Zerocat’s PS/2-Keyboard  v0.1.0
Get rid of keyloggers, avoid USB firmware attacks!
X200 Keyboard Hack

Keyboard Disassembled

IMG_1076.jpg
ThinkPad X200 Keyboard Disassembled (Mechanics of one Key Missing)

Listed Overview

Double Layer Keyboard Cable

IMG_1092.jpg
Keyboard Cable, splits towards Systemboard and Trackpoint
IMG_1084.jpg
Systemboard Connector from JAE, 40-pin + 4 Hold Downs (CONN40A-1-U1GP)

Circuit Schematic

x200-keyboard-cable.sch.png
Schematic of an X200 Keyboard Cable with 32-pin PTPM754DR TrackPoint Controller

Keyboard I/O Pads

As visible from the x200 keyboard cable schematics, the keyboard foil pads are organized in...

...resulting in 36 active pads.

IMG_1088.jpg
Double Layer with integrated Vias
IMG_1091.jpg
Keyboard Connector Pads, Top and Bottom

Trackpoint Board

Please read PS/2 to get prepared for PS/2 basics.

Pad Connection

The trackpoint board is connected to the keyboard cable by eight soldered pads, referenced by names Pad-1..Pad-8 within this documentation. Pad-1 is located close to the board’s edge.

Pad Number Function Remarks 9-pin Sub-D Test Plug
1 CLK close to board’s edge 9
2 RST can be connected to positive POR, alternatively 4
3 MIDDLE BUTTON - 8
4 RIGHT BUTTON - 3
5 LEFT BUTTON - 7
6 DATA - 2
7 VSS (GND) connected to thicker route in keyboard cable 6
8 VCC (+5V) connected to thicker, edgemost route of keyboard cable 1
- - - 5

Alternative Power-On-Reset (POR)

>
> Alternative POR at RST (Pad 2)
> ==============================
>
> C
> VCC --------||------+
> 2.2µF |
> | R
> RST ----------------+------/\/\/------- GND
> 100K
>

Modified Cable

The Keyboard Cable has been modified to ease experimenting with the disassembled Trackpoint Board. Test Connector is a SUB-D9 male plug.

IMG_1118.jpg
Modified Keyboard Cable to Ease Experimenting

Onboard Controller

Controller in use is the TPM754 from Philips Semiconductors. This is a 8051-based machine which runs proprietary code from IBM:

“IBM has licensed Philips Semiconductors to sell microcontrollers with TrackPoint code. By purchasing a TPM from Philips, the purchaser becomes a sub-licensee of Philips. The selling price of Philips’ TPM includes the royalties for IBM’s intellectual property, which Philips in turn pays to IBM. Customers for TPMs do not need to sign any licensing agreement with either IBM or Philips. This code is the intellectual property of IBM, which is covered by numerous patents, and must be treated accordingly.” – Philips Semiconductors (TPM754 Datasheet)

The TPM754 comes in different packages with different ordering codes. Unfortunately there is no datasheet nor pinout available for the 32-pin SSOP package (ordering code PTPM754DR), but in regard to measurements and the 28-pin SSOP datasheet, the pinout can be guessed in a straight foreward approach.

PTPM754DR 32-pin SSOP Pinout

Pin Function Connected Board Pad External PS/2 Mouse (6-pin Mini-DIN)
1 RxD/T0/P3.4 - Pin 1 (DATA)
2 TxD/T1/P3.5 Pad 1 (CLK), close to edge -
3 ECI/P3.6 - -
4 INT1/P3.7 - Pin 5 (CLK)
5 RST Pad 2 (RST) -
6 X2 - -
7 X1 - -
8 VSS Pad 7 (GND) Pin 3 (GND)
9 ZIN - -
10 YIN - -
11 XIN - -
12 XYZRAMP - -
13 AVSS - -
14 AVCC - -
15 not connected - -
16 not connected - -
17 VCC? AVCC? - -
18 not connected - -
19 DECOUPLE - -
20 VREG - -
21 XYDACBIAS - -
22 XYSOURCE - -
23 ZDAC/ASEL - -
24 XYDAC - -
25 P1.2 - -
26 VCC Pad 8 (VCC) Pin 4 (VCC)
27 CEX/P1.1 - -
28 INT0/P1.0 Pad 6 (DATA) -
29 P3.0 Pad 5 (LEFT BUTTON) -
30 P3.1 Pad 4 (RIGHT BUTTON) -
31 P3.2 Pad 3 (MIDDLE BUTTON) -
32 P3.3 - -

PS/2-Mouse at H8’s TrackPoint Interface

Warning
If the TrackPoint is replaced by a PS/2-Mouse, interfacing with the sysboard’s H8 controller doesn't work. Probably, H8 and TrackPoint Controller do not talk according to PS/2 standards??

PS/2-Mouse via Trackpoint Board

Although no interface is provided to attach an additional external PS/2 Mouse, pins 1 and 4 of the TPM754 can be used as a workaround in conjunction with the VCC and GND power lines. The IBM code separates data streams from Trackpoint and Mouse clearly, so that one device moves the screen pointer without being irritated by the other.

IMG_1121.jpg
Experimental Setup with External PS/2 Mouse
IMG_1126.jpg
Connecting the Trackpoint Board

TrackPoint at PS/2 Mouse Port

>
> Connect Trackpoint via Test Plug to a Standard PS/2 Mouse Port
> ==============================================================
>
>
> +---------VCC---------------------+--------> to Pin 4
> | +----------------DATA-----------|--------> to Pin 1
> | | |
> | | +------RST-------+---||-----+
> | | | | 2.2uF
> 1|2|3 4|5 |
> \ · · · · · / +--/\/\/---+
> \ · · · · / 100K |
> 6|7 8 9| |
> | | |
> | +-----------CLOCK----------|--------> to Pin 5
> +---------GND--------------------+--------> to Pin 3
>
> Sub-D9 Test Plug ----> PS/2 6-pin Mini-DIN
>
>

This setup has been proved to work with a D945GCLF Intel Desktop Board, running blobless coreboot firmware and the Trisquel7 Operating System. The Trackpoint and its attached external PS/2-Mouse is recognized at the PS/2 Mouse Port along with a PS/2-Keyboard (IBM Model M) attached to the PS/2 Keyboard Port. The reset line of the Trackpoint is simulated by the alternative Power-On-Reset circuit.

IMG_1137.jpg
Trackpoint with External PS/2-Mouse at Standard PS/2 Mouse Port of a Blobless Coreboot Machine

Drafted Idea for a PS/2-Keyboard with Trackpoint and External Mouse

>
> PS/2-Keyboard Setup using an X200 Keyboard Matrix with Trackpoint and external Mouse
> ====================================================================================
>
>
> ····························································································
> : :
> : +-----------------------------------+ :
> : +-----------------------+ | Board with Free-Design Controller | :
> : | X200 Keyboard |-----GND---/4----------| ================================= | :
> : | ============= | | | :
> : | |=====PB and Hotkey=========discard or translate====+ | :
> : | No controller in use. | |___ | | :
> : | |-----KBDID0----------->| | | | :
> : | * Power Button (PB) |-----KBDID1----------->| ? | | | :
> : | * Fn Hotkey |-----KBDID2----------->|___| | | :
> : | * Matrix 16x8 | | | | :
> : | * 3 Mouse Buttons |-----Matrix 16x8-----------------/24----------+ | | :
> : | * KBDID0..2 Lines | | | | | :
> : | * 4x Ground |---Mouse Button M----->| | /2 | :
> : | = 36 Pads |---Mouse Button R----->| | | | :
> : | |---Mouse Button L----->| | | | :
> : +-----------------------+ | v v | :
> : | +················+ | :
> : | : translate into : | :
> : +-----------------------+ | : PS/2 : | :
> : | TrackPoint Board |<<====+5V, GND===============\\ +················+ | :
> : | ================ | | || ^ | :
> : | |<---Mouse Button M-----| __||___________ | | :
> : | 8051-based controller |<---Mouse Button R-----| | +5V, GND | | | :
> : | (PTPM754DR) runs |<---Mouse Button L-----| |_______________| | | :
> : | proprietary code | | | ^ ^ | | :
> : | from IBM. |<-------Reset----------| | | | | | :
> : | | | /2 /2 /2 /2 | :
> : | * 3x Mouse Buttons | PS/2-Trackpoint | | | | | | :
> : | * PS/2 (clock, data) |<=======clock/data================+ | | | :
> : | * Reset Line | PS/2-Mouse | | | | | | :
> : | * Ground | | | | +-----| | :
> : | * +5V Power | Ext. PS/2 Mouse | v | | | :
> : | * Ext. PS/2 |<======clock/data===========+ | | | :
> : | = 10 Lines | | | | | | :
> : | | | | | | | :
> : +-----------------------+ +----|-----|-----------|------------+ :
> : | | | :
> : PS/2-Keyboard with Trackpoint /4 /4 /4 :
> ························································|·····|···········|·················
> | | |
> +--------Ext. PS/2-Mouse-----------------+ | |
> | | |
> | v v
> | +-----------------------------------------------------+
> v | :| PS/2 | | PS/2 |: |
> +------------------------+ | :| Mouse | | Keyboard |: |
> | External PS/2 Mouse | | :|_______| |__________|: |
> | =================== | | ·····PS/2-Combi-Port?····· |
> | | | |
> | proprietary controller | | Blobfree Coreboot Computer or Laptop |
> | | | ==================================== |
> | * PS/2 | | |
> | = 4 Lines | | * with two PS/2 Ports |
> | | | * or with one PS/2 Combi Port and Y-Splitter-Cable |
> +------------------------+ | |
> | Working Example(s): |
> | |
> | * D945GCLF Desktop Board with Blobless Coreboot |
> | |

Conclusion

In case a desktop board with blobless coreboot is used as host, this PS/2 free-design keyboard would significantly improve the computer user’s situation in respect to freedom and security. Let’s go for prototyping!