Lenovo Tab M10 FHD Plus (lenovo tbx606)
![]() TB-X606FA Tablet docked in it's Alexa speaker dock. | |
Manufacturer | Lenovo |
---|---|
Name | Tab M10 FHD Plus 2nd Gen |
Codename | lenovo-tbx606 |
Released | 2020 |
Hardware | |
Chipset | MediaTek Helio P22T (MT8768) |
CPU | 8x 1.8/2.30GHz Cortex-A53 |
GPU | PowerVR Rogue GE8320 @ 650MHz (OpenGL ES 3.2) |
Display | 10.3" 1920x1200 TDDI 330nits |
Storage | 64GB eMMC |
Memory | 4GB LPDDR4X 3200MHz |
Architecture | aarch64 |
Software | |
Original software | Android |
Original version | 9 |
Extended version | 10 |
postmarketOS | |
Category | testing |
Pre-built images | no |
The Lenovo Tab M10 FHD Plus is a series of tablets sold also intended to be used as voice assistant screen hybrids called Smart Tab M10 FHD Plus. This is the second generation of the M10 FHD tablet (called M10 FHD Plus) and uses Mediatek processors.
Contributors
Users owning this device
- Jiël (Notes: Beta test)
- Rgon (Notes: First attempt at porting to pmos!)
- Zephyr1112 (Notes: 4/64GB, stock ROM, X606F. Making Android trees)
How to enter flash mode
NOTES: Unofficial TWRP is available for this device. Bootloader unlocking:
- Enable Developer Options (Android Settings -> System -> About -> Build Number (press 7 times)
- Turn on OEM Unlocking and USB Debugging in Android Settings -> System -> Developer Options
- Connect tablet to computer, press
Allow USB Debugging
on the popup that will appear on the tablet. $ adb reboot bootloader
$ fastboot flashing unlock
Wipes data!- Follow the instructions on the tablet and reboot to Android for the wipe to complete.
Entering the bootloader:
- Hold
Vol Down + Power
until the tablet vibrates to enter fastboot mode.
Enable installing unverified packages (specific to mediatek devices/Android Verified Boot): either flash an empty vbmeta package
fastboot --disable-verification flash vbmeta vbmeta.img
TODO: provide vbmeta.img or create a custom signed vbmeta.img for your partitions.
Then install your package (after vbmeta):
fastboot flash whatToFlash imageSrc
Installation
TODO: pmbootstrap flasher flash_kernel
causes bootloop.
The device shows the 'Lenovo' splash screen, appears as the usb device: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
, which shortly disappears and reboots.
Serial Console
The device's main board has two exposed POGO pins labelled TX and RX which expose the SOC's 1.8V UART (voltage level checked with oscilloscope). CH340G USB-TTL 3.3V (RX only) confirmed working. Upon charger connected/fastboot reboot
, the device prints the following (115200 baud):
Boot serial output: |
The << garbage >>
found afterwards is data at (921600) baud. Here's an excerpt after calling fastboot reboot
:
Boot serial output @921600n1: |
Android Verified Boot Notice
Every time fastboot is loaded, and either fastboot flash boot bootimg.img
or fastboot boot bootimg.img
is called, an empty vbmeta
image must be flashed previously!! You can do so with pmbootstrap flasher flash_vbmeta
as a first command every time you open fastboot. If not, the kernel will not be loaded and instead, you'll get the following undescriptive messages in the serial console, and no kernel logs whatsoever:
Locked AVB Serial output: |
Boot Debugging
The device will not boot and will enter a bootloop. However, reading the serial terminal, we can diagnose the output of fastboot oem p2u on && fastboot boot '/tmp/postmarketOS-export/boot.img-lenovo-x606fa'
. The system enter a kernel panic and the MTK WDT reboots the device back to fastboot mode. These lines before the panic might shed some light:
Pre-panic output: |
The previous error has been successfully solved with the following defconfig
options:
# CONFIG_MTK_DYNAMIC_FPS_FRAMEWORK_SUPPORT is not set
# CONFIG_MTK_FPSGO is not set
Accidental Bricking
During the development process, I've managed to dead-brick or black-screen-brick the device several times. The device will not show any signs of life other than it vibrating on the constant reboots. There is no way to access fastboot in this bricked state. Serial output shows the preloader tries to load the bootloader but stops at [ATF](0)[5.261232]NOTICE: ['A] CPU[0] IRQ[171][ATF](0)[5.261720]NOTICE: enter(15340998846)[ATF](0)[5.262204]NOTICE: quit(15354769923)
, causing aee_wdt_dump
. Little Kernel doesn't seem to run in such case.
Probable cause:
Trying to fastboot boot bootimg.img
with an erased boot
partition.
Commands that cause hard-brick in a reproducible manner: |
However, simply adding fastboot flash boot '/tmp/postmarketOS-export/boot.img-lenovo-x606fa'
so the boot partition isn't empty (or not erasing it in the first place) guarantees that your non-booting kernel does not brick your device that easily.
Solution:
Use SP-Flash-Tool
to re-flash the vendor's ROM. The fastest route is probably using Lenovo LMSA
on a sepparate Windows (unfortunately) machine and reflash using the MTK Preloader. Just follow the LMSA
instructions and plug the (in rebooting condition) Tablet while pressing Volume UP. No need to try to turn it off nor disconnect the (internal) battery, since it's already in a preloader loop.
Issues stifling development
TWRP install not persistingSolved by installing vbmeta.img before (and after?) the recovery image.Solved by: Troubleshooting#Invalid_sparse_file_format_at_header_magicpmbootstrap flasher flash_rootfs
throws errorInvalid sparse file format at header magic
and keeps transferring the data.
Note: even though no further errors pop up, after calling this command, TWRP throws the following errors: Faled to mount '/system_root' (Invalid-argument)
.
Wiping the "System" partition on TWRP fixes the issue, and reflashing pmOS brings it back up.
So it seems that the partition is not being correctly written by flash_rootfs
pmbootstrap flasher flash_rootfs
followed bypmbootstrap flasher boot
reboots to fastboot.pmbootstrap flasher flash_kernel
does not throw errorspmbootstrap install --no-fde --android-recovery-zip
pmbootstrap export
and usingadb push mos-lenovo-x606fa.zip /sdcard/
to later "Install Zip" is impossible if we don't _Wipe_system
(anddata
,cache
for good measure). After flashing the exported.zip
,/system_root
is once again mountable (containing just thelost+found
dir, butData
is no longer mountable).
See also
The open source kernel code for the models: TB-X606X, TB-X606F (buildable, and containing a defconfig for the board) can be found in Lenovo's Open Source portal, with the filename tab_m10_fhd_plus_opensource_tb-x606m_s000213_200302_bmain.tgz
, sha256sum: aab720c250f05a5b4ae618ecf8350978428446ad14b1f8ed8b01b0582205a12c
.
The board name appears to be achilles6_row_wifi
, as is the provided kernel source's defconfig filename. Note: the extracted working TWRP's defconfig file is called achilles6_row_wifi_alexa
, so the TB-X606FA
version might in fact be different.
You'll probably find more information here [1](UBports community port). They have apparently managed to compile and make it run. However, [2](an user reports) that they arrived to the same bootloop that I found, blaming that since the Kernel Lenovo provides is for the Android 9 variant, flashing it on a tablet that has Android 10 installed (the newer production date ones) causes it to not boot [3](see comment here).
Mainlining
This SOC mt8768 seems to be mostly the same as the mt6765, since in the Lenovo provided kernel, the name mt6765 (Helio P35) appears in many places, substituting this tablet's SOC name.
NOT VERIFIED sourced from deviceinfohw
Hardware type | Chip | Mainline status |
WiFi chip | ? | ? |
Charging IC | bq2560x | ? |
Fuel gauge | ? | ? |
GNSS | N/A | - |
NFC | N/A | - |
Proximity sensor | ltr578_l | ? |
Accelerometer | Bosch bma253 | - |
Touchscreen | ? | fts_ts driver |
Display panel | BOE TV103WUM-LL1 | Generic Driver Used |