dimerr · Nov 7, 2026 · Nov 7, 2026 · Nov 7, 2026
diff --git a/.github/workflows/build-sigmastar.yml b/.github/workflows/build-sigmastar.yml
@@ -174,20 +174,10 @@ jobs:
             done
             [ "$found" = 1 ] || { echo "missing ${kind} image for ${soc} (${pattern})" >&2; rc=1; }
           }
-          # SPI NAND: the boot area ends where the die's environment
-          # starts (include/configs/openipc-common.h on openipc-sigmastar):
-          # 0x200000, infinity2m 0x440000, infinity6c 0x4C0000, Ifliegen
-          # 0x500000, Iford 0x580000.
+          # SPI NAND: the 768 KiB boot partition, the environment from
+          # 0xC0000 (768k(boot),256k(env),-(ubi), as on openipc-hisilicon)
           case "${soc}" in
-            ssd201-nand|ssd202d-nand|ssr621q-nand)
-              check_kind nand 4352 "output/u-boot-${soc}.bin" ;;
-            ssc377*-nand|ssc378*-nand)
-              check_kind nand 4864 "output/u-boot-${soc}.bin" ;;
-            ssc034a-nand|ssc034b-nand)
-              check_kind nand 5120 "output/u-boot-${soc}.bin" ;;
-            ssc029a-nand)
-              check_kind nand 5632 "output/u-boot-${soc}.bin" ;;
-            *-nand) check_kind nand 2048 "output/u-boot-${soc}.bin" ;;
+            *-nand) check_kind nand 768 "output/u-boot-${soc}.bin" ;;
             *) check_kind nor 256 "output/u-boot-${soc}-nor.bin" ;;
           esac
           exit $rc
@@ -213,10 +203,19 @@ jobs:
             libslirp-dev python3 python3-venv
 
       - name: Build qemu-system-arm
+        # Pinned to the commit of OpenIPC/qemu-bench#242, which adds the
+        # ssc029a/b, ssc327de and ssc034a/b machines and Ifliegen's NAND and
+        # SD; back to OpenIPC/qemu-bench master once it is merged
+        env:
+          QEMU_REPO: https://github.com/dimerr/qemu-hisilicon
+          QEMU_REF: 1689faa5474894185d34eaea9c41506b5f6ae358
         run: |
-          git clone --depth 1 --branch master \
-            https://github.com/widgetii/qemu-hisilicon qemu-hisilicon
+          git init -q qemu-hisilicon
           cd qemu-hisilicon
+          git remote add origin "$QEMU_REPO"
+          git fetch -q --depth 1 origin "$QEMU_REF" || \
+            { git fetch -q origin sigmastar-ifliegen-nand; }
+          git checkout -q "$QEMU_REF"
           bash qemu/setup.sh
           cp qemu-src/build/qemu-system-arm "$GITHUB_WORKSPACE/qemu-arm"
           chmod +x "$GITHUB_WORKSPACE/qemu-arm"
@@ -227,15 +226,11 @@ jobs:
           name: qemu-arm
           path: qemu-arm
 
-  # QEMU smoke test -- boots each freshly-built image from flash through
-  # qemu-hisilicon's msc313e machine (#213 or later), whose mask ROM loads
-  # the image's IPL from 0x4000; the vendor IPL and IPL_CUST in the image
-  # then bring up DDR and unpack U-Boot. It asserts U-Boot reaches the
-  # autoboot prompt. There is no MSC316 machine: the MSC316 images boot on
-  # msc313e too (their IPL sizes its 64 MiB), which checks all but their
-  # DDR set-up, so every SoC is a hard gate on release. The infinity2m
-  # images boot on their own machines the same way. The infinity6 dies have
-  # no machine, so they are built but not booted here.
+  # QEMU smoke test -- boots each freshly-built image, NOR and SPI NAND,
+  # from flash through its own qemu-hisilicon machine, whose mask ROM loads
+  # the image's IPL; the vendor stages in the image then bring up DDR and
+  # unpack U-Boot. It asserts U-Boot reaches the autoboot prompt, so every
+  # leg is a hard gate on release.
   #
   # The second boot must load the environment the first saved, which
   # proves the driver's writes land where its reads find them.
@@ -246,7 +241,62 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        soc: [msc313e, msc316dc, msc316dm, ssd201, ssd202d]
+        # Every leg, on its own machine: the bond strap where the vendor
+        # IPL refuses the machine's default (ssc029b on ssc029; the
+        # infinity6e NAND IPLs past QFN88)
+        include:
+          - { soc: msc313e, machine: "msc313e", medium: nor }
+          - { soc: msc316dc, machine: "msc316dc", medium: nor }
+          - { soc: msc316dm, machine: "msc316dm", medium: nor }
+          - { soc: ssd201, machine: "ssd201", medium: nor }
+          - { soc: ssd202d, machine: "ssd202d", medium: nor }
+          - { soc: ssr621q, machine: "ssr621q", medium: nor }
+          - { soc: ssc325, machine: "ssc325", medium: nor }
+          - { soc: ssc325de, machine: "ssc325de", medium: nor }
+          - { soc: ssc327de, machine: "ssc327de", medium: nor }
+          - { soc: ssc333, machine: "ssc333", medium: nor }
+          - { soc: ssc335, machine: "ssc335", medium: nor }
+          - { soc: ssc335de, machine: "ssc335de", medium: nor }
+          - { soc: ssc337, machine: "ssc337", medium: nor }
+          - { soc: ssc337de, machine: "ssc337de", medium: nor }
+          - { soc: ssc30kd, machine: "ssc30kd", medium: nor }
+          - { soc: ssc30kq, machine: "ssc30kq", medium: nor }
+          - { soc: ssc338q, machine: "ssc338q", medium: nor }
+          - { soc: ssc377, machine: "ssc377", medium: nor }
+          - { soc: ssc377d, machine: "ssc377d", medium: nor }
+          - { soc: ssc377de, machine: "ssc377de", medium: nor }
+          - { soc: ssc377qe, machine: "ssc377qe", medium: nor }
+          - { soc: ssc378de, machine: "ssc378de", medium: nor }
+          - { soc: ssc378qe, machine: "ssc378qe", medium: nor }
+          - { soc: ssc029a, machine: "ssc029a", medium: nor }
+          - { soc: ssc029b, machine: "ssc029,bond=0x10", medium: nor }
+          - { soc: ssc029c, machine: "ssc029", medium: nor }
+          - { soc: ssc375, machine: "ssc375", medium: nor }
+          - { soc: ssc034a, machine: "ssc034a", medium: nor }
+          - { soc: ssc034b, machine: "ssc034b", medium: nor }
+          - { soc: ssd201-nand, machine: "ssd201", medium: nand }
+          - { soc: ssd202d-nand, machine: "ssd202d", medium: nand }
+          - { soc: ssr621q-nand, machine: "ssr621q", medium: nand }
+          - { soc: ssc325-nand, machine: "ssc325", medium: nand }
+          - { soc: ssc325de-nand, machine: "ssc325de", medium: nand }
+          - { soc: ssc327de-nand, machine: "ssc327de", medium: nand }
+          - { soc: ssc333-nand, machine: "ssc333", medium: nand }
+          - { soc: ssc335-nand, machine: "ssc335", medium: nand }
+          - { soc: ssc335de-nand, machine: "ssc335de", medium: nand }
+          - { soc: ssc337-nand, machine: "ssc337", medium: nand }
+          - { soc: ssc337de-nand, machine: "ssc337de", medium: nand }
+          - { soc: ssc30kd-nand, machine: "ssc30kd,bond=0x10", medium: nand }
+          - { soc: ssc30kq-nand, machine: "ssc30kq,bond=0x10", medium: nand }
+          - { soc: ssc338q-nand, machine: "ssc338q,bond=0x10", medium: nand }
+          - { soc: ssc377-nand, machine: "ssc377", medium: nand }
+          - { soc: ssc377d-nand, machine: "ssc377d", medium: nand }
+          - { soc: ssc377de-nand, machine: "ssc377de", medium: nand }
+          - { soc: ssc377qe-nand, machine: "ssc377qe", medium: nand }
+          - { soc: ssc378de-nand, machine: "ssc378de", medium: nand }
+          - { soc: ssc378qe-nand, machine: "ssc378qe", medium: nand }
+          - { soc: ssc029a-nand, machine: "ssc029a", medium: nand }
+          - { soc: ssc034a-nand, machine: "ssc034a", medium: nand }
+          - { soc: ssc034b-nand, machine: "ssc034b", medium: nand }
     steps:
       - name: Download qemu-arm
         uses: actions/download-artifact@v4
@@ -275,21 +325,27 @@ jobs:
         timeout-minutes: 3
         run: |
           soc='${{ matrix.soc }}'
-          UBOOT="u-boot-${soc}-nor.bin"
-          test -f "$UBOOT"
-          echo "booting $UBOOT"
-          # One machine for the whole infinity3 family, each its own for
-          # infinity2m; 8 or 16 MiB NOR, U-Boot at 0, the rest erased
-          case "$soc" in
-            msc*) MACHINE=msc313e; MIB=8 ;;
-            *) MACHINE=$soc; MIB=16 ;;
+          MACHINE='${{ matrix.machine }}'
+          case '${{ matrix.medium }}' in
+            nor) UBOOT="u-boot-${soc}-nor.bin" ;;
+            nand) UBOOT="u-boot-${soc}.bin" ;;
           esac
-          python3 - "$UBOOT" /tmp/flash.bin "$MIB" <<'PY'
+          test -f "$UBOOT"
+          echo "booting $UBOOT on -M $MACHINE"
+          # NOR: 8 MiB (infinity3) or 16 MiB, U-Boot at 0, the rest erased.
+          # SPI NAND: 128 MiB of 2048-byte pages, each with its 64 spare
+          # bytes, the boot area at 0 and the rest erased.
+          python3 - "$UBOOT" /tmp/flash.bin '${{ matrix.medium }}' "$soc" <<'PY'
           import sys
-          img = bytearray(b'\xff' * (int(sys.argv[3]) << 20))
           u = open(sys.argv[1], 'rb').read()
-          img[:len(u)] = u
-          open(sys.argv[2], 'wb').write(img)
+          if sys.argv[3] == 'nor':
+              img = bytearray(b'\xff' * ((8 if sys.argv[4].startswith('msc') else 16) << 20))
+              img[:len(u)] = u
+              open(sys.argv[2], 'wb').write(img)
+          else:
+              with open(sys.argv[2], 'wb') as f:
+                  for o in range(0, 128 << 20, 2048):
+                      f.write(u[o:o + 2048].ljust(2048, b'\xff') + b'\xff' * 64)
           PY
           FLASH="-M $MACHINE,flash-file=/tmp/flash.bin"
           chmod +x ./qemu-arm
@@ -323,7 +379,9 @@ jobs:
               exit 1
             fi
           done
-          if grep -q 'bad CRC' /tmp/uboot2.txt; then
+          # U-Boot's own warning: infinity6c's IPL reads the environment
+          # partition too and prints "env bad CRC" for the format it expects
+          if grep -q 'Warning - bad CRC' /tmp/uboot2.txt; then
             echo "FAIL: the environment saved on the first boot did not land"
             exit 1
           fi

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -268,20 +268,20 @@ The build logic lives here. Other branches call it:
 - It is `build-anyka.yml` for `openipc-sigmastar`: the same job graph and
   `resolve`/`ref` rules, NOR and SPI NAND. A NOR image is the 256 KiB
   boot partition (the vendor's IPL, IPL_CUST and on Ifliegen TF-A, the
-  die's flash table, U-Boot). A SPI NAND one is the boot area up to the
-  die's environment, as the fit check limits it: 2 MiB, 4352 KiB on
-  infinity2m, 4864 KiB on infinity6c, 5120 KiB on Ifliegen, 5632 KiB on
-  Iford.
-- **Images are not machines:** the infinity3 legs, the MSC316 ones too,
-  boot on `-M msc313e` (#213 or later); the MSC316 IPL sizes its 64 MiB.
-  `ssd201` and `ssd202d` boot on their own machines. The other legs are
-  built and fit-checked, not booted here (their qemu machines are not in
-  the qemu-hisilicon CI uses). Keep the build
-  matrix, the smoke matrix and the README's list in step.
-- **Smoke test:** two boots of an 8 MiB (infinity3) or 16 MiB (infinity2m)
-  flash image holding only the image; the machine's mask ROM loads the IPL.
-  It passes on
-  `Hit Ctrl-C`, and fails if the second boot reports a bad environment CRC.
+  die's flash table, U-Boot). A SPI NAND one is the 768 KiB boot partition
+  of openipc-hisilicon's `768k(boot),256k(env),-(ubi)`, the fit check's
+  limit on every die.
+- **Every image a machine:** each leg, NOR and NAND, boots on its own
+  machine (`ssc029b` as `ssc029,bond=0x10`, `ssc029c` as `ssc029`; the
+  infinity6e NAND legs at `bond=0x10`). The `qemu` job builds a pinned
+  commit, OpenIPC/qemu-bench#242's, for ssc029a/b, ssc327de and ssc034a/b,
+  until it merges. Keep the build matrix, the smoke matrix and the README's
+  list in step.
+- **Smoke test:** two boots of the image in an erased flash: 8 MiB NOR
+  (infinity3) or 16 MiB, or 128 MiB of SPI NAND pages with their spares.
+  The machine's mask ROM loads the IPL. It passes on `Hit Ctrl-C`, and
+  fails if the second boot reports U-Boot's "Warning - bad CRC" (the
+  infinity6c IPL's own "env bad CRC" is not U-Boot's).
 - **Release and publish:**
   - `release` uploads to the `sigmastar` tag.
   - `publish` is commented out for now, with its input: SigmaStar images

diff --git a/README.md b/README.md
@@ -286,20 +286,24 @@ Every infinity2m, infinity6, 6b0, 6e and 6c part also builds for SPI NAND,
   partition table at `0x3000`, the vendor IPL at `0x4000`, IPL_CUST at
   `0x10000`, and U-Boot (xz uImage) at `0x20000`. From infinity2m on, the
   IPL is at `0` and the table at `0xF000` (infinity6c: `0x9000`).
-- The infinity6, Iford, Ifado and Ifliegen images have **not run on silicon**. They
-  were booted under qemu's per-die machines during development; CI boots only the
-  infinity3 and infinity2m legs and builds and fit-checks the rest. They are only in
-  this repository's `sigmastar` release. Cameras get `u-boot-ssc*` from OpenIPC/u-boot-sigmastar.
-- The SPI NAND images are 2 MiB: SNI at `0`, PNI at `0x800`, IPL, IPL_CUST
-  and U-Boot twice each from `0x40000`, the environment at `0x200000`, then
-  UBI, whose volumes `kernel` and `rootfs` hold the firmware.
+- The infinity6, Iford, Ifado and Ifliegen images have **not run on silicon**, only
+  under qemu: CI boots every leg, NOR and NAND, on its own qemu-hisilicon machine.
+  They are only in this repository's `sigmastar` release. Cameras get `u-boot-ssc*`
+  from OpenIPC/u-boot-sigmastar.
+- The SPI NAND images are openipc-hisilicon's layout, `768k(boot),256k(env),-(ubi)`:
+  the die's CIS, its vendor stages one copy each and U-Boot in the 768 KiB boot
+  partition, the environment at `0xC0000`, then one UBI device whose UBIFS
+  `rootfs` volume holds the kernel as `/boot/uImage` (`rootfs.ubifs.<soc>`).
+  This is not OpenIPC/u-boot-sigmastar's NAND layout: a camera moving over takes
+  a `rootfs.ubifs` as well.
 - Vendor kernels are xz-compressed uImages that only the vendor U-Boot
   unpacks.
 - SD recovery `.img` files: on NOR a uImage whose load address is the flash
-  offset (`mkimage -a 0x50000`, `-a 0x250000`); on NAND the raw kernel and
-  squashfs.
-- SD recovery takes only these file names: `uImage.<soc>.img` (or
-  `fitImage.<soc>.img`) and `rootfs.squashfs.<soc>.img`.
+  offset (`mkimage -a 0x50000`, `-a 0x250000`); on NAND `rootfs.ubifs.<soc>.img`,
+  the UBIFS rootfs with its kernel, as on HiSilicon.
+- SD recovery takes only these file names: on NOR `uImage.<soc>.img` (or
+  `fitImage.<soc>.img`) and `rootfs.squashfs.<soc>.img`; on NAND
+  `rootfs.ubifs.<soc>.img`.
 
 ### Ingenic