Jump to content

Huawei MatePad T8 (huawei-kobe2)

From postmarketOS Wiki
Huawei MatePad T8
Huawei MatePad T8
Huawei MatePad T8
Manufacturer Huawei
Name MatePad T8
Codename huawei-kobe2
Model KOB2-W09 / KOB2-L09
Released 2020
Type tablet
Hardware
Chipset MediaTek MT8768 (MT6765)
CPU 8 ARM Cortex-A53 2GHz
GPU PowerVR GE8320
Display 800x1280 IPS LCD
Storage 16 GB / 32 GB
Memory 2GB / 3GB RAM (LPDDR3)
Architecture aarch64
Software
Original software
The software and version the device was shipped with.
EMUI 10
Extended version
The most recent supported version from the manufacturer.
EMUI 10
postmarketOS
Mainline
Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.
yes

Users owning this device

  • Bengris32 (Notes: Unlocked with MTKClient and kaeru)
  • Fenolftalein (Notes: Unlocked with mtkclient and kaeru, LOS 18.1)
  • R0rt1z2 (Notes: Unlocked with MTKClient and kaeru)
  • Vvladii (Notes: Unlocked with MTKClient and kaeru)


How to enter flash mode

To access fastboot mode you have to press and hold Volume - and Power while turning on the device.

To access TWRP / recovery mode you have to press and hold Volume + and Power while turning on the device.

If you have kaeru installed (see the next section), you can easily access bootrom mode using the fastboot oem reboot-emergency command. This also allows you to use MTKClient to flash partitions directly.

Bootloader unlocking

The official method to unlock this device is by using an unlock code. However, this is no longer possible, as Huawei stopped providing unlock codes several years ago.

Unlike most MediaTek devices, Huawei ignores the lock state in seccfg. If the bootloader detects that you used tools like MTKClient to unlock the device, it will reset the seccfg lock state back to locked.

Fortunately, once seccfg is unlocked, the Preloader stops verifying the LK image, which allows booting unsigned LKs.

To unlock the device, you’ll need to use MTKClient along with kaeru: https://xdaforums.com/t/unlocking-and-rooting-h-awei-matepad-t8.4748324/

Huawei devices have two internal lock states:

  • FBLOCK: A special Research & Development unlock that disables all security restrictions imposed by the bootloader unlock policy. It allows writing to any partition and enables special fastboot commands.
  • USRLOCK: The standard unlock code state, which only permits flashing Android system images via fastboot.

Both of these lock states are forcefully set to true by kaeru.

The source code for all patches applied to the bootloader image by kaeru can be found here: https://github.com/R0rt1z2/kaeru/blob/cccc8377a9f374d19db33e9d1d11d17f16d7e5a3/board/huawei/board-kobe2wifi.c

Notes

Huawei uses an unusual partitioning scheme with multiple additional partitions for boot and recovery.

The Boot image is split into two parts: boot and ramdisk. The boot partition contains the kernel and DTB, while the ramdisk partition contains the ramdisk.

Similarly, what would normally be the Recovery image on AOSP is divided here into recovery_vendor, recovery_ramdisk, and recovery partitions. The recovery partition contains the kernel, DTB, and DTBO, while the recovery_ramdisk holds the recovery ramdisk. The recovery_vendor partition is merged by the bootloader into the ramdisk, and Huawei uses it to store components that are intended to be mounted under /vendor in the recovery ramdisk.

When flashing custom recoveries, it is recommended to flash a dummy recovery_vendor ramdisk to avoid crashes.

In addition, Huawei devices include a secondary (emergency) recovery called eRecovery. It is used to restore the stock firmware and has internet access, allowing it to download firmware packages directly. The eRecovery environment has its own erecovery_ramdisk, erecovery_kernel, and even erecovery_vbmeta partitions.

Installation

See also