[ Avaa Bypassed ]

About this driver
=================

This driver allows you to upload / download and delete pictures from
Tenx TP6801 based picture frames. This are small, cheap picture frames with a
1.1, 1.5 or 1.8 inch display. Currently this driver only supports the following
models:

Insignia NS-KEYXX10 (0168:3011)

I would very much like to extend the list of supported models, if you've
a picture frame which you think is Tenx TP68xx based please drop me a mail
at hdegoede@redhat.com

TP6801 based frames present themselves as a usb mass storage cdrom, which
contains the windows software. Communication with the device happens by
issuing special (custom) scsi commands. This driver uses the special
"usbscsi" port driver, which allows sending the custom scsi commands.


About the TP6801 access protocol
================================

Accessing the pictures uses scsi opcodes, in the vendor specific range,
for accessing the onboard flash memory the following 3 opcodes are used:
0xc1 Read
0xc6 Erase Block (64k)
0xcb Program page (256 bytes)

Each opcode is followed by the magic sequence 0x11 0x31 0x0f 0x30 0x01 and
then the number of bytes to read / write (0 for erase block) in 16bit BE
format, followed by the (start)address for the operation in 24bit BE format.
The SCB is further padded out with 0-s to 16 bytes.

There also is an opcode for setting the time of the photo frame, 0xca,
this opcode is followed by the same magic sequence 0x11 0x31 0x0f 0x30 0x01
and then 1 byte each for hour, minute, seconds, year (no centuries), month
and day of month, and again further padding to 16 bytes with 0-s.


TP6810 memory map
=================

All addresses are in hex!

000000-001dff	Looks font-ish, may be the battery charging icon
001e00-001e3f	Picture Allocation Table, each byte refers to the location in
		the picture memory at the same index (multiplied by imagesize).
		A value between 1 and max-pictures indicates the corresponding
		location contains picture nr value, 0xfe means it contains a
		deleted picture, 0xff means it contains pre-erased memory
		(this allows uploading a new picture without needing an erase).
001e40-001e7f	Unknown, maybe settings (text color, etc).
001e80-001ebf	"Tnex TP6801 Image File System Signature" but then reversed
007c00-007fff	Website url the windows app automatically opens on insert
008000-00dfff	Font
010000-19ffff	Pictures in rgb565 format
1a0000-1a0003	USB vid:pid first pid then vid
1a0020-1a003f	SCSI model string
1a0100-1f5fff	ISO img for emulated cdrom, minus first 32k (which is all 0).
1f6000-1fffff	Power on logo in rgb565 format (same as pictures)


Hans de Goede <hdegoede@redhat.com>
13 June 2011