# Keyboard base read-only probe (tasks 1.2, 1.3)

Evidence class: **board-read**. Commands ran on the second T-Display K230
board, clipped into the LILYGO keyboard base, over the serial console while
the host held `flock /tmp/k230-board.lock`.

## Setup

- Image: `.#sdImage-landscape` built from `master` at `dc2c4dae`, flashed
  over U-Boot `ums` with `tools/ums-session.py --flash` on 2026-10-13.
- Device tree: that image's `mainlineDrmHotplugDeviceTreeNormalName`, rebuilt
  from `impl/keyboard-base` with the I2C4 node and pinctrl states in
  `nix/dts/k230-tdisplay-mainline-drm-common.dtsi`, plus the nRF9151 states
  from `impl/nrf9151`. The image's `/chosen/bootargs` was copied into it with
  `fdtput`, and it was installed with
  `tools/push-file.py --src <dtb> --dest /boot/k230-tdisplay.dtb --reboot`.
- Kernel `7.3.0-rc5`.
- Probe: `tools/keyboard-base-probe.sh`, pushed to `/root` with
  `tools/push-file.py`, run as `bash /root/keyboard-base-probe.sh`.

## Runs

| File | Time (UTC) | Notes |
| --- | --- | --- |
| `probe-2026-10-13T193433Z.log` | 19:34:33 | First version; did not sample IO42/IO43 levels. |
| `probe-2026-10-13T193545Z.log` | 19:35:45 | Current script; samples IO42, IO43 and IO52, which were already inputs. |

Between the runs only the GPIO section and the gauge temperature (0x06 and
0x28, 0x0c0b to 0x0c09) differ.

## Results

Answering addresses on hardware I2C4 (IO46 SCL, IO47 SDA, function 3,
100 kHz, `i2c-1`):

| Address | Chip |
| --- | --- |
| 0x20 | XL9555 expander |
| 0x34 | TCA8418 keypad |
| 0x38 | Not read. LILYGO reads an AHT20 at this address on these pads (`sensor_aht20_iomux_value`) |
| 0x55 | BQ27220 gauge |
| 0x6B | BQ25896 charger |

- **DRV2605 haptics (0x5A): not fitted.** No acknowledgement.
- **IO43 (keypad reset, `gpiochip1` 11): input, level 1**, so the keypad is
  out of reset. IO42 (keypad IRQ, `gpiochip1` 10): input, level 1, inactive.
  IO52 (key backlight, `gpiochip1` 20): input, level 0.

The charger (BQ25896) fields are decoded per the TI datasheet register map:

| Register | Value | Meaning |
| --- | --- | --- |
| REG04 | 0x0b | ICHG 11 × 64 mA = **704 mA** charge current |
| REG05 | 0x13 | IPRECHG 64 + 1 × 64 = **128 mA**; ITERM 64 + 3 × 64 = **256 mA** termination |
| REG06 | 0x72 | VREG 3840 + 28 × 16 = **4288 mV**; BATLOWV 3.0 V; VRECHG 100 mV |
| REG07 | 0x8d | Termination enabled, **watchdog disabled**, safety timer on (12 h) |
| REG0B | 0x5e | CHRG_STAT 11, charge termination done; power good |
| REG0E | 0x63 | BATV 2304 + 99 × 20 = 4284 mV |
| REG11 | 0x97 | VBUS good, VBUSV 2600 + 23 × 100 = 4900 mV |

USB-C was connected to the base.

The gauge (BQ27220) reads, from standard commands:

| Quantity | Value |
| --- | --- |
| Voltage | 4202 mV |
| Current | 0 mA |
| Temperature | 308.3 K (35.2 °C) |
| Remaining capacity | 3000 mAh |
| Full-charge capacity | 3000 mAh |
| State of charge | 100 % |
| State of health | 100 % |
| Cycle count | 0 |
| **Design capacity** | **3000 mAh** |

The keypad and expander read:

- TCA8418 CFG 0x29: key-event interrupt, overflow interrupt and overflow mode
  set.
- XL9555 configuration 0xc7/0xff: port 0 bits 3-5 are outputs. All output
  latches are 1.

## Limits

- **Some register state may be left over from LILYGO's firmware.** The base
  has its own battery and was not power-cycled after LILYGO's firmware last
  ran on this K230 on 2026-10-13. The TCA8418 CFG and XL9555 configuration
  differ from their reset value of 0x00, which suggests prior configuration
  (an inference, not observed). The charger values may also be LILYGO's
  settings rather than power-on defaults.
- **The design capacity may not describe the cell.** 3000 mAh equals the
  BQ27220's factory default, so the gauge may never have been configured for
  this cell. Treat it as unverified until the cell's rating is known.
- **Earlier all-NACK runs were caused by the film.** Earlier attempts on this
  unit, on both the hardware controller and a GPIO bit-bang, saw every
  address NACK. A protective plastic film was still over the base's pogo
  pins; the operator removed it before LILYGO's own firmware detected the base
  (`Detected 6B:yes 55:yes 34:yes 20:yes on I2C4 SDA47/SCL46`). Those runs
  are not evidence about either bus.
- **Not covered here.** This probe does not show that the panel and touch
  still work with the new tree; that is task 2.2.