Saleae Logic16/Firmware

The following information is related to the vendor firmware included with the version 1.1.15 of the vendor application "Logic".

Interrupt handlers

The following interrupt handlers are installed. If the address is absent, it means the handler just returns (RETI) without performing any action.

Handler	Address
RESET	0x0000
TF2	0x0e65
RESUME	0x002e
SUDAV	0x0ae8
SOF	0x13d2
SUTOK	0x13bf
SUSPEND	0x13aa
USB_RESET	0x130b
HISPEED	0x12df
EP0ACK
EP0_IN
EP0_OUT
EP1_IN
EP1_OUT	0x115d
EP2	0x11a2
EP4
EP6
EP8
IBN
EP0PING
EP1PING
EP2PING
EP4PING
EP6PING
EP8PING
ERRLIMIT
EP2ISOERR
EP4ISOERRF
EP6ISOERR
EP8ISOERRF
EP2PF
EP4PF
EP6PF
EP8PF
EP2EF
EP4EF
EP6EF
EP8EF
EP2FF	0x11e7
EP4FF
EP6FF
EP8FF
GPIFDONE
GPIFWF

Endpoint 1 OUT (EP1_OUT) handler

After decrypting the OUT packet, processing of the packet proceeds depending on the first byte of the packet, which selects the operation. After the operation, any resulting IN packet will be encrypted before submitting it to the host.

Byte	Handler	Operation
1	0x14f	Configure endpoints for quad-buffered bulk FIFO operation, and trigger a GPIF read on EP2.
2	0x157	Abort the GPIF.
6	0x15f	Write data to EEPROM with I²C address 1010000 (single addressing mode). The second and third byte contain a fixed magic cookie of 0x42 0x55. The fourth byte contains the single byte address. The fifth byte contains the number of bytes to write (1-58). The rest of the packet contains the data to write.
7	0x1b3	Read data from EEPROM with I²C address 1010000 (single byte addressing mode). The second and third byte contain a fixed magic cookie of 0x33 0x81. The fourth byte contains the single byte address. The fifth byte contains the number of bytes to read (1-64). The data will be available as an IN transfer.
0x7a	0x309	Upload the sine table for LED flashing. The second byte contains the offset to start writing at, and the third byte the number of bytes to write. A maximum of 61 bytes can be uploaded per packet, so two packets are needed to write the entire table.
0x7b	0x346	Enable or disable LED flashing. The second byte of the packet is a bool indicating if LED flashing should be enabled. The following bytes are only used if LED flashing is enabled, but are always transmitted. If flashing is enabled, the LED brighness will periodically be set from the sine table. Byte 3 and 4 of the packet are the Timer 2 reload value, in little endian format. Byte 5 is a software clock divisor. The pointer in the sine table will be advanced by one every (0x10000-RELOAD)*(DIV+1)/4000000 seconds. Byte 6 is a boolean indicating whether to repeat the waveform (1) or stop at the end of the first period (0).
0x7c	0x282	Re-renumerate; return control to the builtin bootloader.
0x7d	0x2aa	Abort the GPIF. The second byte of the packet is returned complemented in an IN transfer, as acknowledgement.
0x7e	0x2cf	Disable LED flashing, configure the GPIF, and prepare the FPGA for bitstream upload by pulsing PROG_B and then waiting for INIT_B.
0x7f	0x2e4	Disable LED flashing, transmit N (1-62) bytes of bitstream on the FPGA DIN pin, clocked by CCLK. The second byte of the packet encodes N.
0x80	0x205	Transmit N (1-31) 16-bit words to the FPGA. The second byte of the packet encodes N. Data is sent on PA6, MSB first, with rising edges of PA5 to clock the bits out. During each word transfer, PA4 is held low. The most significant bit (b15) of each word must be 0.
0x81	0x23b	Perform N (1-31) write-read transactions to the FPGA. The second byte of the packet encodes N. Each transaction consists of 8 bits (from the out packet) being transmitted on PA6, like for the 0x80 operation above, and then 8 bits being received on PA7. N bytes will be available for an IN transfer afterwards. The most significant bit (b7) of each byte to send must be 0, but is actually transmitted as a 1 (to indicate read operation). PA7 is polled immediately after the falling edge of PA5. PA4 is held low during each write-read transaction.
0x82	0x3a3	Read the REVID register. 16 bits of REVID data will be available for an IN transfer.
others	0x3c7	Do nothing

Command 0x7e waveform

Command 0x7f waveform

Command 0x80 waveform

Command 0x81 waveform

XDATA variables

The following variables are stored in the 8K "external" code/data memory, after the firmware code.

Address	Init data in FW		Contents
	Address	Value
0x1f00-0x1f7f	0x8d6-0x955		WAVEDATA
0x1f80	0x981	0xe0	GPIFREADYCFG
0x1f81	0x982	0x10	GPIFCTLCFG
0x1f82	0x983	0x00	GPIFIDLECS
0x1f83	0x984	0x05	GPIFIDLECTL
0x1f84	0x985	0xee	?
0x1f85	0x986	0x50	GPIFWFSELECT
0x1f86	0x987	0x00	GPIFREADYSTAT
0x1f87	0x95a	0x00	FLOWSTATE
0x1f88	0x95b	0x00	FLOWLOGIC
0x1f89	0x95c	0x00	FLOWEQ0CTL
0x1f8a	0x95d	0x00	FLOWEQ1CTL
0x1f8b	0x95e	0x00	FLOWHOLDOFF
0x1f8c	0x95f	0x00	FLOWSTB
0x1f8d	0x960	0x00	FLOWSTBEDGE
0x1f8e	0x961	0x00	FLOWSTBHPERIOD
0x1f8f-0x1faa	0x962-0x97d	0x00	?
0x1fab-0x1fea			64 byte sine table for LED flashing

WAVEDATA

The following data is loaded into WAVEDATA on bootup, and whenever operation 0x7e is performed:

Waveform descriptor 0

State	Length/Branch	Opcode	Output	Logic	Operation	NEXT	DATA	CTL2	CTL1	CTL0
0	0x81	0x01	0x05	0x70	if FF or RDY0 then 0 (ReExec) else 1	0	0	1	0	1
1	0xB8	0x07	0x04	0x2D	if TC expired then 7 else 0	1	1	1	0	0
2	0x01	0x02	0x04	0x00	Delay 1	0	1	1	0	0
3	0x01	0x02	0x04	0x00	Delay 1	0	1	1	0	0
4	0x01	0x02	0x04	0x00	Delay 1	0	1	1	0	0
5	0x01	0x02	0x04	0x00	Delay 1	0	1	1	0	0
6	0x01	0x02	0x04	0x00	Delay 1	0	1	1	0	0

Waveform descriptor 1-3

State	Length/Branch	Opcode	Output	Logic	Operation	NEXT	DATA	CTL2	CTL1	CTL0
0-6	0x01	0x00	0x05	0x00	Delay 1	0	0	1	0	1

FPGA variables

The following variables can be read and written by the host using operations 0x81 and 0x80:

Address	Contents
0x00	FPGA bitstream version (currently 0x10)
0x01	Status and control. Bit 0 = acquisition running. Bit 1 = update acquisition parameters(?). Bit 3 = ?. Bit 6 = ?.
0x02	Channel select low. Each 1 bit in this byte enables one of the channels 0-7 for acquisition.
0x03	Channel select high. Each 1 bit in this byte enables one of the channels 8-15 for acquisition.
0x04	Sampling rate divisor. Sample rate is the base clock divided by N+1, where N is the value in this register.
0x05	LED brightness. 0 = min (off), 0xff = max, 0x19 = dimmed.
0x06	?
0x07	?
0x08	? (Read on acquisition stop.)
0x09	? (Read on acquisition stop.)
0x0a	Bit 7 = ?. Bit 6 = ?. Bit 0 = Sampling base clock select: 0 = 100MHz, 1 = 160MHz
0x0c	?