Huawei MatePad T8 (huawei-kobe2)

Features
Flashing Whether it is possible to flash the device with pmbootstrap flasher.	Works
USB Networking After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system).	Works
Internal storage eMMC, SD cards, UFS...	Works
SD card Also includes other external storage cards.	Works
Battery Whether charging and battery level reporting work.	Partial
Screen Whether the display works; ideally with sleep mode and brightness control.	Untested
Touchscreen	Untested
Multimedia
3D Acceleration	Broken
Audio Audio playback, microphone, headset and buttons.	Partial
Camera	Broken
Connectivity
WiFi	Broken
Bluetooth	Broken
GPS	Broken
Miscellaneous
FDE Full disk encryption and unlocking with unl0kr.	Untested
USB OTG USB On-The-Go or USB-C Role switching.	Broken

Huawei MatePad T8
	; Huawei MatePad T8 (Deepsea Blue)
Manufacturer	Huawei
Name	MatePad T8
Codename	huawei-kobe2
Model	KOB2-W09 / KOB2-L09
Released	2020
Type	tablet
Hardware
Chipset	MediaTek Helio P22T (MT8768)
CPU	8 ARM Cortex-A53 2GHz
GPU	PowerVR GE8320
Display	800x1280 IPS LCD
Storage	16 GB / 32 GB
Memory	2GB / 3GB RAM (LPDDR3)
Architecture	aarch64
Software
Original software The software and version the device was shipped with.	Android (EMUI) 10 (EMUI 10)
Extended version The most recent supported version from the manufacturer.	Android (EMUI)
postmarketOS
Category	downstream
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.	no
pmOS kernel The kernel version that runs on the device's port.	4.14.141+

This device has been tested with postmarketOS, but its device package has not yet been added to the postmarketOS repositories.
This means that it cannot be selected in pmbootstrap.
Status: Mainlining in progress.

🚧	This page is a work-in-progress. Some information contained within may be inaccurate or incomplete. In particular: Add and correct components info

This device is based on the MediaTek MT8768.
See the SoC page for common tips, guides and troubleshooting steps

Users owning this device

Bengris32 (Notes: Unlocked with MTKClient and kaeru)
Fenolftalein (Notes: Unlocked with MTKClient and kaeru, pmOS, broken screen flex)
R0rt1z2 (Notes: Unlocked with MTKClient and kaeru)
Vvladii (Notes: Unlocked with MTKClient and kaeru)

How to enter flash mode

To access fastboot mode you have to press and hold Volume - and Power while turning on the device.

To access TWRP / recovery mode you have to press and hold Volume + and Power while turning on the device.

If you have kaeru installed (see the next section), you can easily access bootrom mode using the fastboot oem reboot-emergency command. This also allows you to use MTKClient to flash partitions directly.

Bootloader unlocking

The official method to unlock this device is by using an unlock code. However, this is no longer possible, as Huawei stopped providing unlock codes several years ago.

Unlike most MediaTek devices, Huawei ignores the lock state in seccfg. The bootloader uses internal lock states that are stored in oeminfo partition.

Huawei devices have two internal lock states:

FBLOCK: A special Research & Development unlock that disables all security restrictions imposed by the bootloader unlock policy. It allows writing to any partition and enables special fastboot commands.
USRLOCK: The standard unlock code state, which only permits flashing Android system images via fastboot.

Fortunately, once seccfg is unlocked, the Preloader stops verifying the LK image, which allows booting unsigned LKs.

To unlock the device, you’ll need to use MTKClient along with kaeru: https://xdaforums.com/t/unlocking-and-rooting-h-awei-matepad-t8.4748324/

Both the USRLOCK and FBLOCK lock states are forcefully set to true by kaeru.

The source code for all patches applied to the bootloader image by kaeru can be found here: https://github.com/R0rt1z2/kaeru/blob/cccc8377a9f374d19db33e9d1d11d17f16d7e5a3/board/huawei/board-kobe2wifi.c

Notes

Huawei uses an unusual partitioning scheme with multiple additional partitions for boot and recovery.

The Boot image is split into two parts: boot and ramdisk. The boot partition contains the kernel and DTB, while the ramdisk partition contains the ramdisk. To boot postmarketOS on this device, deviceinfo_create_initfs_extra="true" should be added to deviceinfo. Then the small initramfs should be put inside the ramdisk partition, while having initramfs_extra in the boot image.

Similarly, what would normally be the Recovery image on AOSP is divided here into recovery_vendor, recovery_ramdisk, and recovery partitions. The recovery partition contains the kernel, DTB, and DTBO, while the recovery_ramdisk holds the recovery ramdisk. The recovery_vendor partition is merged by the bootloader into the ramdisk, and Huawei uses it to store components that are intended to be mounted under /vendor in the recovery ramdisk.

When flashing custom recoveries, it is recommended to flash a dummy recovery_vendor ramdisk to avoid crashes.

In addition, Huawei devices include a secondary (emergency) recovery called eRecovery. It is used to restore the stock firmware and has internet access, allowing it to download firmware packages directly. The eRecovery environment has its own erecovery_ramdisk, erecovery_kernel, and even erecovery_vbmeta partitions.

Wi-Fi functionality depends on 3 kernel modules. These should be loaded and the firmware should also be loaded to the modem chip. The firmware could be found in /vendor/firmware/. The out-of-tree modules could be found here. The wmt_drv and wmt_chrdev_wifi could be loaded but wlan_drv_gen4m complains about symbols. If you're interested, please contact @hakansapling:matrix.org at Matrix.

In dmesg it is possible to see some logs about battery. In /sys/class/power_supply/ there are 5 power supplies: Battery, ac, battery, charger, hwbatt and usb. battery and hwbatt has useful information. Device can charge itself, can switch between Charging-Discharging (hwbatt excluded) and can detect max voltage. But it cannot detect the battery capacity (battery). It also doesn't detect the battery level.

TODO: add more info about sound

For audio, both the speaker and 3.5 mm jack works. The sound isn't clean though.

AUDIO_FORMAT_PCM_32_BIT is set for output.
Sampling rate is locked down to 44100 Hz and 48000 Hz (second probably for stereo).
AUDIO_FORMAT_PCM_16_BIT is set for 3.5mm jack input.
vaud28 regulator. Isn't enabled on boot.

The correct settings for a clean sound is in the works.

TODO: add more info about camera

For camera: vcama, vcamd and vcamio are the regulators for camera. These are disabled on postmarketOS boot. Setting "enabled" to state does not make them enabled for some reason.

Device doesn't mount a USB flash drive nor displays it in lsblk.

Installation

(after the code gets packaged)

Select the device in pmbootstrap init
Run pmbootstrap flasher flash_rootfs and pmbootstrap flasher flash_kernel in fastbootd mode
Run pmbootstrap export ~/exported
Dump ramdisk partition with MTKClient
Get magiskboot and unpack your ramdisk dump
Copy the symlink named initramfs in the ~/export directory and paste it in your magiskboot work directory
Delete ramdisk.cpio and rename initramfs to ramdisk.cpio
Repack the image and flash it in fastboot mode

Users owning this device

How to enter flash mode

Bootloader unlocking

Notes

Installation

See also