[bero]

Figured it out by looking at lsof output -- /dev/ttyDB0 seems to give direct access to the keyboard controller. However, access has to be rather fast or the tinyhttp process in the background starts eating it all up.

The controller's messages are sent in groups of 5 bytes. The first byte seems to be a message type indicator, A key press event has 0xb1 KEYCODE 0x2b in the first 3 bytes, 0xb1 KEYCODE 0x2d in the first 3 bytes is a key release event (in both cases, the 3rd byte is the key code.
The 4th byte doesn't seem to have a meaning (at least for keyboard events), the 5th is a checksum (first xor last == 0xff)

Any message needs to be ACK-ed or NAK-ed (or the commands are bounced back to tinyhttp once the application exits). The ACK code seems to be 0xa2 0x00 0x00 x00 0x5d, NAK seems to be 0xa3 0x00 0x00 0x00 0x5c.