83Plus:OS:84 Plus USB Information

I moved this page from Talk:83Plus:BCALLs:5254 to here because it seems to fit better. Please note that this is still a work in progress, and don't take the information as gold. I figured having an option for a Talk page for this would outweigh the moving of it. For the time being, we'll leave the data formatted as-is, since it's still nicely done. --AndyJ 07:44, 27 May 2005 (PDT)

OK, I've started this talk page to post information about the 84 Plus USB. This isn't the ideal place, since not all of this stuff has to do with entry point 5254, but it'll have to do. If anyone else would like to contribute any information or thoughts, please do so. Much of this data has been discovered by analyzing how the EasyData application interacts with the EasyTemp probe. --Dan Englender 22:32, 23 May 2005 (PDT)

Easy Data

The USB entry points that Easy Data uses are:

5254
5257
525A
525D
5260

These routines return carry flag with an error code in A on failure, or no carry on success. On success they return BC=(9C16), DE=(9C1A), and HL=(9C18). 9C16 = Vendor ID. 9C18 = Device ID. 9C1A = ????.

The entry points seem to be called only on initialization and quit. On initialization 5254 then 525D are called, and then 525A six times. On quit, 5254, then 5260, then 5257 are called.

5254 BCALL

The 5254 entry point seems to take a callback address to be passed in A (page) and HL (address). That callback address appears to be called on quit, after 5257 is called.

5260 and 5257 BCALLs

The 5260 and 5257 entry points are called right after each other in the code, and don't seem to take any input. I guess they're some kind of USB shut down. 5260 doesn't do much of anything other than set 9C1E to 0000. 5257 plays with the ports some, and then clears the callback address. Since the call back address gets called, I'm assuming it must also call the callback address somewhere in there.

525A BCALL

525A takes a pointer to a structure in HL. 9C1C will be set to the structure pointer. Some checks on port 4C and 8F are done at teh beginning of this call. A data segment of value: 21 09 0002 0000 0800 will be sent through the control data port. This cooresponds to Host to Device's endpoint, vendor type, set configuration.

525D BCALL

525D takes a pointer to a structure in HL. The 525D entry point first checks to see if bit 3 of port 4C and bits 0 and 2 of port 8F are set. If they are not, it returns failure. These bits are not set by, say, plugging in the hardware. They are set, however, after 5254 has been called. After checking these bits, 9C1E is set to the passed structure pointer. If this value is zero, the routine will return failure. A value of 1 will be stored to HL+2, then a value of 1 will be output to port 8E, a value of 20h to port 94h, and success will be returned.

5290 BCALL

A BCALL to 5290 alone is enough to turn on the LED on EasyTemp. (Though it turns on to a strange orange color which is never seen during EasyData execution). It must do some sort of USB initialization type stuff. If bit 3,(iy+41) is set, 5290 will fail. So this must either be a USB-already-initialized flag, or a Don't-Use-USB flag I guess.

This BCALL appears to do the following:

1. Do stuff
2. Request the device descriptor with a maximum size of 8 bytes.
3. Issue a Set Address Request, with an address of 2
4. Request the device descriptor again, this time with a 18 byte maximum data size.
5. Check device description for an appropriate TI or Vernier device and quit if not found.
6. Do stuff

Why are there two device descriptor requests? Presumably so that the calculator can check the peripheral's max packet size (which is in the first 8 bytes), so that it will know how to segmentize further traffic.

5293 BCALL

This BCALL is enough to to turn the LED off on EasyTemp. It's called by 5260.

Other

The callback routine appears to recieve some kind of input in B. I'm not sure what yet.

I'm, err, not exactly clear at this point how the app actually gets the temperature data from the EasyTemp probe, as the entry point seem to only be called on init and quit. The callback routine seemed a likely candidate, but it's not that either. Maybe there's something going on in the interrupt that I'm not aware of. Or maybe there are some more entry points used that I missed. ------- I'm now pretty sure that EasyData gets data through the 9C1E structure's callback which I believe returns data retrieved from an interrupt transfer in the OS's interrupt.

EasyData is automatically started when you plug the EasyTemp into the USB port if: The current app is Home Screen, a program is not currently executing, and EasyTemp is loaded on the calculator. EasyTemp is searched for via the app header table below.

4087 Header

The calculator knows to run EasyData when the Probe is plugged in because it includes a special header at address 4087h. The format is as follows:

 db 096h, 0E2h, 00h, 01h
 dw TablePtr
.....
TablePtr:
 dw 1, TableEntryType, DataPtr
.....
DataPtr:   ;This is the EasyData data
 db 03h, 80h, 03h, 00h, 0F7h, 08h, 02h, 00h
 db      80h, 03h, 00h, 0F7h, 08h, 03h, 00h
 db      80h, 03h, 00h, 0F7h, 08h, 04h, 00h
 db 00h, 00h

In theory, the Table should be terminated with a 0000 word. It does not appear that EasyData does this.

Header Table Entries

The TableEntryType value can be one of the follow:

• 1 - This type is checked for in what seems to be unused OS code. There's a string "IsDevice" that is used in conjunction with it. Perhaps it's an unimplemented feature, or perhaps it's debug code that's not active in the release OS. Your guess is as good as mine.
• 2 - This is for the library functions used by OpenLib and ExecLib
• 3 - This is for the USB auto-launch, as used by EasyData

USB Data Table

If the TableEntryType is 3, then the data will be USB data and will be formatted as follows: The first byte will be the number of entries in the USB data table. Then, each entry, starts with a byte. Not sure what that is. Then comes a word. Not really sure what that is either. But weird things happen if the high byte is not 00. And it appears that if the low byte is 01, only the vendor ID will be checked, if it's 03, the vendor ID and the product ID will be checked. If it's something else, well, something else happens. if the low byte was 03, then the next word will be the vendor ID, and the following word will be the product ID. If both of these match a connected USB device, then the app will launch.

FindSpecialAppHeader BCALL

The 50EF BCALL reads the 4087 Header. It is used by the OS. Returns SCF on failure, NC on success. On success, returns in HL the read table value. App name in OP1. Input DE is passed as the table entry to look for. Input A holds whether to look at certain app, or all apps. A = 0 means start at the first app, and search until you find an app with the appropriate header. A = 1 means start searching after the app in OP1. This would be used after the first success returned by A=0, to search the entire app list. A=2 means search only the app named in OP1.

5263 BCALL

The 5263 BCALL reads the 4087 Header. it is used by the OS. This appears to be very similar to the above entry point, except that it searches all the pages by number, instead of searching by name. Input DE = header type to find. Output C on failure, NC on success. HL = table entry value. (appSearchPage) = page it was found on. This only finds the first instance of the header type.

5266 BCALL

This allows you to continue a search you started with the 5263 BCALL. Input page in B.

5269 BCALL

The 5269 BCALL is used by the OS after determining that an app with the USB special app header exists. In general, this entry point seems to compare the values in the USB app header data table with the values at 9C16, 9C18, and 9C1A. Some kind of ID I guess? In specific, it's actually very convoluted and strange code. Input is HL -> data table, A = page.

Hardware

Ports 55h and 56h are initially polled in the interrupt routine to determine USB activity. If activity is detected, 4Dh, 82h, 84h, 86h, 8Fh, 91h, and others may be polled as well.

Port 4C

Some sort of status port. Values of 1A or 5A and 12 or 52 mean something. Default value is 22.

Port 4D

Some sort of status port. Bit 4 is set if a type A cable is plugged in. The high nibble appears to be A if nothing is plugged in, and 6 while connected to the computer. The port is checked bit-wise, but I haven't quite figured out how the rest of the bits function yet. I'm as yet unsure whether the values of this port are set based on external events alone, or also influenced by stuff going on in the interrupt. Will check with interrupts disabled later. There is a routine that is called when the bit 1 port 56 event occurs which first waits for bit 6,4D to be reset (which seems like the standard condition after a peripheral has been plugged in). It then does some outputs to ports 3A, 39, 4C, and 8F; after which it waits for bit 6,4D to be set (which seems like the standard condition after a peripheral has been initialized). This doesn't exactly clarify what bit 6 actually means though.

Port 55

This port determines whether there's USB activity for the interrupt routine to take notice of. If any of the first five bits of the port are reset, that means something's happening in USB land.

• bit 0 - Not sure. Only seems to happen with peripheral.
• bit 1 - ???? (not checked by OS)
• bit 2 - Check port 56 for details on what event has happened
• bit 3 - ???? (not checked by OS)
• bit 4 - Data waiting on bus?

Port 56

The default value for port 56h is 00. If bit 2 of port 55 is reset in the interrupt routine, this port should be checked to see what event occured. Each set bit indicates a particular event:

• bit 0 - ??
• bit 1 - Something to do with peripheral initialization?
• bit 2 - ??
• bit 3 - ??
• bit 4 - Peripheral plug-in
• bit 5 - Peripheral unplug
• bit 6 - PC plug-in
• bit 7 - PC unplug

Port 82

Bit 0 of this input port might be reset when device is busy. Reading this port a background port monitor messes up USB connections, so reading the port probably resets it.

Port 86

Some sort of status port. Seems to generally hold a value of 0. Bits 5 or 7 being set seems to be an error condition. Other bits may or may not be error conditions.

Port 8C

When the USB port is initialized, this port counts from 00 to FF at some fast frequency (anyone feel like timing it?) When it overflows it increments the value of port 8D.

Port 8D

When the USB port is initialized, this port is an overflow counter, that is incremented when port 8C overflows. Only the bottom three bits are active. The frequency is something along the lines of 1/5 of a second, measured by eyeballing only.

Port 8E

This output port might designate the type of transfer. 00 might be control, 01 might be interrupt, 02 might be bulk. The read value is whatever was previously set by a write.

Port 8F

Values of 1 or 3 are outputted to this port. I have no clue what they mean. After USB init, on read, it seems to be some sort of status. Bit 2 being set appears to imply calculator-as-host, reset seems to imply calculator-as-peripheral.

Port 91

This output port might control transfer of some tokens, e.g. ACK, IN, OUT. On read, bits 2 or 4 being set might indicate an error state.

Port A0

I believe this is a/the data input/output port. Control transfer port?

Port A1

Unhappily, there appears to be multiple data I/O ports. This is another. Interrupt transfer port?

Port A2

Port A2 has decided to join the club of data I/O ports. Bulk transfer port? (Shot in the dark...)

RAM

9C13/9C14

9C13 is the page, and 9C14 is the address of a callback routine. It is set by the 5254 BCALL, and called at various times. I'm not really sure what the callback routine is for yet.

9C16

This is where the vendor ID is stored. It is populated by at least the 5290 BCALL, and perhaps others.

9C18

This is where the product ID is stored. It is populated by at least the 5290 BCALL, and perhaps others.

9C1A

This is where the device release number is stored. It is populated by at least the 5290 BCALL, and perhaps others.

9C1C

A pointer to another structure. Similar to 9C1E. Bulk?

9C1E

A pointer to some sort of structure. First word of structure is a pointer to some sort of receive buffer. Reads from port A1 may be stored here. Perhaps for interrupt transfers? Offset 2 of structure is a byte value. Offset 3 of structure is a callback page and address

9C28

Some kind of value denoting either the current state or current operation. The 5290 reoutine initially sets this to 1, though may later change the value. Is used to determine a lot of conditional code in various routines, especially stuff going on in the interrupt.

9C29

This is an 8 byte output buffer

9C31

This is an input buffer of undetermined length. Possibly 64 bytes.

9C75

A flag byte of some sort. Bits 5, 6, and 7 appear to be used.

9C78

Used by the OS to keep track of how many bytes it needs to send for device descriptor replies, at least.

Flags

Flag byte 41 appears to be the main USB flag. Bit 0 of byte 43 is also used for something related.

0,(iy+41)

If this flag is set, it will cause a certain part of USB code to abort. This is the code that is called from the interrupt routine when port 55h is 0Fh, and port 56h is 00h. This flag is set in an odd piece of code that loops around an output to port 0A2h. It reads the data to output, however, from RAM pages 02h and 03h. Will have to look into in more detail later.

2,(iy+41)

This flag is set after loading the values of 9C16, 9C18, and 9C1A. But then it's reset if the VID/PID is 0451, E00F. *shrug* In BCALL 5254, it is reset after the bcall to 5290.

3,(iy+41)

If this is set the BCALL 5290 will immediately terminate. Set in Init if device is E00F. At end of init, if flag is set, screen will turn on and be refreshed.

5,(iy+41)

Reset somewhere in USB code. Not sure what it is.

6,(iy+41)

Reset somewhere in USB code. Not sure what it is.

7,(iy+41)

Reset somewhere in USB code. Not sure what it is.

In Other News

Stuff

• At some point, TI checks for USB devices VID: 045A, PID: E003, E008, and E00F. It seems to return "ok" on E008 and E003, and error on E00F. E008 is the 84P. No clue what E003 and E00F are. Perhaps one is the Viewscreen connector?
• I have successfully connected my calculator and digital camera, and retrieved the Product ID and Vendor ID from the camera. Yay :)
• I think EasyTemp is an HID device. I wish I could connect it to my computer to be sure.

Port Monitor

I've written a Port Monitor that's been useful for figuring out what some of the ports do. It may be useful for others, but it's not extensively tested, so beware. "Setup Hook" records port data through the USB hook. "Setup Int" records data through an IM2 interrupt (will only take a new sample if a port in the requested range has changed). "Disable Mon" will Stop either the interrupt or hook monitor. "Exec Code" allows you to execute a BCALL or hex code, presumably while one of the monitors is running. Exec program isn't implemented yet. "View Data" allows you to view all the data by sample. "View Changes" allows you to view the data by port, only showing ports that had data changes. In future revisions I may add more monitor triggers through other hooks. Oh, it doesn't read from ports 82 or A0, as these will cause problems with USB activity. The interrupt doesn't read from ports 8C or 8D because these are just counter ports and throw off the sampling.