linux-chenxing.org

linux-chenxing

Github project

Intro

This is intended to be a repository for info on the MStar/SigmaStar SoCs and the associated mainling effort.

This will probably never get as big as linux-sunxi so github pages should be more than enough.

Before MStar was bought out by MediaTek the company offered a wide range of SoCs focused at STB and camera applications. Since the company was bought by MediaTek the camera SoC part of the company has been spun out into the fully owned subsidiary called Sigmastar. The camera SoCs that are now marketed by Sigmastar will be the main focus here.

It’s worth noting that the MStar/Sigmastar camera SoCs seem to be derived from the SoCs made by Alpha Imaging Technology which was merged into MStar at some point.

FAQ

Porting Progress Matrix

u-boot

For most chips u-boot is loaded by loading the SPL as IPL-CUST from the IPL so that blob is needed. The mercury5 however can boot with the u-boot SPL as the IPL so no blobs are required. Getting the other chips to boot without the vendor IPL is mostly a case of doing the DDR setup in the SPL.

  load u-boot SPL from boot ROM load u-boot SPL from vendor IPL load u-boot from SPI NOR load u-boot from SPI NAND load u-boot from SD
infinity1   yes yes    
infinity2m   yes wip yes  
infinity3   yes yes    
infinity5   wip wip    
infinity6   wip wip    
infinity6b0   wip wip    
infinity6e          
mercury5 yes, SD yes yes   yes
pioneer3          

linux

  boots to shell from initramfs boots to shell from local storage full system from local storage with network etc boots without blobs (no vendor IPL) smp
infinity1 yes yes yes    
infinity2m yes   yes   yes
infinity3 yes yes yes    
infinity5          
infinity6 wip wip wip    
infinity6b0 yes wip wip    
infinity6e          
mercury5 yes yes yes yes  
mercury6          
pioneer3          

Data Mining Progress

This table is an attempt to collect all of the different part numbers for the different families and the resources that have been found to reverse engineer each of them.

If possible the data codes will have the earliest and latest known date codes so that we can tell roughly when each type of chip was produced.

family part date codes process size sample device acquired boot rom dumped firmware dumped SDK acquired product brief acquired datasheet acquired
cedric                  
  mst786               yes
infinity1             yes[0]    
  msc313 1647B   yes yes        
  msc313d 1638B              
infinity2m             yes    
  msr620                
  msr620q 1717S              
  ssr621d 1945S   yes yes yes      
  ssd201             yes  
  ssd202d             yes  
infinity3             yes[0]    
  msc313e 1744B   yes yes yes   yes  
    1916S              
  msc316dc 1929S   yes same as msc313e yes   yes  
  msc316q             yes  
  msc318             yes  
infinity5                  
  ssa520d                
infinity6                  
  ssc323 1928S              
    1936J              
  ssc325 1937S   yes yes yes      
  ssc333   28nm            
  ssc333de   28nm            
infinity6b0                  
  ssc335   28nm            
  ssc336d   22nm            
  ssc336q   22nm            
  ssc337de   28nm yes          
  ssc338q   22nm            
  ssc338g   22nm            
infinity6e                  
  ssc339g   22nm            
mercury2       yes          
  msc8328 1744       yes      
mercury5                  
  ssc8336 1915S   yes   yes      
  ssc8336n 1918S   yes yes yes      
    1936S              
  ssc8339d 1838A           yes  
pioneer3                  
  ssd210                
  ssd212                
  ssc9211 2118S     yes yes      
misc                  
  ssa330d             yes  
  ssa530g             yes  
  ssd222             yes  

Mainlining progress

See mainlining

SoCs

Spotted a chip that isn’t here? Please see adding new chips.

MIPS based

MStar used to make a lot of MIPS based SoCs for STBs. These aren’t that interesting in themselves but the IP blocks used in the MIPS SoCs were carried forward to the later ARM chips so any datasheets that can be found for the MIPS SoCs might help with reverse engineering the current ARM based ones.

STB

32bit ARM based

Napoli?

Cedric Family

Infinity IP camera family

Infinity1

Infinity2

Infinity2m

Infinity3

Infinity 4

Doesn’t seem to exist.

Infinity5

Infinity6

Infinity6b0

Infinity 6e

These seem to be i6e based on the build tag found in a kernel image for the SSC8629

Pioneer3

This seems to be an evolution of the infinity2m chips.

Mercury family

Mercury2

Mercury5

Mercury6

Misc

64bit ARM based

According to the code that is in the wild and SigmaStars page there are some Cortex-A53 based chips.

https://wemp.app/posts/1d5e4d06-dab5-408d-8349-7721957ca66e

MediaTek chips that contain/have some MStar heritage

Non-SoC chips

Injoinic PMICs

Injoinic seem to be the recommended PMIC vendor for these chips. Maybe like the Allwinner/Xpowers relationship?

Silan chips

Silan MEMs accelerometers seem to be used for a lot of the dash cam devices.

IP blocks

See IP.

ISP/Debug Tool

See ISP.

Blobs, headers, layouts

Vendor uboot, kernels..

Vendor SDKs

Sources of firmwares for reverse engineering

To get the device tree out of the kernel you can use binwalk + extract-dtb and dtc.

binwalk -e <firmware.bin>
extract-dtb.py <extracted firmware dir><uncompressed kernel blob>
dtc -I dtb -O dts -o out.dts <extracted dtb that looks right>

Dumping out registers from running vendor kernels

This works for dumping out a bank under wireless tag’s openwrt:

BASE=0x1f206800; for X in `seq 0 127`; do A=$(($BASE + (4 * $X))); V=`devmem $A`; printf "0x%X - %s\n" $A $V; done

Development boards

Links

Buying chips

See wheretobuy