About this driver ================= This driver allows you to upload / download and delete pictures from Tenx TP6801 based picture frames. This are small, cheap picture frames with a 1.1, 1.5 or 1.8 inch display. Currently this driver only supports the following models: Insignia NS-KEYXX10 (0168:3011) I would very much like to extend the list of supported models, if you've a picture frame which you think is Tenx TP68xx based please drop me a mail at hdegoede@redhat.com TP6801 based frames present themselves as a usb mass storage cdrom, which contains the windows software. Communication with the device happens by issuing special (custom) scsi commands. This driver uses the special "usbscsi" port driver, which allows sending the custom scsi commands. About the TP6801 access protocol ================================ Accessing the pictures uses scsi opcodes, in the vendor specific range, for accessing the onboard flash memory the following 3 opcodes are used: 0xc1 Read 0xc6 Erase Block (64k) 0xcb Program page (256 bytes) Each opcode is followed by the magic sequence 0x11 0x31 0x0f 0x30 0x01 and then the number of bytes to read / write (0 for erase block) in 16bit BE format, followed by the (start)address for the operation in 24bit BE format. The SCB is further padded out with 0-s to 16 bytes. There also is an opcode for setting the time of the photo frame, 0xca, this opcode is followed by the same magic sequence 0x11 0x31 0x0f 0x30 0x01 and then 1 byte each for hour, minute, seconds, year (no centuries), month and day of month, and again further padding to 16 bytes with 0-s. TP6810 memory map ================= All addresses are in hex! 000000-001dff Looks font-ish, may be the battery charging icon 001e00-001e3f Picture Allocation Table, each byte refers to the location in the picture memory at the same index (multiplied by imagesize). A value between 1 and max-pictures indicates the corresponding location contains picture nr value, 0xfe means it contains a deleted picture, 0xff means it contains pre-erased memory (this allows uploading a new picture without needing an erase). 001e40-001e7f Unknown, maybe settings (text color, etc). 001e80-001ebf "Tnex TP6801 Image File System Signature" but then reversed 007c00-007fff Website url the windows app automatically opens on insert 008000-00dfff Font 010000-19ffff Pictures in rgb565 format 1a0000-1a0003 USB vid:pid first pid then vid 1a0020-1a003f SCSI model string 1a0100-1f5fff ISO img for emulated cdrom, minus first 32k (which is all 0). 1f6000-1fffff Power on logo in rgb565 format (same as pictures) Hans de Goede 13 June 2011