Jump to content

Category:MediaTek

From postmarketOS Wiki


MediaTek Inc.
Brand of MediaTek Inc.
Brand of MediaTek Inc.
Name MediaTek Inc.
Native name 聯發科技股份有限公司
Nickname MTK,發哥
Country Taiwan / Worldwide
Industry Arm, Chip
Resources Homepage


MediaTek Inc. is a Taiwanese semiconductor company that designs and manufactures a range of semiconductor products.

Glossary

See MediaTek Glossary.

Naming Conventions

While there doesn't seem to be a stable pattern that MediaTek SoC names follow between subsequent generations, there are a few naming patterns that are prevalent.

MediaTek SoCs can be split into 5 main categories, each corresponding to a certain period of time where several SoCs were released with highly similar core architectures:

Pattern Common name CPU GPU Modem
MT62** - ARMv5 (ARM7) - 2G
MT65** - ARMv7 (Cortex-A) Mali Utgard, PowerVR SGX 3G
MT67** Helio* ARMv8 (Cortex-A) Mali Midgard, Mali Bifrost, PowerVR Rogue 4G
MT68** Dimensity ≤8000 Mali Valhall 5G
MT69** Dimensity 9000 ARMv8 (Cortex-X + Cortex-A)

*The Helio name wasn't used for MT673* as well as MT6750, MT6752 and MT6753 variants

There are SoCs that don't follow this convention. These SoCs are usually tablet or application variants of the MT6*** SoCs, and have names that follow the MT8*** pattern. For some of those SoCs, the only difference between the mobile and tablet variant is the first digit, while others have completely different names despite them being functionally identical. Here are some known mobile/tablet variant pairs:

Mobile MT6*** Tablet MT8***
MT6580 MT8321
MT6582 MT8382
MT6589 MT8389
MT6592* MT8127*
MT6735 MT8735
MT6771 MT8183
MT6789 MT8781
MT6875* MT8192*

*Unconfirmed

Flashing

If you want to flash firmware to Mediatek-based devices, there is a proprietary tool for that: SP Flash Tool. It is e.g. used for the Wiko Lenny 3 (wiko-lenny3).

Some devices also support fastboot, e.g. Sony Xperia XA (sony-tuba), and some support odin, e.g. Samsung Galaxy Grand Prime Plus (samsung-grandpplte).

Some open source software has been developed:

  1. https://github.com/saleemrashid/mediatek_flash_tool has only been tested with the MT6580
  2. https://github.com/MediaTek-Labs/mt76x7-uploader which is compatible with the MT7687 and MT7697 for flashing the bootloader
  3. https://github.com/Wiz-IO/Mediatek-MT2625-Flash-Utility for the MT2625
  4. https://github.com/McBitter/flasher only support for MT6735P, is WIP
  5. https://github.com/bkerler/mtkclient

Enabling previously disabled UART on downstream kernels

Sometimes you might need to get some data from UART on downstream kernel (for example, with intention to debug boot process of your pmOS port) but it's been automatically disabled by the preloader or UBoot or something else. One of the solutions suggested by the official MediaTek OEM FAQ is to run this command as early as possible:

# echo "6 4 1 6" > /proc/sys/kernel/printk

To disable UART logs, run:

# echo "0 0 0 0" > /proc/sys/kernel/printk

TODO TODO: Check if it works on mt67xx devices

Booting procedure

Power applied to the SoC

When chip is powered on the dram controller pushes the address of brom (boot rom, mask rom that is hardwired) to PC (program counter) and execution of rom begins.

Brom execution

  1. UART1 gets initialized to some predetermined baudrate. Baud usually depends in chip input clock source. Observation has been made that UART1 is disabled on many phones, but can be enabled if proper firmware is used and eFuses are not blown.
  2. Initialize storage with low clock. Reason why it's using low clock is because muxes are not programmed at this stage.
  3. Wait for "Start" string on UART1 for unknown amount of time, the internet keeps buzzing about 150ms. After start is recieved, listen to commands from host until jump is observed (refer to brom spec in further reading section). If start is not sent then Preloader image will be loaded from the storage to the SRAM (static ram) and brom loads it. Not sure if flags SP flash tool needs are used at bootup phase.
  4. If KCOL0 pin is shorted to the ground, preloader loading is avoided and download protocol is rolled up on USB port.

Memory maps of different system on chips

Image format

Note Incomplete and has missing information. Feel free to coordinate corrections on Matrix chat. Information here is only for reference. Flashing the binaries to storage will be done using brom protocol and custom flashing software.

This format is used in brom and preloader(has to be verified) while flashing with SP flash tool. All fields are in little endian.

File info image format

Size Content Extra notes
4 4d 4d 4d 01
4 Length of complete header (including this size field and the magic field above)
12 "FILE_INFO\0\0\0" Pay attention to padding bytes
4 01 00 00 00
2 Image type 0: NONE 1: ARM-Bootloader 2: ARM-External-Bootloader 10: Root-Certificate 256: Primary-MAUI 264: VIVA 769: SECURE_RO_ME
1 Storage type 0: NONE 1: NOR Flash 2: NAND Sequential Flash 3: NAND_TTBL 4: NAND_FDM50 5: EMMC-Boot-Region 6: EMMC-Data-Region 7: Serial Flash 255: Device-End
1 Signature type 0: No Signature 1: PHASH 2: SINGLE 3: SINGLE and PHASH 4: MULTI 5: TYPE_NUM 255: TYPE_END
4 Load address
4 Total file size
4 00 00 04 00 Maximum file size
4 Content offset in file You can have multiple headers before actual content (preloader assembly image)
4 Signature length If no signature was set, size is 0
4 Jump offset Seems to be the same as content offset, maybe because preloader needs to execute
4 Ending 1: POST_BUILD_DONE 2: XIP (Execute In Place) use bitwise OR to combine multiple flags

Example data from MT6735P chipset

ROM:00031128 magicValue      DCD 0x14D4D4D
ROM:0003112C HeaderSize      DCD 0x38                ; completeHeaderSize
ROM:00031130 aFile_info      DCB "FILE_INFO",0,0,0
ROM:0003113C alwaysOne       DCD 1
ROM:00031140 FileType        DCW 1                   ; ARM-Bootloader
ROM:00031142 FlashType       DCB 5                   ; EMMC-Boot-Region
ROM:00031143 SignatureType   DCB 3                   ; Single and PHASH
ROM:00031144 LoadAddress     DCD 0x200D00            ; SRAM address
ROM:00031148 FileLength      DCD 0x1CE4C
ROM:0003114C MaximumSize     DCD 0x40000
ROM:00031150 ContentOffset   DCD 0x300
ROM:00031154 SigLen          DCD 0x124
ROM:00031158 JumpOffset      DCD 0x300
ROM:0003115C Ending          DCD 1                   ; POST_BUILD_DONE

SP Flash Tool authentication bypass

By patching a USB driver, it is possible to bypass the chain of trust during flashing. More info in this GitHub repo and here

It is compatible with the following SoCs:

  • mt6261
  • mt6572
  • mt6580
  • mt6582
  • mt6735
  • mt6737
  • mt6739
  • mt6755
  • mt6757
  • mt6761
  • mt6763
  • mt6765
  • mt6768
  • mt6771
  • mt6779
  • mt6785
  • mt6799
  • mt6873
  • mt8127
  • mt8163
  • mt8173
  • mt8695

Mainlining

Supported SoCs

A few MediaTek SoCs have decent support in mainline, and many others have some basic support (only UART and/or I2C). This table shows the SoCs with documented support:

SoC Arch Year UART USB Storage Display CPU GPU Pinctrl I²C Audio Video Thermal WiFi BT Modem GPS Camera Suspend
MediaTek Helio P10/P15/P18 aarch64 2014 P N N P P N N N N N N N N N N N N
MediaTek Helio P90 aarch64 2018 Y N Y P Y N Y N Y N N N N N N N
MediaTek MT6580 armv7 2015 Y N N N P N N N N N N N N N N N N
MediaTek MT6582 armv7 2013 Y N N N P N N N N N N N N N N N N
MediaTek MT6589 armv7 2013 Y N N N P N N N N N N - - N - N N
MediaTek MT6735 aarch64 2014-2016 Y P P Y N Y Y N N N N N N N N N N
MediaTek MT6765 aarch64 2018/2020 Y Y Y Y Y N Y Y N N N N N N N N N
MediaTek MT6878 (Dimensity 7300) aarch64 2024 Y N N N Y N P N N N N N N N N N N
MediaTek MT8167 aarch64 2017 Y Y Y Y Y N Y Y N N N N N - N N N
MediaTek MT8173 aarch64 2015 Y Y Y Y Y P Y Y Y Y Y N N - - N P
MediaTek MT8183 aarch64 2019 Y Y Y Y Y Y Y Y Y Y Y N N - - N Y
MediaTek MT8186 aarch64 2022 Y Y Y Y Y Y Y Y N Y Y - - - - N N

There have been some successes in porting mainline Linux to other SoCs:

See Also

Futher reading


Devices with a MediaTek SoC

See Category:MediaTek/Devices

All MediaTek SoCs

SoC Arch Year UART USB Storage Display CPU GPU Pinctrl I²C Audio Video Thermal WiFi BT Modem GPS Camera Suspend
MediaTek Helio G99 aarch64 2022 Y P P P P N Y Y N
MediaTek Helio P10/P15/P18 aarch64 2014 P N N P P N N N N N N N N N N N N
MediaTek Helio P23 aarch64 2017 P P N P N N P N N N N N N N N N N
MediaTek Helio P65/G70/80/85/88 aarch64 2020 Y P N P P N Y P N N N N N N N N N
MediaTek Helio P90 aarch64 2018 Y N Y P Y N Y N Y N N N N N N N
MediaTek MT6572 armv7 2013
MediaTek MT6580 armv7 2015 Y N N N P N N N N N N N N N N N N
MediaTek MT6582 armv7 2013 Y N N N P N N N N N N N N N N N N
MediaTek MT6589 armv7 2013 Y N N N P N N N N N N - - N - N N
MediaTek MT6735 aarch64 2014-2016 Y P P Y N Y Y N N N N N N N N N N
MediaTek MT6739 aarch64 2017
MediaTek MT6765 aarch64 2018/2020 Y Y Y Y Y N Y Y N N N N N N N N N
MediaTek MT6785
MediaTek MT6797
MediaTek MT6833
MediaTek MT6833
MediaTek MT6833
MediaTek MT6878 (Dimensity 7300) aarch64 2024 Y N N N Y N P N N N N N N N N N N
MediaTek MT8167 aarch64 2017 Y Y Y Y Y N Y Y N N N N N - N N N
MediaTek MT8173 aarch64 2015 Y Y Y Y Y P Y Y Y Y Y N N - - N P
MediaTek MT8183 aarch64 2019 Y Y Y Y Y Y Y Y Y Y Y N N - - N Y
MediaTek MT8186 aarch64 2022 Y Y Y Y Y Y Y Y N Y Y - - - - N N
MediaTek MT8195
MediaTek MT8695