Huawei Ascend G7 (huawei-g7)
|Original software||Android 5.1.1, EMUI 3.1|
|Chipset||Qualcomm MSM8916 Snapdragon 410|
|CPU||Quad-core 1.2 GHz Cortex-A53|
|Display||720 x 1280 (IPS LCD, 5.5")|
Users owning this device
There are two problems that complicate using the Huawei Ascend G7 with the Qualcomm Snapdragon 410/412 (MSM8916) mainline kernel in postmarketOS:
- Huawei stopped providing bootloader unlock codes. Unless you obtained the code already earlier, there is no official, easy or free way to unlock the bootloader completely.
- Huawei ships outdated firmware for this device, which is not able to boot 64-bit (aarch64) kernels. The situation is similar as for samsung-serranovelte which can only boot mainline in 32-bit mode.
However, fortunately Huawei made one big "mistake" (unlike Samsung for samsung-serranovelte). Most older Qualcomm-based Huawei devices do not seem to have Qualcomm's firmware secure boot enabled. It may look like the bootloader is locked, but actually it's possible to replace the entire bootloader! Also, to boot aarch64 kernels we can just flash the firmware from other similar devices.
No matter if your device is still bootloader locked or not, it is possible to use EDL to read/write partitions to the eMMC. For example, you can play with https://github.com/bkerler/edl together with the programmer available for the DB410c at https://releases.linaro.org/96boards/dragonboard410c/qualcomm/firmware/linux-board-support-package-r1034.2.1.zip (
loaders/prog_emmc_firehose_8916.mbn). You can enter EDL from stock Android using
adb reboot edl or using easily available test points after disassembling the device, see e.g. https://i.ibb.co/wMqfMMD/G7-L01-EDL-PIN-OUT.png.
The display is off in EDL mode, the only life sign is that the device should show up via USB. Hold
Volume Down to forcibly reboot the device if you want to get out of EDL mode.
Flashing new firmware
To properly boot the 64-bit mainline kernel we are going to replace the following two firmwares:
tz(TrustZone): Taken from the DB410c firmware downloaded earlier (
hyp(Hypervisor): qhypstub as open source
tz.mbn from DB410c is slightly larger than the
tz partition on the Huawei G7. This means that, before you can flash the firmware from DB410c you need to re-partition the eMMC. I suggest re-assigning the last 256 KiB of the
rpm partition to the
tz partition. The
rpm firmware is not that large anyway.
Then you could use edl.py to flash the
tz.mbn from DB410c and build and flash qhypstub similarly.
Unlocking the bootloader
So far we have not replaced the Huawei bootloader (stored in the
aboot partition) yet. If your bootloader is already unlocked there is no need to go any further. But if you don't have the unlock code more work is needed now. Somehow we either need to obtain the bootloader unlock code from the device, or patch the bootloader code to make it think it's unlocked (when it's not!). Obtaining the code seems tricky, at least on the Huawei G7 it seems to go through several hash/cryptography layers. It's easier to patch the bootloader instead.
Unfortunately, it does not seem to be as trivial as replacing the
aboot firmware with a patched one. The
aboot firmware has a special signed
HUA WEI! header that is verified in Huawei's
sbl1 firmware. To flash a modified bootloader, we would first need to patch-out that header verification from Huawei's
sbl1 firmware, or even replace the
sbl1 firmware entirely. However, it's unclear if the
sbl1 firmware contains device-specific code.
Actually, we have already flashed some custom firmware, e.g. qhypstub. Therefore, another approach is to leave the original bootloader as-is and instead modify qhypstub to patch the bootloader at runtime. If you have the Android 5.1.1 firmware from Huawei, chances are good that you can use the following qhypstub patch:
diff --git a/qhypstub.s b/qhypstub.s index d4a87e1..a54ecfe 100644 --- a/qhypstub.s +++ b/qhypstub.s @@ -98,6 +98,11 @@ _start: and w3, w3, ~0b1 /* RPM_RESET_REMOVAL */ str w3, [x0] + /* Patch Huawei bootloader to make it think the device is unlocked */ + ldr w0, =0x8f62a6d8 /* strb r7, [r5] */ + mov w3, 0xe5c50000 /* -> strb r0, [r5] */ + str w3, [x0] + /* Set exception vector table for initial execution state switch */ adr x0, el2_vector_table msr vbar_el2, x0
If you have a different bootloader, you may need to patch it differently. Explaining this entirely would be too complicated for this wiki article. Shortly said, find the method that returns if the device is bootloader locked (e.g. using Ghidra). In this case, the string
NO widevine key in the oeminfo, so locked is used in it, which may help to find it. Then you need to make that function set
*param_3 = 1 instead of 0 in case the bootloader is not unlocked.
After flashing the modified qhypstub, the Huawei bootloader should now think that your device is unlocked. Also, you have the 64-bit firmware installed so you are ready to go! (Congratulations if you actually got until here, please blame Huawei for the mess!)
The mainline kernel depends on an alternative bootloader (lk2nd). It does not replace the stock bootloader, but provides its own Fastboot interface. When using the mainline kernel you should always use lk2nd for flashing, not the stock Fastboot mode.
- Install lk2nd. (Just needed the first time).
- Warning: lk2nd is installed to the
bootpartition, not the
- Warning: lk2nd is installed to the
How to enter flash mode
- lk2nd Fastboot: Power on the device. After it vibrates, hold
The modem does not work yet due to some Huawei-specific firmware mess. See https://github.com/msm8916-mainline/linux/pull/192 for details.