Teclast X98 Air 3G: cheap Intel Bay Trail tablet, getting acquainted

I got a Teclast X98 Air 3G tablet from Aliexpress, it costed 168 € ( with free shipping) and has a high-definition screen and it's an Intel Bay Trail device; so Android, x86 architecture, 2GiB of RAM and 32 GiB of storage on EMMC.

I think the product has some minor design issues:

  • the speakers are on the same side, the short side, not great when watching videos, but you want headphones or external speakers for better sound anyway;
  • when displaying content with a white background at medium brightness, the screen shows some —very light— yellowish gradient;
  • when using the leather cover the SIM slot and the MicroSD slot cannot be accessed, they are, well, covered;
  • the device does not rotate the screen automatically when booted in landscape mode, the android login screen is shown always in portrait mode at boot; this is inconvenient when booting the tablet while it's on the desk; BTW the firmware screens and the boot logos are also always shown in portrait mode, I guess that's OK for a tablet, but I would have picked a logo with some radial symmetry, or maybe drawn it at an angle, in order to alleviate the feeling of wrong orientation when booting with the device in landscape orientation;
  • the UEFI firmware informative screen is shown at boot, giving the boot experience and old PC feeling, or maybe I should say classic or familiar, I am not sure; this can be disabled in the firmware settings tho;

but beside that it's not bad considering the price, it's got HDMI output, 3G and a MicroSD slot (yeah, I'm lookin' right atch-ya, Google Nexuses...).

I eventually intend to run Debian on it, but let's take a look at the specs and do a full backup first.

Hardware and kernel support

Some info about the CPU:

ao2@localhost:~/WIP/Teclast $ adb shell cat /proc/cpuinfo | grep model\ name | uniq
model name      : Intel(R) Atom(TM) CPU  Z3736F @ 1.33GHz

On Debian unstable adb is available in the android-tools-adb package.

Here is the full dmesg log.

It's pretty easy to get it, as the device came pre-rooted:

ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell dmesg > dmesg-Teclast_X98_Air_3G.log

UEFI firmware backup (with flashrom)

The firmware configuration menu (Aptio Setup Utility) can be accessed by pressing ESC or DEL on a USB keyboard connected to the USB OTG adapter.

The version I have reports these informations:

BIOS Vendor                    American Megatrends
Core version                    5.008
Compliancy                      UEFI 2.3; PI 1.2
Project Version	                A3G069 1.01 x64
Build Date and Time	        08/29/2014 09:41:04
...

There are newer firmware versions available on the net, so if I am going to test them it's better to save the one I have right now.

Get and compile flashrom on an x86 host:

ao2@localhost:~/WIP/Teclast $ git svn clone svn://flashrom.org/flashrom/trunk flashrom
ao2@localhost:~/WIP/Teclast $ cd flashrom
ao2@localhost:~/WIP/Teclast/flashrom $ make NEED_FTDI=no NEED_USB=no CFLAGS=-static LDFLAGS=-static

Copy it on the target device and read the firmware:

  
ao2@localhost:~/WIP/Teclast/flashrom $ adb push flashrom /data
ao2@localhost:~/WIP/Teclast/flashrom $ cd ..
ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell
root@x98air3g_c6j6:/ # cd /data
root@x98air3g_c6j6:/data # ./flashrom -p internal -r Teclast_X98_Air_3G_IFWI_flashrom_dump.rom
flashrom v0.9.7-r1854 on Linux 3.10.20-g4a0098e-dirty (x86_64)
flashrom is free software, get the source code at http://www.flashrom.org

Calibrating delay loop... OK.
No DMI table found.
Found chipset "Intel Bay Trail". 
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
Thank you!
Enabling flash write... OK.
Found Winbond flash chip "W25Q64.W" (8192 kB, SPI) mapped at physical address 0x00000000ff800000.
Reading flash... done.

root@x98air3g_c6j6:/data # exit
ao2@localhost:~/WIP/Teclast $ adb pull /data/Teclast_X98_Air_3G_IFWI_flashrom_dump.rom

So flashrom can read the flash memory just fine, I haven't tried to write it yet, but I think I'll do it soon. Since it's an SPI flash there is a chance that it's reasonably easy to re-program it with an external programmer in case of a brick. I haven't taken the device apart yet to see what physical package the flash chip uses.

EMMC backup

The EMMC contains a GPT, the available partitions can be listed following the approach in this post, we get this:

unit :  sectors
/dev/mmcblk0p1   :  start    =  40,       size  =  131072,    Id=XX
/dev/mmcblk0p2   :  start    =  131112,   size  =  131072,    Id=XX
/dev/mmcblk0p3   :  start    =  262184,   size  =  32768,     Id=XX
/dev/mmcblk0p4   :  start    =  294952,   size  =  32768,     Id=XX
/dev/mmcblk0p5   :  start    =  327720,   size  =  32768,     Id=XX
/dev/mmcblk0p6   :  start    =  360488,   size  =  32768,     Id=XX
/dev/mmcblk0p7   :  start    =  393256,   size  =  131072,    Id=XX
/dev/mmcblk0p8   :  start    =  524328,   size  =  65536,     Id=XX
/dev/mmcblk0p9   :  start    =  589864,   size  =  32768,     Id=XX
/dev/mmcblk0p10  :  start    =  622632,   size  =  32768,     Id=XX
/dev/mmcblk0p11  :  start    =  655400,   size  =  32768,     Id=XX
/dev/mmcblk0p12  :  start    =  688168,   size  =  2097152,   Id=XX
/dev/mmcblk0p13  :  start    =  2785320,  size  =  65536,     Id=XX
/dev/mmcblk0p14  :  start    =  2850856,  size  =  2097152,   Id=XX
/dev/mmcblk0p15  :  start    =  4948008,  size  =  56115160,  Id=XX

And the corresponding partition labels are:

ao2@localhost:~/WIP/Teclast $  adb shell 'ls -l /dev/block/platform/intel/by-label/' | sort -t '>' -k 2.21n | column -t
lrwxrwxrwx  root  root  2014-11-20  13:38  ESP         ->  /dev/block/mmcblk0p1
lrwxrwxrwx  root  root  2014-11-20  13:38  reserved    ->  /dev/block/mmcblk0p2
lrwxrwxrwx  root  root  2014-11-20  13:38  boot        ->  /dev/block/mmcblk0p3
lrwxrwxrwx  root  root  2014-11-20  13:38  recovery    ->  /dev/block/mmcblk0p4
lrwxrwxrwx  root  root  2014-11-20  13:38  fastboot    ->  /dev/block/mmcblk0p5
lrwxrwxrwx  root  root  2014-11-20  13:38  reserved_1  ->  /dev/block/mmcblk0p6
lrwxrwxrwx  root  root  2014-11-20  13:38  test        ->  /dev/block/mmcblk0p7
lrwxrwxrwx  root  root  2014-11-20  13:38  panic       ->  /dev/block/mmcblk0p8
lrwxrwxrwx  root  root  2014-11-20  13:38  factory     ->  /dev/block/mmcblk0p9
lrwxrwxrwx  root  root  2014-11-20  13:38  misc        ->  /dev/block/mmcblk0p10
lrwxrwxrwx  root  root  2014-11-20  13:38  config      ->  /dev/block/mmcblk0p11
lrwxrwxrwx  root  root  2014-11-20  13:38  cache       ->  /dev/block/mmcblk0p12
lrwxrwxrwx  root  root  2014-11-20  13:38  logs        ->  /dev/block/mmcblk0p13
lrwxrwxrwx  root  root  2014-11-20  13:38  system      ->  /dev/block/mmcblk0p14
lrwxrwxrwx  root  root  2014-11-20  13:38  data        ->  /dev/block/mmcblk0p15

I didn't have an empty MicroSD card handy, so I used an external hard drive connected to the USB OTG adapter to strore the backups, I had to use adb via TCP/IP:

ao2@localhost:~/WIP/Teclast $ adb tcpip
ao2@localhost:~/WIP/Teclast $ adb connect 192.168.0.99
ao2@localhost:~/WIP/Teclast $ adb root
ao2@localhost:~/WIP/Teclast $ adb shell

And I ran this script:

#!/system/bin/sh

# The data partition is more than 20GiB, let's skip it.
find /dev/block/platform/intel/by-label -type l | grep -v '/data$' |
while read partition;
do
  OUTPUT_FILE="/storage/usbcard1/$(basename "$partition").img"

  echo "Dumping '$partition' to '$OUTPUT_FILE'"
  dd if="$partition" of="$OUTPUT_FILE"
done

First quick inspection

There are some Android bootimgs (boot, fastboot, recovery) which can be modified with these Bootimg-scripts, I noticed that the kernel is compiled for a 32-bit architecture.

Some ext4 filesystems (cache, config, factory, logs, system).

Some raw data partitions (misc, panic, reserved_1, reserved, test).

The ESP partition is the UEFI boot partition (EFI System Partition), it's a FAT32 filesystem and can be loop-mounted with no problems.

A quick analysis with binwalk shows that this partition contains some 800x1000 bitmaps:

ao2@localhost:~/WIP/Teclast $ binwalk ESP.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1051648       0x100C00        Microsoft portable executable
1149888       0x118BC0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
2465927       0x25A087        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size
3620864       0x374000        Microsoft portable executable
3676128       0x3817E0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
4992167       0x4C2CA7        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size
6100480       0x5D1600        Microsoft portable executable
6198720       0x5E95C0        PC bitmap, Windows 3.x format, 800 x 1000 x 24
7514759       0x72AA87        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size

The pictures can be spotted with a really rough approach using rawtoppm from netpbm:

  ao2@localhost:~/WIP/Teclast $ rawtoppm -bgr 800 $(($(stat -c "%s" ESP.img) / 3 / 800)) ESP.img > ESP.ppm

It turns out that all the three pictures are equal: it's the logo shown at boot right after the UEFI firmware screen.

The logo is contained once in each of the EFI binaries:

ao2@localhost:~/WIP/Teclast $ mkdir ESP
ao2@localhost:~/WIP/Teclast $ sudo mount -o loop ESP.img ESP/
ao2@localhost:~/WIP/Teclast $ find ESP/
ESP/
ESP/EFI
ESP/EFI/Intel
ESP/EFI/Intel/Data
ESP/EFI/Intel/efilinux.efi
ESP/EFI/Intel/warmdump.efi
ESP/EFI/BOOT
ESP/EFI/BOOT/bootx64.efi
ao2@localhost:~/WIP/Teclast $ binwalk ESP/EFI/BOOT/bootx64.efi

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Microsoft portable executable
98240         0x17FC0         PC bitmap, Windows 3.x format, 800 x 1000 x 24
1414279       0x159487        LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, missing uncompressed size

ao2@localhost:~/WIP/Teclast $ dd if=ESP/EFI/BOOT/bootx64.efi of=boot_logo.bmp skip=$((0x0017fc0)) count=$((800 * 1000 * 3 + 0x36)) iflag=count_bytes,skip_bytes
ao2@localhost:~/WIP/Teclast $ sudo umount ESP

firmware splash logo

I guess the logo can be pretty easily replaced with a custom one, but I haven't done that yet.

Maybe the EFI binaries just display the logo and then boot an Android boot image from the right partition, depending on the boot option.

The tablet has three boot options:

  1. normal boot (just quick press the power button);
  2. DROIDBOOT PROVISION OS (quick press the power button and keep pressed for a while the volume-down key);
  3. DnX mode, accepting fastboot commands (quick press the power button and keep pressed both volume keys for a while);

and there are three efi binaries, are these things connected?

I need to learn more about how this UEFI thing works in order to confirm that.

Just to conclude the boot-logos-analysis™, the device shows three logos during the boot sequence:

  1. the generic Teclast t-pad logo mentioned before;
  2. an animated logo referring the X98 Air 3G device, it's in Chinese but it's pretty straightforward to see that, even with zero knowledge of the language;
  3. an Intel-Inside logo.

The last two logos are boot animations, fired up one after the other by the bootanim service invoked by the init.rc file that is on the boot partition; the animation data is taken from the system partition, it's in the media/bootanimation.zip file: just PNGs, one per frame.

Pictures attached below.

So after some hours of looking I found that it'd be super easy to customize the root filesystem and even all the logos of the boot sequence; however what I really want to do is to load a custom kernel, but that's meat for another day.

boot logo 1
boot logo 2
Attached files: 

CommentsSyndicate content

Hi, great review, I bought

TopDiGamma.it's picture

Hi,
great review,
I bought this tablet version ID: c8j7 with American Megatrends Bios
build number V2.00_20141106
have you updated it to the latest version of the tablet firwmare?
Can you write to me your build number?
I tried the manual update with Flash Tool Manufacturing
but it is aborted:
INFO: Port 0/4/2 # 0: Booting to droidboot.img success - SN: Baytrail06CB0580
ERROR: Port 0/4/2 # 0: Device on port 0/4/2 # 0 to enum adb timeout (TIMEOUT = 180)

Also my tablet does not reboot in droidboot mode,
when I press volume- and power the tablet starts in normal boot.

My tablet is reboot in droidboot mode only when I tried to flash the official firmware using the tool to obtain root permissions (in toolbox the function Firmware Flash tablet using fastboot):
http://www.slatedroid.com/topic/105914-toolbox-for-install-windows-and-r...
but it did not work, work only to obtain root permission

Can You give me some suggestions on how to install firwmare with Flash Tool Manufacturing or using another mode?
If I reboot into recovery mode I find written "apply update from AD"B can I use this mode to install the latest version of firmware?
Thanks and sorry for my bad English but I use google translator.

My unit has the ID c6j6. I

ao2's picture

My unit has the ID c6j6.

I haven't updated the firmware yet; and instead I broke it by setting some options in the firmware menu which now makes the device reset at boot and USB host is not working either, so I cannot enter the firmware menu anymore. I think I have to flash the firmware with an external programmer; for the records the chip is a W25Q64FW SPI flash, coming in a SOIC-8 package.

About FPT: before I broke the firmware I found out that on my unit there is a copy installed under /system/bin/fpt-tools-package/ and I can run FPT from adb shell when I am root, and it works fine.

If you want to talk more about the tablet in Italian feel free to write me an email.

Ciao, Antonio

Mi sono reso conto solo dopo

TopDiGamma.it's picture

Mi sono reso conto solo dopo aver inserito il commento che sei italiano, quindi se ti va puoi rispondermi anche in italiano, grazie ciao.

Hi, May I know where to get

kong's picture

Hi, May I know where to get the latest American Megatrends BIOS firmware? Do you have the latest BIOS?

Thanks.

Hi, I only have the UEFI

ao2's picture

Hi, I only have the UEFI firmware which came with the device. To be precise it's not technically a BIOS, even if the user interface looks like one.

You can find more recent ones on the Teclast forums, you may have to use a translator like Bing to read it, Google translator did not work for me.

Ciao, Antonio

Hi, All my respect for the

AnOkRoS's picture

Hi,

All my respect for the awesome job done until now !!!

i just want to know if you have succeed on you customization (boot logo, Vanilla, etc)
Very interested by this tablet , please let me know.

Hi there i was wondering if

coolboy101's picture

Hi there
i was wondering if windows 8 can be installed on
CHUWI V99i Tablet with Intel Atom Z3735D ,2gb ram and 16 gb rom.

colorfly i977A.it has Baytrail-T Z3735F, 2G ram, 64G rom, Android 4.4, 5.0MP Camera, Bluetooth and GPS.

Many windows tablets have same specifications. i really dont know if these tablet shipped with uefi bios.

You should ask the

ao2's picture

You should ask the manufacturer, I don't know if the firmware of your device allows installing/booting Windows and if there are Windows drivers ready for your tablet.

I have no interest in Windows, sorry

Ciao, Antonio

Hello i was struggling making

olivier's picture

Hello

i was struggling making fedlet ( fedora for baytrail with 32bit UEFI ) working.

by switching the the UEFI shell from the ami bios i discover pretty much the same as you, looks like this tablet is shipping a 64bit uefi bios.

with a 64bit uefi boot , I have been able to boot to grub then to dracut but it fail at the fact that the kernel is loosing the USB devices.

i think vanilla kernel is missing this patch

usb-make-xhci-platform-driver-use-64-bit-or-32-bit-D.patch

i hope someday we will be able to use proper linux on it.

ciao

Hi Olivier, I can get the

ao2's picture

Hi Olivier,

I can get the mainline linux kernel to a useful state by tuning the configuration before building the kernel.

I am also hacking the DSDT a fair bit in order to actually make ACPI useful on this device. Contact me privately for details, the work is not ready yet to be shared publicly.

For the USB problem in particular it's the handover from device to host which seems to be failing, I am working around that by having the xhci driver built in, i.e.:

CONFIG_USB_XHCI_HCD=y
CONFIG_USB_XHCI_PCI=y
CONFIG_USB_XHCI_PLATFORM=y
...
CONFIG_USB_DWC3=y
CONFIG_USB_DWC3_HOST=y
...
CONFIG_USB_DWC3_PCI=y
...
CONFIG_DWC3_HOST_USB3_LPM_ENABLE=y

Ciao, Antonio

i am building at now a

olivier's picture

i am building at now a modified version of kernel 4.0.0-1.x86_64 with patches for the Dell Venue 8 Pro.

if will cross check these config options. Thanks.

i be back when i get something new.

ciao

hello By using fedlet and

olivier's picture

hello

By using fedlet and adding the proper config options i have been able to boot my livecd up to a gnome session (with kernel 4.0).

the intel kms driver is working but the touch-screen , accelerometer, wifi and sleep state are not working.

i see you are experimenting with the acpi table , any luck on this side ?

ciao

Hi Olivier, my DSDT hacks

ao2's picture

Hi Olivier,

my DSDT hacks are here: http://git.ao2.it/Teclast-X98-Air-3G_C6J6_custom_DSDT.git/

Mind that if you want to use this DSDT on your firmware you have to check that the following Operation Region does NOT get changed:

OperationRegion (GNVS, SystemMemory, ...

See also this thread: http://thread.gmane.org/gmane.linux.acpi.devel/73176

With these changes I got the touch-screen and the accelerometer working, but the touch-screen driver needs a patch which I am still testing, contact me privately if you want it.

I haven't tested the sleep states.

For the wifi driver look here: https://wiki.gnome.org/BastienNocera/Ondav975w

Hi, Did you manage to replace

Joakim's picture

Hi,

Did you manage to replace all the boot logos? Would like to switch all the logos, including the first one you get before selecting OS. Is this possible? If so, how do I do this, please explain how to replace the boot logos shown after selecting Android or Windows too!

Do you know if it is possible to customize the OS Selector?

Thank you!

Hi Joakim, It should be easy

ao2's picture

Hi Joakim,

It should be easy to replace the boot logos, just use the same format and put the new ones at the same offsets in the efi binaries in the ESP partition. You can use dd for that, just read the manual.

I have not done it tho.

The post-boot ones are even easier, look for tutorials about how to create media/bootanimation.zip.

I do not know much about the new dual-OS firmwares and the OS-Selector, my analysis was done on some older firmware release.

Ciao, Antonio

How's Linux going? Do suspend

wzhd's picture

How's Linux going? Do suspend and hibernate work now? I'm looking forward to the publishing of your work.

Hi wzhd, audio is almost

ao2's picture

Hi wzhd, audio is almost working now. I haven't tested suspend and hibernate.

I hope to find some time soon to fix the remaining audio issues and then I will try to blog about the status.

Thanks for your interest.

Ciao ciao, Antonio

Hi, Thanks for your

Anonymous's picture

Hi,

Thanks for your post. I was trying to follow the same steps as above where I tried compiling flashrom on an x86 machine and then pushed it to my x86 tablet using adb push as shown above, but doesn't seem like that worked for me. I was under the impression that, one has to recompile it on android on x86 using NDK for flashrom to work(Because the libraries that flashrom would need on a Linux machine may or may not be available on android) Could you please throw some light on how you pushed it to android and made it work?

Hi, if you read the command

ao2's picture

Hi,

if you read the command line I used to compile flashrom you see that I built a static binary: make NEED_FTDI=no NEED_USB=no CFLAGS=-static LDFLAGS=-static.

Using static linking was enough for me to have flashrom running on the Android tablet without depending on the host dynamic libraries.

Ciao, Antonio

Post new comment

The content of this field is kept private and will not be shown publicly. If you have a Gravatar account associated with the e-mail address you provide, it will be used to display your avatar.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
y
4
y
S
a
E
Enter the code without spaces.