FEL/Protocol

The FEL is actually a tiny usb stack implementing a special USB protocol.

Part of it is implemented in our tools repository and can be used as reference code.

Below is the closest we have to an official specification for this protocol. It was copied from here:.

The low level protocol uses USB bulk transfers with one input and one output endpoint

Input request char signature[8] = "AWUC" 00000000		Request signature u32 length1					length of request u32 unknown1 = 0x0c000000 u16 request type 0x12	write 0x11	read u32 length2					length of request (same as length1) u8  pad[10]					pad to 64 bytes

Bulk transfer of length data

Status response 0x0000: 4157 5553 0000 0000 0000 0000 00         AWUS.........

The higher level uses requests on the form

u32 request type u32 address u32 length u32 pad

Followed by bulk transfer of length data

Followed by a response

READ(00000008) 0x00000000: ffff 0000 0000 0000 ____ ____ ____ ____ ........

Request types: 0x00000001	INFO 0x00000101	WRITE 0x00000102	CALL 0x00000103	READ

Unknown request types:

0x00000002 0x00000003 0x00000004 0x00000005-0x0000000F 0x00000010 0x00000100 Sequences:


 * INFO *

Write(0x10) 0x0000: 0100 0000 0000 0000 0000 0000 0000 0000  ................

Read(0x20) 0x0000: 4157 5553 4246 4558 0023 1600 0100 0000  AWUSBFEX.#......        0x0010:  0100 4408 007e 0000 0000 0000 0000 0000  ..D..~..........

struct VERSION { char signature[8] = "AWUSBFEX"; u32 unknown_08 = 0x00162300; u32 unknown_0A = 1; u16 version = 1; u8 unknown_12 = 0x44; u8 unknown_13 = 0x08; u32 scratchpad = 0x00007e00; u32 pad[2] = 0; }

Read(0x08) 0x0000: ffff 0000 0000 0000                      ........


 * READ *

WRITE(00000010) 0x00000000: 0301 0000 007e 0000 0001 0000 0000 0000 .....~.......... READ(00000100) 0x00000000: cccc cccc cccc cccc cccc cccc cccc cccc ................       0x00000010: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000020: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000030: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000040: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000050: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000060: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000070: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000080: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000090: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000a0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000b0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000c0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000d0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000e0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000f0: cccc cccc cccc cccc cccc cccc cccc cccc ................ READ(00000008) 0x00000000: ffff 0000 0000 0000 ____ ____ ____ ____ ........


 * WRITE *

WRITE(00000010) 0x00000000: 0101 0000 007e 0000 0001 0000 0000 0000 .....~.......... WRITE(00000100) 0x00000000: 0000 0000 cccc cccc cccc cccc cccc cccc ................       0x00000010: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000020: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000030: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000040: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000050: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000060: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000070: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000080: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x00000090: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000a0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000b0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000c0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000d0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000e0: cccc cccc cccc cccc cccc cccc cccc cccc ................        0x000000f0: cccc cccc cccc cccc cccc cccc cccc cccc ................ READ(00000008) 0x00000000: ffff 0000 0000 0000 ____ ____ ____ ____ ........

Memory map

-0x1fff Stack

0x2000-0x5cff Free for program use

0x5d00-      ??? Traces of USB requests seen there

-0x6fff Stack

0x7000-0x7cff Free for program use

0x7d00-0x7d0f ???

0x7d10-0x7dff Free for program use

0x7e00-0x7eff ??? Used by both FEL and Livesuite. Filled with CC and livesuite clears first word.

0x7f00-0x7fff Stack used by BROM on reset. Free in FEL?

0x8000-0xbfff Free for program use