Memory-mapped I/O ports

90020000 - Serial UART

Used to communicate with the RS232 serial port. The register interface is like that of 16550 UART used in PCs:

• 90020000 (R): Receiver Buffer Register
• 90020000 (W): Transmitter Holding Register
• 90020004 (R/W): Interrupt Enable Register
• 90020008 (R): Interrupt Identification Register
• 90020008 (W): FIFO Control Register
• 9002000C (R/W): Line Control Register
• 90020010 (R/W): Modem Control Register
• 90020014 (R): Line Status Register
• 90020018 (R): Modem Status Register
• 9002001C (R/W): Scratch Register

90060000 - Watchdog timer

Possibly an ARM SP805 or compatible.

90090000 - Real-Time Clock (RTC)

Might be an ARM PrimeCell PL031.

• 90090000 (R): Current time in seconds
• 90090004 (W): ?
• 90090008 (W): ?
• 9009000C (W): ?
• 90090010 (W): ?
• 90090014 (R): ?

900A0000 - Miscellaneous

• 900A0000 (R): ?
• 900A0004 (R/W): ?
• 900A0008 (W): Write a 2 to reset the CPU
• 900A0018 (W): Reset first timer interrupt?
• 900A001C (W): ?
• 900A0020 (W): Reset second timer interrupt (write a 1)?
• 900A0024 (W): ?
• 900A0028-900A002C (R):
  • These registers together give a 64-bit number which comprises 56 data bits and 8 parity checking bits:
    • Bit 0 is a parity check of all data bits
    • Bits 1, 2, 4, 8, 16, and 32 are parity checks of the data bits whose positions, expressed in binary, have that respective bit set.
    • Bit 63 is a parity check of bits 1, 2, 4, 8, 16, and 32.
  • With this system, any single-bit error can be detected and corrected.
  • Data bits 58-62 are the "ASIC user flags", a byte which must match the 80E0 field in an OS image. 01 = CAS, 00 = non-CAS.

900B0000 - Power management

• 900B0000 (R/W): Clock speed load value
  • Bits 1-7: Multiply by 2 to get base/CPU ratio
  • Bit 8: If set, base clock is 27 MHz, else see bits 16-20
  • Bits 12-14: Add 1 to get CPU/AHB ratio
  • Bits 16-20: If bit 8 is clear, base clock is (300 - 6*this) MHz
• 900B0004 (W): ?
• 900B0008 (R/W): ?
• 900B000C (R/W): Clock speed control (write 4 to set the clock speed according to the value in 900B0000)
• 900B0014 (W): ?
• 900B0018 (R/W): ?
• 900B0020 (R/W): ?
• 900B0024 (R): Reads current clock speed value (see 900B0000 for details)
• 900B0028 (R): Bit 4 (0x10) clear when ON key pressed

900C0000 - First timer

Configured as ~488 Hz timer by the OS.

• 900C0000 (R/W): Counts per interrupt - 1. Set to 0 by the OS. Read: decremented from W-1 (FFFF if 0) to 0 each [900C0004] ticks.
• 900C0004 (W): Ticks per count - 1. Set to 0 by the OS. Ticks are approximately 32 kHz.

900D0000 - Second timer

Configured as a ~100 Hz timer by the OS.

• 900C0000 (R/W): Write: Counts per interrupt - 1. Set to 32 by the OS. Read: decremented from W-1 to 0 each [900D0004] ticks.
• 900C0004 (W): Ticks per count - 1. Set to 9 by the OS. Ticks are approximately 32 kHz.

900E0000 - Keypad

• 900E0010-900E001F (R, halfword): Keypad map (see below)
• 900E0044 (R/W): Interrupt status/acknowledge?

900E0010-900E001F - Keypad map

Each bit represents a key. If bit is cleared, the key is being pressed. Only bits 0 to 10 are used in each halfword. The mapping depends on the currently used keypad (TI-Nspire or TI-84+).

TI-Nspire keypad map:

offset	bit 0	bit 1	bit 2	bit 3	bit 4	bit 5	bit 6	bit 7	bit 8	bit 9	bit 10
0010	ret	enter	space	(-)	Z	.	Y	0	X	---	theta
0012	,	+	W	3	V	2	U	1	T	e^x	pi
0014	?	-	S	6	R	5	Q	4	P	10^x	EE
0016	:	*	O	9	N	8	M	7	L	x^2	i
0018	"	/	K	tan	J	cos	I	sin	H	^	>
001A	'	cat	G	)	F	(	E	var	D	caps	<
001C	flag	click	C	home	B	menu	A	esc	|	tab	=
001E	up	u+r	right	r+d	down	d+l	left	l+u	clear	ctrl	---

TI-84+ keypad map:

offset	bit 0	bit 1	bit 2	bit 3	bit 4	bit 5	bit 6	bit 7	bit 8	bit 9	bit 10
0010	down	left	right	up	---	---	---	---	---	---	---
0012	enter	+	-	*	/	^	clear	---	---	---	---
0014	(-)	3	6	9	)	tan	vars	---	---	---	---
0016	.	2	5	8	(	cos	prgm	stat	---	---	---
0018	0	1	4	7	,	sin	apps	X	---	---	---
001A	---	sto	ln	log	x^2	x^-1	math	alpha	---	---	---
001C	graph	trace	zoom	wind	y=	2nd	mode	del	---	---	---
001E	---	---	---	---	---	---	---	---	---	---	---

900F0000 - Unknown

• 900F0020 (W): LCD contrast. Valid values range from 0x6B to 0x95; normal value is 0x80

A4000100-A40096FF - Screen

Read-write, byte, half-word, word

Screen buffer. The upper left corner is the first byte. Each grayscaled pixel is 4-bit long. 1111 is white, 0000 is black.

C0000000 - LCD controller

Probably an ARM PrimeCell PL110 or something compatible.

CC000000 - SHA-256 hash generator

Implements the SHA-256 hash algorithm, which is used in cryptographic signatures.

• CC000000 (R): Busy if bit 0 set
• CC000000 (W): Write 0x10 and then 0x0 to initialize. Write 0xE to process first block, 0xA to process subsequent blocks
• CC000008 (R/W): ?
• CC000010-CC00004F (W): 512-bit block
• CC000060-CC00007F (R): 256-bit state

DC000000 - Interrupt controller

Registers that operate on sets of IRQs are bitmaps, with bit 0 corresponding to IRQ 0, and so on.

• DC000000 (R): Masked IRQ status
• DC000004 (R): Raw interrupt status
• DC000004 (W): Acknowledge a set of IRQs
• DC000008 (R): Current set of enabled IRQs
• DC000008 (W): Enable a set of IRQs
• DC00000C (R): Mirror of DC000008
• DC00000C (W): Disable a set of IRQs
• DC000020 (R): ?
• DC000024 (R): Current IRQ number
• DC000028 (R): Reading this has something to do with acknowledgement
• DC00002C (W): Writing this has something to do with acknowledgement (write an 8?)
• DC000100 (R): Masked FIQ status
• DC000104 (R): Raw interrupt status
• DC000104 (W): Acknowledge a set of FIQs
• DC000108 (R): Current set of enabled FIQs
• DC000108 (W): Enable a set of FIQs
• DC00010C (R): Mirror of DC000108
• DC00010C (W): Disable a set of FIQs
• DC000120 (R): ?
• DC000124 (R): Current FIQ number
• DC000128 (R): Reading this has something to do with acknowledgement
• DC00012C (W): Writing this has something to do with acknowledgement (write an 8?)
• DC000200 (R/W): ?
• DC000204 (R/W): ?
• DC000208 (R/W): ?
• DC000300-DC0003FF (W): IRQ priority? (one register per IRQ)

Here is a list of known IRQ numbers:

• IRQ 1 = Serial UART
• IRQ 3 = Watchdog timer
• IRQ 7 = GPIO
• IRQ 8 = First USB
• IRQ 9 = Second USB
• IRQ 11 = ADC
• IRQ 16 = Keypad
• IRQ 18 = First timer
• IRQ 19 = Second timer
• IRQ 21 = LCD Controller