Category:MediaTek
|
Brand of MediaTek Inc. | |
| Name | MediaTek Inc. |
|---|---|
| Native name | 聯發科技股份有限公司 |
| Nickname | MTK,發哥 |
| Country | Taiwan / Worldwide |
| Industry | Arm, MIPS, Chip |
| Resources | Homepage |
MediaTek Inc. is a Taiwanese semiconductor company that designs and manufactures a range of semiconductor products.
Glossary
See MediaTek Glossary.
Naming Conventions
While there doesn't seem to be a stable pattern that MediaTek SoC names follow between subsequent generations, there are a few naming patterns that are prevalent.
MediaTek SoCs can be split into 5 main categories, each corresponding to a certain period of time where several SoCs were released with highly similar core architectures:
| Pattern | Common name | CPU | GPU | Modem |
|---|---|---|---|---|
MT62**
|
- | ARMv5 (ARM7) | - | 2G |
MT65**
|
- | ARMv7 (Cortex-A) | Mali Utgard, PowerVR SGX | 3G |
MT67**
|
Helio* | ARMv8 (Cortex-A) | Mali Midgard, Mali Bifrost, PowerVR Rogue | 4G |
MT68**
|
Dimensity ≤8000 | Mali Valhall, PowerVR Volcanic | 5G | |
MT69**
|
Dimensity 9000 | ARMv8 (Cortex-X + Cortex-A) |
*The Helio name wasn't used for MT673* as well as MT6750, MT6752 and MT6753 variants
There are SoCs that don't follow this convention. These SoCs are usually tablet or application variants of the MT6*** SoCs, and have names that follow the MT8*** pattern. For some of those SoCs, the only difference between the mobile and tablet variant is the first digit, while others have completely different names despite them being functionally identical. Here are some known mobile/tablet variant pairs:
Mobile MT6***
|
Tablet MT8***
|
|---|---|
MT6577
|
MT8317
|
MT6580
|
MT8321
|
MT6582
|
MT8382
|
MT6589
|
MT8125 MT8389
|
MT6592*
|
MT8127*
|
MT6735
|
MT8735
|
MT6771
|
MT8183
|
MT6789
|
MT8781
|
MT6875*
|
MT8192*
|
*Unconfirmed
Flashing
If you want to flash firmware to MediaTek-based devices, there is a proprietary tool for that: SP Flash Tool. It is e.g. used for the Wiko Lenny 3 (wiko-lenny3).
Some devices also support fastboot, e.g. Sony Xperia XA (sony-tuba), and some support odin, e.g. Samsung Galaxy Grand Prime Plus (samsung-grandpplte).
However, newer devices typically have secure boot enabled, which makes it impossible to use the SP Flash Tool without exploits. In this case, a signed Download Agent and a private key for the specific phone model are required. In such cases, consider using penumbra or mtkclient. These tools include various exploits that allow you to flash protected devices. Note that mtkclient often introduces regressions, so using penumbra or old mtkclient fork is recommended if the upstream mtkclient is broken.
As of late 2024, there are no known exploits in the Download Agent or other boot chain components. Paid tools have access to signed Download Agents, as well as private keys, and can therefore flash devices.
Other tools:
- https://github.com/saleemrashid/mediatek_flash_tool has only been tested with the MT6580
- https://github.com/MediaTek-Labs/mt76x7-uploader which is compatible with the MT7687 and MT7697 for flashing the bootloader
- https://github.com/Wiz-IO/Mediatek-MT2625-Flash-Utility for the MT2625
- https://github.com/McBitter/flasher only support for MT6735P, is WIP
- https://github.com/mt6572-mainline/da-boot only mt6572, WIP
Enabling previously disabled UART
Sometimes you might need to get some data from UART on downstream kernel (for example, with intention to debug boot process of your pmOS port) but it's been automatically disabled by the preloader or secondary bootloader (either U-Boot or LK). One of the solutions suggested by the official MediaTek OEM FAQ is to run this command as early as possible:
# echo "6 4 1 6" > /proc/sys/kernel/printk
To disable UART logs, run:
# echo "0 0 0 0" > /proc/sys/kernel/printk
On MT67XX devices it's usually done by setting field in the preloader header to disable UART log. It can be enabled back by holding volume up key before the LK boots.
Booting procedure
Power applied to the SoC
When chip is powered on, execution starts at 0x0. On older chips it contains ARM jump instruction to the real address, while on newer the BootROM is directly placed at 0x0.
Brom execution
- UART gets initialized with 115200 baud.
- Initialize storage with low clock. Reason why it's using low clock is because muxes are not programmed at this stage.
- If KCOL0 pin is shorted to the ground and BootROM USBDL efuse is not blown, the chip will enter USBDL. Otherwise the preloader is booted.
- Preloader will switch to the 921600 baud.
Memory maps of different system on chips
Image format
| Incomplete and has missing information. Feel free to coordinate corrections on Matrix chat. Information here is only for reference. Flashing the binaries to storage will be done using brom protocol and custom flashing software. |
This format is used in brom and preloader(has to be verified) while flashing with SP flash tool. All fields are in little endian.
File info image format
| Size | Content | Extra notes |
|---|---|---|
| 4 | 4d 4d 4d 01
| |
| 4 | Length of complete header (including this size field and the magic field above) | |
| 12 | "FILE_INFO\0\0\0"
|
Pay attention to padding bytes |
| 4 | 01 00 00 00
| |
| 2 | Image type | 0: NONE 1: ARM-Bootloader 2: ARM-External-Bootloader 10: Root-Certificate 256: Primary-MAUI 264: VIVA 769: SECURE_RO_ME |
| 1 | Storage type | 0: NONE 1: NOR Flash 2: NAND Sequential Flash 3: NAND_TTBL 4: NAND_FDM50 5: EMMC-Boot-Region 6: EMMC-Data-Region 7: Serial Flash 255: Device-End |
| 1 | Signature type | 0: No Signature 1: PHASH 2: SINGLE 3: SINGLE and PHASH 4: MULTI 5: TYPE_NUM 255: TYPE_END |
| 4 | Load address | |
| 4 | Total file size | |
| 4 | 00 00 04 00
|
Maximum file size |
| 4 | Content offset in file | You can have multiple headers before actual content (preloader assembly image) |
| 4 | Signature length | If no signature was set, size is 0 |
| 4 | Jump offset | Seems to be the same as content offset, maybe because preloader needs to execute |
| 4 | Ending | 1: POST_BUILD_DONE 2: XIP (Execute In Place) use bitwise OR to combine multiple flags |
Example data from MT6735P chipset
ROM:00031128 magicValue DCD 0x14D4D4D ROM:0003112C HeaderSize DCD 0x38 ; completeHeaderSize ROM:00031130 aFile_info DCB "FILE_INFO",0,0,0 ROM:0003113C alwaysOne DCD 1 ROM:00031140 FileType DCW 1 ; ARM-Bootloader ROM:00031142 FlashType DCB 5 ; EMMC-Boot-Region ROM:00031143 SignatureType DCB 3 ; Single and PHASH ROM:00031144 LoadAddress DCD 0x200D00 ; SRAM address ROM:00031148 FileLength DCD 0x1CE4C ROM:0003114C MaximumSize DCD 0x40000 ROM:00031150 ContentOffset DCD 0x300 ROM:00031154 SigLen DCD 0x124 ROM:00031158 JumpOffset DCD 0x300 ROM:0003115C Ending DCD 1 ; POST_BUILD_DONE
SP Flash Tool authentication bypass
By exploiting vulnerability in the BootROM, it's possible to bypass the chain of trust during flashing. More info in this GitHub repo and here.
Consider using open source tools instead of SP Flash Tool when possible.
It is compatible with the following SoCs:
- mt6261
- mt6572
- mt6580
- mt6582
- mt6735
- mt6737
- mt6739
- mt6755
- mt6757
- mt6761
- mt6763
- mt6765
- mt6768
- mt6771
- mt6779
- mt6785
- mt6799
- mt6873
- mt8127
- mt8163
- mt8173
- mt8695
Mainlining
Supported SoCs
Some MediaTek SoCs have decent support in mainline, and many others have some basic support (only UART and/or I2C). This table shows the SoCs with documented support:
| SoC | Arch | Year | UART | USB | Storage | Display | CPU | GPU | Pinctrl | I²C | Audio | Video | Thermal | WiFi | BT | Modem | GPS | Camera | Suspend |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MediaTek Dimensity 700 | aarch64 | 2020 | Y | N | N | P | P | N | Y | N | N | N | N | N | N | N | N | N | N |
| MediaTek Dimensity 7300 | aarch64 | 2024 | Y | Y | Y | P | Y | N | Y | Y | N | N | N | N | N | N | N | N | N |
| MediaTek Helio G90T/G95 | aarch64 | 2019/2020 | |||||||||||||||||
| MediaTek Helio G99 | aarch64 | 2022 | Y | Y | Y | P | P | Y | Y | Y | N | N | Y | N | N | N | N | N | N |
| MediaTek Helio P10/P15/P18 | aarch64 | 2014 | P | N | N | P | P | N | N | N | N | N | N | N | N | N | N | N | N |
| MediaTek Helio P65 | aarch64 | 2019/2020/2021/2024 | Y | P | Y | P | P | Y | Y | Y | N | N | Y | N | N | N | N | N | N |
| MediaTek Helio P90 | aarch64 | 2018 | Y | N | Y | P | Y | N | Y | N | Y | N | N | N | N | N | - | N | N |
| MediaTek MT6572 | armv7 | 2013/2014 | Y | Y | P | Y | P | Y | Y | Y | Y | ||||||||
| MediaTek MT6580 | armv7 | 2015 | Y | N | N | N | P | N | N | N | N | N | N | N | N | N | N | N | N |
| MediaTek MT6582 | armv7 | 2013 | Y | N | N | N | P | N | N | N | N | N | N | N | N | N | N | N | N |
| MediaTek MT6589 | armv7 | 2013 | Y | N | P | P | P | N | Y | N | N | N | N | - | - | N | - | N | N |
| MediaTek MT6735 | aarch64 | 2014-2016 | Y | P | P | Y | P | Y | Y | N | N | N | N | N | N | N | N | N | N |
| MediaTek MT6757 | aarch64 | 2016-2017 | Y | P | P | P | P | Y | Y | Y | N | N | P | N | N | N | N | N | N |
| MediaTek MT6765 | aarch64 | 2018/2020 | Y | Y | Y | Y | Y | N | Y | Y | N | N | N | N | N | N | N | N | N |
| MediaTek MT8167 | aarch64 | 2017 | Y | Y | Y | Y | Y | N | Y | Y | N | N | N | N | N | - | N | N | N |
| MediaTek MT8173 | aarch64 | 2015 | Y | Y | Y | Y | Y | N | Y | Y | Y | Y | Y | N | N | - | - | N | P |
| MediaTek MT8183 | aarch64 | 2019 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | N | N | - | - | N | Y |
| MediaTek MT8186 | aarch64 | 2022 | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | - | - | - | - | N | N |
| MediaTek MT8192 | aarch64 |
There have been some successes in porting mainline Linux to other SoCs:
- https://github.com/mt8163-mainline/linux
- https://github.com/arzam16/linux-mt6577
- https://github.com/mt6735-mainline/linux
- https://github.com/affenull2345/linux/tree/mt6771
See Also
Futher reading
- Coolpad Modena 2 (coolpad-modena2)
- http://www.lieberbiber.de/2015/07/02/mediatek-details-soc-startup/
- http://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preloader/
- https://forum.xda-developers.com/u/repair/coolpad-sky-3-e502-modena-2-unbrick-t3610163 (KCOL0 unbrick)
- https://github.com/ave4/SP-Flash-Tool-source
- Boot ROM Design Specification
Devices with a MediaTek SoC
Pages in category "MediaTek"
The following 33 pages are in this category, out of 33 total.
A
M
- MediaTek Dimensity 700 (MT6833)
- MediaTek Dimensity 7300 (MT6878)
- MediaTek Dimensity 800 (MT6873)
- MediaTek Helio A22 (MT6761)
- MediaTek Helio G90T/G95 (MT6785)
- MediaTek Helio G99 (MT6789/MT8781)
- MediaTek Helio P10 (MT6755)
- MediaTek Helio P23 (MT6763)
- MediaTek Helio P35 (MT6765)
- MediaTek Helio P65 (MT6768)
- MediaTek Helio P90 (MT6779)
- MediaTek Helio X20 (MT6797)
- MediaTek Kompanio 1200 (MT8195)
- MediaTek Kompanio 500 (MT8173)
- MediaTek Kompanio 500 (MT8183)
- MediaTek Kompanio 520 (MT8186)
- MediaTek Kompanio 820 (MT8192)
- MediaTek MT5565
- MediaTek MT6572
- MediaTek MT6580
- MediaTek MT6582
- MediaTek MT6589
- MediaTek MT6735
- MediaTek MT6739
- MediaTek MT6757
- MediaTek MT8127
- MediaTek MT8163
- MediaTek MT8167
- MediaTek MT8168
- MediaTek MT8695
- Mtkclient