Onn Tablet Gen 3 (onn-kelvin)

This device is marked as not booting. Status: postmarketOS does not currently reach its initramfs. UART access and 64-bit kernel booting through the stock bootloader have been independently verified.

Onn Tablet Gen 3

A screenshot of a rooted 7" Onn Tablet Gen 3 running Termux
Manufacturer	Onn
Name	Tablet Gen 3
Codename	onn-kelvin
Released	2022
Type	tablet
Hardware
Chipset	MediaTek MT8168
CPU	ARM Cortex-A53 MPCore
GPU	ARM Mali-G52 MC1
Display	7" 1024×600 LCD
Storage	32 GB
Memory	2 GB
Architecture	armv7
Software
Original software The software and version the device was shipped with.	Android (Go) 11
Extended version The most recent supported version from the manufacturer.	Android (Go)
FOSS bootloader	no
postmarketOS
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.	no
pmOS kernel The kernel version that runs on the device's port.	4.14.186
Unixbench score Unixbench Whetstone/Dhrystone score. See Unixbench.	0.0

The Onn Tablet Gen 3 is a low-end Android tablet sold by Walmart from approximately 2022 to 2024. The 7-inch model originally retailed for approximately US$50.

The device family was manufactured by Lightcomm Technology and distributed under Walmart's private-label Onn brand.

postmarketOS does not currently boot on this device. The existing port does not reach the postmarketOS initramfs. The hardware and bootloader information below comes primarily from Android and AOSP bring-up work and should not be interpreted as evidence that postmarketOS itself is functional.

This port is part of the lowendlibre project. Additional 64-bit kernel and Android bring-up research has been performed by the open-source POCA project.

Contributors

• hexaheximal
• poca

Bootloader and architecture

The MediaTek MT8168 contains 64-bit ARM Cortex-A53 CPU cores, although the stock Android installations examined so far use a 32-bit ARM kernel and userspace.

A 64-bit AArch64 Linux 4.14 kernel has been successfully loaded on the tablet through the stock MediaTek boot chain:

preloader -> LK -> Android boot.img

No replacement bootloader or U-Boot stage was required.

The test system reached first-stage init, mounted logical partitions with first_stage_mount, performed switch_root, loaded SELinux policy, activated APEX and ART components, started Binder and servicemanager, processed VINTF data and began starting hardware abstraction layers. It remained running for more than 120 seconds without resetting.

The test remained headless because display output and ADB were not working. postmarketOS has not been booted, but these results indicate that the stock bootloader is capable of loading an AArch64 kernel from an ordinary Android boot.img.

Known-working Android boot image parameters are:

--base 0
--kernel_offset 0x40000000
--ramdisk_offset 0x47c80000
--tags_offset 0x4bc80000
--dtb_offset 0x4bc80000
--pagesize 2048

The tested image uses Android boot image header version 2.

UART

Kernel and bootloader UART output is available at 921600 baud.

The following kernel command-line parameters produce early Linux console output:

earlycon=mtk8250,mmio32,0x11002000 keep_bootcon console=ttyMT0,921600n1

The physical UART test-point locations have not yet been documented on this page.

Unlike some related MediaTek Onn tablets, Linux kernel messages are visible directly through UART on this device.

Persistent kernel logs

The stock memory layout includes a usable ramoops/pstore region beginning at:

0x54410000

Observed allocations include:

• 256 KiB for the console log
• 64 KiB for pmsg

This can preserve panic information across a warm reboot.

Firmware variants

At least two substantially different firmware and partition-layout generations appear to exist.

Feature	Earlier unit documented by the original port	Later unit examined by POCA
Stock operating system	Android Go 11	Android 12-based firmware
Stock kernel	4.14.186, 32-bit ARM	5.10.221-android12, 32-bit ARM zImage
Slot layout	Apparently non-A/B	A/B, using boot_a and boot_b
Observed slot suffix	Unknown	androidboot.slot_suffix=_b
Recovery partition	Unknown	None

Users should inspect the GPT before flashing:

$ mtk printgpt

On older units, the boot partition may be named boot. On newer A/B units it may instead be necessary to flash boot_a or boot_b.

Because the newer firmware layout has no dedicated recovery partition or fastbootd fallback, an invalid boot image may require recovery through MediaTek BROM mode.

How to enter flash mode

MediaTek preloader or BROM mode

To use mtkclient, shut down the tablet completely. After shutdown, reconnect it over USB. The device should briefly enumerate in MediaTek preloader mode.

If the normal boot chain is damaged or the preloader handoff fails, BROM recovery may be required.

Bootloader fastboot

With the tablet powered off:

1. Hold Volume Up and Power.
2. Select the fastboot option from the boot menu.

From a working Android installation, it may also be entered with:

$ adb reboot bootloader

Some Android tools use the command adb reboot fastboot for fastbootd. Newer examined units do not contain a recovery partition and may not provide a usable fastbootd environment, so the GPT and available boot modes should be checked before relying on it.

Installation

WARNING: postmarketOS does not currently boot on this device. These commands are development instructions and may leave the tablet unable to boot until the original partition image is restored through mtkclient or BROM mode. Back up the complete GPT and all relevant partitions first.

Use pmbootstrap to create an installation image:

$ pmbootstrap init
$ pmbootstrap install --fde
$ pmbootstrap export

Before flashing, inspect the partition table:

$ mtk printgpt

For an older non-A/B unit, the command may be:

$ mtk w boot /tmp/postmarketOS-export/boot.img

For an A/B unit, flash the appropriate slot instead:

$ mtk w boot_a /tmp/postmarketOS-export/boot.img

or:

$ mtk w boot_b /tmp/postmarketOS-export/boot.img

Do not assume that boot, boot_a or boot_b is correct without checking the device's GPT and active slot.

Device tree and boot image notes

DT table container

On the newer examined firmware, the DTB appended to the Android boot image is not a bare flattened device tree.

It is an Android DT table container with magic:

0xd7b7ab1e

The observed container has one entry, with its FDT beginning at offset 0x40. Device-tree tools that expect a raw DTB may fail unless the DT table is unpacked first.

DTBO behavior

The stock dtbo_a and dtbo_b partitions contain additional nodes, including panel-related nodes. However, nodes found only in the DTBO were not present in the live device tree on the examined unit.

This suggests that the stock boot process may not apply the DTBO partition, or may apply it only under conditions that have not yet been identified.

Kernel source

Walmart and Lightcomm Technology have not published the corresponding kernel source tree for this tablet.

MediaTek MT8168 vendor sources

Public Amazon source releases provide useful arm64 MT8168 kernel bases.

• Amazon Fire 7, 12th generation
  • Kernel path: kernel/mediatek/mt8168/4.14
  • Architecture: TARGET_ARCH=arm64
  • Defconfig: quartz_debug_defconfig

• Amazon Fire HD 8, 10th generation
  • Kernel path: kernel/mediatek/mt8168/4.14
  • Architecture: TARGET_ARCH=arm64
  • Defconfig: onyx_debug_defconfig

These source trees also use Linux 4.14.186, matching the kernel version associated with the original postmarketOS port.

They should be treated as reference or donor trees rather than exact GPL source releases for the Onn tablet.

Mainline-related sibling

The closest publicly supported MediaTek sibling for newer-kernel development is the MT8365, also marketed as Genio 350.

Relevant sources include:

• MediaTek AIoT BSP Linux, including the mtk-v5.15-dev branch
• Mainline Linux support for MT8365

The upstream mt8365.dtsi uses mediatek,mt8168-i2c as a fallback compatible, showing that some MT8168-related hardware blocks are already represented by upstream bindings and drivers.

Display and mainline notes

The device tree from the newer firmware uses comparatively modern MediaTek bindings.

Examples include:

• mmsys_config with mediatek,mt8168-disp
• gce_mbox with mediatek,mt8168-gce
• mediatek,mt8168-smi-larb
• mediatek,mt8168-m4u
• mediatek,mt6357-regulator

The display description follows the MediaTek DRM model rather than the older mediatek,dispsys model. Likewise, GCE is described as a mailbox rather than through the older mediatek,gce binding.

Consequently, the device tree may be a closer conceptual match for Linux 5.15 and newer MediaTek DRM drivers than for an older vendor 4.14 display stack.

Probe ordering

The approximate dependency order observed during bring-up is:

scpsys
  -> SMI and larbs
    -> display
      -> CMDQ/GCE
        -> framebuffer

If scpsys fails, dependent devices may repeatedly defer probing with -EPROBE_DEFER.

SPM resource conflict

The MediaTek mtk-scpsys driver maps the SPM syscon at:

syscon@10006000

Using devm_ioremap_resource() can fail with -EBUSY because the same address range is also included in the reg regions of other nodes, including:

• dramc@1022c000
• consys@18002000

This prevents the power-domain provider from probing and causes its consumers to defer.

During vendor-kernel bring-up, replacing the exclusive resource request with devm_ioremap() allowed scpsys to initialize.

Hardware inventory

Component	Detail
PMIC	MediaTek MT6357, compatible mediatek,mt6357, attached below pwrap@1000d000
Primary identified panel	MJT070032M
Alternate panel descriptions	SAT070HK30I21Y03 and zs,ne3008b3
LK panel identification	Panel ID 0x65; LK reports we will use lcm: MJT070032M
Display rotation	270 degrees
Panel power	lcmavdd-supply uses the MT6357 VIBR LDO
Panel GPIOs	Power GPIO 21; reset GPIO 20
Backlight	PWM, maximum hardware brightness 1023
Charger	hcn,eta6937 at I²C address 0x6a, with hl7005,cd_pin
USB role detection	extcon_iddig, WUSB3801X Type-C controller, usb_p0_vbus and bc12_active
USB controller	MediaTek MTU3 at 11201000.usb, USB 2.0 high-speed
IOMMU	mediatek,mt8168-m4u at 0x10205000
SMI common	0x14002000
SMI larbs	0x14003000, 0x15001000, 0x16010000 and 0x17010000
GPU	Mali Bifrost using the vendor kbase r16p0 driver