MediaTek

From postmarketOS
Jump to navigation Jump to search

Devices with a MediaTek SoC

Device Chipset Booting Mainline
Acer Chromebook Spin 311 Mediatek MT8183 Yes Y
Acer Liquid Zest 4G MediaTek MT6735 No
Acer Liquid Zest 4G MediaTek MT6735 Yes
Alcatel OneTouch Pixi 4 (5) 5010D MediaTek MT6580 Yes N
Alcatel Pixi 4 (4) [4034D/4034X] MediaTek MT6580 Yes
ALPS (Known also as iPro) Mediatek Obscure Device (MT6572) MediaTek MT6572 No
Amazon Fire 7 (2015) MediaTek MT8127 Yes N
Amazon Fire 7 (2017) MediaTek MT8127 Yes N
Amazon Fire 7 (2019) MediaTek MT8163V/B (64-bit quad-core) Yes
Amazon Fire HD 10 (7th gen) Mediatek MT8173 Yes
Amazon Fire HD 8 (2017) Mediatek MT8163 Yes N
Amazon Fire HD 8 (2018) MediaTek MT8163 Yes
Amazon Fire TV 2 Mediatek MT8173C No N
Amazon Fire TV Stick 4K MediaTek MT8695 Yes -
ASUS Chromebook C202XA Mediatek MT8173C Yes Y
ASUS Zenfone Go (MTK) MediaTek MT6580 Yes
BQ Aquaris M10 Mediatek MT8163B No
BQ Aquaris M10 FHD Mediatek MT8163B Yes N
Coolpad Modena 2 MediaTek MT6735P No
Digma 1538E 4G MediaTek MT8735 No Y
Fairphone Fairphone 1 MediaTek MT6589 Yes P
Fly Spark MediaTek MT6572 Yes
Huawei Y3 II 3G MediaTek MT6582 (M?) No
Huawei Y360-U61 Mediatek MT6582 No
Just5 Freedom X1 MediaTek MT6753 No N
Land Rover A9 MediaTek MT6582 No
LeEco Le 1s Mediatek MT6795 Helio X10 Yes
Lenovo 100e Chromebook 2nd Gen (MTK) Mediatek MT8173C Yes Y
Lenovo 300e Chromebook Mediatek MT8173C Yes Y
Lenovo 300e Chromebook 2nd Gen (MTK) Mediatek MT8173C Yes Y
Lenovo Chromebook C330 Mediatek MT8173C Yes Y
Lenovo Chromebook S330 Mediatek MT8173C Yes Y
Lenovo IdeaPad Duet Mediatek MT8183 Yes Y
Lenovo IdeaPad Flex 3 Chromebook (CB-11M735) Mediatek MT8173C Yes Y
Lenovo IdeaTab A3000 MediaTek MT6589 Yes P
Lenovo K4 Note Mediatek MT6753 (28 nm) Yes
Lenovo Lenovo Smart Tab M10 FHD Plus Mediatek MT6762 (Helio P22T) No
Lenovo N23 Yoga Chromebook Mediatek MT8173C Yes Y
Lenovo Tab 10 FHD Plus 2nd Gen MediaTek MT8768 (Helio P22T) No
Lenovo Tab3 7 Essential Mediatek MT8321 No
Lenovo Vibe P1m Mediatek MT6735P Yes N
LG Bello II MediaTek MT6582 No N
LG K40 MediaTek MT6765 Yes N
LG K5 MediaTek MT6580 No
Meizu M2 MediaTek MT6735 Yes
Meizu M2 Note Mediatek MT6753 No
Mobvoi Ticwatch E/S MediaTek MT2601 No
Motorola Moto C Plus MediaTek MT6737 Yes
NGM WeMove Action MediaTek MT6575 No
Nokia 1 MediaTek MT6737M Yes
Nokia 3 (2017) MediaTek MT6737 Yes
Oppo F15 Mediatek MT6771V Helio P70 No
Oppo Neo 5 Mediatek MT6582 No
Oysters T84Bi 4G MediaTek MT8735 No Y
Planet Computers Gemini PDA MediaTek MT6797P/X Helio X25/X27 Yes N
Poin2 Chromebook 11C Mediatek MT8173C Yes Y
Poin2 Chromebook 14 Mediatek MT8173C Yes Y
Prestigio Prestigio MultiPad PMT5008 3G MediaTek MT8382 No P
Samsung Galaxy Grand Prime+ MediaTek MT6737T Yes Y
Sony Sony Bravia KDL-43W755C Mediatek MT5890 No
Sony Xperia M5 Mediatek MT6795 Helio X10 Yes
Sony Mobile Xperia XA Mediatek MT6755 (Helio P10) Yes N
Sony Mobile Xperia XA Ultra Mediatek MT6755 (Helio P10) Yes
Teracube One Mediatek MT6771 (Helio P60) No
Umidigi F2 Mediatek MT6771V/CT (Helio P70) Yes N
Vernee Thor MediaTek MT6753 Yes N
Volla Phone MediaTek MT6763V Helio P23 Yes P
Volla Phone X MediaTek MT6763V Helio P23 No
Wiko Fever MediaTek MT6753 No
Wiko Harry Mediatek MT6737/ MT6735M No
Wiko Lenny 2 MediaTek MT6580 Yes N
Wiko Lenny 3 MediaTek MT6580M Yes
Wiko Lenny 5 Mediatek MT6580 Yes
Wiko Sunset 2 MediaTek MT6572W No
Wiko U FEEL MediaTek MT6735 Yes
Xiaomi Redmi 6A Mediatek MT6761 Helio A22 Yes
Xiaomi Redmi Note 10 5G MediaTek MT6833 Dimensity 700 5G (7 nm) No
Xiaomi Redmi Note 8 Pro Mediatek MT6785 (Helio G90T) Yes N
Xunlong Orange Pi 4G-IoT MediaTek MT6737M No
ZTE Blade X3 Mediatek MT6735P No

For an overview of Mediatek devices, see Mediatek.

Glossary

See MediaTek Glossary.

Flashing

If you want to flash firmware to Mediatek-based devices, there is a proprietary tool for that: SP Flash Tool. It is e.g. used for the Wiko Lenny 3 (wiko-lenny3).

Some devices also support fastboot, e.g. Sony Xperia XA (sony-tuba).

Some open source software has been developed:

  1. https://github.com/saleemrashid/mediatek_flash_tool has only been tested with the MT6580
  2. https://github.com/MediaTek-Labs/mt76x7-uploader which is compatible with the MT7687 and MT7697 for flashing the bootloader
  3. https://github.com/Wiz-IO/Mediatek-MT2625-Flash-Utility for the MT2625
  4. https://github.com/McBitter/flasher only support for MT6735P, is WIP
  5. https://github.com/bkerler/mtkclient

Enabling previously disabled UART on downstream kernels

Sometimes you might need to get some data from UART on downstream kernel (for example, with intention to debug boot process of your pmOS port) but it's been automatically disabled by the preloader or UBoot or something else. One of the solutions suggested by the official MediaTek OEM FAQ is to run this command as early as possible:

echo "6 4 1 6" > /proc/sys/kernel/printk

To disable UART logs, run:

echo "0 0 0 0" > /proc/sys/kernel/printk

TODO Validate whether these commands require root shell
TODO Check if it works on mt67xx devices

Booting procedure

Power applied to the SoC

When chip is powered on the dram controller pushes the address of brom (boot rom, mask rom that is hardwired) to PC (program counter) and execution of rom begins.

Brom execution

  1. UART1 gets initialized to some predetermined baudrate. Baud usually depends in chip input clock source. Observation has been made that UART1 is disabled on many phones, but can be enabled if proper firmware is used and eFuses are not blown.
  2. Initialize storage with low clock. Reason why it's using low clock is because muxes are not programmed at this stage.
  3. Wait for "Start" string on UART1 for unknown amount of time, the internet keeps buzzing about 150ms. After start is recieved, listen to commands from host until jump is observed (refer to brom spec in further reading section). If start is not sent then Preloader image will be loaded from the storage to the SRAM (static ram) and brom loads it. Not sure if flags SP flash tool needs are used at bootup phase.
  4. If KCOL0 pin is shorted to the ground, preloader loading is avoided and download protocol is rolled up on USB port.

Memory maps of different system on chips

Image format

Note Incomplete and has missing information. Feel free to coordinate corrections on Matrix chat. Information here is only for reference. Flashing the binaries to storage will be done using brom protocol and custom flashing software.

This format is used in brom and preloader(has to be verified) while flashing with SP flash tool. All fields are in little endian.

File info image format

Size Content Extra notes
4 4d 4d 4d 01
4 Length of complete header (including this size field and the magic field above)
12 "FILE_INFO\0\0\0" Pay attention to padding bytes
4 01 00 00 00
2 Image type 0: NONE 1: ARM-Bootloader 2: ARM-External-Bootloader 10: Root-Certificate 256: Primary-MAUI 264: VIVA 769: SECURE_RO_ME
1 Storage type 0: NONE 1: NOR Flash 2: NAND Sequential Flash 3: NAND_TTBL 4: NAND_FDM50 5: EMMC-Boot-Region 6: EMMC-Data-Region 7: Serial Flash 255: Device-End
1 Signature type 0: No Signature 1: PHASH 2: SINGLE 3: SINGLE and PHASH 4: MULTI 5: TYPE_NUM 255: TYPE_END
4 Load address
4 Total file size
4 00 00 04 00 Maximum file size
4 Content offset in file You can have multiple headers before actual content (preloader assembly image)
4 Signature length If no signature was set, size is 0
4 Jump offset Seems to be the same as content offset, maybe because preloader needs to execute
4 Ending 1: POST_BUILD_DONE 2: XIP (Execute In Place) use bitwise OR to combine multiple flags

Example data from MT6735P chipset

ROM:00031128 magicValue      DCD 0x14D4D4D
ROM:0003112C HeaderSize      DCD 0x38                ; completeHeaderSize
ROM:00031130 aFile_info      DCB "FILE_INFO",0,0,0
ROM:0003113C alwaysOne       DCD 1
ROM:00031140 FileType        DCW 1                   ; ARM-Bootloader
ROM:00031142 FlashType       DCB 5                   ; EMMC-Boot-Region
ROM:00031143 SignatureType   DCB 3                   ; Single and PHASH
ROM:00031144 LoadAddress     DCD 0x200D00            ; SRAM address
ROM:00031148 FileLength      DCD 0x1CE4C
ROM:0003114C MaximumSize     DCD 0x40000
ROM:00031150 ContentOffset   DCD 0x300
ROM:00031154 SigLen          DCD 0x124
ROM:00031158 JumpOffset      DCD 0x300
ROM:0003115C Ending          DCD 1                   ; POST_BUILD_DONE

SP Flash Tool authentication bypass

By patching a USB driver, it is possible to bypass the chain of trust during flashing. More info in this GitHub repo and here

It is compatible with the following SoCs:

  • mt6261
  • mt6572
  • mt6580
  • mt6582
  • mt6735
  • mt6737
  • mt6739
  • mt6755
  • mt6757
  • mt6761
  • mt6763
  • mt6765
  • mt6768
  • mt6771
  • mt6785
  • mt6799
  • mt6873
  • mt8127
  • mt8163
  • mt8173
  • mt8695

Mainlining

Supported SoCs

A few MediaTek SoCs have decent support in mainline, and many others have some basic support (only UART and/or I2C). This table shows the SoCs with documented support:

SoC Arch Year UART USB Storage Display CPU GPU Pinctrl I²C Audio Video Thermal WiFi BT Modem GPS Camera Suspend
MediaTek MT6582 armv7 2013 Y N N N P N N N N N N N N N N N N
MediaTek MT6589 armv7 2013 Y N N N P N N N N N N - - N - N N
Mediatek MT8183 aarch64 2019 Y Y Y Y Y Y Y Y Y Y Y Y Y - - N Y

There have been some successes in porting mainline Linux to other SoCs:

Futher reading