Lenovo Tab M10 FHD Plus (lenovo tbx606)

The Lenovo Tab M10 FHD Plus is a series of tablets sold also intended to be used as voice assistant screen hybrids called Smart Tab M10 FHD Plus. This is the second generation of the M10 FHD tablet (called M10 FHD Plus) and uses Mediatek processors.

Contributors

 * Rgon

How to enter flash mode
NOTES: Unofficial TWRP is available for this device. Bootloader unlocking:
 * Enable Developer Options (Android Settings -> System -> About -> Build Number (press 7 times)
 * Turn on OEM Unlocking and USB Debugging in Android Settings -> System -> Developer Options
 * Connect tablet to computer, press  on the popup that will appear on the tablet.
 * Wipes data!
 * Follow the instructions on the tablet and reboot to Android for the wipe to complete.
 * Follow the instructions on the tablet and reboot to Android for the wipe to complete.

Entering the bootloader:
 * Hold  until the tablet vibrates to enter fastboot mode.

Enable installing unverified packages (specific to mediatek devices/Android Verified Boot): either flash an empty vbmeta package TODO: provide vbmeta.img or create a custom signed vbmeta.img for your partitions.

Then install your package (after vbmeta):

Installation
TODO:  causes bootloop. The device shows the 'Lenovo' splash screen, appears as the usb device:, which shortly disappears and reboots.

Serial Console
The device's main board has two exposed POGO pins labelled TX and RX which expose the SOC's 1.8V UART (voltage level checked with oscilloscope). CH340G USB-TTL 3.3V (RX only) confirmed working. Upon charger connected/, the device prints the following (115200 baud):

The  found afterwards is data at (921600) baud. Here's an excerpt after calling :

Android Verified Boot Notice
Every time fastboot is loaded, and either  or   is called, an empty   image must be flashed previously!! You can do so with  as a first command every time you open fastboot. If not, the kernel will not be loaded and instead, you'll get the following undescriptive messages in the serial console, and no kernel logs whatsoever:

Boot Debugging
The device will not boot and will enter a bootloop. However, reading the serial terminal, we can diagnose the output of. The system enter a kernel panic and the MTK WDT reboots the device back to fastboot mode. These lines before the panic might shed some light: The previous error has been successfully solved with the following  options:

Accidental Bricking
During the development process, I've managed to dead-brick or black-screen-brick the device several times. The device will not show any signs of life other than it vibrating on the constant reboots. There is no way to access fastboot in this bricked state. Serial output shows the preloader tries to load the bootloader but stops at, causing. Little Kernel doesn't seem to run in such case.

Probable cause:
Trying to  with an erased   partition.

However, simply adding  so the boot partition isn't empty (or not erasing it in the first place) guarantees that your non-booting kernel does not brick your device that easily.

Solution:
Use  to re-flash the vendor's ROM. The fastest route is probably using  on a sepparate Windows (unfortunately) machine and reflash using the MTK Preloader. Just follow the  instructions and plug the (in rebooting condition) Tablet while pressing Volume UP. No need to try to turn it off nor disconnect the (internal) battery, since it's already in a preloader loop.

Issues stifling development
Note: even though no further errors pop up, after calling this command, TWRP throws the following errors:. Wiping the "System" partition on TWRP fixes the issue, and reflashing pmOS brings it back up. So it seems that the partition is not being correctly written by
 * TWRP install not persisting Solved by installing vbmeta.img before (and after?) the recovery image.
 * throws error   and keeps transferring the data. Solved by: Troubleshooting


 * followed by  reboots to fastboot.
 * does not throw errors
 * and using  to later "Install Zip" is impossible if we don't _Wipe_   (and ,   for good measure). After flashing the exported  ,   is once again mountable (containing just  the   dir, but   is no longer mountable).

Mainlining
This SOC mt8768 seems to be mostly the same as the mt6765, since in the Lenovo provided kernel, the name mt6765 (Helio P35) appears in many places, substituting this tablet's SOC name.

NOT VERIFIED sourced from deviceinfohw