Huawei MatePad T8 (huawei-kobe2)
This device is marked as not booting. Status: Mainlining in progress. |
Huawei MatePad T8 Huawei MatePad T8 | |
Manufacturer | Huawei |
---|---|
Name | MatePad T8 |
Codename | huawei-kobe2 |
Model | KOB2-W09 / KOB2-L09 |
Released | 2020 |
Type | tablet |
Hardware | |
Chipset | MediaTek MT8768 (MT6765) |
CPU | 8 ARM Cortex-A53 2GHz |
GPU | PowerVR GE8320 |
Display | 800x1280 IPS LCD |
Storage | 16 GB / 32 GB |
Memory | 2GB / 3GB RAM (LPDDR3) |
Architecture | aarch64 |
Software | |
Original software The software and version the device was shipped with. |
EMUI 10 |
Extended version The most recent supported version from the manufacturer. |
EMUI 10 |
postmarketOS | |
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline. |
yes |
Users owning this device
- Bengris32 (Notes: Unlocked with MTKClient and kaeru)
- Fenolftalein (Notes: Unlocked with mtkclient and kaeru, LOS 18.1)
- R0rt1z2 (Notes: Unlocked with MTKClient and kaeru)
- Vvladii (Notes: Unlocked with MTKClient and kaeru)
How to enter flash mode
To access fastboot mode you have to press and hold Volume - and Power while turning on the device.
To access TWRP / recovery mode you have to press and hold Volume + and Power while turning on the device.
If you have kaeru installed (see the next section), you can easily access bootrom mode using the fastboot oem reboot-emergency
command. This also allows you to use MTKClient to flash partitions directly.
Bootloader unlocking
The official method to unlock this device is by using an unlock code. However, this is no longer possible, as Huawei stopped providing unlock codes several years ago.
Unlike most MediaTek devices, Huawei ignores the lock state in seccfg
. If the bootloader detects that you used tools like MTKClient to unlock the device, it will reset the seccfg
lock state back to locked.
Fortunately, once seccfg
is unlocked, the Preloader stops verifying the LK image, which allows booting unsigned LKs.
To unlock the device, you’ll need to use MTKClient along with kaeru: https://xdaforums.com/t/unlocking-and-rooting-h-awei-matepad-t8.4748324/
Huawei devices have two internal lock states:
FBLOCK
: A special Research & Development unlock that disables all security restrictions imposed by the bootloader unlock policy. It allows writing to any partition and enables special fastboot commands.USRLOCK
: The standard unlock code state, which only permits flashing Android system images via fastboot.
Both of these lock states are forcefully set to true by kaeru
.
The source code for all patches applied to the bootloader image by kaeru can be found here: https://github.com/R0rt1z2/kaeru/blob/cccc8377a9f374d19db33e9d1d11d17f16d7e5a3/board/huawei/board-kobe2wifi.c
Notes
Huawei uses an unusual partitioning scheme with multiple additional partitions for boot and recovery.
The Boot image is split into two parts: boot
and ramdisk
. The boot
partition contains the kernel and DTB, while the ramdisk partition contains the ramdisk
.
Similarly, what would normally be the Recovery image on AOSP is divided here into recovery_vendor
, recovery_ramdisk
, and recovery
partitions. The recovery
partition contains the kernel, DTB, and DTBO, while the recovery_ramdisk
holds the recovery ramdisk. The recovery_vendor
partition is merged by the bootloader into the ramdisk, and Huawei uses it to store components that are intended to be mounted under /vendor
in the recovery ramdisk.
When flashing custom recoveries, it is recommended to flash a dummy recovery_vendor
ramdisk to avoid crashes.
In addition, Huawei devices include a secondary (emergency) recovery called eRecovery. It is used to restore the stock firmware and has internet access, allowing it to download firmware packages directly. The eRecovery environment has its own erecovery_ramdisk
, erecovery_kernel
, and even erecovery_vbmeta
partitions.