• Bluetooth HID is easy right?

    Miklos Marton • 01/01/2019 at 18:32 • 0 comments

    ... or maybe not.

    I have flashed the nordic keyboard example to make sure that the basic HID - BLE functionality works as expected:

    https://github.com/I0x0I/DIY-A-BLE-Keyboard

    Then I followed the Archlinux Wiki about the Bluetooth keyboard bringup:

    https://wiki.archlinux.org/index.php/bluetooth_keyboard

    Unfortunately I am not able to pair to my device:

    mm@lapos:~$ bluetoothctl
[NEW] Controller 00:15:83:D1:A9:E6 BT 4.0 [default]
[NEW] Device A0:6F:AA:9E:3E:03 LG SJ5(03)
[NEW] Device E8:83:76:AE:34:7D Nordic_Keyboard
[bluetooth]# power on
Changing power on succeeded
[bluetooth]# agent KeyboardOnly
Agent registered
[bluetooth]# default-agent
Default agent request successful
[bluetooth]# pairable on
Changing pairable on succeeded
[bluetooth]# scan on
Discovery started
[CHG] Controller 00:15:83:D1:A9:E6 Discovering: yes
[CHG] Device A0:6F:AA:9E:3E:03 RSSI: -91
[NEW] Device 51:CA:CE:EF:57:5C 51-CA-CE-EF-57-5C
[CHG] Device E8:83:76:AE:34:7D RSSI: -71
[CHG] Device E8:83:76:AE:34:7D RSSI: -86
[bluetooth]# pair E8:83:76:AE:34:7D 
Attempting to pair with E8:83:76:AE:34:7D
[bluetooth]# trust E8:83:76:AE:34:7D 
Changing E8:83:76:AE:34:7D trust succeeded
[bluetooth]# connect E8:83:76:AE:34:7D 
Attempting to connect to E8:83:76:AE:34:7D
[CHG] Device E8:83:76:AE:34:7D Connected: yes
[CHG] Device E8:83:76:AE:34:7D Connected: no
Failed to pair: org.bluez.Error.AuthenticationCanceled
Failed to connect: org.bluez.Error.Failed
[CHG] Device E8:83:76:AE:34:7D RSSI: -73
[CHG] Device E8:83:76:AE:34:7D RSSI: -81
[CHG] Device E8:83:76:AE:34:7D RSSI: -72
[CHG] Device E8:83:76:AE:34:7D RSSI: -81
[CHG] Device E8:83:76:AE:34:7D RSSI: -73

    Here is what I see when doing the connect with btmon:

            Handle: 39
        Random number: 0xff9f0b8649b6cf46
        Encrypted diversifier: 0x3ffe
        Long term key: e085b0c06f0bdfede3bd0238fc181ed4
> HCI Event: Command Status (0x0f) plen 4                                                                                                [hci0] 4.419375
      LE Start Encryption (0x08|0x0019) ncmd 1
        Status: Success (0x00)
> HCI Event: Encryption Change (0x08) plen 4                                                                                             [hci0] 4.470241
        Status: PIN or Key Missing (0x06)
        Handle: 39
        Encryption: Disabled (0x00)
< HCI Command: Disconnect (0x01|0x0006) plen 3                                                                                           [hci0] 4.470347
        Handle: 39
        Reason: Authentication Failure (0x05)
> HCI Event: Command Status (0x0f) plen 4                                                                                                [hci0] 4.472318
      Disconnect (0x01|0x0006) ncmd 1
        Status: Success (0x00)
> HCI Event: Disconnect Complete (0x05) plen 4                                                                                           [hci0] 4.487330
        Status: Success (0x00)
        Handle: 39
        Reason: Connection Terminated By Local Host (0x16)

    To make sure that my setup works I have even started Windows, but I was not able to install drivers to my dongle, since the installer says it is a counterfeit unit...

  • Long live the new shift!

    Miklos Marton • 12/13/2018 at 19:16 • 0 comments

    After separating the original keyboard's layers at the shift buttons and measuring continuity between the top and bottom traces it turned out that the keyboard and the shift column common (COL0) is broken. The tracks at the left shift seems to be corroded, so I assume that the reason of the dislemanting of the whole notebook was a water accident.

    I almost decided to give up on this architecture (and move to a Thinkpad R60 keyboard with an nRF52840 module), but I got an idea to look after a similar keyboard with different layout and move the buttons to that.

    In Hungary we use a lot weird accents, so the US keyboard is not suitable for us. Luckily I was able to buy a Spanish keyboard for 15 bucks which arrived safe before the christmas rush.

    Aaaand the shift is functioning on this particular one!

    Stay tuned!

  • Where is the shift?

    Miklos Marton • 09/24/2018 at 21:02 • 0 comments

    I have successfully mapped my layout, but only two keys are missing:

    the left and right shift.


    The keymap looks fishy: the column 0 is unused.

    - All rows are functioning

    - MCU output checked

    - MCU to connector checked

    - I have peeled off the adhesive glue from the keyboard connector, and was able to verify the connector -> keymatrix connection.

  • Rev B misses

    Miklos Marton • 09/23/2018 at 16:07 • 0 comments

    Yesterday I have discovered a similar firmware project:

    https://github.com/I0x0I/DIY-A-BLE-Keyboard
    Since it pretty much fit's my needs I have started to adopt it for the keyboard part.

    During the bringup I had to realize that I have messed up the PCB (and the whole design) again:

    After deeper inspection the YJ-14015 Chinese module  has two unconnected pins:

    the P0.26 and 27. Supposedly they are used for the 32.768 kHz oscillator. I have no idea how did I missed it because they have even left out the silkscreen for these pins.

    Anyway I will take a look if  I can eliminate the LF osc, and remove and hardwire to those pads. Missing CAPS lock LED is not a big deal but I one of the column outputs is wired to there unfortunately.

  • New PCB manufactured!

    Miklos Marton • 08/09/2018 at 21:29 • 0 comments

    I have just got a 100*100 montage from the Dirty, and one of the boards was this one.


    This time no major fuckupness were made (or not detected yet). There is a messed up footprint around the touch power switching P FET: SV75 footprint were used instead of the SOT23, but I could get the part populated.


  • Getting the code rolling

    Miklos Marton • 03/29/2018 at 21:27 • 0 comments

    It had been a while when I last touched this stuff.

    One of my friends will have a dirty order soon hopefully he will manufacture a new board (with correct BLE module footprint) for it.

    I have started to ditch the code together from a Nordic HID over Bluetooth example and the Linix kernel's Elan I2C-HID code.

    Currently it is in a "code compiles, but who knows what it does in a real env" status.

    Stay tuned!

  • PCB messed up...

    Miklos Marton • 11/06/2017 at 18:31 • 0 comments

    As you can see I have managed to mess up the design: the wrong footprint was used in the final version...

    Conclusion: always print the gerbers to paper, and verify the footprint of the unverified critical components.

    Or do not use components from vendors who is not capable of creating a datasheet for their product. Yes I have not been able to find mechanical dimensions for the YJ-14015 module. If you are smarter than me in finding this please let me know.

  • Heading to the PCB manufacturing

    Miklos Marton • 10/11/2017 at 18:39 • 0 comments

    Today I have panelized my manufacturable designs, and hopefully will besent to the dirty today.

  • Touchpad mistery solved, rerouted board.

    Miklos Marton • 09/21/2017 at 15:43 • 0 comments

    After googling about the ELAN microelectronics corp, I came across the following patchset submitted to the Linux kernel:

    https://lwn.net/Articles/496137/
    It turned out that the touchpad I2C interface is used as a I2C - HID interface. It is in the vanilia mainline now, so it seems to be a good starting point. Basically I will need to create an I2C - HID - BLE - HID converter.

    I have also rerouted the board to align the MIFA antenna to the proper direction:

    Also made some paper printouts to verify the physical dimensions:

    The BLE module footprint had some problems, but fixed now. The rest of the connector verification waits to my PID controlled flat iron because removing the FPC connectors will require preheating what I do not really have ATM.

  • Touchpad calvary

    Miklos Marton • 09/17/2017 at 13:37 • 0 comments

    The notebook is equipped with a touchpad manufactured by Elan microelectornics Corporation. The board number is 2H214-14201 Rev B. The controller IC is Elan 339360-3100. I have found no information about them on the web. I might run a round with Elan in e-mail, but I do not really have big hopes about it.

    I do not have schematic for the original mainboard but have one for an another similar Samsung Ultrabook with discrete graphics codenamed Miranda 13H-EXT.

    The pinout of the touch connector is the following:



    The KBC3_TCLK/TDATA goes to the superio/micom while the SMB3_CLK/DATA hooked to the PCH's SMBUS to the same one which connects the RAM slot's SPD eeproms. Unfortunately I have no luck powering up the board to boot (if I could not this conversion would be it's destination), so I could not run an I2C detect from Linux to see it is answering.

    The KBC3_TCLK/TDATA interface I guess is a PS2. I will power up the board's P3.3V to see if it outputs the clock. PS2 differs from I2C so it would be tricky to interact with it. SMBUS would be better because it could (or should due the lack of free pins) share the same bus with the lipo battery gauge.