Lenovo Xiaoxin Pad Pro 12.6 (lenovo-q706f)
The Lenovo Xiaoxin Pad Pro 12.6 is a high-end Android tablet released in China. Other official names for this tablet are Lenovo Tab P12 Pro. Lenovo has released the downstream Linux kernel sources for this device sources.
 Lenovo Xiaoxin Pad Pro 12.6 running ArchLinux | |
| Manufacturer | Lenovo |
|---|---|
| Name | Xiaoxin Pad Pro 12.6 |
| Codename | lenovo-q706f |
| Model | TB-Q706F |
| Released | 2021 |
| Type | tablet |
| Hardware | |
| Chipset | Qualcomm Snapdragon 870 (SM8250-AC) |
| CPU | Octa-core (1x3.2 GHz Kryo 585 & 3x2.42 GHz Kryo 585 & 4x1.80 GHz Kryo 585) |
| GPU | Adreno 650 |
| Display | 2560 x 1600 (120Hz 12.6" OLED) |
| Storage | 128 GB / 256 GB |
| Memory | 6GB / 8 GB LPDDR5 |
| Architecture | aarch64 |
| Software | |
| Original software | Android (ZUI) |
| Original version | 11 (ZUI 12) |
| postmarketOS | |
| Category | testing |
| Pre-built images | no |
| Mainline | yes |
| postmarketOS kernel | 6.11.0 |
| Flashing |
Works |
|---|---|
| USB Networking |
Partial |
| Internal storage |
Works |
| SD card |
Works |
| Battery |
Partial |
| Screen |
Partial |
| Touchscreen |
Works |
| Keyboard |
Partial |
| Touchpad |
Broken |
| Stylus |
Broken |
| Multimedia | |
| 3D Acceleration |
Works |
| Audio |
Partial |
| Camera |
Broken |
| Camera Flash |
Works |
| Connectivity | |
| WiFi |
Works |
| Bluetooth |
Works |
| Miscellaneous | |
| FDE |
Works |
| USB OTG |
Partial |
| HDMI/DP |
Works |
| Sensors | |
| Accelerometer |
Works |
| Magnetometer |
Works |
| Ambient Light |
Works |
| Proximity |
Works |
| Hall Effect | |
| Haptics |
Broken |
| Barometer | |
Contributors
Users owning this device
How to enter flash mode
- EDL Mode: Hold down Volume Up, then connect the tablet to a computer with a USB cable.
- Fastboot Mode: Power on the device with both Power and Volume Up buttons.
- Recovery Mode: Boot into Fastboot mode and select recovery using the Volume/Power buttons.
Unlocking the bootloader
 |
Note: You have to wait at least a day after initially connecting to the Internet for Lenovo to process your serial number. |
- Go to Settings → My Device, tap on ZUI Version until developer settings are enabled.
- Go to General Settings → Developer Settings and enable "OEM Unlocking".
- Boot into fastboot mode and connect it to a PC
- Take note of the serial number shown on the bootloader screen.
- Download your
sn.imgfrom http://cdn.zui.lenovomm.com/developer/tabletboot/(your_sn_number)/sn.img (Replace the brackets with your serial number in the link) - Flash your
sn.imgwithfastboot flash unlock sn.img. - Unlock the bootloader with
fastboot oem unlock-go
Alternatively this page can also be used to get the sn.img.
EDL Mode
The necessary loader for bkerler's EDL tool can be found in this firmware file (prog_firehose_ddr.elf).
Backup
This section is Optional
Backup your userdata partiton, either by using Magisk (need root) or without root using a recovery program such as TWRP.
Method 1: Magisk
Use Magisk:
$ adb shell
$ su
# dd if=/dev/block/by-name/dtbo_a of=/sdcard/dtbo_a.img
$ exit
$ adb pull /sdcard/dtbo_a.img
Method 2: Kernelsu Boot or TWRP (without root)
Use kernelsu:
Download "boot.img" , install kernelsu app in your tablet, Authorize root to the adb shell
$ fastboot boot boot.img
$ adb shell
# dd if=/dev/block/by-name/dtbo_a of=/sdcard/dtbo_a.img
# exit
$ adb pull /sdcard/dtbo_a.img
Installation
Install pmbootstrap and execute:
$ pmbootstrap init
$ pmbootstrap install
Before installing rootfs, please erase dtbo_a or dtbo_b
$ fastboot erase dtbo_a
Install rootfs to UFS:
Flash rootfs to the userdata partition
$ pmbootstrap flasher flash_rootfs --partition userdata
$ pmbootstrap flasher flash_kernel --partition boot_a
$ fastboot set_active a
Install rootfs to SD card:
In case you want to flash to SD card on a different computer, do the following:
1. Edit $(pmbootstrap config aports)/device/testing/device-lenovo-q706f/deviceinfo and change the value of deviceinfo_rootfs_image_sector_size to 512 (the SD card sector size)
2. Run pmbootstrap install --no-sparse (we do not need a sparse image for the SD card)
3. Copy the newly created $(pmbootstrap config work)/chroot_native/home/pmos/rootfs/lenovo-q706f.img to the other computer and flash it there with your preferred flashing tool.
4. Flash boot to the boot_a partition
Enter Fastboot Mode
$ pmbootstrap flasher flash_kernel --partition boot_a
$ fastboot set_active a
See also Dual Booting if you want to run postmarketOS in parallel with another operating system.
Android operating system useful tools Switch My Slot Android
Camera Flash
One leds at the back of the tablet.
It's max brightness value is 255.
A simple extension for Gnome mobile adds a button to the activities overview : https://gitlab.com/NekoCWD/nekotorch
See LEDs for more details.
Sensors
Initial sensor support was added in pmaports!5506.
some extensions for Gnome mobile adds a button to the quick settings : auto-brightness-toggle screen-rotate.
Type-c
SSH into the device (Full instructions)
$ ssh user@172.16.42.1
Mainline
A work in progress mainline kernel is being developed here.
Mainline status
| Component | Model | Status | Notes |
|---|---|---|---|
| SoC | Qualcomm SM8250-AC Snapdragon 870 | Y | |
| UFS | Kioxia THGJFAT1T84BAIRB | Y | |
| SD card | - | Y | |
| Display | SAMSUNG AMSA26ZP01 | P | Dual DSI samsung 2k dsc 2560 x 1600 120Hz 12.6" AMOLED Changing the brightness too quickly will cause the panel to crash, Turn the screen off and on to recover |
| Touchscreen | Goodix GT9966/GT6975P ? | Y | Goodix berlin series spi@a94000 |
| Pen input | N | Compatible with MPP 1.51 pens | Linux mainline driver goodix-berlin does not support pen input yet |
| Touchpad | hid-over-i2c | Y (untest) | addr: 0x60, bus: 0xa84000 |
| Keyboard | hid-over-i2c | Y (untest) | i2c Address 0x61, bus: 0x98c000 |
| Audio | Cirrus CS35L41 | P | bus: 0x994000， 4x Speaker Amp, one for each speaker |
| Everest-Semi ES7210 | For microphone | N | addr: 0x40, bus: 0x994000 |
| synaptics as33970 | For microphone ? | N | addr: 0x41, bus: 0x994000 |
| Pen Charging | NXP CTN730 | N | addr: 0x28, bus: 0x984000 |
| Charging | Qualcomm SMB1396 ? | P | addr: 0x10, bus: 0x884000 Limit 5V2A. Charging Protetion Driver lenovo_jeita |
| Buttons | GPIO | Y | |
| USB-C | USB 3.0 & USB 2.0 | Y | |
| Role switching | Y | ||
| onsemi NB7VPQ904M DP redriver | Y | addr: 0x19, bus: 0x990000 | |
| FSA4480 | Y | addr: 0x43, bus: 0x990000 | |
| VBUS out | Y | ||
| Fuel gauge | Texas Instruments bq27541 | Y | addr: 0x55, bus: 0x884000 |
| Wi-Fi | Qualcomm QCA6390 | Y | need bootmac |
| Fingerprint | Goodix | N |
i2c Table
Android messes up the i2c numbering. This is the real i2c numbering corresponding to mainline, showing only those that have devices attached.
| Real | Android | Address |
|---|---|---|
| i2c1 | i2c0 | 0x984000 |
| i2c3 | i2c6 | 0x98c000 |
| i2c4 | i2c2 | 0x990000 |
| i2c5 | i2c3 | 0x994000 |
| i2c9 | i2c4 | 0xa84000 |
| i2c13 | i2c7 | 0xa94000 |
| i2c15 | i2c5 | 0x884000 |
Back to stock firmware
Linux tutorial:
- Enter EDL Mode by powering off the tablet first, then hold Volume Up while connecting the tablet to a computer with an USB cable.
- Download the qdl tool from here and build it. Arch Linux users can simply install the qdl AUR package.
- Download the firmware from here.
- Extract the ZIP file.
- cd into the extracted ZIP directory
- Execute the following command:
qdl --storage ufs --include ./ ./prog_firehose_ddr.elf ./rawprogram0.xml ./patch0.xml ./rawprogram1.xml ./patch1.xml ./rawprogram2.xml ./patch2.xml ./rawprogram3.xml ./patch3.xml ./rawprogram4.xml ./patch4.xml ./rawprogram5.xml ./patch5.xml ./rawprogram_unsparse0_fullupgrade.xml - After it has finished, the command will exit itself. Force reboot the tablet by holding Power. Now you should be able to boot back into stock firmware.
See also