Ubuntu Touch on the Galaxy Tab S9

01 · The case

Why this tablet is the Linux tablet

Purpose-built Linux tablets exist, and we're glad they do – but their hardware is a class below what Samsung shipped here. The Tab S9 family pairs a genuine flagship SoC with a display, build, and battery that nothing in the Linux-native world matches. This port exists because we think the best Linux tablet isn't a Linux tablet – yet. Ubuntu Touch runs on it today; mainline Linux is on the roadmap for when it's ready.

Performance, measured on Linux

These aren't spec-sheet extrapolations – every row below is a Geekbench 6 run from the maintainer's own bench, all on Linux, including the Tab S9 itself running this very port. Against the boards and handhelds people actually build Linux devices from, roughly 40% ahead of Intel's current N-series on single-core (the class of silicon inside purpose-built Linux tablets), ahead of every row on multi-core, and better than double a Raspberry Pi CM5.

For scale: the same tablet under Android scores about 2050 / 5400 – the port already delivers roughly 90% of stock performance, on a 5.15 kernel, before any tuning. And the purpose-built comparison: the flagship Star Labs StarLite – the best-known Linux-first tablet, and a machine we genuinely respect for its coreboot firmware and repairability – ships the Intel N350. That's not a guess at its class: the N350 is a row in the chart above, from the same bench, and this tablet is about 40% faster single-core (1867 vs 1337). Around it: a 2160×1440 60 Hz LCD, Wi-Fi 5, no ingress rating, from $1,114. Great software freedom story; not the same league of hardware.

02 · The family

Supported devices

The port targets the three Wi-Fi models. All three lanes support both bootloader rev 1 and rev 5 hardware. The Ultra build is the daily-driver: display at the panel's native 2960×1848 – a September fix; earlier builds drove the panel with the smaller model's profile and paid for it with a band of artifacts along the top edge – touch and S Pen, the keyboard cover (touchpad orientation fixed), Wi-Fi, audio, and Waydroid Android app support with hardware video decode. Suspend/deep-sleep fixes for sane battery life are in the current builds and going through validation now.

In bringup means the build system, kernel sources, and device trees are in place and building, but the image hasn't been validated on hardware yet. If you own an X710 or X810: your most useful move today is to stop it from updating so your bootloader rev stays where it is.

03 · Read this first

Bootloader revisions and the one-way fuse

Every Tab S9 carries a hardware anti-rollback counter – a set of physical eFuses inside the SoC. When Samsung ships a firmware update with a newer bootloader revision and your tablet installs it, the fuse counter is burned up to match. From that moment the tablet permanently refuses to boot any bootloader with a lower revision. There is no unburning. Not with root, not over JTAG, not ever.

Tab S9 devices shipped on rev 1. Samsung's later updates moved the fleet to rev 5 – and the newest updates ship rev 6 and rev 7, which remove the ability to unlock the bootloader at all, and burn fuses as they install, so there is no way back. Revisions only ever move up – a rev-5 tablet is rev 5-or-greater forever. (The OS is different: Android itself can be downgraded, as long as the package's bootloader isn't below your fuses. The bootloader revision never goes back.) This port maintains build lanes for rev 1 and rev 5, so:

• Rev 1 device → use the rev-1 lane. You keep your fuses intact and all your options open. This is the most flexible hardware state – protect it.
• Rev 5 device → use the rev-5 lane. Nothing is lost; it works identically. Rev 5 is the newest unlockable bootloader – one more update takes you past it, so hold the line.
• Rev 6–7 → locked out. Samsung's two newest bootloaders remove bootloader unlocking entirely. A tablet on rev 6 or 7 cannot run this port – or any third-party OS – unless Samsung one day ships an update that restores unlocking, a policy reversal we wouldn't count on without serious consumer pressure.

Why does the rev matter to the port at all? The installer never touches your bootloader – it flashes boot images and the system partition and leaves Samsung's bootloader in place. But the vendor firmware the build extracts must match the bootloader stack actually on your device, which is why each model has rev-1 and rev-5 firmware lanes and why the decoder tells you exactly which stock package to feed the build.

04 · Know your device

Check your firmware and bootloader revision

Three ways, from easiest to most authoritative. The first and third give you the build string for the decoder; Download mode instead reads the fused revision straight off the hardware.

From Settings (easiest)

Settings → About tablet → Software information → Build number. The final segment of the build number is your 12-character build string – for example a build number ending in X910XXS5CYG1 is an Ultra on bootloader rev 5 (the digit in position 8).

From Download mode (authoritative)

Power the tablet off, then hold Vol Up + Vol Down while plugging the USB-C cable into a computer. The Download-mode screen's small status text includes lines like RP SWREV: B5 – that B number is the bootloader revision actually burned into your fuses, read directly from the hardware. Press and hold Vol Down to exit and power off.

From adb (if USB debugging is on)

adb shell getprop ro.boot.bootloader

Prints the full build string of the installed bootloader, e.g. X910XXS5CYG1. (adb is a small command-line tool that runs on your computer – it's part of the prerequisites, and USB debugging gets switched on during the first-boot sequence.)

05 · Hold the line

Don't let it update

Until you've flashed Ubuntu Touch, your tablet is one tap (or one idle night on Wi-Fi) away from a fuse burn. Close every path an update can take:

• Turn off automatic software updates. Settings → Software update – switch automatic software updates off.
• The OS will still push updates at you – refuse them every time. Turning off automatic updates does not stop the asking. One UI will pop up modals telling you to update, and will pin update buttons at the top of the left-hand Settings navigation pane. Tap Cancel or Back, every single time. Never tap Install, Install now, or Download and install, and never schedule Install overnight. If you accidentally install an update, assume this device will never be able to run a third-party OS.
• Never let the setup wizard online. A factory-reset device offers a software update during initial setup. Follow the safe first-boot sequence below instead.
• Don't plug into Smart Switch. Samsung's PC suite offers – and will happily perform – firmware upgrades. Keep the tablet away from it.
• If you ever return to stock Android (see going back), re-disable auto-download immediately on first boot, before the tablet has a chance to sync.

The safe first-boot sequence

For a new-in-box or freshly factory-reset unit – including right after the unlock wipe – this ordering closes every update path before the tablet ever gets connectivity, then grants the minimum it needs to make the OEM unlocking toggle appear:

1. Finish setup offline

   During initial configuration, do not connect to Wi-Fi. Tap turn Wi-Fi off, then Skip, and complete the whole wizard with no connectivity. On rev-1 (Android 13) firmware the exact tap path is: Turn off Wi-Fi → Skip → confirm Skip → Don't Copy → set time zone and date/time manually → uncheck sending diagnostic data → Accept → Skip (password) → Skip anyway → Skip → Skip (Samsung login) → Agree (Samsung services) → Next (light or dark) → Finish. (The rev-5 sequence differs slightly – to be confirmed.)

2. Kill automatic updates

   Settings → Software update → turn automatic software updates off. Do this before anything else touches a network.

3. Enable Developer options and USB debugging

   Settings → About tablet → Software information → tap Build number seven times. Then in Developer options, turn on USB debugging.

4. Look for OEM unlocking

   One of two things happens now. Either OEM unlocking is already sitting in Developer options – you're done, carry on to the install pathway. Or it isn't listed yet because the tablet has never been online – the next step brings it out.

5. If it's hidden: confirm updates are off, then enable Wi-Fi

   After double-checking that automatic updates are off, connect to Wi-Fi. The OEM unlocking toggle should appear in Developer options. The tablet is online now – expect an update modal or an update button at the top of the Settings pane. Cancel or Back only. Never Install: one accidental update and this device likely never runs a third-party OS.

6. On Android 15 / One UI 7.0: sign into a Samsung account

   Newer firmware adds one more gate: OEM unlocking only shows up once you've logged into a Samsung account on the device. Sign in, then check Developer options again.

06 · Gear up

Prerequisites

One expectation to set first: there is no prebuilt image to download. You build your own copy with two scripts we provide – copy-paste level, no programming. The build runs unattended after a single password prompt and takes about an hour and a quarter on a modest 8-core mini-PC; budget two hours the first time. Windows appears below only for the single Odin flash – the build itself needs Linux.

The tablet

• A Wi-Fi model: SM-X710, SM-X810, or SM-X910 (check the box or Settings → About tablet → Model number). 5G/cellular variants are not supported.
• OEM unlocking available. Settings → Developer options → OEM unlocking must be present and toggleable. Don't panic if you can't see it at first – Samsung hides the toggle until the tablet has been online, and Android 15 / One UI 7.0 additionally requires a Samsung-account sign-in. On Android 16 the toggle is hidden entirely: Odin-flash the 5CYG1 firmware for your model (the last rev-5 Android 15 build) first – the OS can go backwards, the bootloader rev never can – and it comes back. The safe first-boot sequence brings it out without exposing you to an update. A unit where it still never appears (some carrier/region locks) can't proceed.
• Everything backed up. Unlocking the bootloader factory-wipes the device. There is no partial path. Copy personal files off over USB and let photos and accounts sync out beforehand; the device-specific partitions get backed up later with TWRP (install step 5), so you don't need Smart Switch for any of this.

The computer

• A Linux x86_64 machine – we build and test on Ubuntu (24.04 and newer). Around 60 GB of free disk space and 16 GB of RAM recommended: the build extracts multi-GB firmware images and assembles a ~12 GB system image.
• adb (Android Debug Bridge – a small command-line tool that talks to the tablet over USB), plus Odin, Samsung's firmware-flashing program for Windows, or its Linux command-line equivalent odin4 – used exactly once, for the TWRP flash. The build kit's preflight checks every other tool and prints the exact sudo apt install line for anything missing.
• A known-good USB-C data cable. Charge-only cables cause the weirdest failures.

The files

• The build kit (release coming – see the note below).
• The full stock Odin firmware package for your model and your bootloader rev – the zip whose name contains a build string matching what the decoder told you, e.g. XAR-X910XXS5CYG1-….zip for a rev-5 Ultra. The build extracts the device-specific vendor firmware from it; it never leaves your machine. Mixing models or revs is refused by the build's provenance checks. Stock firmware is Samsung's software, so we don't distribute it or link mirrors – search the web for your exact build string and download from a source you trust. The XAR prefix in the example is a region code; yours may differ – what must match is the 12-character build string. And you're on solid ground using it: Samsung's mobile software license grants the device's owner the right to run the software on that one device, backup copy included – which is exactly what you're doing here.
• A TWRP recovery image for your model, packaged as an Odin-flashable .tar.

Pre-flight checklist

07 · The pathway

How installation works

Every Android device hides a small maintenance system called recovery. TWRP (Team Win Recovery Project) is a community replacement for it whose Install button can flash zips – that's the entire trick this port relies on. Every install is a zip you flash from TWRP, and rolling back to a previous build is just flashing the previous zip. And the question every first-timer quietly asks – can this brick my tablet? The installer never replaces the bootloader, and everything except the two one-way fuses is reversible: worst case, you Odin-flash stock firmware and start over. Seven steps, end to end:

1. Unlock the bootloader

   Work through the safe first-boot sequence until OEM unlocking is visible, then enable it. Power off, hold Vol Up + Vol Down while plugging into the PC, then long-press Vol Up at the warning screen and confirm. The device factory-wipes. Run the first-boot sequence again on the fresh system (setup offline, updates off first), and verify OEM unlocking now shows as on and greyed out. From now on the tablet shows a brief unlocked-bootloader notice at every power-on – that's normal and harmless.

2. Extract your device's firmware

   On the PC, point the kit's fw-extract.sh at your stock firmware zip. It pulls the six vendor partition images out of Samsung's package and writes a manifest recording your model, build ID, and bootloader rev – which the build step then enforces, so a wrong-model or wrong-rev zip is caught before anything is built.

3. Build the image

   Run build-gts9.sh with your device name. It asks for your sudo password once, up front, then runs unattended: the kernel, the system image, and finally a flashable zip stamped with your model and rev – e.g. ubuntu-touch-gts9uwifi-rev5-24.04-2.x.zip.

4. Flash TWRP – the Whitehat way

   One Odin flash of the recovery image only – deliberately not made permanent. Full detail in the TWRP section below, including why we do it differently from other guides.

5. Back up your device-specific partitions

   Every tablet carries a small set of factory-written, per-unit partitions that exist nowhere else – not in any firmware download: efs and sec_efs (Samsung per-device data, network MACs), modemst1/modemst2/fsg/fsc (Wi-Fi/BT radio calibration), persist (sensor and camera calibration, DRM), and the small ssd/secdata/devinfo/steady stores. Lose these and no stock reflash brings them back. Backing them up takes five minutes and you only ever have to do it once.

   Our TWRP build for this family (coming to this page once it clears testing) lists every one of them in its Backup menu. Tap Backup, check efs, sec_efs, Modemst1, Modemst2, FSG, FSC, Persist, Secdata, Devinfo, Steady and SSD, then use Select Storage to pick the micro SD card – never Internal Storage, which lives on the very data partition that installs wipe. Swipe to back up, then copy the result to your computer too: adb pull /external_sd/TWRP. One copy, on the tablet being experimented on, is not a backup.

   Modem, Firmware, Optics and Prism are optional extras – all four ship inside stock firmware packages (Optics and Prism in the CSC file), so they can always be rebuilt. Include them if the card has room; skip them for the lean set.

   Using a TWRP build whose Backup menu doesn't show these entries? The terminal (Advanced → Terminal) reaches the real partition table on any build:

   BK=/sdcard/factory-backup; mkdir -p "$BK"
   BN=$(ls -d /dev/block/bootdevice/by-name \
              /dev/block/by-name \
              /dev/block/platform/soc/*/by-name 2>/dev/null | head -1)
   for p in efs sec_efs modemst1 modemst2 fsg fsc persist \
            ssd secdata devinfo steady; do
     if [ -e "$BN/$p" ]; then
       dd if="$BN/$p" of="$BK/$p.img"
     else
       echo "MISSING: $p"
     fi
   done
   ls -l "$BK"

   Every partition should copy; if any print MISSING, run ls "$BN" and tell us what your recovery actually exposes before proceeding. Then from the computer: adb pull /sdcard/factory-backup, and keep that folder forever. (Everything else on the device can be rebuilt from stock firmware.)

6. Flash it in TWRP

   adb push the zip to the tablet, boot into TWRP, and use Install to flash it. Reboot to system – first boot takes a few minutes.

7. Smoke-test

   Walk the post-flash checks that ship with the kit: display and touch, Wi-Fi, audio, rotation, the keyboard cover if you have one, and (on the Ultra) Waydroid with hardware video playback. If anything is off, flashing the previous known-good zip from TWRP puts you right back.

08 · Recovery, our way

Flashing TWRP without making it permanent

Most published Tab S9 TWRP guides have you flash the recovery image and a follow-up installer zip that patches the boot chain so TWRP survives everything. We deliberately skip the second half. Our method flashes only the recovery image, via Odin:

1. Enter Download mode

   Power off. Hold Vol Up + Vol Down and plug the USB-C cable into the PC. Short-press Vol Up to continue past the warning.

2. Flash the recovery tar

   Odin's window shows four file slots labeled BL, AP, CP, CSC. Load the TWRP .tar for your model into AP, leave the others empty, and untick Auto Reboot before hitting Start. On Linux: odin4 -a twrp-<model>.tar. Nothing else gets flashed – no installer zip, no boot-chain patch.

3. Boot straight into TWRP

   Exit Download mode and immediately hold the recovery combo (Power + Vol Up with the cable still connected) so the very first boot lands in TWRP – don't let it boot into Android first. Missed the combo and Android started booting? No harm done – stock recovery is simply back; redo the Odin flash and try again. From TWRP you take your partition backup and then flash the Ubuntu Touch zip.

Which tar to load? We maintain a Whitehat TWRP build for the Tab S9 family – its Backup menu carries the full per-unit partition list from the backup step above, so the whole guide works without touching a terminal. It's in final testing now and will be published right here, per-model tars and checksums included.

Why not make it stick?

The trade is simple. Because we skip the persistence zip, booting or reflashing stock Android will quietly put Samsung's stock recovery back, and you'll need to redo the one Odin flash above next time you want TWRP. That's the entire downside – a two-minute reflash.

In exchange, the failure mode for an inexperienced user gets much friendlier: there is no state where the tablet is stuck with only TWRP and no clean way back. Stock behavior always restores itself. For a guide aimed at first-time flashers, we'll take “TWRP occasionally needs a reflash” over “user is wedged in a recovery they don't understand” every time.

09 · The exit door

Going back to Android

Fully reversible, with the two permanent exceptions you already know about. Odin-flash the complete stock firmware package for your model at your fused bootloader rev – never lower (the fuses reject it), and don't reach for a rev-6/7 package either: those bootloaders remove unlocking, and flashing one permanently ends this device's third-party OS story. Then the tablet is a normal Samsung tablet again. The Knox fuse stays tripped, and whatever bootloader rev you're fused to stays your floor. First boot on stock: disable auto-update before it gets any ideas.