Lenovo TB-X306F stuck booting to blank recovery

Search This thread

tmpodxlr

Member
Jun 17, 2022
9
1
Hello,

I was following some threads regarding flashing Magisk to root this tablet and managed to get it working after some trial and error and recovering with Lenovo's Rescue tool. I did not manage to flash TWRP successfully because there doesn't seem to be any port of it (I tried flashing the port for the X606 series, but didn't work).

I then tried to flash a Lineage GSI following this XDA guide, using the manual process, and after I did the factory reset from the system's UI, the tablet rebooted and is now always stuck on a black screen. Tried to reboot to recovery and bootloader using adb and the physical buttons, to no avail. Then I thought of checking what `adb devices` was reporting, and it turns out it's stuck on the recovery?

Code:
❱ sudo adb devices
List of devices attached
HA1MPS2C    recovery

Is there a way to fix this? Or did I screw up somewhere really badly?

Thanks in advance!
 

tmpodxlr

Member
Jun 17, 2022
9
1
Just took a peek with `adb shell` to read the `/tmp/recovery.log` file and found this repeating:

Code:
Starting TWRP 3.6.0_11-0-aafc82e8-dirty on Sat Jan  1 10:22:18 2011
 (pid 765)
RECOVERY_SDCARD_ON_DATA := true
I:Lun file '/sys/class/android_usb/android0/f_mass_storage/lun0/file' does not exist, USB storage mode disabled
TW_INCLUDE_CRYPTO := true
I:Find_File: Error opening '/sys/class/backlight'
I:Found brightness file at '/sys/class/leds/lcd-backlight/brightness'
I:Got max brightness 255 from '/sys/class/leds/lcd-backlight/max_brightness'
I:TWFunc::Set_Brightness: Setting brightness control to 255
I:TW_EXCLUDE_ENCRYPTED_BACKUPS := true
I:LANG: en
Starting the UI...
setting DRM_FORMAT_RGB565 and GGL_PIXEL_FORMAT_RGB_565
cannot find/open a drm device: No such file or directory
fb0 reports (possibly inaccurate):
  vi.bits_per_pixel = 32
  vi.red.offset   =   0   .length =   8
  vi.green.offset =   8   .length =   8
  vi.blue.offset  =  16   .length =   8
failed to mmap framebuffer: Invalid argument
I:TWFunc::Set_Brightness: Setting brightness control to 255
TW_SCREEN_BLANK_ON_BOOT := true
I:TWFunc::Set_Brightness: Setting brightness control to 0
ioctl(): blank: Bad file descriptor
ioctl(): blank: Bad file descriptor
I:TWFunc::Set_Brightness: Setting brightness control to 255
I:Loading package: splash (/twres/splash.xml)
I:Load XML directly
I:PageManager::LoadFileToBuffer loading filename: '/twres/splash.xml' directly
I:Checking resolution...
libc: Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 765 (recovery), pid 765 (recovery)
libc: Unable to set property "ro.twrp.boot" to "1": error code: 0xb
libc: Unable to set property "ro.twrp.version" to "3.6.0_11-0": error code: 0xb

So the failed TWRP is still there, and somehow always booting to it?
 
Last edited:

tmpodxlr

Member
Jun 17, 2022
9
1
Further development: I have tried flashing the stock recovery using `flash_image` through an adb shell, but with no success. It just spits out
Code:
failed with error: -1
I assume you cannot flash the recovery while in the recovery...?
I just don't understand how this started happening after I it did the factory reset from the booted Android UI.
 

tmpodxlr

Member
Jun 17, 2022
9
1
I finally solved this conundrum!

After digging around a bit more, I found this blog post on someone's website (thank you!) and tried it out.
In my case, I had /dev/block/platform/bootdevice/by-name/recovery but it still worked wonders.

In case that blog ever goes down, what you have to do is check that path and see if it matches. Like the post suggests, you can do DEV=$(ls /dev/block/platform/*/by-name/recovery); echo $DEV.
Then, it's a matter of using dd to dump the image onto that path, like this: dd of=$DEV if=/path/to/recovery.img (I put mine in /sdcard with adb push).
Finally, just reboot using adb reboot ... or using your device's physical buttons.

Hope this helps!
 

alecxs

Forum Moderator
Staff member
Feb 17, 2016
5,035
8
5,138
gitlab.com
if TWRP would be broken, you wouldn't be able to use adb shell.

system won't boot because avb/dm-verity detects modified partition (such as recovery) and will therefore send into recovery mode on unsuccessful boot. It's not the recovery blocking here, this would happen with every custom recovery no matter what file you flash, unless you disable dm-verity.

The TWRP used here is most likely targeting Android 11
 

tmpodxlr

Member
Jun 17, 2022
9
1
if TWRP would be broken, you wouldn't be able to use adb shell.

system won't boot because avb/dm-verity detects modified partition (such as recovery) and will therefore send into recovery mode on unsuccessful boot. It's not the recovery blocking here, this would happen with every custom recovery no matter what file you flash, unless you disable dm-verity.

The TWRP used here is most likely targeting Android 11
Oooh I see. So if I disable verity (with fastboot's --disable-verity, I assume), it could work?
I will have to try that, thank you for the response!