Custom Firmware v3.02

Firmware v3.02 adds three new vendor commands (0xB7—0xB9) optimized for real-time signal monitoring and RF analysis workflows. These commands reduce USB round-trips by combining multiple register reads into single transfers. v3.02

Built on the same v3.01 codebase — same SDCC + fx2lib toolchain, same stock-compatible command set, same I2C timeout protection.

Property	Value
Version ID	0x030200
Date	2026-02-12
New commands	0xB7—0xB9 (3 added to v3.01’s 7)
Total custom commands	10 (0xB0—0xB9)

New Commands

Command	Name	Direction	Payload	Purpose
0xB7	SIGNAL_MONITOR	IN	8 bytes	Fast combined read: SNR + AGC + lock + status
0xB8	TUNE_MONITOR	OUT+IN	10 bytes each	Tune + dwell + read in one round-trip
0xB9	MULTI_REG_READ	IN	1—64 bytes	Batch read contiguous indirect registers

Signal Monitor (0xB7)

Combines six indirect register reads and two direct register reads into a single 8-byte USB transfer. Replaces three separate transfers (GET_SIGNAL_STRENGTH + GET_SIGNAL_LOCK + individual register reads) with one.

SIGNAL_MONITOR response format (8 bytes)

Bytes 0-1: SNR         (u16 LE, indirect regs 0x00-0x01, dBu × 256)
Bytes 2-3: AGC1        (u16 LE, indirect regs 0x02-0x03)
Bytes 4-5: AGC2        (u16 LE, indirect regs 0x04-0x05)
Byte 6:    Lock        (direct reg 0xA4, bit 5 = locked)
Byte 7:    Status      (direct reg 0xA2)

Enables ~50 Hz polling for real-time dish alignment feedback.

Tune Monitor (0xB8)

Combines tune + configurable dwell + signal read into one command round-trip. This is the building block for host-driven spectrum sweeps.

The command uses two USB control transfers sharing the same bRequest code, distinguished by direction:

TUNE_MONITOR protocol

// Phase 1: OUT (0x40) — host sends 10-byte tune payload
//   wValue = dwell_ms (1-255), firmware tunes, waits, reads signal
// Phase 2: IN (0xC0) — host reads 10-byte result
//   Bytes 0-5: SNR(2) + AGC1(2) + AGC2(2)
//   Byte 6: lock, Byte 7: status
//   Bytes 8-9: dwell_ms echo (u16 LE)

Note

The OUT phase blocks for the full dwell time inside the FX2 vendor command handler. The USB STATUS phase does not complete until handle_vendorcommand() returns. With a maximum dwell of 255 ms and a USB timeout of 2000 ms, this is well within safe bounds.

Multi Register Read (0xB9)

Batch-reads up to 64 contiguous BCM4500 indirect registers in a single USB transfer. Each register still requires an individual I2C read sequence internally, but eliminating 63 USB control transfer round-trips provides ~64x speedup for register exploration.

MULTI_REG_READ parameters

wValue = start register number
wIndex = count (1-64)
Returns: count bytes, one per register

What Changed from v3.01

Feature	v3.01	v3.02
Custom commands	7 (0xB0—0xB6)	10 (0xB0—0xB9)
Spectrum sweep	0xB0 via EP2 bulk (firmware-driven)	Also 0xB8 via control EP (host-driven)
Signal monitoring	3 USB transfers (stock method)	1 transfer (0xB7, 8 bytes)
Batch register read	1 reg per transfer	64 regs per transfer (0xB9)
All other features	—	Unchanged

The v3.01 commands (0xB0—0xB6) remain fully functional. See the v3.01 documentation for spectrum sweep, blind scan, raw demod access, I2C scan, boot stage, and GPIO state commands.