I2C Specs

• HID over I2C

• Address: 0x5b

• Bus speed: 400kHz

• HID_Descriptor: 0x0000

• ACPI Device: TOUA

Address

ACPI tells that the device TOUA uses I2C-2@400kHz with an address of 0x5b

HID Descriptor

GPIOs

HID Interrupt: K2

Flash Chip

Boot loader for the RT1 is written on a Winbond W25Q32VIP. This is a 32MBit (4K Byte) SPI flash chip that operates in Single mode and comes in an 8 pin WSON 6X5-MM package. Its contents are locked in because of the P variation in its name that specifies the OTP (Write Once) feature in the chip. This means the contents can't be replaced. We can however replace the entire chip.

Pinout

Below is the pinout for Single mode operation of the chip.

Naming Convention

Replacing the flash

Before starting it is recommended to dump the contents of the chip as it contains unique configuration aspects for the device. Check the on how to do this

Replacing the chip is not to be taken lightly. It requires a hot air station to remove as it is a surface mounted package with a big ground pane in the center. Beside this there are multiple components close to the chip that need to stay in place.

Removing the shielding

Begin by the shield covering the SOC, Memory and flash chips. This will come of very easily with little force. Take your time doing this.

Once removed we have an overview over the most important components

Removing the chip

To make the flash chip better accessible, the metal that held the shield in place can be bent back slightly. To help the desoldering the back of the PCB should be pre-heated at a low temp before starting work on the front. This will help with removing the chip and its big ground pane. Then start heating the flash chip itself at a low flow to not disturb the components around it. Make sure to heat it properly as forcing the chip off will break the pads on the PCB.

• HID over I2C

• Address: 0x28

• Bus speed: 400kHz

• HID_Descriptor: 0x0001

• ACPI Device: SNMU

32/64GB internal eMMC

GPIOs

Power: D7 Card Detect: I5 WriteProtect: T3

Power

uSD Card is powered by PMIC LowDropout regaultor 5 (LDO5) It switches between 3.3V and 1.8V.

Devices

     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00: 00 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- 28 -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 

Physical Access

Access to I2C Bus 0 can be found on J14.

i2c-0 i2c 7000c000.i2c I2C adapter - LVDS DDC (according to cardhu devicetree) - access on J14 i2c-1 i2c 7000c400.i2c I2C adapter - daughter board (touch controller; touch/typeCover) - access MAYBE on DaughterBoard Testpoints i2c-2 i2c 7000c500.i2c I2C adapter - nothing - dont care i2c-3 i2c 7000c700.i2c I2C adapter - HDMI DDC - Via HDMI-port i2c-4 i2c 7000d000.i2c I2C adapter - PMIC - not found :(

I2C addresses on Bus - 0: 0x00; 0x28 - 1: 0x2D; 0x39; 0x5B - 2: - 3: depends on HDMI display - 4: 0x0A; 0x1A; 0x2D; 0x4A; 0x4C; 0x60

HID knowledge

VendorID / ProdcutID

HID Descriptor

Device Specific Method

I2C Specs

• Normal I2C

• Address: 0x?

• Bus speed: 400kHz

• ACPI Device: ?

related to Surface Home Buttone Driver

Cypress touch sensor config?? MSP430??

Devices

     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- 2d -- -- 
30: -- -- -- -- -- -- -- -- -- 39 -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- 5b -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 

Physical Access

Access to I2C Bus 0 can be found on the back of the daughterboard. Use MTP52 & MTP53

I2C Specs

• HID over I2C

• Address: 0x00

• Bus speed: 400kHz

• HID_Descriptor: 0x0041

• ACPI Device: SNMU

• Power:

  • Bridge IC: PMIC.REG1: 1.8V

  • tCover Power: PMIC.REG3: 2.8V

GPIO

HID Interrupt: O5 Hotplug Interrupt: S0

Issue

The tCover I2C address is 0x00. This address is reserved for general call. Linux doesn't allow I2C Slaves to use this address therefore the I2C driver must be patched to allow 0x00 as valid Slave address.

Implementation

i2c-hotplug-gpio is a grate driver and doesn't work in mainline.

VendorID / ProductID

Physical Access

Access to I2C Bus 3 can be found on the micro-HDMI connector

I2C Specs

• Normal I2C

• Address: 0x2d

Bus speed

400 kHz

Devices

     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00: -- -- -- -- -- -- -- -- -- -- 0a -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- 1a -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- 2d -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- 4a -- 4c -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: 60 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 

Physical Access

Access to I2C Bus 4 is not known right now.

I2C Specs

• Normal I2C

• Address: 0x1A

The I2C address seems to be 0x34 but that's the 8 Bit address. Shift the address 1 to the right (>>1) and you get 0x1A as 7Bit address

Digital Stereo Microphone

Wolfson WM7220 Microphones

I2C Specs

• Normal I2c

• Address: 0x0A

What is it?

Surface RT uses the Topology. The controller is located at 0xa. That means that there must be an IC somewhere which interacts with the Charger and the Fuelgauge and provide an interface to both of them to the SoC. The and the are exposed through 0xa which provides an ACPI interface. The ACPI BAT0 device deals with the Fuelgauge. The ACPI ADP0 device deals with the Charger.

The ACPI methods like _BIX, _BTS, ... provide all the necessary information about the battery and the charger. They can be decrypted by reading the p. 492 10.2 Control Method Batteries

"(Control Method) Batteries and ACPI are tied together in quite a complex way. Generally, the battery state information is transmitted over a SMBUS bus to the embedded controller, a.k.a. EC, which in turn interfaces to the OS via ACPI methods. These methods can interrogate the embedded controller for battery state information ..."

Battery <-- EC <--> BIOS ACPI Methods <--> OS

Since there is no ACPI implementation for ARM32 and we need to replace the ACPI Methods with a custom driver. all Necessary information can be found in the SSDT0000 ACPI table

Embedded Controller

The Embedded Controller directly interacts with the Charger and the Fuelgauge.

Fuelgauge

BQ28400

Charger

BQ24725A

Critic

The Embedded Controller topology prevents the use of SmartBatterySystem (SBS) and requires an ACPI or custom driver. ACPI isn't (fully) implemented on ARM32 therefore we need a custom driver which resembels the ACPI methods.

Dump

I2C Specs

• Normal I2C

• Address: 0x60

I2C Specs

• SMBus SBS

• Address: 0x4C

The Slave address and the ManufacturerID register do match. + This sensor is also found on Cardhu.

I2C Dump

Tegra 3 only supports a parallel interface or SPI LCD, DVI, an HDMI HDTV, RGB monitor or a MIPI DSI LCD.

Surface RT uses a LVDS Display. Therefore an translator is needed.

They used a Integrated Device Technology V103 LVDS encoder https://datasheetspdf.com/pdf-file/696938/IntegratedDeviceTechnology/V103/1

The converter is transparent to the SoC and does its job without any configuration. It only needs power and the PowerDown pin set to LOW

GPIOs

B2 - power down

If we set this pin to LOW from UEFI Shell new information can't be send from the SoC to the display. In this case the image fades out.