Saleae Logic16/Firmware
Revision as of 13:53, 29 July 2013 by Marcus Comstedt (talk | contribs) (→Waveform descriptor 0: Expand waveform descriptor 0)
The following information is related to the vendor firmware included with the version 1.1.15 of the vendor application "Logic".
Interrupt handlers
The following interrupt handlers are installed. If the address is absent, it means the handler just returns (RETI) without performing any action.
| RESET | 0x0000 |
| TF2 | 0x0e65 |
| RESUME | 0x002e |
| SUDAV | 0x0ae8 |
| SOF | 0x13d2 |
| SUTOK | 0x13bf |
| SUSPEND | 0x13aa |
| USB_RESET | 0x130b |
| HISPEED | 0x12df |
| EP0ACK | |
| EP0_IN | |
| EP0_OUT | |
| EP1_IN | |
| EP1_OUT | 0x115d |
| EP2 | 0x11a2 |
| EP4 | |
| EP6 | |
| EP8 | |
| IBN | |
| EP0PING | |
| EP1PING | |
| EP2PING | |
| EP4PING | |
| EP6PING | |
| EP8PING | |
| ERRLIMIT | |
| EP2ISOERR | |
| EP4ISOERRF | |
| EP6ISOERR | |
| EP8ISOERRF | |
| EP2PF | |
| EP4PF | |
| EP6PF | |
| EP8PF | |
| EP2EF | |
| EP4EF | |
| EP6EF | |
| EP8EF | |
| EP2FF | 0x11e7 |
| EP4FF | |
| EP6FF | |
| EP8FF | |
| GPIFDONE | |
| GPIFWF |
Endpoint 1 OUT (EP1_OUT) handler
After decrypting the OUT packet, processing of the packet proceeds depending on the first byte of the packet, which selects the operation. After the operation, any resulting IN packet will be encrypted before submitting it to the host.
| Byte | Handler | Operation |
|---|---|---|
| 1 | 0x14f | Configure endpoints for quad-buffered bulk FIFO operation, and trigger a GPIF read on EP2. |
| 2 | 0x157 | ? |
| 6 | 0x15f | ? |
| 7 | 0x1b3 | ? |
| 0x7a | 0x309 | ? |
| 0x7b | 0x346 | ? |
| 0x7c | 0x282 | Re-renumerate; return control to the builtin bootloader. |
| 0x7d | 0x2aa | Abort the GPIF. The second byte of the packet is returned complemented in an IN transfer, as acknowledgement. |
| 0x7e | 0x2cf | Configure the GPIF, and prepare the FPGA for bitstream upload by pulsing PROG_B and then waiting for INIT_B. |
| 0x7f | 0x2e4 | Transmit N (1-62) bytes of bitstream on the FPGA DIN pin, clocked by CCLK. The second byte of the packet encodes N. |
| 0x80 | 0x205 | Transmit N (1-31) 16-bit words to the FPGA. The second byte of the packet encodes N. Data is sent on PA6, MSB first, with rising edges of PA5 to clock the bits out. During each word transfer, PA4 is held low. The most significant bit (b15) of each word must be 0. |
| 0x81 | 0x23b | Perform N (1-31) write-read transactions to the FPGA. The second byte of the packet encodes N. Each transaction consists of 8 bits (from the out packet) being transmitted on PA6, like for the 0x80 operation above, and then 8 bits being received on PA7. N bytes will be available for an IN transfer afterwards. The most significant bit (b7) of each byte to send must be 0, but is actually transmitted as a 1 (to indicate read operation). PA7 is polled immediately after the falling edge of PA5. PA4 is held low during each write-read transaction. |
| 0x82 | 0x3a3 | Read the REVID register. 16 bits of REVID data will be available for an IN transfer. |
| others | 0x3c7 | Do nothing |
Command 0x7e waveform
Command 0x7f waveform
Command 0x80 waveform
Command 0x81 waveform
XDATA variables
The following variables are stored in the 8K "external" code/data memory, after the firmware code.
| Address | Init data in FW | Contents | |
|---|---|---|---|
| Address | Value | ||
| 0x1f00-0x1f7f | 0x8d6-0x955 | WAVEDATA | |
| 0x1f80 | 0x981 | 0xe0 | GPIFREADYCFG |
| 0x1f81 | 0x982 | 0x10 | GPIFCTLCFG |
| 0x1f82 | 0x983 | 0x00 | GPIFIDLECS |
| 0x1f83 | 0x984 | 0x05 | GPIFIDLECTL |
| 0x1f84 | 0x985 | 0xee | ? |
| 0x1f85 | 0x986 | 0x50 | GPIFWFSELECT |
| 0x1f86 | 0x987 | 0x00 | GPIFREADYSTAT |
| 0x1f87-0x1faa | 0x95a-0x97d | ? | |
| 0x1fab-0x1fea | ? | ||
WAVEDATA
The following data is loaded into WAVEDATA on bootup, and whenever operation 0x7e is performed:
Waveform descriptor 0
| State | Length/Branch | Opcode | Output | Logic | Operation | NEXT | DATA | CTL2 | CTL1 | CTL0 |
|---|---|---|---|---|---|---|---|---|---|---|
| 0 | 0x81 | 0x01 | 0x05 | 0x70 | if FF or RDY0 then 0 (ReExec) else 1 | 0 | 0 | 1 | 0 | 1 |
| 1 | 0xB8 | 0x07 | 0x04 | 0x2D | if TC expired then 7 else 0 | 1 | 1 | 1 | 0 | 0 |
| 2 | 0x01 | 0x02 | 0x04 | 0x00 | Delay 1 | 0 | 1 | 1 | 0 | 0 |
| 3 | 0x01 | 0x02 | 0x04 | 0x00 | Delay 1 | 0 | 1 | 1 | 0 | 0 |
| 4 | 0x01 | 0x02 | 0x04 | 0x00 | Delay 1 | 0 | 1 | 1 | 0 | 0 |
| 5 | 0x01 | 0x02 | 0x04 | 0x00 | Delay 1 | 0 | 1 | 1 | 0 | 0 |
| 6 | 0x01 | 0x02 | 0x04 | 0x00 | Delay 1 | 0 | 1 | 1 | 0 | 0 |
Waveform descriptor 1-3
| State | Length/Branch | Opcode | Output | Logic |
|---|---|---|---|---|
| 0-6 | 0x01 | 0x00 | 0x05 | 0x00 |
FPGA variables
The following variables can be read and written by the host using operations 0x81 and 0x80:
| Address | Contents |
|---|---|
| 0x02 | Channel select low. Each 1 bit in this byte enables one of the channels 0-7 for acquisition. |
| 0x03 | Channel select high. Each 1 bit in this byte enables one of the channels 8-15 for acquisition. |
| 0x04 | Sampling rate divisor. Sample rate is the base clock divided by N+1, where N is the value in this register. |
| 0x0a | Sampling base clock select: 0 = 100MHz, 1 = 160MHz |