Subsystems

Sensors

The sensor hub (SCP) and the HID services it feeds.

Hardware

The phone’s sensors (accelerometer, gyroscope, magnetometer, light and proximity, step counting) sit behind a sensor hub: MediaTek’s SCP, a Cortex-M4 at 0x10500000 with 768 KiB of SRAM, which Android starts with a firmware image and talks to through IPI messages and a ring of records in DRAM.

Driver

mtk_scp.c has one thread that owns the SCP: it polls for messages every 2 ms, answers them and applies what the HID services ask for. mp_sensor_steps (default 5; 0 leaves the SCP alone), each step with the ones before it: 1 status, read only; 2 the IPI handshake (the SCP’s clock to the 26 MHz crystal with mp_scp_clk26m=1, the start when LK’s region information is in a memory hole, READY within 30 s, the hub’s INIT_DONE, a 1 MiB ring below 2 GiB handed over, the non-wakeup interrupt unmasked unless mp_scp_unmask=0); 3 the accelerometer and its HID service; 4 the plain sensors; 5 also what locationd reads from the SPU: steps and activity, raise to wake and device motion. A quiet hub is given its ring and the wanted sensors again every 10 s, six tries. The records go to MappleSPU.cpp’s HID services, which stand in for Apple’s SPU. mt6781_scp.c has the registers. The hub’s own firmware is the vendor’s and is not in any repository.

By default only the accelerometer and the orientation service are published (mp_spu_off is 0x7de, a bit per service left out); mp_spu_off=0 publishes all of them. Orientation runs the accelerometer at 10 Hz and is held for 300 ms of sample time before it is reported. The light sensor reports 100 lux (mp_als_default) until its first reading.

Device tree

None of its own: the hub is addressed by the driver.

Boot-arguments

mp_sensor_steps, mp_scp_clk26m, mp_scp_unmask, mp_scp_ring_max, mp_scp_accel_us, mp_spu_off, mp_spu_prox, mp_imu_axes, mp_mag_axes, mp_als_div, mp_als_default and mp_stride_cm in the catalogue. Sysctl: kern.mapple_sensors gives a line per hub sensor: its name, whether it is present and enabled, its samples and the milliseconds since the last.

User space

iOS reads the HID services; the hub’s orientation decision turns the screen (rotation), and on the GPU the Metal driver turns the rotated surfaces.

Status

device.conf: missing. Rotation, which depends on the hub, works: landscape both ways, about a second a turn on the GPU (run 47). The light, proximity, compass and step sensors are planned for release 2.

Seen: services published and opened, with records flowing (33880 by 310 s in run 45); rotation in landscape both ways (run 45); automatic brightness not proven (a torch gave 500 nits and covering the sensor never dimmed).

Known issues

• Automatic brightness, the compass, proximity and step counting are not there yet.
• An occasional turn back to portrait is slower than the first turn.

Source files

bsd/dev/mtk_scp.c, mtk_scp_hub.h, iokit/Kernel/arm/hid/MappleSPU.cpp, MappleSPU.h of the kernel at dcb77a0; osfmk/arm64/mt6781_scp.c of the MT6781 layer at 426b4f6; the rotated-surface code in mapple_gpu_mali at cdd9794.