After doing some fiddling around myself, I've put together a few tools
and I think I now have the beginnings of an understanding of the report
frame structure. I've attached some notes below. The data packets
appear to be 6 bytes long, consistent with earlier versions of the
protocol. The first and fifth bytes of the touchpad packet are still
quite mysterious. While they likely have something to do with
multitouch, they both fluctuate even with single touch events. Touchpad
packets can be distinguished from stick packets by examining the byte 5,
which is 0x3f (out of the range of the pressure field) in touchstick
packets.
I've also attached two tools I've developed. ps2-parse.py annotates PS/2
traces produced by the VM with common command names (simply pipe a trace
in to stdin, out comes the annotate trace on stdout). Alps.py is a first
attempt at communicating with the hardware. It currently has the ability
to put playback a trace (say, the attached serio-init.log) and start
dumping frames to stdout. It also has an incomplete version of the
initialization sequence (enter_absolute_mode).
Hopefully I'll find some more time in the next few days to figure out
the last few bits (primarily how multitouch events work). I wouldn't be
sad if someone finished the task for me, however.
Cheers,
- Ben
Touchpad Packet format:
byte 0: ??? starts with 0x9f, 0x8f, changes
0x10: ??
0x20: ??
0x8f: Always set
Only 0x10 and 0x20 are set with single-touch events. 0x40 seems to be set with multitouch events
byte 1: X position? (- is left, + is right)
byte 2: Y position? (- is up, + is down)
byte 3: button state:
0x1: left touchpad
0x2: right touchpad
0x4: middle touchpad?
0x8: Always set?
0x10: left touchstick
0x20: right touchstick
0x40: middle touchstick
0x80: ???
byte 4: ???
byte 5: Pressure (0x00 - 0x3e)
0x3f: Reporting stick?
Touchstick Packet format:
byte 0: 0x10: Y Sign
0x20: X Sign
0x4f: Always set
byte 1: X pressure (0 - 0x7f)
byte 2: Y pressure (0 - 0x7f)
byte 3: always 0x48
byte 4: Z pressure (0 - 0x7c)
byte 5: always 0x3f