Memory-mapped I/O ports: Difference between revisions

From Hackspire
Jump to navigation Jump to search
(→‎B0000000 - First USB: tentative register list)
(Restored from Google cache)
Line 1: Line 1:
== 8FFF0000 - Unknown ==
==8FFF0000 - Unknown==


== 90000000 - General Purpose I/O (GPIO) ==
==90000000 - General Purpose I/O (GPIO)==
 
The GPIO registers are separated into 4 sections:
 
* Section 0: 90000000-9000003F
* Section 1: 90000040-9000007F
* Section 2: 90000080-900000BF
* Section 3: 900000C0-900000FF.
 
Each register is a word, and only bits 0-7 of each are used. There can be up to 32 devices accessed by this setup, each known as a GPIO. Each GPIO is defined by one of the 8 bits in one of the sections. The number of the GPIO is the section number times 8 plus the bit number. Each GPIO has a status bit and can cause interrupts.
 
The following addresses are offsets from the beginning of the GPIO section:
 
* +00 (R): Masked interrupt status ([+04] & [+08])
* +04 (R): Reads raw interrupt status (directly dependent on the GPIO status) or sticky interrupt status (becomes set when GPIO status changes) depending on bit in [+20]
* +04 (W): Write 1 to the bit to reset the sticky interrupt status.
* +08 (R): Reads current interrupt mask bit.
* +08 (W): Write 1 to the bit to enable interrupt (set mask bit to 1)
* +0C (W): Write 1 to the bit to disable interrupt (set mask bit to 0)
 
The following addresses should be changed with a read-modify-write pattern so as to not disturb other bits in the register.
 
* +10 (R/W): Setting bit to 0 will not allow GPIO status bit to change from its default (?)
* +14 (R/W): (?)
* +18 (R): Reads GPIO status bit.
* +1C (R/W): Setting bit to 1 will invert raw interrupt status (?)
* +20 (R/W): Setting bit to 1 will use sticky interrupt status in [+04], or setting to 0 will use raw interrupt status.
* +24 (R/W): (?)
 
Currently known GPIOs:
 
* GPIO 8 (Section 1, bit 0): Status bit is 0 if Reset Button is pressed.
* GPIO 24 (Section 3, bit 0): Status bit is 1 if a keypad is not plugged in. (TI-Nspire non-cas only?)
 
==90010000 - Fast timer==
 
The same interface as 900C0000/900D0000, but runs at the speed of the APB clock (22.5MHz) rather than 32kHz. See [[#900D0000 - Second timer Second timer]] for more info.
 
==90020000 - Serial UART==


== 90020000 - Serial UART ==
Used to communicate with the [[Hardware#RS232|RS232 serial port]]. The register interface is like that of 16550 UART used in PCs:
Used to communicate with the [[Hardware#RS232|RS232 serial port]]. The register interface is like that of 16550 UART used in PCs:
* 90020000 (R): Receiver Buffer Register
* 90020000 (R): Receiver Buffer Register
* 90020000 (W): Transmitter Holding Register
* 90020000 (W): Transmitter Holding Register
Line 16: Line 54:
* 9002001C (R/W): Scratch Register
* 9002001C (R/W): Scratch Register


== 90060000 - Watchdog timer ==
==90060000 - Watchdog timer==
 
Possibly an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0270b/index.html ARM SP805] or compatible.
Possibly an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0270b/index.html ARM SP805] or compatible.


== 90080000 - Unknown ==
==90080000 - Unknown==
 
==90090000 - Real-Time Clock (RTC)==


== 90090000 - Real-Time Clock (RTC) ==
Might be an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0224b/index.html ARM PrimeCell PL031].
Might be an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0224b/index.html ARM PrimeCell PL031].
* 90090000 (R): Current time in seconds
* 90090000 (R): Current time in seconds
* 90090004 (W): ?
* 90090004 (W): ?
* 90090008 (W): ?
* 90090008 (R/W): Sets the value of 90090000 (clock will not read new time until a couple seconds later). Reads last value written.
* 9009000C (W): ?
* 9009000C (W): ?
* 90090010 (W): ?
* 90090010 (W): ?
* 90090014 (R): ?
* 90090014 (R): ?


== 900A0000 - Miscellaneous ==
==900A0000 - Miscellaneous==
 
* 900A0000 (R): ?
* 900A0000 (R): ?
* 900A0004 (R/W): ?
* 900A0004 (R/W): Set bit 0x20 to enable TI-84+ keypad link port. Other bits likely control functions of peripherals as well.
* 900A0008 (W): Write a 2 to reset the CPU
* 900A0008 (W): Write a 2 to reset the CPU
* 900A0018 (W): Reset first timer interrupt?
* 900A0010 (R/W): Fast timer interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
* 900A001C (W): ?
* 900A0014 (R/W): Fast timer interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0010] should trigger an IRQ.
* 900A0020 (W): Reset second timer interrupt (write a 1)?
* 900A0018 (R/W): Timer 1 interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
* 900A0024 (W): ?
* 900A001C (R/W): Timer 1 interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0018] should trigger an IRQ.
* 900A0028-900A002C (R):
* 900A0020 (R/W): Timer 2 interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
** These registers together give a 64-bit number which comprises 56 data bits and 8 parity checking bits:
* 900A0024 (R/W): Timer 2 interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0020] should trigger an IRQ.
*** Bit 0 is a parity check of all data bits
* 900A0028-900A002C (R): These registers together give a 64-bit number which comprises 56 data bits and 8 parity checking bits, allowing any single-bit error in it to be detected and corrected.
*** Bits 1, 2, 4, 8, 16, and 32 are parity checks of the data bits whose positions, expressed in binary, have that respective bit set.
** Parity bit 0: Check of all data bits
*** Bit 63 is a parity check of bits 1, 2, 4, 8, 16, and 32.
** Parity bits 1, 2, 4, 8, 16, and 32: Checks of the data bits whose positions, expressed in binary, have that respective bit set.
** With this system, any single-bit error can be detected and corrected.
** Data bits 3, 5-7, 9-15, 17-31, and 33-55: Middle part of the calculator's Product ID
** Data bits 58-62 are the "ASIC user flags", a byte which must match the 80E0 field in an OS image. 01 = CAS, 00 = non-CAS.
** Data bits 56-57: Unknown
** Data bits 58-62: "ASIC user flags"; must match the 80E0 field in an OS image. 01 = CAS, 00 = non-CAS.
** Parity bit 63: Check of parity bits 1, 2, 4, 8, 16, and 32.
 
==900B0000 - Power management==


== 900B0000 - Power management ==
* 900B0000 (R/W): Clock speed load value
* 900B0000 (R/W): Clock speed load value
** Bits 1-7:   Multiply by 2 to get base/CPU ratio
** Bits 1-7: Multiply by 2 to get base/CPU ratio
** Bit 8:     If set, base clock is 27 MHz, else see bits 16-20
** Bit 8: If set, base clock is 27 MHz, else see bits 16-20
** Bits 12-14: Add 1 to get CPU/AHB ratio
** Bits 12-14: Add 1 to get CPU/AHB ratio
** Bits 16-20: If bit 8 is clear, base clock is (300 - 6*this) MHz
** Bits 16-20: If bit 8 is clear, base clock is (300 - 6*this) MHz
Line 55: Line 100:
* 900B0008 (R/W): ?
* 900B0008 (R/W): ?
* 900B000C (R/W): Clock speed control (write 4 to set the clock speed according to the value in 900B0000)
* 900B000C (R/W): Clock speed control (write 4 to set the clock speed according to the value in 900B0000)
* 900B0014 (W): ?
* 900B0010 (R/W): ON interrupt mask (1-bit). 1 if ON interrupt should be serviced or 0 if not.
* 900B0014 (R/W): Bit 0 is set if ON interrupt is requested. Bit 1 also causes an interrupt, but the cause is unknown (and it is not masked by [900B0010]). Write "1" bits to reset the requests.
* 900B0018 (R/W): ?
* 900B0018 (R/W): ?
* 900B0020 (R/W): ?
* 900B0020 (R/W): ?
Line 61: Line 107:
* 900B0028 (R): Bit 4 (0x10) clear when ON key pressed
* 900B0028 (R): Bit 4 (0x10) clear when ON key pressed


== 900C0000 - First timer ==
==900C0000 - First timer==
Configured as ~488 Hz timer by the OS.
 
*900C0000 (R/W): Counts per interrupt - 1. Set to 0 by the OS. Read: decremented from W-1 (FFFF if 0) to 0 each [900C0004] ticks.
Configured as ~488 Hz timer by the OS. Same port structure as [[#900D0000 - Second timer Second timer]].
*900C0004 (W): Ticks per count - 1. Set to 0 by the OS. Ticks are approximately 32 kHz.
 
==900D0000 - Second timer==
 
Two timers are located here, but only the first can generate IRQs. IRQ status/mask is located at [900A0020]. Configured as a ~100 Hz timer by the OS.
 
* 900D0000 (R/W): Current IRQ timer value (16-bit). Set to 32 by the OS. Increases/decreases each [900D0004] ticks. The value written to this port is saved internally and can be reloaded automatically upon timer completion, depending on settings in [900D0008].
* 900D0004 (R/W): IRQ timer divider (16-bit). Ticks per count - 1. Set to 9 by the OS. Ticks are approximately 32 kHz.
* 900D0008 (R/W): IRQ timer control (5-bit).
** Bit 4: Set to 1 to freeze timer.
** Bit 3: Set to 1 for increasing timer, or to 0 for decreasing timer.
** Bits 2-0: If 0, timer will count to zero and stop. If 1-6, timer will complete when it reaches the corresponding timer completion value and then reload with original timer value (see [900D0018] to [900D002C]). If 7, timer will never complete and runs infinitely.
* 900D000C (R/W): Current timer value (16-bit). Increases/decreases each [900D0010] ticks. The value written to this port is saved internally and can be reloaded automatically upon timer completion, depending on settings in [900D0014].
* 900D0010 (R/W): Timer divider (16-bit). Ticks per count - 1. Ticks are approximately 32 kHz.
* 900D0014 (R/W): Timer control (5-bit).
** Bit 4: Set to 1 to freeze timer, or 0 to run timer.
** Bit 3: Set to 1 for increasing timer, or to 0 for decreasing timer.
** Bits 2-0: If 0, timer will count to zero and stop. If 1-6, timer will complete when it reaches the corresponding timer completion value (see [900D0018] to [900D002C]). If 7, timer will not complete and runs infinitely.
* 900D0018 (R/W): Timer completion value 1 (16-bit). If IRQ timer equals this value, bit 0 of the interrupt status becomes set.
* 900D001C (R/W): Timer completion value 2 (16-bit). If IRQ timer equals this value, bit 1 of the interrupt status becomes set.
* 900D0020 (R/W): Timer completion value 3 (16-bit). If IRQ timer equals this value, bit 2 of the interrupt status becomes set.
* 900D0024 (R/W): Timer completion value 4 (16-bit). If IRQ timer equals this value, bit 3 of the interrupt status becomes set.
* 900D0028 (R/W): Timer completion value 5 (16-bit). If IRQ timer equals this value, bit 4 of the interrupt status becomes set.
* 900D002C (R/W): Timer completion value 6 (16-bit). If IRQ timer equals this value, bit 5 of the interrupt status becomes set.
* 900D0030 (R/W): Unknown 6-bit value.


== 900D0000 - Second timer ==
==900E0000 - Keypad==
Configured as a ~100 Hz timer by the OS.
*900C0000 (R/W): Write: Counts per interrupt - 1. Set to 32 by the OS. Read: decremented from W-1 to 0 each [900D0004] ticks.
*900C0004 (W): Ticks per count - 1. Set to 9 by the OS. Ticks are approximately 32 kHz.


== 900E0000 - Keypad ==
* 900E0008 (R/W): Keypad interrupt status/acknowledge (2-bit). Bit 1 is set when a key is pressed or released, and bit 0 has an unknown cause.. Write "1" bits to acknowledge.
* 900E000C (R/W): Keypad interrupt mask (2-bit). Set each bit to 1 if the corresponding event in [900E0008] should cause an interrupt.
* 900E0010-900E001F (R, halfword): Keypad map (see below)
* 900E0010-900E001F (R, halfword): Keypad map (see below)
* 900E0044 (R/W): Interrupt status/acknowledge?
* 900E0044 (R/W): Unknown.
 
===900E0010-900E001F - Keypad map===


=== 900E0010-900E001F - Keypad map ===
Each bit represents a key. If bit is cleared, the key is being pressed. Only bits 0 to 10 are used in each halfword. The mapping depends on the currently used keypad (TI-Nspire or TI-84+).
Each bit represents a key. If bit is cleared, the key is being pressed. Only bits 0 to 10 are used in each halfword. The mapping depends on the currently used keypad (TI-Nspire or TI-84+).


'''TI-Nspire keypad map:'''
'''TI-Nspire keypad map:'''
{|border="1" cellspacing="0" cellpadding="5"
{|border="1" cellspacing="0" cellpadding="5"
|-
|-
Line 93: Line 162:
! bit 9
! bit 9
! bit 10
! bit 10
|-
| 0010
| ret
| enter
| space
| (-)
| Z
| .
| Y
| 0
| X
| ---
| theta
|-
|-
| 0012
| 0012
Line 181: Line 237:
| A
| A
| esc
| esc
| |
| |
| tab
| tab
| =
| ---
|-
|-
| 001E
| 001E
Line 196: Line 252:
| clear
| clear
| ctrl
| ctrl
| ---
| =
|}
|}


<br />'''TI-84+ keypad map:'''


'''TI-84+ keypad map:'''
{|border="1" cellspacing="0" cellpadding="5"
{|border="1" cellspacing="0" cellpadding="5"
|-
|-
Line 321: Line 377:
|}
|}


== 900F0000 - Unknown ==
==900F0000 - Unknown==
 
* 900F0020 (R/W): LCD contrast. Valid values range from 0x6B to 0x95; normal value is 0x80
* 900F0020 (R/W): LCD contrast. Valid values range from 0x6B to 0x95; normal value is 0x80


== 90100000 - TI-84 Plus link port ==
==90100000 - TI-84 Plus link port==
 
* 90100000 (W): Write to bits 0-1 to hold I/O link lines low or let them go high. 1=high, 0=low.
* 90100000 (R): Bits 0-1 hold the status of the I/O link lines. 1=high, 0=low. Bits 4-5 hold the last value outputted to bits 0-1.
* 90100004 (R/W): Unknown. The OS writes 0x80 here during initialization.
* 90100008 (R): Unknown. Bit 0x40 is set if any link lines are low.
 
==90110000 - LED==
 
* 90110B00 (R/W): Control register
** Bit 0: Set this bit to enable green light blink data. If green blink data iteration is not on, the green light state is read from bit 0 of green blink data.
** Bit 1: Set this bit and bit 6 to enable green blink data iteration.
** Bit 2: Set this bit to force green light off. Overrides bit 4.
** Bit 3: Set this bit to force red light off. Overrides bits 5 and 13.
** Bit 4: Set this bit to force green light on.
** Bit 5: Set this bit to force red light on.
** Bit 6: See this bit and bit 1 to enable green blink data iteration. Reset before modifying green blink data or delay.
** Bit 9: Set this bit to enable red light blink data. If red blink data iteration is not on, the red light state is read from bit 0 of red blink data.
** Bit 10: Set this bit and bit 12 to enable red blink data iteration.
** Bit 12: Set this bit and bit 10 to enable red blink data iteration. Reset before modifying red blink data or delay.
** Bit 13: Forces red light on if bit 4 is 0, or red light off if bit 4 is 1. (?)
* 90110B04 (R/W): Green blink data. 32 bits of on and off state, represented by 1 and 0. Iteration is done from bit 31 to bit 0 repeatedly.
* 90110B08 (R/W): Green blink delay (negative). OS sets this to -2048.
* 90110B0C (R/W): Red blink data. 32 bits of on and off state, represented by 1 and 0. Iteration is done from bit 31 to bit 0 repeatedly.
* 90110B10 (R/W): Red blink delay (negative). OS sets this to -2048.


== 90110000 - Unknown ==
Note: If red and green lights are on at the same time, the color becomes yellow.
 
==A4000100-A40096FF - Screen==


== A4000100-A40096FF - Screen ==
Read-write, byte, half-word, word
Read-write, byte, half-word, word


Screen buffer. The upper left corner is the first byte. Each grayscaled pixel is 4-bit long. 1111 is white, 0000 is black.
Screen buffer. The upper left corner is the first byte. Each grayscaled pixel is 4-bit long. 1111 is white, 0000 is black.


== AC000000 - Unknown ==
==A9000000 - "SPI"==


== B0000000 - First USB ==
==AC000000 - SD Host Controller==
 
See http://www.sdcard.org/developers/tech/host_controller/simple_spec/
 
==B0000000 - USB OTG controller==


Appears similar to the USB interface on Freescale Semiconductor's microcontrollers.
Appears similar to the USB interface on Freescale Semiconductor's microcontrollers.
Line 378: Line 464:
** B00001CC (R/W): ENDPTCTRL3 - Endpoint control 3
** B00001CC (R/W): ENDPTCTRL3 - Endpoint control 3


== B4000000 - Second USB ==
==B4000000 - USB HOST controller==


== B8000000 - NAND Flash ==
==B8000000 - NAND Flash==


== BC000000 - Unknown ==
==BC000000 - Unknown==
 
==C0000000 - LCD controller==


== C0000000 - LCD controller ==
Probably an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0161e/index.html ARM PrimeCell PL110] or something compatible.
Probably an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0161e/index.html ARM PrimeCell PL110] or something compatible.
* C0000010 (R/W): Frame Base Address. Holds the address to read pixel data from. Set to A4000100 by the OS.
* C0000010 (R/W): Frame Base Address. Holds the address to read pixel data from. Set to A4000100 by the OS.
* C0000018 (R/W): Interrupt mask.
* C0000018 (R/W): Interrupt mask.
Line 395: Line 483:
*** 010 = 4 bpp (default setting of OS)
*** 010 = 4 bpp (default setting of OS)
*** 011 = 8 bpp
*** 011 = 8 bpp
*** 100 = 16 bpp
*** 100 = 16 bpp (holds the literal 16-bit palette value instead of a palette index)
*** 101 = 24 bpp (not applicable to TI-Nspire's STN LCD)
*** 101 = 24 bpp (not applicable to TI-Nspire's STN LCD)
*** 110,111 = reserved
*** 110,111 = reserved
Line 405: Line 493:
** Bit 9: Set to 1 if the bytes in each word are to be read as big-endian, or 0 if little-endian. Set to 0 by the OS.
** Bit 9: Set to 1 if the bytes in each word are to be read as big-endian, or 0 if little-endian. Set to 0 by the OS.
** Bit 10: Set to 1 if the pixels within each byte are to be read as big-endian, or 0 if little-endian. Only affects 1,2,4 bpp modes. Set to 1 by the OS.
** Bit 10: Set to 1 if the pixels within each byte are to be read as big-endian, or 0 if little-endian. Only affects 1,2,4 bpp modes. Set to 1 by the OS.
** Bit 11: LCD power enable.  
** Bit 11: LCD power enable.
** Bits 12-13: Vertical compare interrupt region.
** Bits 12-13: Vertical compare interrupt region.
*** 00 = start of vertical synchronization
*** 00 = start of vertical synchronization
Line 428: Line 516:
** Bit 15: Intensity (unused on Nspire)
** Bit 15: Intensity (unused on Nspire)


== C4000000 - Analog-to-Digital Converter (ADC) ==
==C4000000 - Analog-to-Digital Converter (ADC)==


== CC000000 - SHA-256 hash generator ==
==CC000000 - SHA-256 hash generator==
Implements the [http://en.wikipedia.org/wiki/SHA_hash_functions SHA-256 hash algorithm], which is used in cryptographic signatures.  
 
Implements the [http://en.wikipedia.org/wiki/SHA_hash_functions SHA-256 hash algorithm], which is used in cryptographic signatures.


* CC000000 (R): Busy if bit 0 set
* CC000000 (R): Busy if bit 0 set
Line 439: Line 528:
* CC000060-CC00007F (R): 256-bit state
* CC000060-CC00007F (R): 256-bit state


== DC000000 - Interrupt controller ==
==DC000000 - Interrupt controller==
 
Registers that operate on sets of IRQs are bitmaps, with bit 0 corresponding to IRQ 0, and so on.
Registers that operate on sets of IRQs are bitmaps, with bit 0 corresponding to IRQ 0, and so on.


* DC000000 (R): Masked IRQ status
* DC000000 (R): Masked IRQ status (always equal to [DC000004] & [DC000008])
* DC000004 (R): Raw interrupt status
* DC000004 (R): Raw interrupt status or sticky interrupt status, depending on bitfield in DC000204
* DC000004 (W): Acknowledge a set of IRQs
* DC000004 (W): Resets a set of sticky interrupts
* DC000008 (R): Current set of enabled IRQs
* DC000008 (R): Current set of enabled IRQs
* DC000008 (W): Enable a set of IRQs
* DC000008 (W): Enable a set of IRQs
* DC00000C (R): Mirror of DC000008
* DC00000C (R): Mirror of DC000008
* DC00000C (W): Disable a set of IRQs
* DC00000C (W): Disable a set of IRQs
* DC000020 (R): ?
* DC000020 (R): Reads current IRQ number (no side effects)
* DC000024 (R): Current IRQ number
* DC000024 (R): Reads current IRQ number, copies the value in DC00002C to DC000028, writes the priority of the current IRQ to DC00002C
* DC000028 (R): Reading this has something to do with acknowledgement
* DC000028 (R): Reading this register will reset the IRQ request. The value read is whatever was last copied by reading DC000024
* DC00002C (W): Writing this has something to do with acknowledgement (write an 8?)
* DC00002C (R/W): 4-bit value. IRQs with priority greater than or equal to this value will not be requested
* DC000100 (R): Masked FIQ status
* DC000100 (R): Masked FIQ status (always equal to [DC000104] & [DC0000108])
* DC000104 (R): Raw interrupt status
* DC000104 (R): Raw interrupt status or sticky interrupt status, depending on bitfield in DC000204
* DC000104 (W): Acknowledge a set of FIQs
* DC000104 (W): Resets a set of sticky interrupts
* DC000108 (R): Current set of enabled FIQs
* DC000108 (R): Current set of enabled FIQs
* DC000108 (W): Enable a set of FIQs
* DC000108 (W): Enable a set of FIQs
* DC00010C (R): Mirror of DC000108
* DC00010C (R): Mirror of DC000108
* DC00010C (W): Disable a set of FIQs
* DC00010C (W): Disable a set of FIQs
* DC000120 (R): ?
* DC000120 (R): Reads current FIQ number (no side effects)
* DC000124 (R): Current FIQ number
* DC000124 (R): Reads current FIQ number, copies the value in DC00012C to DC000128, writes the priority of the current IRQ to DC00012C
* DC000128 (R): Reading this has something to do with acknowledgement
* DC000128 (R): Reading this register will reset the FIQ request. The value read is whatever was last copied by reading DC000124
* DC00012C (W): Writing this has something to do with acknowledgement (write an 8?)
* DC00012C (R/W): 4-bit value. FIQs with priority greater than or equal to this value will not be requested
* DC000200 (R/W): ?
* DC000200 (R/W): Bits that are 0 will invert the corresponding raw interrupt status bit. Typically this register should hold 0xFFFFFFFF.
* DC000204 (R/W): ?
* DC000204 (R/W): Bits that are 1 will cause the corresponding bit in DC000004 and DC000104 to read the sticky interrupt status. Bits that are 0 will cause the corresponding bit to read the raw interrupt status.
* DC000208 (R/W): ?
* DC000208 (R/W): ?
* DC000300-DC0003FF (W): IRQ priority? (one register per IRQ)
* DC000300-DC0003FF (W): IRQ priority (0-7). One register per IRQ. Lower values indicate higher priority.


Here is a list of known IRQ numbers:
Here is a list of known IRQ numbers:
Line 473: Line 563:
* IRQ 1 = [[#90020000 - Serial UART|Serial UART]]
* IRQ 1 = [[#90020000 - Serial UART|Serial UART]]
* IRQ 3 = [[#90060000 - Watchdog timer|Watchdog timer]]
* IRQ 3 = [[#90060000 - Watchdog timer|Watchdog timer]]
* IRQ 7 = [[#90000000 - General Purpose I/O (GPIO)|GPIO]]
* IRQ 7 = [[#90000000_-_General_Purpose_I.2FO_.28GPIO.29|GPIO]]
* IRQ 8 = [[#B0000000 - First USB|First USB]]
* IRQ 8 = [[#B0000000 - USB OTG controller|USB OTG]]
* IRQ 9 = [[#B4000000 - Second USB|Second USB]]
* IRQ 9 = [[#B4000000 - USB HOST controller|USB HOST]]
* IRQ 11 = [[#C4000000 - Analog to Digital Converter (ADC)|ADC]]
* IRQ 11 = [[#C4000000_-_Analog-to-Digital_Converter_.28ADC.29|ADC]]
* IRQ 13 = [[#AC000000 - SD Host Controller|SD Host Controller]]
* IRQ 14 = [[#900F0000_-_Unknown|Unknown]] (?)
* IRQ 15 = [[#900B0000 - Power management|Power management]]
* IRQ 16 = [[#900E0000 - Keypad|Keypad]]
* IRQ 16 = [[#900E0000 - Keypad|Keypad]]
* IRQ 17 = [[#90010000 - Fast timer|Fast timer]]
* IRQ 18 = [[#900C0000 - First timer|First timer]]
* IRQ 18 = [[#900C0000 - First timer|First timer]]
* IRQ 19 = [[#900D0000 - Second timer|Second timer]]
* IRQ 19 = [[#900D0000 - Second timer|Second timer]]
* IRQ 21 = [[#C0000000 - LCD controller|LCD controller]]
* IRQ 21 = [[#C0000000 - LCD controller|LCD controller]]
* IRQ 22 = [[#90100000 - TI-84 Plus link port|TI-84 Plus link port]] (?)

Revision as of 14:11, 3 October 2010

8FFF0000 - Unknown

90000000 - General Purpose I/O (GPIO)

The GPIO registers are separated into 4 sections:

  • Section 0: 90000000-9000003F
  • Section 1: 90000040-9000007F
  • Section 2: 90000080-900000BF
  • Section 3: 900000C0-900000FF.

Each register is a word, and only bits 0-7 of each are used. There can be up to 32 devices accessed by this setup, each known as a GPIO. Each GPIO is defined by one of the 8 bits in one of the sections. The number of the GPIO is the section number times 8 plus the bit number. Each GPIO has a status bit and can cause interrupts.

The following addresses are offsets from the beginning of the GPIO section:

  • +00 (R): Masked interrupt status ([+04] & [+08])
  • +04 (R): Reads raw interrupt status (directly dependent on the GPIO status) or sticky interrupt status (becomes set when GPIO status changes) depending on bit in [+20]
  • +04 (W): Write 1 to the bit to reset the sticky interrupt status.
  • +08 (R): Reads current interrupt mask bit.
  • +08 (W): Write 1 to the bit to enable interrupt (set mask bit to 1)
  • +0C (W): Write 1 to the bit to disable interrupt (set mask bit to 0)

The following addresses should be changed with a read-modify-write pattern so as to not disturb other bits in the register.

  • +10 (R/W): Setting bit to 0 will not allow GPIO status bit to change from its default (?)
  • +14 (R/W): (?)
  • +18 (R): Reads GPIO status bit.
  • +1C (R/W): Setting bit to 1 will invert raw interrupt status (?)
  • +20 (R/W): Setting bit to 1 will use sticky interrupt status in [+04], or setting to 0 will use raw interrupt status.
  • +24 (R/W): (?)

Currently known GPIOs:

  • GPIO 8 (Section 1, bit 0): Status bit is 0 if Reset Button is pressed.
  • GPIO 24 (Section 3, bit 0): Status bit is 1 if a keypad is not plugged in. (TI-Nspire non-cas only?)

90010000 - Fast timer

The same interface as 900C0000/900D0000, but runs at the speed of the APB clock (22.5MHz) rather than 32kHz. See #900D0000 - Second timer Second timer for more info.

90020000 - Serial UART

Used to communicate with the RS232 serial port. The register interface is like that of 16550 UART used in PCs:

  • 90020000 (R): Receiver Buffer Register
  • 90020000 (W): Transmitter Holding Register
  • 90020004 (R/W): Interrupt Enable Register
  • 90020008 (R): Interrupt Identification Register
  • 90020008 (W): FIFO Control Register
  • 9002000C (R/W): Line Control Register
  • 90020010 (R/W): Modem Control Register
  • 90020014 (R): Line Status Register
  • 90020018 (R): Modem Status Register
  • 9002001C (R/W): Scratch Register

90060000 - Watchdog timer

Possibly an ARM SP805 or compatible.

90080000 - Unknown

90090000 - Real-Time Clock (RTC)

Might be an ARM PrimeCell PL031.

  • 90090000 (R): Current time in seconds
  • 90090004 (W): ?
  • 90090008 (R/W): Sets the value of 90090000 (clock will not read new time until a couple seconds later). Reads last value written.
  • 9009000C (W): ?
  • 90090010 (W): ?
  • 90090014 (R): ?

900A0000 - Miscellaneous

  • 900A0000 (R): ?
  • 900A0004 (R/W): Set bit 0x20 to enable TI-84+ keypad link port. Other bits likely control functions of peripherals as well.
  • 900A0008 (W): Write a 2 to reset the CPU
  • 900A0010 (R/W): Fast timer interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
  • 900A0014 (R/W): Fast timer interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0010] should trigger an IRQ.
  • 900A0018 (R/W): Timer 1 interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
  • 900A001C (R/W): Timer 1 interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0018] should trigger an IRQ.
  • 900A0020 (R/W): Timer 2 interrupt status/acknowledge (6-bit). Write "1" bits to reset the corresponding interrupt requests.
  • 900A0024 (R/W): Timer 2 interrupt mask (6-bit). Set bits to 1 if the corresponding bits in [900A0020] should trigger an IRQ.
  • 900A0028-900A002C (R): These registers together give a 64-bit number which comprises 56 data bits and 8 parity checking bits, allowing any single-bit error in it to be detected and corrected.
    • Parity bit 0: Check of all data bits
    • Parity bits 1, 2, 4, 8, 16, and 32: Checks of the data bits whose positions, expressed in binary, have that respective bit set.
    • Data bits 3, 5-7, 9-15, 17-31, and 33-55: Middle part of the calculator's Product ID
    • Data bits 56-57: Unknown
    • Data bits 58-62: "ASIC user flags"; must match the 80E0 field in an OS image. 01 = CAS, 00 = non-CAS.
    • Parity bit 63: Check of parity bits 1, 2, 4, 8, 16, and 32.

900B0000 - Power management

  • 900B0000 (R/W): Clock speed load value
    • Bits 1-7: Multiply by 2 to get base/CPU ratio
    • Bit 8: If set, base clock is 27 MHz, else see bits 16-20
    • Bits 12-14: Add 1 to get CPU/AHB ratio
    • Bits 16-20: If bit 8 is clear, base clock is (300 - 6*this) MHz
  • 900B0004 (W): ?
  • 900B0008 (R/W): ?
  • 900B000C (R/W): Clock speed control (write 4 to set the clock speed according to the value in 900B0000)
  • 900B0010 (R/W): ON interrupt mask (1-bit). 1 if ON interrupt should be serviced or 0 if not.
  • 900B0014 (R/W): Bit 0 is set if ON interrupt is requested. Bit 1 also causes an interrupt, but the cause is unknown (and it is not masked by [900B0010]). Write "1" bits to reset the requests.
  • 900B0018 (R/W): ?
  • 900B0020 (R/W): ?
  • 900B0024 (R): Reads current clock speed value (see 900B0000 for details)
  • 900B0028 (R): Bit 4 (0x10) clear when ON key pressed

900C0000 - First timer

Configured as ~488 Hz timer by the OS. Same port structure as #900D0000 - Second timer Second timer.

900D0000 - Second timer

Two timers are located here, but only the first can generate IRQs. IRQ status/mask is located at [900A0020]. Configured as a ~100 Hz timer by the OS.

  • 900D0000 (R/W): Current IRQ timer value (16-bit). Set to 32 by the OS. Increases/decreases each [900D0004] ticks. The value written to this port is saved internally and can be reloaded automatically upon timer completion, depending on settings in [900D0008].
  • 900D0004 (R/W): IRQ timer divider (16-bit). Ticks per count - 1. Set to 9 by the OS. Ticks are approximately 32 kHz.
  • 900D0008 (R/W): IRQ timer control (5-bit).
    • Bit 4: Set to 1 to freeze timer.
    • Bit 3: Set to 1 for increasing timer, or to 0 for decreasing timer.
    • Bits 2-0: If 0, timer will count to zero and stop. If 1-6, timer will complete when it reaches the corresponding timer completion value and then reload with original timer value (see [900D0018] to [900D002C]). If 7, timer will never complete and runs infinitely.
  • 900D000C (R/W): Current timer value (16-bit). Increases/decreases each [900D0010] ticks. The value written to this port is saved internally and can be reloaded automatically upon timer completion, depending on settings in [900D0014].
  • 900D0010 (R/W): Timer divider (16-bit). Ticks per count - 1. Ticks are approximately 32 kHz.
  • 900D0014 (R/W): Timer control (5-bit).
    • Bit 4: Set to 1 to freeze timer, or 0 to run timer.
    • Bit 3: Set to 1 for increasing timer, or to 0 for decreasing timer.
    • Bits 2-0: If 0, timer will count to zero and stop. If 1-6, timer will complete when it reaches the corresponding timer completion value (see [900D0018] to [900D002C]). If 7, timer will not complete and runs infinitely.
  • 900D0018 (R/W): Timer completion value 1 (16-bit). If IRQ timer equals this value, bit 0 of the interrupt status becomes set.
  • 900D001C (R/W): Timer completion value 2 (16-bit). If IRQ timer equals this value, bit 1 of the interrupt status becomes set.
  • 900D0020 (R/W): Timer completion value 3 (16-bit). If IRQ timer equals this value, bit 2 of the interrupt status becomes set.
  • 900D0024 (R/W): Timer completion value 4 (16-bit). If IRQ timer equals this value, bit 3 of the interrupt status becomes set.
  • 900D0028 (R/W): Timer completion value 5 (16-bit). If IRQ timer equals this value, bit 4 of the interrupt status becomes set.
  • 900D002C (R/W): Timer completion value 6 (16-bit). If IRQ timer equals this value, bit 5 of the interrupt status becomes set.
  • 900D0030 (R/W): Unknown 6-bit value.

900E0000 - Keypad

  • 900E0008 (R/W): Keypad interrupt status/acknowledge (2-bit). Bit 1 is set when a key is pressed or released, and bit 0 has an unknown cause.. Write "1" bits to acknowledge.
  • 900E000C (R/W): Keypad interrupt mask (2-bit). Set each bit to 1 if the corresponding event in [900E0008] should cause an interrupt.
  • 900E0010-900E001F (R, halfword): Keypad map (see below)
  • 900E0044 (R/W): Unknown.

900E0010-900E001F - Keypad map

Each bit represents a key. If bit is cleared, the key is being pressed. Only bits 0 to 10 are used in each halfword. The mapping depends on the currently used keypad (TI-Nspire or TI-84+).

TI-Nspire keypad map:

offset bit 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 8 bit 9 bit 10
0012 , + W 3 V 2 U 1 T e^x pi
0014 ? - S 6 R 5 Q 4 P 10^x EE
0016 : * O 9 N 8 M 7 L x^2 i
0018 " / K tan J cos I sin H ^ >
001A ' cat G ) F ( E var D caps <
001C flag click C home B menu A esc tab ---
001E up u+r right r+d down d+l left l+u clear ctrl =


TI-84+ keypad map:

offset bit 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 8 bit 9 bit 10
0010 down left right up --- --- --- --- --- --- ---
0012 enter + - * / ^ clear --- --- --- ---
0014 (-) 3 6 9 ) tan vars --- --- --- ---
0016 . 2 5 8 ( cos prgm stat --- --- ---
0018 0 1 4 7 , sin apps X --- --- ---
001A --- sto ln log x^2 x^-1 math alpha --- --- ---
001C graph trace zoom wind y= 2nd mode del --- --- ---
001E --- --- --- --- --- --- --- --- --- --- ---

900F0000 - Unknown

  • 900F0020 (R/W): LCD contrast. Valid values range from 0x6B to 0x95; normal value is 0x80

90100000 - TI-84 Plus link port

  • 90100000 (W): Write to bits 0-1 to hold I/O link lines low or let them go high. 1=high, 0=low.
  • 90100000 (R): Bits 0-1 hold the status of the I/O link lines. 1=high, 0=low. Bits 4-5 hold the last value outputted to bits 0-1.
  • 90100004 (R/W): Unknown. The OS writes 0x80 here during initialization.
  • 90100008 (R): Unknown. Bit 0x40 is set if any link lines are low.

90110000 - LED

  • 90110B00 (R/W): Control register
    • Bit 0: Set this bit to enable green light blink data. If green blink data iteration is not on, the green light state is read from bit 0 of green blink data.
    • Bit 1: Set this bit and bit 6 to enable green blink data iteration.
    • Bit 2: Set this bit to force green light off. Overrides bit 4.
    • Bit 3: Set this bit to force red light off. Overrides bits 5 and 13.
    • Bit 4: Set this bit to force green light on.
    • Bit 5: Set this bit to force red light on.
    • Bit 6: See this bit and bit 1 to enable green blink data iteration. Reset before modifying green blink data or delay.
    • Bit 9: Set this bit to enable red light blink data. If red blink data iteration is not on, the red light state is read from bit 0 of red blink data.
    • Bit 10: Set this bit and bit 12 to enable red blink data iteration.
    • Bit 12: Set this bit and bit 10 to enable red blink data iteration. Reset before modifying red blink data or delay.
    • Bit 13: Forces red light on if bit 4 is 0, or red light off if bit 4 is 1. (?)
  • 90110B04 (R/W): Green blink data. 32 bits of on and off state, represented by 1 and 0. Iteration is done from bit 31 to bit 0 repeatedly.
  • 90110B08 (R/W): Green blink delay (negative). OS sets this to -2048.
  • 90110B0C (R/W): Red blink data. 32 bits of on and off state, represented by 1 and 0. Iteration is done from bit 31 to bit 0 repeatedly.
  • 90110B10 (R/W): Red blink delay (negative). OS sets this to -2048.

Note: If red and green lights are on at the same time, the color becomes yellow.

A4000100-A40096FF - Screen

Read-write, byte, half-word, word

Screen buffer. The upper left corner is the first byte. Each grayscaled pixel is 4-bit long. 1111 is white, 0000 is black.

A9000000 - "SPI"

AC000000 - SD Host Controller

See http://www.sdcard.org/developers/tech/host_controller/simple_spec/

B0000000 - USB OTG controller

Appears similar to the USB interface on Freescale Semiconductor's microcontrollers.

  • Module identification registers
    • B0000000 (R): ID - Identification register
    • B0000004 (R): HWGENERAL - General hardware parameters
    • B0000008 (R): HWHOST - Host hardware parameters
    • B000000C (R): HWDEVICE - Device hardware parameters
    • B0000010 (R): HWTXBUF - TX buffer hardware parameters
    • B0000014 (R): HWRXBUF - RX buffer hardware parameters
  • Capability registers
    • B0000100 (R): CAPLENGTH - Capability registers length
    • B0000102 (R): HCIVERSION - Host controller interface version
    • B0000104 (R): HCSPARAMS - Host controller structural parameters
    • B0000108 (R): HCCPARAMS - Host controller capability parameters
    • B0000120 (R): DCIVERSION - Device controller interface version
    • B0000124 (R): DCCPARAMS - Device controller capability parameters
  • Operational registers
    • B0000140 (R/W): USBCMD - USB command
    • B0000144 (R/W): USBSTS - USB status
    • B0000148 (R/W): USBINTR - USB interrupt enable
    • B000014C (R/W): FRINDEX - USB frame index
    • B0000150 (R): CTRLDSSEGMENT - 4G segment selector (always 0?)
    • B0000154 (R/W): PERIODICLISTBASE - Frame list base address
    • B0000158 (R/W): ASYNCLISTADDR - Next asynchronous list address
    • B000015C (R/W): TTCTRL - TT status and control
    • B0000160 (R/W): BURSTSIZE - Programmable DMA burst size
    • B0000164 (R/W): TXFILLTUNING - Host TT Xmit pre-buffer packet tuning
    • B0000180 (R): CONFIGFLAG - Configured flag register (always 1?)
    • B0000184 (R/W): PORTSC - Port status and control
    • B00001A4 (R/W): OTGSC - On-The-Go status and control
    • B00001A8 (R/W): USBMODE - USB device mode
    • B00001AC (R/W): ENDPOINTSETUPSTAT - Endpoint setup status
    • B00001B0 (R/W): ENDPTPRIME - Endpoint initialization
    • B00001B4 (R/W): ENDPTFLUSH - Endpoint de-initialize
    • B00001B8 (R): ENDPTSTATUS - Endpoint status
    • B00001BC (R/W): ENDPTCOMPLETE - Endpoint complete
    • B00001C0 (R/W): ENDPTCTRL0 - Endpoint control 0
    • B00001C4 (R/W): ENDPTCTRL1 - Endpoint control 1
    • B00001C8 (R/W): ENDPTCTRL2 - Endpoint control 2
    • B00001CC (R/W): ENDPTCTRL3 - Endpoint control 3

B4000000 - USB HOST controller

B8000000 - NAND Flash

BC000000 - Unknown

C0000000 - LCD controller

Probably an ARM PrimeCell PL110 or something compatible.

  • C0000010 (R/W): Frame Base Address. Holds the address to read pixel data from. Set to A4000100 by the OS.
  • C0000018 (R/W): Interrupt mask.
  • C000001C (R/W): LCD Control
    • Bit 0: LCD controller enable.
    • Bits 1-3: LCD bits per pixel.
      • 000 = 1 bpp
      • 001 = 2 bpp
      • 010 = 4 bpp (default setting of OS)
      • 011 = 8 bpp
      • 100 = 16 bpp (holds the literal 16-bit palette value instead of a palette index)
      • 101 = 24 bpp (not applicable to TI-Nspire's STN LCD)
      • 110,111 = reserved
    • Bit 4: Set to 1 if STN LCD is monochrome, or 0 if color. Should be set to 1 on TI-Nspire.
    • Bit 5: Set to 1 if LCD is TFT, or 0 if STN. Should be set to 0 on TI-Nspire.
    • Bit 6: Set to 1 if monochrome STN LCD has a 8-bit interface, or 0 if 4-bit. Should be set to 1 on TI-Nspire.
    • Bit 7: Set to 1 if LCD is dual panel STN, or 0 if single-panel. Should be set to 0 on TI-Nspire.
    • Bit 8: Set to 1 if the palettes are read as BGR, or 0 if RGB. Since monochrome displays use only the R color, it is possible to store a secondary palette in the B color and switch instantly by flipping this bit.
    • Bit 9: Set to 1 if the bytes in each word are to be read as big-endian, or 0 if little-endian. Set to 0 by the OS.
    • Bit 10: Set to 1 if the pixels within each byte are to be read as big-endian, or 0 if little-endian. Only affects 1,2,4 bpp modes. Set to 1 by the OS.
    • Bit 11: LCD power enable.
    • Bits 12-13: Vertical compare interrupt region.
      • 00 = start of vertical synchronization
      • 01 = start of back porch
      • 10 = start of active video
      • 11 = start of front porch
    • Bits 14-15: Reserved.
    • Bit 16: LCD DMA FIFO Watermark Level.
    • Bits 17-31: Reserved.
  • C0000020 (R): Raw interrupt status.
    • Bit 1: FIFO Underflow
    • Bit 2: LCD next address base update. Signifies that a new Frame Base Address value can be loaded for double-buffering.
    • Bit 3: Vertical compare. Set when one of four vertical regions (specified by the LCD Control register) is reached.
    • Bit 4: AHB Master bus error.
  • C0000024 (R): Masked interrupt status.
  • C0000028 (W): Interrupt clear. Write a 1 to each bit to clear.
  • C000002C (R): Address that is currently being read from (approximate)
  • C00000200-C00003FF (R/W): 256 color palettes (each is a half-word).
    • Bits 0-4: Red palette data (bits 1-4 are the grayscale data on the Nspire screen)
    • Bits 5-9: Green palette data (unused on Nspire)
    • Bits 10-14: Blue palette data (bits 11-14 are the grayscale data on the Nspire screen if BGR mode is set)
    • Bit 15: Intensity (unused on Nspire)

C4000000 - Analog-to-Digital Converter (ADC)

CC000000 - SHA-256 hash generator

Implements the SHA-256 hash algorithm, which is used in cryptographic signatures.

  • CC000000 (R): Busy if bit 0 set
  • CC000000 (W): Write 0x10 and then 0x0 to initialize. Write 0xE to process first block, 0xA to process subsequent blocks
  • CC000008 (R/W): ?
  • CC000010-CC00004F (W): 512-bit block
  • CC000060-CC00007F (R): 256-bit state

DC000000 - Interrupt controller

Registers that operate on sets of IRQs are bitmaps, with bit 0 corresponding to IRQ 0, and so on.

  • DC000000 (R): Masked IRQ status (always equal to [DC000004] & [DC000008])
  • DC000004 (R): Raw interrupt status or sticky interrupt status, depending on bitfield in DC000204
  • DC000004 (W): Resets a set of sticky interrupts
  • DC000008 (R): Current set of enabled IRQs
  • DC000008 (W): Enable a set of IRQs
  • DC00000C (R): Mirror of DC000008
  • DC00000C (W): Disable a set of IRQs
  • DC000020 (R): Reads current IRQ number (no side effects)
  • DC000024 (R): Reads current IRQ number, copies the value in DC00002C to DC000028, writes the priority of the current IRQ to DC00002C
  • DC000028 (R): Reading this register will reset the IRQ request. The value read is whatever was last copied by reading DC000024
  • DC00002C (R/W): 4-bit value. IRQs with priority greater than or equal to this value will not be requested
  • DC000100 (R): Masked FIQ status (always equal to [DC000104] & [DC0000108])
  • DC000104 (R): Raw interrupt status or sticky interrupt status, depending on bitfield in DC000204
  • DC000104 (W): Resets a set of sticky interrupts
  • DC000108 (R): Current set of enabled FIQs
  • DC000108 (W): Enable a set of FIQs
  • DC00010C (R): Mirror of DC000108
  • DC00010C (W): Disable a set of FIQs
  • DC000120 (R): Reads current FIQ number (no side effects)
  • DC000124 (R): Reads current FIQ number, copies the value in DC00012C to DC000128, writes the priority of the current IRQ to DC00012C
  • DC000128 (R): Reading this register will reset the FIQ request. The value read is whatever was last copied by reading DC000124
  • DC00012C (R/W): 4-bit value. FIQs with priority greater than or equal to this value will not be requested
  • DC000200 (R/W): Bits that are 0 will invert the corresponding raw interrupt status bit. Typically this register should hold 0xFFFFFFFF.
  • DC000204 (R/W): Bits that are 1 will cause the corresponding bit in DC000004 and DC000104 to read the sticky interrupt status. Bits that are 0 will cause the corresponding bit to read the raw interrupt status.
  • DC000208 (R/W): ?
  • DC000300-DC0003FF (W): IRQ priority (0-7). One register per IRQ. Lower values indicate higher priority.

Here is a list of known IRQ numbers: