Browsed by
Category: HP Touchpad

HP Touchpad tablet information, hackery and repurposing.

USB Host on HP Touchpad: Progress…

USB Host on HP Touchpad: Progress…

To access USB Host mode on the Touchpad (to plug in a Keyboard/USB Drive/etc), you need:

  1. A microUSB to USB Female cable (USB-OTG cable), available on ebay for ~$3, shipped [search ‘USB-OTG cable’]
  2. A powered USB Hub (a USB Hub with a spot to plug in an external power supply), available on ebay for under $10, shipped, with power supply  [Search ‘powered usb hub’]

All you need to do is plug the USB Hub into the OTG adapter, and the OTG Adapter into the Touchpad. Power it with a wall adapter, and you’ll have USB devices showing up in dmesg in no time!

For example:

[16075.755719] usb 1-1.1: new high speed USB device using msm_hsusb_host and address 3
[16075.775744] get_port_status port=1,portstatus=1503, portchange=10
[16075.868006] usb 1-1.1: New USB device found, idVendor=13fe, idProduct=3323
[16075.868111] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16075.883769] usb 1-1.1: Product: STORE N GO
[16075.883821] usb 1-1.1: Manufacturer: Verbatim
[16075.894000] usb 1-1.1: SerialNumber: 070007A315074099E8C5
[16075.922270] scsi1 : usb-storage 1-1.1:1.0
[16075.944010] get_port_status port=1,portstatus=1503, portchange=0
[16076.953338] scsi 1:0:0:0: Direct-Access     Verbatim STORE N GO       5.00 PQ: 0 ANSI: 0 CCS
[16076.993863] sd 1:0:0:0: Attached scsi generic sg0 type 0
[16077.204050] sd 1:0:0:0: [sda] 7802880 512-byte logical blocks: (3.99 GB/3.72 GiB)
[16077.204665] sd 1:0:0:0: [sda] Write Protect is off
[16077.216317] sd 1:0:0:0: [sda] Mode Sense: 23 00 00 00
[16077.216329] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.219671] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.227274]  sda: sda1
[16077.237134] sd 1:0:0:0: [sda] Assuming drive cache: write through
[16077.237234] sd 1:0:0:0: [sda] Attached SCSI removable disk

To be fair, there is most likely a way to enable the Touchpad to power USB OTG devices itself, which would remove the need for the powered hub.

See also: and, which suggest using a USB Y-cable to inject power, and from which I blatantly stole the idea of using a powered USB hub 😉

So far I have tried a USB thumbdrive and a wireless mouse dongle; the thumbdrive was detected flawlessly, while the mouse’s dongle was not.

HP Touchpad Hardware [Preliminary]

HP Touchpad Hardware [Preliminary]

Although this is an article on hardware, I’m going to be using software to probe it. This is from a 32GB HP Touchpad, though the 16GB should be the same, barring the difference in storage.


Processor       : ARMv7 Processor rev 2 (v7l)
processor       : 0
BogoMIPS        : 13.52

Features        : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0x02d
CPU revision    : 2

Hardware        : TENDERLOIN
Revision        : 0000
Serial          : 0000000000000000

The touchpad runs on a Qualcomm Snapdragon dual-core CPU, so I would take this output with a grain of salt: It’s only showing one core, and my touchpad is in powersave mode, so the bogomips, as usual, is way off.

Now for the more interesting stuff, like i2c devices.

cat /sys/bus/i2c/devices/*/name: (with annotations)

mt9m113– Aptina Webcam SoC

  • /sys/devices/i2c-1/1-0078

a6_0 – Battery monitor – Battery?

  • /sys/devices/i2c-3/3-0031
  • This one seems to have information on voltage, charge percentage, etc.
  • Seems to be the battery monitor
  • Here are the values/categories for the Veer (for comparison and info)
  • A6 Version: HW: 255, FW (M.m.B): 2.13.25, ManID: 28769, ProdTyp: 1281

a6_1 – Battery monitor – Charger?

  • /sys/devices/i2c-3/3-0032
  • This one has info in acc_data_*, but not voltage
  • Seems to be the battery charging circuit
  • A6 Version: HW: 255, FW (M.m.B): 2.7.23, ManID: 28769, ProdTyp: 1793

LM8502– National Semiconductor “Smart Lighting” IC

  • /sys/devices/i2c-3/3-0033
  • Fun: The LM8502 driver brings out the vibrator, LEDs (home button LEDs?), flash (for camera? I dont’ think the TP has one),

wm8958– Wolfson Microelectronics Audio Hub w/ 3 Digital Audio interfaces & DSP

  • /sys/devices/i2c-4/4-001a
  • Fun: Driver brings out some GPIO pins

maXTouch– Atmel’s family of “Unlimited-Touch” Touchscreen controllers

pm8058-core – Qualcomm Power Management IC

  • /sys/devices/i2c-6/6-0055
  • The datasheet for this one is kept under wraps?
  • From what the driver brings out, we can see that it controls power to the charger, GPIO, MPP (Multi-Purpose Pins), PWM, Power button, RTC, TM (IC Temperature Monitor), UPL(?), and the vibrator

pm8901-core – Qualcomm Power Management IC (No datasheet?)

  • /sys/devices/i2c-7/7-0055
  • The datasheet for this one is kept under wraps?
  • The driver brings out MPP (Multi-Purpose Pins), regulators, and a Temperature Monitor.
  • (Maybe this one is used for large loads, whereas the pm8058 is for smaller loads?)

QUP I2C adapter – (Six) – Qualcomm Universal Peripheral [cite]

  • /sys/devices/i2c-0 all the way through i2c-5

MSM SSBI adapter – (Three) – Qualcomm MSM-series “Single-Wire Serial Bus Interface” [cite]

  • /sys/devices/i2c-6 through i2c-8

cat /etc/fstab:

  • # <filesystem>  <mount point>   <type>  <options>       <dump>  <pass>
  • rootfs  /       ext3    ro,suid,dev,exec,auto,nouser,async,noatime      1       1
  • /dev/mapper/store-var   /var    ext3    noatime,data=writeback  0       0
  • /dev/mapper/store-cryptodb      /var/db ext3    noauto,noatime,data=ordered     0       0
  • /dev/mapper/store-cryptofilecache       /var/file-cache ext3    noauto,noatime,user_xattr       0       0
  • /dev/mapper/store-log   /var/log        ext3    noatime 0       0
  • /dev/mapper/store-update        /var/lib/update ext3    noauto,noatime  0       0
  • proc    /proc   proc    defaults        0       0
  • devpts  /dev/pts        devpts  mode=0620,gid=5 0       0
  • tmpfs   /tmp    tmpfs   size=40M,mode=1777      0       0
  • tmpfs   /var/run        tmpfs   size=16M,mode=1777      0       0
  • tmpfs   /var/tmp        tmpfs   size=32M,mode=1777      0       0
  • tmpfs   /media/ram      tmpfs   defaults        0       0
  • /dev/mapper/store-media /media/internal vfat    utf8,shortname=mixed,umask=0000 0       0

/dev/input/event0 is the home button and volume button device
/dev/input/event1 is the power button device
/dev/bt_uart is the Bluetooth serial stream

/proc/tty/drivers: (showing some promising signs of USB-Host ability)

/dev/tty             /dev/tty        5       0 system:/dev/tty
/dev/console         /dev/console    5       1 system:console
/dev/ptmx            /dev/ptmx       5       2 system
/dev/vc/0            /dev/vc/0       4       0 system:vtmaster
usbserial            /dev/ttyUSB   188 0-253 serial
acm                  /dev/ttyACM   166 0-31 serial
msm_serial_hsl       /dev/ttyS     243 0-3 serial
pty_slave            /dev/pts      136 0-1048575 pty:slave
pty_master           /dev/ptm      128 0-1048575 pty:master
pty_slave            /dev/ttyp       3 0-255 pty:slave
pty_master           /dev/pty        2 0-255 pty:master
smd_tty_driver       /dev/smd      253 0-36 serial
unknown              /dev/tty        4 1-63 console

More to come.