mediapad 7 lite S7-931W online notes - Huawei MediaPad, T-Mobile SpringBoard

Hi
these are my random online notes. Being sometimes dis-organised, I need to focus on some things which in hindsight may be trivia but better to put them out there so others can add knowledge if they are free to do so.
Please note this is not a post to specifically answer questions but general research and observations of what I think I know. And I may be wrong
I may also ramble on about some of my intentions
#######################
Stock tablet ROM but rooted.
Kernel size reported on unpack follows/// md5 second bit
3673028 kernel // 947125799e8124bddcb9737a347e98ec kernel
TWRP kernel details are
3676160 kernel // e421c8e09888728b6a43aa7a63288074 kernel
########################
I think I will use the boot image kernel
#######################
In stock normal boot, AFAIK usb-otg works as expected.
in TWRP, so far I can't get it to work.
In comparing the init commands and some files and modules in stock I am leaning this way
stock has 2 modules that begin with the string rk as per image
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
research suggests the first one, ipp is useful for screen stuff and may resolve some upside down issues so I may inject that into any TWRP mod
The second module apparently is required for usb-otg. however this is the current config lines
on early-init
insmod /rk29xxnand_ko.ko.3.0.8+
insmod /rk29xxnand_ko.ko.2.6.32.27
write /sys/bus/platform/drivers/usb20_otg/force_usb_mode 2
write /sys/devices/virtual/display/HDMI/scale 80
Click to expand...
Click to collapse
Checking other init lines I see a trend that before we write any configs we turn off a service and re-enable, restart it at the end of the config as per these type entries
write /sys/class/android_usb/android0/enable 0
blah blah
write /sys/class/android_usb/android0/enable 1
now I consider otg as a USB style function and most usb entries have above formula but I may be wrong.
Testing it may prove something but unfortunately I believe I should make only small changes so I can trouble shoot my own brain .....giggles.....
thanks for reading.
Feel free to add any notes for mediapad

---

You do realize you can run Abdul's recovery for RK2918 tablets? I use that and it seems much better than the one made here for the Mediapad 7 lite specifically. I'm not sure about USB OTG working (haven't tested) and IIRC I also changed the partition sizes as well to eliminate the useless cust partition and I love it!
To change sizes you gotta edit some addresses in misc before flashing and you must make sure to edit fstab accordingly.
Oh and to get the recovery running - the device has an unified image with kernel and recovery like most standard Android devices (RK2918 usually has it separate).
Simply take the recovery image for the RK2918 (TWRP by abdul), take its ramdisk, put the stock zimage and make the final recovery.img with mkbootimage for rockchip. (This is coming all from my memory atm)
It was a while ago since I modded this tablet, so I am a bit rusty with it, but I got it again just yesterday so I will start hacking the thing again.
If in any case you want me to, I can dd the tablet and send images away (except big files due to upload speed).

---

@xan1242 this is great news... Hope you guys can make cm rom for this tablet

---

There already are ports for RK2918 done numerous times (namely by CrewRKtablets, props to them!) and I almost did make it to run on the Mediapad 7 Lite, but it got stuck at the part where after it caches the programs it just holds at "Starting applications". This has all been done, of course, with the stock kernel image.
I couldn't compile from the sources for some reason, it didn't want to boot. Also yes, Huawei released the kernel sources specifically for Mediapad 7 Lite. It doesn't matter if it's the w or u variant as they're compatible. I can confirm that since I am running a modified stock ROM of the S7-931u on my S7-931w. I'm not sure which kernel it is, but, nevertheless, it can be configured which variant you've got during compilation anyway.
As far as CM11 goes, I tried porting CWM recovery off of the main branch as well, but the display didn't work with the stock kernel.

---

OOH goody I should keep quiet but I have just rememebered while I had stock recovery I had downloaded firmware from here
http://consumer.huawei.com/en/support/downloads/
unfortunately when I unzip it, its not like a traditional official zip containing mulitiple images like boot and system but only one big file called update.app.
Anyhows that might explain why my kernel differs from our TWRP.
######################################
xan1242 in post 4 you mention you almost had a new ROM running.
forgive me for mentioning it, but you did flash both the boot image and the kernel area?
I know you may have changed your fstab but for a stock rom, kernel is sitting at mtd1
also known as /dev/mtd/mtd1 as per mtd outputs hidden here
OR try /dev/block/mtd/by-name/kernel
dev: size erasesize name
mtd0: 00400000 00004000 "misc"
mtd1: 00800000 00004000 "kernel"
mtd2: 01000000 00004000 "boot"
mtd3: 01000000 00004000 "recovery"
mtd4: 00400000 00004000 "backup"
mtd5: 00c00000 00004000 "oeminfo"
mtd6: 00800000 00004000 "vrcb"
mtd7: 01000000 00004000 "reserved"
mtd8: 20000000 00004000 "cust"
mtd9: 1cc00000 00004000 "system"
mtd10: 10000000 00004000 "cache"
mtd11: 01000000 00004000 "userdata"
mtd12: 00400000 00004000 "kpanic"
mtd13: 9a800000 00004000 "user"
Click to expand...
Click to collapse

---

aus9 said:
xan1242 in post 4 you mention you almost had a new ROM running.
forgive me for mentioning it, but you did flash both the boot image and the kernel area?
I know you may have changed your fstab but for a stock rom, kernel is sitting at mtd1
also known as /dev/mtd/mtd1 as per mtd outputs hidden here
OR try /dev/block/mtd/by-name/kernel
Click to expand...
Click to collapse
The listing you got there is the default partition table indeed which can be changed as per one single text file which has got a specific name I can't remember (located in the folder with the images for the Rockchip flash tool), but you'd usually flash it in the "misc" partition, hence it being the partition 0.
Here is the thing with the kernel - as I said, with this device the images are unified just like on normal Android devices (only on Mediapads as far as Rockchips go) which means - the kernel is inside "boot" and "recovery" partitions respectively.
The "kernel" partition you see there seems to be nothing more than either a fallback or a leftover for the flash tool so it could still work. I believe it still may be necessary for the device to start up, but it may just be a dummy to which you can put anything. (zImage only goes here)
So when you boot normally it boots the "boot" partition, so if you need to change the kernel, change it like you would for any other device. IIRC the regular mkbootimg works fine!
When you go to recovery (hold vol up + vol down), it'll boot the "recovery" partition and its own kernel and everything so the recovery is treated entirely as its own part.
So yeah, I changed the boot partition by separating the zImage from the stock boot dump, modifying the ramdisk as necessary and then remaking the boot image with mkbootimg with some special addresses (I think, don't take my word for the address part, I don't remember exactly as of yet, will have to do things again since I deleted most of the stuff)

---

let me take the opportunity to mention I have edit top post to encourage anyone to add more notes on mediapad.
your information is very valuable, but I do have some issues so have not tested what you have said on the kernel or remodding my own partition table.
I would agree tho, that its not very efficient to rely on a kernel from boot image and some other flash storage.
As a side note, I have been attempted to flash various re-modded TWRPS, and at this stage with no luck, so the kernel is a bit of fixation for me at the moment.
That and keeping aussie beach babes from smothering me.....giggles

---

I have still not converted my boot image to insecure mode, and yes I know how to
instead I am using an apk to give me insecure mode called .......adbd insecure by Chainfire
in order to overwrite, I use a simple read-write script I made executable sitting on removeable sdcard = /sdcard2 with contents
#!/system/bin/sh
mount -o remount,rw /system
mount | busybox grep system
Click to expand...
Click to collapse
make it executable with a rooted device by commands
Code:
su
busybox chmod +x /sdcard2/rw.sh
result of actioning script is showing in image
Notice that we are looking for rw against /system and anything else is bad.
the balance of the output of mount for system has been cut from image as its irrelevant to discussion
hope that helps someone

---

mtd1 the kernel......
just took an image of it using formula
dd if=/dev/mtd/mtd1 of=/sdcard2/kernel.img
2) tried to unpack it using Linux executable imgrepackerrk.......gives me error unknown format detected
3) so tried Linux command strings against it with the following result for any interested?
Code:
strings kernel.img
RKOEM10
RKOEM10
[email protected]:~/Downloads$file kernel.img
kernel.img: data
[email protected]:~/Downloads$ ls -al
total 8280
drwxr-xr-x 2 gordon gordon 4096 Jan 31 13:29 .
drwxr-xr-x 21 gordon gordon 4096 Jan 31 13:12 ..
-rwxrwxr-x 1 gordon gordon 74456 Feb 17 2014 imgrepackerrk
-rw-rw-r-- 1 gordon gordon 131 Jan 31 13:29 imgrepackerrk.ini
-rw-r--r-- 1 gordon gordon 8388608 Jan 31 2015 kernel.img
It does nothing for me......but hey I am just the messenger

---

You should dd using the ones in "by-name" since it's kind of broken or just use TWRP.
Besides, it seems it's just the addresses there for the kernel, the rest is padding.
Code:
http://puu.sh/fhpXv/45b3326285.7z
Check this file out and tell me if it differs from yours. If it does in any case, then there are the addresses for the kernels in the other two partitions. If not, then it's something else I don't know about. I don't think I've ever touched this file even.
By the way, the ROM I'm using is this one:
Code:
http://4pda.ru/forum/index.php?showtopic=395683&st=840#entry23349533
It's based off of the stock one and it's basically just a cleaned up ROM. Only thing is you'd need to survive through is the Russian. To fix that you just need to get MoreLocale and change the languages.
There you can find some info about flashing 'n' other stuff.
I just looked into the images from the ROM as well - misc is just random padding again, kernel is the same thing I got and the partition table is defined in a single file called parameter. You can edit that file with any text editor.
There you will find the CMDLINE where the partition table is defined as well under mtdparts.
parameter
Code:
FIRMWARE_VER:0.2.3
MACHINE_MODEL:MediaPad 7 Lite
MACHINE_ID:007
MANUFACTURER:HUAWEI
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 2929
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
COMBINATION_KEY: 0,6,A,1,0
CMDLINE: quiet console=ttyS1,115200n8n androidboot.console=ttyS1 init=/init initrd=0x62000000,0x800000 mtdparts=rk29xxnand:[email protected](misc),[email protected](kernel),[email protected](boot),[email protected](recovery),[email protected](backup),[email protected](oeminfo),[email protected](vrcb),[email protected](reserved),[email protected](cust),[email protected](system),[email protected](cache),[email protected](userdata),[email protected](kpanic),[email protected](user)
Format is
Code:
[email protected]

---

xan1242
You should dd using the ones in "by-name" since it's kind of broken or just use TWRP
Click to expand...
Click to collapse
I wish I knew this early as I had made a number of flashing with modified TWRPS, all not booting and always thought it was just me not being good enough to know what I am doing with a Rockchip.
So I plan to redo one of my better efforts just to see if it boots later.
2) I downloaded and inspected your file here
Code:
md5sum kernel.img
c497d0e079117e8a08c3e3894237811d kernel.img
[email protected]:~/Downloads$ ls -al
total 8208
drwxr-xr-x 2 gordon gordon 4096 Feb 1 06:53 .
drwxr-xr-x 21 gordon gordon 4096 Feb 1 06:45 ..
-rw-rw-r-- 1 gordon gordon 5529 Feb 1 06:53 kernel.7z
-rw-rw-r-- 1 gordon gordon 8388608 Jan 31 23:10 kernel.img
strings kernel.img gives me
RKOEM10
RKOEM10
That size looks to me to be padded already. As the size/ erase size from stock mtd output is
mtd1: 00800000 00004000 "kernel"
Click to expand...
Click to collapse
the 8 number I believe means 8 megs or 8 x 1024 x 1024 = 8388608 bytes and so we agree
the rest is padding.
Click to expand...
Click to collapse
but it does not help me know if we have same kernel or not sorry. Can you at least tell me what kernel version the Russian ROM is please?
I use Linux tool imgrepackerrk from here
http://forum.xda-developers.com/showthread.php?t=2257331

---

ignore my next bit.....its just a whine by me.....after I pull my fist out of the monitor
I have found 3 main methods.....ignoring adb....to flash recovery from within normal bootup
dd if=newimagename of=/dev/mtd/md3
dd if=newimagename of=/dev/block/mtd/by-name/recovery
dd if=newimagename of=/dev/block/mtdblock3
I have also apppended those lines with bs=512 count=32768, giving a total of 6 commands
all of them show output of records in matching records out
but I am not getting recovery on boot up for any of them, consistenly so sorry if that looks bad.
2) it may be that I have been long pressing to turn off on failure and other pressing buttons.......that my device is spanking me for treating it without respect
b) but then if what I just said is true, this device is unreliable. I mean no great disrespect here either as it only costs A$50 in australia
end of grumble

---

ok so had modest success on a TWRP mod and flash using mtd3 method
the working bits are in images hidden, the really bad bits I am too shy to show but mount is not getting access to my fstab entries such as for system which in showing as 0 MB to backup
Yes.....thats not good.
Also I added some more flags to show more options in the mount area of TWRP but inserting usb-otg after boot or on reboot.....does not allow me to CHECK the box and mount it.
In first image, removeable sdcard means the microsd card you push into slot and the bottom entry is for OTG, I might amend the flags later but only when I resolve the fstab to mount issue.
working fstab entry is
/sdcard2 vfat /dev/block/mmcblk0p1 /dev/block/mmcblk0 flags=display="removeable sdcard";wipeingui;storage;removable;backup=0
OTG failure line is currently
/usb-otg vfat /dev/block/sda1 flags=display="USB Storage";storage;wipeingui;removable
and yes I must make that auto instead of vfat
system faulure line is attempt to use block style and yes I must try by name
/system ext4 /dev/block/mtdblock9 flags=display=system;wipeingui;backup=1
Drat I should I think remove wipingui for sdcards
#######################
heck I think I just found a gremlin?
in normal boot up the command
Code:
cat /proc/mtd
gives me the mtd list including this line
mtd9: 1cc00000 00004000 "system"
looks good but we know that our current TWRP has this entry for its fstab line
/system ext4 /dev/block/mtdblock10
WT?
well I know and am fairly sure pogs24ever has done a TWRP backup and restore so mtd10 must be for system and not mt9
only way to confirm is for me to try a new image with corrected fstab

---

well well well
lets go and have a peek at the current TWRP backup log created when doing a backup. I backed up only boot, data and system
Q If anyone thinks I should back up more, please say so.
############
now let me focus on mtd.....which I know scant about.....in normal boot up......recovery is mtd3
in twrp log its not the same!!
and others also have changed. so frustrated I am with this blinkin mtd system I thought I would share a link to my log and maybe some kind soul can tell me where to go.....LOL
https://www.dropbox.com/s/xa6uy8f4akauffo/twrp-current-recovery.txt?dl=0
if not thanks for reading.
Just to repeat ......this is the current TWRP not my mod as my mod contains more errors than current.

---

Hi Guys...
You can check my conversation with abdul on his page... here's the first page........ http://www.freaktab.com/showthread.php?10466-Unofficial-TWRP-2-7-0-0-for-Rockchip-s/page4

---

pog2rever
I can see your recovery log from that other site.......so in case it helps others let me take a snip from yours that our friend also saw at post 95, page 5
I:Actual command is: 'cd "/" && cat proc/mtd 2>&1'
dev: size erasesize name
mtd0: 00400000 00004000 "parameter"
mtd1: 00400000 00004000 "misc"
mtd2: 00800000 00004000 "kernel"
mtd3: 01000000 00004000 "boot"
mtd4: 01000000 00004000 "recovery"
mtd5: 00400000 00004000 "backup"
mtd6: 00c00000 00004000 "oeminfo"
mtd7: 00800000 00004000 "vrcb"
mtd8: 01000000 00004000 "reserved"
mtd9: 20000000 00004000 "cust"
mtd10: 1cc00000 00004000 "system"
mtd11: 10000000 00004000 "cache"
mtd12: 01000000 00004000 "userdata"
mtd13: 00400000 00004000 "kpanic"
mtd14: 18880000 00004000 "user"
Click to expand...
Click to collapse
now from our post 5.....with a normal boot up, I used cat /proc/mtd giving us
dev: size erasesize name
mtd0: 00400000 00004000 "misc"
mtd1: 00800000 00004000 "kernel"
mtd2: 01000000 00004000 "boot"
mtd3: 01000000 00004000 "recovery"
mtd4: 00400000 00004000 "backup"
mtd5: 00c00000 00004000 "oeminfo"
mtd6: 00800000 00004000 "vrcb"
mtd7: 01000000 00004000 "reserved"
mtd8: 20000000 00004000 "cust"
mtd9: 1cc00000 00004000 "system"
mtd10: 10000000 00004000 "cache"
mtd11: 01000000 00004000 "userdata"
mtd12: 00400000 00004000 "kpanic"
mtd13: 9a800000 00004000 "user"
Click to expand...
Click to collapse
I still have no idea why a twrp boot up uses different numbers from our normal boot up.
I am now forced to use a "by-name" etc/recovery.fstab, but have yet to resolve USB-OTG
################
adbul_pt discusses some of this issue at post 100,
at post 126 it is claimed TWRP does not support fuse........I can see on normal boot /dev/fuse so will have to check that out later.
thanks for reading

---

hi
Having read 60 odd pages at freaktab I have a new test, for USB-OTG
boot current TWRP, insert usb stick into hub and hub into OTG cable into device
check mount and try to check the box for usb storage.....fails
choose right hand side, it names a storage device and changes to a dialog box........usb storage shows as 0 Mb......result ......fails
Altho this is no better than my earlier report, until someone says they have succeeded with OTG storage..............I think I have done enough testing of this and my brain hurts (joke)

---

Sorry for not replying, been a bit busy. ;V
I'll upload the recovery dump now. I have some files on my computer too (ramdisk and other stuff) so if you want those too I'll send em too.
EDIT: Link
Code:
http://puu.sh/fsBNP/4789c249eb.zip
This is the recovery I use. It really wasn't too hard to make. I even think I took the one for RK3xxx. Only bad things are - no internal SD and it's upside down lol

---

i tried a CWM and found it upside down
repacked with this string in default.prop
ro.sf.hwrotation=180
still upside down.....have not had a chance to look at your recovery but assume its based on the generic rk2918?
cheers

---

aus9 said:
still upside down.....have not had a chance to look at your recovery but assume its based on the generic rk2918?
cheers
Click to expand...
Click to collapse
My pack is based on abdul's RK292x recovery since there wasn't any 2918 based with 1024x600 resolution.
On another note - I think the etna_viv driver can be ported to the Mediapad 7 Lite as the developer himself has a RK2918 based tablet. I think it's better than the regular Vivante driver. Apparently it handles things horribly and you can see it in games such as Table Top Racing or some games/3D apps not running at all such as Epic Citadel, which is quite disappointing. Besides games and apps, I think it can benefit the latest of CWM recoveries since the framebuffer didn't get updated at all when I ran it (and I'm not sure even if it ran since I need serial pins for that, I do own a RS232 interface though).
EDIT: I actually found the original image file I used. Instead of the link above (which has the extra unnecessary padding) use this one;
Code:
http://puu.sh/fta8X/824844a344.img