With the release of the mid-2013 MacBook models, Apple stopped using the standard USB video device class interface for the laptops’ webcams. On these laptops, the webcam connects via the PCIe bus, enumerating as a Broadcom 1570 device. Unfortunately, this interface is completely undocumented, and there is no Linux driver, although an effort is being made to reverse engineer one. Since I thought understanding the device hardware might aid this driver development effort, I bought a replacement webcam to disassemble. The front of the camera, from left to right, contains a 12-pin connector; power management circuitry, consisting of some sort of crystal or resonator, a Texas Instruments TPS657091 power management IC, and assorted passives; an ambient light sensor (with decoupling capacitor); the image sensor and fixed-focus optics; and an LED. The back of the device contains identification markings, which include a DataMatrix barcode and text, both of which read CC2 3222 2UYE F9T9CF
on my particular camera.
Prying the plastic piece holding the optics and ambient light sensor off of the PCB below it exposes the image sensor, LED, and a few more passives. What it doesn’t reveal is the Broadcom device that is on the PCIe bus (more on that later).
The OS X and Windows drivers for the camera make a reference to the OV5650 image sensor, but a quick visual comparison shows that this isn’t the sensor used. I was unfortunately unable to identify the sensor by looking at photos online and do not have access to a microscope capable of inspecting die markings. The driver also references the AD5816 focus controller, but this is unsurprisingly not present due to the fixed-focus optics.
Although the image sensor likely contains the readout circuitry needed to digitize the captured image, it doesn’t contain a PCIe bus interface (and Broadcom doesn’t make image sensors). Therefore, I turned to looking at MacBook teardowns to find the missing interface. The camera board connects directly to the main logic board, which just so happens to contain a Broadcom BCM15700A2 chip that no one seems to know the purpose of. As the part number contains the camera controller’s PCIe bus ID, it is very likely the chip in question, particularly since there are no other mysterious Broadcom chips on the logic board. In retrospect, it makes sense for this chip to be on the logic board and not by the camera, since PCIe signals are not normally carried over cables. A photo of the bottom of the chip on eBay shows that it is an 8 mm x 8 mm, 208-ball BGA, but I can’t find any other information about it. The chip is much too big to fit next to the camera, and its size suggests it probably doesn’t just serve as a PCIe interface and likely does some image processing as well. Although none of the information I discovered will likely be very helpful for writing a driver, locating and associating a part number with the PCIe interface chip was at least illuminating.
Have you still got this hardware? any chance you could post further info on what controls the LED? I’m largely interested from the perspective of whether or not it could be controlled independently from the camera by malware.
I no longer have the hardware. Sorry. I tried to visually follow the LED traces when I took this apart to see if it was hardwired to the power, but I was unsuccessful. If I removed all the components with a hot air pencil I would have been able to do continuity testing to figure it out, but I didn’t care enough at the time to put in the effort.