skywalker-1/skywalker1-hardware-reference.md

# Genpix SkyWalker-1 Hardware Reference

Consolidated technical reference for the Genpix SkyWalker-1 DVB-S USB 2.0 satellite receiver, derived from Linux kernel driver analysis, firmware reverse engineering (Ghidra), and Windows BDA driver source review.

---

## 1. Overview

The Genpix SkyWalker-1 is a standalone USB 2.0 DVB-S satellite receiver built around two ICs:

- **Cypress CY7C68013A** (FX2LP) -- USB 2.0 Hi-Speed microcontroller (8051 core, 48 MHz)
- **Broadcom BCM4500** -- DVB-S / 8PSK satellite demodulator

The FX2 handles USB communication, LNB control, DiSEqC signaling, and orchestrates tuning via I2C commands to the BCM4500. The BCM4500 performs RF demodulation, FEC decoding, and outputs an MPEG-2 transport stream on an 8-bit parallel bus. The GPIF engine inside the FX2 transfers the transport stream directly into a USB bulk endpoint with zero firmware intervention in the data path.

### Supported Modulations

| Index | Modulation | Constant |
|-------|-----------|----------|
| 0 | DVB-S QPSK | `ADV_MOD_DVB_QPSK` |
| 1 | Turbo-coded QPSK | `ADV_MOD_TURBO_QPSK` |
| 2 | Turbo-coded 8PSK | `ADV_MOD_TURBO_8PSK` |
| 3 | Turbo-coded 16QAM | `ADV_MOD_TURBO_16QAM` |
| 4 | Digicipher II Combo | `ADV_MOD_DCII_C_QPSK` |
| 5 | Digicipher II I-stream (split) | `ADV_MOD_DCII_I_QPSK` |
| 6 | Digicipher II Q-stream (split) | `ADV_MOD_DCII_Q_QPSK` |
| 7 | Digicipher II Offset QPSK | `ADV_MOD_DCII_C_OQPSK` |
| 8 | DSS QPSK | `ADV_MOD_DSS_QPSK` |
| 9 | DVB-S BPSK | `ADV_MOD_DVB_BPSK` |

DVB-S2 is **not** supported (incompatible FEC architecture).

### RF Specifications

| Parameter | Value |
|-----------|-------|
| IF frequency range | 950 -- 2150 MHz |
| Symbol rate | 256 Ksps -- 30 Msps |
| Input connector | IEC F-type female |
| LNB voltage | 13/18V (or 14/19V with USE_EXTRA_VOLT) |
| LNB current | 450 mA continuous / 750 mA burst |
| Switch control | 22 kHz, Tone Burst, DiSEqC 1.0/1.2, Legacy Dish Network |

---

## 2. USB Interface

### VID/PID Table

All Genpix products share VID `0x09C0`:

| PID | Product | cold_ids | warm_ids | Kernel Module | Notes |
|-----|---------|----------|----------|---------------|-------|
| 0x0200 | 8PSK-to-USB2 Rev.1 Cold | Yes | No | gp8psk | Requires FW01 upload to RAM |
| 0x0201 | 8PSK-to-USB2 Rev.1 Warm | No | Yes | gp8psk | Requires FW02 (BCM4500) |
| 0x0202 | 8PSK-to-USB2 Rev.2 | No | Yes | gp8psk | Boots from EEPROM |
| 0x0203 | **SkyWalker-1** | No | Yes | gp8psk | Boots from EEPROM |
| 0x0204 | SkyWalker-1 (alternate) | No | Yes | gp8psk | Boots from EEPROM |
| 0x0205 | SkyWalker-2 | -- | -- | -- | Not in kernel 6.16.5 |
| 0x0206 | SkyWalker CW3K | No | Yes | gp8psk | Requires CW3K_INIT (0x9D) |

PID 0x0203 was added to the kernel device table after v6.6.1.

### USB Endpoints and Streaming Properties

| Property | Value |
|----------|-------|
| Control endpoint | EP0 (default, vendor requests) |
| Bulk IN endpoint | EP2 (0x82) -- MPEG-2 transport stream |
| Generic bulk CTRL endpoint | 0x01 (BCM4500 FW02 upload only) |
| URB count | 7 |
| URB buffer size | 8192 bytes each |
| Stream type | USB_BULK |
| FX2 controller type | CYPRESS_FX2 |

### Warm Boot Behavior

The SkyWalker-1 (PID 0x0203) enumerates directly as a "warm" device. The DVB-USB framework skips firmware download when `cold_ids` is NULL. No host-side firmware files (`dvb-usb-gp8psk-01.fw` or `dvb-usb-gp8psk-02.fw`) are required. These files were never open-sourced or included in the `linux-firmware` package.

| Device | Needs FW01? | Needs FW02? | Boot Source |
|--------|-------------|-------------|-------------|
| Rev.1 Cold (0x0200) | Yes | -- | RAM (empty) |
| Rev.1 Warm (0x0201) | No | Yes | RAM (FW01 loaded) |
| Rev.2 (0x0202) | No | No | EEPROM |
| SkyWalker-1 (0x0203) | No | No | EEPROM |
| SkyWalker CW3K (0x0206) | No | No | EEPROM |

---

## 3. Complete Vendor Command Reference

All vendor commands use USB control transfers:
- **USB Type**: `USB_TYPE_VENDOR`
- **Timeout**: 2000 ms
- **Retry**: Up to 3 attempts for IN operations if partial data received
- **Data buffer maximum**: 80 bytes (kernel driver)

### 3.1 Command Table

The vendor command dispatcher at CODE:0056 validates `bRequest` in the range 0x80--0x9D (30 entries) and dispatches via an indexed jump table at CODE:0076. Rev.2 supports only 0x80--0x9A (27 entries).

| Cmd | Name | Dir | wValue | wIndex | wLength | Purpose | Linux | Windows | v2.06 | Rev.2 | v2.13 |
|-----|------|-----|--------|--------|---------|---------|-------|---------|-------|-------|-------|
| 0x80 | GET_8PSK_CONFIG | IN | 0 | 0 | 1 | Read configuration status byte | Yes | Yes | OK | OK | OK |
| 0x81 | SET_8PSK_CONFIG | OUT | varies | 0 | 0 | Set config (reserved) | No | No | STALL | STALL | STALL |
| 0x82 | (reserved) | -- | -- | -- | -- | Reserved | No | No | STALL | STALL | STALL |
| 0x83 | I2C_WRITE | OUT | dev_addr | reg_addr | N | Write to I2C device | Yes | Yes | OK | OK | OK |
| 0x84 | I2C_READ | IN | dev_addr | reg_addr | N | Read from I2C device | Yes | Yes | OK | OK | OK |
| 0x85 | ARM_TRANSFER | OUT | 0/1 | 0 | 0 | Start (1) / stop (0) MPEG-2 stream | Yes | Yes | OK | OK | OK |
| 0x86 | TUNE_8PSK | OUT | 0 | 0 | 10 | Set tuning parameters (see Section 6) | Yes | Yes | OK | OK | OK |
| 0x87 | GET_SIGNAL_STRENGTH | IN | 0 | 0 | 6 | Read SNR and diagnostics | Yes | Yes | OK | OK | Changed |
| 0x88 | LOAD_BCM4500 | OUT | 1 | 0 | 0 | Initiate BCM4500 FW download | Yes* | No | STALL | STALL | STALL |
| 0x89 | BOOT_8PSK | IN | 0/1 | 0 | 1 | Power on (1) / off (0) demodulator | Yes | Yes | OK | OK | OK |
| 0x8A | START_INTERSIL | IN | 0/1 | 0 | 1 | Enable (1) / disable (0) LNB supply | Yes | Yes | OK | OK | OK |
| 0x8B | SET_LNB_VOLTAGE | OUT | 0/1 | 0 | 0 | 13V (0) or 18V (1) | Yes | Yes | OK | OK | OK |
| 0x8C | SET_22KHZ_TONE | OUT | 0/1 | 0 | 0 | Tone off (0) or on (1) | Yes | Yes | OK | OK | OK |
| 0x8D | SEND_DISEQC_COMMAND | OUT | msg[0] | 0 | len | DiSEqC message or tone burst | Yes | Yes | OK | OK | OK |
| 0x8E | SET_DVB_MODE | OUT | 1 | 0 | 0 | Enable DVB-S mode | Yes | No | STALL | STALL | STALL |
| 0x8F | SET_DN_SWITCH | OUT | cmd7bit | 0 | 0 | Legacy Dish Network switch protocol | Yes | Yes | OK | OK | OK |
| 0x90 | GET_SIGNAL_LOCK | IN | 0 | 0 | 1 | Read signal lock status | Yes | Yes | OK | OK | OK |
| 0x91 | I2C_ADDR_ADJUST | IN | 0/1 | 0 | 1 | Inc/dec internal IRAM counter (debug) | No | No | OK | OK | OK |
| 0x92 | GET_FW_VERS | IN | 0 | 0 | 6 | Read firmware version + build date | Yes | No | OK | OK | OK |
| 0x93 | GET_SERIAL_NUMBER | IN | 0 | 0 | 4 | Read 4-byte serial from I2C EEPROM | No | Yes | OK | OK | OK |
| 0x94 | USE_EXTRA_VOLT | OUT | 0/1 | 0 | 0 | Enable +1V LNB boost (14V/19V) | Yes | Yes | OK | OK | OK |
| 0x95 | GET_FPGA_VERS | IN | 0 | 0 | 1 | Read EEPROM hardware/platform ID | Yes | No | OK | OK | OK |
| 0x96 | SET_LNB_GPIO_MODE | OUT | 0/1 | 0 | 0 | Configure LNB GPIO output enables | No | No | OK | OK | OK |
| 0x97 | SET_GPIO_PINS | OUT | bitmap | 0 | 0 | Direct write to LNB GPIO pins | No | No | OK | OK | OK |
| 0x98 | GET_GPIO_STATUS | IN | 0 | 0 | 1 | Read LNB feedback GPIO pin | No | No | OK | OK | OK |
| 0x99 | GET_DEMOD_STATUS | IN | 0 | 0 | 1 | Read BCM4500 register 0xF9 | No | No | STALL | Proto | OK |
| 0x9A | INIT_DEMOD | OUT | 0 | 0 | 0 | Trigger demod re-init (3 attempts) | No | No | STALL | Proto | OK |
| 0x9B | (reserved) | -- | -- | -- | -- | Reserved | No | No | STALL | N/A | STALL |
| 0x9C | DELAY_COMMAND | OUT | delay | 0 | 0 | Host-controlled tuning delay + poll | No | No | STALL | N/A | OK |
| 0x9D | CW3K_INIT / SET_MODE_FLAG | OUT | 0/1 | 0 | 0 | CW3K init or conditional demod reset | Yes** | No | OK | N/A | Changed |

\* Linux driver only sends LOAD_BCM4500 for Rev.1 Warm (PID 0x0201). On SkyWalker-1, `bm8pskFW_Loaded` is already set and 0x88 routes to STALL.

\*\* Linux driver only sends CW3K_INIT for SkyWalker CW3K (PID 0x0206).

**Status key**: OK = implemented, STALL = routes to stall handler (endpoint stall returned), Proto = partial/prototype implementation, N/A = command index out of range (Rev.2 only supports 0x80--0x9A), Changed = implementation differs between versions.

### 3.2 Detailed Parameter Formats

**0x8D SEND_DISEQC_COMMAND**: When `wLength > 0`, the payload is a standard DiSEqC message (3--6 bytes) with `wValue` set to `msg[0]` (framing byte, typically 0xE0 or 0xE1). When `wLength == 0` and `wValue == 0`, a tone burst A is sent. When `wLength == 0` and `wValue != 0`, a tone burst B is sent.

**0x8F SET_DN_SWITCH**: `wValue` carries a 7-bit Dish Network switch command (LSB-first), bit-banged on GPIO P0.4 with specific timing. The 8th bit of the original switch command selects LNB voltage and is sent separately via SET_LNB_VOLTAGE.

**0x92 GET_FW_VERS**: Returns 6 bytes: `[minor_minor, minor, major, day, month, year-2000]`. Full version = `major<<16 | minor<<8 | minor_minor`. Build date = `(2000+year)/month/day`.

**0x93 GET_SERIAL_NUMBER**: Returns 4 bytes read from I2C EEPROM at device address 0x51 (7-bit), extracted at 8-bit intervals using a shift/rotate routine.

**0x94 USE_EXTRA_VOLT**: `wValue=1` writes 0x6A to XRAM 0xE0B6; `wValue=0` writes 0x62. The difference is bit 3 (0x08), which controls the extra voltage boost on the LNB power regulator.

**0x95 GET_FPGA_VERS**: Reads from I2C EEPROM at 0x51. Despite the name, there is no FPGA -- this returns the EEPROM-stored hardware platform ID. v2.06 reads offset 0x31 (2 bytes); v2.13/Rev.2 read offset 0x00 (1 byte).

**0x96--0x98**: Internal debug commands for LNB GPIO control. 0x96 configures output enables (OEB/OEA), 0x97 writes pin states, 0x98 reads a feedback pin. GPIO assignments differ between v2.06/v2.13 (Port B) and Rev.2 (Port A + Port B). See Section 10 for pin details.

---

## 4. Configuration Status Byte

Returned by GET_8PSK_CONFIG (0x80). Stored in IRAM at version-dependent addresses.

```
Bit 7 (0x80): bmArmed         - MPEG-2 stream transfer armed / GPIF active
Bit 6 (0x40): bmDCtuned       - DC offset tuning complete (set for DCII modes)
Bit 5 (0x20): bmSEL18V        - 18V LNB voltage selected (else 13V)
Bit 4 (0x10): bm22kHz         - 22 kHz tone active
Bit 3 (0x08): bmDVBmode       - DVB mode enabled
Bit 2 (0x04): bmIntersilOn    - LNB power supply enabled
Bit 1 (0x02): bm8pskFW_Loaded - BCM4500 firmware loaded (always set on SkyWalker-1)
Bit 0 (0x01): bm8pskStarted   - Device booted and running
```

| Version | IRAM Address |
|---------|-------------|
| v2.06 | 0x6D |
| Rev.2 v2.10.4 | 0x4E |
| v2.13 | 0x4F |

---

## 5. Boot Sequence

### 5.1 Two-Stage Firmware Architecture

The FX2 supports two firmware sources:

1. **Host RAM upload** (Rev.1 Cold only): The host writes 8051 code to FX2 RAM via USB 0xA0 vendor requests, using the built-in boot ROM. This requires `dvb-usb-gp8psk-01.fw` in binary hexline format.

2. **EEPROM boot** (Rev.2, SkyWalker-1, CW3K): The FX2 boot ROM reads firmware from an external I2C EEPROM in Cypress C2 format on power-up. No host interaction needed.

### 5.2 C2 EEPROM Format

SkyWalker-1 firmware is stored in Cypress C2 IIC second-stage boot format:

**Header (8 bytes):**

| Offset | Size | Field | SkyWalker-1 Value |
|--------|------|-------|-------------------|
| 0 | 1 | Marker | 0xC2 (external memory, large code model) |
| 1 | 2 | VID (LE) | 0x09C0 |
| 3 | 2 | PID (LE) | 0x0203 |
| 5 | 2 | DID (LE) | 0x0000 |
| 7 | 1 | Config | 0x40 (400 kHz I2C) |

**Code segments** follow: 2-byte length (BE) + 2-byte target address (BE) + data. Maximum segment size is 1023 bytes (FX2 I2C boot ROM buffer limit). All SkyWalker-1 variants use 10 segments.

**Terminator**: 0x80xx (high bit set) + 2-byte entry point address (0xE600 = CPUCS).

### 5.3 Power-On Boot Sequence

```
1. GET_8PSK_CONFIG (0x80) -- read config status byte
   |-- Check bit 0: bm8pskStarted?

2. If not started:
   |-- BOOT_8PSK (0x89, wValue=1)
   |-- GET_FW_VERS (0x92) -- read firmware version

3. If bit 1 clear (bm8pskFW_Loaded):
   |-- LOAD_BCM4500 (0x88) -- Rev.1 Warm only; STALLs on SkyWalker-1

4. If bit 2 clear (bmIntersilOn):
   |-- START_INTERSIL (0x8A, wValue=1) -- enable LNB power supply

5. SET_DVB_MODE (0x8E, wValue=1) -- STALLs on all SkyWalker-1 FW versions

6. ARM_TRANSFER (0x85, wValue=0) -- abort any pending MPEG transfer

7. Device ready for tuning
```

### 5.4 Firmware Version Identification

The kernel reads firmware version on boot via GET_FW_VERS (0x92) and logs:
```
gp8psk: FW Version = 2.06.4 (0x20604)  Build 2007/07/13
```

Kernel revision constants (from `gp8psk-fe.h`):
```
GP8PSK_FW_REV1 = 0x020604    (v2.06.4)
GP8PSK_FW_REV2 = 0x020704    (v2.07.4)
```

If `fw_vers >= GP8PSK_FW_REV2`, the kernel enables Rev.2-specific code paths. The v2.10 and v2.13 firmwares are newer than either kernel constant.

---

## 6. Tuning Protocol

### 6.1 TUNE_8PSK Command Format (0x86)

The host sends a 10-byte OUT payload via USB control transfer:

```
USB SETUP:  bmRequestType=0x40, bRequest=0x86, wValue=0, wIndex=0, wLength=10

EP0BUF Layout:
  Byte  Content             Encoding
  ----  ------------------  ----------------
  [0]   Symbol Rate byte 0  Little-endian LSB
  [1]   Symbol Rate byte 1
  [2]   Symbol Rate byte 2
  [3]   Symbol Rate byte 3  Little-endian MSB
  [4]   Frequency byte 0    Little-endian LSB
  [5]   Frequency byte 1
  [6]   Frequency byte 2
  [7]   Frequency byte 3    Little-endian MSB
  [8]   Modulation Type      0--9 (see Section 1 table)
  [9]   Inner FEC Rate       Index into modulation-specific table
```

**Symbol Rate** is in samples per second (sps). The Windows driver multiplies ksps by 1000.

**Frequency** is the IF frequency in kHz (950000--2150000), computed by the host as `(RF_freq - LO_freq) * multiplier`.

### 6.2 Firmware EP0BUF Parsing

The firmware reads the 10-byte payload from EP0BUF (XRAM 0xE740--0xE749) and stores:

| Source | Destination | Notes |
|--------|-------------|-------|
| EP0BUF[8] (mod) | IRAM 0x4D | Direct copy |
| EP0BUF[9] (FEC) | IRAM 0x4F | Direct copy |
| EP0BUF[4--7] (freq) | XRAM 0xE0DB--0xE0DE | Byte-reversed (LE to BE) |
| EP0BUF[0--3] (SR) | XRAM 0xE0CB--0xE0CE | Byte-reversed (LE to BE) |

The byte reversal converts host little-endian to BCM4500 big-endian so values can be written directly to the demodulator via I2C.

### 6.3 Modulation Dispatch

After parsing, the firmware validates the modulation type (< 10) and dispatches via a jump table to modulation-specific handlers. Each handler:

1. Validates the FEC index against the maximum for that modulation
2. Looks up a preconfigured byte from an XRAM table
3. Writes configuration to four XRAM registers

**FEC Rate Lookup Tables** (populated from the CODE-space init table at boot):

| XRAM Base | Modulation | Max FEC Index | Notes |
|-----------|-----------|---------------|-------|
| 0xE0F9 | DVB-S QPSK, DSS, BPSK | 7 | Standard Viterbi rates (1/2, 2/3, 3/4, 5/6, 7/8, auto, none) |
| 0xE0B7 | Turbo QPSK | 5 | Turbo code rates |
| 0xE0B1 | Turbo 8PSK | 5 | Turbo code rates |
| 0xE0BC | Turbo 16QAM | 1 | Single code rate |
| 0xE0BD | DCII (all variants) | 9 | Combined code rate + modulation |

**BCM4500 XRAM Configuration after dispatch:**

| XRAM Addr | Register | DVB-S QPSK | Turbo (Q/8/16) | DCII | DSS/BPSK |
|-----------|----------|-----------|---------------|------|----------|
| 0xE0EB | FEC Code Rate | Table lookup | Table lookup | 0xFC (fixed) | Table lookup OR 0x80 |
| 0xE0EC | Modulation Type | 0x09 | 0x09 | From DCII table | 0x09 |
| 0xE0F5 | Demod Mode | 0x10 | 0x10 | 0x10/0x11/0x12/0x16 | 0x10 |
| 0xE0F6 | Turbo Flag | 0x00 | 0x01 | 0x00 | 0x00 |

**DCII Demod Mode values:**

| Modulation | XRAM 0xE0F5 Value |
|-----------|-------------------|
| DCII Combo (4) | 0x10 |
| DCII Offset QPSK (7) | 0x11 |
| DCII I-stream (5) | 0x12 |
| DCII Q-stream (6) | 0x16 |

DSS (8) and DVB BPSK (9) share the same handler; they use the DVB-S QPSK FEC table but OR the lookup value with 0x80.

### 6.4 Complete Tuning Sequence (Host to Satellite)

```
=== Phase 1: LNB Configuration (separate vendor commands) ===
1. SET_LNB_VOLTAGE (0x8B) -- GPIO P0.4 (no I2C)
   H / Circular-L -> wValue=1 (18V)
   V / Circular-R -> wValue=0 (13V)
2. SET_22KHZ_TONE (0x8C)  -- GPIO P0.3 (no I2C)
   High band -> wValue=1 (tone on)
   Low band  -> wValue=0 (tone off)
3. SEND_DISEQC_COMMAND (0x8D) -- if multi-switch needed

=== Phase 2: Tune Command ===
4. TUNE_8PSK (0x86) -- 10-byte payload

=== Phase 3: Firmware Internal Processing ===
5. EP0BUF parsing: mod/FEC to IRAM, freq/SR byte-reversed to XRAM
6. Modulation dispatch: FEC lookup, XRAM config registers set
7. GPIO P3.6: DVB mode select

=== Phase 4: BCM4500 I2C Programming (3 outer retries x 3 I2C addresses) ===
8. Poll BCM4500 ready: I2C READ regs 0xA2, 0xA8, 0xA4
9. Write page: I2C WRITE reg 0xA6 <- 0x00
10. Write config: I2C WRITE reg 0xA7 <- [freq, SR, FEC, mod, demod params]
11. Execute: I2C WRITE reg 0xA8 <- 0x03 (indirect write command)
12. Poll completion: I2C READ regs 0xA8, 0xA2
13. Verify: I2C READ reg 0xA7 (read-back compare)

=== Phase 5: Signal Acquisition (host polling) ===
14. GET_SIGNAL_LOCK (0x90) -- poll until non-zero
15. GET_SIGNAL_STRENGTH (0x87) -- read SNR
```

### 6.5 Signal Lock (GET_SIGNAL_LOCK, 0x90)

Returns 1 byte from BCM4500 register 0xA4. Bit 5 (0x20) indicates signal lock. Both the Linux and Windows drivers interpret any non-zero value as locked and report full lock status (`FE_HAS_LOCK | FE_HAS_SYNC | FE_HAS_VITERBI | FE_HAS_SIGNAL | FE_HAS_CARRIER`).

### 6.6 Signal Strength (GET_SIGNAL_STRENGTH, 0x87)

Returns 6 bytes. The first two bytes contain a 16-bit SNR value (little-endian, in dBu * 256 units):

```
Byte 0: SNR low byte (LSB)
Byte 1: SNR high byte (MSB)
Bytes 2-5: Reserved / BCM4500 diagnostic registers
```

**SNR scaling formula** (from Windows BDA driver):
```
snr_raw = (buf[1] << 8) | buf[0]
if snr_raw <= 0x0F00:
    signal_strength = snr_raw * 17     // maps to 0--65535
else:
    signal_strength = 0xFFFF           // 100% at SNR >= 0x0F00
```

The firmware performs a multi-step I2C transaction to read signal quality: BCM4500 indirect register write/read via 0xA6/0xA7/0xA8, with read-back verification.

Version differences:
- v2.06: polls 3 registers (0xA2, 0xA8, 0xA4), loops up to 6 times
- v2.13: simplified polling (consolidated to 1 register), different call chain
- Rev.2: explicit write/read-back verification step

---

## 7. BCM4500 Demodulator Interface

### 7.1 I2C Bus

The BCM4500 is accessed via the FX2's I2C controller at XRAM 0xE678.

| Parameter | Value |
|-----------|-------|
| Primary I2C address | 0x10 (7-bit) |
| Alternate addresses | 0x3F, 0x7F (probed by v2.13 INT0 handler) |
| Bus speed | 400 kHz (set via C2 header config byte 0x40) |
| EEPROM address | 0x51 (7-bit, 24Cxx-family, for serial number / platform ID) |

The FX2 I2C controller is accessed through XRAM registers:
- 0xE678: I2C control/status register
- 0xE679: I2C data register

### 7.2 Indirect Register Protocol

The BCM4500 uses an indirect register access scheme through three I2C-accessible registers:

```
Register 0xA6: Page/address select (write page number)
Register 0xA7: Data register (read/write indirect data)
Register 0xA8: Command register (write 0x03 to execute indirect write)
```

**Write sequence:**
```
1. I2C WRITE device 0x10, reg 0xA6 <- page_number (typically 0x00)
2. I2C WRITE device 0x10, reg 0xA7 <- data_bytes (N bytes)
3. I2C WRITE device 0x10, reg 0xA8 <- 0x03 (execute)
4. Poll reg 0xA8 until command complete
5. Read back reg 0xA7 to verify
```

### 7.3 Status Registers

| Register | Function |
|----------|----------|
| 0xA2 | BCM4500 status (polled for readiness) |
| 0xA4 | Lock/ready register; bit 5 = signal locked |
| 0xA8 | Command register; bit 0 = command done (polled) |
| 0xF9 | Demod status (read by v2.13 GET_DEMOD_STATUS / INT0 polling) |

### 7.4 Demod Scan

The tune function tries up to 3 different I2C address configurations per attempt, with 3 outer retries (total: up to 9 I2C programming attempts). This supports hardware variants where the BCM4500 may appear at different bus addresses.

The demod scan function (Rev.2 FUN_CODE_1dd0) iterates through parameter sets computed from the iteration index (address offsets multiplied by 0x11), calling the indirect write function (FUN_CODE_1670) for each.

v2.13 adds a more sophisticated probe at boot: INT0 polls addresses 0x7F and 0x3F up to 40 times (0x28), setting a "no demod found" flag (`_1_4`) if neither responds. This flag prevents tuning attempts on boards with absent or failed demodulators.

---

## 8. GPIF Streaming Path

### 8.1 Data Flow

```
BCM4500              Cypress FX2 (CY7C68013A)              USB Host
Demodulator    P3.5  GPIF Engine    EP2 FIFO     EP2 (0x82)
  (I2C:0x10) <-----> (Master Read)  (AUTOIN)   ------------> Bulk IN
             8-bit   0xE4xx wfm     4x buffer                7 URBs
             parallel               8-bit                     x 8KB
```

The path is fully hardware-managed. The GPIF engine reads data from the BCM4500's 8-bit parallel transport stream output directly into the EP2 FIFO. The AUTOIN bit causes automatic USB commit when the FIFO buffer is full. The FLOWSTATE engine automatically re-triggers GPIF transactions when buffer space becomes available. No firmware intervention occurs in the data path after initial setup.

### 8.2 Key Register Configuration

All values are identical across the three firmware versions:

| Register | Address | Value | Function |
|----------|---------|-------|----------|
| IFCONFIG | 0xE601 | 0xEE | Internal 48 MHz clock, GPIF master mode, async, debug output |
| EP2FIFOCFG | 0xE618 | 0x0C | AUTOIN=1, ZEROLENIN=1, 8-bit data path |
| REVCTL | 0xE60B | 0x03 | NOAUTOARM + SKIPCOMMIT |
| CPUCS | 0xE600 | bits [4:3]=10 | 48 MHz CPU clock |
| FLOWSTATEA | 0xE668 | OR= 0x09 | FSEN (flow state enable) + FS[3] |
| GPIFIE | 0xE65C | OR= 0x3D | Waveform, TC, DONE, FIFO flag, WF2 interrupts |

**IFCONFIG decode (0xEE = 1110_1110):**
- Bit 7: IFCLKSRC=1 (internal clock)
- Bit 6: 3048MHZ=1 (48 MHz)
- Bit 5: IFCLKOE=1 (clock output to BCM4500)
- Bit 4: IFCLKPOL=0 (non-inverted)
- Bit 3: ASYNC=1 (RDY pin handshaking, not clock-edge sampling)
- Bit 2: GSTATE=1 (debug state output on PORTE)
- Bits 1:0: IFCFG=10 (GPIF internal master)

### 8.3 ARM_TRANSFER Sequences

**Start streaming (wValue=1):**
1. Set config_byte bit 7 (streaming active)
2. Load GPIF transaction count: GPIFTCB3:2 = 0x8000 (effectively infinite)
3. Reset GPIF address and EP2 FIFO byte count
4. Assert P3.5 LOW (BCM4500 transport stream enable)
5. Wait for initial GPIF transaction (poll GPIFTRIG bit 7)
6. De-assert P3.5 HIGH
7. Trigger continuous GPIF read: GPIFTRIG = 0x04 (read into EP2)
8. Set P0.7 LOW (streaming indicator)

**Stop streaming (wValue=0):**
1. Set P0.7 HIGH (streaming stopped)
2. Write EP2FIFOBCH = 0xFF (force-flush current buffer)
3. Wait for GPIF idle (poll GPIFTRIG bit 7)
4. Write OUTPKTEND = 0x82 (skip/discard partial EP2 packet)
5. Clear config_byte bit 7 (streaming inactive)
6. Set P3 bits 7:5 = 1 (de-assert all BCM4500 control lines)

### 8.4 Interrupt Handling

INT4 and INT6 (GPIF/FIFO events) share a common handler that sets a software flag and clears the hardware interrupt. The main loop polls this flag, enters CPU idle mode (PCON.0) between events, and checks EP2CS for buffer availability before re-arming the GPIF.

---

## 9. LNB and DiSEqC Control

### 9.1 LNB Voltage

LNB voltage is controlled via GPIO P0.4 on all firmware versions. No I2C is involved.

| wValue | Voltage | GPIO P0.4 | Polarization |
|--------|---------|-----------|-------------|
| 0 | 13V | LOW | Vertical / Circular-Right |
| 1 | 18V | HIGH | Horizontal / Circular-Left |

**USE_EXTRA_VOLT** (0x94) enables a +1V boost (13V->14V, 18V->19V) for long cable runs, by writing to XRAM 0xE0B6 (0x62=normal, 0x6A=boosted; difference is bit 3).

### 9.2 22 kHz Tone

The 22 kHz tone is controlled via GPIO P0.3 on all firmware versions. P0.3 gates an external 22 kHz oscillator on the PCB. The firmware does not generate the 22 kHz signal directly.

| wValue | State | GPIO P0.3 | Band |
|--------|-------|-----------|------|
| 0 | OFF | LOW | Low band (9.75 GHz LO on universal LNB) |
| 1 | ON | HIGH | High band (10.6 GHz LO on universal LNB) |

### 9.3 DiSEqC Protocol

All firmware versions implement DiSEqC via Timer2-based GPIO bit-bang. The algorithm is identical across versions; only the data pin assignment differs (see Section 10).

**Timer2 configuration (identical across all versions):**

| Parameter | Value |
|-----------|-------|
| T2CON | 0x04 (auto-reload, running) |
| RCAP2H:RCAP2L | 0xF82F (reload = 63535) |
| CKCON.T2M | 0 (Timer2 clock = 48 MHz / 12 = 4 MHz) |
| Tick period | (65536 - 63535) / 4 MHz = 500.25 us |

**DiSEqC timing:**

| Parameter | Value |
|-----------|-------|
| Bit period | 1.5 ms (3 Timer2 ticks) |
| Byte period | 13.5 ms (9 bits: 8 data + 1 parity) |
| Tone burst | 12.5 ms (25 ticks) |
| Pre-TX settling delay | 7.5 ms (15 ticks) |
| Data '0' | 1.0 ms tone + 0.5 ms silence (2/3 duty) |
| Data '1' | 0.5 ms tone + 1.0 ms silence (1/3 duty) |
| Carrier frequency | 22 kHz (external oscillator gated by P0.3) |

**Manchester encoding** (decompiled from Rev.2 FUN_CODE_213c):
```
Each DiSEqC bit = 3 Timer2 ticks:
  Tick 1: inter-bit gap (carrier OFF)
  Tick 2: carrier ON via P0.3
  Tick 3: if data='1', carrier OFF early; if data='0', carrier stays ON
  End: carrier OFF
```

**Byte transmission**: 8 data bits MSB-first + 1 odd parity bit, each encoded as a Manchester symbol. The parity bit is '1' when the number of '1' data bits is even.

**Tone burst** (mini DiSEqC): 25 consecutive Timer2 ticks of carrier (12.5 ms).

### 9.4 SET_DN_SWITCH (0x8F) -- Legacy Dish Network Protocol

A 7-bit serial command bit-banged on GPIO P0.4 with specific timing:

1. Assert P0.4 HIGH (start pulse)
2. Delay ~32 cycles
3. De-assert P0.4
4. Delay ~8 cycles
5. Shift out 7 bits LSB-first via P0.4, with ~8 cycle delays between bits

The Linux kernel calls this via the `dishnetwork_send_legacy_command` frontend callback. The 8th bit (0x80) of the original switch command controls LNB voltage and is sent separately via SET_LNB_VOLTAGE.

---

## 10. GPIO Pin Map

### Port 0 (SFR 0x80, a.k.a. IOA)

| Pin | v2.06 | Rev.2 v2.10 | v2.13 | Notes |
|-----|-------|-------------|-------|-------|
| P0.0 | -- | LNB control (0x97) | **DiSEqC data** | DiSEqC data pin moved across versions |
| P0.1 | -- | -- | -- | |
| P0.2 | Init set | Init set (0x84) | Init set | BCM4500 control |
| P0.3 | **22 kHz tone** | **22 kHz tone** | **22 kHz tone** | Gates external 22 kHz oscillator |
| P0.4 | **LNB 13V/18V** | **LNB 13V/18V** + DiSEqC data | **LNB 13V/18V** | Also SET_DN_SWITCH bit-bang (all versions) |
| P0.5 | -- | GPIO status (0x98) input | -- | LNB feedback on Rev.2 |
| P0.6 | -- | GPIO control (0x97) | -- | LNB control on Rev.2 |
| P0.7 | **DiSEqC data** | Streaming indicator | Streaming indicator | DiSEqC data on v2.06 only |

### Port 3 (SFR 0xB0)

| Pin | Function | Notes |
|-----|----------|-------|
| P3.0 | Init HIGH | |
| P3.4 | GPIO control | Used by FUN_CODE_1fcf (Rev.2) |
| P3.5 | **TS_EN** | Transport stream enable: LOW=active, HIGH=idle |
| P3.6 | **DVB mode** | BCM4500 mode select; DiSEqC port direction (Rev.2) |
| P3.7 | BCM4500 control | De-asserted (HIGH) when streaming stops |

### Port B (XRAM-mapped IOB)

Used by internal debug commands 0x96--0x98:

| Pin | v2.06/v2.13 | Rev.2 |
|-----|-------------|-------|
| IOB.0 | GPIO status input (0x98) | -- |
| IOB.1 | LNB control (0x97) | -- |
| IOB.2 | LNB control (0x97) | -- |
| IOB.3 | LNB GPIO mode (0x96) | -- |
| IOB.4 | -- | LNB GPIO mode (0x96) + control (0x97) |

**Init values (Rev.2):**
- P0 = 0x84 (P0.7=1, P0.2=1)
- P3 = 0xE1 (P3.7:5=1, P3.0=1)
- IPL1 = 0x9E

### DiSEqC Data Pin Summary

| Version | Data Pin | Carrier Pin |
|---------|----------|-------------|
| v2.06 | P0.7 | P0.3 |
| Rev.2 v2.10 | P0.4 | P0.3 |
| v2.13 | P0.0 | P0.3 |

The carrier pin (P0.3) is the same across all versions. The data pin is used only internally by the firmware's Manchester encoding logic to control whether the carrier is cut short or held for the full bit period.

---

## 11. Firmware Versions

### 11.1 Version Table

| Firmware | Version | Build Date | PID | Functions | Binary Size | Stack Ptr |
|----------|---------|------------|-----|-----------|-------------|-----------|
| v2.06.04 | 0x020604 | 2007-07-13 | 0x0203 | 61 | ~9,472 bytes | SP=0x72 |
| Rev.2 v2.10.04 | 0x020A04 | 2010-03-12 | 0x0202 | 107 | ~8,843 bytes | SP=0x4F |
| v2.13.01 | 0x020D01 | 2010-03-12 | 0x0203 | 88 | ~9,322 bytes | SP=0x50 |

Note: Rev.2 v2.10 targets a different product (PID 0x0202). The v2.13 family has three sub-variants (FW1/FW2/FW3) targeting different SkyWalker-1 hardware sub-revisions.

### 11.2 GET_FW_VERS (0x92) Format

Returns 6 bytes of hardcoded constants:

```
Byte 0: version minor_minor  (e.g., 0x04)
Byte 1: version minor        (e.g., 0x06)
Byte 2: version major        (e.g., 0x02)
Byte 3: build day            (e.g., 0x0D = 13)
Byte 4: build month          (e.g., 0x07 = July)
Byte 5: build year - 2000    (e.g., 0x07 = 2007)
```

Full version number: `byte[2] << 16 | byte[1] << 8 | byte[0]`

Kernel constants for comparison:
```
GP8PSK_FW_REV1 = 0x020604
GP8PSK_FW_REV2 = 0x020704
```

### 11.3 Binary Comparison Matrix

Byte-level similarity (percentage of matching bytes within shared length):

| | v2.06 | v2.13.1 | v2.13.2 | v2.13.3 | Rev.2 |
|---|---|---|---|---|---|
| v2.06 | -- | 4.8% | 4.3% | 4.3% | 6.0% |
| v2.13.1 | | -- | 57.2% | 59.4% | 8.0% |
| v2.13.2 | | | -- | 83.5% | 5.8% |
| v2.13.3 | | | | -- | 5.8% |
| Rev.2 | | | | | -- |

The very low similarity between major versions (4--8%) indicates complete recompilation with different linker configurations. Functions are relocated even when logic is identical. Within the v2.13 family, FW2 and FW3 are 83.5% similar (minor hardware tuning), while FW1 differs more (57--59%, different demod interface).

### 11.4 Key Differences Between Versions

| Feature | v2.06 | Rev.2 v2.10 | v2.13 |
|---------|-------|-------------|-------|
| Vendor commands | 30 (0x80--0x9D) | 27 (0x80--0x9A) | 30 (0x80--0x9D) |
| INT0 purpose | USB re-enumeration | USB re-enumeration | Demod availability polling |
| Demod probe at init | No | No | Yes (40 attempts at 0x7F + 0x3F) |
| Retry loops | No | No | Yes (20-attempt with checksum verification) |
| HW revision detection | No | Yes (descriptor walker) | Yes (flag `_1_3`) |
| DiSEqC data pin | P0.7 | P0.4 | P0.0 |
| Config byte IRAM | 0x6D | 0x4E | 0x4F |
| Descriptor base | 0x1200 | 0x0E00 | 0x0E00 |
| Init table address | CODE:0B46 | CODE:0B48 | CODE:0B88 |
| BCM4500 status poll | 3 registers | 3 registers | 1 register (consolidated) |
| Anti-tampering string | No | No | Yes (at offset 0x1880) |
| New commands | -- | 0x99/0x9A proto | 0x99 GET_DEMOD_STATUS, 0x9A INIT_DEMOD, 0x9C DELAY_COMMAND |
| 0x9D behavior | HW revision mode switch | N/A (out of range) | Conditional demod reset |

### 11.5 EEPROM Format Details

All SkyWalker-1 C2 files use uniform 1023-byte segments:

```
Segment  Address   Length
-------  -------   ------
1        0x0000    1023    Contains reset vector, interrupt handlers
2        0x03FF    1023
3        0x07FE    1023
4        0x0BFD    1023
5        0x0FFC    1023
6        0x13FB    1023
7        0x17FA    1023
8        0x1BF9    1023
9        0x1FF8    1023
10       0x23F7    varies  (115--265 bytes depending on version)
```

### 11.6 Anti-Tampering (v2.13 only)

At firmware offset 0x1880, all v2.13 sub-variants contain:
```
"Tampering is detected. Attempt is logged. Warranty is voided ! \n"
```
Followed by I2C register write commands (`01 10 aa 82 02 41 41 83`). This string and mechanism are absent from v2.06 and Rev.2 firmware.

### 11.7 Rev.2 as Transitional Firmware

Rev.2 v2.10.4 sits architecturally between v2.06 and v2.13:
- Adopted v2.13's stack pointer (SP=0x4F) and descriptor base (0x0E00)
- Retained v2.06's INT0 USB re-enumeration behavior
- Lacks v2.13's demodulator polling, retry loops, and 3 additional vendor commands
- Has the most functions (107) but smallest binary (~8.7 KB) due to granular decomposition
- The INT0 repurposing was the last major architectural change between Rev.2 and v2.13

---

## 12. Internal Debug Commands

Commands 0x91 and 0x96--0x98 are not used by any driver (Linux or Windows). They appear to be manufacturing/debug interfaces.

### 0x91 I2C_ADDR_ADJUST

Increments (wValue != 0) or decrements (wValue == 0) an internal IRAM counter and returns its current value (1 byte). The counter is at IRAM 0x66 (v2.06) or IRAM 0x18 (v2.13/Rev.2). Likely used for I2C bus address or tuner register index adjustment during development.

### 0x96 SET_LNB_GPIO_MODE

Configures GPIO output enable registers for LNB voltage regulator hardware:

| Mode | v2.06/v2.13 | Rev.2 |
|------|-------------|-------|
| Default (wValue=0) | OEB=0xF0 | OEB=0xE7, OEA=0x9E |
| Active (wValue=1) | IOB=(IOB & 0xF7) OR 0x06; OEB=0xFE | IOB.4 clear; P0.6, P0.0 set; OEA OR= 0x41 |

### 0x97 SET_GPIO_PINS

Direct GPIO pin write for LNB control:

| wValue Bit | v2.06/v2.13 Target | Rev.2 Target |
|-----------|-------------------|-------------|
| bit 1 | IOB.1 | P0.6 (Port A) |
| bit 2 | IOB.2 | P0.0 (Port A) |
| bit 3 | IOB.3 | IOB.4 (Port B) |

### 0x98 GET_GPIO_STATUS

Returns 1 byte (0 or 1) from a single GPIO input pin -- likely an LNB overcurrent or power-good feedback signal:

| Version | Pin Read |
|---------|----------|
| v2.06/v2.13 | IOB.0 (Port B bit 0) |
| Rev.2 | P0.5 (Port A bit 5) |

---

## Sources

### Firmware Analysis

- Ghidra decompilation/disassembly of three firmware images:
  - v2.06.04 (Ghidra port 8193) -- extracted from SkyWalker-1 EEPROM
  - Rev.2 v2.10.04 (Ghidra port 8197) -- extracted from Rev.2 hardware
  - v2.13.01 FW1 (Ghidra port 8194) -- extracted from Windows updater
- Firmware dumps: `/home/rpm/claude/ham/satellite/genpix/skywalker-1/firmware-dump/`

### Driver Source

- Linux kernel 6.16.5: `drivers/media/usb/dvb-usb/gp8psk.c`, `gp8psk.h`, `gp8psk-fe.c`, `gp8psk-fe.h`
- Linux kernel: `drivers/media/usb/dvb-usb/dvb-usb-firmware.c`
- Windows BDA driver: `SkyWalker1_Final_Release/Source/SkyWalker1Control.cpp`
- Windows BDA driver: `SkyWalker1_Final_Release/Include/SkyWalker1Control.h`, `SkyWalker1CommonDef.h`

### Hardware Documentation

- Cypress CY7C68013A (FX2LP) Technical Reference Manual
- Genpix Electronics official site: https://www.genpix-electronics.com/index.php?act=viewDoc&docId=9
- Device `dmesg` output from running SkyWalker-1 hardware (v2.06.04 firmware)

### Phase 1 Analysis Reports

1. `gp8psk-driver-analysis.md` -- Linux kernel driver analysis
2. `firmware-analysis-v206-vs-v213.md` -- Cross-version firmware comparison
3. `rev2-deep-analysis.md` -- Rev.2 deep function inventory (107 functions)
4. `gpif-streaming-analysis.md` -- GPIF/MPEG-2 streaming path
5. `kernel-fw01-analysis.md` -- Kernel firmware format and EEPROM boot
6. `vendor-commands-unknown.md` -- Complete vendor command decode (0x8F, 0x91--0x98)
7. `tuning-protocol-analysis.md` -- TUNE_8PSK protocol deep dive