MediaTek

About MediaTek
MediaTek Inc. is a chip maker company from Taiwan.

Devices with a MediaTek SoC
For an overview of Mediatek devices, see Mediatek.

Glossary
See MediaTek Glossary.

Naming Conventions
While there doesn't seem to be a stable pattern that MediaTek SoC names follow between subsequent generations, there are a few naming patterns that are prevalent.

MediaTek SoCs can be split into 5 main categories, each corresponding to a certain period of time where several SoCs were released with highly similar core architectures:
 * The Helio name wasn't used for as well as,   and   variants

There are SoCs that don't follow this convention. These SoCs are usually tablet or application variants of the  SoCs, and have names that follow the   pattern. For some of those SoCs, the only difference between the mobile and tablet variant is the first digit, while others have completely different names despite them being functionally identical. Here are some known mobile/tablet variant pairs:


 * Unconfirmed

Flashing
If you want to flash firmware to Mediatek-based devices, there is a proprietary tool for that: SP Flash Tool. It is e.g. used for the Wiko Lenny 3 (wiko-lenny3).

Some devices also support fastboot, e.g. Sony Xperia XA (sony-tuba), and some support odin, e.g. Samsung Galaxy Grand Prime Plus (samsung-grandpplte).

Some open source software has been developed:
 * 1) https://github.com/saleemrashid/mediatek_flash_tool has only been tested with the MT6580
 * 2) https://github.com/MediaTek-Labs/mt76x7-uploader which is compatible with the MT7687 and MT7697 for flashing the bootloader
 * 3) https://github.com/Wiz-IO/Mediatek-MT2625-Flash-Utility for the MT2625
 * 4) https://github.com/McBitter/flasher only support for MT6735P, is WIP
 * 5) https://github.com/bkerler/mtkclient

Enabling previously disabled UART on downstream kernels
Sometimes you might need to get some data from UART on downstream kernel (for example, with intention to debug boot process of your pmOS port) but it's been automatically disabled by the preloader or UBoot or something else. One of the solutions suggested by the official MediaTek OEM FAQ is to run this command as early as possible:

To disable UART logs, run:

Power applied to the SoC
When chip is powered on the dram controller pushes the address of brom (boot rom, mask rom that is hardwired) to PC (program counter) and execution of rom begins.

Brom execution

 * 1) UART1 gets initialized to some predetermined baudrate. Baud usually depends in chip input clock source. Observation has been made that UART1 is disabled on many phones, but can be enabled if proper firmware is used and eFuses are not blown.
 * 2) Initialize storage with low clock. Reason why it's using low clock is because muxes are not programmed at this stage.
 * 3) Wait for "Start" string on UART1 for unknown amount of time, the internet keeps buzzing about 150ms. After start is recieved, listen to commands from host until jump is observed (refer to brom spec in further reading section). If start is not sent then Preloader image will be loaded from the storage to the SRAM (static ram) and brom loads it. Not sure if flags SP flash tool needs are used at bootup phase.
 * 4) If KCOL0 pin is shorted to the ground, preloader loading is avoided and download protocol is rolled up on USB port.

Memory maps of different system on chips

 * MT6735

Image format
This format is used in brom and preloader(has to be verified) while flashing with SP flash tool. All fields are in little endian.

Example data from MT6735P chipset
ROM:00031128 magicValue     DCD 0x14D4D4D ROM:0003112C HeaderSize     DCD 0x38                ; completeHeaderSize ROM:00031130 aFile_info     DCB "FILE_INFO",0,0,0 ROM:0003113C alwaysOne      DCD 1 ROM:00031140 FileType       DCW 1                   ; ARM-Bootloader ROM:00031142 FlashType      DCB 5                   ; EMMC-Boot-Region ROM:00031143 SignatureType  DCB 3                   ; Single and PHASH ROM:00031144 LoadAddress    DCD 0x200D00            ; SRAM address ROM:00031148 FileLength     DCD 0x1CE4C ROM:0003114C MaximumSize    DCD 0x40000 ROM:00031150 ContentOffset  DCD 0x300 ROM:00031154 SigLen         DCD 0x124 ROM:00031158 JumpOffset     DCD 0x300 ROM:0003115C Ending         DCD 1                   ; POST_BUILD_DONE

SP Flash Tool authentication bypass
By patching a USB driver, it is possible to bypass the chain of trust during flashing. More info in this GitHub repo and here

It is compatible with the following SoCs:
 * mt6261
 * mt6572
 * mt6580
 * mt6582
 * mt6735
 * mt6737
 * mt6739
 * mt6755
 * mt6757
 * mt6761
 * mt6763
 * mt6765
 * mt6768
 * mt6771
 * mt6785
 * mt6799
 * mt6873
 * mt8127
 * mt8163
 * mt8173
 * mt8695

Supported SoCs
A few MediaTek SoCs have decent support in mainline, and many others have some basic support (only UART and/or I2C). This table shows the SoCs with documented support:

There have been some successes in porting mainline Linux to other SoCs:
 * https://github.com/mt8163-mainline/linux
 * https://github.com/arzam16/linux-mt6577
 * https://github.com/mt6735-mainline/linux

Futher reading

 * Coolpad Modena 2 (coolpad-modena2)
 * http://www.lieberbiber.de/2015/07/02/mediatek-details-soc-startup/
 * http://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preloader/
 * https://forum.xda-developers.com/u/repair/coolpad-sky-3-e502-modena-2-unbrick-t3610163 (KCOL0 unbrick)
 * https://github.com/ave4/SP-Flash-Tool-source
 * Boot ROM Design Specification