Keypads and NAND Memory Layout: Difference between pages

From Hackspire
(Difference between pages)
Jump to navigation Jump to search
(Mention CX/CM/CX II as well)
 
(Add note for the CX II)
 
Line 1: Line 1:
==Key maps==
==NAND Flash==


Each bit in the 900E0010-900E001F registers represents a key. Only bits 0 to 10 are used in each halfword. The mapping depends on the currently used keypad.
NAND pages are 528-bytes long (512 + 16-bytes header) on TI-Nspire and 2112-bytes long (2048 + 64-bytes header) on TI-Nspire CX/CM/CX II.


'''Clickpad keypad map:'''
The following information does not apply to the CX II anymore.


If the bit is cleared, the key is being pressed.
* pages 0000 to 001F (Nspire) or 0000 to 003F (CX/CM): written to /phoenix/manuf.dat at each boot.
** Offset 000-003: 3C B0 6E 79
** Offset 804-805: model ID (little-endian): 0C (Nspire CAS), 0D (Nspire Lab Cradle), 0E (Nspire), 0F (Nspire CX CAS), 10 (Nspire CX), 11 (Nspire CM CAS), 12 (Nspire CM)
** Offset 806-807: unknown - 00 00 or 10 00
** Offset 808-80F: optional default language (CX/CM), filled with FF if missing - ISO 639 supported language string padded with 00 (for exemple fr, en, ar, zh_CN for TI-Nspire CX-C or CM-C...)
** Offset 818-81B: signature - 91 5F 9E 4C (CX/CM)
** Offset 81C-81F: features (little-endian) - 0x05 (CM + CX Napoca), 0x85 (CX CR/HW-J+), 0x185 (CX CR4/HW-W+)
** Offset 820-823: default keypad - 4C 00 00 00 (CX/CM)
** Offset 824-825: lcd width - 40 01 (CX/CM)
** Offset 826-827: lcd height - F0 00 (CX/CM)
** Offset 228-229: lcd bpp - 10 00 (CX/CM)
** Offset 82A-82B: lcd color - 01 00 (CX/CM)
** Offset 82C-82F: offset diags - 00 00 32 00 (CX/CM)
** Offset 830-833: offset boot2 - 00 00 02 00 (CX/CM)
** Offset 834-837: offset boot data - 00 00 2C 00 (CX/CM)
** Offset 838-83B: offset file system - 00 00 40 00 (CX/CM)
** Offset 83C-83F: config clock - 02 10 56 00 (CX/CM)
** Offset 840-843: SDRAM config: 12 80 01 FC for 64MB (CX) or 11 80 01 FE for 32MB (CM)
*** Offset 840: SDRAM size in MB - keep 6 lowest bytes - size is 4*2^((value/8)+(value%8))
** Offset 844-847: lcd spi count - 02 00 00 00 (CX/CM)
** Offset 848-887: lcd spi data filled with 0xFF - 06 00 00 00 5C 00 00 00 30 00 00 00 04 00 00 00  (CX/CM)
** Offset 888-889: lcd light min - 1A 01 (CX/CM)
** Offset 88A-88B: lcd light max - CE 01 (CX/CM)
** Offset 88C-88D: lcd light default - 6A 01 (CX/CM)
** Offset 88E-88F: lcd light increment - 14 00 (CX/CM)
** Offset 890-893: 0C 01 A2 18 (CX/CM)
** Offset 894-923: display informations on the 12 elements of the splash screen (CX/CM): horizontal display offset + vertical display offset + width + height (2-bytes each) + data offset (4-bytes)
*** Offset 894-89F: Low Battery error icon [diplayed unknown]
*** Offset 8A0-8AB: Boot1 Recoverable Error icon [displayed 8th]
*** Offset 8AC-8B7: Send Diagnostics Software info icon [displayed 8th]
*** Offset 8B8-8C3: Boot2 Recoverable Error icon [displayed 8th]
*** Offset 8C4-8CF: Unrecoverable Error icon [displayed 8th]
*** Offset 8D0-8DB: Progress Bar Background [displayed 6th]
*** Offset 8DC-8E7: Progress Bar [displayed 7th]
*** Offset 8E8-8F3: permanent element #1 (background) [displayed 1st]
*** Offset 8F4-8FF: permanent element #2 (unused) [displayed 2nd]
*** Offset 900-90B: permanent element #3 (unused) [displayed 3th]
*** Offset 90C-917: permanent element #4 (unused) [displayed 4th]
*** Offset 918-923: permanent element #5 (unused) [displayed 5th]
** Offset 924-927: compressed splash screen data size
** Offset 928-92B: uncompressed splash screen data size (0x0000FA40 on CX EVT, 0x00029CD0 on all CX/CM)
** Offset 92C-92F: ? (0x00000756 on CX EVT, 0x000006D3 on all CX/CM)
** Offset 930-???: compressed splash screen data (same compression format as the boot2)
** Offset ???-???: TI-Certificate - fields present :
*** Production : 0x290 (0x100), 0x290 (0x100), 0x340 (0x1A4), 0x290 (0x100), 0x340 (0x115), 0x290 (0x100), 0xFFFF0 (0)
*** Development : 0x290 (0x100), 0x290 (0x100), 0x340 (0x1A4), 0x240 (0x80), 0x290 (0x100), 0x340 (0x115), 0x290 (0x100), 0xFFFF0 (0)
* pages 0020 to 0A7F (Nspire) or 0040 to 057F (CX/CM): boot2 image
* pages 0A80 to 0AFF (Nspire) or 0580 to 063F (CX/CM): "bootdata" (every time this is modified, the next available page is used; if all 128 pages are in use, then the whole area is erased first)
** Offset 00-03: Marker AA C6 8C 92
** Offset 04-07: Downgrade protection: minimum OS version allowed as a 4-bytes word (major-minor-lower1-lower2). Written during OS installation with the value found in the second field 8020 of the [[OS_upgrade_files#Structure OS upgrade file|OS upgrade file]]
** Offset 08-0F: Hold the press-to-test status (word, word, long word)
***Offset 08-09: press to test mode
****00 : none
****01 : 84+ mode (OS is going to prompt for a 84+ keypad if not installed on next reboot)
****02 : fully restricted (all listed features disabled) - LED flashes in green
****03 : partially restricted (no or some listed features disables) - LED flashes in orange
****04 : old mode not used any more, for OS 1.x/2.x - at that time there were only 2 features which could be disabled - meant that one feature had been selected but not botg - LED flashes in green+orange
****06 : for Netherlands/Europe (since OS 4.3) - no programming, and easily disabled through any USB transfer - LED flashes in orange
***0A-0B : clear PTT folders content on next reboot (1 during the 1st reboot after (re)enabling PTT - default 0)
***0C-0D : disabled features in PTT mode - default 0
****Mode 3 :
*****bit 0 : geometry
*****bit 1 : drag&move in graphs
*****bit 2 : vectors
*****bit 3 : isPrime()
*****bit 4 : diff eq
*****bit 5 : ineq graphing
*****bit 6 : 3D graphing
*****bit 7 : rel/coniq graphing
*****bit 8 : trig
*****both bits 9+10 : logbase()
*****both bits 11+12 : poly and simult solving
****Mode 2 : all 13 previous bits are 1
****Mode 6 : all 13 previous bits are 0
***0E-0F : unkown - default 0 - sometimes 0x8000 in PTT mode
** Offset 10-13: If nonzero, BOOT1 will attempt to run DIAGS by default; if zero, it will skip straight to BOOT2. (Either behavior can be overridden with the Esc+Menu+G key combination.)
** Offset 14-1A: TI-84 Plus emulator 0A1 certificate field
** Offset 1B-1E: TI-84 Plus emulator 041 certificate field
** Offset 1F-61: TI-84 Plus emulator 0A2 certificate field
** Offset 64-67: (OS 1.6+) Default LCD contrast (if not in range from 0x76 to 0x8A, assumed to be 0x80)
* pages 0B00 to 0F7F (Nspire) or 0640 to 079F (CX) or 0640 to 7BF (CM): diags software
* pages 0F80 to 0FFF (Nspire) or 0780 to 07FF (CX): diags test results
* pages from 1000 (Nspire) or 0800 (CX) or 07C0 (CM): factory images or filesystem


{|border="1" cellspacing="0" cellpadding="5"
===Factory images===
|-
! offset
! bit 0
! bit 1
! bit 2
! bit 3
! bit 4
! bit 5
! bit 6
! bit 7
! bit 8
! bit 9
! bit 10
|-
| 0010
| ret
| enter
| space
| (-)
| Z
| .
| Y
| 0
| X
| on
| theta
|-
| 0012
| ,
| +
| W
| 3
| V
| 2
| U
| 1
| T
| e^x
| pi
|-
| 0014
| ?
| -
| S
| 6
| R
| 5
| Q
| 4
| P
| 10^x
| EE
|-
| 0016
| :
| *
| O
| 9
| N
| 8
| M
| 7
| L
| x^2
| i
|-
| 0018
| "
| /
| K
| tan
| J
| cos
| I
| sin
| H
| ^
| >
|-
| 001A
| '
| cat
| G
| )
| F
| (
| E
| var
| D
| shift
| <
|-
| 001C
| flag
| click
| C
| home
| B
| menu
| A
| esc
| &#124;
| tab
| bgcolor=lightgray |
|-
| 001E
| up
| u+r
| right
| r+d
| down
| d+l
| left
| l+u
| del
| ctrl
| =
|}


'''TI-84+ keypad map:'''
At startup, boot2 checks the NAND flash for a pre-loaded factory image. The format is a 32-byte header followed by the .tnc/.tno file contents:


If the bit is cleared, the key is being pressed.
* Offset 00-13: String "***PRELOAD_IMAGE***"
* Offset 14-17: 55 F0 01 55
* Offset 18-1B: (unknown)
* Offset 1C-1F: Size of image (in big-endian)


{|border="1" cellspacing="0" cellpadding="5"
If boot2 finds this header, the user is prompted to press 'I' on the keypad. After that, the image is copied to RAM before creating the filesystem (The filesystem also starts at page 0x1000, so it cannot co-exist with a factory image), and is installed the same as if it had been received from the serial port.
|-
! offset
! bit 0
! bit 1
! bit 2
! bit 3
! bit 4
! bit 5
! bit 6
! bit 7
! bit 8
! bit 9
! bit 10
|-
| 0010
| down
| left
| right
| up
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 0012
| enter
| +
| -
| *
| /
| ^
| clear
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 0014
| (-)
| 3
| 6
| 9
| )
| tan
| vars
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 0016
| .
| 2
| 5
| 8
| (
| cos
| prgm
| stat
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 0018
| 0
| 1
| 4
| 7
| ,
| sin
| apps
| X
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 001A
| on
| sto
| ln
| log
| x^2
| x^-1
| math
| alpha
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 001C
| graph
| trace
| zoom
| wind
| y=
| 2nd
| mode
| del
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|-
| 001E
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
|}
 
'''Touchpad/CX/CM/CX II keypad map:'''
 
If the bit is set, the key is being pressed.
 
{|border="1" cellspacing="0" cellpadding="5"
|-
! offset
! bit 0
! bit 1
! bit 2
! bit 3
! bit 4
! bit 5
! bit 6
! bit 7
! bit 8
! bit 9
! bit 10
|-
| 0010
| ret
| enter
| bgcolor=lightgray |
| (-)
| space
| Z
| Y
| 0
| ?!
| on
| bgcolor=lightgray |
|-
| 0012
| X
| W
| V
| 3
| U
| T
| S
| 1
| pi
| trig
| 10^x
|-
| 0014
| R
| Q
| P
| 6
| O
| N
| M
| 4
| EE
| x^2
| bgcolor=lightgray |
|-
| 0016
| L
| K
| J
| 9
| I
| H
| G
| 7
| /
| e^x
| bgcolor=lightgray |
|-
| 0018
| F
| E
| D
| bgcolor=lightgray |
| C
| B
| A
| =
| *
| ^
| bgcolor=lightgray |
|-
| 001A
| bgcolor=lightgray |
| var
| -
| )
| .
| (
| 5
| cat
| frac
| del
| scratch
|-
| 001C
| flag
| bgcolor=lightgray |
| +
| doc
| 2
| menu
| 8
| esc
| bgcolor=lightgray |
| tab
| bgcolor=lightgray |
|-
| 001E
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| bgcolor=lightgray |
| shift
| ctrl
| ,
|}
 
==Touchpad I²C==
 
Communication with the actual touchpad is done with the [http://en.wikipedia.org/wiki/I%C2%B2C I²C] protocol.
 
On the original Touchpad models, the I2C protocol is bitbanged through the GPIO: GPIO 1 is the Serial Clock (SCL) and GPIO 3 is the Serial Data Line (SDA). On the CX model, there is a dedicated [[Memory-mapped_I/O_ports#90050000_-_I2C_controller|I2C controller]] for accessing it.
 
The touchpad seems to be a [http://read.pudn.com/downloads64/doc/fileformat/229278/510-501-rev4-tm603.pdf TM-603].
[http://lxr.free-electrons.com/source/drivers/input/mouse/synaptics_i2c.c The linux driver] is a good source for documentation.
 
it responds to messages with address 0x20. A write message consists of the first port to write to, followed by the values to write: the port number auto-increments, so a message of <tt>00 de ad</tt> writes <tt>de</tt> to port <tt>00</tt> and <tt>ad</tt> to port <tt>01</tt>. A read message reads from whatever port was set by the previous write message, so it generally has to be preceded by an empty write to set the port.
 
A list of the touchpad's ports follows. All 16-bit numbers are big-endian.
 
* Any page:
** FF: Page number
* Page 04 (default):
** 00: Contact (usually is 01 if proximity >= 0x2F, 00 otherwise)
** 01: Proximity
** 02-03: X position
** 04-05: Y position
** 06: relative X
** 07: relative Y (both refresh on irq)
** 0A: 1 if touchpad pressed down, 0 if not
** 0B: Status (reading this clears the low bits)
*** Bit 0 (0x01): Set when proximity is nonzero
*** Bit 1 (0x02): Set when velocity bytes are nonzero
*** Bit 2 (0x04): Set when unknown byte at 08 is nonzero
*** Bit 3 (0x08): Set when pressed byte has changed
*** Bit 6 (0x40): Set when the touchpad is configured
*** Bit 7 (0x80): Set when an error occured
** E4-E7: Firmware version
* Page 10:
** 04-05: Maximum X coordinate (0x0918)
** 06-07: Maximum Y coordinate (0x069B)
 
==Keypad Connector==
The Connector joining the keypads to the nspire itself has a very basic design concept: There are a bunch of GPIO pins, VCC, and GND. The OS memory-maps the pins to the bit chart seen above, using half as input, half as output. The same pins the touchpad uses for its I2C connection are used for buttons on the clickpad.
 
The pins are as follows:
1. Ground
2. Vcc
3-30. GPIO pins, alternating Column-Row-Column-Row
 
On the 84+ Pad:
Pin 23 = Link port wire 1
Pin 25 = Link port wire 2
 
 
The OS is constantly doing iskeypressed() on all the keys, so the pins end up looking like a square wave if read by a 'scope. Input pins only show the wave if one of their buttons is pressed, but output pins show the whole wave regardless.
 
If you can't envision how the keys actually work yet, this might help:
All the buttons have 2 connectors, that get shorted when they are pressed.
The bits in the table above represent columns of buttons. It's not layed out perfectly because it has more than 8 buttons per column, so it gets offset strangely.
The bits in the offsets (the rows) represent rows of buttons.
 
The columns are each hooked to one Input pin.
The rows are each hooked to one output pin.
The calculator turns on ''One'' output pin, and looks for any signals on the inputs. If there are any, it records the button that matches the input pin and that column.
It then repeats this process for all the other columns, and the iskeypressed() process is complete.
 
If this doesn't make any sense still, email me (willrandship at gmail dot com) and I'll see if I can help.
--[[User:Willrandship|William Shipley]] 05:38, 16 September 2011 (CEST)

Revision as of 17:12, 3 July 2019

NAND Flash

NAND pages are 528-bytes long (512 + 16-bytes header) on TI-Nspire and 2112-bytes long (2048 + 64-bytes header) on TI-Nspire CX/CM/CX II.

The following information does not apply to the CX II anymore.

  • pages 0000 to 001F (Nspire) or 0000 to 003F (CX/CM): written to /phoenix/manuf.dat at each boot.
    • Offset 000-003: 3C B0 6E 79
    • Offset 804-805: model ID (little-endian): 0C (Nspire CAS), 0D (Nspire Lab Cradle), 0E (Nspire), 0F (Nspire CX CAS), 10 (Nspire CX), 11 (Nspire CM CAS), 12 (Nspire CM)
    • Offset 806-807: unknown - 00 00 or 10 00
    • Offset 808-80F: optional default language (CX/CM), filled with FF if missing - ISO 639 supported language string padded with 00 (for exemple fr, en, ar, zh_CN for TI-Nspire CX-C or CM-C...)
    • Offset 818-81B: signature - 91 5F 9E 4C (CX/CM)
    • Offset 81C-81F: features (little-endian) - 0x05 (CM + CX Napoca), 0x85 (CX CR/HW-J+), 0x185 (CX CR4/HW-W+)
    • Offset 820-823: default keypad - 4C 00 00 00 (CX/CM)
    • Offset 824-825: lcd width - 40 01 (CX/CM)
    • Offset 826-827: lcd height - F0 00 (CX/CM)
    • Offset 228-229: lcd bpp - 10 00 (CX/CM)
    • Offset 82A-82B: lcd color - 01 00 (CX/CM)
    • Offset 82C-82F: offset diags - 00 00 32 00 (CX/CM)
    • Offset 830-833: offset boot2 - 00 00 02 00 (CX/CM)
    • Offset 834-837: offset boot data - 00 00 2C 00 (CX/CM)
    • Offset 838-83B: offset file system - 00 00 40 00 (CX/CM)
    • Offset 83C-83F: config clock - 02 10 56 00 (CX/CM)
    • Offset 840-843: SDRAM config: 12 80 01 FC for 64MB (CX) or 11 80 01 FE for 32MB (CM)
      • Offset 840: SDRAM size in MB - keep 6 lowest bytes - size is 4*2^((value/8)+(value%8))
    • Offset 844-847: lcd spi count - 02 00 00 00 (CX/CM)
    • Offset 848-887: lcd spi data filled with 0xFF - 06 00 00 00 5C 00 00 00 30 00 00 00 04 00 00 00 (CX/CM)
    • Offset 888-889: lcd light min - 1A 01 (CX/CM)
    • Offset 88A-88B: lcd light max - CE 01 (CX/CM)
    • Offset 88C-88D: lcd light default - 6A 01 (CX/CM)
    • Offset 88E-88F: lcd light increment - 14 00 (CX/CM)
    • Offset 890-893: 0C 01 A2 18 (CX/CM)
    • Offset 894-923: display informations on the 12 elements of the splash screen (CX/CM): horizontal display offset + vertical display offset + width + height (2-bytes each) + data offset (4-bytes)
      • Offset 894-89F: Low Battery error icon [diplayed unknown]
      • Offset 8A0-8AB: Boot1 Recoverable Error icon [displayed 8th]
      • Offset 8AC-8B7: Send Diagnostics Software info icon [displayed 8th]
      • Offset 8B8-8C3: Boot2 Recoverable Error icon [displayed 8th]
      • Offset 8C4-8CF: Unrecoverable Error icon [displayed 8th]
      • Offset 8D0-8DB: Progress Bar Background [displayed 6th]
      • Offset 8DC-8E7: Progress Bar [displayed 7th]
      • Offset 8E8-8F3: permanent element #1 (background) [displayed 1st]
      • Offset 8F4-8FF: permanent element #2 (unused) [displayed 2nd]
      • Offset 900-90B: permanent element #3 (unused) [displayed 3th]
      • Offset 90C-917: permanent element #4 (unused) [displayed 4th]
      • Offset 918-923: permanent element #5 (unused) [displayed 5th]
    • Offset 924-927: compressed splash screen data size
    • Offset 928-92B: uncompressed splash screen data size (0x0000FA40 on CX EVT, 0x00029CD0 on all CX/CM)
    • Offset 92C-92F: ? (0x00000756 on CX EVT, 0x000006D3 on all CX/CM)
    • Offset 930-???: compressed splash screen data (same compression format as the boot2)
    • Offset ???-???: TI-Certificate - fields present :
      • Production : 0x290 (0x100), 0x290 (0x100), 0x340 (0x1A4), 0x290 (0x100), 0x340 (0x115), 0x290 (0x100), 0xFFFF0 (0)
      • Development : 0x290 (0x100), 0x290 (0x100), 0x340 (0x1A4), 0x240 (0x80), 0x290 (0x100), 0x340 (0x115), 0x290 (0x100), 0xFFFF0 (0)
  • pages 0020 to 0A7F (Nspire) or 0040 to 057F (CX/CM): boot2 image
  • pages 0A80 to 0AFF (Nspire) or 0580 to 063F (CX/CM): "bootdata" (every time this is modified, the next available page is used; if all 128 pages are in use, then the whole area is erased first)
    • Offset 00-03: Marker AA C6 8C 92
    • Offset 04-07: Downgrade protection: minimum OS version allowed as a 4-bytes word (major-minor-lower1-lower2). Written during OS installation with the value found in the second field 8020 of the OS upgrade file
    • Offset 08-0F: Hold the press-to-test status (word, word, long word)
      • Offset 08-09: press to test mode
        • 00 : none
        • 01 : 84+ mode (OS is going to prompt for a 84+ keypad if not installed on next reboot)
        • 02 : fully restricted (all listed features disabled) - LED flashes in green
        • 03 : partially restricted (no or some listed features disables) - LED flashes in orange
        • 04 : old mode not used any more, for OS 1.x/2.x - at that time there were only 2 features which could be disabled - meant that one feature had been selected but not botg - LED flashes in green+orange
        • 06 : for Netherlands/Europe (since OS 4.3) - no programming, and easily disabled through any USB transfer - LED flashes in orange
      • 0A-0B : clear PTT folders content on next reboot (1 during the 1st reboot after (re)enabling PTT - default 0)
      • 0C-0D : disabled features in PTT mode - default 0
        • Mode 3 :
          • bit 0 : geometry
          • bit 1 : drag&move in graphs
          • bit 2 : vectors
          • bit 3 : isPrime()
          • bit 4 : diff eq
          • bit 5 : ineq graphing
          • bit 6 : 3D graphing
          • bit 7 : rel/coniq graphing
          • bit 8 : trig
          • both bits 9+10 : logbase()
          • both bits 11+12 : poly and simult solving
        • Mode 2 : all 13 previous bits are 1
        • Mode 6 : all 13 previous bits are 0
      • 0E-0F : unkown - default 0 - sometimes 0x8000 in PTT mode
    • Offset 10-13: If nonzero, BOOT1 will attempt to run DIAGS by default; if zero, it will skip straight to BOOT2. (Either behavior can be overridden with the Esc+Menu+G key combination.)
    • Offset 14-1A: TI-84 Plus emulator 0A1 certificate field
    • Offset 1B-1E: TI-84 Plus emulator 041 certificate field
    • Offset 1F-61: TI-84 Plus emulator 0A2 certificate field
    • Offset 64-67: (OS 1.6+) Default LCD contrast (if not in range from 0x76 to 0x8A, assumed to be 0x80)
  • pages 0B00 to 0F7F (Nspire) or 0640 to 079F (CX) or 0640 to 7BF (CM): diags software
  • pages 0F80 to 0FFF (Nspire) or 0780 to 07FF (CX): diags test results
  • pages from 1000 (Nspire) or 0800 (CX) or 07C0 (CM): factory images or filesystem

Factory images

At startup, boot2 checks the NAND flash for a pre-loaded factory image. The format is a 32-byte header followed by the .tnc/.tno file contents:

  • Offset 00-13: String "***PRELOAD_IMAGE***"
  • Offset 14-17: 55 F0 01 55
  • Offset 18-1B: (unknown)
  • Offset 1C-1F: Size of image (in big-endian)

If boot2 finds this header, the user is prompted to press 'I' on the keypad. After that, the image is copied to RAM before creating the filesystem (The filesystem also starts at page 0x1000, so it cannot co-exist with a factory image), and is installed the same as if it had been received from the serial port.

Retrieved from "https://hackspire.org//index.php?title=Keypads&oldid=1715"