| Value | I2C Speed | Notes |
|-------|-----------|-------|
| `0x00` | 100 kHz | Default if EEPROM missing |
| `0x20` | 200 kHz | |
| `0x40` | **400 kHz** | Used by SkyWalker-1 |
### Code Segment Structure
Following the 8-byte header, one or more code segments:
```
Offset Size Field
------ ---------- -----
0 2 seg_len (big-endian) -- number of data bytes
2 2 seg_addr (big-endian) -- target RAM address
4 seg_len data[] -- code/data bytes
```
Segments are packed contiguously. The 1023-byte maximum segment size is the limit of the FX2 boot ROM's internal I2C read buffer.
### Terminator
```
Offset Size Field
------ ---- -----
0 2 0x8001 -- high bit set signals terminator (length with MSB set)
2 2 entry -- entry point address (big-endian) = 0xE600 (CPUCS)
```
Writing to CPUCS (`0xE600`) with value `0x00` releases the CPU from reset and begins execution at the reset vector (`0x0000`).
## Decoded C2 Files
### Header Comparison
| File | VID | PID | DID | I2C Speed | Code Size |
|------|-----|-----|-----|-----------|-----------|
| `skywalker1_eeprom.bin` (v2.06) | `0x09C0` | **`0x0203`** | `0x0000` | 400 kHz | 9,472 bytes |
| `sw1_v213_fw_1_c2.bin` (v2.13.1) | `0x09C0` | **`0x0203`** | `0x0000` | 400 kHz | 9,322 bytes |
| `sw1_v213_fw_2_c2.bin` (v2.13.2) | `0x09C0` | **`0x0203`** | `0x0000` | 400 kHz | 9,377 bytes |
| `sw1_v213_fw_3_c2.bin` (v2.13.3) | `0x09C0` | **`0x0203`** | `0x0000` | 400 kHz | 9,369 bytes |
| `rev2_v210_fw_1_c2.bin` (Rev.2) | `0x09C0` | **`0x0202`** | `0x0000` | 400 kHz | 8,843 bytes |
<Aside type="note">
Rev.2 uses PID `0x0202` while all SkyWalker-1 variants use `0x0203`. This PID difference is the primary mechanism by which the kernel driver distinguishes hardware revisions. The DID field is unused (always `0x0000`).
</Aside>
### Segment Layout (SkyWalker-1 Variants)
All SkyWalker-1 C2 files use uniform 1023-byte segments (except the last):
| Segment | Address | Length | Notes |
|---------|---------|-------:|-------|
| 1 | `0x0000` | 1023 | Reset vector, interrupt handlers |
| 2 | `0x03FF` | 1023 | |
| 3 | `0x07FE` | 1023 | |
| 4 | `0x0BFD` | 1023 | |
| 5 | `0x0FFC` | 1023 | |
| 6 | `0x13FB` | 1023 | |
| 7 | `0x17FA` | 1023 | |
| 8 | `0x1BF9` | 1023 | |
| 9 | `0x1FF8` | 1023 | |
| 10 | `0x23F7` | varies | 115--265 bytes depending on version |
The address of each segment is exactly `previous_addr + 1023`, creating a contiguous mapping from `0x0000` to the end of the firmware image.
### Rev.2 Segment Layout
Rev.2 has only 9 segments (one fewer than SkyWalker-1 variants) because its firmware is smaller:
| Segment | Address | Length |
|---------|---------|-------:|
| 1 | `0x0000` | 1023 |
| 2 | `0x03FF` | 1023 |
| 3 | `0x07FE` | 1023 |
| 4 | `0x0BFD` | 1023 |
| 5 | `0x0FFC` | 1023 |
| 6 | `0x13FB` | 1023 |
| 7 | `0x17FA` | 1023 |
| 8 | `0x1BF9` | 1023 |
| 9 | `0x1FF8` | 659 |
## Kernel Binary Hexline Format
This format is used exclusively by `dvb-usb-gp8psk-01.fw` for loading firmware into Rev.1 Cold devices (PID `0x0200`). The SkyWalker-1 never uses this format at runtime.
### Record Structure
```
Offset Size Field
------ ---- -----
0 1 len Number of data bytes in this record
1 1 addr_lo Target address, low byte
2 1 addr_hi Target address, high byte
3 1 type Record type
4 len data[] Payload bytes
4+len 1 chk Checksum byte
Total per record: len + 5 bytes
```
### Record Types
| Type | Name | Purpose |
|------|------|---------|
| `0x00` | Data | Write data bytes to FX2 RAM at address `(addr_hi * 256 + addr_lo)` |
| `0x01` | EOF | End of file, no more records |
| `0x04` | Extended Linear Address | `data[0]:data[1]` = upper 16 bits of target address |
### Comparison With Other DVB-USB Firmware
Files from other DVB-USB devices confirm the format:
| File | Size | First Record |
|------|-----:|-------------|
| `dvb-usb-dib0700-1.20.fw` | 33,768 | len=2, addr=0x0000, type=0x04 |
| `dvb-usb-it9135-01.fw` | 8,128 | len=3, addr=0x0000, type=0x03 |
| `dvb-usb-it9135-02.fw` | 5,834 | len=3, addr=0x0000, type=0x03 |
## 64K Full EEPROM Dump
The complete EEPROM can be dumped as a 65,536-byte raw image. The firmware occupies the first ~10 KB; the remainder contains:
| Offset Range | Content |
|-------------|---------|
| `0x0000`--`0x0007` | C2 header (8 bytes) |
| `0x0008`--`0x25xx` | Code segments (varies by version) |
| `0x25xx`--`0x26xx` | C2 terminator |
| `0x2700`--`0x3FFF` | Padding / unused (typically `0xFF`) |
| `0x4000`--`0x7FFF` | Mirror/unused (some EEPROMs wrap at 32K) |
<Aside type="caution">
Not all 64K images are identical even for the same firmware version. The "unused" region after the terminator may contain artifacts from previous firmware flashes or EEPROM test patterns. Only the data from the C2 header through the terminator is meaningful.
</Aside>
## Format Conversion
### C2 to Flat Binary
Extract raw code from a C2 file by stripping headers:
```python title="C2 to flat binary extraction"
def c2_to_flat(c2_data):
"""Extract flat binary from C2 EEPROM format."""
pos = 8 # Skip 8-byte C2 header
flat = bytearray(0x10000) # 64K address space
while pos < len(c2_data):
seg_len = (c2_data[pos] << 8) | c2_data[pos + 1]
seg_addr = (c2_data[pos + 2] << 8) | c2_data[pos + 3]
pos += 4
if seg_len & 0x8000: # Terminator (high bit set)
break
flat[seg_addr:seg_addr + seg_len] = c2_data[pos:pos + seg_len]
pos += seg_len
return flat
```
### C2 to Kernel Hexline
Theoretical conversion for producing a `dvb-usb-gp8psk-01.fw` equivalent:
```python title="C2 to kernel hexline conversion"
def c2_to_hexline(c2_data):
"""Convert C2 EEPROM format to kernel binary hexline."""
records = bytearray()
flat = c2_to_flat(c2_data)
code_end = find_code_end(flat)
for addr in range(0, code_end, 16):
chunk = flat[addr:addr + 16]
rec_len = len(chunk)
addr_lo = addr & 0xFF
addr_hi = (addr >> 8) & 0xFF
rec_type = 0x00 # Data record
chk = (rec_len + addr_lo + addr_hi + rec_type
+ sum(chunk)) & 0xFF
records.extend([rec_len, addr_lo, addr_hi, rec_type])
records.extend(chunk)
records.append((~chk + 1) & 0xFF)
# EOF record
records.extend([0x00, 0x00, 0x00, 0x01, 0xFF])
return records
```
For the v2.06 firmware (9,472 code bytes), this produces approximately 12,442 bytes in hexline format.
## File Identification
Quick format identification by examining the first byte:
| First Byte | Format | Notes |
|------------|--------|-------|
| `0xC2` | C2 EEPROM | Standard SkyWalker-1 EEPROM dump |
| `0xC0` | C0 EEPROM | VID/PID-only header (no code segments) |
| `0x02` | Flat binary | Likely starts with `LJMP` instruction (`0x02 xx xx`) |
| Other | Hexline or unknown | Check record structure |

287
site/src/content/docs/firmware/version-comparison.mdx Normal file
View File

@ -0,0 +1,287 @@
---
title: Firmware Version Comparison
description: Side-by-side comparison of all known SkyWalker-1 firmware revisions including stock and custom builds.
---
import { Tabs, TabItem, Badge, Aside } from '@astrojs/starlight/components';
Five firmware versions have been analyzed through Ghidra reverse engineering and source code review. This page compares their architecture, features, and binary characteristics.
## Version Summary
| Firmware | Version ID | Build Date | Target PID | Functions | Binary Size | Stack Pointer |
|----------|-----------|------------|------------|-----------|-------------|---------------|
| v2.06.04 | `0x020604` | 2007-07-13 | `0x0203` | 61 | 9,472 bytes | `0x72` |
| Rev.2 v2.10.04 | `0x020A04` | 2010-03-12 | `0x0202` | 107 | 8,843 bytes | `0x4F` |
| v2.13.01 (FW1) | `0x020D01` | 2010-03-12 | `0x0203` | 82-88 | 9,322 bytes | `0x50` |
| v2.13.02 (FW2) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,377 bytes | `0x50` |
| v2.13.03 (FW3) | `0x020D01` | 2010-03-12 | `0x0203` | 83 | 9,369 bytes | `0x52` |
| Custom v3.01.0 | `0x030100` | 2026-02-12 | `0x0203` | N/A | ~3 KB (RAM) | N/A |
<Aside type="note">
Rev.2 v2.10 targets PID `0x0202` (a different product line). All other versions target `0x0203` (SkyWalker-1). The custom v3.01.0 is compiled with SDCC + fx2lib and loaded into FX2 RAM, not flashed to EEPROM.
</Aside>
## Version-by-Version Details
<Tabs>
<TabItem label="v2.06">
### v2.06.04 <Badge text="Stock" variant="note" />
The original SkyWalker-1 firmware extracted from the device's onboard EEPROM.
| Property | Value |
|----------|-------|
| Version ID | `0x020604` |
| Build date | 2007-07-13 |
| Functions | 61 |
| Binary size | 9,472 bytes |
| Stack pointer | `0x72` |
| Config byte IRAM | `0x6D` |
| Descriptor base | `0x1200` |
| Init table address | `CODE:0B46` |
| Vendor commands | 30 (`0x80`--`0x9D`) |
| DiSEqC data pin | P0.7 |
**Characteristics:**
- Simplest firmware with the fewest functions
- INT0 handler performs USB re-enumeration (CPUCS pulse)
- No demodulator probe at boot
- No retry loops or integrity verification
- BCM4500 status polling reads 3 registers (0xA2, 0xA8, 0xA4) up to 6 times
- Commands 0x99, 0x9A, 0x9C route to STALL
- Command 0x9D reads descriptor byte and sets mode flag based on hardware revision (4, 5, or 6)
</TabItem>
<TabItem label="Rev.2 v2.10">
### Rev.2 v2.10.04 <Badge text="Transitional" variant="caution" />
Firmware for the Rev.2 hardware variant (PID `0x0202`). Architecturally sits between v2.06 and v2.13.
| Property | Value |
|----------|-------|
| Version ID | `0x020A04` |
| Build date | 2010-03-12 |
| Functions | 107 (most of any version) |
| Binary size | 8,843 bytes (smallest) |
| Stack pointer | `0x4F` |
| Config byte IRAM | `0x4E` |
| Descriptor base | `0x0E00` |
| Init table address | `CODE:0B48` |
| Vendor commands | 27 (`0x80`--`0x9A`) |
| DiSEqC data pin | P0.4 |
**Characteristics:**
- Highest function count due to granular decomposition (10-30 byte helper functions)
- Smallest binary despite having the most functions
- Retained v2.06's INT0 USB re-enumeration behavior
- Already adopted v2.13's descriptor base (`0x0E00`) and similar stack pointer
- Contains `FUN_CODE_0800`: a massive 874-byte configuration dispatcher with embedded main loop
- Lacks v2.13's demodulator polling, retry loops, and additional vendor commands (0x9B--0x9D out of range)
- 0x99/0x9A present as prototype implementations
See the [Rev.2 Analysis](/firmware/rev2-analysis/) page for the complete 107-function inventory.
</TabItem>
<TabItem label="v2.13 FW1">
### v2.13.01 (FW1) <Badge text="Stock" variant="note" />
The most feature-complete stock firmware, targeting the original I2C-connected SkyWalker-1 hardware.
| Property | Value |
|----------|-------|
| Version ID | `0x020D01` |
| Build date | 2010-03-12 |
| Functions | 82-88 |
| Binary size | 9,322 bytes |
| Stack pointer | `0x50` |
| Config byte IRAM | `0x4F` |
| Descriptor base | `0x0E00` |
| Init table address | `CODE:0B88` |
| Vendor commands | 30 (`0x80`--`0x9D`) |
| DiSEqC data pin | P0.0 |
**New features over v2.06:**
- Three new vendor commands: `0x99` (GET_DEMOD_STATUS), `0x9A` (INIT_DEMOD), `0x9C` (DELAY_COMMAND)
- INT0 repurposed for demodulator availability polling (40 attempts at addresses 0x7F and 0x3F)
- USB re-enumeration moved to `FUN_CODE_2031` (called as normal function before main loop)
- Demodulator signature verification (`FUN_CODE_1799`) with 20 retry attempts
- Descriptor checksum verification (`FUN_CODE_1ca0`) with 20 retry attempts
- Hardware revision detection via descriptor byte (flag `_1_3`)
- Consolidated BCM4500 status polling (1 register instead of 3)
- Anti-tampering string at firmware offset 0x1880
See the [FW2.13 Variants](/firmware/fw213-variants/) page for sub-variant comparison.
</TabItem>
<TabItem label="Custom v3.01">
### Custom v3.01.0 <Badge text="Custom" variant="success" />
Open-source replacement firmware built with SDCC + fx2lib. RAM-loaded for testing.
| Property | Value |
|----------|-------|
| Version ID | `0x030100` |
| Build date | 2026-02-12 |
| Toolchain | SDCC + fx2lib |
| Source | `firmware/skywalker1.c` (1351 lines) |
| Binary size | ~3 KB |
| Load method | RAM upload via `tools/fw_load.py` |
| DiSEqC data pin | P0.7 (v2.06 assignment) |
**Additions over stock:**
- Seven new diagnostic commands (`0xB0`--`0xB6`)
- Incremental debug boot modes (wValue `0x80`--`0x85` for BOOT_8PSK)
- I2C timeout protection (6000-iteration countdown vs. infinite spin)
- I2C bus scan for device discovery
- Spectrum sweep and blind scan capabilities
- Raw BCM4500 register access
See the [Custom v3.01](/firmware/custom-v301/) page for full details.
</TabItem>
</Tabs>
## Architectural Differences
| Feature | v2.06 | Rev.2 v2.10 | v2.13 | Custom v3.01 |
|---------|-------|-------------|-------|--------------|
| Vendor commands | 30 | 27 | 30 | 30 stock + 7 custom |
| INT0 handler | USB re-enum | USB re-enum | Demod polling | N/A (fx2lib ISR) |
| Demod probe at boot | No | No | Yes (40 attempts) | Yes (with timeout) |
| Retry loops | No | No | Yes (20-attempt) | Yes (with timeout) |
| HW revision detect | No | Yes (descriptor walker) | Yes (flag `_1_3`) | No |
| DiSEqC data pin | P0.7 | P0.4 | P0.0 | P0.7 |
| Config byte IRAM addr | `0x6D` | `0x4E` | `0x4F` | C variable |
| BCM4500 status poll | 3 registers | 3 registers | 1 register | 1 register |
| I2C timeout | None | None | None | 6000-count |
| Anti-tampering | No | No | Yes | No |
| New commands | -- | 0x99/0x9A proto | 0x99, 0x9A, 0x9C | 0xB0--0xB6 |
| 0x9D behavior | HW revision mode | N/A (out of range) | Conditional demod reset | N/A |
## Kernel Version Constants
The Linux kernel driver defines two firmware version thresholds in `gp8psk-fe.h`:
```c title="Kernel firmware version constants"
GP8PSK_FW_REV1 = 0x020604 // v2.06.4
GP8PSK_FW_REV2 = 0x020704 // v2.07.4
```
If the firmware version reported by `GET_FW_VERS` (command `0x92`) is >= `GP8PSK_FW_REV2`, the kernel enables Rev.2-specific code paths. All v2.10 and v2.13 firmwares are newer than either constant.
## Binary Similarity Matrix
Byte-level comparison across the shared code length (percentage of identical bytes):
| | v2.06 | v2.13.1 | v2.13.2 | v2.13.3 | Rev.2 |
|---|---|---|---|---|---|
| **v2.06** | -- | 4.8% | 4.3% | 4.3% | 6.0% |
| **v2.13.1** | | -- | 57.2% | 59.4% | 8.0% |
| **v2.13.2** | | | -- | 83.5% | 5.8% |
| **v2.13.3** | | | | -- | 5.8% |
| **Rev.2** | | | | | -- |
<Aside type="note">
The extremely low similarity between major versions (4--8%) indicates complete recompilation with different linker configurations. Functions relocate to entirely different addresses even when the logic is identical. Only the vendor command dispatcher at `CODE:0056` maintains the same address across all versions.
</Aside>
## Key Function Correspondence
Functions that serve the same role but reside at different addresses:
| Role | v2.06 | Rev.2 | v2.13 |
|------|-------|-------|-------|
| RESET vector / main | `0x188D` | `0x155F` | `0x170D` |
| Main init + loop | `0x09A7` | `0x09A9` | `0x0800` |
| USB descriptor setup | `0x13C3` | `0x10D9` | `0x11AB` |
| Standard USB handler | `0x032A` | `0x0319` | `0x034E` |
| Vendor cmd dispatch | `0x0056` | `0x0056` | `0x0056` |
| Main loop poll | `0x2297` | -- | `0x21EC` |
| GPIF/FIFO management | `0x1919` | `0x0D7C` | `0x1800` |
| BCM4500 firmware loader | `0x0DDD` | `0x0C64` | `0x0CA4` |
| BCM4500 status polling | `0x2000` | -- | `0x208D` |
| Delay loop | `0x1DFB` | `0x1BDA` | `0x14B9` |
## INT0 Handler Evolution
The INT0 interrupt vector (`CODE:0003`) was repurposed between firmware generations:
<Tabs>
<TabItem label="v2.06 / Rev.2">
**USB Re-enumeration** -- pulses CPUCS bit 3 to trigger controlled USB disconnect/reconnect:
```c title="INT0 handler (v2.06 and Rev.2)"
void INT0_vec(void) {
if (flag == 0) CPUCS |= 0x08; // CPUCS bit 3
else CPUCS |= 0x0A; // CPUCS bits 3+1
delay(5, 0xDC); // ~1500 cycles
EPIRQ = 0xFF; // Clear endpoint IRQs
USBIRQ = 0xFF; // Clear USB IRQs
EXIF &= 0xEF; // Clear external interrupt flag
CPUCS &= 0xF7; // Clear CPUCS bit 3
}
```
</TabItem>
<TabItem label="v2.13">
**Demodulator Availability Polling** -- probes two I2C addresses up to 40 times:
```c title="INT0 handler (v2.13)"
void INT0_vector(void) {
for (counter = 0x28; counter != 0; counter--) {
byte result = I2C_read(0x7F);
if (result != 0x01) {
result = I2C_read(0x3F);
if (result != 0x01) break;
}
}
no_demod_flag = (counter == 0);
}
```
The USB re-enumeration logic was moved to `FUN_CODE_2031` and called as a normal function before the main loop.
</TabItem>
</Tabs>
## XRAM Initialization Table
All versions initialize FX2 peripheral registers from a CODE-space table at startup. The table format is identical: `[addr_hi] [addr_lo] [data_byte]` triplets terminated by `0x0000`.
| Firmware | Table Address | Key Registers Set |
|----------|--------------|-------------------|
| v2.06 | `CODE:0B46` | IFCONFIG, EP2CFG, EP2FIFOCFG, REVCTL, I2CTL |
| Rev.2 | `CODE:0B48` | Same set, 2 bytes later |
| v2.13 | `CODE:0B88` | Same set, different offsets |
All versions set the same final values: `IFCONFIG=0xEE`, `EP2CFG=0xE2`, `EP2FIFOCFG=0x0C`, `REVCTL=0x03`, `I2CTL=0x01`.
## Anti-Tampering (v2.13 Only)
All v2.13 sub-variants contain this string at firmware offset `0x1880`:
```
"Tampering is detected. Attempt is logged. Warranty is voided ! \n"
```
This is followed by I2C register write commands (`01 10 aa 82 02 41 41 83`). The mechanism is absent from v2.06, Rev.2, and the custom firmware.
## Version Identification
The `GET_FW_VERS` command (`0x92`) returns 6 bytes of hardcoded constants:
```
Byte 0: version minor_minor (e.g., 0x04)
Byte 1: version minor (e.g., 0x06)
Byte 2: version major (e.g., 0x02)
Byte 3: build day (e.g., 0x0D = 13)
Byte 4: build month (e.g., 0x07 = July)
Byte 5: build year - 2000 (e.g., 0x07 = 2007)
```
Full version = `byte[2] << 16 | byte[1] << 8 | byte[0]`. Build date = `(2000 + byte[5]) / byte[4] / byte[3]`.

131
site/src/content/docs/hardware/gpio-pinmap.mdx Normal file
View File

@ -0,0 +1,131 @@
---
title: GPIO Pin Map
description: Complete FX2 GPIO pin assignments across all firmware versions including stock and custom firmware.
---
import { Tabs, TabItem, Badge, Aside } from '@astrojs/starlight/components';
The Cypress FX2 uses three GPIO ports for hardware control on the SkyWalker-1: Port 0 (IOA), Port 3 (IOD), and Port B (XRAM-mapped IOB). Pin assignments differ significantly between firmware versions due to PCB revisions and design changes.
<Aside type="caution" title="Pin Assignments Vary By Firmware">
The DiSEqC data pin and several LNB control pins changed between firmware versions. Always verify which firmware version is running before driving GPIO pins directly.
</Aside>
## Port 0 / Port A (SFR 0x80, IOA)
<Tabs>
<TabItem label="Stock Firmware">
| Pin | v2.06 | Rev.2 v2.10 | v2.13 | Notes |
|-----|-------|-------------|-------|-------|
| P0.0 | -- | LNB control (0x97) | **DiSEqC data** | DiSEqC data pin moved across versions |
| P0.1 | Power enable | Power enable | Power enable | BCM4500 power supply enable |
| P0.2 | Power disable | Power disable (init=0x84) | Power disable | BCM4500 power supply disable |
| P0.3 | **22 kHz tone** | **22 kHz tone** | **22 kHz tone** | Gates external 22 kHz oscillator (all versions) |
| P0.4 | **LNB 13V/18V** | **LNB 13V/18V** + DiSEqC data | **LNB 13V/18V** | Also SET_DN_SWITCH bit-bang (all versions) |
| P0.5 | **BCM4500 RESET** | GPIO status input (0x98) | **BCM4500 RESET** | Reset and feedback pin |
| P0.6 | -- | GPIO control (0x97) | -- | LNB control on Rev.2 only |
| P0.7 | **DiSEqC data** | Streaming indicator | Streaming indicator | DiSEqC data on v2.06 only |
</TabItem>
<TabItem label="Custom v3.01.0">
| Pin | Custom v3.01.0 | Notes |
|-----|----------------|-------|
| P0.0 | -- | Unused |
| P0.1 | **Power enable** | BCM4500 power supply enable (HIGH = on) |
| P0.2 | **Power disable** | BCM4500 power supply disable (LOW = off) |
| P0.3 | **22 kHz tone** | Gates external 22 kHz oscillator |
| P0.4 | **LNB 13V/18V** | Voltage select: LOW = 13V, HIGH = 18V |
| P0.5 | **BCM4500 RESET** | LOW = reset asserted, HIGH = released |
| P0.6 | -- | Unused |
| P0.7 | **DiSEqC data** + streaming | DiSEqC data (matches v2.06); also streaming indicator |
</TabItem>
</Tabs>
## Port 3 / Port D (SFR 0xB0, IOD)
These pins are consistent across all firmware versions:
| Pin | Function | Active State | Notes |
|-----|----------|-------------|-------|
| P3.0 | Init HIGH | -- | Set during initialization |
| P3.4 | GPIO control | -- | Used by Rev.2 `FUN_CODE_1fcf` |
| P3.5 | **TS_EN** | LOW | Transport stream enable: LOW = active, HIGH = idle |
| P3.6 | **DVB mode** | -- | BCM4500 mode select; DiSEqC port direction (Rev.2) |
| P3.7 | BCM4500 control | HIGH (idle) | De-asserted (HIGH) when streaming stops |
<Aside type="caution" title="P3.5 During Boot">
P3.5 (TS_EN) must remain HIGH (idle) during the boot sequence and demodulator initialization. Driving it LOW before the BCM4500 is fully initialized may produce undefined behavior on the transport stream bus.
</Aside>
## Port B (XRAM-mapped IOB)
Port B is used exclusively by the internal debug commands 0x96--0x98. These commands are not used by the Linux or Windows drivers.
<Tabs>
<TabItem label="v2.06 / v2.13">
| Pin | Function | Command |
|-----|----------|---------|
| IOB.0 | GPIO status input | GET_GPIO_STATUS (0x98) |
| IOB.1 | LNB control line 1 | SET_GPIO_PINS (0x97) |
| IOB.2 | LNB control line 2 | SET_GPIO_PINS (0x97) |
| IOB.3 | LNB GPIO mode | SET_LNB_GPIO_MODE (0x96) |
| IOB.4 | -- | Unused |
</TabItem>
<TabItem label="Rev.2 v2.10">
| Pin | Function | Command |
|-----|----------|---------|
| IOB.0 | -- | Unused |
| IOB.1 | -- | Unused |
| IOB.2 | -- | Unused |
| IOB.3 | -- | Unused |
| IOB.4 | LNB GPIO mode + control | SET_LNB_GPIO_MODE (0x96) + SET_GPIO_PINS (0x97) |
Rev.2 moved LNB control from Port B to Port A (P0.6, P0.0).
</TabItem>
</Tabs>
## DiSEqC Data Pin Summary
The DiSEqC data pin assignment is the most significant change between firmware versions. The carrier pin (P0.3) remains constant.
| Firmware Version | Data Pin | Carrier Pin |
|-----------------|----------|-------------|
| v2.06 | P0.7 | P0.3 |
| Rev.2 v2.10 | P0.4 | P0.3 |
| v2.13 | P0.0 | P0.3 |
| Custom v3.01.0 | P0.7 | P0.3 |
The data pin is used only internally by the firmware's Manchester encoding logic. It controls whether the 22 kHz carrier gate signal (on P0.3) is cut short or held for the full bit period during DiSEqC transmission. See [DiSEqC Protocol](/lnb-diseqc/diseqc-protocol/) for the encoding details.
## Initial GPIO State
On power-up, the FX2 initialization code sets:
| Register | Value | Decode |
|----------|-------|--------|
| IOA (P0) | 0x84 | P0.7=1 (idle), P0.2=1 (power disable active) |
| IOD (P3) | 0xE1 | P3.7:5=1 (all control lines idle), P3.0=1 |
| OEA | 0xBE | P0.1-5,7 configured as outputs |
These initial states ensure:
- The BCM4500 is held in reset (P0.5 driven by output enable, but P0 init has it low after OEA is set)
- The transport stream bus is idle (P3.5 = HIGH)
- The streaming indicator is off (P0.7 = HIGH)
- All BCM4500 control lines are de-asserted (P3.7:5 = 1)
## Streaming GPIO State Changes
| Pin | SFR | Direction | During Streaming | Streaming Stopped | Function |
|-----|-----|-----------|-----------------|-------------------|----------|
| P0.2 | 0x80 | Output | Set during init | -- | BCM4500 config |
| P0.7 | 0x80 | Output | **LOW** | HIGH | Streaming status indicator |
| P3.5 | 0xB0 | Output | Pulsed LOW | HIGH | BCM4500 TS_EN (transport stream enable) |
| P3.6 | 0xB0 | Output | Controlled | HIGH | BCM4500 DVB mode control |
| P3.7 | 0xB0 | Output | Controlled | HIGH | BCM4500 control line |

94
site/src/content/docs/hardware/overview.mdx Normal file
View File

@ -0,0 +1,94 @@
---
title: Hardware Overview
description: Board layout, chip identification, supported modulations, and architecture of the Genpix SkyWalker-1 DVB-S USB 2.0 receiver.
---
import { Tabs, TabItem, Badge, Aside, CardGrid, Card } from '@astrojs/starlight/components';
The Genpix SkyWalker-1 is a standalone USB 2.0 DVB-S satellite receiver built around two primary ICs: a Cypress FX2LP USB microcontroller and a Broadcom BCM4500 satellite demodulator. The FX2 handles all USB communication, LNB control, and DiSEqC signaling, while the BCM4500 performs RF demodulation, forward error correction, and outputs an MPEG-2 transport stream on an 8-bit parallel bus.
## Core Components
| Component | Part Number | Role |
|-----------|-------------|------|
| MCU | Cypress CY7C68013A (FX2LP) | USB 2.0 Hi-Speed controller, 8051 core at 48 MHz |
| Demodulator | Broadcom BCM4500 | DVB-S / Turbo / DCII / DSS demodulator, 128-pin MQFP |
| EEPROM | 24Cxx-family (I2C address 0x51) | FX2 firmware storage, serial number, calibration data |
| Tuner/LNB | Unknown IC (I2C address 0x10) | Tuner or LNB controller on shared I2C bus |
## Board Block Diagram
```
+--[ I2C EEPROM 0x51 ]
|
USB 2.0 HS | I2C Bus (400 kHz)
Host PC <----> [ CY7C68013A FX2LP ] <-----> [ BCM4500 Demod 0x08 ]
| 8051 @ 48 MHz | |
| GPIF Engine |<-----------+ 8-bit parallel TS
| EP2 Bulk IN |
| GPIO (P0/P3) |---> [ 22 kHz Osc ] ---> LNB/Coax
| |---> [ LNB Voltage Ctrl ]
+-----------------+
|
+--[ Tuner/LNB IC 0x10 ]
```
The GPIF engine inside the FX2 transfers the BCM4500's transport stream output directly into USB bulk endpoint EP2 with zero firmware intervention in the data path. This hardware-managed pipeline provides approximately 5x bandwidth headroom over the maximum DVB-S transport stream rate.
## Supported Modulations
| Index | Modulation | Constant | FEC Family |
|-------|-----------|----------|------------|
| 0 | DVB-S QPSK <Badge text="Standard" variant="note" /> | `ADV_MOD_DVB_QPSK` | Viterbi + Reed-Solomon |
| 1 | Turbo-coded QPSK <Badge text="Turbo" variant="success" /> | `ADV_MOD_TURBO_QPSK` | Turbo |
| 2 | Turbo-coded 8PSK <Badge text="Turbo" variant="success" /> | `ADV_MOD_TURBO_8PSK` | Turbo |
| 3 | Turbo-coded 16QAM <Badge text="Turbo" variant="success" /> | `ADV_MOD_TURBO_16QAM` | Turbo |
| 4 | Digicipher II Combo <Badge text="DCII" variant="caution" /> | `ADV_MOD_DCII_C_QPSK` | DCII |
| 5 | Digicipher II I-stream (split) <Badge text="DCII" variant="caution" /> | `ADV_MOD_DCII_I_QPSK` | DCII |
| 6 | Digicipher II Q-stream (split) <Badge text="DCII" variant="caution" /> | `ADV_MOD_DCII_Q_QPSK` | DCII |
| 7 | Digicipher II Offset QPSK <Badge text="DCII" variant="caution" /> | `ADV_MOD_DCII_C_OQPSK` | DCII |
| 8 | DSS QPSK <Badge text="DSS" variant="note" /> | `ADV_MOD_DSS_QPSK` | Viterbi + Reed-Solomon |
| 9 | DVB-S BPSK <Badge text="Standard" variant="note" /> | `ADV_MOD_DVB_BPSK` | Viterbi + Reed-Solomon |
<Aside type="caution" title="DVB-S2 Not Supported">
DVB-S2 is **not** supported by the SkyWalker-1. This is a fundamental hardware limitation of the BCM4500 demodulator silicon -- it was designed before the DVB-S2 standard was ratified (March 2005) and contains no LDPC or BCH decoder hardware. No firmware update can add DVB-S2 support. See the [DVB-S2 Incompatibility](/driver/dvb-s2/) page for the full technical analysis.
</Aside>
## Architecture Overview
<CardGrid>
<Card title="USB Interface" icon="laptop">
EP0 for vendor commands (tuning, LNB control, status). EP2 for bulk MPEG-2 transport stream data. VID `0x09C0`, PID `0x0203`. See [USB Interface](/usb/interface/).
</Card>
<Card title="BCM4500 Demodulator" icon="seti:config">
Indirect register access via I2C (0xA6/0xA7/0xA8 protocol). Two FEC decoder paths: turbo codes and legacy Viterbi/Reed-Solomon. See [Demodulator Interface](/bcm4500/demodulator/).
</Card>
<Card title="GPIF Streaming" icon="right-arrow">
Hardware-managed data path. 8-bit parallel bus from BCM4500 to EP2 FIFO via GPIF master read. AUTOIN auto-commits full packets to USB. See [GPIF Streaming](/bcm4500/gpif-streaming/).
</Card>
<Card title="I2C Bus" icon="setting">
400 kHz bus connecting FX2 to BCM4500 (0x08), tuner IC (0x10), and EEPROM (0x51). Bit-banged DiSEqC on separate GPIO pins. See [I2C Bus Architecture](/i2c/bus-architecture/).
</Card>
</CardGrid>
## FEC Architecture
The BCM4500 contains two distinct FEC decoder paths:
1. **Advanced Modulation Turbo FEC Decoder** -- Iterative turbo code decoder supporting QPSK (rates 1/4, 1/2, 3/4), 8PSK (rates 2/3, 3/4, 5/6, 8/9), 16QAM (rate 3/4), with Reed-Solomon (t=10) outer code.
2. **Legacy DVB/DIRECTV/DCII-Compliant FEC Decoder** -- Concatenated Viterbi inner decoder (convolutional code, rates 1/2 through 7/8) plus Reed-Solomon outer decoder.
There is no LDPC or BCH decoder hardware. The turbo FEC codes are Broadcom/EchoStar proprietary and are not part of any open standard.
## Firmware
The SkyWalker-1 boots from an on-board I2C EEPROM containing firmware in Cypress C2 format. No host-side firmware files are required. Multiple stock firmware versions have been identified:
| Firmware | Version ID | Build Date | Notes |
|----------|-----------|------------|-------|
| v2.06.04 | 0x020604 | 2007-07-13 | Original release, 61 functions |
| v2.13.01 | 0x020D01 | 2010-03-12 | Latest revision, 82-88 functions |
| Custom v3.01.0 | 0x030100 | 2026-02-12 | Open-source SDCC + fx2lib, RAM-loaded |
See [Firmware Version Comparison](/firmware/version-comparison/) for a full analysis of the differences between stock firmware versions.

94
site/src/content/docs/hardware/rf-specifications.mdx Normal file
View File

@ -0,0 +1,94 @@
---
title: RF Specifications
description: RF input parameters, LNB voltage and current limits, and symbol rate range for the SkyWalker-1.
---
import { Aside } from '@astrojs/starlight/components';
## RF Input Parameters
| Parameter | Value |
|-----------|-------|
| IF frequency range | 950 -- 2150 MHz |
| Symbol rate | 256 Ksps -- 30 Msps |
| Input connector | IEC F-type female |
The IF frequency is the intermediate frequency after LNB downconversion. The host computes it as `(RF_freq - LO_freq) * multiplier` and sends it in the [TUNE_8PSK](/bcm4500/tuning-protocol/) command payload.
## LNB Power Supply
| Parameter | Value |
|-----------|-------|
| LNB voltage (standard) | 13V / 18V |
| LNB voltage (boosted) | 14V / 19V (with USE_EXTRA_VOLT) |
| Maximum continuous current | 450 mA |
| Maximum burst current | 750 mA |
<Aside type="caution" title="Current Limits">
750 mA is the maximum **non-continuous** (several minutes) allowable load. To avoid overheating the on-board voltage regulator, do not exceed **450 mA** for permanent load. Exceeding these limits may damage the SkyWalker-1 hardware.
</Aside>
LNB voltage is controlled via GPIO P0.4 on all firmware versions. The voltage selection determines the polarization:
| wValue | Voltage | GPIO P0.4 | Polarization |
|--------|---------|-----------|-------------|
| 0 | 13V | LOW | Vertical / Circular-Right |
| 1 | 18V | HIGH | Horizontal / Circular-Left |
The USE_EXTRA_VOLT command (0x94) enables a +1V boost for long cable runs by toggling bit 3 of the LNB control register at XRAM 0xE0B6 (0x62 = normal, 0x6A = boosted). See [Vendor Commands](/usb/vendor-commands/) for the command interface.
## Switch Control
The SkyWalker-1 supports multiple satellite switching protocols:
| Protocol | Implementation | Command |
|----------|---------------|---------|
| 22 kHz tone | GPIO P0.3 gates external oscillator | SET_22KHZ_TONE (0x8C) |
| Tone Burst (mini DiSEqC) | Timer2-based carrier gating | SEND_DISEQC_COMMAND (0x8D) |
| DiSEqC 1.0 | Timer2 Manchester encoding | SEND_DISEQC_COMMAND (0x8D) |
| DiSEqC 1.2 | Timer2 Manchester encoding | SEND_DISEQC_COMMAND (0x8D) |
| Legacy Dish Network | 7-bit serial bit-bang on P0.4 | SET_DN_SWITCH (0x8F) |
## 22 kHz Tone
The 22 kHz tone signal is generated by an external oscillator on the PCB, gated by GPIO P0.3. The firmware does not generate the 22 kHz carrier directly -- it only enables or disables the oscillator output.
| wValue | State | GPIO P0.3 | Band Selection |
|--------|-------|-----------|------|
| 0 | OFF | LOW | Low band (9.75 GHz LO on universal LNB) |
| 1 | ON | HIGH | High band (10.6 GHz LO on universal LNB) |
## Signal Path
```
Satellite
|
v
[ LNB on Dish ] <-- 13V/18V + 22kHz from SkyWalker-1
|
| Coax (950-2150 MHz IF)
v
[ SkyWalker-1 F-connector ]
|
v
[ BCM4500 Demodulator ] -- demod + FEC decode
|
| 8-bit parallel MPEG-2 TS
v
[ FX2 GPIF Engine ] -- zero-copy DMA to EP2
|
| USB 2.0 High-Speed Bulk
v
[ Host PC ]
```
The USB/GPIF data path has substantial headroom over the satellite link throughput:
| Metric | Value |
|--------|-------|
| USB 2.0 HS bulk (practical) | ~280 Mbps (~35 MB/s) |
| GPIF engine (theoretical) | 48 MHz x 8 bits = 384 Mbps |
| Typical DVB-S TS rate | 1--5 MB/s |
| Maximum symbol rate (30 Msps) | ~58 Mbps |
The bottleneck for all supported modulation modes is the satellite link, not the USB data path.

156
site/src/content/docs/i2c/bus-architecture.mdx Normal file
View File

@ -0,0 +1,156 @@
---
title: I2C Bus Architecture
description: FX2 I2C controller details, bus topology, device addresses, and the combined write-read protocol.
---
import { Aside, Steps } from '@astrojs/starlight/components';
The SkyWalker-1 uses a single I2C bus connecting the FX2 microcontroller (master) to three slave devices. The FX2's hardware I2C controller handles all bus transactions through XRAM-mapped registers.
## FX2 I2C Controller
| SFR | Address | Function |
|-----|---------|----------|
| I2CS | 0xE678 (XRAM) | I2C control/status register |
| I2DAT | 0xE679 (XRAM) | I2C data register |
| I2CTL | 0xE67A (XRAM) | I2C control (speed selection) |
### I2CS Control/Status Bits
| Bit | Name | Function |
|-----|------|----------|
| bmSTART | bit 7 | Write: initiate START condition |
| bmSTOP | bit 6 | Write: initiate STOP condition |
| bmLASTRD | bit 5 | Write: signal last read byte (NACK after next read) |
| bmDONE | bit 2 | Read: byte transfer complete |
| bmACK | bit 1 | Read: ACK received from slave |
| bmBERR | bit 0 | Read: bus error detected |
## Bus Speed
The I2C bus operates at 400 kHz. The speed is set through two mechanisms:
1. **C2 EEPROM header** -- Config byte at offset 7 = 0x40, which the FX2 boot ROM uses to configure the I2C speed during initial EEPROM read.
2. **Firmware/software** -- I2CTL = `bm400KHZ` (written by the custom firmware and init table).
## Known Bus Devices
| 7-bit Address | Wire Write | Wire Read | Identity |
|---------------|-----------|----------|----------|
| 0x08 | 0x10 | 0x11 | BCM4500 demodulator |
| 0x10 | 0x20 | 0x21 | Tuner or LNB controller |
| 0x51 | 0xA2 | 0xA3 | Configuration EEPROM (24Cxx-family) |
These addresses were confirmed via the I2C_BUS_SCAN command (0xB4) in custom firmware v3.01.0, which probes all 7-bit addresses from 0x01 to 0x77.
### BCM4500 Demodulator (0x08)
The primary device for all demodulation operations. Register access uses the [indirect register protocol](/bcm4500/demodulator/) through registers 0xA6, 0xA7, and 0xA8. Direct registers 0xA2, 0xA4, and 0xF9 provide status information.
The v2.13 firmware also probes alternate addresses 0x7F and 0x3F at startup to detect which demodulator variant is present.
### Tuner/LNB Controller (0x10)
Likely a tuner IC or LNB controller. In normal operation, the BCM4500 accesses this device internally for tuning. It is also directly addressable on the shared I2C bus. The kernel driver does not directly communicate with this device.
### Configuration EEPROM (0x51)
A 24Cxx-family serial EEPROM that stores:
- Device serial number (read by GET_SERIAL_NUMBER, 0x93)
- Hardware platform ID (read by GET_FPGA_VERS, 0x95)
- Calibration data
## Bus Topology
```
FX2 I2C Master
(I2CS/I2DAT/I2CTL)
|
+----------+-----------+
| | |
BCM4500 Tuner/LNB EEPROM
(0x08) (0x10) (0x51)
```
All three devices share the same SCL/SDA lines. The FX2's hardware I2C controller manages bus arbitration and clock stretching detection.
## Combined Write-Read Protocol
All BCM4500 register reads use the I2C combined write-read protocol with a repeated START condition. This is required because the BCM4500 uses a register-addressed protocol where the register number must be sent in a write phase before the read phase.
```
Complete I2C transaction for reading register 0xA2 from device 0x08:
Phase 1 (Write):
[S] [0x10] [ACK] [0xA2] [ACK]
| | | | |
| | | | +-- BCM4500 ACKs register address
| | | +--------- Register address byte
| | +---------------- BCM4500 ACKs its device address
| +----------------------- Device address (0x08 << 1) = 0x10 (write)
+---------------------------- START condition
Phase 2 (Read with Repeated START):
[Sr] [0x11] [ACK] [DATA] [NACK] [P]
| | | | | |
| | | | | +-- STOP condition
| | | | +--------- Master NACKs (last byte)
| | | +---------------- Register data
| | +----------------------- BCM4500 ACKs its device address
| +------------------------------ Device address (0x08 << 1 | 1) = 0x11 (read)
+------------------------------------ REPEATED START (no STOP between phases)
```
The repeated START (Sr) is essential. A STOP between phases would release the bus, and the BCM4500 would lose the register address context.
### FX2 SFR Sequence for Combined Read
```c title="Combined Write-Read Implementation"
// Phase 1: Write register address
I2CS |= bmSTART; // Generate START
I2DAT = 0x10; // Write: device addr + W
// wait bmDONE, check bmACK
I2DAT = 0xA2; // Write: register address
// wait bmDONE, check bmACK
// Phase 2: Read with repeated START
I2CS |= bmSTART; // Generate REPEATED START (no STOP first!)
I2DAT = 0x11; // Write: device addr + R
// wait bmDONE, check bmACK
I2CS |= bmLASTRD; // Signal this is the last read byte
tmp = I2DAT; // Dummy read (triggers first clock burst)
// wait bmDONE
I2CS |= bmSTOP; // Generate STOP after reading
data = I2DAT; // Read actual data byte
// wait bmSTOP to clear
```
<Aside type="danger" title="STOP Condition Warning">
Do NOT issue `I2CS |= bmSTOP` when no I2C transaction is active. This corrupts the FX2 I2C controller state machine. See [I2C STOP Corruption Bug](/i2c/stop-corruption-bug/) for the full analysis.
</Aside>
## Timeout Protection
The fx2lib I2C functions poll `bmDONE` with no timeout:
```c title="fx2lib Original Code (Vulnerable)"
while (!(I2CS & bmDONE) && !cancel_i2c_trans);
```
Since `cancel_i2c_trans` is never set during normal operation, these loops are effectively infinite. If a slave holds SCL low or a bus error prevents bmDONE from asserting, the firmware hangs.
The custom firmware replaces all fx2lib I2C functions with timeout-protected wrappers:
```c title="Timeout-Protected I2C Wait"
#define I2C_TIMEOUT 6000
static BOOL i2c_wait_done(void) {
WORD timeout = I2C_TIMEOUT;
while (!(I2CS & bmDONE)) {
if (--timeout == 0) return FALSE;
}
return TRUE;
}
```
A WORD counter of 6000 decremented in a tight SDCC-compiled loop at 48 MHz gives approximately 5--10 ms per wait. At 400 kHz I2C, a single byte transfer takes 22.5 us, so the timeout provides over 200x margin for normal operations while bounding the worst case.

167
site/src/content/docs/i2c/stop-corruption-bug.mdx Normal file
View File

@ -0,0 +1,167 @@
---
title: I2C STOP Corruption Bug
description: Root cause analysis of the spurious I2C STOP condition that corrupted the FX2 controller state during boot.
---
import { Steps, Aside, Badge } from '@astrojs/starlight/components';
During development of the custom firmware v3.01.0, the BOOT_8PSK (0x89) command caused the FX2 to hang for over 10 seconds, making the USB device completely unresponsive. The root cause was traced to a single line of code: a spurious I2C STOP condition issued when no transaction was active.
<Aside type="danger" title="Critical Hardware Bug">
Sending `I2CS |= bmSTOP` when no I2C transaction is active (no prior START, bus idle) corrupts the FX2 I2C controller's internal state machine. The bmSTOP bit may not self-clear, and subsequent START conditions fail to detect ACK from slaves. The Cypress TRM does not explicitly warn against this.
</Aside>
## The Problem
The boot function originally included a "bus reset" step before any I2C communication:
```c title="Broken Code"
I2CS |= bmSTOP;
i2c_wait_stop();
```
This pattern appears in various FX2 example code and seems reasonable -- send a STOP to ensure the I2C bus is in a known idle state before starting fresh. On the FX2's I2C controller hardware, this is incorrect.
## Root Cause Analysis
The root cause was discovered through a series of incremental debug modes added to the BOOT_8PSK handler. Each mode executes a subset of the full boot sequence, isolating which step introduces the failure.
### Debug Mode Results
| wValue | Action | Result | Key Observation |
|--------|--------|--------|-----------------|
| 0x80 | No-op: return status only | <Badge text="Works" variant="success" /> | Baseline |
| 0x81 | GPIO + power + delays (no I2C) | <Badge text="Works" variant="success" /> | Power sequencing is correct |
| 0x82 | GPIO + power + bmSTOP + I2C probe | <Badge text="Fails" variant="danger" /> | bmSTOP corrupts I2C |
| 0x83 | GPIO + power + bmSTOP + probe + init | <Badge text="Fails" variant="danger" /> | Same root cause |
| 0x84 | I2C probe only (chip already powered) | <Badge text="Works" variant="success" /> | BCM4500 is alive |
| 0x85 | GPIO + power + probe (**no bmSTOP**) | <Badge text="Works" variant="success" /> | Confirms bmSTOP is the cause |
### Three Key Observations
1. **Mode 0x82 fails but mode 0x85 succeeds.** These modes are identical except that 0x82 issues `I2CS |= bmSTOP` before the probe and 0x85 does not. The bmSTOP is the only difference.
2. **Mode 0x84 succeeds immediately after 0x82 fails.** Mode 0x84 performs a plain I2C combined read with no GPIO manipulation or bus reset. If called after a failed 0x82, it succeeds. This proves the BCM4500 was alive and responding -- the FX2 I2C controller was in a bad state, not the bus or the slave.
3. **Raw I2C reads via command 0xB5 succeed after 0x82 fails.** Command 0xB5 uses the same `i2c_combined_read` function. Running it from the host after a failed 0x82 returns valid data from the BCM4500.
## What Happens Inside the FX2
The FX2's I2C master controller is a hardware peripheral accessed through the I2CS, I2DAT, and I2CTL SFRs. The controller implements an I2C state machine in silicon. Writing bmSTOP to I2CS instructs the hardware to generate a STOP condition (SDA rising while SCL is high).
When no I2C transaction is active -- no prior START has been issued, and the bus is idle -- writing bmSTOP puts the controller into an inconsistent internal state:
- The bmSTOP bit may not clear properly (it is supposed to self-clear when the STOP condition completes)
- Subsequent START conditions fail to generate proper clock sequences
- ACK detection from slaves becomes unreliable
The Cypress TRM describes STOP as a step that follows a completed read or write transaction. It is not documented as a standalone bus-reset mechanism.
## The Fix
The fix is a single deletion. Remove the spurious STOP from the boot sequence:
```c title="Before (Broken)"
/* "Reset" I2C bus */
I2CS |= bmSTOP;
i2c_wait_stop();
```
```c title="After (Correct)"
/* NOTE: Do NOT send I2CS bmSTOP here. Sending STOP when no
* transaction is active corrupts the FX2 I2C controller state,
* causing subsequent START+ACK detection to fail. The I2C bus
* will be in a clean state when we reach the probe step --
* any prior transaction ended with STOP. */
```
The correct approach is to simply proceed with a new START condition. If the bus is idle (after power-on or after the previous transaction completed normally), the START succeeds and the controller enters its normal operating state. The hardware handles bus arbitration automatically.
## Corrected Boot Sequence
```c title="bcm4500_boot() -- Corrected"
static BOOL bcm4500_boot(void) {
boot_stage = 1;
cancel_i2c_trans = FALSE;
/* P3.7, P3.6, P3.5 HIGH (idle state for control lines) */
IOD |= 0xE0;
/* Assert BCM4500 hardware RESET (P0.5 LOW) */
OEA |= PIN_BCM_RESET;
IOA &= ~PIN_BCM_RESET;
/* No I2CS bmSTOP here -- see note above */
/* Power on: P0.1 HIGH (enable), P0.2 LOW (disable off) */
OEA |= (PIN_PWR_EN | PIN_PWR_DIS);
IOA = (IOA & ~PIN_PWR_DIS) | PIN_PWR_EN;
boot_stage = 2;
delay(30); /* power settle */
IOA |= PIN_BCM_RESET; /* release reset */
delay(50); /* BCM4500 POR + mask ROM boot */
boot_stage = 3;
/* I2C probe -- if this fails, the chip didn't respond */
if (!bcm_direct_read(BCM_REG_STATUS, &i2c_rd[0]))
return FALSE;
/* ... register init blocks follow ... */
}
```
## Boot Results After Fix
| Metric | Value |
|--------|-------|
| Boot time | ~90 ms total |
| config_status | 0x03 (STARTED + FW_LOADED) |
| boot_stage | 0xFF (COMPLETE) |
| Direct registers 0xA2-0xA8 | All return 0x02 (powered, not locked) |
| Signal lock | 0x00 (no lock -- dish not aimed) |
| USB responsiveness | No hang; fully responsive throughout |
## Test Scripts
The investigation was driven by a series of test scripts in the `tools/` directory:
| Script | Purpose |
|--------|---------|
| `test_boot_debug.py` | Sends debug modes 0x80--0x83 sequentially |
| `test_i2c_debug.py` | Powers on via 0x81, runs bus scans, tests probe timing |
| `test_i2c_isolate.py` | Tests whether re-reset or insufficient delay causes failure |
| `test_i2c_pinpoint.py` | The definitive test: compares modes 0x84, 0x85, and 0x82 |
## Timeout Protection
Even with the bmSTOP fix, timeout protection on all I2C operations is essential. The FX2's I2C controller has no hardware timeout -- if a slave holds SCL low (clock stretching) or a fault prevents bmDONE from asserting, the firmware spins forever.
The custom firmware replaces all fx2lib I2C functions with timeout-protected wrappers:
```c title="Timeout-Protected I2C Waits"
#define I2C_TIMEOUT 6000
static BOOL i2c_wait_done(void) {
WORD timeout = I2C_TIMEOUT;
while (!(I2CS & bmDONE)) {
if (--timeout == 0) return FALSE;
}
return TRUE;
}
static BOOL i2c_wait_stop(void) {
WORD timeout = I2C_TIMEOUT;
while (I2CS & bmSTOP) {
if (--timeout == 0) return FALSE;
}
return TRUE;
}
```
A WORD counter of 6000 at 48 MHz gives approximately 5--10 ms per wait, providing over 200x margin above the 22.5 us required for a single byte transfer at 400 kHz.
<Aside type="tip" title="FX2 Recovery">
If the firmware hangs due to I2C issues, the device can be recovered without a physical unplug. The FX2's CPUCS register (0xE600) is accessible via the boot ROM's `bRequest=0xA0` handler, which runs at hardware priority. See [Boot Sequence](/usb/boot-sequence/) for the recovery procedure.
</Aside>

77
site/src/content/docs/index.mdx Normal file
View File

@ -0,0 +1,77 @@
---
title: SkyWalker-1 Documentation
description: Reverse-engineered technical documentation for the Genpix SkyWalker-1 DVB-S USB 2.0 satellite receiver.
template: splash
hero:
title: SkyWalker-1
tagline: Open-source reverse-engineered documentation for the Genpix SkyWalker-1 DVB-S USB 2.0 satellite receiver
image:
file: ../../assets/skywalker-1-hero.jpg
alt: Genpix Electronics SkyWalker-1 DVB-S USB satellite receiver
actions:
- text: Get Started
link: /hardware/overview/
icon: right-arrow
- text: Master Reference
link: /reference/master-reference/
variant: minimal
---
import { CardGrid, Card, Aside } from '@astrojs/starlight/components';
The Genpix SkyWalker-1 is a standalone USB 2.0 DVB-S satellite receiver built around a Cypress FX2LP microcontroller and Broadcom BCM4500 demodulator. This project documents its complete internal architecture through Linux kernel driver analysis, Ghidra firmware reverse engineering across five firmware images, Windows BDA driver source review, and custom firmware development.
The result is a fully open-source technical reference covering every vendor command, register, GPIO pin, and data path -- from the USB control transfers down to the I2C bit timing on the BCM4500's indirect register protocol.
**Supported modulations:** DVB-S (QPSK), Turbo QPSK, Turbo 8PSK, Turbo 16QAM, Digicipher II (Combo, Split I/Q, Offset QPSK), DSS (QPSK), and DVB-S BPSK. Symbol rates from 256 Ksps to 30 Msps across a 950--2150 MHz IF range.
<Aside type="note">
DVB-S2 is **not supported**. The BCM4500 predates the DVB-S2 standard and contains no LDPC or BCH decoder hardware. This is a silicon limitation -- no firmware update can change it. See the [DVB-S2 Incompatibility](/driver/dvb-s2/) section for the full investigation.
</Aside>
## Explore the Documentation
<CardGrid>
<Card title="Hardware" icon="laptop">
FX2LP + BCM4500 architecture, GPIO pin maps, RF specifications, and board block diagram.
[Hardware Overview](/hardware/overview/)
</Card>
<Card title="USB Interface" icon="puzzle">
Vendor command reference, boot sequence, configuration status byte, and endpoint layout.
[USB Interface](/usb/interface/)
</Card>
<Card title="BCM4500" icon="setting">
Demodulator I2C protocol, indirect register access, tuning sequence, and GPIF streaming path.
[Demodulator](/bcm4500/demodulator/)
</Card>
<Card title="LNB and DiSEqC" icon="rocket">
LNB voltage and tone control, DiSEqC 1.0/1.2 protocol, legacy Dish Network switches.
[LNB Control](/lnb-diseqc/lnb-control/)
</Card>
<Card title="Firmware" icon="document">
Version comparison across five firmware images, custom v3.01.0 development, and storage formats.
[Firmware Versions](/firmware/version-comparison/)
</Card>
<Card title="Tools" icon="seti">
Python utilities for RAM loading, EEPROM flashing, transponder tuning, transport stream analysis, and hardware debugging.
[Firmware Loader](/tools/firmware-loader/)
</Card>
</CardGrid>
## Project Scope
This documentation covers the complete reverse engineering of the SkyWalker-1 hardware and firmware:
- **5 firmware images** decompiled in Ghidra: v2.06.04, Rev.2 v2.10.04, and three v2.13 sub-variants
- **30 vendor USB commands** fully decoded with parameter formats and version-specific behavior
- **Custom firmware** (v3.01.0) built from scratch with SDCC + fx2lib, including 7 new diagnostic commands
- **13 Python tools** for firmware management, satellite tuning, transport stream analysis, and hardware debugging
- **I2C STOP corruption bug** discovered and fixed through incremental debug modes on the FX2 controller
All source code, firmware binaries, analysis reports, and this documentation are available in the project repository.

273
site/src/content/docs/lnb-diseqc/diseqc-protocol.mdx Normal file
View File

@ -0,0 +1,273 @@
---
title: DiSEqC Protocol
description: DiSEqC 1.0/1.2 implementation with Manchester-encoded GPIO bit-bang, timing analysis, and command framing.
---
import { Steps, Badge, Aside, Tabs, TabItem } from '@astrojs/starlight/components';
The SkyWalker-1 implements DiSEqC (Digital Satellite Equipment Control) via Timer2-based GPIO bit-bang on the FX2 microcontroller. The algorithm is identical across all firmware versions -- only the data pin assignment changes per PCB revision.
[Download DiSEqC PDF](/downloads/DiSEqC%20for%20the%20Skywalker-1.pdf)
## Protocol Diagrams
The following diagrams document the Genpix BDA driver's DiSEqC extended property interface:
![DiSEqC Protocol Diagram Page 1](../../../assets/diagrams/DiSEqC%20for%20the%20Skywalker-1_page_1.svg)
![DiSEqC Protocol Diagram Page 2](../../../assets/diagrams/DiSEqC%20for%20the%20Skywalker-1_page_2.svg)
## Signal Architecture
The firmware does **not** generate the 22 kHz carrier directly. GPIO P0.3 gates an external 22 kHz oscillator circuit on the PCB:
```
FX2 Firmware External Hardware Coax Cable
+------------------+ +--------------------+ +------------------+
| P0.3 (carrier) |---->| 22 kHz oscillator |---->| LNB power line |
| (enable/disable) | | (gated by P0.3) | | (13V/18V + tone) |
| | | | | |
| P0.x (data bit) | | (internal firmware | | |
| (firmware only) | | logic only) | | |
+------------------+ +--------------------+ +------------------+
```
The data pin (P0.7 / P0.4 / P0.0 depending on version) is used only internally by the firmware's Manchester encoding logic. It controls whether the carrier gate signal is cut short or held for the full bit period.
## Timer2 Configuration
All firmware versions configure Timer2 identically during USB descriptor setup:
| Parameter | Value | Notes |
|-----------|-------|-------|
| T2CON | `0x04` | Auto-reload mode, timer running |
| RCAP2H | `0xF8` | Reload high byte |
| RCAP2L | `0x2F` | Reload low byte (reload = 63535) |
| CKCON.T2M | `0` | Timer2 clock = 48 MHz / 12 = 4 MHz |
**Tick period calculation:**
```
FX2 master clock = 48 MHz
CKCON.T2M = 0 -> Timer2 clock = 48 MHz / 12 = 4 MHz
Count per overflow = 65536 - 63535 = 2001
Tick period = 2001 / 4,000,000 = 500.25 us ~ 500 us
Tick frequency ~ 2.0 kHz
```
Timer2 runs continuously from power-on and is never stopped or reconfigured. It serves as a stable 500 us timebase for all DiSEqC operations.
## Manchester Encoding
Each DiSEqC bit consists of 3 Timer2 ticks (3 x 500 us = 1.5 ms):
<Tabs>
<TabItem label="Data '0'">
**Data '0'** -- 2/3 tone, 1/3 silence (1.0 ms carrier + 0.5 ms silence):
```
Tick 1 Tick 2 Tick 3
(500 us) (500 us) (500 us)
P0.3: _____|========|========|________|
^tone ON ^tone OFF
(setup gap) (1.0 ms carrier) (0.5 ms silence)
```
</TabItem>
<TabItem label="Data '1'">
**Data '1'** -- 1/3 tone, 2/3 silence (0.5 ms carrier + 1.0 ms silence):
```
Tick 1 Tick 2 Tick 3
(500 us) (500 us) (500 us)
P0.3: _____|========|________|________|
^tone ON ^tone OFF early
(setup gap) (0.5 ms carrier) (1.0 ms silence)
```
</TabItem>
</Tabs>
### Bit Symbol Implementation
Decompiled from Rev.2 `FUN_CODE_213c`:
```c title="DiSEqC bit symbol function"
void diseqc_bit_symbol(void) {
wait_TF2(); // Tick 1: inter-bit gap (500 us)
P0 |= 0x08; // P0.3 = 1 -> 22 kHz carrier ON
wait_TF2(); // Tick 2: carrier period (500 us)
if (data_pin != 0) { // If data = '1':
P0 &= 0xF7; // P0.3 = 0 -> carrier OFF (short pulse)
}
wait_TF2(); // Tick 3: final period (500 us)
P0 &= 0xF7; // P0.3 = 0 -> carrier always OFF at end
}
```
The `wait_TF2()` function is the lowest-level timing primitive -- a busy-wait on the Timer2 overflow flag:
```c title="Timer2 tick wait (identical across all versions)"
void wait_TF2(void) {
while (TF2 == 0) {} // Poll Timer2 overflow flag
TF2 = 0; // Clear flag for next tick
}
```
## Byte Transmission
Each DiSEqC byte is 9 bits: 8 data bits (MSB first) + 1 odd parity bit.
```c title="DiSEqC byte transmit (from Rev.2 FUN_CODE_07d1)"
void diseqc_send_byte(char first_byte, byte data) {
byte ones_count = 0;
if (first_byte == 0) TF2 = 0; // Sync timer on first byte
for (char i = 8; i > 0; i--) { // 8 bits, MSB first
if (data & 0x80) {
data_pin = 1; // Set data = '1'
diseqc_bit_symbol();
ones_count++;
} else {
data_pin = 0; // Set data = '0'
diseqc_bit_symbol();
}
data <<= 1; // Next bit
}
data_pin = ~ones_count & 1; // Odd parity: '1' if even count
diseqc_bit_symbol(); // Transmit parity bit
}
```
**Timing per byte:** 9 bits x 1.5 ms = 13.5 ms
## DiSEqC Command Sequence
The full command flow for sending a DiSEqC message via vendor command `0x8D` (`SEND_DISEQC_COMMAND`):
<Steps>
1. **Read wLength** from USB SETUP packet (`0xE6BE`) to determine message byte count
2. **Disable 22 kHz carrier** by clearing P0.3 (ensuring a clean start state)
3. **Pre-transmission delay** of 15 Timer2 ticks (7.5 ms) for LNB voltage settling
4. **Transmit message bytes** if wLength > 0: iterate through EP0BUF, sending each byte via Manchester-encoded bit-bang (8 data bits + odd parity, 3 Timer2 ticks per bit)
5. **Or send tone burst** if wLength == 0:
- `wValue == 0`: Tone Burst A (25 Timer2 ticks = 12.5 ms of unmodulated carrier)
- `wValue != 0`: Tone Burst B (transmitted as `0xFF` byte pattern through the bit-bang function)
</Steps>
## USB Command Format
### Full DiSEqC Message (3-6 bytes)
```
USB SETUP:
bmRequestType = 0x40 (vendor, host-to-device)
bRequest = 0x8D (SEND_DISEQC_COMMAND)
wValue = msg[0] (framing byte, typically 0xE0 or 0xE1)
wIndex = 0x0000
wLength = message length (3-6)
EP0 Data:
Byte 0: Framing byte (e.g., 0xE0 = command from master, no reply expected)
Byte 1: Address byte (e.g., 0x10 = any LNB, 0x11 = LNB 1)
Byte 2: Command byte (e.g., 0x38 = Write N0, committed switch port)
Byte 3: Data byte 0 (optional, port selection bits)
Byte 4: Data byte 1 (optional)
Byte 5: Data byte 2 (optional)
```
### Tone Burst (Mini DiSEqC)
```
USB SETUP:
bmRequestType = 0x40
bRequest = 0x8D
wValue = 0x00 (Burst A) or 0x01 (Burst B)
wIndex = 0x0000
wLength = 0 (zero length signals tone burst mode)
```
## Windows BDA Driver Interface
The Windows driver exposes DiSEqC through a BDA extended property GUID:
```c title="BDA Extended Property GUID"
// {0B5221EB-F4C4-4976-B959-EF74427464D9}
#define STATIC_KSPROPSETID_BdaExtendedProperty \
0x0B5221EB, 0xF4C4, 0x4976, 0xB9, 0x59, 0xEF, 0x74, 0x42, 0x74, 0x64, 0xD9
```
The DiSEqC command structure:
```c title="DISEQC_COMMAND structure"
typedef enum enSimpleToneBurst {
SEC_MINI_A,
SEC_MINI_B
} SIMPLE_TONE_BURST;
typedef struct __DISEQC_COMMAND {
UCHAR ucMessage[6]; // Framing, Address, Command, Data[0..2]
UCHAR ucMessageLength; // 3-6 for DiSEqC; 1 for tone burst
} DISEQC_COMMAND;
```
For tone burst commands, set `ucMessageLength = 1` and `ucMessage[0]` to either `SEC_MINI_A` (0x00) or `SEC_MINI_B` (0x01).
## Data Pin Assignment Per Version
The DiSEqC algorithm is identical across all firmware versions. Only the data pin changes per PCB revision:
| Firmware Version | Data Pin | Carrier Pin | Byte Transmit Function | Bit Symbol Function | Timer Wait |
|------------------|----------|-------------|----------------------|--------------------|-----------:|
| v2.06 | **P0.7** | P0.3 | `0x2098` | `0x23B5` | `0x24C6` |
| Rev.2 v2.10 | **P0.4** | P0.3 | `FUN_CODE_07d1` | `FUN_CODE_213c` | `FUN_CODE_225f` |
| v2.13 FW1 | **P0.0** | P0.3 | `FUN_CODE_2060` | `FUN_CODE_22f3` | `func_0x2431` |
| Custom v3.01.0 | **P0.7** | P0.3 | `diseqc_tone_burst()` | (inline) | (inline) |
<Aside type="note">
The custom v3.01.0 firmware uses the v2.06 pin assignment (P0.7 for data) since it targets the same original PCB revision. If flashing custom firmware to a Rev.2 board, the DiSEqC data pin would need to be changed to P0.4.
</Aside>
## CPU Clock Compensation
The delay function used before DiSEqC transmission adjusts its loop count based on the FX2 CPU clock speed:
```c title="Clock-aware delay function"
void delay(byte high, byte low) {
byte clkspd = CPUCS & 0x18; // CPUCS[4:3] = clock speed bits
if (clkspd == 0x00) { // 12 MHz: halve the count
// Adjust high:low /= 2
} else if (clkspd == 0x10) { // 48 MHz: double the count
// Adjust high:low *= 2
}
// 24 MHz (0x08): use count as-is
while (high:low > 0) {
wait_TF2();
high:low--;
}
}
```
The pre-DiSEqC delay call is `delay(0, 0x0F)` = 15 ticks x 500 us = **7.5 ms**. This allows the LNB voltage to stabilize before DiSEqC signaling begins.
## Complete Timing Summary
| Parameter | Value | Source |
|-----------|-------|--------|
| Timer2 clock | 4 MHz (48 MHz / 12) | CKCON default, T2M=0 |
| Timer2 reload | `0xF82F` | RCAP2H:RCAP2L |
| Tick period | 500.25 us | (65536 - 63535) / 4 MHz |
| Bit period | 1.5 ms (3 ticks) | DiSEqC Manchester encoding |
| Byte period | 13.5 ms (9 bits) | 8 data + 1 parity |
| Tone burst duration | 12.5 ms (25 ticks) | Mini-command A/B |
| Pre-TX settling delay | 7.5 ms (15 ticks) | Voltage stabilization |
| Data '0' | 1.0 ms tone + 0.5 ms silence | 2/3 duty cycle |
| Data '1' | 0.5 ms tone + 1.0 ms silence | 1/3 duty cycle |
| Carrier frequency | 22 kHz (external oscillator) | Gated by P0.3 |
| 3-byte DiSEqC message | ~48 ms total | 7.5 ms settle + 3 x 13.5 ms |
| 6-byte DiSEqC message | ~88.5 ms total | 7.5 ms settle + 6 x 13.5 ms |

106
site/src/content/docs/lnb-diseqc/legacy-switch.mdx Normal file
View File

@ -0,0 +1,106 @@
---
title: Legacy Dish Network Switch
description: SET_DN_SWITCH (0x8F) protocol for Dish Network SW21/SW44 legacy switches.
---
import { Badge, Aside, Steps } from '@astrojs/starlight/components';
The SkyWalker-1 supports legacy Dish Network satellite switches (SW21, SW44) through vendor command `0x8F` (`SET_DN_SWITCH`). This protocol predates DiSEqC and uses a simpler serial bit-bang scheme on a shared GPIO pin.
## Protocol Overview
The legacy Dish Network switch protocol sends a 7-bit serial command via **GPIO P0.4** (the same pin used for LNB voltage selection). The command is bit-banged LSB-first with fixed timing delays.
<Aside type="note">
The 8th bit (bit 7, value `0x80`) of the original Dish Network switch command controls LNB voltage polarity and is **not** sent via this protocol. Instead, the kernel driver sends it separately via `SET_LNB_VOLTAGE` (command `0x8B`). This split between data bits and voltage is handled by the `send_legacy_dish_cmd` callback in the kernel driver.
</Aside>
## USB Command Format
```
USB SETUP:
bmRequestType = 0x40 (vendor, host-to-device)
bRequest = 0x8F (SET_DN_SWITCH)
wValue = 7-bit switch command (bits 0-6)
wIndex = 0x0000
wLength = 0
```
## Bit-Bang Sequence
The firmware transmits the 7-bit command using the following GPIO sequence:
<Steps>
1. **Start pulse**: Assert P0.4 HIGH, delay approximately 32 CPU cycles (~0.67 us at 48 MHz)
2. **Gap**: De-assert P0.4 LOW, delay approximately 8 CPU cycles (~0.17 us at 48 MHz)
3. **Data bits**: Shift out 7 bits LSB-first via P0.4, with approximately 8-cycle delays between each bit transition
4. **End**: P0.4 returns to its previous LNB voltage state
</Steps>
## Switch Position Mapping
The legacy protocol supports the SW21 (2-input, 1-output) and SW44 (4-input, 4-output) switches. The 7-bit command encodes the desired input port and satellite selection:
| Switch Type | Bit Pattern | Function |
|-------------|-------------|----------|
| SW21 | <Badge text="Port A" variant="success" /> `0bxxxxxxx` with port bit = 0 | Select satellite A input |
| SW21 | <Badge text="Port B" variant="note" /> `0bxxxxxxx` with port bit = 1 | Select satellite B input |
| SW44 | Multiple bit fields | Select one of 4 inputs to one of 4 outputs |
The exact bit-field layout is proprietary to Dish Network. The kernel driver constructs the command value in `dishnetwork_send_legacy_command()` based on the requested switch position.
## Timing Characteristics
The legacy switch protocol is significantly simpler and faster than DiSEqC:
| Parameter | Value |
|-----------|-------|
| Start pulse width | ~0.67 us (32 cycles at 48 MHz) |
| Inter-bit gap | ~0.17 us (8 cycles at 48 MHz) |
| Total command time | ~5-10 us for 7 bits |
| GPIO pin | P0.4 (shared with LNB voltage) |
<Aside type="caution">
Because P0.4 is shared between the legacy switch protocol and LNB voltage selection, a switch command briefly disrupts the LNB voltage level. The switch must complete before the voltage is returned to its correct state. The kernel driver handles this coordination automatically.
</Aside>
## Kernel Driver Integration
The Linux kernel driver implements legacy Dish Network support through a dedicated callback:
```c title="Legacy Dish Network command callback"
// Registered as .send_legacy_dish_cmd in dvb_usb_device_properties
static int gp8psk_send_legacy_dish_cmd(struct dvb_frontend *fe, unsigned long cmd)
{
struct dvb_usb_adapter *adap = fe->dvb->priv;
struct dvb_usb_device *d = adap->dev;
// Bit 7 (0x80) controls voltage, sent separately
gp8psk_usb_out_op(d, SET_LNB_VOLTAGE, (cmd >> 7) & 1, 0, NULL, 0);
// Bits 0-6 sent via SET_DN_SWITCH
gp8psk_usb_out_op(d, SET_DN_SWITCH, cmd & 0x7F, 0, NULL, 0);
return 0;
}
```
## Comparison with DiSEqC
| Feature | Legacy Dish Protocol | DiSEqC 1.0 |
|---------|---------------------|------------|
| Standard | Proprietary (Dish Network) | EUTELSAT standard |
| Encoding | Serial bit-bang, LSB-first | Manchester encoding, MSB-first |
| Carrier | None (direct GPIO) | 22 kHz modulated |
| Message length | 7 bits | 3-6 bytes (24-54 bits + parity) |
| Timing | ~5-10 us total | ~48-88 ms total |
| Switch support | SW21, SW44 | DiSEqC 1.0/1.1/1.2 compatible switches |
| GPIO pin | P0.4 (shared with voltage) | P0.x (data) + P0.3 (carrier) |
| Vendor command | `0x8F` | `0x8D` |
For modern satellite installations, DiSEqC is the preferred switch protocol. The legacy Dish Network protocol exists for backward compatibility with older SW21 and SW44 switches commonly found in North American installations. See the [DiSEqC Protocol](/lnb-diseqc/diseqc-protocol/) page for the full DiSEqC implementation.

127
site/src/content/docs/lnb-diseqc/lnb-control.mdx Normal file
View File

@ -0,0 +1,127 @@
---
title: LNB Control
description: LNB voltage selection (13V/18V), 22 kHz tone generation, extra volt mode, and current limits.
---
import { Badge, Aside, Tabs, TabItem } from '@astrojs/starlight/components';
The SkyWalker-1 controls LNB power and band selection through dedicated GPIO pins on the FX2 microcontroller. No I2C transactions are involved in basic LNB control -- voltage and tone are driven directly by port pins.
## LNB Voltage (13V / 18V)
LNB voltage selects the polarization of the received signal. It is controlled via **GPIO P0.4** using vendor command `0x8B` (`SET_LNB_VOLTAGE`).
| wValue | Voltage | GPIO P0.4 | Polarization |
|--------|---------|-----------|--------------|
| `0x00` | 13V | LOW | Vertical / Circular-Right |
| `0x01` | 18V | HIGH | Horizontal / Circular-Left |
The Linux kernel driver sets the voltage during the tuning sequence based on the requested polarization:
```c title="Kernel driver polarization mapping"
// From gp8psk-fe.c set_voltage callback
case SEC_VOLTAGE_13: // Vertical / Circular-R
gp8psk_usb_out_op(d, SET_LNB_VOLTAGE, 0, 0, NULL, 0);
break;
case SEC_VOLTAGE_18: // Horizontal / Circular-L
gp8psk_usb_out_op(d, SET_LNB_VOLTAGE, 1, 0, NULL, 0);
break;
```
The configuration status byte (returned by `GET_8PSK_CONFIG`, command `0x80`) reflects the current voltage selection in **bit 5** (`0x20`, `bmSEL18V`).
## Extra Volt Mode (+1V Boost)
For long cable runs where voltage drop is significant, the SkyWalker-1 supports a +1V boost mode (13V becomes 14V, 18V becomes 19V). This is controlled via vendor command `0x94` (`USE_EXTRA_VOLT`).
| wValue | XRAM 0xE0B6 | Result |
|--------|-------------|--------|
| `0x00` | `0x62` | Normal voltage (13V / 18V) |
| `0x01` | `0x6A` | Boosted voltage (14V / 19V) |
The difference between the two XRAM values is **bit 3** (`0x08`), which enables the boost on the LNB power regulator circuitry.
<Aside type="caution">
The LNB power output has firm current limits. The maximum **non-continuous** draw is 750 mA (for short bursts of several minutes). For permanent continuous load, do not exceed **450 mA** to avoid overheating the onboard regulator. Exceeding these limits risks thermal damage to the SkyWalker-1 board.
</Aside>
The kernel driver exposes extra volt mode through the `enable_high_lnb_voltage` callback in the DVB frontend properties.
## 22 kHz Tone Generation
The 22 kHz tone selects the high or low band on a universal LNB. It is controlled via **GPIO P0.3** using vendor command `0x8C` (`SET_22KHZ_TONE`).
| wValue | State | GPIO P0.3 | LNB Band |
|--------|-------|-----------|----------|
| `0x00` | OFF | LOW | Low band (9.75 GHz LO on universal LNB) |
| `0x01` | ON | HIGH | High band (10.6 GHz LO on universal LNB) |
<Aside type="note">
P0.3 does not generate the 22 kHz carrier directly. Instead, it **gates an external 22 kHz oscillator circuit** on the PCB. When P0.3 is HIGH, the oscillator output is coupled onto the coaxial cable's DC power line alongside the 13V/18V LNB voltage. When P0.3 is LOW, the oscillator is disabled and no tone is present.
</Aside>
The configuration status byte tracks the tone state in **bit 4** (`0x10`, `bm22kHz`).
## LNB Power Supply Enable
Before any LNB control is possible, the LNB power supply itself must be enabled via vendor command `0x8A` (`START_INTERSIL`). The kernel driver does this during the boot sequence if bit 2 (`bmIntersilOn`) of the configuration status byte is not already set.
| wValue | Action | Config Bit |
|--------|--------|------------|
| `0x01` | Enable LNB power supply | Sets `bmIntersilOn` (bit 2) |
| `0x00` | Disable LNB power supply | Clears `bmIntersilOn` (bit 2) |
In the custom v3.01.0 firmware, enabling the LNB supply also configures the output enable masks for the LNB control GPIO pins:
```c title="START_INTERSIL handler in custom firmware"
case START_INTERSIL:
if (wval) {
OEA |= (PIN_22KHZ | PIN_LNB_VOLT | PIN_DISEQC);
config_status |= BM_INTERSIL;
} else {
config_status &= ~BM_INTERSIL;
}
```
## GPIO Pin Assignments
The LNB control pins are consistent across firmware versions, though their exact initialization differs:
| GPIO Pin | Function | Direction | Init State |
|----------|----------|-----------|------------|
| P0.1 | Power supply enable | Output | LOW (off) |
| P0.2 | Power supply disable | Output | HIGH (active disable) |
| P0.3 | 22 kHz tone gate | Output | LOW (tone off) |
| P0.4 | LNB voltage select | Output | LOW (13V) |
| P0.5 | BCM4500 hardware reset | Output | LOW (reset asserted) |
The initial GPIO state after power-on is `IOA = 0x84` (P0.7 and P0.2 HIGH, all others LOW), with the output enable mask `OEA = 0xBE` (P0.1 through P0.5 and P0.7 as outputs).
## LNB GPIO Debug Commands
Three vendor commands provide low-level GPIO access for LNB debugging:
| Command | Name | Purpose |
|---------|------|---------|
| `0x96` | `SET_LNB_GPIO_MODE` | Configure LNB GPIO output enables |
| `0x97` | `SET_GPIO_PINS` | Direct write to LNB GPIO pins via `wValue` bitmap |
| `0x98` | `GET_GPIO_STATUS` | Read LNB feedback GPIO pin (1 byte) |
These commands access Port B (XRAM-mapped IOB) rather than Port A. In v2.06 and v2.13, `0x97` controls IOB bits 1 and 2 for LNB, while `0x96` configures IOB bit 3 as the GPIO mode select. Rev.2 uses IOB bit 4 instead.
<Aside type="note">
These debug GPIO commands are not used by the Linux kernel driver during normal operation. They are available for diagnostic tools and custom applications that need direct hardware-level LNB control.
</Aside>
## Complete LNB Configuration Sequence
During a typical tune operation, the kernel driver configures the LNB in this order:
```
1. SET_LNB_VOLTAGE (0x8B) -- Select 13V or 18V based on polarization
2. SET_22KHZ_TONE (0x8C) -- Select low or high band
3. SEND_DISEQC (0x8D) -- Switch multi-port switch if needed
4. TUNE_8PSK (0x86) -- Send tuning parameters
```
The voltage and tone are set before any DiSEqC commands because the LNB must be powered and in the correct band before the switch can respond. See the [DiSEqC Protocol](/lnb-diseqc/diseqc-protocol/) page for details on switch control, and the [Tuning Protocol](/bcm4500/tuning-protocol/) for the complete tune flow.

1711
site/src/content/docs/reference/master-reference.md Normal file
View File

File diff suppressed because it is too large Load Diff

259
site/src/content/docs/tools/debugging.mdx Normal file
View File

@ -0,0 +1,259 @@
---
title: Debugging Tools
description: Hardware diagnostic tools for boot testing, I2C bus debugging, and firmware extraction.
---
import { Tabs, TabItem, Steps, Aside, Badge } from '@astrojs/starlight/components';
The `tools/` directory includes a suite of diagnostic scripts developed during the reverse engineering of the SkyWalker-1. These tools were instrumental in isolating the I2C STOP corruption bug in the FX2 controller and verifying correct BCM4500 initialization.
All debugging tools require `pyusb`, root access, and the kernel `dvb_usb_gp8psk` module to be unloaded.
```bash
pip install pyusb
sudo modprobe -r dvb_usb_gp8psk gp8psk_fe
```
<Tabs>
<TabItem label="Boot Tests">
## Boot Testing Tools
Two scripts test the BCM4500 boot sequence using debug modes in the custom v3.01.0 firmware.
### test_boot.py -- Full Boot Verification
Runs a complete BOOT_8PSK sequence and reports success or failure with detailed register readback.
```bash
sudo python3 tools/test_boot.py
```
**What it does:**
<Steps>
1. Reads firmware version via `GET_FW_VERS` (0x92)
2. Reads config status via `GET_8PSK_CONFIG` (0x80)
3. Sends `BOOT_8PSK` (0x89, wValue=1) with a 10-second timeout
4. Decodes the 3-byte response: config status, boot stage, probe byte
5. On success: reads BCM4500 direct registers (0xA2--0xA8), indirect registers (pages 0x00--0x0F), I2C diagnostic data, signal strength, and lock status
6. On failure: runs I2C bus scan (0xB4), attempts raw I2C reads to BCM4500
</Steps>
**Boot stage codes:**
| Stage | Code | Meaning |
|-------|------|---------|
| `NOT_STARTED` | 0x00 | Boot not attempted |
| `GPIO_SETUP` | 0x01 | GPIO pins configured |
| `PWR_SETTLED` | 0x02 | Power-on delay complete |
| `I2C_PROBE` | 0x03 | Probing BCM4500 on I2C |
| `INIT_BLK0` | 0x04 | Writing init block 0 |
| `INIT_BLK1` | 0x05 | Writing init block 1 |
| `INIT_BLK2` | 0x06 | Writing init block 2 |
| `COMPLETE` | 0xFF | Boot finished |
**Config status flags after successful boot:**
| Flag | Bit | Expected |
|------|-----|----------|
| `bm8pskStarted` | 0x01 | <Badge text="ON" variant="success" /> |
| `bm8pskFW_Loaded` | 0x02 | <Badge text="ON" variant="success" /> |
### test_boot_debug.py -- Incremental Stage Testing
Sends debug boot modes (wValue=0x80 through 0x83) one at a time to isolate which stage of the boot sequence fails. Can test a single stage or run all sequentially.
```bash title="Run all debug stages"
sudo python3 tools/test_boot_debug.py
```
```bash title="Test only stage 0x82"
sudo python3 tools/test_boot_debug.py 0x82
```
**Debug modes:**
| wValue | Action | Tests |
|--------|--------|-------|
| `0x80` | No-op: return current state | Firmware responsive? |
| `0x81` | GPIO setup + power + delays (no I2C) | Power rails working? |
| `0x82` | GPIO + I2C bus reset + BCM4500 probe | I2C communication working? |
| `0x83` | GPIO + I2C probe + write init block 0 | Register writes accepted? |
Each mode returns a 3-byte response: config status, boot stage, and probe byte. The tool reports timing (ms) for each stage and checks if the device is still responsive after failures.
</TabItem>
<TabItem label="I2C Tests">
## I2C Debugging Suite
Three scripts that implement a progressive isolation methodology to identify I2C bus faults. These were developed in sequence, each informed by the results of the previous one.
### Methodology
<Steps>
1. **Broad scan** (`test_i2c_debug.py`) -- Power on the BCM4500 and probe the entire I2C bus. Does the chip respond at any address?
2. **Isolation** (`test_i2c_isolate.py`) -- Determine whether the fault is in the BCM4500, the I2C bus, or the FX2 controller. Test the chip when already powered vs. after a reset.
3. **Pinpoint** (`test_i2c_pinpoint.py`) -- Identify the exact operation that corrupts communication. Compare I2C read-only, GPIO+reset, and GPIO+bus-reset+probe modes.
</Steps>
### test_i2c_debug.py -- Bus Discovery
Powers on the BCM4500 via GPIO-only mode (0x81), then runs progressively detailed diagnostics.
```bash
sudo python3 tools/test_i2c_debug.py
```
**Test sequence:**
| Step | Action | Purpose |
|------|--------|---------|
| 1 | Send mode 0x81 (GPIO power on) | Start BCM4500 without any I2C |
| 2 | I2C bus scan (0xB4) immediately | Check for devices right after power-on |
| 3 | Wait 500 ms, scan again | Maybe chip needs more time? |
| 4 | Raw I2C reads to candidate addresses | Try 0x08, 0x09, 0x0A, 0x0B, 0x10, 0x11, 0x68, 0x69, 0x60, 0x61 |
| 5 | Check I2C controller state | Observe bus health |
| 6 | Send mode 0x82 after 1s delay | Test probe with extra settling time |
**Candidate addresses** cover different BCM4500 pin-strap configurations and common demodulator/tuner addresses.
### test_i2c_isolate.py -- Fault Isolation
Determines whether the failure is caused by `bcm_direct_read`, re-reset timing, or the I2C bus reset (bmSTOP).
```bash
sudo python3 tools/test_i2c_isolate.py
```
**Test sequence:**
| Test | Action | Question |
|------|--------|----------|
| **A** | Power on (0x81), wait 1s, raw read | Is BCM4500 alive from cold start? |
| **B** | Run mode 0x82 (re-resets + probe) | Does `bcm_direct_read` work after reset? |
| **C** | Immediately raw read after 0x82 | Is I2C function itself broken? |
| **D** | Raw reads at 100, 200, 500, 1000, 2000 ms | Is it a timing issue? |
| **E** | Re-power (0x81), wait, then 0x82 | Repeatable? |
### test_i2c_pinpoint.py -- Root Cause Identification
The definitive test that identified the I2C STOP corruption bug. Compares three modes on a chip that is already proven alive.
```bash
sudo python3 tools/test_i2c_pinpoint.py
```
**Test sequence:**
<Steps>
1. Power on BCM4500 via mode 0x81, confirm alive with raw read
2. **Mode 0x84**: `bcm_direct_read` only (no GPIO, chip already powered) -- tests if the read function itself is broken
3. **Mode 0x85**: GPIO + reset + power but NO I2C bus reset (no `bmSTOP`) -- tests if re-reset breaks things
4. **Mode 0x82**: GPIO + I2C `bmSTOP` + reset + power + probe -- the mode that was failing
</Steps>
**Interpretation:**
| Result Pattern | Diagnosis |
|----------------|-----------|
| 0x84 works, 0x85 works, 0x82 fails | `bmSTOP` (I2C bus reset) is the culprit |
| 0x84 fails | `bcm_direct_read` has a bug |
| 0x85 fails | Re-reset timing needs more delay |
<Aside type="note">
This test conclusively proved that the spurious `I2CS |= bmSTOP` in the boot sequence was corrupting the FX2 I2C controller. Mode 0x84 succeeded immediately after 0x82 failed, proving the BCM4500 was alive the entire time -- only the FX2 controller was in a bad state. See [I2C STOP Corruption Bug](/i2c/stop-corruption-bug/) for the full analysis.
</Aside>
</TabItem>
<TabItem label="Memory Extraction">
## Windows Memory Dump (wine_memdump.py)
Extracts firmware from the Genpix Windows driver/updater by running it under Wine and dumping process memory. The Windows updater executable contains embedded firmware images that are unpacked into memory at runtime.
<Aside type="note">
This tool requires **Wine** to be installed. It reads `/proc/PID/mem` and `/proc/PID/maps`, which requires running as the same user as the Wine process or as root.
</Aside>
```bash
sudo python3 tools/wine_memdump.py SkyWalkerUpdater.exe
```
```bash title="Attach to an already-running Wine process"
sudo python3 tools/wine_memdump.py SkyWalkerUpdater.exe --skip-launch
```
```bash title="Custom output directory and wait time"
sudo python3 tools/wine_memdump.py SkyWalkerUpdater.exe -o dumps/ --wait 5
```
### Options
| Flag | Description |
|------|-------------|
| `EXE` | Windows PE executable to run under Wine (positional, required) |
| `-o, --output-dir DIR` | Output directory for dumps (default: `.`) |
| `--wait SECONDS` | Seconds to wait after launch for unpacking (default: `3`) |
| `--skip-launch` | Attach to an already-running Wine process |
### How It Works
<Steps>
1. Launches the `.exe` under Wine with `WINEDEBUG=-all` to suppress noise
2. Waits for the process to unpack (configurable delay)
3. Finds the Wine process PID by scanning `/proc`
4. Reads `/proc/PID/maps` to identify readable memory regions
5. Reads each region from `/proc/PID/mem` into a contiguous dump
6. Saves the full dump (`wine_memdump.bin`) and region map (`wine_memdump_regions.txt`)
7. Searches the dump for firmware signatures
</Steps>
### Firmware Signature Search
The tool searches for 7 categories of signatures:
| Search | Pattern | Purpose |
|--------|---------|---------|
| C2 EEPROM headers | `C2 C0 09 03 02` | Find embedded firmware images |
| FX2 init sequence | `78 7F E4 F6 D8 FD 75 81` | FX2 RAM clear/init code |
| RAM clear pattern | `78 7F E4 F6 D8 FD` | Partial match variant |
| C2 load records | LEN + addr `0x0000` + `LJMP` | Record chain starts |
| VID references | `C0 09` near `03 02` | VID/PID byte pairs |
| Version strings | `2.13`, `SkyWalker`, `Genpix`, `8PSK`, etc. | Text markers |
| USB transfer setup | `0x40 0xA0`, `0x40 0x83`, `0x40 0x84` | WinUSB vendor request patterns |
Each hit is reported with the dump offset, virtual address, containing memory region, and context bytes.
### Output Files
| File | Contents |
|------|----------|
| `wine_memdump.bin` | Full concatenated memory dump |
| `wine_memdump_regions.txt` | Region map with virtual addresses, permissions, and dump offsets |
</TabItem>
</Tabs>
## Diagnostic Command Reference
The custom v3.01.0 firmware adds these diagnostic vendor commands used by the test scripts:
| Command | Code | Direction | Purpose |
|---------|------|-----------|---------|
| `I2C_BUS_SCAN` | 0xB4 | IN | Probe all 128 I2C addresses, return 16-byte bitmap |
| `I2C_RAW_READ` | 0xB5 | IN | Read from any I2C device (wValue=addr, wIndex=reg) |
| `I2C_DIAG` | 0xB6 | IN | Step-by-step indirect register read with intermediate values |
| `RAW_DEMOD_READ` | 0xB1 | IN | Read any BCM4500 indirect register |
| `RAW_DEMOD_WRITE` | 0xB2 | OUT | Write any BCM4500 indirect register |
These commands are only available when running the custom firmware. Stock firmware will STALL on these command codes.
## See Also
- [I2C STOP Corruption Bug](/i2c/stop-corruption-bug/) -- the bug these tools helped discover
- [Boot Sequence](/usb/boot-sequence/) -- the initialization flow being tested
- [Custom Firmware v3.01.0](/firmware/custom-v301/) -- the firmware that enables debug modes
- [I2C Bus Architecture](/i2c/bus-architecture/) -- I2C protocol and controller details
- [Firmware Loader](/tools/firmware-loader/) -- load custom firmware before running debug tools

266
site/src/content/docs/tools/eeprom-utilities.mdx Normal file
View File

@ -0,0 +1,266 @@
---
title: EEPROM Utilities
description: EEPROM read, write, probe, and verification tools for the FX2 configuration EEPROM.
---
import { Tabs, TabItem, Steps, Aside, Badge } from '@astrojs/starlight/components';
Three tools manage the SkyWalker-1's I2C EEPROM (24Cxx-family at address `0x51`): `eeprom_write.py` for flashing firmware images, `eeprom_dump.py` for reading EEPROM contents, and `eeprom_probe.py` for testing I2C addressing methods.
The EEPROM stores the Cypress FX2 boot firmware in C2 IIC format. The FX2 loads this firmware automatically on every power-up. Writing incorrect data to the EEPROM will prevent the device from enumerating on USB.
<Aside type="danger">
**Writing incorrect firmware to the EEPROM can brick the device.** The SkyWalker-1 boots exclusively from this EEPROM on power-up. A corrupted image means no USB enumeration -- the device will appear dead until the EEPROM is reprogrammed using either the FX2 boot ROM's `0xA0` vendor request (if accessible) or an external I2C programmer.
Always back up the current EEPROM contents before flashing.
</Aside>
```bash
pip install pyusb
```
<Tabs>
<TabItem label="Flash (eeprom_write.py)">
## EEPROM Flash Tool
`eeprom_write.py` is the full-featured EEPROM management tool with four subcommands.
### Subcommands
| Subcommand | Purpose |
|------------|---------|
| `info` | Parse and display C2 header from a `.bin` file (offline, no device needed) |
| `backup` | Dump current EEPROM contents to a file |
| `verify` | Compare a `.bin` file against current EEPROM contents |
| `flash` | Write a C2 firmware image to the EEPROM |
### info -- Inspect a C2 Image File
Parse and display the C2 header and load records from a firmware binary without connecting to the device.
```bash
python3 tools/eeprom_write.py info firmware.bin
```
```
C2 Image: firmware.bin
File size: 9512 bytes
========================================
Header:
Format: C2 (Large EEPROM, code loads to internal RAM)
VID: 0x09C0 (Genpix)
PID: 0x0203 (SkyWalker-1)
DID: 0x0000
Config: 0x40 (400kHz I2C)
Load Records:
[0] 1023 bytes -> 0x0000-0x03FE [02 18 8d 78 7f e4 f6 d8...]
[1] 1023 bytes -> 0x03FF-0x07FD [...]
...
[9] 115 bytes -> 0x23F7-0x2469 [...]
[10] END MARKER -> entry point: 0xE600
Total firmware: 9472 bytes in 10 segments
Entry point: 0xE600 (LJMP target after boot)
EEPROM footprint: 9512 bytes (0x2528)
```
### backup -- Read EEPROM to File
```bash
sudo python3 tools/eeprom_write.py backup -o my_backup.bin
```
```bash title="Specify read size"
sudo python3 tools/eeprom_write.py backup -o my_backup.bin --max-size 16384
```
| Flag | Description |
|------|-------------|
| `-o, --output FILE` | Output file (default: `skywalker1_eeprom.bin`) |
| `--max-size BYTES` | Maximum bytes to read (default: `16384`) |
### verify -- Compare Image Against EEPROM
Read the EEPROM and compare byte-by-byte against a local `.bin` file. Reports any mismatches with offset and expected vs. actual values.
```bash
sudo python3 tools/eeprom_write.py verify firmware.bin
```
Exit code `0` = match, `1` = mismatch.
### flash -- Write Image to EEPROM
The flash workflow includes built-in safety measures: image validation, VID/PID check, automatic backup, countdown timer, write verification.
<Steps>
1. **Validate** the C2 image file (header format, VID/PID match, record integrity)
2. **Connect** to the SkyWalker-1 and check device VID/PID against the image
3. **Backup** the current EEPROM contents to a timestamped file
4. **Wait** 3 seconds with a countdown (Ctrl-C to abort)
5. **Write** the image in 16-byte page-aligned chunks with 10 ms write cycle delays
6. **Verify** by reading back and comparing every byte
</Steps>
```bash title="Flash with all safety checks"
sudo python3 tools/eeprom_write.py flash firmware.bin
```
```bash title="Dry run (shows what would happen, writes nothing)"
sudo python3 tools/eeprom_write.py flash firmware.bin --dry-run
```
```bash title="Skip backup (not recommended)"
sudo python3 tools/eeprom_write.py flash firmware.bin --no-backup
```
```bash title="Force flash with VID/PID mismatch"
sudo python3 tools/eeprom_write.py flash firmware.bin --force
```
| Flag | Description |
|------|-------------|
| `FILE` | C2 firmware image (positional, required) |
| `--dry-run` | Validate and show plan without writing |
| `--no-backup` | Skip pre-flash EEPROM backup |
| `--force` | Override VID/PID mismatch check |
### EEPROM Write Parameters
| Parameter | Value |
|-----------|-------|
| I2C slave address | `0x51` (7-bit) |
| Vendor command (write) | `I2C_WRITE` (`0x83`) |
| Vendor command (read) | `I2C_READ` (`0x84`) |
| Page size | 16 bytes (conservative for 24Cxx) |
| Write cycle time | 10 ms per page |
| Maximum image size | 16,384 bytes (16 KB) |
</TabItem>
<TabItem label="Dump (eeprom_dump.py)">
## EEPROM Dump Tool
`eeprom_dump.py` is a simpler read-only tool focused on extracting and analyzing EEPROM contents.
```bash
sudo python3 tools/eeprom_dump.py -o eeprom.bin
```
```bash title="Extract flat binary + 64K Ghidra image"
sudo python3 tools/eeprom_dump.py -o eeprom.bin --extract
```
### Options
| Flag | Description |
|------|-------------|
| `-o, --output FILE` | Output file (default: `skywalker1_eeprom.bin`) |
| `--extract` | Extract firmware as flat binary + full 64K image |
| `--max-size BYTES` | Maximum EEPROM size to read (default: `16384`) |
### Auto-Detect End of Data
The tool detects the end of valid data by watching for consecutive `0xFF` chunks (4 or more = end of programmed region). This avoids reading the entire EEPROM when only the first few KB contain firmware.
### Extract Mode (--extract)
When `--extract` is specified, the tool additionally produces:
- **`*_flat.bin`** -- firmware code extracted from C2 records, stored as a flat binary covering only the used address range
- **`*_full64k.bin`** -- full 64 KB memory image (unused regions filled with `0xFF`), suitable for loading in Ghidra at base address `0x0000`
### Output
```
Genpix SkyWalker-1 EEPROM Dump
========================================
Found device: Bus 1 Addr 12
Reading EEPROM (max 16384 bytes)...
End of data at 0x2600 (0xFF padding)
Read 9728 bytes total
Saved raw EEPROM to: eeprom.bin
========================================
EEPROM Header:
Format: C2 (Large EEPROM, code loads to internal RAM)
VID: 0x09C0 (Genpix)
PID: 0x0203 (SkyWalker-1)
DID: 0x0000
Config: 0x40 (400kHz I2C)
Load Records:
[0] 1023 bytes -> 0x0000-0x03FE [02 18 8d 78 7f e4 f6 d8...]
...
[10] END MARKER -> entry point: 0xE600
Total firmware: 9472 bytes in 10 records
Entry point: 0xE600 (LJMP target after boot)
```
</TabItem>
<TabItem label="Probe (eeprom_probe.py)">
## EEPROM Address Probe
`eeprom_probe.py` is a diagnostic script that tests different I2C addressing methods to determine how the Genpix firmware's `I2C_READ`/`I2C_WRITE` commands interpret `wValue` and `wIndex` parameters for EEPROM access.
This is a developer tool used during reverse engineering. It runs 7 different addressing approaches and checks each result against known reference bytes from the EEPROM header.
```bash
sudo python3 tools/eeprom_probe.py
```
### Test Approaches
| Approach | Method | Description |
|----------|--------|-------------|
| 1 | `I2C_WRITE data=[addr_h, addr_l]` then `I2C_READ` | Set EEPROM offset via write data |
| 2 | `wValue=addr, wIndex=slave` | Reversed parameter mapping |
| 3 | `wValue=slave, wIndex=addr` | Standard Genpix mapping |
| 4 | `I2C_READ wIndex=offset` | Offset in wIndex field |
| 5 | `wValue=(slave<<8\|offset)` | Packed slave + offset |
| 6 | `wValue=offset (no slave)` | Offset only, no slave address |
| 7 | Larger reads (64 bytes) | Verify sequential data across page boundaries |
### Known Reference Bytes
The script compares against two known patterns:
- **Offset 0x0000**: `C2 C0 09 03 02 00 00 40` (C2 header: marker, VID, PID, DID, config)
- **Offset 0x0008**: `03 FF 00 00 02 18 8D 30` (first load record)
<Aside type="note">
This tool confirmed that the Genpix firmware uses `wValue=slave_address` (0x51) and `wIndex=eeprom_offset` for the `I2C_READ` (0x84) command. Approach 4 is the correct protocol.
</Aside>
</TabItem>
</Tabs>
## Cypress C2 Boot Format
The EEPROM stores firmware in the Cypress C2 IIC second-stage boot format:
| Field | Offset | Size | Description |
|-------|--------|------|-------------|
| Marker | 0 | 1 | `0xC2` (large EEPROM, external memory) |
| VID | 1 | 2 | USB Vendor ID, little-endian (`0x09C0`) |
| PID | 3 | 2 | USB Product ID, little-endian (`0x0203`) |
| DID | 5 | 2 | Device ID, little-endian |
| Config | 7 | 1 | Boot config (`0x40` = 400 kHz I2C) |
| Records | 8+ | var | Code segments: `[len_hi][len_lo][addr_hi][addr_lo][data...]` |
| End | last | 4 | `[0x80][0x01][entry_hi][entry_lo]` (entry point = `0xE600`) |
For a full description of the storage format, see [Firmware Storage Formats](/firmware/storage-formats/).
## See Also
- [Firmware Loader](/tools/firmware-loader/) -- RAM-based firmware loading (non-destructive)
- [Storage Formats](/firmware/storage-formats/) -- C2 format, hexline, and FW02 chunk details
- [Version Comparison](/firmware/version-comparison/) -- differences across firmware versions
- [I2C Bus Architecture](/i2c/bus-architecture/) -- I2C protocol details

255
site/src/content/docs/tools/firmware-loader.mdx Normal file
View File

@ -0,0 +1,255 @@
---
title: Firmware Loader
description: RAM firmware loader and firmware dump/probe utilities for the Genpix SkyWalker-1.
---
import { Tabs, TabItem, Steps, Aside, Badge } from '@astrojs/starlight/components';
Two complementary tools handle firmware on the SkyWalker-1: `fw_load.py` loads firmware into FX2 RAM for testing, and `fw_dump.py` extracts firmware and device information from a running device.
Both tools require `pyusb` and typically need root access (or appropriate udev rules) to communicate with the USB device.
```bash
pip install pyusb
```
<Aside type="danger">
**RAM loading is non-destructive.** The `fw_load.py` tool writes to volatile FX2 RAM only -- it never touches the EEPROM. Power-cycling the device restores the factory-programmed firmware. For permanent EEPROM programming, see [EEPROM Utilities](/tools/eeprom-utilities/).
</Aside>
<Tabs>
<TabItem label="Loading (fw_load.py)">
## RAM Firmware Loader
`fw_load.py` loads firmware into the Cypress FX2 internal/external RAM via the standard `0xA0` vendor request built into the FX2 silicon boot ROM. This is the primary tool for firmware development: load, test, power-cycle to revert.
### Subcommands
| Subcommand | Purpose |
|------------|---------|
| `load` | Load a firmware file into FX2 RAM |
| `reset` | Halt and restart the FX2 CPU |
| `read` | Read and hex-dump FX2 RAM contents |
### load -- Write Firmware to RAM
<Steps>
1. **Halt the CPU** -- writes `0x01` to the CPUCS register at `0xE600`
2. **Write code segments** into RAM in 64-byte chunks via vendor request `0xA0`
3. **Start the CPU** -- writes `0x00` to CPUCS, triggering USB re-enumeration
</Steps>
**Supported file formats:**
| Extension | Format | Load Address |
|-----------|--------|-------------|
| `.ihx`, `.hex` | Intel HEX | Addresses embedded in file |
| `.bix`, `.bin` | Raw binary | `0x0000` (start of internal RAM) |
**Options:**
| Flag | Description |
|------|-------------|
| `FILE` | Firmware file path (positional, required) |
| `--no-reset` | Load segments without halting/starting the CPU |
| `--wait SECONDS` | Wait for USB re-enumeration after load |
| `-v, --verbose` | Show per-chunk transfer progress |
| `--force` | Allow loading to devices with unknown VID/PID |
**Examples:**
```bash title="Load custom firmware and wait for re-enumeration"
sudo python3 tools/fw_load.py load firmware/build/skywalker1.ihx --wait 3
```
```bash title="Load raw binary with verbose output"
sudo python3 tools/fw_load.py load firmware.bix -v --wait 5
```
```bash title="Load without CPU reset (write segments only)"
sudo python3 tools/fw_load.py load firmware.ihx --no-reset
```
**Typical output:**
```
SkyWalker-1 RAM Firmware Loader
========================================
Firmware: firmware/build/skywalker1.ihx
Segments: 3
Total size: 3072 bytes
Address: 0x0000 - 0x0BFF
Found SkyWalker-1: Bus 1 Addr 12 (VID 0x09C0 PID 0x0203)
[1/3] Halting CPU (CPUCS = 0x01)...
CPU halted
[2/3] Loading 3 segment(s) into RAM...
0x0000-0x03FF (1024 bytes)
0x0400-0x07FF (1024 bytes)
0x0800-0x0BFF (1024 bytes)
3072 bytes loaded
[3/3] Starting CPU (CPUCS = 0x00)...
CPU released
Firmware is running. The device will re-enumerate
with new USB descriptors if the firmware does so.
```
### reset -- Restart the FX2 CPU
Halts and restarts the CPU without loading new code. Useful for triggering USB re-enumeration when the device is in a bad state.
```bash
sudo python3 tools/fw_load.py reset --wait 3
```
| Flag | Description |
|------|-------------|
| `--wait SECONDS` | Wait for re-enumeration after reset |
| `--force` | Allow reset on unknown VID/PID |
### read -- Hex-Dump FX2 RAM
Read memory contents from a running FX2. Useful for verifying loaded firmware or inspecting register state.
```bash title="Read first 256 bytes of internal RAM"
sudo python3 tools/fw_load.py read --addr 0x0000 --len 256
```
```bash title="Check CPUCS register"
sudo python3 tools/fw_load.py read --addr 0xe600 --len 1
```
```bash title="Dump to file"
sudo python3 tools/fw_load.py read --addr 0x0000 --len 8192 -o ram_dump.bin
```
| Flag | Description |
|------|-------------|
| `--addr ADDR` | Start address in hex (default: `0x0000`) |
| `--len LENGTH` | Bytes to read (default: `256`) |
| `-o, --output FILE` | Save raw bytes to file |
| `--force` | Allow read on unknown VID/PID |
### Device Detection
The loader searches for devices in this order:
1. **SkyWalker-1** -- VID `0x09C0`, PID `0x0203`
2. **Bare Cypress FX2** -- VID `0x04B4`, PID `0x8613` (unprogrammed/blank EEPROM)
Use `--force` to override VID/PID checks for devices with non-standard descriptors.
<Aside type="tip">
**Recovery procedure:** If the device is completely hung (not responding to vendor commands), you can still recover it using `fw_load.py`. The FX2's `0xA0` vendor request is handled by the boot ROM in silicon, not by user firmware. Even a hung 8051 CPU can be halted and reprogrammed via this mechanism.
</Aside>
</TabItem>
<TabItem label="Dumping (fw_dump.py)">
## Firmware Probe and Dump Tool
`fw_dump.py` queries device information, dumps FX2 RAM contents, and scans for undocumented vendor commands.
### Options
| Flag | Description |
|------|-------------|
| `--info` | Query and display device information |
| `--dump FILE` | Dump FX2 RAM to a binary file |
| `--scan` | Brute-force scan all vendor commands (0x00--0xFF) |
| `--start ADDR` | RAM dump start address (default: `0x0000`) |
| `--size SIZE` | RAM dump size in bytes (default: `0x2000` = 8 KB) |
| `--external` | Attempt to dump external RAM (64 KB) |
Running with no flags defaults to `--info --scan`.
### Device Info (--info)
Queries all known Genpix vendor commands and displays firmware version, build date, USB speed, serial number, and the 8PSK configuration status byte with decoded flags.
```bash
sudo python3 tools/fw_dump.py --info
```
```
=== Genpix SkyWalker-1 Device Info ===
FW Version: 2.06.4 (0x020604)
FW Build: 2007-07-13
BCD Version: 0206
Vendor: Genpix
Product: SkyWalker-1
USB Speed: High (480Mbps)
Serial: 00000000
Config: 0x03
[ ON] 8PSK Started
[ ON] BCM4500 FW Loaded
[off] Intersil LNB On
[off] DVB Mode
[off] 22kHz Tone
[off] 18V Selected
[off] DC Tuned
[off] Armed (streaming)
```
### Vendor Command Scan (--scan)
Sends vendor IN requests to every command index from `0x00` to `0xFF` and reports which ones return data. Commands already documented in the reference are labeled `[KNOWN]`; unexpected responses are flagged `[NEW!]`.
```bash
sudo python3 tools/fw_dump.py --scan
```
### RAM Dump (--dump)
Reads FX2 internal RAM (8 KB at `0x0000`--`0x1FFF`) or external RAM (up to 64 KB with `--external`) via the standard `0xA0` vendor request.
```bash title="Dump internal RAM"
sudo python3 tools/fw_dump.py --dump internal_ram.bin
```
```bash title="Dump external RAM (64 KB)"
sudo python3 tools/fw_dump.py --dump external_ram.bin --external
```
```bash title="Dump specific range"
sudo python3 tools/fw_dump.py --dump region.bin --start 0x1000 --size 0x800
```
The tool performs a quick analysis of the dump, reporting non-`0xFF` byte count and checking for the standard FX2 reset vector (`LJMP` at address `0x0000`).
<Aside type="note">
RAM readback may fail if the running firmware has disabled or overridden the `0xA0` vendor request. Stock Genpix firmware supports `0xA0` readback; some custom configurations may not. If you see consecutive read failures, the device firmware may need to be reloaded first.
</Aside>
</TabItem>
</Tabs>
## Kernel Driver Conflict
The Linux `dvb_usb_gp8psk` module auto-loads when the SkyWalker-1 enumerates on USB. It will race with these tools for device access.
**Before using any tool**, either blacklist the module or unload it:
```bash title="Unload for current session"
sudo modprobe -r dvb_usb_gp8psk gp8psk_fe
```
```bash title="Permanent blacklist"
echo -e "blacklist dvb_usb_gp8psk\nblacklist gp8psk_fe" | \
sudo tee /etc/modprobe.d/blacklist-gp8psk.conf
```
## See Also
- [EEPROM Utilities](/tools/eeprom-utilities/) -- for permanent firmware flashing
- [Boot Sequence](/usb/boot-sequence/) -- what happens after firmware loads
- [Custom Firmware v3.01.0](/firmware/custom-v301/) -- the open-source replacement firmware
- [Vendor Commands](/usb/vendor-commands/) -- command reference used by these tools

262
site/src/content/docs/tools/ts-analyzer.mdx Normal file
View File

@ -0,0 +1,262 @@
---
title: TS Analyzer
description: MPEG-2 Transport Stream analyzer for captured satellite data from the SkyWalker-1.
---
import { Tabs, TabItem, Steps, Aside, Badge } from '@astrojs/starlight/components';
`ts_analyze.py` parses and analyzes 188-byte MPEG-2 transport stream packets from `.ts` files captured by `tune.py`, piped from stdin, or any standard TS source. It covers PID distribution, PAT/PMT parsing, continuity counter verification, scrambling detection, bitrate estimation, and live stream monitoring.
Reference: ISO/IEC 13818-1 (MPEG-2 Systems).
## Subcommands
| Subcommand | Purpose |
|------------|---------|
| `analyze` | Full stream analysis with PID table, CC errors, bitrate (default) |
| `pids` | Quick PID summary table |
| `pat` | Parse and display the Program Association Table |
| `pmt` | Parse and display Program Map Tables |
| `dump` | Hex dump of individual TS packets |
| `monitor` | Live stream monitoring with real-time statistics |
Passing a filename without a subcommand defaults to `analyze`.
## Global Options
| Flag | Description |
|------|-------------|
| `-v, --verbose` | Show sync search details and debug info |
---
## analyze -- Full Stream Analysis
Comprehensive analysis of a TS file or stream: total packets, unique PIDs, TEI errors, scrambling, continuity counter errors, PCR-based bitrate, and a per-PID distribution table.
```bash
python3 tools/ts_analyze.py capture.ts
```
```bash title="Analyze first 10000 packets only"
python3 tools/ts_analyze.py analyze capture.ts --max-packets 10000
```
| Flag | Description |
|------|-------------|
| `INPUT` | TS file path or `-` for stdin |
| `--max-packets N` | Limit analysis to N packets (0 = all) |
**Example output:**
```
MPEG-2 Transport Stream Analysis
============================================================
File: capture.ts (52,428,800 bytes)
Total packets: 278,876
Total bytes: 52,428,688
Unique PIDs: 12
TEI errors: 0
Scrambled: 0
Duration: 5.23s (from PCR)
Bitrate: 80.21 Mbps (PCR-based)
============================================================
PID Distribution
============================================================
PID Count % CC Err Name
--- ----- -- ------ ----
0x0000 1,394 0.50% - PAT
0x0001 278 0.10% - CAT
0x0010 556 0.20% - NIT/ST
0x0011 556 0.20% - SDT/BAT/ST
0x0100 139,438 50.00% -
0x0101 83,663 29.99% -
0x0102 5,576 2.00% -
0x1FFF 47,415 17.01% - Null
```
### What It Detects
| Metric | Description |
|--------|-------------|
| **PID count** | Packet count per Program ID |
| **TEI** | Transport Error Indicator flag in the TS header |
| **Scrambling** | Transport scrambling control bits (even/odd key) |
| **CC errors** | Continuity counter discontinuities per PID |
| **Bitrate** | Calculated from PCR timestamps when available |
---
## pids -- Quick PID Table
Faster variant of `analyze` that only counts packets per PID without CC checking or PCR extraction.
```bash
python3 tools/ts_analyze.py pids capture.ts
```
---
## pat -- Program Association Table
Parses PID 0x0000 to extract the PAT, showing the transport stream ID and which PMT PID corresponds to each program number.
```bash
python3 tools/ts_analyze.py pat capture.ts
```
```
Program Association Table (PAT)
==================================================
Transport Stream ID: 0x0001 (1)
Version: 3
Programs: 2
Program PMT PID Note
------- ------- ----
0 0x0010 NIT
1 0x0100
```
---
## pmt -- Program Map Tables
Parses the PAT first to discover PMT PIDs, then parses each PMT to show the elementary streams (video, audio, data) in each program.
```bash
python3 tools/ts_analyze.py pmt capture.ts
```
```
Program Map Tables
============================================================
Transport Stream ID: 0x0001
Program 1 (PMT PID 0x0100, version 2)
PCR PID: 0x0101
Streams:
Type PID Description
---- --- -----------
0x02 0x0101 MPEG-2 Video (13818-2)
0x04 0x0102 MPEG-2 Audio (13818-3)
0x06 0x0103 PES Private Data
```
### Known Stream Types
The tool recognizes these standard stream type identifiers:
| Code | Description |
|------|-------------|
| 0x01 | MPEG-1 Video |
| 0x02 | MPEG-2 Video |
| 0x03 | MPEG-1 Audio |
| 0x04 | MPEG-2 Audio |
| 0x06 | PES Private Data |
| 0x0F | MPEG-2 AAC Audio |
| 0x1B | H.264/AVC Video |
| 0x24 | H.265/HEVC Video |
| 0x81 | AC-3 Audio (ATSC) |
---
## dump -- Hex Dump Packets
Print detailed per-packet information including header fields, adaptation field flags, PCR values, and raw hex dump.
```bash title="Dump first 5 packets"
python3 tools/ts_analyze.py dump capture.ts --count 5
```
```bash title="Dump packets for a specific PID"
python3 tools/ts_analyze.py dump capture.ts --pid 0x0100 --count 3
```
| Flag | Description |
|------|-------------|
| `--pid PID` | Filter by PID (hex `0x100` or decimal `256`) |
| `--count N` | Maximum packets to dump (default: `10`) |
**Example output:**
```
Packet #1
PID: 0x0000 (PAT)
TEI: 0 PUSI: 1 Priority: 0
Scrambling: none Adaptation: payload only CC: 5
Hex:
0000: 47 40 00 15 00 00 B0 0D 00 01 C1 00 00 00 00 E0 G@..............
0010: 10 00 01 E1 00 78 A0 B4 FF FF FF FF FF FF FF FF .....x..........
...
```
---
## monitor -- Live Stream Monitoring
Real-time monitoring of a TS stream, reporting new PIDs as they appear, continuity errors, TEI errors, and bitrate.
```bash title="Monitor from a live stream pipe"
sudo python3 tools/tune.py stream --stdout | python3 tools/ts_analyze.py monitor -
```
```bash title="Monitor a growing file"
python3 tools/ts_analyze.py monitor capture.ts
```
The monitor prints events as they occur (new PIDs, errors) and updates a status line on stderr every second with running statistics.
```
MPEG-2 TS Live Monitor
============================================================
Ctrl-C to stop
[ 0.0s] New PID: 0x0000 (PAT)
[ 0.0s] New PID: 0x1FFF (Null)
[ 0.1s] New PID: 0x0100
[ 0.1s] New PID: 0x0101
[ 0.2s] New PID: 0x0102
278,876 pkts 52,428,688 bytes 80.21 Mbps PIDs: 12 CCerr:0 TEI:0 (5s)
Monitor Summary
========================================
Duration: 5.2s
Packets: 278,876
Bytes: 52,428,688
Unique PIDs: 12
CC errors: 0
TEI errors: 0
Avg bitrate: 80.21 Mbps
```
---
## Capturing a Transport Stream
<Aside type="tip">
To capture a TS stream for analysis, first tune to a transponder with `tune.py`, then capture with the `stream` subcommand:
```bash title="Tune and capture"
sudo python3 tools/tune.py tune 12520 27500 --pol H --band high
sudo python3 tools/tune.py stream -o capture.ts --duration 30
```
```bash title="Pipe directly to analyzer"
sudo python3 tools/tune.py stream --stdout | python3 tools/ts_analyze.py monitor -
```
</Aside>
## Sync Detection
The analyzer requires at least 3 consecutive sync bytes (`0x47`) at 188-byte intervals to confirm alignment. If the file starts with non-TS data (e.g., leading garbage from a partial USB transfer), the tool will skip ahead until sync is found.
When using `-v` (verbose), the sync search offset is reported. A non-zero sync offset may indicate that the capture started mid-packet or contains a non-TS preamble.
## See Also
- [Tuning Tool](/tools/tuning/) -- capture TS data from a transponder
- [GPIF Streaming](/bcm4500/gpif-streaming/) -- how TS data flows from BCM4500 through USB
- [Vendor Commands](/usb/vendor-commands/) -- ARM_TRANSFER (0x85) starts/stops the stream

293
site/src/content/docs/tools/tuning.mdx Normal file
View File

@ -0,0 +1,293 @@
---
title: Tuning Tool
description: DVB-S tuning, signal monitoring, LNB control, DiSEqC switching, and transport stream capture.
---
import { Tabs, TabItem, Steps, Aside, Badge } from '@astrojs/starlight/components';
`tune.py` is the primary user-facing tool for operating the SkyWalker-1 as a satellite receiver. It handles the complete signal chain: powering the demodulator, configuring LNB voltage and tone, sending DiSEqC switch commands, tuning to a transponder, monitoring signal quality, and capturing MPEG-2 transport stream data.
```bash
pip install pyusb
```
## Subcommands
| Subcommand | Purpose |
|------------|---------|
| `status` | Show device config, firmware version, and signal info |
| `tune` | Tune to a transponder frequency |
| `stream` | Capture MPEG-2 transport stream data |
| `diseqc` | Send DiSEqC switch commands |
| `lnb` | Control LNB voltage and 22 kHz tone |
Running with no subcommand defaults to `status`.
## Global Options
| Flag | Description |
|------|-------------|
| `-v, --verbose` | Show raw USB control transfer traffic |
| `--json` | Output machine-readable JSON (where supported) |
---
## status -- Device Information
Displays the current device state: firmware version, configuration status flags, signal lock, and SNR.
```bash
sudo python3 tools/tune.py status
```
```
Genpix SkyWalker-1 Status
==================================================
USB: Bus 1 Addr 12 (VID 0x09C0, PID 0x0203)
FW: 2.06.4 (built 2007-07-13)
Config: 0x07
[ ON] 8PSK Started
[ ON] BCM4500 FW Loaded
[ ON] LNB Power On
[off] DVB Mode
[off] 22 kHz Tone
[off] 18V Selected
[off] DC Tuned
[off] Armed (streaming)
Signal Lock: LOCKED
SNR: 8.2 dB (raw 0x0823)
Quality: [################------------------------] 42.3%
```
Use `--json` for programmatic access to all fields.
---
## tune -- Transponder Tuning
The 8-step tuning sequence: check status, boot demodulator, enable LNB power, set voltage (polarization), set extra voltage, set 22 kHz tone (band), send TUNE_8PSK command, wait for signal lock.
### Required Arguments
| Argument | Description |
|----------|-------------|
| `FREQ` | Transponder downlink frequency in MHz (e.g., `12520`) |
| `SR` | Symbol rate in ksps (e.g., `27500`) |
### Options
| Flag | Description |
|------|-------------|
| `--pol H/V/L/R` | Polarization: H (horizontal/18V), V (vertical/13V), L (left circular/18V), R (right circular/13V) |
| `--band low/high` | LNB band: low (tone off, 9750 MHz LO) or high (tone on, 10600 MHz LO) |
| `--lnb-lo MHZ` | Override LNB local oscillator frequency (default: 9750 low, 10600 high) |
| `--mod TYPE` | Modulation type (default: `qpsk`) |
| `--fec RATE` | FEC rate (default: `auto`) |
| `--timeout SECONDS` | Signal lock timeout (default: `10`) |
| `--extra-volt` | Enable +1V LNB voltage boost for long cables |
| `--json` | Output JSON result |
### Modulation Types
| Name | Description | FEC Group |
|------|-------------|-----------|
| `qpsk` | DVB-S QPSK | dvbs |
| `turbo-qpsk` | Turbo-coded QPSK | turbo |
| `turbo-8psk` | Turbo-coded 8PSK | turbo |
| `turbo-16qam` | Turbo-coded 16QAM | turbo-16qam |
| `dcii-combo` | Digicipher II Combo | dcii |
| `dcii-i` | Digicipher II I-stream | dcii |
| `dcii-q` | Digicipher II Q-stream | dcii |
| `dcii-oqpsk` | Digicipher II Offset QPSK | dcii |
| `dss` | DSS QPSK | dvbs |
| `bpsk` | DVB BPSK | dvbs |
### FEC Rates by Group
| Group | Available Rates |
|-------|----------------|
| **dvbs** | `1/2`, `2/3`, `3/4`, `5/6`, `7/8`, `auto`, `none` |
| **turbo** | `1/2`, `2/3`, `3/4`, `5/6`, `auto` |
| **turbo-16qam** | `3/4`, `auto` |
| **dcii** | `1/2`, `2/3`, `6/7`, `3/4`, `5/11`, `1/2+`, `2/3+`, `6/7+`, `3/4+`, `auto` |
<Tabs>
<TabItem label="DVB-S">
```bash title="Standard DVB-S QPSK, Ku-band high"
sudo python3 tools/tune.py tune 12520 27500 --pol H --band high
```
```bash title="DVB-S with explicit FEC"
sudo python3 tools/tune.py tune 11836 27500 --pol V --band low --fec 3/4
```
```bash title="C-band with custom LNB LO"
sudo python3 tools/tune.py tune 3960 26667 --pol V --lnb-lo 5150
```
</TabItem>
<TabItem label="Turbo">
```bash title="Turbo 8PSK"
sudo python3 tools/tune.py tune 12224 20000 --pol V --band high --mod turbo-8psk --fec 2/3
```
```bash title="Turbo QPSK with auto FEC"
sudo python3 tools/tune.py tune 12090 20000 --pol H --band high --mod turbo-qpsk
```
</TabItem>
<TabItem label="DCII">
```bash title="Digicipher II Combo"
sudo python3 tools/tune.py tune 12224 20000 --pol V --band high --mod dcii-combo --fec auto
```
```bash title="DCII Split I-stream"
sudo python3 tools/tune.py tune 12224 20000 --pol V --band high --mod dcii-i --fec 6/7
```
</TabItem>
</Tabs>
### Tuning Output
```
Tuning SkyWalker-1
==================================================
Downlink: 12520 MHz
LNB LO: 10600 MHz
IF Frequency: 1920.0 MHz (1920000 kHz)
Symbol Rate: 27500 ksps (27500000 sps)
Modulation: DVB-S QPSK (index 0)
FEC: auto (index 5)
Polarization: Horizontal (18V)
Band: high (22kHz on)
[1/8] Config status: 0x07
[2/8] Demodulator already running
[3/8] LNB power already on
[4/8] Setting LNB voltage: 18V
[5/8] Extra voltage: off
[6/8] 22 kHz tone: ON
[7/8] Sending TUNE_8PSK...
[8/8] Waiting for signal lock (timeout 10s)...
...
LOCKED
SNR: 8.2 dB (raw 0x0823)
Quality: [################------------------------] 42.3%
```
<Aside type="tip">
The IF frequency is computed as `downlink - LNB_LO`. It must fall within 950--2150 MHz or the tool will warn. If you see negative IF values, your LNB LO is set higher than the downlink frequency -- check your LNB type.
</Aside>
---
## stream -- Transport Stream Capture
Captures MPEG-2 transport stream data from EP2 bulk endpoint after the device is tuned and locked. Requires a prior successful `tune` command (signal must be locked).
```bash title="Capture to file for 60 seconds"
sudo python3 tools/tune.py stream -o capture.ts --duration 60
```
```bash title="Pipe directly to VLC"
sudo python3 tools/tune.py stream --stdout | vlc -
```
```bash title="Pipe to ffmpeg for recording"
sudo python3 tools/tune.py stream --stdout | ffmpeg -i pipe: -c copy output.mp4
```
| Flag | Description |
|------|-------------|
| `-o, --output FILE` | Write TS data to file |
| `--stdout` | Write TS data to stdout (for piping) |
| `--duration SECONDS` | Capture duration (default: until Ctrl-C) |
The stream status is written to stderr when using `--stdout`, so it does not contaminate the TS data pipe.
<Aside type="tip">
Capture a short sample and analyze it with [ts_analyze.py](/tools/ts-analyzer/) to verify PIDs, check for continuity errors, and identify the programs in the transport stream.
</Aside>
---
## diseqc -- Switch Commands
Send DiSEqC 1.0 port selection, mini-DiSEqC tone bursts, or raw DiSEqC messages.
```bash title="Select DiSEqC 1.0 port 1"
sudo python3 tools/tune.py diseqc --port 1
```
```bash title="Send tone burst A"
sudo python3 tools/tune.py diseqc --tone-burst A
```
```bash title="Send raw DiSEqC message"
sudo python3 tools/tune.py diseqc --raw E0 10 38 F0
```
| Flag | Description |
|------|-------------|
| `--port 1-4` | DiSEqC 1.0 committed switch port |
| `--tone-burst A/B` | Mini-DiSEqC tone burst |
| `--raw HH HH ...` | Raw DiSEqC bytes in hex (3--6 bytes) |
For details on the DiSEqC signaling implementation, see [DiSEqC Protocol](/lnb-diseqc/diseqc-protocol/).
---
## lnb -- LNB Control
Direct control of LNB voltage, 22 kHz tone, and power supply. Running with no flags shows the current LNB state.
```bash title="Show LNB status"
sudo python3 tools/tune.py lnb
```
```bash title="Set voltage and tone"
sudo python3 tools/tune.py lnb --voltage 18 --tone on
```
```bash title="Power cycle the LNB"
sudo python3 tools/tune.py lnb --power off
sudo python3 tools/tune.py lnb --power on
```
| Flag | Description |
|------|-------------|
| `--voltage 13/18` | LNB voltage (13V = vertical, 18V = horizontal) |
| `--tone on/off` | 22 kHz tone (on = high band, off = low band) |
| `--extra-volt` | Enable +1V boost (13V becomes 14V, 18V becomes 19V) |
| `--power on/off` | LNB power supply on/off |
<Aside type="caution">
The LNB can supply up to 750 mA non-continuous, but sustained loads should stay below 450 mA to avoid overheating the on-board regulator. Use `--extra-volt` only when needed for long cable runs.
</Aside>
---
## Signal Quality Metrics
| Metric | Source | Description |
|--------|--------|-------------|
| **SNR** | `GET_SIGNAL_STRENGTH` (0x87) | Signal-to-noise ratio in dB, read as 16-bit value (dBu * 256 units) |
| **Lock** | `GET_SIGNAL_LOCK` (0x90) | BCM4500 register 0xA4, bit 5 indicates signal lock |
| **Quality %** | Computed | SNR scaled: `snr_raw * 17` maps to 0--100%, saturating at SNR >= `0x0F00` |
For details on the signal monitoring protocol, see [Signal Monitoring](/bcm4500/signal-monitoring/).
## See Also
- [Tuning Protocol](/bcm4500/tuning-protocol/) -- firmware-level TUNE_8PSK command format
- [LNB Control](/lnb-diseqc/lnb-control/) -- hardware-level voltage and tone control
- [TS Analyzer](/tools/ts-analyzer/) -- analyze captured transport streams
- [Vendor Commands](/usb/vendor-commands/) -- complete USB command reference

135
site/src/content/docs/usb/boot-sequence.mdx Normal file
View File

@ -0,0 +1,135 @@
---
title: Boot Sequence
description: Complete power-on boot flow from USB enumeration through BCM4500 demodulator initialization.
---
import { Steps, Badge, Aside } from '@astrojs/starlight/components';
## EEPROM Boot (Hardware)
The SkyWalker-1 firmware is stored in a 24Cxx-family I2C EEPROM in Cypress C2 format. On power-up, the FX2 boot ROM reads this firmware automatically -- no host interaction is required.
### C2 EEPROM Format
| Offset | Size | Field | SkyWalker-1 Value |
|--------|------|-------|-------------------|
| 0 | 1 | Marker | 0xC2 (external memory, large code model) |
| 1 | 2 | VID (LE) | 0x09C0 |
| 3 | 2 | PID (LE) | 0x0203 |
| 5 | 2 | DID (LE) | 0x0000 |
| 7 | 1 | Config | 0x40 (400 kHz I2C) |
Code segments follow the header: 2-byte length (BE) + 2-byte target address (BE) + data. Maximum segment size is 1023 bytes (FX2 I2C boot ROM buffer limit). All SkyWalker-1 variants use 10 segments.
The terminator is 0x80xx (high bit set) + 2-byte entry point address (0xE600 = CPUCS register).
## Kernel Driver Boot Flow
After USB enumeration, the Linux `dvb_usb_gp8psk` driver executes this initialization sequence:
<Steps>
1. **GET_8PSK_CONFIG (0x80)** -- Read the [configuration status byte](/usb/config-status/). Check bit 0 (`bm8pskStarted`).
2. **BOOT_8PSK (0x89, wValue=1)** -- If not started, power on the BCM4500 demodulator. Then read the firmware version via **GET_FW_VERS (0x92)**.
3. **LOAD_BCM4500 (0x88)** -- If bit 1 (`bm8pskFW_Loaded`) is clear, load BCM4500 firmware. This only applies to Rev.1 Warm (PID 0x0201). On SkyWalker-1, this bit is always set and 0x88 returns STALL.
4. **START_INTERSIL (0x8A, wValue=1)** -- If bit 2 (`bmIntersilOn`) is clear, enable the LNB power supply.
5. **SET_DVB_MODE (0x8E, wValue=1)** -- Attempt to set DVB mode. This STALLs on all SkyWalker-1 firmware versions (the command is a no-op).
6. **ARM_TRANSFER (0x85, wValue=0)** -- Abort any pending MPEG-2 transfer to ensure a clean state.
7. **Device ready for tuning** -- The kernel driver reports the frontend as available.
</Steps>
## BCM4500 Demodulator Boot (BOOT_8PSK, 0x89)
The BOOT_8PSK command handler powers on the BCM4500 demodulator and writes three initialization register blocks via I2C. This sequence was reverse-engineered from stock v2.06 firmware (`FUN_CODE_1D4F` + `FUN_CODE_0ddd`) and re-implemented in custom firmware v3.01.0.
<Steps>
1. **Assert BCM4500 RESET** -- Drive P0.5 LOW. This holds the BCM4500's digital logic in reset while power is applied.
2. **Power on** -- Set P0.1 HIGH (power enable), P0.2 LOW (power disable off). The SkyWalker-1 has complementary power control pins.
3. **Wait for power settle** -- 30 ms delay. The power supply must reach regulation before releasing reset.
4. **Release RESET** -- Drive P0.5 HIGH. The BCM4500 begins its internal power-on reset (POR) and mask ROM boot sequence.
5. **Wait for BCM4500 POR** -- 50 ms delay. The chip needs time for its internal oscillator to stabilize and mask ROM to execute.
6. **I2C probe** -- Read direct register 0xA2 (status) at I2C address 0x08 to verify the chip is alive and responding. If this fails, boot aborts.
7. **Write init block 0** -- 7 bytes to indirect page 0, starting at register 0x06. Data: `{06 0b 17 38 9f d9 80}`.
8. **Write init block 1** -- 8 bytes to indirect page 0, starting at register 0x07. Data: `{07 09 39 4f 00 65 b7 10}`.
9. **Write init block 2** -- 3 bytes to indirect page 0, starting at register 0x0F. Data: `{0f 0c 09}`.
10. **Set config_status** -- OR in `BM_STARTED | BM_FW_LOADED` (0x03). Subsequent vendor commands check this flag before operating.
</Steps>
Each init block is written using the BCM4500 [indirect register protocol](/bcm4500/demodulator/): page select (0xA6 = 0x00), data to 0xA7 (multi-byte with auto-increment), trailing zero to 0xA7, then commit (0xA8 = 0x03). The firmware polls 0xA8 until the command completes before proceeding.
**Total boot time**: approximately 90 ms (30 ms power settle + 50 ms POR delay + ~10 ms I2C transactions).
### Boot Results
| Metric | Value |
|--------|-------|
| Boot time | ~90 ms total |
| config_status after boot | 0x03 (STARTED + FW_LOADED) |
| Direct registers 0xA2-0xA8 | All return 0x02 (powered, not locked -- expected without signal) |
| Signal lock | 0x00 (no lock -- no satellite signal present) |
<Aside type="danger" title="I2C STOP Corruption During Boot">
A critical bug was discovered during custom firmware development: sending `I2CS |= bmSTOP` when no I2C transaction is active (before the probe step) corrupts the FX2 I2C controller state, causing all subsequent I2C operations to fail.
The fix is to simply omit the spurious STOP condition. If the I2C bus is idle (as it should be after power-on), a new START condition succeeds without any bus reset.
See [I2C STOP Corruption Bug](/i2c/stop-corruption-bug/) for the complete root cause analysis.
</Aside>
## Firmware Version Identification
The kernel reads the firmware version on boot via GET_FW_VERS (0x92) and logs it:
```
gp8psk: FW Version = 2.06.4 (0x20604) Build 2007/07/13
```
Kernel revision constants for hardware detection:
```c title="gp8psk-fe.h"
GP8PSK_FW_REV1 = 0x020604 // v2.06.4
GP8PSK_FW_REV2 = 0x020704 // v2.07.4
```
If `fw_vers >= GP8PSK_FW_REV2`, the kernel enables Rev.2-specific code paths. The v2.10 and v2.13 firmwares are newer than either constant and trigger Rev.2 behavior.
## FX2 CPUCS Recovery
The FX2's CPUCS register at 0xE600 is accessible via the standard vendor request `bRequest=0xA0` (RAM read/write), which is handled by the FX2 boot ROM in silicon -- not by user firmware. This means firmware can be reloaded over a completely hung device without a physical USB unplug:
```bash title="Recover a hung device"
sudo python3 tools/fw_load.py load firmware/build/skywalker1.ihx --wait 3
```
Writing 0x01 to CPUCS halts the CPU. New code is written to RAM. Writing 0x00 restarts it. The device re-enumerates with the new firmware.
## Custom Debug Boot Modes (v3.01.0)
The custom firmware extends BOOT_8PSK (0x89) with incremental debug modes for isolating boot failures:
| wValue | Action | Purpose |
|--------|--------|---------|
| 0x80 | No-op: return `config_status` and `boot_stage` | Status check without side effects |
| 0x81 | GPIO + power + delays only (no I2C) | Test power sequencing |
| 0x82 | GPIO + power + I2C probe | Test I2C after power-on |
| 0x83 | GPIO + power + probe + init block 0 | Test first register write |
| 0x84 | I2C probe only (chip already powered) | Isolate I2C from power sequencing |
| 0x85 | Same as 0x82 without bmSTOP | Confirmed the STOP corruption bug |
| 0x01 | Full boot (production) | Normal operation |
| 0x00 | Shutdown | Power down demodulator |
These modes were instrumental in identifying the [I2C STOP corruption bug](/i2c/stop-corruption-bug/) -- mode 0x82 (with bmSTOP) failed while mode 0x85 (without bmSTOP) succeeded, pinpointing the exact cause.

79
site/src/content/docs/usb/config-status.mdx Normal file
View File

@ -0,0 +1,79 @@
---
title: Configuration Status Byte
description: Bit-field breakdown of the configuration status byte returned by GET_8PSK_CONFIG (0x80).
---
import { Badge, Aside } from '@astrojs/starlight/components';
The configuration status byte is returned by the GET_8PSK_CONFIG vendor command (0x80) and reflects the current device state. The kernel driver checks these bits during initialization to determine which boot steps have already completed.
## Bit Field Map
| Bit | Mask | Name | Meaning |
|-----|------|------|---------|
| 7 | 0x80 | bmArmed | MPEG-2 stream transfer armed / GPIF active |
| 6 | 0x40 | bmDCtuned | DC offset tuning complete (set for DCII modes) |
| 5 | 0x20 | bmSEL18V | 18V LNB voltage selected (else 13V) |
| 4 | 0x10 | bm22kHz | 22 kHz tone active |
| 3 | 0x08 | bmDVBmode | DVB mode enabled |
| 2 | 0x04 | bmIntersilOn | LNB power supply enabled |
| 1 | 0x02 | bm8pskFW_Loaded | BCM4500 firmware loaded |
| 0 | 0x01 | bm8pskStarted | Device booted and running |
## IRAM Storage Address
The status byte is stored at a different IRAM address depending on firmware version:
| Firmware | IRAM Address |
|----------|-------------|
| v2.06 | 0x6D |
| Rev.2 v2.10.4 | 0x4E |
| v2.13 | 0x4F |
## Bit Details
### Bit 0: bm8pskStarted <Badge text="0x01" variant="note" />
Set when BOOT_8PSK (0x89, wValue=1) completes successfully. The kernel driver checks this bit first. If clear, it sends BOOT_8PSK to power on the demodulator.
### Bit 1: bm8pskFW_Loaded <Badge text="0x02" variant="note" />
Indicates that the BCM4500 firmware has been loaded. On the SkyWalker-1, the BCM4500 runs from internal mask ROM, so this bit is **always set** after boot. The kernel driver checks this to decide whether to send LOAD_BCM4500 (0x88), which STALLs on the SkyWalker-1 since it is unnecessary.
### Bit 2: bmIntersilOn <Badge text="0x04" variant="note" />
Set when START_INTERSIL (0x8A, wValue=1) enables the LNB power supply. The name "Intersil" refers to the LNB voltage regulator IC manufacturer.
### Bit 3: bmDVBmode <Badge text="0x08" variant="note" />
Set when DVB-S mode is enabled via SET_DVB_MODE (0x8E). On SkyWalker-1, this command STALLs -- the bit is managed internally by the tuning dispatch logic.
### Bit 4: bm22kHz <Badge text="0x10" variant="note" />
Reflects the current state of the 22 kHz tone (SET_22KHZ_TONE, 0x8C). Set when the tone is active (high band), clear when inactive (low band).
### Bit 5: bmSEL18V <Badge text="0x20" variant="note" />
Reflects the current LNB voltage selection (SET_LNB_VOLTAGE, 0x8B). Set for 18V (horizontal/circular-left), clear for 13V (vertical/circular-right).
### Bit 6: bmDCtuned <Badge text="0x40" variant="note" />
Set when tuning to a Digicipher II (DCII) modulation mode. Cleared for all other modulation types (DVB-S, Turbo, DSS, BPSK). The tuning dispatch logic manages this bit during TUNE_8PSK (0x86) processing.
### Bit 7: bmArmed <Badge text="0x80" variant="note" />
Set when ARM_TRANSFER (0x85, wValue=1) starts the MPEG-2 transport stream. Cleared when ARM_TRANSFER (0x85, wValue=0) stops it. While set, the [GPIF engine](/bcm4500/gpif-streaming/) is continuously reading data from the BCM4500 into the EP2 FIFO.
## Typical Values
| State | Value | Bits Set |
|-------|-------|----------|
| After power-on (before boot) | 0x00 | None |
| After BOOT_8PSK | 0x03 | bm8pskStarted + bm8pskFW_Loaded |
| After LNB enable + 18V + tone | 0x37 | Started + FW + Intersil + 18V + 22kHz |
| Streaming DVB-S | 0xB7 | Above + bmArmed |
| Streaming DCII | 0xF7 | Above + bmDCtuned |
<Aside type="note" title="Kernel Driver Behavior">
The kernel driver reads this byte during initialization and uses it to skip already-completed steps. On a warm reboot (without USB disconnect), some bits may already be set from the previous session, causing the driver to skip BOOT_8PSK, START_INTERSIL, or LOAD_BCM4500 as appropriate.
</Aside>

105
site/src/content/docs/usb/interface.mdx Normal file
View File

@ -0,0 +1,105 @@
---
title: USB Interface
description: USB VID/PID table, endpoint map, descriptors, and warm boot behavior for the SkyWalker-1.
---
import { Badge, Aside } from '@astrojs/starlight/components';
## VID/PID Table
All Genpix products share USB Vendor ID `0x09C0`:
| PID | Product | State | Notes |
|-----|---------|-------|-------|
| 0x0200 | 8PSK-to-USB2 Rev.1 | <Badge text="Cold" variant="caution" /> | Requires FW01 upload to RAM |
| 0x0201 | 8PSK-to-USB2 Rev.1 | <Badge text="Warm" variant="success" /> | Requires FW02 (BCM4500 firmware) |
| 0x0202 | 8PSK-to-USB2 Rev.2 | <Badge text="Warm" variant="success" /> | Boots from EEPROM |
| 0x0203 | **SkyWalker-1** | <Badge text="Warm" variant="success" /> | Boots from EEPROM |
| 0x0204 | SkyWalker-1 (alternate) | <Badge text="Warm" variant="success" /> | Boots from EEPROM |
| 0x0205 | SkyWalker-2 | -- | Not in kernel 6.16.5 |
| 0x0206 | SkyWalker CW3K | <Badge text="Warm" variant="success" /> | Requires CW3K_INIT (0x9D) |
PID `0x0203` was added to the Linux kernel `dvb_usb_gp8psk` device table after v6.6.1.
## Endpoint Map
| Property | Value |
|----------|-------|
| Control endpoint | EP0 (default pipe, vendor requests) |
| Bulk IN endpoint | EP2 (address 0x82) -- MPEG-2 transport stream |
| Generic bulk CTRL endpoint | 0x01 (BCM4500 FW02 upload, Rev.1 only) |
## Streaming Properties
| Property | Value |
|----------|-------|
| URB count | 7 |
| URB buffer size | 8192 bytes each |
| Stream type | USB_BULK |
| FX2 controller type | CYPRESS_FX2 |
## EP2 Endpoint Configuration
```c title="EP2CFG Register (0xE610)"
EP2CFG = 0xE2; // valid=1, dir=IN, type=BULK, size=512, buf=DOUBLE
```
| Bit | Value | Meaning |
|-----|-------|---------|
| 7 (VALID) | 1 | Endpoint enabled |
| 6 (DIR) | 1 | IN (device to host) |
| 5:4 (TYPE) | 10 | Bulk transfer |
| 3 (SIZE) | 0 | 512-byte packets |
| 1:0 (BUF) | 10 | Double-buffered |
EP4, EP6, and EP8 are disabled (`&= ~bmVALID`). Only EP2 is used for data streaming.
## Warm Boot Behavior
The SkyWalker-1 (PID 0x0203) enumerates directly as a "warm" device. The DVB-USB framework skips firmware download when `cold_ids` is NULL. No host-side firmware files are required.
| Device | PID | Needs FW01? | Needs FW02? | Boot Source |
|--------|-----|-------------|-------------|-------------|
| Rev.1 Cold | 0x0200 | Yes | -- | RAM (empty) |
| Rev.1 Warm | 0x0201 | No | Yes | RAM (FW01 loaded) |
| Rev.2 | 0x0202 | No | No | EEPROM |
| SkyWalker-1 | 0x0203 | No | No | EEPROM |
| SkyWalker CW3K | 0x0206 | No | No | EEPROM |
<Aside type="note" title="Firmware Files Not Available">
The firmware files `dvb-usb-gp8psk-01.fw` and `dvb-usb-gp8psk-02.fw` were never open-sourced or included in the `linux-firmware` package. They are only needed for the older Rev.1 hardware (PID 0x0200/0x0201), not for the SkyWalker-1.
</Aside>
## USB Control Transfer Protocol
All vendor commands use USB control transfers with these common parameters:
| Parameter | Value |
|-----------|-------|
| bmRequestType | `USB_TYPE_VENDOR` (0x40 for OUT, 0xC0 for IN) |
| Timeout | 2000 ms |
| Retry | Up to 3 attempts for IN operations if partial data received |
| Data buffer maximum | 80 bytes (kernel driver) |
See [Vendor Commands](/usb/vendor-commands/) for the complete command reference.
## Kernel Driver Modules
The Linux kernel uses two modules for the SkyWalker-1:
| Module | Function |
|--------|----------|
| `dvb_usb_gp8psk` | USB transport layer, device management, firmware loading |
| `gp8psk_fe` | DVB frontend operations (demodulation, tuning, signal status) |
<Aside type="tip" title="Blacklisting for Development">
When developing or testing custom firmware, blacklist both kernel modules to prevent the driver from racing with your test tools:
```
# /etc/modprobe.d/blacklist-gp8psk.conf
blacklist dvb_usb_gp8psk
blacklist gp8psk_fe
```
Then unload: `sudo modprobe -r dvb_usb_gp8psk gp8psk_fe`
</Aside>

177
site/src/content/docs/usb/vendor-commands.mdx Normal file
View File

@ -0,0 +1,177 @@
---
title: Vendor Commands
description: Complete USB vendor command reference with bRequest codes, parameters, and firmware version compatibility.
---
import { Tabs, TabItem, Badge, Aside } from '@astrojs/starlight/components';
All vendor commands use USB control transfers with `USB_TYPE_VENDOR` (bmRequestType bit 6 set). The vendor command dispatcher at CODE:0056 validates `bRequest` in the range 0x80--0x9D (30 entries for v2.06/v2.13) or 0x80--0x9A (27 entries for Rev.2) and dispatches via an indexed jump table at CODE:0076.
<Aside type="note" title="Status Key">
<Badge text="OK" variant="success" /> = Implemented and functional. <Badge text="STALL" variant="danger" /> = Routes to stall handler (endpoint stall returned). <Badge text="Proto" variant="caution" /> = Partial/prototype implementation. <Badge text="N/A" variant="note" /> = Command index out of range (Rev.2 only supports 0x80--0x9A). <Badge text="Changed" variant="caution" /> = Implementation differs between versions.
</Aside>
<Tabs>
<TabItem label="Documented Commands">
## Stock Command Table (0x80--0x9D)
| Cmd | Name | Dir | wValue | wIndex | wLength | Purpose | v2.06 | Rev.2 | v2.13 |
|-----|------|-----|--------|--------|---------|---------|-------|-------|-------|
| 0x80 | GET_8PSK_CONFIG | IN | 0 | 0 | 1 | Read [configuration status byte](/usb/config-status/) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x81 | SET_8PSK_CONFIG | OUT | varies | 0 | 0 | Set config (reserved) | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> |
| 0x82 | (reserved) | -- | -- | -- | -- | Reserved | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> |
| 0x83 | I2C_WRITE | OUT | dev_addr | reg_addr | N | Write to I2C device | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x84 | I2C_READ | IN | dev_addr | reg_addr | N | Read from I2C device | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x85 | ARM_TRANSFER | OUT | 0/1 | 0 | 0 | Start (1) / stop (0) MPEG-2 stream | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x86 | TUNE_8PSK | OUT | 0 | 0 | 10 | Set [tuning parameters](/bcm4500/tuning-protocol/) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x87 | GET_SIGNAL_STRENGTH | IN | 0 | 0 | 6 | Read [SNR and diagnostics](/bcm4500/signal-monitoring/) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="Changed" variant="caution" /> |
| 0x88 | LOAD_BCM4500 | OUT | 1 | 0 | 0 | Initiate BCM4500 FW download | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> |
| 0x89 | BOOT_8PSK | IN | 0/1 | 0 | 1 | Power on (1) / off (0) demodulator | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x8A | START_INTERSIL | IN | 0/1 | 0 | 1 | Enable (1) / disable (0) LNB supply | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x8B | SET_LNB_VOLTAGE | OUT | 0/1 | 0 | 0 | 13V (0) or 18V (1) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x8C | SET_22KHZ_TONE | OUT | 0/1 | 0 | 0 | Tone off (0) or on (1) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x8D | SEND_DISEQC_COMMAND | OUT | msg[0] | 0 | len | DiSEqC message or tone burst | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x8E | SET_DVB_MODE | OUT | 1 | 0 | 0 | Enable DVB-S mode | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> | <Badge text="STALL" variant="danger" /> |
| 0x8F | SET_DN_SWITCH | OUT | cmd7bit | 0 | 0 | Legacy Dish Network switch protocol | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x90 | GET_SIGNAL_LOCK | IN | 0 | 0 | 1 | Read [signal lock status](/bcm4500/signal-monitoring/) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x92 | GET_FW_VERS | IN | 0 | 0 | 6 | Read firmware version + build date | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x93 | GET_SERIAL_NUMBER | IN | 0 | 0 | 4 | Read 4-byte serial from EEPROM | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x94 | USE_EXTRA_VOLT | OUT | 0/1 | 0 | 0 | Enable +1V LNB boost (14V/19V) | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x95 | GET_FPGA_VERS | IN | 0 | 0 | 1 | Read EEPROM hardware/platform ID | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
### Detailed Parameter Formats
**0x87 GET_SIGNAL_STRENGTH**: Returns 6 bytes. Bytes 0--1 contain a 16-bit SNR value (little-endian, dBu x 256 units). Bytes 2--5 are reserved/diagnostic BCM4500 registers. Version differences: v2.06 polls 3 registers (0xA2, 0xA8, 0xA4) up to 6 times; v2.13 consolidates to 1 register with a simplified poll.
**0x8D SEND_DISEQC_COMMAND**: When `wLength > 0`, the payload is a standard DiSEqC message (3--6 bytes) with `wValue` set to `msg[0]` (framing byte, typically 0xE0 or 0xE1). When `wLength == 0` and `wValue == 0`, tone burst A is sent. When `wLength == 0` and `wValue != 0`, tone burst B is sent.
**0x8F SET_DN_SWITCH**: `wValue` carries a 7-bit Dish Network switch command (LSB-first), bit-banged on GPIO P0.4 with specific timing. The 8th bit (0x80) of the original switch command selects LNB voltage and is sent separately via SET_LNB_VOLTAGE.
**0x92 GET_FW_VERS**: Returns 6 bytes of hardcoded constants:
```c title="GET_FW_VERS Response Format"
Byte 0: version minor_minor (e.g., 0x04)
Byte 1: version minor (e.g., 0x06)
Byte 2: version major (e.g., 0x02)
Byte 3: build day (e.g., 0x0D = 13)
Byte 4: build month (e.g., 0x07 = July)
Byte 5: build year - 2000 (e.g., 0x07 = 2007)
Full version = byte[2] << 16 | byte[1] << 8 | byte[0]
Build date = (2000 + byte[5]) / byte[4] / byte[3]
```
**0x93 GET_SERIAL_NUMBER**: Returns 4 bytes read from I2C EEPROM at device address 0x51 (7-bit), extracted at 8-bit intervals using a shift/rotate routine.
**0x94 USE_EXTRA_VOLT**: `wValue=1` writes 0x6A to XRAM 0xE0B6; `wValue=0` writes 0x62. The difference is bit 3 (0x08), which controls the voltage boost on the LNB power regulator.
**0x95 GET_FPGA_VERS**: Reads from I2C EEPROM at 0x51. Despite the name, there is no FPGA on the SkyWalker-1 -- this returns a hardware platform ID. v2.06 reads EEPROM offset 0x31 (2 bytes); v2.13/Rev.2 read offset 0x00 (1 byte).
</TabItem>
<TabItem label="Debug / Internal Commands">
## Debug Commands (0x91, 0x96--0x98)
These commands are not used by any driver (Linux or Windows). They appear to be manufacturing/debug interfaces.
| Cmd | Name | Dir | wValue | wLength | Purpose | v2.06 | Rev.2 | v2.13 |
|-----|------|-----|--------|---------|---------|-------|-------|-------|
| 0x91 | I2C_ADDR_ADJUST | IN | 0=dec, 1=inc | 1 | Inc/dec internal IRAM counter | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x96 | SET_LNB_GPIO_MODE | OUT | 0/1 | 0 | Configure LNB GPIO output enables | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x97 | SET_GPIO_PINS | OUT | bitmap | 0 | Direct write to LNB GPIO pins | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
| 0x98 | GET_GPIO_STATUS | IN | 0 | 1 | Read LNB feedback GPIO pin | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> | <Badge text="OK" variant="success" /> |
### 0x91 I2C_ADDR_ADJUST
Increments (`wValue != 0`) or decrements (`wValue == 0`) an internal IRAM counter and returns its current value (1 byte). The counter lives at IRAM 0x66 (v2.06) or IRAM 0x18 (v2.13/Rev.2). Likely used for I2C address or tuner register index adjustment during development.
### 0x96 SET_LNB_GPIO_MODE
Configures GPIO output enable registers for the LNB voltage regulator hardware:
| Mode | v2.06/v2.13 | Rev.2 |
|------|-------------|-------|
| Default (wValue=0) | OEB=0xF0 | OEB=0xE7, OEA=0x9E |
| Active (wValue=1) | IOB=(IOB & 0xF7) OR 0x06; OEB=0xFE | IOB.4 clear; P0.6, P0.0 set; OEA OR= 0x41 |
### 0x97 SET_GPIO_PINS
Direct GPIO pin write for LNB control:
| wValue Bit | v2.06/v2.13 Target | Rev.2 Target |
|-----------|-------------------|-------------|
| bit 1 | IOB.1 (Port B) | P0.6 (Port A) |
| bit 2 | IOB.2 (Port B) | P0.0 (Port A) |
| bit 3 | IOB.3 (Port B) | IOB.4 (Port B) |
### 0x98 GET_GPIO_STATUS
Returns 1 byte (0 or 1) from a single GPIO input pin -- likely an LNB overcurrent or power-good feedback signal:
| Version | Pin Read |
|---------|----------|
| v2.06/v2.13 | IOB.0 (Port B bit 0) |
| Rev.2 | P0.5 (Port A bit 5) |
</TabItem>
<TabItem label="Extended Commands (v2.13+)">
## Extended Commands (0x99--0x9D)
| Cmd | Name | Dir | wValue | wLength | Purpose | v2.06 | Rev.2 | v2.13 |
|-----|------|-----|--------|---------|---------|-------|-------|-------|
| 0x99 | GET_DEMOD_STATUS | IN | 0 | 1 | Read BCM4500 register 0xF9 | <Badge text="STALL" variant="danger" /> | <Badge text="Proto" variant="caution" /> | <Badge text="OK" variant="success" /> |
| 0x9A | INIT_DEMOD | OUT | 0 | 0 | Trigger demod re-init (3 attempts) | <Badge text="STALL" variant="danger" /> | <Badge text="Proto" variant="caution" /> | <Badge text="OK" variant="success" /> |
| 0x9B | (reserved) | -- | -- | -- | Reserved | <Badge text="STALL" variant="danger" /> | <Badge text="N/A" variant="note" /> | <Badge text="STALL" variant="danger" /> |
| 0x9C | DELAY_COMMAND | OUT | delay | 0 | Host-controlled tuning delay + poll | <Badge text="STALL" variant="danger" /> | <Badge text="N/A" variant="note" /> | <Badge text="OK" variant="success" /> |
| 0x9D | CW3K_INIT / SET_MODE_FLAG | OUT | 0/1 | 0 | CW3K init or conditional demod reset | <Badge text="OK" variant="success" /> | <Badge text="N/A" variant="note" /> | <Badge text="Changed" variant="caution" /> |
### Driver Usage Notes
- The Linux driver only sends LOAD_BCM4500 (0x88) for Rev.1 Warm (PID 0x0201). On SkyWalker-1, `bm8pskFW_Loaded` is already set and 0x88 routes to STALL.
- The Linux driver only sends CW3K_INIT (0x9D) for SkyWalker CW3K (PID 0x0206).
- Rev.2 supports only commands 0x80--0x9A (27 entries). Commands 0x9B--0x9D are out of range and produce undefined behavior.
</TabItem>
<TabItem label="Custom Firmware">
## Custom Firmware Commands (0xB0--0xB6)
Commands added in custom firmware v3.01.0 for development and diagnostics:
| Cmd | Name | Dir | wValue | wIndex | wLength | Purpose |
|-----|------|-----|--------|--------|---------|---------|
| 0xB0 | SPECTRUM_SWEEP | OUT | 0 | 0 | 10 | Step through freq range, read SNR at each step |
| 0xB1 | RAW_DEMOD_READ | IN | reg | 0 | 1 | Read BCM4500 indirect register |
| 0xB2 | RAW_DEMOD_WRITE | OUT | reg | data | 0 | Write BCM4500 indirect register |
| 0xB3 | BLIND_SCAN | OUT | 0 | 0 | 16 | Try symbol rates at given freq, report lock |
| 0xB4 | I2C_BUS_SCAN | IN | 0 | 0 | 16 | Probe all 7-bit addresses, return 16-byte bitmap |
| 0xB5 | I2C_RAW_READ | IN | addr7 | reg | N | Combined write-read from any I2C device |
| 0xB6 | I2C_DIAG | IN | page | 0 | 8 | Step-by-step indirect register diagnostic |
### Parameter Formats
**0xB0 SPECTRUM_SWEEP**: 10-byte EP0 payload: `[start_freq(u32 LE kHz), stop_freq(u32 LE kHz), step_khz(u16 LE)]`. Programs BCM4500 at each frequency step, reads SNR, packs u16 LE results into EP2 bulk FIFO.
**0xB3 BLIND_SCAN**: 16-byte EP0 payload: `[freq_khz(u32 LE), sr_min(u32 LE sps), sr_max(u32 LE sps), sr_step(u32 LE sps)]`. Returns 8 bytes on lock `[freq_khz(4) + sr_locked(4)]` or 1 byte 0x00 if no lock found.
**0xB4 I2C_BUS_SCAN**: Returns a 16-byte bitmap (128 bits for addresses 0x00--0x77). Each bit set = ACK received at that 7-bit address.
</TabItem>
</Tabs>
## Vendor Command Dispatch Mechanism
The dispatch logic at CODE:0056 (identical address across all stock versions):
```
1. Check bmRequestType bit 6 -> vendor request?
2. Read bRequest from SETUPDAT[1]
3. Subtract 0x80 (command base offset)
4. Compare against maximum: < 0x1E (v2.06/v2.13) or < 0x1B (Rev.2)
5. If in range: double the index (2 bytes per AJMP) -> JMP @A+DPTR
6. If out of range: route to STALL handler
```
The jump table at CODE:0076 contains 2-byte AJMP instruction targets, one per command from 0x80 upward.

69
site/src/styles/custom.css Normal file
View File

@ -0,0 +1,69 @@
/* Teal/Steel Engineering Theme for SkyWalker-1 Docs */
:root {
--sl-color-accent-low: #0d3b3b;
--sl-color-accent: #1a8a8a;
--sl-color-accent-high: #b8e6e6;
--sl-hue: 180;
--sl-color-white: #f0f4f5;
--sl-color-gray-1: #dde4e6;
--sl-color-gray-2: #b8c4c8;
--sl-color-gray-3: #7a8f96;
--sl-color-gray-4: #4a5c63;
--sl-color-gray-5: #2a3a40;
--sl-color-gray-6: #1a2a30;
--sl-color-black: #0e1519;
}
:root[data-theme='light'] {
--sl-color-accent-low: #d0f0f0;
--sl-color-accent: #0d7377;
--sl-color-accent-high: #043d3f;
--sl-color-white: #1a2a30;
--sl-color-gray-1: #2a3a40;
--sl-color-gray-2: #4a5c63;
--sl-color-gray-3: #7a8f96;
--sl-color-gray-4: #b8c4c8;
--sl-color-gray-5: #dde4e6;
--sl-color-gray-6: #eef2f3;
--sl-color-black: #f5f8f9;
}
/* Ensure link colors use teal */
:root {
--sl-color-text-accent: var(--sl-color-accent);
}
/* Table styling for hardware register tables */
table {
font-size: 0.9rem;
}
th {
background-color: var(--sl-color-gray-6);
}
/* Code block enhancement */
.expressive-code {
--ec-brdCol: var(--sl-color-gray-5);
}
/* Badge color overrides for hardware status */
.sl-badge--success {
--sl-color-bg-badge: #0d5e3a;
color: #a8e6cf;
}
.sl-badge--danger {
--sl-color-bg-badge: #5e1a0d;
color: #e6b8a8;
}
/* Mobile horizontal scroll for wide tables */
@media (max-width: 50rem) {
table {
display: block;
overflow-x: auto;
-webkit-overflow-scrolling: touch;
}
}

3
site/tsconfig.json Normal file
View File

@ -0,0 +1,3 @@
{
"extends": "astro/tsconfigs/base"
}