Product Numbers: 1838, 1839

Tegra 2 tablet, possible kernel name (from schematics, not used as-is): PHJ00

Board markings: LA-746

PHJ00LA-7561P
Rev:1.0
2011-06-03

schematics: compal_la-7461p_r0.3_schematics.pdf

links

• https://forum.xda-developers.com/wiki/Lenovo_ThinkPad_Tablet
• https://www.gsmarena.com/lenovo_thinkpad-4444.php

Review:

• https://www.notebookcheck.net/Review-Lenovo-ThinkPad-Tablet-18382DG-Tablet-MID.64965.0.html

dock connector

https://web.archive.org/web/20150108184014/http://rootzwiki.com:80/topic/8523-reverse-engineering-the-dock-charger/

Posted 31 October 2011 - 03:09 AM #1
I got my desktop charger today and unpacked it only to rip it aparts to check whats inside.
By first view theese are the highlights:

The dock connector is 40 pins
Dock connector is on a separate small pcb with a 40 pin board to board connector to a larger board.
On this small pcb is a 12 pin MLF package marked:
AAU
NAD

Probably has a ground pad underneath.

The main pcb has a few more circuits and connectors on it.
There is a micro usb, a full size master usb, audio out and microphone jacks. A bit more exiting there is room for a HDMI connector as well there with unpopulated spaces for line filters and a hdmi circuit. By first look it seems to be a displayport or MHL to HDMI bridge chip of some kind. I is TQFP-48 package.
edit:
It seems to be a PI3VDP411LS from pericom
http://www.pericom.c...PI3VDP411LS.pdf

It is a displayport levelshifter / bridge to HDMI. It is the only 48 pin package I have found to match the input with the differential pairs.

The power supply is 20 VDC 65 Watts. It does not seem like the center connector is connected. The connector is the standard "IBM" charger, outer case ground, inner case + 20 vdc, center pin power diag.

There is a fet transistor between the dock connector and the psu marked FA1K18 and it is controlled by some regulator marked 920A4 in a SOT-223 package. The 20 VDC goes in on pin 2 and the tab on it.

the HDMI chip has differential pair inputs on pin 47,48 - 44,45 - 41,41 - 38,39

I will do my best reversing the whole schematic for this unit and split it into parts so we can make other chargers and hopefully add HDMI to the dock.

Pinout Docking Connector Thinkpad Tablet

Pinout AAU chipAAU chip is audio amp.
audio out
pin 10 ring
pin 11 tip
pin 2, 7 gnd

Charger stuff :
The supplied DC apater is 20Volt 3.25Amps
In the dock there is a voltage regulator PV1. It is a 3.3 V LDO Tab has 20 volts in and pin 3 gives 3.30 Volts out.
There is also a FET in SSO8 (?) package. It is controlled by 2 transistors and works only as a switch.
On the base of PQ2 (pin 1, I guess it is the base) there is a float of 3.30 volts when there is nothing in the dock. The FET is OPEN and no voltage to the charger pins.
When grounding PQ2 pin1 (dock pin 5) the FET CLOSES and the charger outputs 20,5volts which basically is the same as dc power into the dock.

Now I am just waiting for the TPT to get fully charged so I can measure if there is any difference when fully charged.

Note:
By charging at 20 volts instead of 5 volts I understand why the charger only uses 2 pins into the TPT.
At 20 volts you can transfer 4 times the energy instead of just charging at 5 volts from USB powers. There is no need for step ups to charge the LI-Po battery as it would need more than 5 volts.

This is the schematics of the charger part:

www.r-888.com/tpt/schema.pdf

I am not sure of the 2 transitors if they are pnp or npn yet but the rest is how it is.
The original mosfet is a P-channel AON7403.
The regulator is just any 3,3 volt LDO.

The TPT charger control pin 5 gets a 3,3 volt float via the resistor to the left in the schematic. When it is connected the TPT grounds the pin and the FET lets current through.

Edited by ZebCrs, 05 November 2011 - 12:56 PM.

adb

[Tue Oct  9 14:12:34 2018] usb 2-4: new high-speed USB device number 9 using xhci_hcd
[Tue Oct  9 14:12:34 2018] usb 2-4: New USB device found, idVendor=17ef, idProduct=7494, bcdDevice=99.99
[Tue Oct  9 14:12:34 2018] usb 2-4: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[Tue Oct  9 14:12:34 2018] usb 2-4: Product: ThinkPadTablet
[Tue Oct  9 14:12:34 2018] usb 2-4: Manufacturer: LENOVO
[Tue Oct  9 14:12:34 2018] usb 2-4: SerialNumber: MP1YCPF

dpavlin@klin:~$ adb devices
List of devices attached
MP1YCPF device

dpavlin@klin:~$ adb shell
shell@android:/ $ df
Filesystem             Size   Used   Free   Blksize
/dev                   357M    32K   357M   4096
/mnt/asec              357M     0K   357M   4096
/mnt/obb               357M     0K   357M   4096
/sqlite_stmt_journals     4M     0K     4M   4096
/system                755M   310M   445M   4096
/data                   56G     1G    54G   4096
/cache                 885M    81M   804M   4096
/mnt/pia               492M   233M   258M   4096
/mnt/persdata           19M     8M    11M   4096
/storage/sdcard0        56G     1G    54G   4096


shell@android:/ # uname -a
Linux localhost 2.6.39.4-g40c7636-dirty #1 SMP PREEMPT Thu Feb 7 20:07:37 CET 2013 armv7l GNU/Linux


1|shell@android:/ # cat /proc/cpuinfo                                          
Processor       : ARMv7 Processor rev 0 (v7l)
processor       : 0
BogoMIPS        : 996.14

processor       : 1
BogoMIPS        : 996.14

Features        : swp half thumb fastmult vfp edsp vfpv3 vfpv3d16 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x1
CPU part        : 0xc09
CPU revision    : 0

Hardware        : ventana
Revision        : 0000
Serial          : 0000000000000000


shell@android:/ # free
             total         used         free       shared      buffers
Mem:        731896       720924        10972            0        18392
-/+ buffers:             702532        29364
Swap:            0            0            0


shell@android:/ # cat /proc/partitions                                         
major minor  #blocks  name

 179        0   62520320 mmcblk0
 179        1       6144 mmcblk0p1
 179        2       8192 mmcblk0p2
 179        3     786432 mmcblk0p3
 179        4     921600 mmcblk0p4
 179        5       2048 mmcblk0p5
 179        6     524288 mmcblk0p6
 179        7      20480 mmcblk0p7
 259        0     143360 mmcblk0p8
 259        1      20480 mmcblk0p9
 259        2   60071936 mmcblk0p10

APX mode

• turn off tablet
• press rotation button and hold it
• press power button for 2 seconds

 [Tue Oct  9 14:30:41 2018] usb 2-4: new high-speed USB device number 16 using xhci_hcd
[Tue Oct  9 14:30:42 2018] usb 2-4: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Tue Oct  9 14:30:42 2018] usb 2-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Tue Oct  9 14:30:42 2018] usb 2-4: Product: APX
[Tue Oct  9 14:30:42 2018] usb 2-4: Manufacturer: NVIDIA Corp.

nvflash

https://forum.xda-developers.com/showthread.php?t=1745450

dpavlin@klin:/virtual/android/tegra/linux4tegra/nvflash$ LD_LIBRARY_PATH=. ./nvflash --bl ../prebuilt/fastboot.stock.bin --getpartitiontable /klin/Tegra/tpt1.nvflash.getpartitiontable
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 4
   chip sku: 0x8
   chip uid: 0x0a8051c743dfd457
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: emmc
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 0

downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: ../prebuilt/fastboot.stock.bin
| 936016/936016 bytes sent
../prebuilt/fastboot.stock.bin sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
failed executing command 19 NvError 0x120000
command failure: get partition table failed 

partition table

dpavlin@nuc:/nuc/Tegra/nvflash$ LD_LIBRARY_PATH=. ./nvflash --bl ../04.EBT.img --getpartitiontable partitiontable.txt --go
Nvflash started
rcm version 0X20001
System Information:
   chip name: t20
   chip id: 0x20 major: 1 minor: 4
   chip sku: 0x8
   chip uid: 0x043c71c3433f8497
   macrovision: disabled
   hdcp: enabled
   sbk burned: false
   dk burned: false
   boot device: emmc
   operating mode: 3
   device config strap: 0
   device config fuse: 0
   sdram config strap: 2

downloading bootloader -- load address: 0x108000 entry point: 0x108000
sending file: ../04.EBT.img
/ 6291456/6291456 bytes sent
../04.EBT.img sent successfully
waiting for bootloader to initialize
bootloader downloaded successfully
Succesfully updated partition table information to partitiontable.txt

backup

dpavlin@nuc:/nuc/Tegra/nvflash$ grep PartitionId partitiontable.txt  | cut -d= -f2 | tr -d '\r' | xargs -i ./nvflash -r --read {} {}

# even better version which removes biggest partition (15)

dpavlin@klin:/klin/Tegra/nvflash$ grep PartitionId partitiontable.txt  | cut -d= -f2 | tr -d '\r' | grep -v 15 | xargs -i ../nvflash/nvflash -r --read {} {}

BCT - Boot Configuration Table

https://http.download.nvidia.com/tegra-public-appnotes/bct-overview.html

compiler: https://github.com/NVIDIA/cbootimage

dpavlin@klin:/klin/Tegra/tegrarcm$ ./src/tegrarcm readbct --bct tpt.bct

[Wed Oct 10 14:31:05 2018] usb 3-1.1: new high-speed USB device number 23 using ehci-pci
[Wed Oct 10 14:31:05 2018] usb 3-1.1: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Wed Oct 10 14:31:05 2018] usb 3-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Wed Oct 10 14:31:05 2018] usb 3-1.1: Product: APX
[Wed Oct 10 14:31:05 2018] usb 3-1.1: Manufacturer: NVIDIA Corp.

bct file: tpt.bct
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
reading BCT from system, writing to tpt.bct...done!

serial

From android:

shell@android:/ # cat /proc/cmdline                                            
tegraid=20.1.4.0.0 mem=1022M@0M android.commchip=2685344 vmalloc=256M androidboot.serialno=0a805185415fc1d7 video=tegrafb no_console_suspend=1 console=none debug_uartport=lsport,-3 usbcore.old_scheme_first=1 lp0_vec=8192@0x1d826000 tegra_fbmem=8197120@0x1d82a000 tegraboot=sdmmc charging=0 isBatteryFail=0 gpt gpt_sector=125040639 


shell@android:/ # lsof | grep tty                                              
rild        103      radio   13       ???                ???       ???        ??? /dev/ttyACM1
brcm_patc   330  bluetooth    3       ???                ???       ???        ??? /dev/ttyHS2
sh         1789      shell   24       ???                ???       ???        ??? /dev/tty
sh         1795       root   24       ???                ???       ???        ??? /dev/tty

shell@android:/ # dmesg | grep tty                                             
<6>[    6.290150] serial8250.0: ttyS0 at MMIO 0x70006300 (irq = 122) is a Tegra
<6>[    6.290475] tegra_uart.1: ttyHS1 at I/O 0x0 (irq = 69) is a unknown
<6>[    6.290727] Registered UART port ttyHS1
<6>[    6.290873] tegra_uart.2: ttyHS2 at I/O 0x0 (irq = 78) is a unknown
<6>[    6.291115] Registered UART port ttyHS2
<6>[    7.056012] cdc_acm 1-1:1.1: ttyACM0: USB ACM device
<6>[    7.067323] cdc_acm 1-1:1.3: ttyACM1: USB ACM device
<6>[    7.137758] cdc_acm 1-1:1.9: ttyACM2: USB ACM device
<4>[   15.154176] ttyACM1: Entering acm_tty_open.

serial port

Schematic has 4 pin debug connector with serial on it.

There are three 4-pin connectors on this side of board, and from pictures other side doesn't seem to have connectors.

Skip JLTE1 and JLTE2 connector (under ribbon to front-facing camera), they are wrong connectors, and pop rf shield off Tegra
compartment and locate JP4:

solder pin 1 and 2 and ground

JP4 pinout from schematics:

• 1 - UART4_RXD
• 2 - UART4_TXD
• 3
• 4 - GND

Pins 1 and 2 are 1.8V when device is turned on. so far, so good.

u-boot

dpavlin@klin:/klin/Tegra/u-boot-tegra$ export CROSS_COMPILE="arm-none-eabi-" ARCH=arm
dpavlin@klin:/klin/Tegra/u-boot-tegra$ make ventana_defconfig

press left-most button and power (top-right of tablet)

[Sun Oct 21 16:29:05 2018] usb 1-3.4.1: pl2303 converter now attached to ttyUSB3
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: new high-speed USB device number 105 using xhci_hcd
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: New USB device found, idVendor=0955, idProduct=7820, bcdDevice= 1.04
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: Product: APX
[Sun Oct 21 16:29:22 2018] usb 1-3.4.4: Manufacturer: NVIDIA Corp.

# backup bct

dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ ../tegrarcm/src/tegrarcm --bct broken.bct readbct
bct file: broken.bct
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
reading BCT from system, writing to broken.bct...done!

# try u-boot

dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ ../tegrarcm/src/tegrarcm --bct broken.bct --bootloader /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin --loadaddr 0x108000

bct file: broken.bct
bootloader file: /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin
load addr 0x108000
entry addr 0x108000
device id: 0x7820
uid:  0x0a805185415fc1d7
RCM version: 2.1
downloading miniloader to target at address 0x40008000 (132976 bytes)...
miniloader downloaded successfully
Chip UID:                0x00000000000000000a805185415fc1d7
Chip ID:                 0x20
Chip ID Major Version:   0x1
Chip ID Minor Version:   0x4
Chip SKU:                0x8 (t20)
Boot ROM Version:        0x1
Boot Device:             0x2 (EMMC)
Operating Mode:          0x3 (developer mode)
Device Config Strap:     0x0
Device Config Fuse:      0x0
SDRAM Config Strap:      0x1
sending file: broken.bct
- 4080/4080 bytes sent
broken.bct sent successfully
sending file: /mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin
/ 496836/496836 bytes sent
/mnt/klin/klin/Tegra/u-boot-tegra/u-boot-tegra.bin sent successfully
dpavlin@nuc:/nuc/Tegra/tpt-brokenscreen$ 
[Sun Oct 21 16:39:58 2018] usb 1-3.4.4: USB disconnect, device number 108

and screen seems to work with changes ported from 2.6!

                                display-timings {
                                        timing@0 {
                                                /* XXX tegra_dc_mode ventana_panel_modes */
                                                clock-frequency = <72072000>;
                                                hactive = <1280>;
                                                vactive = <800>;
                                                hback-porch = <72>;
                                                hfront-porch = <48>;
                                                hsync-len = <32>;
                                                vback-porch = <22>;
                                                vfront-porch = <3>;
                                                vsync-len = <7>;
                                                hsync-active = <1>;
                                        };
                                };

wifi

dpavlin@tegra20:~$ dmesg | grep brcm
[   13.971076] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4329-sdio for chip BCM4329/3

apt-get install firmware-brcm80211

# it seems to need some non-free parts

root@tegra20:/home/dpavlin# cd /lib/firmware/brcm/
wget https://raw.githubusercontent.com/armbian/firmware/master/brcm/brcmfmac4329-sdio.txt

battery

without any config with ventana dts battery isn't charging which is annoying for development because you need to charge tablet often.

• The Power-Supply Subsystem - Sebastian Reichel, Collabora https://youtu.be/MdgmyOHldZg

according to schematics charger is: ISL9519HRTZ-T_TQFN28_4X4

https://www.intersil.com/content/dam/intersil/documents/isl9/isl9519.pdf (too short, not useful)

There seems to be patch to add isl9519q to kernel back from 2011: https://lkml.org/lkml/2011/8/29/312
which judging from one datasheet that google can find ISL9519C-Intersil.pdf is roughly correct.

i2c

root@tegra20:~# i2cdetect -l     
i2c-3   i2c             7000d000.i2c                            I2C adapter
i2c-1   i2c             7000c400.i2c                            I2C adapter
i2c-4   i2c             i2c-1-mux (chan_id 0)                   I2C adapter
i2c-2   i2c             7000c500.i2c                            I2C adapter
i2c-0   i2c             7000c000.i2c                            I2C adapter
i2c-5   i2c             i2c-1-mux (chan_id 1)                   I2C adapter

root@tegra20:~# i2cdetect -y -r 0
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- UU -- 1c -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 1 # very slow
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 2
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 3
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- 0c -- -- 0f 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- UU -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- UU -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 4
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# i2cdetect -y -r 5
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --                         

root@tegra20:~# grep . /sys/bus/i2c/devices/*/name
/sys/bus/i2c/devices/0-001a/name:wm8903
/sys/bus/i2c/devices/0-0044/name:isl29018
/sys/bus/i2c/devices/3-0034/name:tps6586x
/sys/bus/i2c/devices/3-004c/name:nct1008
/sys/bus/i2c/devices/i2c-0/name:7000c000.i2c
/sys/bus/i2c/devices/i2c-1/name:7000c400.i2c
/sys/bus/i2c/devices/i2c-2/name:7000c500.i2c
/sys/bus/i2c/devices/i2c-3/name:7000d000.i2c
/sys/bus/i2c/devices/i2c-4/name:i2c-1-mux (chan_id 0)
/sys/bus/i2c/devices/i2c-5/name:i2c-1-mux (chan_id 1)

addresses from schematics

does g-sensor have typo? 0b0001_111 is 0x0f and we see such device