Lenovo Tab M10 FHD Plus (lenovo tbx606)

From postmarketOS Wiki
Lenovo Tab M10 FHD Plus 2nd Gen
TB-X606FA Tablet docked in it's Alexa speaker dock.
TB-X606FA Tablet docked in it's Alexa speaker dock.
Manufacturer Lenovo
Name Tab M10 FHD Plus 2nd Gen
Codename lenovo-tbx606
Released 2020
Hardware
Chipset MediaTek Helio P22T (MT8768)
CPU 8x 1.8/2.30GHz Cortex-A53
GPU PowerVR Rogue GE8320 @ 650MHz (OpenGL ES 3.2)
Display 10.3" 1920x1200 TDDI 330nits
Storage 64GB eMMC
Memory 4GB LPDDR4X 3200MHz
Architecture aarch64
Software
Original software Android
Original version 9
Extended version 10
postmarketOS
Category testing
Pre-built images no
This device is marked as not booting.

The Lenovo Tab M10 FHD Plus is a series of tablets sold also intended to be used as voice assistant screen hybrids called Smart Tab M10 FHD Plus. This is the second generation of the M10 FHD tablet (called M10 FHD Plus) and uses Mediatek processors.

Contributors

Users owning this device

  • Jiël (Notes: Beta test)
  • Rgon (Notes: First attempt at porting to pmos!)
  • Zephyr1112 (Notes: 4/64GB, stock ROM, X606F)

How to enter flash mode

NOTES: Unofficial TWRP is available for this device. Bootloader unlocking:

  • Enable Developer Options (Android Settings -> System -> About -> Build Number (press 7 times)
  • Turn on OEM Unlocking and USB Debugging in Android Settings -> System -> Developer Options
  • Connect tablet to computer, press Allow USB Debugging on the popup that will appear on the tablet.
  • $ adb reboot bootloader
  • $ fastboot flashing unlock Wipes data!
  • Follow the instructions on the tablet and reboot to Android for the wipe to complete.

Entering the bootloader:

  • Hold Vol Down + Power until the tablet vibrates to enter fastboot mode.

Enable installing unverified packages (specific to mediatek devices/Android Verified Boot): either flash an empty vbmeta package

  • fastboot --disable-verification flash vbmeta vbmeta.img

TODO: provide vbmeta.img or create a custom signed vbmeta.img for your partitions.

Then install your package (after vbmeta):

  • fastboot flash whatToFlash imageSrc

Installation

TODO: pmbootstrap flasher flash_kernel causes bootloop. The device shows the 'Lenovo' splash screen, appears as the usb device: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader, which shortly disappears and reboots.

Serial Console

The device's main board has two exposed POGO pins labelled TX and RX which expose the SOC's 1.8V UART (voltage level checked with oscilloscope). CH340G USB-TTL 3.3V (RX only) confirmed working. Upon charger connected/fastboot reboot, the device prints the following (115200 baud):

The << garbage >> found afterwards is data at (921600) baud. Here's an excerpt after calling fastboot reboot:

Android Verified Boot Notice

Every time fastboot is loaded, and either fastboot flash boot bootimg.img or fastboot boot bootimg.img is called, an empty vbmeta image must be flashed previously!! You can do so with pmbootstrap flasher flash_vbmeta as a first command every time you open fastboot. If not, the kernel will not be loaded and instead, you'll get the following undescriptive messages in the serial console, and no kernel logs whatsoever:

Boot Debugging

The device will not boot and will enter a bootloop. However, reading the serial terminal, we can diagnose the output of fastboot oem p2u on && fastboot boot '/tmp/postmarketOS-export/boot.img-lenovo-x606fa'. The system enter a kernel panic and the MTK WDT reboots the device back to fastboot mode. These lines before the panic might shed some light:

The previous error has been successfully solved with the following defconfig options: 

# CONFIG_MTK_DYNAMIC_FPS_FRAMEWORK_SUPPORT is not set
# CONFIG_MTK_FPSGO is not set

Accidental Bricking

During the development process, I've managed to dead-brick or black-screen-brick the device several times. The device will not show any signs of life other than it vibrating on the constant reboots. There is no way to access fastboot in this bricked state. Serial output shows the preloader tries to load the bootloader but stops at [ATF](0)[5.261232]NOTICE: ['A] CPU[0] IRQ[171][ATF](0)[5.261720]NOTICE: enter(15340998846)[ATF](0)[5.262204]NOTICE: quit(15354769923), causing aee_wdt_dump. Little Kernel doesn't seem to run in such case.

Probable cause:

Trying to fastboot boot bootimg.img with an erased boot partition.

However, simply adding fastboot flash boot '/tmp/postmarketOS-export/boot.img-lenovo-x606fa' so the boot partition isn't empty (or not erasing it in the first place) guarantees that your non-booting kernel does not brick your device that easily.

Solution:

Use SP-Flash-Tool to re-flash the vendor's ROM. The fastest route is probably using Lenovo LMSA on a sepparate Windows (unfortunately) machine and reflash using the MTK Preloader. Just follow the LMSA instructions and plug the (in rebooting condition) Tablet while pressing Volume UP. No need to try to turn it off nor disconnect the (internal) battery, since it's already in a preloader loop.

Issues stifling development

  • TWRP install not persisting Solved by installing vbmeta.img before (and after?) the recovery image.
  • pmbootstrap flasher flash_rootfs throws error Invalid sparse file format at header magic and keeps transferring the data. Solved by: Troubleshooting#Invalid_sparse_file_format_at_header_magic

Note: even though no further errors pop up, after calling this command, TWRP throws the following errors: Faled to mount '/system_root' (Invalid-argument). Wiping the "System" partition on TWRP fixes the issue, and reflashing pmOS brings it back up. So it seems that the partition is not being correctly written by flash_rootfs

  • pmbootstrap flasher flash_rootfs followed by pmbootstrap flasher boot reboots to fastboot.
  • pmbootstrap flasher flash_kernel does not throw errors
  • pmbootstrap install --no-fde --android-recovery-zip pmbootstrap export and using adb push mos-lenovo-x606fa.zip /sdcard/ to later "Install Zip" is impossible if we don't _Wipe_ system (and data, cache for good measure). After flashing the exported .zip, /system_root is once again mountable (containing just the lost+found dir, but Data is no longer mountable).

See also

The open source kernel code for the models: TB-X606X, TB-X606F (buildable, and containing a defconfig for the board) can be found in Lenovo's Open Source portal, with the filename tab_m10_fhd_plus_opensource_tb-x606m_s000213_200302_bmain.tgz, sha256sum: aab720c250f05a5b4ae618ecf8350978428446ad14b1f8ed8b01b0582205a12c.

The board name appears to be achilles6_row_wifi, as is the provided kernel source's defconfig filename. Note: the extracted working TWRP's defconfig file is called achilles6_row_wifi_alexa, so the TB-X606FA version might in fact be different.

You'll probably find more information here [1](UBports community port). They have apparently managed to compile and make it run. However, [2](an user reports) that they arrived to the same bootloop that I found, blaming that since the Kernel Lenovo provides is for the Android 9 variant, flashing it on a tablet that has Android 10 installed (the newer production date ones) causes it to not boot [3](see comment here).


Mainlining

This SOC mt8768 seems to be mostly the same as the mt6765, since in the Lenovo provided kernel, the name mt6765 (Helio P35) appears in many places, substituting this tablet's SOC name.

NOT VERIFIED sourced from deviceinfohw

Hardware type Chip Mainline status
WiFi chip ? ?
Charging IC bq2560x ?
Fuel gauge ? ?
GNSS N/A -
NFC N/A -
Proximity sensor ltr578_l ?
Accelerometer Bosch bma253 -
Touchscreen ? fts_ts driver
Display panel BOE TV103WUM-LL1 Generic Driver Used
Retrieved from "https://wiki.postmarketos.org/index.php?title=Lenovo_Tab_M10_FHD_Plus_(lenovo_tbx606)&oldid=43204"