android_device_lenovo_TB336FU

Device tree and recovery bring-up notes for the Lenovo Tab K11 Gen 2 TB336FU.

This repository is intended as a shared starting point for TWRP and recovery development on the TB336FU. It is not a finished, fully functional recovery tree yet.

The dedicated reference/a1-adb-working branch is the reproducible baseline for the hardware-tested a1 recovery with root ADB. See REFERENCE-A1.md. It reconstructs the exact tested image from reviewed tools plus the matching public reference artifact bundle; no private or locally generated baseline CPIO is required.

Device

Item	Value
Device	Lenovo Tab K11 Gen 2
Model	TB336FU
Codename	sycamore_row_wifi
Platform	MediaTek MT6835
Board	mt8755
Architecture	arm64, arm
Stock base	Android 16, Lenovo build 17.5.10.271
Boot layout	Android boot header v4, GKI, A/B
Recovery location	vendor_boot
Tested slot	vendor_boot_a

Current Status

Known working in tested BinDroid recovery images:

• Boots to TWRP UI.
• Touch input works after a short startup delay.
• Navigation through many TWRP screens works.
• Timezone and TWRP settings persist after reboot when /persist is used as TWRP settings storage.
• Reboot to recovery through fastboot works.
• Flashing and rollback through fastboot work.

Known issues:

• A new full-source a2 RC2 candidate was built from the matching Android 16 / TWRP 16.0 source generation after the earlier failed a2 was proven to contain API 32 runtime binaries. RC2 is consistently API 36, has zero missing dependencies across 454 ELF files, and retains the proven vendor_boot layout, DTB, and bootconfig. Hardware testing still failed before UI/ADB startup, looping between a snowy display and the Lenovo splash. This proves the API mismatch was not the only source-runtime defect. The tested a1 ADB hybrid was restored and reverified as the working recovery with root ADB, bound ConfigFS/UDC state, and a matching push/pull transfer hash.

• The UI can be unresponsive for roughly the first 5-7 seconds after boot.

• Root ADB in recovery now works in the tested a1 hybrid. A passive tablet snapshot proved that TWRP's MTP startup changes sys.usb.config through none to unsupported mtp,adb, tearing down the otherwise working ADB ConfigFS gadget. The single-variable a2-adb-no-mtp test confirmed the USB root cause: with MTP excluded, ADB stayed online as root across two recovery boots, f1 remained linked to ffs.adb, and UDC remained bound. That image is nevertheless unusable because its newly compiled recovery executable exited with status 1 and the UI never replaced the Lenovo splash. A later clean, complete normal-MTP source build packaged a matching recovery runtime and passed ELF dependency closure, but still boot-cycled between the Lenovo splash and a snowy display. A subsequent clean, complete ADB-only a2 source build also passed image invariants and ELF closure, but failed identically before UI or ADB startup. The a1 baseline was restored after both tests. Those generated runtime failures remain relevant to future clean source builds, but the successful hybrid avoids them by retaining the complete working a1 CPIO and changing only the one pooled mtp,adb literal in system/bin/recovery to zero-padded adb. It passed responsive UI/touch, root shell, push/pull, ConfigFS/UDC, and two-boot recovery tests. MTP remains unavailable by design.

• A passive, manually invoked tb336fu-usb-snapshot.sh diagnostic is available for post-UI ConfigFS/FunctionFS/UDC inspection. It has no init service or automatic execution path and does not modify USB state. Invoke it as sh /system/bin/tb336fu-usb-snapshot.sh after the UI is stable.

• /data is not decrypted or mounted correctly yet.

• Backup screen currently shows Data (0MB) and Super ... (0MB).

• TWRP may select Persist Settings (43 MB) as the active storage target. This is good enough for settings persistence, but not suitable for backups.

• Internal storage backup/restore is not ready.

• MTP, USB OTG, external storage, fastbootd, and restore flows still need systematic testing.

Repository Layout

device/lenovo/TB336FU/
  Android.mk
  AndroidProducts.mk
  BoardConfig.mk
  device.mk
  twrp_TB336FU.mk
  recovery.fstab
  system.prop
  recovery/root/               Recovery ramdisk overlay files
  prebuilt/                    Kernel, DTB, DTBO, stock vendor ramdisk
  stock_reference/             Stock/reference analysis, hashes, and small images
  tools/                       Verification and vendor_boot repack tools

Top-level files:

• AGENTS.md: repository-specific contributor/agent instructions.
• CHANGELOG.md: chronological record of recovery/device-tree changes.
• DEVICE_TREE_MANIFEST.txt: file list and sizes for the release package.
• SHA256SUMS.txt: checksums for the release package.
• .gitattributes: marks firmware artifacts as binary.
• .gitignore: ignores macOS resource fork files and Python caches.

Proven Vendor Boot Layout

The stock Lenovo image and the known-working TWRP reference image both use:

• vendor_boot header version 4
• page size 4096
• partition size 67108864
• DTB size 192119
• one unnamed PLATFORM ramdisk table entry

The known-working recovery payload is one LZ4 legacy stream containing:

stock platform CPIO + TWRP recovery CPIO

This is important. A normal Android/TWRP build may emit separate platform and recovery ramdisk fragments, but the TB336FU known-good layout expects one merged unnamed PLATFORM entry. The helper script device/lenovo/TB336FU/tools/normalize_vendor_boot.py performs that repack at the uncompressed CPIO level.

Build Tree Placement

Place the checked-out repo in an Android/TWRP tree as:

device/lenovo/TB336FU

Example:

cd ~/android
git clone https://github.com/GhekkoDeveloper/android_device_lenovo_TB336FU.git device/lenovo/TB336FU

Verify the tree:

cd ~/android
export ANDROID_BUILD_TOP="$PWD"
device/lenovo/TB336FU/tools/verify_tree.sh

Build

The original source-release scripts still contain some legacy WhiteWidow names. Those names are historical and should be cleaned up as development continues.

Basic build flow:

cd ~/android
source build/envsetup.sh
lunch twrp_TB336FU-eng
mka vendorbootimage
python3 -m pip install --user lz4
device/lenovo/TB336FU/tools/build_whitewidow.sh

Expected normalized output from the current checked-in script:

out/target/product/TB336FU/vendor_boot_WhiteWidow.img

Inspect the image before flashing:

python3 device/lenovo/TB336FU/tools/normalize_vendor_boot.py info \
  out/target/product/TB336FU/vendor_boot_WhiteWidow.img

Expected structure:

entries=1
[0] type=PLATFORM name=''

Known-Good Reference Repack

This does not compile TWRP. It combines the stock platform CPIO with the known-working TWRP recovery CPIO:

cd ~/android
export ANDROID_BUILD_TOP="$PWD"
export TB336FU_REFERENCE_DIR=/path/to/TWRP-reference-binary-bundle/device/lenovo/TB336FU/stock_reference
device/lenovo/TB336FU/tools/build_known_good_reference.sh

This is useful for validating the vendor_boot packaging path independently from new source builds.

Reproduce The Tested A1 ADB Reference

On the reference/a1-adb-working branch, reproduce the complete tested image from this repository plus the matching reference artifact bundle:

python3 -m pip install -r device/lenovo/TB336FU/tools/requirements-reference.txt
export TB336FU_REFERENCE_DIR=/path/to/TWRP-reference-binary-bundle/device/lenovo/TB336FU/stock_reference
device/lenovo/TB336FU/tools/build_reproducible_a1.sh out/a1-reference

Expected final image:

out/a1-reference/vendor_boot_BinDroid_a1-adb-reference.img
SHA256: bfbcc046cf6edfb0d2eef4f0e722715d178c74df2e9bb2ab2717b9ee2689d929

This is byte-identical to the hardware-tested a1 ADB hybrid. The implementation is a deterministic reconstruction from the original TWRP reference CPIO, not a claim that all recovery binaries compile cleanly from current upstream TWRP source. Full details and intermediate hashes are in REFERENCE-A1.md.

Build From An Existing A1 Baseline

The hardware-tested ADB recovery deliberately preserves the complete known-good BinDroid a1-persist-clean userspace. The helper fails closed unless its input CPIO has the exact tested SHA-256, then changes only the pooled mtp,adb literal and performs the proven normalized vendor_boot repack:

python3 -m pip install --user lz4
device/lenovo/TB336FU/tools/build_a1_adb_hybrid.sh \
  /path/to/recovery_ramdisk_BinDroid_a1_persist_clean.cpio \
  out/target/product/TB336FU/vendor_boot_BinDroid_a2-a1-adb-hybrid.img

Expected image SHA-256: bfbcc046cf6edfb0d2eef4f0e722715d178c74df2e9bb2ab2717b9ee2689d929.

Flashing

The tested device uses slot a.

Check the active slot:

fastboot getvar current-slot

Flash recovery to slot A:

fastboot flash vendor_boot_a vendor_boot.img
fastboot reboot recovery

Do not flash vbmeta, lk, boot, init_boot, or other partitions just to test recovery changes.

Keep a stock rollback image available before testing.

Known rollback source from local bring-up:

Lenovo stock 17.5.10.271 vendor_boot.img
SHA256: a1d54fc981062947539409f6753a15f7898f24f0cb56e09882e2ebde6f7d5edb

Tested BinDroid Images From Bring-Up

The public source tree may lag behind local test images. During bring-up, these images were tested on hardware:

Image	Result
vendor_boot_twrp_v1.0.img	Working UI, original Antreas-branded reference
vendor_boot_BinDroid_AntreasBase_alpha001.img	Working UI, visible BinDroid naming
vendor_boot_BinDroid_base_alpha001.img	Booted splash but UI did not work
vendor_boot_BinDroid_short_a1.img	Working UI, short safe in-place branding
vendor_boot_BinDroid_a1_persist_settings.img	Settings persisted via /persist
vendor_boot_BinDroid_a1_persist_clean.img	Removed duplicate /mnt/vendor/persist; settings still persisted
vendor_boot_BinDroid_a1_mt6835_adb_probe.img	Failed test; stayed at TWRP splash/no ADB, then fallback returned to bootloader
vendor_boot_BinDroid_a1_bindroid_adbd_probe.img	Failed test; local bindroid_adbd service still stayed at splash/no ADB, then fallback returned to bootloader
vendor_boot_BinDroid_a1_stock_adbd_root_probe.img	Failed test; stock adbd with service.adb.root=1 still had no ADB, then fallback returned to bootloader
vendor_boot_BinDroid_a1_state_probe.img	Failed test; no USB rc change, but still no ADB and no automatic fallback within timeout
vendor_boot_BinDroid_a2-adb-no-mtp.img	USB success but recovery regression; root ADB survived two recovery boots, but the UI did not load and system/bin/recovery repeatedly exited with status 1
vendor_boot_BinDroid_a3-coherent-mtp.img	Failed control test; complete matching runtime passed static ELF closure but boot-cycled between Lenovo splash and snowy display; a1 restored
vendor_boot_BinDroid_a2.img	Failed full-source ADB-only test; clean build and static closure passed, but hardware boot-cycled between Lenovo splash and snowy display; proven a1 ADB hybrid restored
vendor_boot_BinDroid_a2-a1-adb-hybrid.img	Success; responsive a1 UI plus root recovery ADB, push/pull, bound ConfigFS/UDC, and repeat recovery boot passed
vendor_boot_BinDroid_a2-api36-rc2.img	API 36 and static validation pass, but hardware still boot-cycles before UI/ADB; a1 rollback required

The latest tested cleanup image used this visible version string:

3.7.1_16-BinDroid-TB336FU-a1

Current Development Priorities

1. Cleanly rebrand scripts and build output from WhiteWidow to BinDroid.
2. Bring the latest tested /persist settings-storage fstab changes into the checked-in source tree.
3. Compare the API 36 RC2 pre-UI path against a1 beyond ELF/API generation: init first-stage behavior, SELinux policy/denials, graphics HAL loading, kernel command line, mounts, properties, and early persistent logging.
4. Investigate the 5-7 second UI input delay after boot.
5. Implement or repair Android 16 FBE metadata decryption for /data.
6. Fix backup storage selection so /persist is not used as the main backup destination.
7. Validate USB OTG, microSD if available, MTP, fastbootd, backup, restore, reboot targets, brightness, and slot behavior.
8. Keep large stock/reference artifacts outside Git and publish them as a hash-verified reference bundle when needed for reproduction.

Large Files

Large stock/reference artifacts are intentionally not tracked in this branch. They are kept as a release artifact bundle and are selected with TB336FU_REFERENCE_DIR when a script needs them. The current external bundle layout is:

device/lenovo/TB336FU/stock_reference/images/boot.img
device/lenovo/TB336FU/stock_reference/images/vendor_boot_stock_271.img
device/lenovo/TB336FU/stock_reference/images/vendor_boot_twrp_v1.0.img
device/lenovo/TB336FU/stock_reference/recovery_ramdisk_twrp_v1.0.cpio

The small stock_reference/images/SHA256SUMS file remains tracked so the external bundle can be verified after download or copy.

Contributing

Useful contributions include:

• Logs from the same model and firmware base.
• FBE/decryption fixes for Android 16 and MediaTek metadata encryption.
• Recovery fstab cleanup.
• USB, MTP, and ADB fixes.
• Reproducible build script cleanup.
• Tested rollback and flashing documentation.

When reporting test results, include:

• Exact image name and SHA256.
• Active slot.
• Firmware/build version.
• Whether the device booted to UI.
• Touch, ADB, MTP, storage, backup, and reboot behavior.
• Recovery logs when available.

Disclaimer

This is experimental recovery-development work. Flashing custom recovery images can soft-brick a device or make data inaccessible. Keep stock images and a known rollback path before testing.