After doing some fiddling around myself, I've put together a few tools
and I think I now have the beginnings of an understanding of the report
frame structure. I've attached some notes below. The data packets
appear to be 6 bytes long, consistent with earlier versions of the
protocol.  The first and fifth bytes of the touchpad packet are still
quite mysterious. While they likely have something to do with
multitouch, they both fluctuate even with single touch events. Touchpad
packets can be distinguished from stick packets by examining the byte 5,
which is 0x3f (out of the range of the pressure field) in touchstick
packets.

I've also attached two tools I've developed. ps2-parse.py annotates PS/2
traces produced by the VM with common command names (simply pipe a trace
in to stdin, out comes the annotate trace on stdout). Alps.py is a first
attempt at communicating with the hardware. It currently has the ability
to put playback a trace (say, the attached serio-init.log) and start
dumping frames to stdout. It also has an incomplete version of the
initialization sequence (enter_absolute_mode).

Hopefully I'll find some more time in the next few days to figure out
the last few bits (primarily how multitouch events work). I wouldn't be
sad if someone finished the task for me, however.

Cheers,

- Ben



Touchpad Packet format:
  byte 0: ??? starts with 0x9f, 0x8f, changes
          0x10:  ??
          0x20:  ??
          0x8f:  Always set
          Only 0x10 and 0x20 are set with single-touch events. 0x40 seems to be set with multitouch events
          
  byte 1: X position? (- is left, + is right)
  byte 2: Y position? (- is up, + is down)
  byte 3: button state:
                0x1:  left touchpad
                0x2:  right touchpad
                0x4:  middle touchpad?
                0x8:  Always set?
                0x10: left touchstick
                0x20: right touchstick
                0x40: middle touchstick
                0x80: ???
  byte 4: ???
  byte 5: Pressure (0x00 - 0x3e)
                0x3f: Reporting stick?


Touchstick Packet format:
  byte 0: 0x10:  Y Sign
          0x20:  X Sign
          0x4f:  Always set
  byte 1: X pressure (0 - 0x7f)
  byte 2: Y pressure (0 - 0x7f)
  byte 3: always 0x48
  byte 4: Z pressure (0 - 0x7c)
  byte 5: always 0x3f