Product Numbers: 1838, 1839
Tegra  2 tablet, possible kernel name (from schematics, not used as‑is): PHJ00
Board markings: LA‑746
PHJ00LA‑7561P
 Rev:1.0
 2011‑06‑03
schematics: compal_la‑7461p_r0.3_schematics.pdf 

Contents: [Dobrica Pavlinušić's random unstructured stuff]
• Dobrica Pavlinušić's random unstructured stuff (links) 
• Dobrica Pavlinušić's random unstructured stuff (dock connector) 
• Dobrica Pavlinušić's random unstructured stuff (adb) 
• Dobrica Pavlinušić's random unstructured stuff (APX mode) 
• Dobrica Pavlinušić's random unstructured stuff (nvflash) 
• Dobrica Pavlinušić's random unstructured stuff (partition table) 
• Dobrica Pavlinušić's random unstructured stuff (backup) 
• Dobrica Pavlinušić's random unstructured stuff (BCT ‑ Boot Configuration Table) 
• Dobrica Pavlinušić's random unstructured stuff (serial) 
• Dobrica Pavlinušić's random unstructured stuff (serial port) 
• Dobrica Pavlinušić's random unstructured stuff (u‑boot) 
• Dobrica Pavlinušić's random unstructured stuff (screen) 
• Dobrica Pavlinušić's random unstructured stuff (flash u‑boot to emmc) 
• Dobrica Pavlinušić's random unstructured stuff (wifi) 
• Dobrica Pavlinušić's random unstructured stuff (battery and EC) 
• Dobrica Pavlinušić's random unstructured stuff (embedded controller i2c) 
• Dobrica Pavlinušić's random unstructured stuff (turn charning on) 
• Dobrica Pavlinušić's random unstructured stuff (turn watchdog off) 
• Dobrica Pavlinušić's random unstructured stuff (shutdown, reboot) 
• Dobrica Pavlinušić's random unstructured stuff (kernel 2.6 drivers) 
• Dobrica Pavlinušić's random unstructured stuff (i2c) 
• Dobrica Pavlinušić's random unstructured stuff (mainline 4.19) 
• Dobrica Pavlinušić's random unstructured stuff (kernel 2.6 (android)) 
• Dobrica Pavlinušić's random unstructured stuff (addresses from schematics) 
• Dobrica Pavlinušić's random unstructured stuff (i2c devices support) 
• Dobrica Pavlinušić's random unstructured stuff (memory) 

links
• https://forum.xda‑developers.com/wiki/Lenovo_ThinkPad_Tablet 
• https://www.gsmarena.com/lenovo_thinkpad‑4444.php 
Review:
• https://www.notebookcheck.net/Review‑Lenovo‑ThinkPad‑Tablet‑18382DG‑Tablet‑MID.64965.0.html 
dock connector
https://web.archive.org/web/20150108184014/http://rootzwiki.com:80/topic/8523‑reverse‑engineering‑the‑dock‑charger/ 
Posted 31 October 2011 ‑ 03:09 AM #1
 I got my desktop charger today and unpacked it only to rip it aparts to check whats inside.
 By first view theese are the highlights:
The dock connector is 40 pins
 Dock connector is on a separate small pcb with a 40 pin board to board connector to a larger board.
 On this small pcb is a 12 pin MLF package marked:
 AAU
 NAD
Probably has a ground pad underneath.
The main pcb has a few more circuits and connectors on it.
 There is a micro usb, a full size master usb, audio out and microphone jacks. A bit more exiting there is room for a HDMI connector as well there with unpopulated spaces for line filters and a hdmi circuit. By first look it seems to be a displayport or MHL to HDMI bridge chip of some kind. I is TQFP‑48 package.
 edit:
 It seems to be a PI3VDP411LS from pericom
http://www.pericom.c...PI3VDP411LS.pdf 
It is a displayport levelshifter / bridge to HDMI. It is the only 48 pin package I have found to match the input with the differential pairs.
The power supply is 20 VDC 65 Watts. It does not seem like the center connector is connected. The connector is the standard "IBM" charger, outer case ground, inner case + 20 vdc, center pin power diag.
There is a fet transistor between the dock connector and the psu marked FA1K18 and it is controlled by some regulator marked 920A4 in a SOT‑223 package. The 20 VDC goes in on pin 2 and the tab on it.
the HDMI chip has differential pair inputs on pin 47,48 ‑ 44,45 ‑ 41,41 ‑ 38,39
I will do my best reversing the whole schematic for this unit and split it into parts so we can make other chargers and hopefully add HDMI to the dock.
Pinout Docking Connector Thinkpad Tablet

1	charge	2	gnd	
3	charge	4	hdmi pin 44 In D3‑	
5	Charger control (to pq2)	6	hdmi pin 45 In D3+	
7	hdmi VDD 3.3V	8	gnd	
9	gnd	10	hdmi pin 47 In D4‑	
11	USB Micro D‑	12	hdmi pin 48 In D4 +	
13	USB micro D+	14	gnd	
15	USB Master D‑	16	nc	
17	USB MAster D+	18	nc	
19	gnd	20	hdmi pin 29 SDA	
21	gnd	22	hdmi pin 28 SCL	
23	hdmi pin 41 IN D2‑	24	hdmi pin 7 HPD_Source	
25	hdmi pin 42 In D2+	26	gnd	
27	gnd	28	audio out L	
29	hdmi pin 38 IN D1‑	30	audio out R	
31	hdmi pin 39 IN D1+	32	headset inserted switch	
33	gnd	34	mic inserted switch feed	
35	USB micro +	36	mic inserted switch	
37	gnd	38	mic tip	
39	+ 5V to usb master	40	mic ring	

Pinout AAU chipAAU chip is audio amp.
 audio out
 pin 10 ring
 pin 11 tip
 pin 2, 7 gnd
Charger stuff :
 The supplied DC apater is 20Volt 3.25Amps
 In the dock there is a voltage regulator PV1. It is a 3.3 V LDO Tab has 20 volts in and pin 3 gives 3.30 Volts out.
 There is also a FET in SSO8 (?) package. It is controlled by 2 transistors and works only as a switch.
 On the base of PQ2 (pin 1, I guess it is the base) there is a float of 3.30 volts when there is nothing in the dock. The FET is OPEN and no voltage to the charger pins.
 When grounding PQ2 pin1 (dock pin 5) the FET CLOSES and the charger outputs 20,5volts which basically is the same as dc power into the dock.
Now I am just waiting for the TPT to get fully charged so I can measure if there is any difference when fully charged.
Note:
 By charging at 20 volts instead of 5 volts I understand why the charger only uses 2 pins into the TPT.
 At 20 volts you can transfer 4 times the energy instead of just charging at 5 volts from USB powers. There is no need for step ups to charge the LI‑Po battery as it would need more than 5 volts.
This is the schematics of the charger part:
www.r‑888.com/tpt/schema.pdf
I am not sure of the 2 transitors if they are pnp or npn yet but the rest is how it is.
 The original mosfet is a P‑channel AON7403.
 The regulator is just any 3,3 volt LDO.
The TPT charger control pin 5 gets a 3,3 volt float via the resistor to the left in the schematic. When it is connected the TPT grounds the pin and the FET lets current through.
Edited by ZebCrs, 05 November 2011 ‑ 12:56 PM.
adb
[Tue Oct  9 14:12:34 2018] usb 2-4: new high-speed USB device number 9 using xhci_hcd
[Tue Oct  9 14:12:34 2018] usb 2-4: New USB device found, idVendor=17ef, idProduct=7494, bcdDevice=99.99
[Tue Oct  9 14:12:34 2018] usb 2-4: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[Tue Oct  9 14:12:34 2018] usb 2-4: Product: ThinkPadTablet
[Tue Oct  9 14:12:34 2018] usb 2-4: Manufacturer: LENOVO
[Tue Oct  9 14:12:34 2018] usb 2-4: SerialNumber: MP1YCPF

dpavlin@klin:~$ adb devices
List of devices attached
MP1YCPF device

dpavlin@klin:~$ adb shell
shell@android:/ $ df
Filesystem             Size   Used   Free   Blksize
/dev                   357M    32K   357M   4096
/mnt/asec              357M     0K   357M   4096
/mnt/obb               357M     0K   357M   4096
/sqlite_stmt_journals     4M     0K     4M   4096
/system                755M   310M   445M   4096
/data                   56G     1G    54G   4096
/cache                 885M    81M   804M   4096
/mnt/pia               492M   233M   258M   4096
/mnt/persdata           19M     8M    11M   4096
/storage/sdcard0        56G     1G    54G   4096

shell@android:/ # uname -a
Linux localhost 2.6.39.4-g40c7636-dirty #1 SMP PREEMPT Thu Feb 7 20:07:37 CET 2013 armv7l GNU/Linux

1|shell@android:/ # cat /proc/cpuinfo                                          
Processor       : ARMv7 Processor rev 0 (v7l)
processor       : 0
BogoMIPS        : 996.14

processor       : 1
BogoMIPS        : 996.14

Features        : swp half thumb fastmult vfp edsp vfpv3 vfpv3d16 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x1
CPU part        : 0xc09
CPU revision    : 0

Hardware        : ventana
Revision        : 0000
Serial          : 0000000000000000

shell@android:/ # free
             total         used         free       shared      buffers
Mem:        731896       720924        10972            0        18392
-/+ buffers:             702532        29364
Swap:            0            0            0

shell@android:/ # cat /proc/partitions                                         
major minor  #blocks  name

 179        0   62520320 mmcblk0
 179        1       6144 mmcblk0p1
 179        2       8192 mmcblk0p2
 179        3     786432 mmcblk0p3
 179        4     921600 mmcblk0p4
 179        5       2048 mmcblk0p5
 179        6     524288 mmcblk0p6
 179        7      20480 mmcblk0p7
 259        0     143360 mmcblk0p8
 259        1      20480 mmcblk0p9
 259        2   60071936 mmcblk0p10

APX mode
• turn off tablet
• press rotation button and hold it
• press power button for 2 seconds
 [Tue Oct  9 14:30:41 2018] usb 2-4: new high-speed USB device number 16 using xhci_hcd
[Tue Oct  9 14:30:42 2018] usb 2-4: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Tue Oct  9 14:30:42 2018] usb 2-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Tue Oct  9 14:30:42 2018] usb 2-4: Product: APX
[Tue Oct  9 14:30:42 2018] usb 2-4: Manufacturer: NVIDIA Corp.

nvflash
https://forum.xda‑developers.com/showthread.php?t=1745450 
dpavlin@klin:/virtual/android/tegra/linux4tegra/nvflash$ LD_LIBRARY_PATH=. ./nvflash --bl ../prebuilt/fastboot.stock.bin --getpartitiontable /klin/Tegra/tpt1.nvflash.getpartitiontable
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 4
   chip sku: 0x8
   chip uid: 0x0a8051c743dfd457
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: emmc
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 0

downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: ../prebuilt/fastboot.stock.bin
| 936016/936016 bytes sent
../prebuilt/fastboot.stock.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
failed executing command 19 NvError 0x120000
command failure: get partition table failed

partition table
dpavlin@nuc:/nuc/Tegra/nvflash$ LD_LIBRARY_PATH=. ./nvflash --bl ../04.EBT.img --getpartitiontable partitiontable.txt --go
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 4
   chip sku: 0x8
   chip uid: 0x043c71c3433f8497
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: emmc
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 2

downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: ../04.EBT.img
/ 6291456/6291456 bytes sent
../04.EBT.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
Succesfully updated partition table information to partitiontable.txt

backup
dpavlin@nuc:/nuc/Tegra/nvflash$ grep PartitionId partitiontable.txt  | cut -d= -f2 | tr -d '\r' | xargs -i ./nvflash -r --read {} {}

# even better version which removes biggest partition (15)

dpavlin@klin:/klin/Tegra/nvflash$ grep PartitionId partitiontable.txt  | cut -d= -f2 | tr -d '\r' | grep -v 15 | xargs -i ../nvflash/nvflash -r --read {} {}

BCT ‑ Boot Configuration Table
https://http.download.nvidia.com/tegra‑public‑appnotes/bct‑overview.html 
compiler: https://github.com/NVIDIA/cbootimage 
dpavlin@klin:/klin/Tegra/tegrarcm$ ./src/tegrarcm readbct --bct tpt.bct

[Wed Oct 10 14:31:05 2018] usb 3-1.1: new high-speed USB device number 23 using ehci-pci
[Wed Oct 10 14:31:05 2018] usb 3-1.1: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Wed Oct 10 14:31:05 2018] usb 3-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Wed Oct 10 14:31:05 2018] usb 3-1.1: Product: APX
[Wed Oct 10 14:31:05 2018] usb 3-1.1: Manufacturer: NVIDIA Corp.

bct file: tpt.bct
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
reading BCT from system, writing to tpt.bct...done!

serial
From android:
shell@android:/ # cat /proc/cmdline                                            
tegraid=20.1.4.0.0 mem=1022M@0M android.commchip=2685344 vmalloc=256M androidboot.serialno=0a805185415fc1d7 video=tegrafb no_console_suspend=1 console=none debug_uartport=lsport,-3 usbcore.old_scheme_first=1 lp0_vec=8192@0x1d826000 tegra_fbmem=8197120@0x1d82a000 tegraboot=sdmmc charging=0 isBatteryFail=0 gpt gpt_sector=125040639 

shell@android:/ # lsof | grep tty                                              
rild        103      radio   13       ???                ???       ???        ??? /dev/ttyACM1
brcm_patc   330  bluetooth    3       ???                ???       ???        ??? /dev/ttyHS2
sh         1789      shell   24       ???                ???       ???        ??? /dev/tty
sh         1795       root   24       ???                ???       ???        ??? /dev/tty

shell@android:/ # dmesg | grep tty                                             
<6>[    6.290150] serial8250.0: ttyS0 at MMIO 0x70006300 (irq = 122) is a Tegra
<6>[    6.290475] tegra_uart.1: ttyHS1 at I/O 0x0 (irq = 69) is a unknown
<6>[    6.290727] Registered UART port ttyHS1
<6>[    6.290873] tegra_uart.2: ttyHS2 at I/O 0x0 (irq = 78) is a unknown
<6>[    6.291115] Registered UART port ttyHS2
<6>[    7.056012] cdc_acm 1-1:1.1: ttyACM0: USB ACM device
<6>[    7.067323] cdc_acm 1-1:1.3: ttyACM1: USB ACM device
<6>[    7.137758] cdc_acm 1-1:1.9: ttyACM2: USB ACM device
<4>[   15.154176] ttyACM1: Entering acm_tty_open.

serial port
Schematic has 4 pin debug connector with serial on it.
There are three 4‑pin connectors on this side of board, and from pictures other side doesn't seem to have connectors.
Skip JLTE1 and JLTE2 connector (under ribbon to front‑facing camera), they are wrong connectors, and pop rf shield off Tegra
 compartment and locate JP4:

solder pin 1 and 2 and ground

JP4 pinout from schematics:
• 1 ‑ UART4_RXD
• 2 ‑ UART4_TXD
• 3
• 4 ‑ GND
Pins 1 and 2 are 1.8V when device is turned on. so far, so good.
u‑boot
dpavlin@klin:/klin/Tegra/u-boot-tegra$ export CROSS_COMPILE="arm-none-eabi-" ARCH=arm
dpavlin@klin:/klin/Tegra/u-boot-tegra$ make ventana_defconfig

press left‑most button and power (top‑right of tablet)
[Sun Oct 21 16:29:05 2018] usb 1-3.4.1: pl2303 converter now attached to ttyUSB3
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: new high-speed USB device number 105 using xhci_hcd
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: Product: APX
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: Manufacturer: NVIDIA Corp.

# backup bct

dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ ../tegrarcm/src/tegrarcm --bct broken.bct readbct
bct file: broken.bct
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
reading BCT from system, writing to broken.bct...done!

# try u-boot

dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ ../tegrarcm/src/tegrarcm --bct broken.bct --bootloader /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin --loadaddr 0x108000

bct file: broken.bct
bootloader file: /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin
load addr 0x108000
entry addr 0x108000
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
Chip UID:                0x00000000000000000a805185415fc1d7
Chip ID:                 0x20
Chip ID Major Version:   0x1
Chip ID Minor Version:   0x4
Chip SKU:                0x8 (t20)
Boot ROM Version:        0x1
Boot Device:             0x2 (EMMC)
Operating Mode:          0x3 (developer mode)
Device Config Strap:     0x0
Device Config Fuse:      0x0
SDRAM Config Strap:      0x1
sending file: broken.bct
- 4080/4080 bytes sent
broken.bct sent successfully
sending file: /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin
/ 496836/496836 bytes sent
/mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin sent successfully
dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ 
[Sun Oct 21 16:39:58 2018] usb 1-3.4.4: USB disconnect, device number 108

Complete nfsroot with u‑boot is documented in u‑boot  page.
screen
LG LP101WX1 ‑ datasheet ‑ https://datasheetspdf.com/pdf‑file/788219/LG/LP101WX1‑SLN2/1 
and screen seems to work with changes ported from 2.6!
                                display-timings {
                                        timing@0 {
                                                /* XXX tegra_dc_mode ventana_panel_modes */
                                                clock-frequency = <72072000>;
                                                hactive = <1280>;
                                                vactive = <800>;
                                                hback-porch = <72>;
                                                hfront-porch = <48>;
                                                hsync-len = <32>;
                                                vback-porch = <22>;
                                                vfront-porch = <3>;
                                                vsync-len = <7>;
                                                hsync-active = <1>;
                                        };
                                };

flash u‑boot to emmc
based on https://github.com/Stuw/ac100‑self‑installers/blob/master/switch‑to‑uboot/install_bootloader.sh 
root@tegra20:/home/dpavlin# dd if=/dev/mmcblk2boot0 of=mmcblk2boot0 bs=4080 count=1

root@tegra20:/home/dpavlin# echo 0 > /sys/block/mmcblk2boot0/force_ro 
root@tegra20:/home/dpavlin# echo 0 > /sys/block/mmcblk2boot1/force_ro 

root@tegra20:/home/dpavlin# bct_dump mmcblk2boot0 > bct.cfg

root@tegra20:/home/dpavlin# scp dpavlin@klin:/klin/Tegra/u-boot-tegra/u-boot-tegra.bin .

Rest of procedure is based on my changes for phj00: https://github.com/dpavlin/cbootimage‑configs/tree/phj00 
root@tegra20:/home/dpavlin/cbootimage-configs/tegra20/nvidia/phj00# make
cbootimage -t20 phj00-emmc.img.cfg phj00-emmc.img
Image file phj00-emmc.img has been successfully generated!

root@tegra20:/home/dpavlin/cbootimage-configs/tegra20/nvidia/phj00# dd if=phj00-emmc.img of=/dev/mmcblk2boot0

modify u‑boot boot.cmd to boot from mmc
root@tegra20:/boot# cat boot.cmd

setenv bootargs root=/dev/mmcblk2p1 panic=60
ext2load mmc 0 ${kernel_addr_r} /boot/zImage
ext2load mmc 0 ${fdt_addr_r} /boot/tegra20-ventana.dtb
ext2load mmc 0 ${ramdisk_addr_r} /boot/uInitrd

bootz ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r}

# mkimage -C none -A arm -T script -d boot.cmd boot.scr

Victory: booting from mmc
wifi
dpavlin@tegra20:~$ dmesg | grep brcm
[   13.971076] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4329-sdio for chip BCM4329/3

apt-get install firmware-brcm80211

# it seems to need some non-free parts

root@tegra20:/home/dpavlin# cd /lib/firmware/brcm/
wget https://raw.githubusercontent.com/armbian/firmware/master/brcm/brcmfmac4329-sdio.txt

And to make it work on 5.0 kernel you also need specific symlink for device:
root@tegra20:/lib/firmware# dmesg | grep firmware
[    5.748888] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2
[   14.614802] brcmfmac mmc0:0001:1: Direct firmware load for brcm/brcmfmac4329-sdio.nvidia,ventana.txt failed with error -2
[  447.338018] brcmfmac mmc0:0001:1: Direct firmware load for brcm/brcmfmac4329-sdio.nvidia,ventana.txt failed with error -2

root@tegra20:/lib/firmware/brcm# ln -sf brcmfmac4329-sdio.txt brcmfmac4329-sdio.nvidia,ventana.txt

battery and EC
without any config with ventana dts battery isn't charging which is annoying for development because you need to charge tablet often.
• The Power‑Supply Subsystem ‑ Sebastian Reichel, Collabora https://youtu.be/MdgmyOHldZg 
according to schematics charger is: ISL9519HRTZ‑T_TQFN28_4X4
https://www.intersil.com/content/dam/intersil/documents/isl9/isl9519.pdf  (too short, not useful)
There seems to be patch to add isl9519q to kernel back from 2011: https://lkml.org/lkml/2011/8/29/312 
 which judging from one datasheet that google can find ISL9519C‑Intersil.pdf  is roughly correct.
However, it's connected to KB930QF‑A1_LQFP128_14X14 which seems to be bios controller chip based
 on 8051 core with custom firmware and 2.6 driver is https://github.com/dpavlin/linux/blob/thinktabletopensource‑2.6.36/drivers/power/EC_battery.c 
embedded controller i2c
turn charning on
After connecting usb, issue following command to start charging battery:
i2cset -y 5 0x58 0x5b 0x0001 w

turn watchdog off
root@tegra20:~# cat /home/dpavlin/ec-disable-watchdog.sh 
#!/bin/sh

# i2c_smbus_write_word_data(EC_Bat_device->client,0x46,0

i2cset -y 5 0x58 0x46 0x0000 w

root@tegra20:~# cat /etc/systemd/system/phj00-disable-watchdog.service 
[Unit]
Description=phj00 watchdog disable
After=local-fs.target

[Service]
User=root
Type=oneshot
ExecStart=/home/dpavlin/ec-disable-watchdog.sh

[Install]
WantedBy=multi-user.target
root@tegra20:~# systemctl enable phj00-disable-watchdog.service 
root@tegra20:~# systemctl start phj00-disable-watchdog.service

shutdown, reboot
root@tegra20:~# cat /lib/systemd/system-shutdown/phj00-shutdown.sh 
#!/bin/sh

echo "DEBUG $0 -- $*"

case "$1" in
        halt|poweroff)
                # shutdown
                i2cset -y 5 0x58 0x52 0x0000 w
                ;;
        reboot)
                # restart
                i2cset -y 5 0x58 0x55 0x0001 w
                ;;
        *)
                echo "WARNING: $1 ignored"
                ;;
esac

kernel 2.6 drivers
custom drivers: https://github.com/dpavlin/linux/tree/thinktabletopensource‑2.6.36/drivers/phj00 
i2c
mainline 4.19
root@tegra20:~# i2cdetect -l     
i2c-3   i2c             7000d000.i2c                            I2C adapter
i2c-1   i2c             7000c400.i2c                            I2C adapter
i2c-4   i2c             i2c-1-mux (chan_id 0)                   I2C adapter
i2c-2   i2c             7000c500.i2c                            I2C adapter
i2c-0   i2c             7000c000.i2c                            I2C adapter
i2c-5   i2c             i2c-1-mux (chan_id 1)                   I2C adapter

root@tegra20:~# i2cdetect -y -r 0
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- UU -- 1c -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 1 # very slow
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 2
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 3
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- 0c -- -- 0f 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- UU -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- UU -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 4
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 5
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# grep . /sys/bus/i2c/devices/*/name
/sys/bus/i2c/devices/0-001a/name:wm8903
/sys/bus/i2c/devices/0-0044/name:isl29018
/sys/bus/i2c/devices/3-0034/name:tps6586x
/sys/bus/i2c/devices/3-004c/name:nct1008
/sys/bus/i2c/devices/i2c-0/name:7000c000.i2c
/sys/bus/i2c/devices/i2c-1/name:7000c400.i2c
/sys/bus/i2c/devices/i2c-2/name:7000c500.i2c
/sys/bus/i2c/devices/i2c-3/name:7000d000.i2c
/sys/bus/i2c/devices/i2c-4/name:i2c-1-mux (chan_id 0)
/sys/bus/i2c/devices/i2c-5/name:i2c-1-mux (chan_id 1)

kernel 2.6 (android)
shell@android:/ # grep . /sys/bus/i2c/devices/*/name                           
/sys/bus/i2c/devices/0-001a/name:wm8903
/sys/bus/i2c/devices/0-001c/name:al3000a_ls
/sys/bus/i2c/devices/1-003a/name:nvhdcp1
/sys/bus/i2c/devices/1-0050/name:tegra_edid
/sys/bus/i2c/devices/2-0050/name:phj00_lcd
/sys/bus/i2c/devices/2-0058/name:EC_Battery
/sys/bus/i2c/devices/3-003c/name:mt9p111
/sys/bus/i2c/devices/3-003d/name:mt9d115
/sys/bus/i2c/devices/4-000c/name:akm8975
/sys/bus/i2c/devices/4-000f/name:kxtf9
/sys/bus/i2c/devices/4-0034/name:tps6586x
/sys/bus/i2c/devices/4-004c/name:nct1008
/sys/bus/i2c/devices/i2c-0/name:Tegra I2C adapter
/sys/bus/i2c/devices/i2c-1/name:Tegra I2C adapter
/sys/bus/i2c/devices/i2c-2/name:Tegra I2C adapter
/sys/bus/i2c/devices/i2c-3/name:Tegra I2C adapter
/sys/bus/i2c/devices/i2c-4/name:Tegra I2C adapter

shell@android:/sys/kernel/debug # grep . clock/i2c*/rate                       
clock/i2c1/rate:3000000
clock/i2c2/rate:800000
clock/i2c3/rate:3000000

addresses from schematics

PWR_I2C address	
PMU	0b0110_100	0x34	
E‑Compass	0b0000_110	0x06	
Temperature sensor	0b0100_110	0x26	
GEN1_I2C	
Audio Codec	0b0011_010	0x1a	
Light sensor	0b0001_110	0x0e	
EC_SMB	
BATT	0b0001_001	0x09	
IME_I2C	
G‑sensor	0b0001_1111	0x1f	

does g‑sensor have typo? 0b0001_111 is 0x0f and we see such device
i2c  devices support
• al3000a  i2c light sensor
• phj00  include EC communication
memory
LPDDR: MT46H64M32L2JG‑5IT‑A_FBGA168
MT46H64M32L2CG‑5 IT:A
 2 x 1Gb DDR, x32, 200 MHz
64M32 ‑ 64 Meg x 32 (8 Meg x 32 x 4 banks x 2)
Cycle Time: ‑5 = 5ns tCK CL = 3