The SigmaTel STMP3xxx series is a somewhat popular System-on-a-Chip solution for portable audio players. They include CPU, on chip RAM and ROM, I/O to external storage devices, display, and buttons, USB interface, ADC and DAC, headphone amplifier, and a battery management interface.
The major SigmaTel STMP3xxx series can be devided into the STMP34xx, STMP35xx, and STMP36xx series. The STMP35xx series is backward pin and firmware compatible with STMP3410. The STMP36xx series is based on a different CPU.
- Samsung YP-55 > STMP3400 - Firmware updates
- Rio Nitrus > STMP3400
- Rio Sport S30s/S35s > STMP3411L
- iAudio4 > STMP3400
- Philips Rush SA230 > STMP3411L - Firmware updater
- MPMan CS157 > STMP3504
- iPod Shuffle > STMP3550 - IpodShuffle
- iAudio i5, G2, G3, U2, F1 > STMP3520
- Cenix CMP-M5 > STMP3507
- Creative MuVo >STMP3520 - Useful page, Firmware archive
- Creative Zen Nano >STMP3520
- Creative Zen Stone > STMP3550
- Dyne Tuny 11 (AKA Trekstor i.Beat p!nk ) > STMP35XX
- Jingwah Digital JWM62 > STMP3505 - Teardown
- Philips SA 177+ SA1100 +SA1300s + SA1200 > STMP35XX
- Philips GoGear SA 31XX + 41XX + 51XX > STMP35XX - PhilipsGoGear3100Port
- Samsung YP-53 +YP-T6 > STMP35XX - Firmware updates
- Samsung YP-U1 +YP-F1 > STMP3550 - Firmware updates
- Samsung YP-U2 +YP-F2 > STMP3550 - Firmware updates
- RioForge , Rio Carbon > STMP35XX
- SanDisk Sansa e130/e140 > STMP35XX - Firmware updater
- Packard Bell Vibe 360 > STMP35XX
- Rover Aria M1 (MSI Megaplayer 533) > STMP35XX - An attempt by some Russians to write custom code for it
- iBead 400 (AKA Trekstor i.Beat organix) + iBead 600 (AKA Trekstor i.Beat sweez) >STMP3520 - TrekStorIBeatOrganixFM
- Median Mcody MX300, MX700 > STMP3520
- Median Mcody M20, M22, M25 > STMP3507
- Median Mcody M30 (AKA Trekstor i.Beat Blaxx ) > STMP3507
- Meizu X2, E2 (AKA Emgeton E2 Cult) > STMP3520
- Mobiblu DAH-1500i > STMP3520 - MobibluPort
- Gigabeat P > STMP35XX - Firmware updater
STMP35XX Reference Schematics
The STMP3400/500 specifications state that the embedded DSP chip is "DSP56004-compatible", however, it is unclear whether additional instructions have been introduced. Porting Rockbox to an architecture whose smallest addressable unit is 24 bits with inadequate compilers is going to be painful at best. Luckily, information on the chip series is very easy to come by -- more than enough to write or port a new compiler.
For more information, see MotorolaDSP56k.
- The main core seems to be an ARM962EJ-S running at ~200Mhz.
- Sigmatel provides a SDK to their customers, probably with example code.
- Probably, the Media engine provides hardware accelerated video processing?
Devices using this chipset:
external link: STMP36XX Datasheet (PDF)
Note: Sigmatel has been bought by Freescale in 2008 and SoCs older than STMP3700 are now discontinued.
- The main core seems to be an ARM962EJ-S running at ~300Mhz.
- The (normal) Media engine is absent (compared to STMP36xx), but there's a DCP (which does Color-Space Conversion) and a Media engine 2006.
Devices using this chipset:
Product Briefing (PDF)
STMP37xx family comparison table
SigmaTel is offering an SDK for these series of chips for $12,000. The SDK includes full source code to a reference implementation MP3 player. It is unclear how many MP3 player firmwares are directly based on this SDK, but there is evidence of similarity. For example, the SDK includes implementations of MP3 and WMV decoders, which most STMP3-powered players exclusively support. The document "Customizing Flash Players Using SigmaTel SDK 2.4xx" is available here. This document contains a brief outline of the SDK versioning.
STMP3400 - SDK v?
The firmware updater of the Philips Rush SA230 player includes an unencrypted/unsigned binary firmware image; additionally, the updater boots off of USB before writing any flash, making this a safe environment for hacking and testing on real hardware.
STMP3500 - SDK v2.4 - v3.2
- bootmanager.sb - This file is a Loader, which code will determine if USB device is connected and load the appropriate Firmware into RAM. It is not loaded during recovery mode. After bootmanager.sb loads the Firmware into RAM it jumps to the reset vector. All code that is loaded by bootmanager.sb, must have a valid reset vector in order to startup. If not, Firmware update could be successful in terms of proper installation process and its integrity, but device will not work.
- usbmsc.sb - This file is loaded by bootmanager.sb when device is connected at startup. This file contains only the software that interfaces to the native USB Mass Storage drivers on the OS. The usbmsc.sb firmware uses SCSI commands. It operates at the device sector level and does not contain a file system or have any knowledge about files being transferred.
- resource.bin - This file contains all code/data overlays, bitmaps used in user’s interface (e.g. shown on display) and fonts, which are stored in bitmap format as well. Resources loaded into RAM as needed during player operation by SysLoadResource (system code contained in stmpsys.sb).
- stmpsys.sb - The file is loaded by bootmanager.sb when USB device is not connected at startup. This is actually the player itself, as it contains all system code used by the player. System code is considered to be all functions resident in static memory (not overlays). When USB device is connected during player operation, the device is reset and bootmanager.sb loads usbmsc.sb from flash if USB is still connected when bootmanager.sb executes.
- hostlink.sb - Reportedly, the purpose of this is to change the device from a USB Host to a Host Link, in an attempt to block users from sharing files over USB OTG connections. See here. The next file, hostsrc.bin, is presumably related to this.
Note: Much of the above info was taken from here.
The ROM of the STMP3500 contains code to recover the player if no valid firmware is installed on the device (this is also used to initially flash the products in manufacturing). In order to do this, the player must be restarted in recovery mode while connected through USB to a computer with the recovery driver installed (StMp3Rec.sys). The ROM will then connect to the driver and load the file usbmsc.sb off of the computer and onto the player. From there, the player will restart running only usbmsc.sb. The player will subsequently be recognized as a mass storage device, and all of the remaining firmware files (resource.bin, etc...) can be loaded using stupdaterapp.exe.
To make a long story short, it's impossible to brick your stmp35xx device unless you physically break it.
Note: To start player in recovery mode, press the reset button while holding the play button. Let go of reset, but continue holding play for at least 5 seconds. Your computer will then make that "something's been connected" sound, and if the recovery driver is installed, usbmsc.sb will automatically be loaded onto the player (provided it can be found in its respective directory on the computer).
STMP3600 - SDK v4.xx
Creative Zen Series
Creative used their own firmware format for the Zen series. All information about Creative Zen devices is available at CreativeZVMPort.
There seems to be a standardized recovery mode in these chips. The
StMp3Rec.sys file is a "Recovery Player Class Device" driver and will connect the player by it's chip name.
Copyright © by the contributing authors.