A somewhat-updated version of the WikiTI USB documentation. Port ranges: 30h-3Fh: crystal timers (also on the 83+SE) and battery ports. 40h-4Fh: unknown. 50h-5Fh: unknown. ... What TI calls the "private" range: 80h-8Fh: general port stuff. 90h-9Fh: stuff that applies to a specific endpoint or pipe, influenced by port 8Eh. 0A0h-0AFh: the actual pipes that data is transferred across. Port 39h: Bit 1: set and reset during initialization around outputs to ports 4Ch and 8Fh. Port 3Ah: This is some sort of battery port that only exists on the 84+ and 84+SE. It is used in testing battery levels in _Chk_Batt_Low and elsewhere. Bit 3: this is checked exclusively by the USB routines and executes different code based on it. Port 4Ah: 20h is written to this port during initialization. Port 4Bh: 20h is written to this port during initialization. Port 4Ch: Values of 1Ah/5Ah and 12h/52h are significant. With nothing plugged in, it appears to be 22h. Bit 3: some host routines make sure this is set. It may be set whenever device is initialized. On error, this bit is set if either bits 5 or 6 of port 4Dh are set (all others zeroed out). Otherwise, it zeroes out all bits. Port 4Dh: Bit 4: set if A cable is plugged in. Bit 5: this is checked first by OS to see if USB communication should be attempted (reset if so). Bit 6: if bit 5 was set, then OS checks this bit to see if USB communication should be attempted (reset if so). Bit 7: on error, If bit 5 is reset (or 6, if that's not the case), the OS attempts to use USB over I/O. Bits 5 and/or 6 being set are tied to acting as host somehow. Port 4Fh: Outputs to ports 39h and 3Ah surround the only known output to this port, during initialization; it resets bit 6, then sets bits 7 and 3, then ANDs with 37h. Port 50h: I have absolutely no clue what this port could be for (it's new). 27h is written to this port during initialization. Port 54h: Bit 1: if reset, port 54h gets 2 and 4Ch gets zero (and this implies the ViewScreen connector is not initialized). Port 55h: A status port checked by the interrupt to determine what event has just occurred. A reset bit means the event has occurred. Bit 0: unknown, but has been seen reset in peripheral mode. Bit 1: not checked by OS. Bit 2: check port 56h to see what happened. Bit 3: not checked by OS. Bit 4: data is waiting or ready to be read. Port 56h: Apparently this port is not reliant on port 55h. Bits 0, 2, and 3 are not used by the OS nor the boot code. Bit 1: this has something to do with initializing as either host or peripheral (5,(4Dh) set if peripheral). Bit 4: mini-A cable was just inserted. This says nothing about what's on the other end, if anything. Bit 5: mini-A cable was just removed. Bit 6: mini-B cable was just inserted. This says nothing about what's on the other end, if anything. Bit 7: mini-B cable was just removed. Port 57h: On error, if 6,(4Dh) is set, this port gets 93h. If reset, this port gets 50h. Bit 4 is reset by the OS at some point. Port 5Ah: Gets 1 when setting up endpoints for Vernier EasyData probe. Port 5Bh: Bit 0: set to enable USB-related interrupts. Reset to disable. Port 80h: Holds the device address in either host or peripheral mode. When the OS is host, it always assigns 2 to this port. Port 81h: Bit 0: set when initializing as peripheral. Bit 1: setting this bit is what kills a USB peripheral. Port 54h gets bit 0 set beforehand in OS. Bit 4: this bit is set if we are connected and initialized as a USB peripheral. This port gets 1 in seemingly-inactive OS code. Port 82h: Indicates outgoing data success. This appears to be valid for both data packets, and IN/OUT tokens. Each bit set indicates data sent successfully for that Ax port. The control port's bit registers for both incoming and outgoing data (instead of using port 84h). Port 83h: Likely a continuation of port 82h, with each bit indicating outgoing data success for endpoint/pipes 0A8h through 0AFh. Port 84h: Indicates incoming data ready. Each bit set indicates data is ready to be read on that Ax port. The control pipe acts as if it were an OUT pipe, so use bit 0 of port 82h to check for control data. Port 85h: Likely a continuation of port 85h, with each bit set indicating incoming data ready for endpoint/pipes 0A8h through 0Afh. Port 86h: Some sort of status port. Bit 1: unknown, possibly error condition of some sort. Bit 4: in as-host initialization, the OS loops on this port until it is set. Bit 5: error condition of some sort. Bit 7: error condition of some sort. Port 87h: Bitmap of which pipes in the 0A0h-0A7h range are enabled for output. Port 88h: Likely a bitmap of which pipes in the 0A8h-0AFh range are enabled for output. Port 89h: Bitmap of which pipes in the 0A0h-0A7h range are enabled for input. Port 8Ah: Likely a bitmap of which pipes in the 0A8h-0AFh range are enabled for input. Port 8Bh: Unknown. On initialization, this tends to get 0A1h (or 0F7h) if acting as host, and 05h if acting as peripheral. Port 8Ch: The low byte of the 15-bit frame counter. It is automatically incremented if a cable is plugged in. In theory, this should be incremented once per millisecond. Port 8Dh: The high byte of the 15-bit frame counter. Port 8Eh: Designates the current endpoint to read from or transfer to (00h-0Fh). Port 8Fh: Bit 2: reset implies calculator-as-peripheral, and set implies calculator-as-host. This may be the "host bit" that TI refers to, and is checked in initialization. If 3,(4Ch) is set and bits 0 or 2 of 8Fh are reset, that's bad for doing something host-like. Bits 6 and 7 of port 86h apparently don't matter if bit 7 is set. Port 90h: Sets up the maximum packet size for outgoing pipes. The value of this port times 8 is the packet size. Port 91h: Outgoing pipe command port. This is complicated and functions very differently in host and peripheral mode. Port 92h: Gets only zero in boot code, and sometimes in the OS. The OS sets this to 10h when initializing Vernier EasyData probe's endpoints/pipes. The OS sets this to 01h when Vernier EasyData timeout expired and the callback is being notified of it. Port 93h: Sets up the maximum packet size for incoming pipes. The value of this port times 8 is the packet size. Port 94h: Incoming pipe command port. This is complicated and probably functions differently in host and peripheral mode. Port 95h: This port gets zero when endpoints are set up. Port 96h: Holds the low byte of the size of received and buffered input data for the currently-selected endpoint/pipe (port 8Eh). This is how much you read from the appropriate Ax port. Port 97h: Possibly holds the high byte of the size of the received and buffered nput data for the currently-selected endpoint/pipe (port 8Eh). The 84+ and 84+SE don't send packets over 256 bytes, so this port has no use in the OS. Port 98h: Sets up outgoing pipes. The high nibble defines the type of pipe: 1 is isochronous, 2 is bulk, and 3 is interrupt. The low nibble defines which pipe to map the endpoint to, which corresponds to a port in the Ax range. Example (outgoing bulk pipe to port 0A1h): ld a,21h out (98h),a Port 99h: Sets up the poll interval for an outgoing interrupt endpoint. Port 9Ah: Sets up incoming pipes. The high nibble defines the type of pipe: 1 is isochronous, 2 is bulk, and 3 is interrupt. The low nibble defines which pipe to map the ednpoint to, which corresponds to a port in the Ax range. Example (incoming bulk pipe to port 0A1h): ld a,21h out (9Ah),a Port 9Bh: Sets up the poll interval for an incoming interrupt endpoint. Port 0A0h: Control pipe data port. Reads and writes to the control pipe are sent to/read from this port. Ports 0A1h-0AFh: The other data pipes, configured by 8Eh and the 9x ports. 9C1Ch: Address of Vernier send structure. 9C1Eh: Address of Vernier receive structure. 9C27h: Current Vernier EasyData state. 1: Set report (send command) has been attempted. 6: Sending Vernier command from _SendVernierCommand. 9: Set report (send command) has just completed. 9C28h: Current USB status, likely used by the Vernier EasyData callback. 2: calculator is being initialized as a peripheral? Why would this happen with EasyData probe? 6: there has been a USB error. 9C71h: Holds address of device (as peripheral). 9C75h: USB flag byte. Bit 0: not used. Bit 1: not used. Bit 2: internally, this is set if currently returning a string descriptor, or reset for device/config descriptors. Bit 3: this is set if the calculator is acting as a SmartView Input Pad. Bit 4: when 21 09 00 02 00 00 01 00 control request is received (as SmartView Input Pad), this bit is set if the data byte had bit 1 set, or reset otherwise. This status is returned by BCALL 52E1h. Bit 5: set if Vernier EasyData command is queued to be sent. Bit 6: set if initialized device is a Vernier EasyData probe. This is also used to determine whether to call the Vernier EasyData callback at certain times. Bit 7: set address request was just received. The OS uses this to remember to set the address on the next read data interrupt. 9C77h: Internal use, offset in the descriptor table of the descriptor to return. 9C78h: Internal use, holds the maximum number of bytes being returned for a descriptor request. _AttemptUSBOSReceive: 80E4h: Inputs: NZ set if this is being called in response to a USB event (A needs to be contents of port 56h) If Z set, it will wait for an event to occur. Unplugging a mini-B cable here will throw a boot code error. Example: in a,(56h) or a ;if nothing's going on, Z will be set and it'll wait, otherwise it'll take action immediately B_CALL AttemptUSBOSReceive