User:0x47df/Panasonic FZ-B2B
This device is supported as part of a generic port. Refer to x86_64 for installation instructions and more information. |
This means that it cannot be selected in pmbootstrap.
Status: boots on unlocked device
![]() Photo of Panasonic FZ-B2B tablet running postmarketOS | |
Manufacturer | Panasonic |
---|---|
Name | ToughPad FZ-B2 Mk I |
Codename | panasonic-fzb2b |
Model | FZ-B2Bxxxxxx |
Released | 2014 |
Type | tablet |
Hardware | |
Chipset | Intel Celeron N2930 |
CPU | 4x 1.83GHz x86_64 |
GPU | Intel® HD Graphics for Intel Atom® Processor Z3700 Series |
Display | 1280x800 Daylight-readable LCD |
Storage | 32GB |
Memory | 2GB |
Architecture | x86_64 |
Software | |
Original software | Android |
Original version The version the device was shipped with. |
4.4.4 |
Extended version The most recent supported version from the manufacturer. |
4.4.4 |
FOSS bootloader | no |
postmarketOS | |
Category | testing |
Pre-built images Whether pre-built images are available here. |
no |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
no |
pmOS kernel The kernel version that runs on the device's port. |
6.15.5-0 |
Unixbench score Unixbench Whetstone/Dhrystone score. See Unixbench. |
0.0 |
Generic port | x86_64 |
Internal storage eMMC, SD cards, UFS, ... |
Works
|
---|---|
SD card Also includes other external storage cards |
Untested
|
Battery Charging and battery level reporting works |
Works
|
Screen Display works. Ideally with sleep mode and brightness control. |
Works
|
Touchscreen |
Works
|
Multimedia | |
3D Acceleration |
Untested
|
Audio Audio playback, microphone, headset and buttons. |
Works
|
Camera |
Works
|
Camera Flash |
Broken
|
Connectivity | |
WiFi |
Works
|
Bluetooth |
Works
|
Modem | |
Calls |
Untested
|
SMS |
Untested
|
Mobile data |
Untested
|
Miscellaneous | |
FDE Full disk encryption and unlocking with unl0kr. |
Untested
|
USB-A Full-sized USB-A port works (Usually applicable to SBCs and laptops). |
Works
|
SATA/eSATA |
Works
|
Sensors | |
Accelerometer Auto screen rotation works in desktops e.g. Phosh or Plasma Mobile |
Works
|
Magnetometer Sensor to measure magnetism |
Untested
|
Ambient Light |
Works
|
Contributors
Users owning this device
How to enter BIOS etc
By default, the BIOS can be entered by rapidly tapping the top left corner of the screen at boot.
The BIOS can also be accessed using a USB keyboard, by pressing 'Delete' at boot.
The boot selection menu can be invoked by pressing Vol- during boot, which can invoke signed MokManager, signed EFI shell, etc. Vol- moves down, Vol+ selects. Do not go too far, as there is no up option unless you have a usb keyboard.
Pre-Installation
A word of warning - this is not a particularly nice device to get booting and won't be easy. By default, this device ships with Secure Boot from the factory, with no visible option in the BIOS to disable Secure Boot.
You have two possible options to boot postmarketOS on this device:
- Method 1: Use existing shim
- Method 2: Disable secure boot (Advanced) - requires flash programmer
It is recommended you replace the internal m.2 eMMC card with a SATA type m.2 card as part of the installation process to retain a backup of the original bootloader components, but not essential.
However, once you have it booting, it is nice enough.
Method 1: Use existing shim
The device ships with an existing signed EFI shim, which is used to load the unsigned next-stage bootloader. Using this shim, we can also execute our own payload, if we also enrol our MOK. It is a little tricky, but possible.
You will also need a copy of refind.
How it works:
- You enrol a MOK, used to execute refind and any other .efi binaries you want.
- You copy existing shim.efi and MokManager.efi from the original disk.
- Device starts 'EFI/boot/bootx64.efi', which is actually the same 'shim.efi' file.
- The shim then tries to load file '/gummiboot.efi'
- Either the real gummiboot tries to load Android, or you've replaced it with refind, which you use as next-stage of bootloader.
Step 1: Obtain the shim from factory image
For this to work, we need to obtain some files from the existing installation:
* MokManager.efi * shim.efi * EFI/boot/bootx64.efi
As the device originally ran an early version of Android, you can take a copy of these using a generic Terminal APK, and copy them to mounted USB storage. Keep these safe for later, as you will need them.
You may also wish to use dd to create a full backup of the eMMC now, as it contains parts necessary for boot on the factory image. If not, the recommendation is for you to use a replacement m.2 SATA drive later once our MOK is enrolled.
Step 2: Generate your MOK.
tbd.
$ openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.cer -nodes -days 36500 -subj "/CN=MY_MOK/"
Once MOK is created, copy these files to a blank USB key. Do not use a populated USB key, as the file list is too large to fit on the screen and the MokManager is very buggy on long lists.
Step 3: Enrol your MOK
Note: A USB Hub, USB Stick with your MOK, and a USB Keyboard is necessary for this step.
- Press Vol- while on the "Starting System" screen to enter the boot device selection menu.
- At the menu, Press Vol- until 'MokManager' is the highlighted boot option.
- Press Vol+ to select the option.
- You will be greeted with a 'Shim UEFI key management' screen.
- Use Vol- to highlight 'Enrol key from disk', and press Vol+ to select.
- Use Vol- to highlight your USB disk, and press Vol+ to select.
- Use Vol- to highlight your MOK.cer, and press Vol+ to select.
- At the Enrol MOK key screen, press '1' followed by Enter on your USB keyboard to review the MOK, and verify it's your key.
- When you are happy it is your key, '0' followed by Enter to enrol the key.
- It will ask for y/n confirmation again. Press 'y' if you are happy.
- Press Vol+ to return to filesystem list.
- Press Vol+ to select the 'Exit' option.
- Press Vol+ to select 'Continue boot'
- Press Vol+ to boot the 'Android' option.
You may be prompted to enter your passphrase as part of MOK enrolment. Boot to Android as normal now, and then shut the device down.
Step 4: Prepare boot media
In the root of your USB, copy the following files:
- MokManager.efi, taken from Step 1
- shim.efi, taken from Step 1
Create directory EFI/boot, and add the following files:
- bootx64.efi, same file as your shim.efi file from Step 1.
Create directory cert, and add your keys to this.
Copy refind's refind_x64.efi to gummiboot.efi on the root of the USB.
Copy refind's refind.conf into EFI/boot/
Copy refind's icons/, and drivers_x64/ into EFI/boot/.
Copy EDK II UEFI Shell to shell.efi. You will need to sign this with your MOK. $ sbsign --key MOK.priv --cert MOK.cer "shell-unsigned.efi" --output "shell.efi"
Copy AMISetupWriter.efi to your usb Sign again. $ sbsign --key MOK.priv --cert MOK.cer "AMISetupWriter-unsigned.efi" --output "AMISetupWriter.efi"
Using a second USB stick, image this with the generic x86_64 target image.
Step 6: Boot EFI shell and enable touch panel:
Plug in a usb hub, keyboard, and your EFI usb.
Use Vol- to enter boot menu, and select your shell.efi.
At shell.efi, ls fs1: and you should see your files. if not, try fs2, etc.
Type 'fs1:' to select the filesystem, if it's the right one.
Run `AMISetupWriter.efi 0x1f0 0x01` to set the boot device type to Windows 8.x.
Run `AMISetupWriter.efi 0x1f1 0x01` to set the device type from ACPI to PCI.
This is necessary as the device is still exposing the touch device as an 'Android' type, which doesn't work in linux. I have no idea why, but it may be an android-specific thing they set, which we need to remove.
Using the power button, hard shut down the unit to ensure nothing flushes in-ram values back to our variables causing them to become overwritten.
Step 7: Replace disk, boot.
At this stage, you can swap the internal eMMC m.2 out for a SATA m.2 to ensure you keep a backup of the original bootloader, as it is tricky to make it work.
Plug your EFI usb stick in on one usb port of your hub.
Plug your postmarketOS generic target USB stick into another usb port.
Start the device. It should load refind from your EFI usb, and refind should find postmarketOS components to boot from the next device with. You can proceed to installation if this is successful, but remember the installation does not set up secure-boot. You will need to make the same workarounds (directory structure, cert, shim with gummiboot replacement) as built for the usb stick, on the main disk once installation is completed.
Troubleshooting:
- Sign your own EDKII shell with:
$ sbsign --key MOK.priv --cert MOK.cer "input.efi" --output "output.efi"
- Sign your own EFI bootloader with a similar process.
- You can maunally start your chosen bootloader from such a shell, if you elect to boot from it. This may be more robust than replacing gummiboot, but you may experience some trial-and-error.
Method 2: Disable secure boot (Advanced)
This method requires the use of an external flash programmer, and disassembly of the device to access the 25-series BIOS chip using a SOIC-8 flash chip.
This method is dangerous and has the potential to brick your device. Do not follow these instructions unless you are aware of the implications and have experience editing BIOS regions.
- Disassemble the device and access the flash chip.
- Disassembly consists of removing the side bumpers, top and lower plastics, rear door, and then all exposed screws.
- Once plastics are removed, a sandwich of two metal parts will be present. Seperate the rear and front metal gently, a gasket will seal these. The BIOS chip will be on the left side of the device, located below the m.2 connector.
- Take a backup of the flash.
- Copy your flash dump to two files - one you can put far out of reach unless you need to roll back to it, and a second working copy.
- Using UEFITool, open your working copy of the dump, and extract the AMITSESetup region, body only.
- Open the body in a hex editor.
- Find address 0x1f0, which should be set to 0x01. Replace this with 0x00
- Find address 0x1f1, which should be set to 0x00. Replace this with 0x01
- Find address 0x22e, which should be set to 0x01. Replace this with 0x00, and save the file.
- Using UEFITool, replace the body of AMITSESetup with the edited body you just saved.
- Save your working copy ROM.
- Using your flash programmer, write this back to the BIOS chip.
- Reassemble the device, and power it up. Spam the BIOS hotkey and enter the BIOS.
- You should now have a Security > Secure Boot menu option visible, allowing you to disable Secure Boot.
If it doesn't work, check if Backup AMITSESetup regions are present and also require updating.
An alternative version of this not involving flash programmers could be to sign your own EDKII shell binary and the AMISetupWriter.efi tool with your MOK, and from the EFI shell, invoke `AMISetupWriter.efi 0x22e 0x0` to enable the secure boot menu. Hard-power down the device after this, as exiting to the BIOS would put the vars back when it saves. This option is probably more dangerous, as it leaves you with no NVRAM backup, and the possibility you will typo the hex offset by accident.
Installation
Using pmbootstrap
As this is Generic-x86_64_(Generic-x86_64), you can follow Installation/Using pmbootstrap using the same steps. When asked for the device's vendor/codename, select generic as the vendor and x86_64 as the codename.
Post-Installation
At this stage, the device is not yet supported, so we have to make some manual fixes.
Adding your EFI shim
Appliccable only if you elected to not defeat secure-boot.
tbd. similar steps to how we prepared a usb earlier, copy your shim, certs, and preferred EFI bootloader into the actual disk's ESP.
Power Button Handling
On the FZ-B2B, there are three sources of button which will conflict:
- The regular power button
- Sends only 'KEY_POWER' events
- Buttons exposed by `intel_vbtn` module
- Sends all button events
- Buttons exposed by `panasonic_laptop` modules
- Sends all button events except `KEY_POWER`.
Due to platform limitations, the buttons pass through a 1ms press-and-release event. This means we do not have the luxury of being able to detect long-pressed buttons.
Out of these, it is recommended to blacklist the intel_vbtn module, this way, power button handling is kept by the power button device, and panasonic-specific quirks can remain handled by the panasonic_laptop driver.
# echo 'blacklist intel_vbtn' >> /etc/modprobe.d/blacklist.conf
Platform-specific notes
EFI Variables of note
Offset | Description | Default Value | Values | Remarks |
---|---|---|---|---|
0x1F0 | OS Selection | 0x1 | 0x0 - Windows 8.1 0x1 - Android 0x2 - Windows 7 |
Leave as Android for BIOS hotkey emulation on touchscreen to remain functional. |
0x1F1 | LPSS & SCC Devices Mode | 0x0 | 0x0 - ACPI Mode 0x1 - PCI Mode |
Leave as PCI mode, ACPI mode seems to cause hang on boot due to strange ACPI table implementation. |
0x22E | Secure Boot Items In Security Menu | 0x1 | 0x0 - Enable 0x1 - Disable |
Enable to see Secure Boot menu in BIOS |
GPS Option
GPS for this device is only present with specific models of Mobile Broadband option kit, and would be presented via whichever mechanisms the specific MBB card provides.
You can access option kit config from the BIOS menu using password 'toughkit', if fitting an option board.
Barcode Reader
Some configurations have a barcode reader. Unexplored but assume unsupported.
Internal Storage
FZ-B2B series ships with very slow eMMC storage, on an m.2 form factor card marked 'DFUP2328ZC PbF eMMC HF'. No other markings or identifiers are present on this m.2, and it looks custom for the FZ-B2.
This eMMC m.2 can be replaced by an m.2 SATA type SSD. NVMe types are not supported.
It is recommended to keep the original storage, in case you have a need to revert to the original OS, or to use MokMgr again as this is loaded from the inbuilt storage rather than on-ROM.
Access to the storage is via the silver panel on the rear of the device, with 6 screws to remove to access the bay.