Huawei Mediapad T1 8.0 Pro (huawei-t18p0)

Huawei Mediapad T1 8.0 Pro
Manufacturer	Huawei
Name	Mediapad T1 8.0 Pro
Codename	huawei-t18p0
Released	2015
Hardware
Chipset	Qualcomm Snapdragon 410 (MSM8916)
CPU	Quad-core Cortex-A53 1.2 GHz
GPU	Adreno 306
Display	800x1280 IPS TFT
Storage	16 GB
Memory	1/2 GB
Architecture	aarch64
Software
Original software	Android
Original version	4.4.4 (EmotionUI 2.3)
postmarketOS
Category	testing
Pre-built images	no

Contributors

Roboe: collecting scarce available information and sources before trying to port pmOS. Currently brute-forcing the bootloader unlock.

Users owning this device

Roboe (Notes: (second hand) T1-821W; running stock Android until I manage to unlock its bootloader)
SomnIncedo

Models

There seems to be three different models: one wifi-only with 1 GB of RAM, and two others with a LTE modem and 1 GB/2 GB of RAM.

Model	LTE modem	RAM
T1-821W	No	1 GB
T1-821L	Yes	1 GB
T1-823L	Yes	2 GB

Anyway, I (Roboe) have the wifi-only model and its stock Android's ro.product.device is hwt1821l and its ro.product.name is t1_8p0lte.

How to enter flash mode

Using ADB from stock Android:

Recovery: adb reboot recovery
Fastboot: adb reboot bootloader
Qualcomm EDL: adb reboot edl (works with a locked bootloader)

TODO: EDL is only accessible from the booted stock Android. That means it can only be used safely to read partitions o dump them. Writing them risks bricking the device. I've tried (Roboe) shorting every test point combination I'm aware of in the PCB in order to get access to EDL, multiple times, with and without battery connected, but all those efforts have been in vain so far. A Xiaomi EDL cable does not work either.

In fact,edl can be only visited by shorting the testpoint.I don't know the special testpoint for this device(T1-823L),but,we can put off the metal cover and short each point to the ground to find what point can prevent emmc to be loaded.If no emmc loaded,the device will automatically jump into edl mode.In this way,I find the right point. With hardware buttons:

Recovery: Power on the device with both Power and Volume Up buttons.
Fastboot: With the device off, hold Volume Down button while connecting a micro USB cable.

Unlock bootloader

Unfortunately, official unlock method was shut down by Huawei on May 24th, 2018.^[1]^[2] See also Bootloader#Huawei.

Fortunately, the open source community is awesome and there are a number of brute-force alternatives:

https://github.com/B83C/huawei_bootloader_unlocker (testing for some hours... nothing yet)
https://github.com/haexhub/huaweiBootloaderHack
etc.

WARNING: All of these functions above could not work.The follow ways may be work but may be dangerous.So backup the full emmc before you write any partition!!!

In fact ,unlocking bootloader of old devices using qualcomm of huawei is easy. Because most of them do not configure secure boot at all.

That means we can simply replace the full bootloader with a more functional unlocked one,so that there is no need to unlock the orogin bootloader. We can use an opensource bootloader called "lk1st".

First, we need to go to the edl mode ,and then do a emmc backup.

Then, compile and build the lk1st (we need to add the display panel to ensure the screen)

Then write lk1st.img to aboot partition

In this way,we replace the stock bootloader.

lk1st can make dual boot,which means we can choose to start from emmc or sd card.

The device uses arm32 firmware,so we also need to replace it with a 64 one.

The firmware can be find on https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip

we need to write tz partition in EDL Mode.

And We need to replace the hypervisior partition too.

qhypstub is an opensource one. And it can also let you run system at EL2 to enable KVM(virtualization)

Remember to write the hyp partition.

TODO: Please follow the details at https://wiki.postmarketos.org/wiki/Huawei_Ascend_G7_(huawei-g7)#Preparation

Stock images

Huawei seems to have removed any references to these tablets from their websites, but diving into the Spanish Support page or the German Support page, you can still get your hands in the T1-821W's firmware for Spain and the T1-821L's firmware for Germany:

T1 WIFI_Open Market_Spain_B003: Huawei T1 WIFI Firmware(T1-821W, Android 4.4, EMUI 2.3, V100R001C232B003CUSTC100D001, Spain).zip|December 29, 2015|1G

Huawei MediaPad T1 8.0 LTE Firmware (T1-821L, Android 4.4, EMUI 2.3, V100R001C278B003CUSTC278D001, Germany, Telefonica): Huawei_MediaPad T1 8.0 LTE_Firmware_T1-821L_Android 4.4_EMUI 2.3_V100R001C278B003CUSTC278D001_Germany_Telefonica.zip|March 29, 2016|1013M

These contain a PDF file with instructions (in English) to sideload the update from the SD card using the stock recovery, and the UPDATE.APP file containing the actual OS. There's a number of projects to extract flashable images from UPDATE.APP:

rogarb/huextract: written in Rust, you need to compile it with Cargo before running it. Tested: extracting images works fine.
chinaykl/HuaweiUnpack: written in Java, there's a precompiled jar file in the out/ folder. You need to run it in a terminal with java -jar. Tested: CLI is a little weird, but extracting works fine.
etc.

Hidden fastboot OEM commands

Analyzing the extracted ABOOT.img brings some hidden fastboot OEM commands:

# apt install binutils #or apk add binutils
$ strings huawei-t18p0_ABOOT.img | grep "^oem "
oem get-psid
oem enable-charger-screen
oem disable-charger-screen
oem emmc_diag
oem dump
oem emmc-dump
oem select-display-panel
oem getversion
oem log-ctr
oem get-product-model
oem get-build-number
oem battery_present_check

Particularly interesting are the fastboot oem dump and the fastboot oem emmc-dump commands.

Hidden manufacturer menu

There's a hidden menu in the stock OS with useful information. Open it like this:

Open the Calculator app in landscape mode
Type in order: ()()2846579()()=
A menu should appear listing three options (beware the third option!):
- MMITest_II: seems like a common diagnostic tool called MMI Test or HwMMITest, depending on the device.
- ProjectMenu: this will bring you to another menu with multiple options. Caution with them, since they can e.g. reset your tablet entirely. Beware the 7th option, Battery Charge Control, it seem to be the same as the next top-menu option.
- BatteryCharge: beware that clicking this option will set the tablet's brightness and volume to their full and start vibrating while reproducing a Chinese video, in order to test the battery duration.

There are a number of interesting options behind the ProjectMenu option:

2. Background setting -> 3. Usb ports setting will let you change USB mode. As far as I've read on the internet, the proprietary DC Unlocker program requires this to be changed to manufacturer mode in order to give you Huawei devices' bootloader unlock code. In case you change it, it defaults to Other mode, at least on my (Roboe) Spanish T1-821W.
2. Background setting -> 6. Dump & Log will let you check some logs, apparently. Needs further investigation.
3. Veneer information query -> 1. S/H version query will list software and hardware version, like AMSS, OEMSXL, EFS, APPSBOOT, baseline or CUST version numbers. My (Roboe) T1-821W seems to correspond to the hardware version number SH1T121WM_VERA (pun not intended).
3. Veneer information query -> 2. Apparatus type query gives a quite interesting hardware overview, read below.

According to the Apparatus type query, my (Roboe) T1-821W seems to have this hardware:

Entry	Value
Touch screen type	SYNAPTICS_S3207A_ofilm_0005
Camera type	External camera type:s5k4e1_liteon_13p1_pad Internal camera type:ov2680_ofilm_fe16_pad
EMMC Flash type	SanDisk
LCD type	BOE_NEW_BP080WX_8_800P_VIDEO
board ID	Mediapad T1 8.0-821W
Light sensor type	APS9930/TMD27723T
Gsensor type	ST LIS3DH

Installation

Not yet.

References

[xda-huawei-halts-unlock-program-1] Huawei will stop providing bootloader unlocking for all new devices - XDA Developers

[android-police-huawei-halts-unlock-program-2] Huawei halts bootloader unlock program indefinitely - Android Police

[1]

[2]