Reverse engineering Blackberry Passport Keyboard pinout part 5

Well, I moved back to Bangkok. I got access to all of my tool. And We have good news!

I found the pinout of the Synaptics Touch controller! YAYYYYYY🙌🥳

This might be useful for you who want to reverse engineer pinout of unknown chip. Last time with Wacom W9013 is easy since it was power up and running with the PC. But this one is a bit tricky.

I recalled that STM8L has 2 pins, PC0 and PC1. Both has no protection diode (clamp diode). So I used multimeter in diode mode to try and probe between ground and various pins of the Synaptics. With reference measurement from my STM8L151F3 board. I can at least tell which pin is potentially a Vcc and I2C bus.

typical GPIO of STM8L and many other digital IC

You can measure these clamp diode by probing positive lead to ground and negative lead to the pin. You should be able to measure forward voltage of the protection diode on typical GPIO. Except the I2C pin.

But as I said that it was tricky. The I2C slave device has 1 open drain for SDA and (probably) input-only pin for SCL. The diode mode can mess up the reading (by turning the gates on). So I switched to resistance reading mode instead. For some reason, The VCC pin to ground has a reading about 5k Ohm (pos to VCC, neg to GND). This happened on both STM8L and *S3501B S3508A too.

After trial and error. I was able to come up with the complete pinout!!!

Complete pinout!!

I was right on guessing the I2C pin. I found the correct SCL/SDA pinout by using my STM8L as I2C scanner (code is up on stm8l_sdcc_template).

I used STM8L as I2C Scanner and look what I found!!! Address 0x20!!
Some little test with evtest with my F1C100s board

evtest dump :

Input driver version is 1.0.1
Input device ID: bus 0x1d vendor 0x6cb product 0x0 version 0x0
Input device name: "Synaptics 57782-013"
Supported events:
Event type 0 (EV_SYN)
Event type 1 (EV_KEY)
Event code 330 (BTN_TOUCH)
Event type 3 (EV_ABS)
Event code 0 (ABS_X)
Value 0
Min 0
Max 3232
Resolution 40
Event code 1 (ABS_Y)
Value 0
Min 0
Max 906
Resolution 41
Event code 24 (ABS_PRESSURE)
Value 0
Min 0
Max 255
Event code 47 (ABS_MT_SLOT)
Value 0
Min 0
Max 9
Event code 48 (ABS_MT_TOUCH_MAJOR)
Value 0
Min 0
Max 15
Event code 49 (ABS_MT_TOUCH_MINOR)
Value 0
Min 0
Max 15
Event code 52 (ABS_MT_ORIENTATION)
Value 0
Min 0
Max 1
Event code 53 (ABS_MT_POSITION_X)
Value 0
Min 0
Max 3232
Resolution 40
Event code 54 (ABS_MT_POSITION_Y)
Value 0
Min 0
Max 906
Resolution 41
Event code 55 (ABS_MT_TOOL_TYPE)
Value 0
Min 0
Max 15
Event code 57 (ABS_MT_TRACKING_ID)
Value 0
Min 0
Max 65535
Event code 58 (ABS_MT_PRESSURE)
Value 0
Min 0
Max 255
Properties:
Property type 1 (INPUT_PROP_DIRECT)
Testing … (interrupt to exit)

I also decoded the F12 HID report bytes. From 88 bytes, only 17 are actually used

More info on this later.

// Finger 1
// F12_report[0] -> Finger 1 present (1/0)
// F12_report[1] -> ABS_X LSB
// F12_report[2] -> ABS_X MSB
// F12_report[3] -> ABS_Y LSB
// F12_report[4] -> ABS_Y MSB
// F12_report[5] -> pressure
// F12_report[6] -> ABS_MT_TOUCH_MINOR
// F12_report[7] -> ABS_MT_TOUCH_MAJOR

// Finger 2
// F12_report[8] -> Finger 2 present (1/0)
// F12_report[9] -> ABS_X LSB
// F12_report[10] -> ABS_X MSB
// F12_report[11] -> ABS_Y LSB
// F12_report[12] -> ABS_Y MSB
// F12_report[13] -> pressure
// F12_report[14] -> ABS_MT_TOUCH_MINOR
// F12_report[15] -> ABS_MT_TOUCH_MAJOR

// F12_report[16] to F12_report[85] are all at 0x00

// F12_report[86] -> BTN_TOUCH single finger == 1, 2 fingers == 3
// F12_report[87] is 0x00

As for now I’m working on the code port of Synaptics RMI4 driver to STM8 and STM32. So please stay tune for next part!

Note *: My previous keyboard has S3501B chip. But the new one I got has S3508A. I just find out about it couple days ago (By peel of the intact black sticker). FYI, These two are compatible as both are RMI4 compliance.

Advertisement

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s