Huawei Ascend G7 (huawei-g7)

From postmarketOS
Jump to navigation Jump to search
Huawei Ascend G7
200px
TODO
Manufacturer Huawei
Name Ascend G7
Codename huawei-g7
Released 2014
Category testing
Original software Android 5.1.1, EMUI 3.1
postmarketOS kernel Mainline
Hardware
Chipset Qualcomm MSM8916 Snapdragon 410
CPU Quad-core 1.2 GHz Cortex-A53
GPU Adreno 306
Display 720 x 1280 (IPS LCD, 5.5")
Storage 16 GB
Memory 2 GB
Architecture aarch64
Features
USB Networking
Works
Flashing
Works
Touchscreen
Works
Display
Works
WiFi
Works
Xwayland
Works
FDE
Works
Mainline
Works
Battery
3D Acceleration
Works
Accelerometer
Works
Audio
Works
Bluetooth
Works
Camera
GPS
Mobile data
SMS
Calls
USB OTG
NFC
Works


This device is based on Snapdragon 410.
See the SoC page for common tips, guides and troubleshooting steps

Contributors

  • minecrell

Users owning this device


Preparation

There are two problems that complicate using the Huawei Ascend G7 with the Qualcomm Snapdragon 410/412 (MSM8916) mainline kernel in postmarketOS:

  1. Huawei stopped providing bootloader unlock codes. Unless you obtained the code already earlier, there is no official, easy or free way to unlock the bootloader completely.
  2. Huawei ships outdated firmware for this device, which is not able to boot 64-bit (aarch64) kernels. The situation is similar as for samsung-serranovelte which can only boot mainline in 32-bit mode.

However, fortunately Huawei made one big "mistake" (unlike Samsung for samsung-serranovelte). Most older Qualcomm-based Huawei devices do not seem to have Qualcomm's firmware secure boot enabled. It may look like the bootloader is locked, but actually it's possible to replace the entire bootloader! Also, to boot aarch64 kernels we can just flash the firmware from other similar devices.

Note WARNING: Overall this is easier said than done. Replacing early boot firmware is a dangerous process that may prevent your device from booting entirely. Make sure that you backup all important data and do not try this if you still need the device for other important purposes.
TODO The instructions below show the general idea, but it's not a step by step guide (yet). Please contact minecrell on Matrix and IRC (e.g. in the mainline channel) to get further advice.

No matter if your device is still bootloader locked or not, it is possible to use EDL to read/write partitions to the eMMC. For example, you can play with https://github.com/bkerler/edl together with the programmer available for the DB410c at https://releases.linaro.org/96boards/dragonboard410c/qualcomm/firmware/linux-board-support-package-r1034.2.1.zip (loaders/prog_emmc_firehose_8916.mbn). You can enter EDL from stock Android using adb reboot edl or using easily available test points after disassembling the device, see e.g. https://i.ibb.co/wMqfMMD/G7-L01-EDL-PIN-OUT.png.

Note Note: Even if you use adb reboot edl, be prepared to use the test point method in case your device fails to boot when making a mistake. You may want to test that it works before doing any flashing.

The display is off in EDL mode, the only life sign is that the device should show up via USB. Hold Power + Volume Down to forcibly reboot the device if you want to get out of EDL mode.

Flashing new firmware

To properly boot the 64-bit mainline kernel we are going to replace the following two firmwares:

  1. tz (TrustZone): Taken from the DB410c firmware downloaded earlier (bootloaders-linux/tz.mbn)
  2. hyp (Hypervisor): qhypstub as open source hyp firmware replacement.
Note Note: Make a backup of these two partitions using ./edl.py r <hyp/tz> <hyp/tz>.img.

Unfortunately, the tz.mbn from DB410c is slightly larger than the tz partition on the Huawei G7. This means that, before you can flash the firmware from DB410c you need to re-partition the eMMC. I suggest re-assigning the last 256 KiB of the rpm partition to the tz partition. The rpm firmware is not that large anyway.

TODO The re-partitioning process is not described here at the moment because it is particularly dangerous and complicated and really needs to be simplified somehow. Please ask on Matrix and IRC.

Then you could use edl.py to flash the tz.mbn from DB410c and build and flash qhypstub similarly.

Unlocking the bootloader

So far we have not replaced the Huawei bootloader (stored in the aboot partition) yet. If your bootloader is already unlocked there is no need to go any further. But if you don't have the unlock code more work is needed now. Somehow we either need to obtain the bootloader unlock code from the device, or patch the bootloader code to make it think it's unlocked (when it's not!). Obtaining the code seems tricky, at least on the Huawei G7 it seems to go through several hash/cryptography layers. It's easier to patch the bootloader instead.

Unfortunately, it does not seem to be as trivial as replacing the aboot firmware with a patched one. The aboot firmware has a special signed HUA WEI! header that is verified in Huawei's sbl1 firmware. To flash a modified bootloader, we would first need to patch-out that header verification from Huawei's sbl1 firmware, or even replace the sbl1 firmware entirely. However, it's unclear if the sbl1 firmware contains device-specific code.

Actually, we have already flashed some custom firmware, e.g. qhypstub. Therefore, another approach is to leave the original bootloader as-is and instead modify qhypstub to patch the bootloader at runtime. If you have the Android 5.1.1 firmware from Huawei, chances are good that you can use the following qhypstub patch:

diff --git a/qhypstub.s b/qhypstub.s
index d4a87e1..a54ecfe 100644
--- a/qhypstub.s
+++ b/qhypstub.s
@@ -98,6 +98,11 @@ _start:
 	and	w3, w3, ~0b1	/* RPM_RESET_REMOVAL */
 	str	w3, [x0]
 
+	/* Patch Huawei bootloader to make it think the device is unlocked */
+	ldr	w0, =0x8f62a6d8	/*    strb	r7, [r5] */
+	mov	w3, 0xe5c50000	/* -> strb	r0, [r5] */
+	str	w3, [x0]
+
 	/* Set exception vector table for initial execution state switch */
 	adr	x0, el2_vector_table
 	msr	vbar_el2, x0

If you have a different bootloader, you may need to patch it differently. Explaining this entirely would be too complicated for this wiki article. Shortly said, find the method that returns if the device is bootloader locked (e.g. using Ghidra). In this case, the string NO widevine key in the oeminfo, so locked is used in it, which may help to find it. Then you need to make that function set *param_3 = 1 instead of 0 in case the bootloader is not unlocked.

After flashing the modified qhypstub, the Huawei bootloader should now think that your device is unlocked. Also, you have the 64-bit firmware installed so you are ready to go! (Congratulations if you actually got until here, please blame Huawei for the mess!)

lk2nd

The mainline kernel depends on an alternative bootloader (lk2nd). It does not replace the stock bootloader, but provides its own Fastboot interface. When using the mainline kernel you should always use lk2nd for flashing, not the stock Fastboot mode.

  1. Install lk2nd. (Just needed the first time).
    • Warning: lk2nd is installed to the boot partition, not the aboot partition!

How to enter flash mode

  • lk2nd Fastboot: Power on the device. After it vibrates, hold Volume Down.

Installation

See Qualcomm_Snapdragon_410/412_(MSM8916)#Installation.

Modem

The modem does not work yet due to some Huawei-specific firmware mess. See https://github.com/msm8916-mainline/linux/pull/192 for details.

See also