About this driver
=================
This driver allows you to upload / download and delete pictures from
Tenx TP6801 based picture frames. This are small, cheap picture frames with a
1.1, 1.5 or 1.8 inch display. Currently this driver only supports the following
models:
Insignia NS-KEYXX10 (0168:3011)
I would very much like to extend the list of supported models, if you've
a picture frame which you think is Tenx TP68xx based please drop me a mail
at hdegoede@redhat.com
TP6801 based frames present themselves as a usb mass storage cdrom, which
contains the windows software. Communication with the device happens by
issuing special (custom) scsi commands. This driver uses the special
"usbscsi" port driver, which allows sending the custom scsi commands.
About the TP6801 access protocol
================================
Accessing the pictures uses scsi opcodes, in the vendor specific range,
for accessing the onboard flash memory the following 3 opcodes are used:
0xc1 Read
0xc6 Erase Block (64k)
0xcb Program page (256 bytes)
Each opcode is followed by the magic sequence 0x11 0x31 0x0f 0x30 0x01 and
then the number of bytes to read / write (0 for erase block) in 16bit BE
format, followed by the (start)address for the operation in 24bit BE format.
The SCB is further padded out with 0-s to 16 bytes.
There also is an opcode for setting the time of the photo frame, 0xca,
this opcode is followed by the same magic sequence 0x11 0x31 0x0f 0x30 0x01
and then 1 byte each for hour, minute, seconds, year (no centuries), month
and day of month, and again further padding to 16 bytes with 0-s.
TP6810 memory map
=================
All addresses are in hex!
000000-001dff Looks font-ish, may be the battery charging icon
001e00-001e3f Picture Allocation Table, each byte refers to the location in
the picture memory at the same index (multiplied by imagesize).
A value between 1 and max-pictures indicates the corresponding
location contains picture nr value, 0xfe means it contains a
deleted picture, 0xff means it contains pre-erased memory
(this allows uploading a new picture without needing an erase).
001e40-001e7f Unknown, maybe settings (text color, etc).
001e80-001ebf "Tnex TP6801 Image File System Signature" but then reversed
007c00-007fff Website url the windows app automatically opens on insert
008000-00dfff Font
010000-19ffff Pictures in rgb565 format
1a0000-1a0003 USB vid:pid first pid then vid
1a0020-1a003f SCSI model string
1a0100-1f5fff ISO img for emulated cdrom, minus first 32k (which is all 0).
1f6000-1fffff Power on logo in rgb565 format (same as pictures)
Hans de Goede <hdegoede@redhat.com>
13 June 2011
Generated by dwww version 1.15 on Thu May 23 12:41:06 CEST 2024.