Mediatek

From postmarketOS
Jump to: navigation, search

This page is WiP.

Booting procedure

Power applied to the SoC

When chip is powered on the dram controller pushes the address of brom (boot rom, mask rom that is hardwired) to PC (program counter) and execution of rom begins.

Brom execution

  1. UART1 gets initialized to some predetermined baudrate. Baud usually depends in chip input clock source. Observation has been made that UART1 is disabled on many phones, but can be enabled if proper firmware is used and eFuses are not blown.
  2. Initialize storage with low clock. Reason why it's using low clock is because muxes are not programmed at this stage.
  3. Wait for "Start" string on UART1 for unknown amount of time, the internet keeps buzzing about 150ms. After start is recieved, listen to commands from host until jump is observed (refer to brom spec in further reading section). If start is not sent then Preloader image will be loaded from the storage to the SRAM (static ram) and brom loads it according to the flags set in header.
  4. If KCOL0 pin is shorted to the ground, preloader loading is avoided and download protocol is rolled up on USB port.

Image format

Incomplete and has missing information. Feel free to coordinate corrections on Matrix chat.

This format is used in brom and preloader(has to be verified). All fields are in little endian.

File info image format

Size Content Extra notes
4 4d 4d 4d 01
4 Length of complete header (including this size field and the magic field above)
12 "FILE_INFO\0\0\0" Pay attention to padding bytes
4 01 00 00 00
2 Image type 0: NONE 1: ARM-Bootloader 2: ARM-External-Bootloader 10: Root-Certificate 256: Primary-MAUI 264: VIVA 769: SECURE_RO_ME
1 Storage type 0: NONE 1: NOR Flash 2: NAND Sequential Flash 3: NAND_TTBL 4: NAND_FDM50 5: EMMC-Boot-Region 6: EMMC-Data-Region 7: Serial Flash 255: Device-End
1 Signature type 0: No Signature 1: PHASH 2: SINGLE 3: SINGLE and PHASH 4: MULTI 5: TYPE_NUM 255: TYPE_END
4 Load address
4 Total file size
4 00 00 04 00 Maximum file size
4 Content offset in file You can have multiple headers before actual content (preloader assembly image)
4 Signature length If no signature was set, size is 0
4 Jump offset Seems to be the same as content offset, maybe because preloader needs to execute
4 Ending 1: POST_BUILD_DONE 2: XIP (Execute In Place) use bitwise OR to combine multiple flags

Example data from MT6735P chipset

ROM:00031128 magicValue      DCD 0x14D4D4D
ROM:0003112C HeaderSize      DCD 0x38                ; completeHeaderSize
ROM:00031130 aFile_info      DCB "FILE_INFO",0,0,0
ROM:0003113C alwaysOne       DCD 1
ROM:00031140 FileType        DCW 1                   ; ARM-Bootloader
ROM:00031142 FlashType       DCB 5                   ; EMMC-Boot-Region
ROM:00031143 SignatureType   DCB 3                   ; Single and PHASH
ROM:00031144 LoadAddress     DCD 0x200D00            ; SRAM address
ROM:00031148 FileLength      DCD 0x1CE4C
ROM:0003114C MaximumSize     DCD 0x40000
ROM:00031150 ContentOffset   DCD 0x300
ROM:00031154 SigLen          DCD 0x124
ROM:00031158 JumpOffset      DCD 0x300
ROM:0003115C Ending          DCD 1                   ; POST_BUILD_DONE

Futher reading