Thinkpad Tablet 10 (TPT10) – Some hackery

      Kommentare deaktiviert für Thinkpad Tablet 10 (TPT10) – Some hackery

For some reason I got attracted to the Thinkpad Tablet 10 again these days and treid new Linux kernels and hacked some stuff.

Overview:

  • Little progress on sound
  • A hint on BCM4752 GNSS/GPS
  • More hints…and code?

Little progress on sound

First of all the latest kernel 4.10.x seems to be pretty stable. The issue with the i915 panel self refresh (psr) is gone, which should again save some power. Also the issue with the Baytrail Alsa SOC sound drivers that prevented to enter sleep/standby modes seems to solved, yeah! So we can finally try to get around the ACPI bug which claims a RT5640 codec chip while in fact we have a RT5671 (the product sheet of the TPT10 actually claims RT5672 but the ID register of the chip says 0x5671 – hm). I hacked up a patch that seems to do the right thing but does not produce sound – yet. Here is the patch: tpt10-audio-4.9.10.diff.gz
If you want to play with the patch, you need to activate the driver in the kernel config with this option:
CONFIG_SND_SOC_INTEL_BYTCR_RT567X_MACH=m

It does not work yet:

[    6.265816] intel_sst_acpi 80860F28:00: BYT-CR not detected
[    6.266708] intel_sst_acpi 80860F28:00: LPE base: 0xd0a00000 size:0x200000
[    6.266711] intel_sst_acpi 80860F28:00: IRAM base: 0xd0ac0000
[    6.266752] intel_sst_acpi 80860F28:00: DRAM base: 0xd0b00000
[    6.266758] intel_sst_acpi 80860F28:00: SHIM base: 0xd0b40000
[    6.266769] intel_sst_acpi 80860F28:00: Mailbox base: 0xd0b44000
[    6.266775] intel_sst_acpi 80860F28:00: DDR base: 0x20000000
[    6.266863] intel_sst_acpi 80860F28:00: Got drv data max stream 25
...
[    6.891688] bytcr_rt567x probe 'snd-soc-dummy'
[    6.891689] bytcr_rt567x probe 'snd-soc-dummy'
[    6.891690] bytcr_rt567x probe 'snd-soc-dummy'
[    6.891690] bytcr_rt567x probe 'i2c-10EC5670:00'
[    6.906054] bytcr_rt567x bytcr_rt567x: snd-soc-dummy-dai <-> media-cpu-dai mapping ok
[    6.906107] bytcr_rt567x bytcr_rt567x: snd-soc-dummy-dai <-> deepbuffer-cpu-dai mapping ok
[    6.906138] compress asoc: snd-soc-dummy-dai <-> compress-cpu-dai mapping ok
[    6.907582] bytcr_rt567x bytcr_rt567x: rt5670-aif1 <-> ssp2-port mapping ok
[    6.920375] input: cherrytrailcraudio Headset as /devices/platform/80860F28:00/bytcr_rt567x/sound/card0/input13
...
[   10.275760] intel_sst_acpi 80860F28:00: FW Version 01.0c.00.01
[   10.280736]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
[   10.281125]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
[   10.281414]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
[   10.285924]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
[   10.286552]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
[   10.286828]  Audio Port: ASoC: no backend DAIs enabled for Audio Port
...

Well, this still needs some love…

A hint on BCM4752 GNSS/GPS

The TPT10 includes a GPS/GNSS chip from Broadcom, namely the BCM4752 (sometimes also named BCM47521). This type of GNSS/GPS chip does not calculate the solution (the actual coordinates) on the chip but outputs rather raw GPS data. This is very similar to what the GNSS Hammerhead chips did, formerly owned by Infineon PMB2520, here is a brief datasheet of it: PMB2520-XV10T7-7600

This kind of chip was also used in the Openmoko GTA-01 phone, as described here: https://wiki.openmoko.org/wiki/Hammerhead/Protocol Most of the links are dead by now but I managed to get hold of the hhtest.c code and one of the mentioned strace logs.

The BCM4752 shows up with a RFKILL switch in my system:

$ rfkill list
0: LNV4752:00: GPS
    Soft blocked: no
    Hard blocked: no
1: phy0: Wireless LAN
    Soft blocked: no
    Hard blocked: no
2: hci0: Bluetooth
    Soft blocked: yes
    Hard blocked: no

The device LNV4752 is connected to a system UART, according to ACPI DSDT it is SB.URT2 with an additional GPIO at GPO0 0x01, which is the RFKILL, and another ACPI device “BCM4752”, also SB.URT2 and two more GPIOs on GPO0, 0x33 & 0x01. Since the Bluetooth chip is also attached to an UART and according to DSDT is attached to SB.URT1, the BCM GNSS has to be on the following UART. I found Bluetooth an UART ttyS4 so I would expect the GNSS on ttyS5.

I changed the hhtest.c a little since it contained a lot of GTA01 specific stuff, you can find it here: hhtest-nf.c

The code will sync the baudrate with the chip and then send an init command, this is the result from the init command:

#define GPS_SYNC “\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80\x80”

(58) fe 0c fd c0 00 05 00 00 30 a1 1f 00 00 00 10 00 00 04 00 00 00 77 71 17 03 00 00 00 00 00 32 02 50 00 3b 33 23 70 81 00 00 e8 03 00 00 00 00 00 00 00 00 00 00 80 60 02 00 fc

If I disable the device using rfkill then there is no reply, so I think we are pretty correct on the UART. The reply also looks pretty promising.

More hints…and code?

There are several Intel Z37xx based Android tablets out in the wild which need to supply at least the Linux kernel sourcecode and thus maybe some drivers. One of the promising sets could be from the Lenovo S8-50 tablet and its code here:

http://pcsupport.lenovo.com/de/en/products/Tablets/S-Series/S8-50-Tablet/downloads/DS112961