Skip to content

Latest commit

 

History

History
486 lines (341 loc) · 29.9 KB

index.md

File metadata and controls

486 lines (341 loc) · 29.9 KB
Raw

linux-chenxing

Github project

Intro

This is intended to be a repository for info on the MStar/SigmaStar SoCs and the associated mainling effort.

This will probably never get as big as linux-sunxi so github pages should be more than enough.

Before MStar was bought out by MediaTek the company offered a wide range of SoCs focused at STB and camera applications. Since the company was bought by MediaTek the camera SoC part of the company has been spun out into the fully owned subsidiary called Sigmastar. The camera SoCs that are now marketed by Sigmastar will be the main focus here.

It's worth noting that the MStar/Sigmastar camera SoCs seem to be derived from the SoCs made by Alpha Imaging Technology which was merged into MStar at some point.

FAQ

  • Q: Why linux-chenxing?

  • A: The name is a parody of linux-sunxi for Allwinner SoCs. MStar in Chinese is chenxing and the newer SigmaStar name is xingchen.

  • Q: Is this the official support site for MStar/SigmaStar?

  • A: No. There is no relationship between this site and the vendor. This is a "community" (community meaning one guy with a multimeter right now) research effort.

  • Q: Have you reached out to the vendor to get more information?

  • A: Yes, they said without an NDA and project in place they cannot help. Signing an NDA would be a bad idea for code that is going mainline.

  • Q: If I pay you money will you support me using the official SDKs?

  • A: No.

  • Q: Is there an IRC channel, discord or something for discussion?

  • A: Please use github's discussion feature for now.

  • Q: Should I upload SDKs and post links here?

  • A: Please don't. Extract the parts that are licensed in a friendly way (i.e. GPLv2 or BSD) and push them onto github or somewhere and link that instead.

    The exception to this rule is where the SDK has already been leaked to github. For example there are some copies of the SDKs that seem to have been uploaded by manufacturers that are actually trying to comply with the licenses covering the kernel, u-boot etc and uploaded the entire SDK.

    Basically, if someone else leaks their copy of an SDK that's their problem.

  • Q: Should I upload datasheets or other references here?

  • A: Maybe. If they are already easy to download then putting them here for non-profit educational/research purposes should be ok. IANAL but as far as I can tell github is in the US and fair use applies.

    Materials that are behind an NDA wall like those in the SDKs might be interesting but most of the information they contain can be worked out from the kernel sources or about stuff contained the proprietary modules we don't really care about anyways.

  • Q: Why is Tux orange and why does he have a stalk and leaf sticking out of his head?

  • A: The SigmaStar logo is an orange isn't it? Looks like one to me.

Porting Progress Matrix

u-boot

For most chips u-boot is loaded by loading the SPL as IPL-CUST from the IPL so that blob is needed. The mercury5 however can boot with the u-boot SPL as the IPL so no blobs are required. Getting the other chips to boot without the vendor IPL is mostly a case of doing the DDR setup in the SPL.

load u-boot SPL from boot ROM load u-boot SPL from vendor IPL load u-boot from SPI NOR load u-boot from SPI NAND load u-boot from SD
infinity1 yes yes
infinity2m yes wip yes
infinity3 yes yes
infinity5 wip wip
infinity6 wip wip
infinity6b0 wip wip
infinity6e
mercury5 yes, SD yes yes yes
pioneer3

linux

boots to shell from initramfs boots to shell from local storage full system from local storage with network etc boots without blobs (no vendor IPL) smp
infinity1 yes yes yes
infinity2m yes yes yes
infinity3 yes yes yes
infinity5
infinity6 wip wip wip
infinity6b0 yes wip wip
infinity6e
mercury5 yes yes yes yes
mercury6
pioneer3

Data Mining Progress

This table is an attempt to collect all of the different part numbers for the different families and the resources that have been found to reverse engineer each of them.

If possible the data codes will have the earliest and latest known date codes so that we can tell roughly when each type of chip was produced.

family part date codes process size sample device acquired boot rom dumped firmware dumped SDK acquired product brief acquired datasheet acquired
cedric
mst786 yes
infinity1 yes[0]
msc313 1647B yes yes
msc313d 1638B
infinity2m yes
msr620
msr620q 1717S
ssr621d 1945S yes yes yes
ssd201 yes
ssd202d yes
infinity3 yes[0]
msc313e 1744B yes yes yes yes
1916S
msc316dc 1929S yes same as msc313e yes yes
msc316q yes
msc318 yes
infinity5
ssa520d
infinity6
ssc323 1928S
1936J
ssc325 1937S yes yes yes
ssc333 28nm
ssc333de 28nm
infinity6b0
ssc335 28nm
ssc336d 22nm
ssc336q 22nm
ssc337de 28nm yes
ssc338q 22nm
ssc338g 22nm
infinity6e
ssc339g 22nm
ssc9351q 2114j 22nm yes yes yes yes
ssc9351d 22nm yes
mercury2 yes
msc8328 1744 yes
mercury5
ssc8336 1915S yes yes
ssc8336n 1918S yes yes yes
1936S
ssc8339d 1838A yes
mercury6
ssd268g
pioneer3
ssd210
ssd212
ssc9211 2118S yes yes
misc
ssa330d yes
ssa530g yes
ssd222 yes

Mainlining progress

See mainlining

SoCs

Spotted a chip that isn't here? Please see adding new chips.

MIPS based

MStar used to make a lot of MIPS based SoCs for STBs and TVs. These aren't that interesting in themselves but the IP blocks used in the MIPS SoCs were carried forward to the later ARM chips so any datasheets that can be found for the MIPS SoCs might help with reverse engineering the current ARM based ones.

Titania4

  • MSD306PT
  • MSD309PX - 312 MHz MIPS 34Kc in a 536-ball BGA
  • MSD318QT

Milan

  • MSD3463GU - MIPS 34Kf with 64 MiB DDR2 in a eLQFP128

Marlon

  • MSD3663LUA - MIPS 34Kf with 64 MiB DDR2 in a eLQFP128

Kronus

  • MSD5043 - 552 MHz MIPS 34Kf in BGA
  • MSD7816 - 552 MHz MIPS 34Kf in a eLQFP128
  • MSD7818 - mostly same as MSD7816 but with integrated demod

Kappa

  • MSD7802 - 600 MHz MIPS 34Kf in eLQFP128

Kriti

  • MSD7T01 - 576 MHz MIPS 34Kf + 64 MiB DDR2 in a eLQFP128
  • MSD7T03 - same as MSD7T01 but with 128 MiB DDR3 instead

Kirin

K5AP

  • MSA7T00 - 750 MHz MIPS 34Kf + 64 MiB DDR2 in a QFN80
  • MSA7T00E - same as MSA7T00, but with Ethernet MAC/PHY
  • MSA7T10E - same as MSA7T00E, but with HEVC decoder

something else

  • MSD7828

32bit ARM based

Napoli?

  • MSO9810 - Quad Core ARM Cortex-A9

Messi

  • MSD6A338S (aka MSD338S) - 1.5 GHz Dual Cortex-A7 in a BGA
    • MSD6A338ST - 512 MiB DDR3
    • MSD6A338SXG - 1 GiB DDR3

Cedric Family

  • MST786 - Dual core Cortex A9 automotive (head unit) SoC

Infinity IP camera family

Infinity1

  • IP camera chips with video encoder and camera interface

  • MSC313 - Cortex A7 + 64MB DDR2 in a QFN80

  • MSC313D - Probably a Cortex A7 + 128MB DDR3 in a BGA

Infinity2

  • part numbers not known. there are some references in the SDKs etc to infinity2 and it seems to be dual Cortex A9
  • Probably for the recording side i.e. has a video decoder and no camera interface.

Infinity2m

  • Closer to the infinity6 chips than the infinity2.

  • Probably a replacement for the recording side, has video decoder, framebuffer etc.

  • SSR621D - Dual Cortex A7 128MB DDR3(TBC) in QFN128 with HDMI, VGA, SATA

  • SSD201 - Dual Cortex A7 with 64MB of DDR2 in QFN128

  • SSD202D - Dual Cortex A7 with 128MB of DDR3 in a QFN128

  • MSR620? Maybe "k6lite" family

  • MSR630? Maybe "k6" family

    • TL-NVR6104C-4PX (based on MSR630 being in the source paths in the kernel binary)

Infinity3

  • Updated version of the infinity1

  • MSC313E - Cortex A7 + 64MB DDR2 in a QFN80

  • MSC316DC - Cortex A7 + 128MB DDR3 in a QFN88

  • MSC316Q - Cortex A7 + 128MB DDR3 in a 256 ball BGA

  • MSC318 - Cortex A7 + 128MB DDR3 in a 324 ball BGA

Infinity 4

Doesn't seem to exist.

Infinity5

  • Seems to be a version of the infinity3 that can handle higher resoltion sensors.

  • SSC328Q - Cortex A7 + 256MB DDR3 (this might be i6)

  • SSC329Q - Cortex A7 + 256MB DDR3 + NPU (this might be i6)

  • SSA520D - 64MB DDR2? BGA

Infinity6

  • Updated version of the infinity3.

  • SSC323 - probably Cortex A7 + 64MB DDR2 in a QFN88

  • SSC325 - Cortex A7 + 64MB DDR2 in a QFN88

  • SSC325DE - Cortex A7 + 128MB DDR3 in a QFN88

  • SSC326D - Cortex A7 + 128MB DDR3 + NPU

  • SSC327DE - Cortex A7 + 128MB DDR3

Infinity6b0

Infinity 6c

  • SSC377 - Cortex A35, QFN88, 64MB DDR2 Internal, BROM signature MVX4##I6C#gd11293fROM########XVM -- Anjoy vision MC-J40:

Infinity 6e

  • Infinity 6e seems to be a dual core variation in this family

  • SSC339G - Dual Cortex A7

These seem to be i6e based on the build tag found in a kernel image for the SSC8629

Pioneer3

This seems to be an evolution of the infinity2m chips.

Mercury family

Mercury2

Mercury5

  • Dash camera SoC based on the infinity3.

  • SSC8336 - Probably Cortex A7 + 64MB DDR2 in a QFP128

  • SSC8336N - Cortex A7 + 64MB DDR2 in a 128 pin QFN

  • SSC8339D - Probably in this family, Cortex A7 + 128MB(?) DDR3(?) in a 268 ball BGA

Mercury6

SDK name: TIRAMISU

  • SSD268G - 2 * Cortex A53
  • SSC359G - 2 * Cortex A53, 64bit, BGA, Ext. RAM, BROM signature MVX4######ga2f5884M6_ROM#####XVM

Misc

64bit ARM based

According to the code that is in the wild and SigmaStars page there are some Cortex-A53 based chips.

  • SSC8826D - 2 * Cortex A53, QFN
  • SSC8826Q - 2 * Cortex A53, QFN
  • SSC8836Q - Cortex A53, LQFP
  • SSC8838G - Cortex A53, BGA
  • SSC8526 - 2 * Cortex A53, BGA
  • SSD261Q - 2 * Cortex A53
  • SSR910Q - 2 * Cortex A53, LQFP
  • SSR920G - 2 * Cortex A53, BGA

https://wemp.app/posts/1d5e4d06-dab5-408d-8349-7721957ca66e

RISC-V?

MediaTek chips that contain/have some MStar heritage

  • MT53xx

  • MSD6886

  • MT9255 (aka MSD368) - Quad Cortex-A53 in a 156-pin QFN

    • MT9255A - 512 MiB RAM
    • MT9255B - 1 GiB RAM

Non-SoC chips

Injoinic PMICs

Injoinic seem to be the recommended PMIC vendor for these chips. Maybe like the Allwinner/Xpowers relationship?

Silan chips

Silan MEMs accelerometers seem to be used for a lot of the dash cam devices.

CPU blocks

See CPU.

IP blocks

See IP.

ISP/Debug Tool

See ISP.

Blobs, headers, layouts

  • BootROM - Baked in BootROM
  • IPL - First/Second stage bootloaders
  • MXPT - Partition table used for SPI NOR
  • CIS - "Chip information structure"? first block for SPI NAND.

Vendor uboot, kernels..

Vendor SDKs

Sources of firmwares for reverse engineering

To get the device tree out of the kernel you can use binwalk + extract-dtb and dtc.

binwalk -e <firmware.bin>
extract-dtb.py <extracted firmware dir><uncompressed kernel blob>
dtc -I dtb -O dts -o out.dts <extracted dtb that looks right>

Dumping out registers from running vendor kernels

This works for dumping out a bank under wireless tag's openwrt:

BASE=0x1f206800; for X in `seq 0 127`; do A=$(($BASE + (4 * $X))); V=`devmem $A`; printf "0x%X - %s\n" $A $V; done

Development boards

Links

Buying chips

See wheretobuy