Huawei Mediapad T1 8.0 Pro (huawei-t18p0)

== Contributors ==
* Roboe: collecting scarce available information and sources before trying to port pmOS. Currently brute-forcing the bootloader unlock.
== Users owning this device ==
== Models ==
There seems to be three different models: one wifi-only with 1 GB of RAM, and two others with a LTE modem and 1 GB/2 GB of RAM.
Model 	LTE modem	RAM
T1-821W	No 	1 GB
T1-821L	Yes 	1 GB
T1-823L	Yes 	2 GB
Anyway, I (Roboe) have the wifi-only model and its stock Android's ro.product.device is hwt1821l and its ro.product.name is t1_8p0lte.
== How to enter flash mode ==
Using ADB from stock Android:
* Recovery: adb reboot recovery
* Fastboot: adb reboot bootloader
* Qualcomm EDL: adb reboot edl (works with a locked bootloader)
In fact,edl can be only visited by shorting the testpoint.I don't know the special testpoint for this device(T1-823L),but,we can put off the metal cover and short each point to the ground to find what point can prevent emmc to be loaded.If no emmc loaded,the device will automatically jump into edl mode.In this way,I find the right point.
With hardware buttons:
* Recovery: Power on the device with both Power and Volume Up buttons.
* Fastboot: With the device off, hold Volume Down button while connecting a micro USB cable.
== Unlock bootloader ==
Unfortunately, official unlock method was shut down by Huawei on May 24th, 2018. See also Bootloader#Huawei.
Fortunately, the open source community is awesome and there are a number of brute-force alternatives:
* https://github.com/B83C/huawei_bootloader_unlocker (testing for some hours... nothing yet)
* https://github.com/haexhub/huaweiBootloaderHack
* etc.
In fact ,unlocking bootloader of old devices using qualcomm of huawei is easy.
Because most of them do not configure secure boot at all.
That means we can simply replace the full bootloader with a more functional unlocked one,so that there is no need to unlock the orogin bootloader.
We can use an opensource bootloader called "lk1st".
First, we need to go to the edl mode ,and then do a emmc backup.
Then, compile and build the lk1st (we need to add the display panel to ensure the screen)
Then write lk1st.img to aboot partition
In this way,we replace the stock bootloader.
lk1st can make dual boot,which means we can choose to start from emmc or sd card.
The device uses arm32 firmware,so we also need to replace it with a 64 one.
The firmware can be find on https://releases.linaro.org/96boards/dragonboard410c/linaro/rescue/17.09/dragonboard410c_bootloader_emmc_android-88.zip
we need to write tz partition in EDL Mode.
And We need to replace the hypervisior partition too.
qhypstub is an opensource one.
And it can also let you run system at EL2 to enable KVM(virtualization)
Remember to write the hyp partition.
== Stock images ==
Huawei seems to have removed any references to these tablets from their websites, but diving into the Spanish Support page or the German Support page, you can still get your hands in the T1-821W's firmware for Spain and the T1-821L's firmware for Germany:
; T1 WIFI_Open Market_Spain_B003
: Huawei T1 WIFI Firmware(T1-821W, Android 4.4, EMUI 2.3, V100R001C232B003CUSTC100D001, Spain).zip|December 29, 2015|1G
; Huawei MediaPad T1 8.0 LTE Firmware (T1-821L, Android 4.4, EMUI 2.3, V100R001C278B003CUSTC278D001, Germany, Telefonica)
: Huawei_MediaPad T1 8.0 LTE_Firmware_T1-821L_Android 4.4_EMUI 2.3_V100R001C278B003CUSTC278D001_Germany_Telefonica.zip|March 29, 2016|1013M
These contain a PDF file with instructions (in English) to sideload the update from the SD card using the stock recovery, and the UPDATE.APP file containing the actual OS. There's a number of projects to extract flashable images from UPDATE.APP:
* rogarb/huextract: written in Rust, you need to compile it with Cargo before running it. Tested: extracting images works fine.
* chinaykl/HuaweiUnpack: written in Java, there's a precompiled jar file in the out/ folder. You need to run it in a terminal with java -jar. Tested: CLI is a little weird, but extracting works fine.
* etc.
=== Hidden fastboot OEM commands ===
Analyzing the extracted ABOOT.img brings some hidden fastboot OEM commands:
# apt install binutils #or apk add binutils
$ strings huawei-t18p0_ABOOT.img | grep "^oem "
oem get-psid
oem enable-charger-screen
oem disable-charger-screen
oem emmc_diag
oem dump
oem emmc-dump
oem select-display-panel
oem getversion
oem log-ctr
oem get-product-model
oem get-build-number
oem battery_present_check
Particularly interesting are the fastboot oem dump and the fastboot oem emmc-dump commands.
=== Hidden manufacturer menu ===
There's a hidden menu in the stock OS with useful information. Open it like this:
# Open the Calculator app in landscape mode
# Type in order: ()()2846579()()=
# A menu should appear listing three options (beware the third option!):
#* MMITest_II: seems like a common diagnostic tool called MMI Test or HwMMITest, depending on the device.
#* ProjectMenu: this will bring you to another menu with multiple options. Caution with them, since they can e.g. reset your tablet entirely. Beware the 7th option, Battery Charge Control, it seem to be the same as the next top-menu option.
#* BatteryCharge: beware that clicking this option will set the tablet's brightness and volume to their full and start vibrating while reproducing a Chinese video, in order to test the battery duration.
There are a number of interesting options behind the ProjectMenu option:
* 2. Background setting -> 3. Usb ports setting will let you change USB mode. As far as I've read on the internet, the proprietary DC Unlocker program requires this to be changed to manufacturer mode in order to give you Huawei devices' bootloader unlock code. In case you change it, it defaults to Other mode, at least on my (Roboe) Spanish T1-821W.
* 2. Background setting -> 6. Dump & Log will let you check some logs, apparently. Needs further investigation.
* 3. Veneer information query -> 1. S/H version query will list software and hardware version, like AMSS, OEMSXL, EFS, APPSBOOT, baseline or CUST version numbers. My (Roboe) T1-821W seems to correspond to the hardware version number SH1T121WM_VERA (pun not intended).
* 3. Veneer information query -> 2. Apparatus type query gives a quite interesting hardware overview, read below.
According to the Apparatus type query, my (Roboe) T1-821W seems to have this hardware:
Entry 	Value
Touch screen type	SYNAPTICS_S3207A_ofilm_0005
Camera type 	External camera type:s5k4e1_liteon_13p1_padInternal camera type:ov2680_ofilm_fe16_pad
EMMC Flash type 	SanDisk
LCD type 	BOE_NEW_BP080WX_8_800P_VIDEO
board ID 	Mediapad T1 8.0-821W
Light sensor type	APS9930/TMD27723T
Gsensor type 	ST LIS3DH
== Installation ==
Not yet.
== See also ==
* Huawei Mediapad T1 8.0 WiFi T1-821W Detailed Tech Specs - PhoneDB
* Kernel DTS (from the Mediapad T1 10 source): T1-821W, T1-821L, T1-823L
* Unofficial TWRP device tree
* Custom recovery build (TWRP-based?)
* A wild t18p0_junda_fw.img firmware blob appeared in an unrelated codebase!
* A wild t18p0_ofilm_fw.img firmware blob appeared in an unrelated codebase!
== References ==
 Huawei will stop providing bootloader unlocking for all new devices - XDA Developers
 Huawei halts bootloader unlock program indefinitely - Android Police