tb323fu-linux t51

tb323fu-linux t51 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

7.3.0-rc4-tb323fu-t51: mainline v7.3-rc4 + patches 0001–0132 (kernel/patches),
tb323fu-linux 43ee432. What works: docs/hardware-status.md.

What's new

Patches 0131 and 0132 on top of kernel-t49 (same configuration):

• Night light without the blink: setting or clearing a colour matrix (CTM) no longer forces a full modeset once
  the display has its colour block (DSPP), so a night-light fade no longer turns the panel off and on at the start and
  the end. One modeset remains for the first CTM after boot; a compositor that sets an identity CTM with its first
  modeset avoids that too (patch 0131).
• Charge current limit: the battery manager's fast-charge current limit is readable and writable as
  /sys/class/power_supply/qcom-battmgr-bat/constant_charge_current (µA, up to constant_charge_current_max)
  (patch 0132). With it, Open Device Helper 0.4.2's Bypass keeps the charger at 9 V (about 21 W) instead of letting
  the firmware drop to 5 V (about 12 W): the battery takes ~85 mA and still helps under heavy load. Do not write 0:
  the firmware then stops charging until the charge limit is crossed again.
• dsiN: pclk=… byteclk=… is no longer printed for every DSI command (it filled the log).

Still true

• The CPU cluster idle state stays out of runtime idle (patch 0118, cpuidle_psci_domain.allow_cluster_off=0): with
  it the tablet reset when left idle. Suspend still uses it.
• No USB root shell in release images (how to build one).
• No firmware inside: drivers that start before the root (GPU, Bluetooth) log a missing-firmware error and recover
  once it is mounted (details).

Install

• With Open Device Helper: tb323fu-ctl kernel update (or About → Kernel Updates). It runs the kernel on trial
  and goes back by itself if it does not start.
• By hand: python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t51 linux-boot.img, then write it to
  boot_a (docs/install.md).
  There is no ready-made boot.img: its header and signatures are Lenovo's and must match your tablet.
• If it does not boot: hold volume up + down for 10 s to return to Android, or restore boot_a over EDL
  (docs/recovery.md).

You provide: your stock boot.img, the firmware from your own tablet
(firmware/), and
/etc/tb323fu/android-boot.sha256 for the way back to Android.

Files

File
Image-tb323fu-t51	the kernel (device tree, command line, initramfs and all 830 modules built in)
Image-tb323fu-t51.gz	the same, compressed; what the helper downloads
modules-tb323fu-t51.tar.gz	the modules alone, only for a root set to own modules
boot-repack-kernel.py	puts the kernel into your stock boot image
config-tb323fu-t51, initramfs-t51.list, initramfs-t51.files	kernel configuration, initramfs contents
busybox-1.36.1.config, busybox-1.36.1.tar.bz2, THIRD-PARTY-NOTICES.txt	source, configuration and licences of the initramfs' third-party files
SHA256SUMS	checksums (not a signature)

Source code (GPL)

• Kernel: torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + kernel/patches
  at 43ee4326e14c89bd2f9668d7969e8a2f37527d07; configuration config-tb323fu-t51 = defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment, baldur-display.fragment, baldur-netfilter.fragment, baldur-extra.fragment.
    Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs, userspace/platform/src/keyhold.c, android/back-to-android.
• BusyBox 1.36.1 (GPL-2.0), unmodified, source attached (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314);
  static aarch64 binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7.
• Terminus Font (SIL OFL 1.1, console), wireless-regdb regulatory.db (ISC, sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b).

Licences of the repository: NOTICE. Modified builds use their own name: TRADEMARKS.md.

Open Device Helper 0.4.2

Open Device Helper 0.4.2

• Bypass keeps the charger at full power: with kernel t51 or newer (charge current limit, patch 0132), Bypass
  holds the battery with a small charge current (100 mA by default) instead of lowering the charge limit, so the USB PD
  contract stays at 9 V (about 21 W) instead of dropping to 5 V (about 12 W). The battery still helps when the load is
  over what the charger gives. Battery → Bypass Method / Bypass Current in the app, tb323fu-ctl bypass method auto|current|limit and tb323fu-ctl bypass current MA; older kernels keep the old way.
• Stalled charging is restarted: when the firmware stops charging by itself below the limit, the helper starts it
  again (Battery → Restart Stalled Charging, tb323fu-ctl battery stall-rescue on|off).
• Fixed: a connected Bluetooth mouse's battery was taken for the tablet's (wrong charge and a 100 % limit in the app
  and quick settings). About shows the kernel's patch series again instead of "unknown".

Files

File	What
tb323fu-helper-0.4.2-aarch64.tar.gz	the helper's self-update (a MANIFEST plus the files install.sh installs under /usr/local)
tb323fu-platform_0.4.2_arm64.deb	layer 1: udev rules, systemd units, audio routing (UCM), sensors, emergency key, back-to-android
tb323fu-helper_0.4.2_arm64.deb	tb323fu-helperd (system D-Bus service, polkit), tb323fu-ctl and tb323fu-mesa
tb323fu-settings_0.4.2_arm64.deb	the Open Device Helper app (GTK 4 / libadwaita)
tb323fu-helper-gnome_0.4.2_all.deb	the GNOME Shell quick-settings extension

The Debian packages go into a root built with rootfs/ubuntu/build-rootfs.sh (DEBS_FROM=, which
tools/install/install.sh does), or sudo apt install ./tb323fu-*.deb on a running Debian 13 / Ubuntu 26.04 root.
Built on Debian 13 (trixie, arm64) from commit 43ee432; needs glibc 2.39 or newer. What changed:
helper/CHANGELOG.md.
SHA256SUMS catches a damaged download; it is not a signature.

tb323fu-linux t49

tb323fu-linux t49 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

7.3.0-rc4-tb323fu-t49: mainline v7.3-rc4 + patches 0001–0130 (kernel/patches),
tb323fu-linux 1866984. What works: docs/hardware-status.md.

What's new

Same patches as kernel-t47; the configuration gains kernel/config/baldur-extra.fragment:

• Devices and file systems: exFAT, NTFS3, btrfs, CIFS, ISO 9660/UDF, EROFS; Xbox, PlayStation, Nintendo and Steam
  controllers, Logitech HID++, Apple, Microsoft and Wacom; USB UAS, phone tethering (RNDIS), CH341/PL2303 serial,
  printers; the tablet as a USB webcam or MIDI device (gadget).
• Waydroid: binderfs. Wine/Proton: ntsync. Network: BBR, fq_codel, cake, kTLS, MPTCP.
• Memory: MGLRU (on), zswap and zstd/lz4 for zram (off until you enable them), userfaultfd.
• Tracing: BTF for the kernel (bpftrace, sched_ext), kprobes, the function tracer.
• Virtual devices for tests: vkms (load with create_default_dev=0 and build devices in configfs, or it takes card0),
  snd-dummy, dummy_hcd, vivid/vimc, gpio-sim.
• Behaviour changes: Yama is active (ptrace_scope 1: a debugger attaches only to its own children unless root).
  SELinux and AppArmor are built in but not enabled.
• The Image grew from 56 to 74 MB.

Still true

• The CPU cluster idle state stays out of runtime idle (patch 0118, cpuidle_psci_domain.allow_cluster_off=0): with
  it the tablet reset when left idle. Suspend still uses it.
• No USB root shell in release images (how to build one).
• No firmware inside: drivers that start before the root (GPU, Bluetooth) log a missing-firmware error and recover
  once it is mounted (details).

Install

• With Open Device Helper: tb323fu-ctl kernel update (or About → Kernel Updates). It runs the kernel on trial
  and goes back by itself if it does not start.
• By hand: python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t49 linux-boot.img, then write it to
  boot_a (docs/install.md).
  There is no ready-made boot.img: its header and signatures are Lenovo's and must match your tablet.
• If it does not boot: hold volume up + down for 10 s to return to Android, or restore boot_a over EDL
  (docs/recovery.md).

You provide: your stock boot.img, the firmware from your own tablet
(firmware/), and
/etc/tb323fu/android-boot.sha256 for the way back to Android.

Files

File
Image-tb323fu-t49	the kernel (device tree, command line, initramfs and all 830 modules built in)
Image-tb323fu-t49.gz	the same, compressed; what the helper downloads
modules-tb323fu-t49.tar.gz	the modules alone, only for a root set to own modules
boot-repack-kernel.py	puts the kernel into your stock boot image
config-tb323fu-t49, initramfs-t49.list, initramfs-t49.files	kernel configuration, initramfs contents
busybox-1.36.1.config, busybox-1.36.1.tar.bz2, THIRD-PARTY-NOTICES.txt	source, configuration and licences of the initramfs' third-party files
SHA256SUMS	checksums (not a signature)

Source code (GPL)

• Kernel: torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + kernel/patches
  at 186698482f51484d8da2df790798b9ef23a854ec; configuration config-tb323fu-t49 = defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment, baldur-display.fragment, baldur-netfilter.fragment, baldur-extra.fragment.
    Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs, userspace/platform/src/keyhold.c, android/back-to-android.
• BusyBox 1.36.1 (GPL-2.0), unmodified, source attached (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314);
  static aarch64 binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7.
• Terminus Font (SIL OFL 1.1, console), wireless-regdb regulatory.db (ISC, sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b).

Licences of the repository: NOTICE. Modified builds use their own name: TRADEMARKS.md.

tb323fu-linux t47

tb323fu-linux t47 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

Kernel: 7.3.0-rc4-tb323fu-t47 — Linux version 7.3.0-rc4-tb323fu-t47 (tb323fu@build) (Ubuntu clang version 18.1.3 (1ubuntu1), Ubuntu LLD 18.1.3) #1 SMP PREEMPT Thu Oct 8 15:41:41 UTC 2026

Mainline Linux v7.3-rc4 with the 129 patches 0001–0130 of kernel/patches,
built from tb323fu-linux commit 0c7c0c477d4fbd1f223737d553ab2014f6879209. What works and what does not: docs/hardware-status.md.

Read this first

• Fixes the Bluetooth address changing after Bluetooth is turned off and on (patch 0130). The controller got its
  address (the one in /etc/tb323fu/bt-address) at boot, but after the adapter was powered off and on — the
  Bluetooth switch, bluetoothctl power, a bluetoothd restart, rfkill — it came back with the placeholder address
  78:55:00:01:5A:AD from the firmware's NVM file, and paired devices (bonded to the real address) no longer
  connected until a restart. Tested: 3 power cycles, a bluetoothd restart and an rfkill block/unblock all keep the
  address, and a paired keyboard reconnects by itself after the switch. Upstream status of each patch:
  kernel/PROVENANCE.md.
• Includes the storage hang fix from kernel-t46 (patch 0129).
• CPU cluster idle state left out of runtime idle (patch 0118). With it the tablet reset when left idle
  (twice in 78 minutes); this kernel's built-in command line sets cpuidle_psci_domain.allow_cluster_off=0, and the
  tablet then ran 3 hours idle without a reset at the same display-off power. Suspend (s2idle) still uses the state;
  the cause in its power-down path is not fixed.
• CPU capacities (patch 0117): the device tree describes the big and little cores, so the scheduler places
  tasks by capacity (energy-aware scheduling).
• No USB root shell. Development images open a root shell without password on the USB serial port and telnet
  over USB networking while the initramfs runs; this release does not (the USB gadget itself is still set up, so a
  root's serial getty and usb0 networking work). To turn it on for recovery work, build your own image: the
  initramfs with kernel/initramfs/build.sh -u, or the kernel with tb323fu.usbshell=1 added to CONFIG_CMDLINE
  (kernel/initramfs/README.md). Anyone with a cable
  gets root while that shell runs.
• If it does not boot: the boot summary on the panel says how far it got. Holding volume up + down for 10 s
  restores Android from boot_b (needs the Android image hash, below). Otherwise write your saved Android boot.img
  back to boot_a from a PC in EDL mode (fastboot is read-only on this bootloader):
  docs/recovery.md.

What is in this release

File	What
Image-tb323fu-t47	the kernel as a raw arm64 Image, with its device tree, command line and initramfs built in — and all its modules: the initramfs carries lib/modules/7.3.0-rc4-tb323fu-t47 (782 modules, the out-of-tree speaker amplifier driver in extra/) as a squashfs and mounts it on /lib/modules/7.3.0-rc4-tb323fu-t47 of the root it boots, so the roots need no modules of their own
Image-tb323fu-t47.gz	the same kernel, gzip-compressed (the bootloader decompresses it); the helper's kernel updates download this one
modules-tb323fu-t47.tar.gz	the same modules tree as a tarball — only for a root that opts out of the shared modules (own in its /etc/tb323fu/modules); normally not needed
boot-repack-kernel.py	puts Image-tb323fu-t47 into your own stock boot image (Python 3, no dependencies; same as tools/boot-repack-kernel.py)
config-tb323fu-t47	the kernel .config
initramfs-t47.list, initramfs-t47.files	the initramfs: gen_init_cpio list and file list
busybox-1.36.1.config	configuration of the BusyBox binary in the initramfs
busybox-1.36.1.tar.bz2	the complete source of that BusyBox binary (the unmodified upstream tarball)
THIRD-PARTY-NOTICES.txt	copyright and license texts of the third-party files in the initramfs (BusyBox, wireless-regdb, Terminus Font)
SHA256SUMS	checksums of all of the above (they catch a damaged download; they are not a signature)

There is no ready-made boot.img, on purpose. A boot image for this tablet is the stock image with only the kernel
replaced: its header, Lenovo's GKI boot signature and the vbmeta/AVB footer are copied from a stock boot.img. Those
blobs are Lenovo's, not ours to redistribute, and they have to match the firmware version and region of your
tablet. So you build the image yourself, from the stock boot.img you saved during the backup step:

python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t47 linux-boot.img

tools/install/install.sh boot does this for you. Install: see docs/install.md
(repacked image → boot_a; nothing is installed into the roots).

Already running Linux with Open Device Helper? tb323fu-ctl kernel update (or About → Kernel Updates in the
settings app) installs this release the same way, runs it on trial and goes back to the previous kernel by itself if
it does not start (docs/helper.md).

What you must provide

• Firmware — none is included. Vendor firmware may not be redistributed. Extract it from your own tablet with
  firmware/extract-on-device.sh
  (the list is firmware/manifest.tsv) and put it into each root's /lib/firmware (the root builders do this).
  The initramfs carries only regulatory.db (wireless-regdb, ISC).
• The Android image hash for the emergency way back (volume up + down held 10 s): /etc/tb323fu/android-boot.sha256
  on baldur-root (or baldur-root-sd). Without it the chord does nothing in the initramfs.
• Your own stock boot.img (saved in the backup step, docs/install.md) to repack Image-tb323fu-t47 into.

Firmware-free initramfs: what that means

Drivers that probe before a root is mounted cannot find their firmware in this image (measured on the tablet; table in
kernel/initramfs/README.md):

• Wi-Fi (ath12k) is a module: udev loads it from the root, where the firmware is, so it comes up with the root
  (no Wi-Fi in the initramfs itself).
• GPU and Bluetooth log a missing-firmware error in the initramfs and recover after the root is mounted.
• Touch is loaded by the root (udev), not by the initramfs; the initramfs' touch echo is not available.
• The boot summary's GPU line is empty (the GPU has no firmware yet at that point).

Source code (GPL)

• Kernel: upstream torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + the patch series in
  kernel/patches of tb323fu-linux kernel-t47
  (commit 0c7c0c477d4fbd1f223737d553ab2014f6879209); configuration: config-tb323fu-t47 (= defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment + kernel/config/baldur-display.fragment + kernel/config/baldur-netfilter.fragment, CONFIG_LOCALVERSION="-tb323fu-t47",
    built with make LOCALVERSION=). Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0, Awinic): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs (init, build.sh; gpu-probe.c GPL-2.0),
  userspace/platform/src/keyhold.c, android/back-to-android; file list initramfs-t47.list.
• BusyBox 1.36.1 (GPL-2.0), unmodified: the source is attached to this release as busybox-1.36.1.tar.bz2
  (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314, the same file as https://busybox.net/downloads/busybox-1.36.1.tar.bz2),
  configuration busybox-1.36.1.config, static aarch64 build (binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7).
• Console font: console-setup Lat15-Terminus28x14 (Terminus Font, SIL OFL 1.1).
• regulatory.db: wireless-regdb (ISC), sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b.

Copyright and license texts of these third-party files: THIRD-PARTY-NOTICES.txt.

Licenses of the repository's parts: NOTICE.
Redistributors: modified builds use their own name, see TRADEMARKS.md.

Checksums

6b1a2b0f5bdeaa9e862fade84ccd877518681a3c0cb4d1a2df8eb56031ccff19  Image-tb323fu-t47
44d6a1751b3cc92b5ee87c912e58f71f496227c692fcdc1e7feb0c4bb0346175  Image-tb323fu-t47.gz
b4b4731ff05453639a7e2fad65fd61ef78167cd4f40d278f3d092b7fd82fe529  modules-tb323fu-t47.tar.gz
050c00865c257786fa84be475762f50c1dfe0dde1628bdf9233c7a1f6cc4bada  config-tb323fu-t47
1ff5c1917f927bddfd504340f56ecfb9307247592435a88e998a999169c5e296  initramfs-t47.list
70784378de7eaa64af2221a15d48189a9573d45f81a5a630d6...

tb323fu-linux t46

tb323fu-linux t46 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

Kernel: 7.3.0-rc4-tb323fu-t46 — Linux version 7.3.0-rc4-tb323fu-t46 (tb323fu@build) (Ubuntu clang version 18.1.3 (1ubuntu1), Ubuntu LLD 18.1.3) #1 SMP PREEMPT Thu Oct 8 11:06:33 UTC 2026

Mainline Linux v7.3-rc4 with the 128 patches 0001–0129 of kernel/patches,
built from tb323fu-linux commit db7f8a9c3ab3d25550a51aed910bda8f1a77c08c. What works and what does not: docs/hardware-status.md.

Read this first

• Fixes a storage hang that restarted the tablet (patch 0129). Clock scaling of the storage controller and a
  storage management command (a query from the kernel or from sysfs) could wait for each other forever: all storage
  I/O stopped, and about a minute later the hung task check restarted the tablet. It happened after hours of normal
  use on kernel-t43; a stress test (load bursts that make the clock scale, plus back-to-back queries) hung
  kernel-t43 within 10 s. 0129 takes the clock scaling lock before stopping the queues; every earlier
  kernel of this project has the bug (it came with Linux 6.19). Tested: the same stress test, 2 × 600 s and
  about 700 clock changes, without a hang or a storage error. Upstream status of each patch:
  kernel/PROVENANCE.md.
• CPU cluster idle state left out of runtime idle (patch 0118). With it the tablet reset when left idle
  (twice in 78 minutes); this kernel's built-in command line sets cpuidle_psci_domain.allow_cluster_off=0, and the
  tablet then ran 3 hours idle without a reset at the same display-off power. Suspend (s2idle) still uses the state;
  the cause in its power-down path is not fixed.
• CPU capacities (patch 0117): the device tree describes the big and little cores, so the scheduler places
  tasks by capacity (energy-aware scheduling).
• No USB root shell. Development images open a root shell without password on the USB serial port and telnet
  over USB networking while the initramfs runs; this release does not (the USB gadget itself is still set up, so a
  root's serial getty and usb0 networking work). To turn it on for recovery work, build your own image: the
  initramfs with kernel/initramfs/build.sh -u, or the kernel with tb323fu.usbshell=1 added to CONFIG_CMDLINE
  (kernel/initramfs/README.md). Anyone with a cable
  gets root while that shell runs.
• If it does not boot: the boot summary on the panel says how far it got. Holding volume up + down for 10 s
  restores Android from boot_b (needs the Android image hash, below). Otherwise write your saved Android boot.img
  back to boot_a from a PC in EDL mode (fastboot is read-only on this bootloader):
  docs/recovery.md.

What is in this release

File	What
Image-tb323fu-t46	the kernel as a raw arm64 Image, with its device tree, command line and initramfs built in — and all its modules: the initramfs carries lib/modules/7.3.0-rc4-tb323fu-t46 (782 modules, the out-of-tree speaker amplifier driver in extra/) as a squashfs and mounts it on /lib/modules/7.3.0-rc4-tb323fu-t46 of the root it boots, so the roots need no modules of their own
Image-tb323fu-t46.gz	the same kernel, gzip-compressed (the bootloader decompresses it); the helper's kernel updates download this one
modules-tb323fu-t46.tar.gz	the same modules tree as a tarball — only for a root that opts out of the shared modules (own in its /etc/tb323fu/modules); normally not needed
boot-repack-kernel.py	puts Image-tb323fu-t46 into your own stock boot image (Python 3, no dependencies; same as tools/boot-repack-kernel.py)
config-tb323fu-t46	the kernel .config
initramfs-t46.list, initramfs-t46.files	the initramfs: gen_init_cpio list and file list
busybox-1.36.1.config	configuration of the BusyBox binary in the initramfs
busybox-1.36.1.tar.bz2	the complete source of that BusyBox binary (the unmodified upstream tarball)
THIRD-PARTY-NOTICES.txt	copyright and license texts of the third-party files in the initramfs (BusyBox, wireless-regdb, Terminus Font)
SHA256SUMS	checksums of all of the above (they catch a damaged download; they are not a signature)

There is no ready-made boot.img, on purpose. A boot image for this tablet is the stock image with only the kernel
replaced: its header, Lenovo's GKI boot signature and the vbmeta/AVB footer are copied from a stock boot.img. Those
blobs are Lenovo's, not ours to redistribute, and they have to match the firmware version and region of your
tablet. So you build the image yourself, from the stock boot.img you saved during the backup step:

python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t46 linux-boot.img

tools/install/install.sh boot does this for you. Install: see docs/install.md
(repacked image → boot_a; nothing is installed into the roots).

Already running Linux with Open Device Helper? tb323fu-ctl kernel update (or About → Kernel Updates in the
settings app) installs this release the same way, runs it on trial and goes back to the previous kernel by itself if
it does not start (docs/helper.md).

What you must provide

• Firmware — none is included. Vendor firmware may not be redistributed. Extract it from your own tablet with
  firmware/extract-on-device.sh
  (the list is firmware/manifest.tsv) and put it into each root's /lib/firmware (the root builders do this).
  The initramfs carries only regulatory.db (wireless-regdb, ISC).
• The Android image hash for the emergency way back (volume up + down held 10 s): /etc/tb323fu/android-boot.sha256
  on baldur-root (or baldur-root-sd). Without it the chord does nothing in the initramfs.
• Your own stock boot.img (saved in the backup step, docs/install.md) to repack Image-tb323fu-t46 into.

Firmware-free initramfs: what that means

Drivers that probe before a root is mounted cannot find their firmware in this image (measured on the tablet; table in
kernel/initramfs/README.md):

• Wi-Fi (ath12k) is a module: udev loads it from the root, where the firmware is, so it comes up with the root
  (no Wi-Fi in the initramfs itself).
• GPU and Bluetooth log a missing-firmware error in the initramfs and recover after the root is mounted.
• Touch is loaded by the root (udev), not by the initramfs; the initramfs' touch echo is not available.
• The boot summary's GPU line is empty (the GPU has no firmware yet at that point).

Source code (GPL)

• Kernel: upstream torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + the patch series in
  kernel/patches of tb323fu-linux kernel-t46
  (commit db7f8a9c3ab3d25550a51aed910bda8f1a77c08c); configuration: config-tb323fu-t46 (= defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment + kernel/config/baldur-display.fragment + kernel/config/baldur-netfilter.fragment, CONFIG_LOCALVERSION="-tb323fu-t46",
    built with make LOCALVERSION=). Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0, Awinic): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs (init, build.sh; gpu-probe.c GPL-2.0),
  userspace/platform/src/keyhold.c, android/back-to-android; file list initramfs-t46.list.
• BusyBox 1.36.1 (GPL-2.0), unmodified: the source is attached to this release as busybox-1.36.1.tar.bz2
  (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314, the same file as https://busybox.net/downloads/busybox-1.36.1.tar.bz2),
  configuration busybox-1.36.1.config, static aarch64 build (binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7).
• Console font: console-setup Lat15-Terminus28x14 (Terminus Font, SIL OFL 1.1).
• regulatory.db: wireless-regdb (ISC), sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b.

Copyright and license texts of these third-party files: THIRD-PARTY-NOTICES.txt.

Licenses of the repository's parts: NOTICE.
Redistributors: modified builds use their own name, see TRADEMARKS.md.

Checksums

4ba9b9addfbc73f85e96278d09380c94cfbc9643d4dcf9895decf4f9202be705  Image-tb323fu-t46
b2fbeaf3749f42b491bcd7dc683dde98240d0658f286b136d59f118e20f55b5e  Image-tb323fu-t46.gz
7122b5d7cda1fbf548b94dea64fffa70d4788a73d5afe8594ecb5069ad0ea212  modules-tb323fu-t46.tar.gz
5c1f7fc458a6481062a1c42d37af0da6646648e4a0ca6dbe6e4f07640d906bbb  config-tb323fu-t46
eee071dcb3fc3ea90fbd7e68692ead0e7c5dcca4ea3ecceee0a266ef8cee755d  initramfs-t46.list
d15f0119d2e6282d121267d650a0...

tb323fu-linux t43

tb323fu-linux t43 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

Kernel: 7.3.0-rc4-tb323fu-t43 — Linux version 7.3.0-rc4-tb323fu-t43 (tb323fu@build) (Ubuntu clang version 18.1.3 (1ubuntu1), Ubuntu LLD 18.1.3) #1 SMP PREEMPT Wed Oct 7 14:36:55 UTC 2026

Mainline Linux v7.3-rc4 with the 127 patches 0001–0128 of kernel/patches,
built from tb323fu-linux commit d212685ece92c7d7e00a3fd9b07e8a53e9ac5ca8. What works and what does not: docs/hardware-status.md.

Read this first

• Fixes resume from suspend after kernel-t42 (patch 0128). With kernel-t42 the storage controller lost its
  multi-queue (MCQ) setup in every suspend: each resume began with a 10 s stall and a storage reset, after which reads
  ran slower (about 254k instead of 430k IOPS, 4 jobs), and now and then the resume failed and the tablet restarted.
  0128 sets the clock bit that keeps that state, as on SM8650 and SM8750 (sent upstream). Tested: 15 s2idle cycles
  without a storage error, 428k IOPS after suspend.
• CPU cluster idle state left out of runtime idle (patch 0118). With it the tablet reset when left idle
  (twice in 78 minutes); this kernel's built-in command line sets cpuidle_psci_domain.allow_cluster_off=0, and the
  tablet then ran 3 hours idle without a reset at the same display-off power. Suspend (s2idle) still uses the state;
  the cause in its power-down path is not fixed.
• CPU capacities (patch 0117): the device tree describes the big and little cores, so the scheduler places
  tasks by capacity (energy-aware scheduling).
• No USB root shell. Development images open a root shell without password on the USB serial port and telnet
  over USB networking while the initramfs runs; this release does not (the USB gadget itself is still set up, so a
  root's serial getty and usb0 networking work). To turn it on for recovery work, build your own image: the
  initramfs with kernel/initramfs/build.sh -u, or the kernel with tb323fu.usbshell=1 added to CONFIG_CMDLINE
  (kernel/initramfs/README.md). Anyone with a cable
  gets root while that shell runs.
• If it does not boot: the boot summary on the panel says how far it got. Holding volume up + down for 10 s
  restores Android from boot_b (needs the Android image hash, below). Otherwise write your saved Android boot.img
  back to boot_a from a PC in EDL mode (fastboot is read-only on this bootloader):
  docs/recovery.md.

What is in this release

File	What
Image-tb323fu-t43	the kernel as a raw arm64 Image, with its device tree, command line and initramfs built in — and all its modules: the initramfs carries lib/modules/7.3.0-rc4-tb323fu-t43 (782 modules, the out-of-tree speaker amplifier driver in extra/) as a squashfs and mounts it on /lib/modules/7.3.0-rc4-tb323fu-t43 of the root it boots, so the roots need no modules of their own
Image-tb323fu-t43.gz	the same kernel, gzip-compressed (the bootloader decompresses it); the helper's kernel updates download this one
modules-tb323fu-t43.tar.gz	the same modules tree as a tarball — only for a root that opts out of the shared modules (own in its /etc/tb323fu/modules); normally not needed
boot-repack-kernel.py	puts Image-tb323fu-t43 into your own stock boot image (Python 3, no dependencies; same as tools/boot-repack-kernel.py)
config-tb323fu-t43	the kernel .config
initramfs-t43.list, initramfs-t43.files	the initramfs: gen_init_cpio list and file list
busybox-1.36.1.config	configuration of the BusyBox binary in the initramfs
busybox-1.36.1.tar.bz2	the complete source of that BusyBox binary (the unmodified upstream tarball)
THIRD-PARTY-NOTICES.txt	copyright and license texts of the third-party files in the initramfs (BusyBox, wireless-regdb, Terminus Font)
SHA256SUMS	checksums of all of the above (they catch a damaged download; they are not a signature)

There is no ready-made boot.img, on purpose. A boot image for this tablet is the stock image with only the kernel
replaced: its header, Lenovo's GKI boot signature and the vbmeta/AVB footer are copied from a stock boot.img. Those
blobs are Lenovo's, not ours to redistribute, and they have to match the firmware version and region of your
tablet. So you build the image yourself, from the stock boot.img you saved during the backup step:

python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t43 linux-boot.img

tools/install/install.sh boot does this for you. Install: see docs/install.md
(repacked image → boot_a; nothing is installed into the roots).

Already running Linux with Open Device Helper? tb323fu-ctl kernel update (or About → Kernel Updates in the
settings app) installs this release the same way, runs it on trial and goes back to the previous kernel by itself if
it does not start (docs/helper.md).

What you must provide

• Firmware — none is included. Vendor firmware may not be redistributed. Extract it from your own tablet with
  firmware/extract-on-device.sh
  (the list is firmware/manifest.tsv) and put it into each root's /lib/firmware (the root builders do this).
  The initramfs carries only regulatory.db (wireless-regdb, ISC).
• The Android image hash for the emergency way back (volume up + down held 10 s): /etc/tb323fu/android-boot.sha256
  on baldur-root (or baldur-root-sd). Without it the chord does nothing in the initramfs.
• Your own stock boot.img (saved in the backup step, docs/install.md) to repack Image-tb323fu-t43 into.

Firmware-free initramfs: what that means

Drivers that probe before a root is mounted cannot find their firmware in this image (measured on the tablet; table in
kernel/initramfs/README.md):

• Wi-Fi (ath12k) is a module: udev loads it from the root, where the firmware is, so it comes up with the root
  (no Wi-Fi in the initramfs itself).
• GPU and Bluetooth log a missing-firmware error in the initramfs and recover after the root is mounted.
• Touch is loaded by the root (udev), not by the initramfs; the initramfs' touch echo is not available.
• The boot summary's GPU line is empty (the GPU has no firmware yet at that point).

Source code (GPL)

• Kernel: upstream torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + the patch series in
  kernel/patches of tb323fu-linux kernel-t43
  (commit d212685ece92c7d7e00a3fd9b07e8a53e9ac5ca8); configuration: config-tb323fu-t43 (= defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment + kernel/config/baldur-display.fragment + kernel/config/baldur-netfilter.fragment, CONFIG_LOCALVERSION="-tb323fu-t43",
    built with make LOCALVERSION=). Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0, Awinic): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs (init, build.sh; gpu-probe.c GPL-2.0),
  userspace/platform/src/keyhold.c, android/back-to-android; file list initramfs-t43.list.
• BusyBox 1.36.1 (GPL-2.0), unmodified: the source is attached to this release as busybox-1.36.1.tar.bz2
  (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314, the same file as https://busybox.net/downloads/busybox-1.36.1.tar.bz2),
  configuration busybox-1.36.1.config, static aarch64 build (binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7).
• Console font: console-setup Lat15-Terminus28x14 (Terminus Font, SIL OFL 1.1).
• regulatory.db: wireless-regdb (ISC), sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b.

Copyright and license texts of these third-party files: THIRD-PARTY-NOTICES.txt.

Licenses of the repository's parts: NOTICE.
Redistributors: modified builds use their own name, see TRADEMARKS.md.

Checksums

388818d8a0b7f36cfa352e9b15351e2ea2e29612459346836a56fb0b562745f8  Image-tb323fu-t43
e3669b6bfad16782f54d06b7cfa3df68b49a8854d12f6802f7841739a06b8d00  Image-tb323fu-t43.gz
3e88f958a7b66ca21f28c5ee7997de4a1a7493486bbd559607fb98de13714fab  modules-tb323fu-t43.tar.gz
1306f3250e9d389ef728aacae374ee4e6dd0a01a5c5ee266bc76ab4a629bb4fa  config-tb323fu-t43
f5abb58a11ad1af315d6c6f019c7d966a64e8c243366324d6fb6de31b9849355  initramfs-t43.list
2461ea9cf6c1c9195daa64ccad2a29d79a4f83e1c7ae27f26b7f32a90fd542b7  initramfs-t43.files
5bea14190056e80da14cafb633fd483374441aea80dbf5b3f8e58acbec2ebd26  busybox-1.36.1.config
b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314  busybox-1.36.1.tar.bz2
741dc2dc1662d91c0fd3e8bd5ff1a77a3704c5e2eb6b2a45f3736029c5c8d207  THIRD-PARTY-NOTICES.txt
48a1eddea802e3ea3c...

tb323fu-linux t42

tb323fu-linux t42 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

Kernel: 7.3.0-rc4-tb323fu-t42 — Linux version 7.3.0-rc4-tb323fu-t42 (tb323fu@build) (Ubuntu clang version 18.1.3 (1ubuntu1), Ubuntu LLD 18.1.3) #1 SMP PREEMPT Tue Oct 6 12:10:20 UTC 2026

Mainline Linux v7.3-rc4 with the 126 patches 0001–0127 of kernel/patches,
built from tb323fu-linux commit 11a25bf89b65fff48112a91a0b25bc247e7736d8. What works and what does not: docs/hardware-status.md.

Read this first

• New in t42: 256 MB CMA and a 4 MB kernel log buffer, as on the development kernel. The release builds had the
  32 MB and 128 KB defaults: with 32 MB, camera tools run as root could not allocate 1080p buffers for the rear
  camera, and a long boot or a crash kept only the last part of the kernel log. Otherwise the same as t41 (camera and
  GPU-imported buffers fixed, memlat). Checked on the device: camera regression set passes, and the performance set
  matches t41 (Geekbench 7 CPU 3069 / 9891, OpenCL 20024 on the project's Mesa).

• CPU cluster idle state left out of runtime idle (patch 0118). With it the tablet reset when left idle
  (twice in 78 minutes); this kernel's built-in command line sets cpuidle_psci_domain.allow_cluster_off=0, and the
  tablet then ran 3 hours idle without a reset at the same display-off power. Suspend (s2idle) still uses the state;
  the cause in its power-down path is not fixed.

• CPU capacities (patch 0117): the device tree describes the big and little cores, so the scheduler places
  tasks by capacity (energy-aware scheduling).

• No USB root shell. Development images open a root shell without password on the USB serial port and telnet
  over USB networking while the initramfs runs; this release does not (the USB gadget itself is still set up, so a
  root's serial getty and usb0 networking work). To turn it on for recovery work, build your own image: the
  initramfs with kernel/initramfs/build.sh -u, or the kernel with tb323fu.usbshell=1 added to CONFIG_CMDLINE
  (kernel/initramfs/README.md). Anyone with a cable
  gets root while that shell runs.

• If it does not boot: the boot summary on the panel says how far it got. Holding volume up + down for 10 s
  restores Android from boot_b (needs the Android image hash, below). Otherwise write your saved Android boot.img
  back to boot_a from a PC in EDL mode (fastboot is read-only on this bootloader):
  docs/recovery.md.

What is in this release

File	What
Image-tb323fu-t42	the kernel as a raw arm64 Image, with its device tree, command line and initramfs built in — and all its modules: the initramfs carries lib/modules/7.3.0-rc4-tb323fu-t42 (782 modules, the out-of-tree speaker amplifier driver in extra/) as a squashfs and mounts it on /lib/modules/7.3.0-rc4-tb323fu-t42 of the root it boots, so the roots need no modules of their own
Image-tb323fu-t42.gz	the same kernel, gzip-compressed (the bootloader decompresses it); the helper's kernel updates download this one
modules-tb323fu-t42.tar.gz	the same modules tree as a tarball — only for a root that opts out of the shared modules (own in its /etc/tb323fu/modules); normally not needed
boot-repack-kernel.py	puts Image-tb323fu-t42 into your own stock boot image (Python 3, no dependencies; same as tools/boot-repack-kernel.py)
config-tb323fu-t42	the kernel .config
initramfs-t42.list, initramfs-t42.files	the initramfs: gen_init_cpio list and file list
busybox-1.36.1.config	configuration of the BusyBox binary in the initramfs
busybox-1.36.1.tar.bz2	the complete source of that BusyBox binary (the unmodified upstream tarball)
THIRD-PARTY-NOTICES.txt	copyright and license texts of the third-party files in the initramfs (BusyBox, wireless-regdb, Terminus Font)
SHA256SUMS	checksums of all of the above (they catch a damaged download; they are not a signature)

There is no ready-made boot.img, on purpose. A boot image for this tablet is the stock image with only the kernel
replaced: its header, Lenovo's GKI boot signature and the vbmeta/AVB footer are copied from a stock boot.img. Those
blobs are Lenovo's, not ours to redistribute, and they have to match the firmware version and region of your
tablet. So you build the image yourself, from the stock boot.img you saved during the backup step:

python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t42 linux-boot.img

tools/install/install.sh boot does this for you. Install: see docs/install.md
(repacked image → boot_a; nothing is installed into the roots).

Already running Linux with Open Device Helper? tb323fu-ctl kernel update (or About → Kernel Updates in the
settings app) installs this release the same way, runs it on trial and goes back to the previous kernel by itself if
it does not start (docs/helper.md).

What you must provide

• Firmware — none is included. Vendor firmware may not be redistributed. Extract it from your own tablet with
  firmware/extract-on-device.sh
  (the list is firmware/manifest.tsv) and put it into each root's /lib/firmware (the root builders do this).
  The initramfs carries only regulatory.db (wireless-regdb, ISC).
• The Android image hash for the emergency way back (volume up + down held 10 s): /etc/tb323fu/android-boot.sha256
  on baldur-root (or baldur-root-sd). Without it the chord does nothing in the initramfs.
• Your own stock boot.img (saved in the backup step, docs/install.md) to repack Image-tb323fu-t42 into.

Firmware-free initramfs: what that means

Drivers that probe before a root is mounted cannot find their firmware in this image (measured on the tablet; table in
kernel/initramfs/README.md):

• Wi-Fi (ath12k) is a module: udev loads it from the root, where the firmware is, so it comes up with the root
  (no Wi-Fi in the initramfs itself).
• GPU and Bluetooth log a missing-firmware error in the initramfs and recover after the root is mounted.
• Touch is loaded by the root (udev), not by the initramfs; the initramfs' touch echo is not available.
• The boot summary's GPU line is empty (the GPU has no firmware yet at that point).

Source code (GPL)

• Kernel: upstream torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + the patch series in
  kernel/patches of tb323fu-linux kernel-t42
  (commit 11a25bf89b65fff48112a91a0b25bc247e7736d8); configuration: config-tb323fu-t42 (= defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment + kernel/config/baldur-display.fragment + kernel/config/baldur-netfilter.fragment, CONFIG_LOCALVERSION="-tb323fu-t42",
    built with make LOCALVERSION=). Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0, Awinic): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs (init, build.sh; gpu-probe.c GPL-2.0),
  userspace/platform/src/keyhold.c, android/back-to-android; file list initramfs-t42.list.
• BusyBox 1.36.1 (GPL-2.0), unmodified: the source is attached to this release as busybox-1.36.1.tar.bz2
  (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314, the same file as https://busybox.net/downloads/busybox-1.36.1.tar.bz2),
  configuration busybox-1.36.1.config, static aarch64 build (binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7).
• Console font: console-setup Lat15-Terminus28x14 (Terminus Font, SIL OFL 1.1).
• regulatory.db: wireless-regdb (ISC), sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b.

Copyright and license texts of these third-party files: THIRD-PARTY-NOTICES.txt.

Licenses of the repository's parts: NOTICE.
Redistributors: modified builds use their own name, see TRADEMARKS.md.

Checksums

8a48b4554316da4983b45a58e592c472e7e49008cbb0afc24876ee32397edd78  Image-tb323fu-t42
150eb968a58c90aaeb1704ba5df497ab82359ecab31dcf9ea8cee2a1dbf5fc36  Image-tb323fu-t42.gz
8f589cf5cbd932b8577d3e66ddf74d1740069ec7ddff462f6c0272e1e2783505  modules-tb323fu-t42.tar.gz
ceba2cbeee8eef3e4f17556b864e00f6b5aa4acd907728b8301e3d4af47a78bf  config-tb323fu-t42
227bc4776a40f68ab7fe2536a0c66b1a72567d7971d419b3e2bd70834d127d6f  initramfs-t42.list
bd2e5fc8b6c7adc0583b80967d7d02bf861d4b137ad6e17af09e338e0914be55  initramfs-t42.files
5bea14190056e80da14cafb633fd483374441aea80dbf5b3f8e58acbec2ebd26  busybox-1.36.1.config
b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314  busybox-1.36.1.tar.bz2
a856d1510afc4be0d368f31b3129042d8ef053b684d3eb810ae7140aec775dc7  THIRD-PARTY-NOTI...

tb323fu-linux t41

tb323fu-linux t41 — kernel for the Lenovo Legion Tab Y700 gen 5 (TB323FU)

Kernel: 7.3.0-rc4-tb323fu-t41 — Linux version 7.3.0-rc4-tb323fu-t41 (tb323fu@build) (Ubuntu clang version 18.1.3 (1ubuntu1), Ubuntu LLD 18.1.3) #1 SMP PREEMPT Tue Oct 6 10:52:06 UTC 2026

Mainline Linux v7.3-rc4 with the 126 patches 0001–0127 of kernel/patches,
built from tb323fu-linux commit 3f7e42ad79f912dc591d301185be9cc0ae8a6a23. What works and what does not: docs/hardware-status.md.

Read this first

• New in t41: camera and imported buffers on the GPU work. Every earlier release (t38–t40) was built with CONFIG_DMABUF_DEBUG,
  which hands drivers that import a buffer from another device a copy without the page information the GPU driver
  maps from. Every such buffer reached the GPU as nothing: libcamera's GPU image processing gave black frames, and the
  camera app (GNOME Snapshot) stayed black or stopped responding. This kernel turns the option off; with it both
  cameras show a picture in Snapshot, and switching between them works.

• Memory latency (patches 0120–0127, memlat): the CPUCP firmware now raises DDR, LLCC and DDR QoS for
  latency-bound CPU work; without it DDR stayed low and memory latency was about twice as high. Patch 0119 describes
  the UFS MCQ registers.

• CPU cluster idle state left out of runtime idle (patch 0118). With it the tablet reset when left idle
  (twice in 78 minutes); this kernel's built-in command line sets cpuidle_psci_domain.allow_cluster_off=0, and the
  tablet then ran 3 hours idle without a reset at the same display-off power. Suspend (s2idle) still uses the state;
  the cause in its power-down path is not fixed.

• CPU capacities (patch 0117): the device tree describes the big and little cores, so the scheduler places
  tasks by capacity (energy-aware scheduling).

• No USB root shell. Development images open a root shell without password on the USB serial port and telnet
  over USB networking while the initramfs runs; this release does not (the USB gadget itself is still set up, so a
  root's serial getty and usb0 networking work). To turn it on for recovery work, build your own image: the
  initramfs with kernel/initramfs/build.sh -u, or the kernel with tb323fu.usbshell=1 added to CONFIG_CMDLINE
  (kernel/initramfs/README.md). Anyone with a cable
  gets root while that shell runs.

• If it does not boot: the boot summary on the panel says how far it got. Holding volume up + down for 10 s
  restores Android from boot_b (needs the Android image hash, below). Otherwise write your saved Android boot.img
  back to boot_a from a PC in EDL mode (fastboot is read-only on this bootloader):
  docs/recovery.md.

What is in this release

File	What
Image-tb323fu-t41	the kernel as a raw arm64 Image, with its device tree, command line and initramfs built in — and all its modules: the initramfs carries lib/modules/7.3.0-rc4-tb323fu-t41 (782 modules, the out-of-tree speaker amplifier driver in extra/) as a squashfs and mounts it on /lib/modules/7.3.0-rc4-tb323fu-t41 of the root it boots, so the roots need no modules of their own
Image-tb323fu-t41.gz	the same kernel, gzip-compressed (the bootloader decompresses it); the helper's kernel updates download this one
modules-tb323fu-t41.tar.gz	the same modules tree as a tarball — only for a root that opts out of the shared modules (own in its /etc/tb323fu/modules); normally not needed
boot-repack-kernel.py	puts Image-tb323fu-t41 into your own stock boot image (Python 3, no dependencies; same as tools/boot-repack-kernel.py)
config-tb323fu-t41	the kernel .config
initramfs-t41.list, initramfs-t41.files	the initramfs: gen_init_cpio list and file list
busybox-1.36.1.config	configuration of the BusyBox binary in the initramfs
busybox-1.36.1.tar.bz2	the complete source of that BusyBox binary (the unmodified upstream tarball)
THIRD-PARTY-NOTICES.txt	copyright and license texts of the third-party files in the initramfs (BusyBox, wireless-regdb, Terminus Font)
SHA256SUMS	checksums of all of the above (they catch a damaged download; they are not a signature)

There is no ready-made boot.img, on purpose. A boot image for this tablet is the stock image with only the kernel
replaced: its header, Lenovo's GKI boot signature and the vbmeta/AVB footer are copied from a stock boot.img. Those
blobs are Lenovo's, not ours to redistribute, and they have to match the firmware version and region of your
tablet. So you build the image yourself, from the stock boot.img you saved during the backup step:

python3 boot-repack-kernel.py stock-boot.img Image-tb323fu-t41 linux-boot.img

tools/install/install.sh boot does this for you. Install: see docs/install.md
(repacked image → boot_a; nothing is installed into the roots).

Already running Linux with Open Device Helper? tb323fu-ctl kernel update (or About → Kernel Updates in the
settings app) installs this release the same way, runs it on trial and goes back to the previous kernel by itself if
it does not start (docs/helper.md).

What you must provide

• Firmware — none is included. Vendor firmware may not be redistributed. Extract it from your own tablet with
  firmware/extract-on-device.sh
  (the list is firmware/manifest.tsv) and put it into each root's /lib/firmware (the root builders do this).
  The initramfs carries only regulatory.db (wireless-regdb, ISC).
• The Android image hash for the emergency way back (volume up + down held 10 s): /etc/tb323fu/android-boot.sha256
  on baldur-root (or baldur-root-sd). Without it the chord does nothing in the initramfs.
• Your own stock boot.img (saved in the backup step, docs/install.md) to repack Image-tb323fu-t41 into.

Firmware-free initramfs: what that means

Drivers that probe before a root is mounted cannot find their firmware in this image (measured on the tablet; table in
kernel/initramfs/README.md):

• Wi-Fi (ath12k) is a module: udev loads it from the root, where the firmware is, so it comes up with the root
  (no Wi-Fi in the initramfs itself).
• GPU and Bluetooth log a missing-firmware error in the initramfs and recover after the root is mounted.
• Touch is loaded by the root (udev), not by the initramfs; the initramfs' touch echo is not available.
• The boot summary's GPU line is empty (the GPU has no firmware yet at that point).

Source code (GPL)

• Kernel: upstream torvalds/linux v7.3-rc4 (93f51579e7df248780214094418f205253383cc5) + the patch series in
  kernel/patches of tb323fu-linux kernel-t41
  (commit 3f7e42ad79f912dc591d301185be9cc0ae8a6a23); configuration: config-tb323fu-t41 (= defconfig + kaanapali-oneplus-infiniti_defconfig
  • kernel/config/baldur.fragment + kernel/config/baldur-display.fragment + kernel/config/baldur-netfilter.fragment, CONFIG_LOCALVERSION="-tb323fu-t41",
    built with make LOCALVERSION=). Origins of every patch: kernel/PROVENANCE.md.
• Out-of-tree module snd-soc-aw882xx (GPL-2.0, Awinic): kernel/out-of-tree/aw882xx.
• Initramfs: kernel/initramfs (init, build.sh; gpu-probe.c GPL-2.0),
  userspace/platform/src/keyhold.c, android/back-to-android; file list initramfs-t41.list.
• BusyBox 1.36.1 (GPL-2.0), unmodified: the source is attached to this release as busybox-1.36.1.tar.bz2
  (sha256 b8cc24c9574d809e7279c3be349795c5d5ceb6fdf19ca709f80cde50e47de314, the same file as https://busybox.net/downloads/busybox-1.36.1.tar.bz2),
  configuration busybox-1.36.1.config, static aarch64 build (binary sha256 9ebb421890774102b38919eced19cd3ccd51a984ac0599cbc763f1b09dad11e7).
• Console font: console-setup Lat15-Terminus28x14 (Terminus Font, SIL OFL 1.1).
• regulatory.db: wireless-regdb (ISC), sha256 2fb33ca0074db573e05ef7dd50bb45b63c0ff98b7e852e1105ebad536fae8e6b.

Copyright and license texts of these third-party files: THIRD-PARTY-NOTICES.txt.

Licenses of the repository's parts: NOTICE.
Redistributors: modified builds use their own name, see TRADEMARKS.md.

Checksums

d2427452153f8ea15e349e9730bc2e00991f49e55e57b80a09f1c7a8b246e24e  Image-tb323fu-t41
9597bf8e18590bbd30b4debd02e8fded167b1b3de959e96a41835a0416c5ce91  Image-tb323fu-t41.gz
dddf84ab8e3a682669b2cfb00805fe17d1f94e611a5380fb5e6365b3421495ab  modules-tb323fu-t41.tar.gz
05c514e5901c676d42607ed936a1eb3eea64c74db9e7eff45e4527b50d1806b4  config-tb323fu-t41
bbcaec189c2166dbf97d69602d69c0a0e4b52e0bcb78123d9d60073aaae9ad97  initramfs-t41.list
45aebe06c73a35eb574b3e9bce33a3067dd1d5cf0ec6ad8062f5d59015220d3c  initramfs-t41.files
5be...

Open Device Helper 0.4.1

Open Device Helper 0.4.1

• Refresh rate follows the display mode: in the 164 Hz panel mode (chosen in the display settings) the fixed rate
  goes up to 164 Hz, and the third policy, now Full Rate (was "Always 120 Hz"), means the current mode's rate.
  The Refresh D-Bus object has a new MaxHz property.

Files

File	What
tb323fu-helper-0.4.1-aarch64.tar.gz	the helper's self-update (a MANIFEST plus the files install.sh installs under /usr/local)
tb323fu-platform_0.4.1_arm64.deb	layer 1: udev rules, systemd units, audio routing (UCM), sensors, emergency key, back-to-android
tb323fu-helper_0.4.1_arm64.deb	tb323fu-helperd (system D-Bus service, polkit), tb323fu-ctl and tb323fu-mesa
tb323fu-settings_0.4.1_arm64.deb	the Open Device Helper app (GTK 4 / libadwaita)
tb323fu-helper-gnome_0.4.1_all.deb	the GNOME Shell quick-settings extension

The Debian packages go into a root built with rootfs/ubuntu/build-rootfs.sh (DEBS_FROM=, which
tools/install/install.sh does), or sudo apt install ./tb323fu-*.deb on a running Debian 13 / Ubuntu 26.04 root.
Built on Debian 13 (trixie, arm64) from commit e6fcbef; needs glibc 2.39 or newer. What changed:
helper/CHANGELOG.md.
SHA256SUMS catches a damaged download; it is not a signature.

Open Device Helper 0.4.0

Open Device Helper 0.4.0

• Graphics drivers (Mesa channel): the project's Mesa build for the Adreno 840 (Turnip for Vulkan, rusticl for
  OpenCL) from the mesa-* releases, installed next to the distribution's Mesa. App: Performance → Graphics
  Drivers; CLI: tb323fu-ctl mesa update, tb323fu-ctl mesa on|off|keep|rollback; one program with either driver:
  tb323fu-mesa run|distro COMMAND. A version switched on is on trial: without Keep, the third start goes back to the
  distribution's Mesa.
• Settings survive a restart: Bypass turned off during the performance thermal profile stays off; Bypass on, the
  brightness lowered by the panel heat limit and the Wi-Fi power-saving changes are restored after a restart; a
  config file that does not parse is kept as helper.toml.bad.
• New app icon; release files carry the Rust crates' license notices.

Files

File	What
tb323fu-helper-0.4.0-aarch64.tar.gz	the helper's self-update (a MANIFEST plus the files install.sh installs under /usr/local)
tb323fu-platform_0.4.0_arm64.deb	layer 1: udev rules, systemd units, audio routing (UCM), sensors, emergency key, back-to-android
tb323fu-helper_0.4.0_arm64.deb	tb323fu-helperd (system D-Bus service, polkit), tb323fu-ctl and tb323fu-mesa
tb323fu-settings_0.4.0_arm64.deb	the Open Device Helper app (GTK 4 / libadwaita)
tb323fu-helper-gnome_0.4.0_all.deb	the GNOME Shell quick-settings extension

The Debian packages go into a root built with rootfs/ubuntu/build-rootfs.sh (DEBS_FROM=, which
tools/install/install.sh does), or sudo apt install ./tb323fu-*.deb on a running Debian 13 / Ubuntu 26.04 root.
Built on Debian 13 (trixie, arm64) from commit 1ed6339; needs glibc 2.39 or newer. What changed:
helper/CHANGELOG.md.
SHA256SUMS catches a damaged download; it is not a signature.