Huawei Mediapad T1 8.0 Pro (huawei-t18p0)

From postmarketOS
Huawei Mediapad T1 8.0 Pro
Manufacturer Huawei
Name Mediapad T1 8.0 Pro
Codename huawei-t18p0
Released 2015
Category testing
Pre-built images no
Original software Android
Original version 4.4.4 (EmotionUI 2.3)
Hardware
Chipset Qualcomm Snapdragon 410 (MSM8916)
CPU Quad-core Cortex-A53 1.2 GHz
GPU Adreno 306
Display 800x1280 IPS TFT
Storage 16 GB
Memory 1/2 GB
Architecture AArch64
This device is marked as not booting.
Features
USB Networking
Flashing
Touchscreen
Display
WiFi
FDE
Mainline
Battery
3D Acceleration
Audio
Bluetooth
Camera
GPS
Mobile data
Internal storage
SMS
Calls
USB OTG
NFC
Sensors
Accelerometer
Magnetometer
Ambient Light
Proximity
Hall Effect
Barometer
Power Sensor
Misc
Built-in DVB
Camera Flash
Keyboard
Touchpad
USB-A
HDMI/DP
Ir TX
Ir RX
Stylus
Memory Card
Haptics
Ethernet
FOSS bootloader


Contributors

  • Roboe: collecting scarce available information and sources before trying to port pmOS. Currently brute-forcing the bootloader unlock.

Users owning this device

  • Roboe (Notes: (second hand) T1-821W; running stock Android until I manage to unlock its bootloader)


Models

There seems to be three different models: one wifi-only with 1 GB of RAM, and two others with a LTE modem and 1 GB/2 GB of RAM.

Model LTE modem RAM
T1-821W No 1 GB
T1-821L Yes 1 GB
T1-823L Yes 2 GB

Anyway, I (Roboe) have the wifi-only model and its stock Android's ro.product.device is hwt1821l and its ro.product.name is t1_8p0lte.

How to enter flash mode

Using ADB from stock Android:

  • Recovery: adb reboot recovery
  • Fastboot: adb reboot bootloader
  • Qualcomm EDL: adb reboot edl (works with a locked bootloader)
Icon TODO: EDL is only accessible from the booted stock Android. That means it can only be used safely to read partitions o dump them. Writing them risks bricking the device. I've tried (Roboe) shorting every test point combination I'm aware of in the PCB in order to get access to EDL, multiple times, with and without battery connected, but all those efforts have been in vain so far. A Xiaomi EDL cable does not work either.

With hardware buttons:

  • Recovery: Power on the device with both Power and Volume Up buttons.
  • Fastboot: With the device off, hold Volume Down button while connecting a micro USB cable.

Unlock bootloader

Unfortunately, official unlock method was shut down by Huawei on May 24th, 2018.[1][2] See also Bootloader#Huawei.

Fortunately, the open source community is awesome and there are a number of brute-force alternatives:

Stock images

Huawei seems to have removed any references to these tablets from their websites, but diving into the Spanish Support page or the German Support page, you can still get your hands in the T1-821W's firmware for Spain and the T1-821L's firmware for Germany:

T1 WIFI_Open Market_Spain_B003
Huawei T1 WIFI Firmware(T1-821W, Android 4.4, EMUI 2.3, V100R001C232B003CUSTC100D001, Spain).zip|December 29, 2015|1G
Huawei MediaPad T1 8.0 LTE Firmware (T1-821L, Android 4.4, EMUI 2.3, V100R001C278B003CUSTC278D001, Germany, Telefonica)
Huawei_MediaPad T1 8.0 LTE_Firmware_T1-821L_Android 4.4_EMUI 2.3_V100R001C278B003CUSTC278D001_Germany_Telefonica.zip|March 29, 2016|1013M

These contain a PDF file with instructions (in English) to sideload the update from the SD card using the stock recovery, and the UPDATE.APP file containing the actual OS. There's a number of projects to extract flashable images from UPDATE.APP:

  • rogarb/huextract: written in Rust, you need to compile it with Cargo before running it. Tested: extracting images works fine.
  • chinaykl/HuaweiUnpack: written in Java, there's a precompiled jar file in the out/ folder. You need to run it in a terminal with java -jar. Tested: CLI is a little weird, but extracting works fine.
  • etc.

Hidden fastboot OEM commands

Analyzing the extracted ABOOT.img brings some hidden fastboot OEM commands:

# apt install binutils #or apk add binutils
$ strings huawei-t18p0_ABOOT.img | grep "^oem "
oem get-psid
oem enable-charger-screen
oem disable-charger-screen
oem emmc_diag
oem dump
oem emmc-dump
oem select-display-panel
oem getversion
oem log-ctr
oem get-product-model
oem get-build-number
oem battery_present_check

Particularly interesting are the fastboot oem dump and the fastboot oem emmc-dump commands.

Hidden manufacturer menu

There's a hidden menu in the stock OS with useful information. Open it like this:

  1. Open the Calculator app in landscape mode
  2. Type in order: ()()2846579()()=
  3. A menu should appear listing three options (beware the third option!):
    • MMITest_II: seems like a common diagnostic tool called MMI Test or HwMMITest, depending on the device.
    • ProjectMenu: this will bring you to another menu with multiple options. Caution with them, since they can e.g. reset your tablet entirely. Beware the 7th option, Battery Charge Control, it seem to be the same as the next top-menu option.
    • BatteryCharge: beware that clicking this option will set the tablet's brightness and volume to their full and start vibrating while reproducing a Chinese video, in order to test the battery duration.

There are a number of interesting options behind the ProjectMenu option:

  • 2. Background setting -> 3. Usb ports setting will let you change USB mode. As far as I've read on the internet, the proprietary DC Unlocker program requires this to be changed to manufacturer mode in order to give you Huawei devices' bootloader unlock code. In case you change it, it defaults to Other mode, at least on my (Roboe) Spanish T1-821W.
  • 2. Background setting -> 6. Dump & Log will let you check some logs, apparently. Needs further investigation.
  • 3. Veneer information query -> 1. S/H version query will list software and hardware version, like AMSS, OEMSXL, EFS, APPSBOOT, baseline or CUST version numbers. My (Roboe) T1-821W seems to correspond to the hardware version number SH1T121WM_VERA (pun not intended).
  • 3. Veneer information query -> 2. Apparatus type query gives a quite interesting hardware overview, read below.

According to the Apparatus type query, my (Roboe) T1-821W seems to have this hardware:

Entry Value
Touch screen type SYNAPTICS_S3207A_ofilm_0005
Camera type External camera type:s5k4e1_liteon_13p1_pad
Internal camera type:ov2680_ofilm_fe16_pad
EMMC Flash type SanDisk
LCD type BOE_NEW_BP080WX_8_800P_VIDEO
board ID Mediapad T1 8.0-821W
Light sensor type APS9930/TMD27723T
Gsensor type ST LIS3DH

Installation

Not yet.


See also

References