[Nexus 7 General] bpye:
I thought I would put all of my findings in one thread, feel free to ask questions below.

Dock Connector

The dock connector is functional in the latest branch of the Nexus 7 kernel found on android source (android-tegra3-grouper-3.1-jb-mr1-fr). The top pin is ground, the second is the right audio channel, the third the left and the bottom pin is 5V. Upon connecting the ground and 5V lines the audio on the dock connector is enabled and the internal speaker is disabled. I used a piezo element to check so I'm not sure how good the audio is, but it is definately there.

Variants

From the kernel source code there are 3 different project ids but 4 names. Nakasi (the standard Nexus 7), Nakasi 3G, Bach and ME370TG. Nakasi 3G and Bach share the same project ID. This is interesting as the project id table states that Nakasi and ME370T are the same, but also separates the ME370TG and Nakasi 3G. It is also revealed that there are, or have been, two power management ICs and two GPS ICs used in the product. For power management both a TI chip and a Maxim chip have been used, though I believe all? of the current Nexus 7 have the Maxim one. The two GPS' used have been the BCM47511 and BCM4751. In addition to this there have been 4/6 PCB revisions. SR3 appears to be very early as some of the code excludes it, and it also has ID 0 assigned. ER1-ER3 appear to be the current series and my C9O Nexus 7 is revision 3, this can be checked in the bootloader, it is noted as "HW VERSION" or version-hardware in fastboot ("fastboot getvar all").

In my kernel compile below I have added a simple debug output that displays the PMIC ID, project ID and pcb ID. If you decide to test the below kernel for the dock functionality it'd be appreciated if you post the output from /proc/kmsg. The line that I have added looks something like "HEADSET: PMIC: 0 Project ID: 0 Revision: 3 UART_enable:1". This means that I have the Maxim PMIC, it's a Nakasi device and the PCB is revision ER3. The reason it's in headset is explained below.

Fastboot OEM Commands

The oem lock and oem unlock commands are well known, however through looking at the bootloader run through strings I have found 4 additional commands that may be of use. I have found oem off-mode-charge 0 and oem off-mode-charge 1. These appear to enable or disable off mode charging, eg charging without the device being on. The more interesting command is however oem uart-on (and oem uart-off). This causes the bootloader to pass debug_uartport=lsport,0 to the kernel, I am not sure however where "lsport" is but it is referenced in arch/arm/mach-tegra/common.c, if uart is not enabled in the bootloader (evident by fastboot getvar all showing uart-on as no) then the bootloader passes debug_uartport=hsport. The 0 appears to indicate the port it outputs on.

Headset UART Output

In the headset driver (/sound/soc/tegra/headset.c) there is reference to a debug board that can be used to get a UART output. From what I understand this is enabled by setting a line-out pin low, however I am having issues working out which one. I have also attempted to enable this for anything inserted, and while this worked, my simple 4 connector 3.5mm plug breakout didn't reveal any data. I'm leaving this one out there for other people to try. For reference, https://android.googlesource.com/kernel/tegra/+/b0d6be9e2033745e46624e518f55e067b75bcd50 is the commit when the debug board was added. I also commented out it's PMIC check to ensure that it did not stop because I have a Maxim PMIC. This should not matter I believe it is just a way to filter out retail Nexus 7s as it can supposedly cause issues with powered headphones.

The driver also shows the possibility for headset support, however I have yet to investigate this.

Kernel Build

I have built a kernel in an attempt to enable as much of the above as is possible. It has working dock functionality and some additional debug information in relation to the headset UART output. My only changes from the default branch are in headset.c and are as follows:

if(project_info == GROUPER_PROJECT_BACH ||
(project_info == GROUPER_PROJECT_NAKASI/* && pmic_id ==GROUPER_PMIC_TI*/))
UART_enable = true;

revision = grouper_query_pcba_revision();

printk("HEADSET: PMIC: %i Project ID: %i Revision: %i UART_enable: %i\n", pmic_id, project_info, revision, UART_enable);

It should be fairly obvious what bit of code it replaces, it's in headset_init(void).

I have only provided the kernel as a ramdisk and zImage as the ramdisk depends upon the ROM you use. If you use CM10 then these will work, else you'll have to extract the ramdisk from your current boot.img with a tool such as abootimg. This can be run using the fastboot boot command, "fastboot boot zImage initrd.img" or by using the fastboot flash:raw command, "fastboot flash:raw boot zImage initrd.img". The latter is permanent while the former is once only.

This kernel does not support overclocking, special IO schedulers or any special "optimizations". It never will, it is purely to work out how to activate some of the hidden functions in our Nexus 7s.

Note to Moderators

Wasn't really sure where this thread should go, if you feel this should be moved then please do.