qemu-bench — QEMU models of IP-camera, DVR/NVR and STB SoCs

QEMU machine and device models for the SoCs inside surveillance cameras, recorders and set-top boxes, targeting QEMU v10.2.0. Boots unmodified OpenIPC firmware and vendor SDK kernels to a full Linux userspace, so firmware can be developed and tested without the hardware on the desk. Vendor families covered:

• HiSilicon V1–V5 IPC, DVR/NVR and STB SoCs, plus their Goke/XMedia rebrands (GK7205, GK7206, …) — the table-driven core
• Xiongmai XM510 / XM530 / XM550, and XM530V200 / XM533 / XM535
• Goke GK7101 / GK7102 and the GK710xS die
• Anyka AK39xx
• SigmaStar / MStar infinity2m (SSD20x, SSR621Q, SSC375) and infinity3 (MSC313E)
• Novatek NT9856x, NT98533 and NT98332
• Allwinner V831 / V833
• Fullhan FH8852 / FH8856 (V100 and V200), FH8858V200, FH865x, FH8626V100, FH8632
• Grain Media GM8135S, GM8136, GM8136S

The project was called qemu-hisilicon until the other families arrived; GitHub redirects the old URL.

Builds two QEMU targets:

• qemu-system-arm — 32 IPC + 11 DVR/NVR + 1 STB (ARMv7-A) + 6 Xiongmai + 4 Goke GK710x/GK710xS (ARM1176) + 6 Anyka AK39xx (ARM926) + 5 SigmaStar (Cortex-A7) + 2 Novatek NT9856x (Cortex-A9) + 1 Novatek NT98533 (Cortex-A7 for the A32) + 2 Allwinner V83x (Cortex-A7) + 7 Fullhan (ARM1176) + 3 Fullhan FH865x (Cortex-A7) + 3 Grain Media GM813x (FA626TE)
• qemu-system-aarch64 — 3 IPC + 1 STB (ARMv8-A, Cortex-A53/A55) + 1 Novatek NT98332 (Cortex-A53)

¹ No OpenIPC release exists for these two yet, so there is nothing to boot them with; they build and register. The four Goke V500 parts share the xmedia,sp804 timer wiring (hisi-xmsp804.c) that the V500 kernel needs.

² gk7206v10 and gk7206v12a (codename "xmorca"; same die, 64 vs 256 MiB embedded DDR) boot the vendor XMedia SDK kernel (linux-5.10.y, xmorca_defconfig) and busybox userspace, not OpenIPC — via qemu-boot/run-gk7206.sh for an initramfs boot or FLASH=1 for a SPI-NOR boot with a jffs2 root. No vendor artifacts are committed here; see the script header for how to build them from the SDK.

The three dual-core Cortex-A7 parts (hi3516cv500, hi3516dv300, hi3516av300) boot both cores with -smp 2, from -kernel and from a flash-file image alike. As on silicon, the kernel writes a reset trampoline at physical 0 and clears CPU1's soft-reset bit in CRG REG_CPU_SRST_CRG (0x78), and that bit drives CPU1's power state. The default is still one CPU. The other "MP2" parts leave CPU1 offline: their vendor release methods are not modelled yet.

³ Flash boot of a camera dump only: vendor U-Boot, kernel and Sofia, no OpenIPC release yet. These are the second-generation parts (#154): DDR behind a uMCTL2, U-Boot entered at the flash window, a latching SP804, and the SDIO controller moved. Sofia streams H.265 over RTSP from a test picture (capture, ISP, VPSS, HEVC and JPEG engines, OSD), with audio, SD recording, USB and an AltoBeam USB Wi-Fi dongle; multi-lens boards (spliced and three-camera) included. See docs/xiongmai.md.

Not HiSilicon parts, although their BSP kernels started from HiSilicon templates: the memory map and the flash controller (xmsfc) are Xiongmai's own, the rest is licensed IP (PrimeCell PL011/SP804/SP805/PL190, Synopsys DWMAC, Arasan SDHCI). So the family has its own table and init in hw/arm/xiongmai.c rather than HisiSoCConfig slots; addresses and their sources are in docs/xiongmai.md. xm510 boots the OpenIPC xm510_lite release with qemu-boot/run-xm510.sh, and boots a full camera flash dump through its own U-Boot with -M xm510,flash-file=dump.bin.

CI covers:

• login;
• guest reboot;
• the network: DHCP, ICMP, SSH and routed DNS;
• SPI-NOR erase/program;
• the firmware's flash paths, each run by the firmware's own SD-card hook and checked on the host:
  • sysupgrade --archive (test-sysupgrade.sh);
  • firstboot (test-firstboot.sh);
  • init keeping an overlay this kernel cannot mount (test-overlay-keep.sh, firmware#2613).

xm530 and xm550 boot the xm530_lite release with -smp 2: CPU1 is released through REG_SC_REMAP and REG_CPU1_SOFT_RST as on silicon. An XM550 camera's full flash dump boots through its own U-Boot to login: with -M xm550,flash-file=dump.bin -smp 2. Dumps of XM530V200, XM533 and XM535 cameras boot the same way on xm530v200 (-smp 2), xm533 and xm535, through their vendor U-Boot and kernel to Sofia. Their kernels print only with xmuart=0 in the saved U-Boot environment.

CI covers login, both CPUs, guest reboot and clock on both. On xm530 it also runs the network check and the flash tests: erase/program, sysupgrade and firstboot.

Boot them with mem= as the first kernel argument, as OpenIPC's U-Boot does (mem=32M). load_xiongmai sizes MMZ from the first argument. If it is missing, MMZ covers all of RAM, kernel included. majestic then Oopses in mmz and never stops the xm_wdt the script started, and the guest resets a minute later.

Goke's own first SoC, unrelated to the HiSilicon-derived GK7205 line above: Ambarella A5s IP (VIC, timers, watchdog, IDC I2C), a 16550, a Synopsys GMAC and Goke's register-driven SPI-NOR controller, modelled in hw/arm/goke.c. The vendor U-Boot and kernel reach the hardware only through a HAL blob that relocates, reorders and bit-scrambles every register; the models are of the silicon underneath, mapped by executing that HAL (qemu-boot/gk710x-halmap.py). Addresses, the boot header and the hand-off are in docs/goke-gk710x.md.

A camera's full SPI-NOR dump boots through its own U-Boot and kernel to the vendor application and a shell, network included: -M gk7102,flash-file=dump.bin (or FLASH=dump.bin qemu-boot/run-gk7102.sh). The OpenIPC gk7102 release boots to login: with -kernel/-initrd given a vendor HAL to load — -M gk7102,hal-file=<vendor U-Boot or dump>, see qemu-boot/run-gk7102.sh — since the kernel calls into it. sensor=jxh42 (or jxh62, f37) puts an SOI sensor on I2C 0.

gk7101s/gk7102s are the later S die (the GK7102C cameras are this family): the same IP at the drivers' own 0x9000_0000 / 0xA000_0000 map and register layouts, which the vendor kernel uses directly. They reuse the GK710x models behind gk-remap, plus a DMA controller the GK7102C U-Boot tests at start. A GK7102C camera dump boots through its U-Boot and kernel to the vendor application and login: with -M gk7102s,flash-file=<image in chip byte order> (qemu-boot/run-gk7102s.sh converts a software dump).

¹ gk7101/gk7101s are the same dies and models with 128 MiB; no image of either was at hand.

Anyka's camera SoCs, unrelated to HiSilicon: one memory map from the AK3918EV200 through AnyCloud39EV300 to AnyCloud V500 (EV330), in hw/arm/anyka.c. The UART and the SPI master move their data through the L2 buffer SRAM rather than FIFOs, which hw/misc/ak-l2.c models with its block handshakes and DMA. A camera's SPI-NOR dump boots the way the mask ROM does -- boot-header register script, then U-Boot (EV200 / EV300) or the EV330's L2-resident first stage -- through the vendor U-Boot and kernel to the vendor application and login:: -M ak3918ev300,flash-file=dump.bin. Flash writes go back to the file. Ethernet (the Synopsys GMAC, on xm-dwmac) works from both the vendor U-Boot and kernels: -nic user. The SoC list from the SDKs, the map, the boot header and the dumps tried are in docs/anyka.md.

¹ An AK3916EV301 dump. ² Same die and models as a tested sibling; no image was at hand.

SigmaStar's (formerly MStar's) infinity2m and infinity3 dies, in hw/arm/sigmastar.c: every peripheral behind the RIU's 16-bit register banks at 0x1F000000. An SSR621Q NVR's SPI-NOR dump boots the way the mask ROM does -- the board's own IPL into IMI, IPL_CUST, U-Boot, the kernel from the romfs squashfs -- to Xiongmai's Sofia GUI on the emulated HDMI output, with the mouse and keyboard on USB and the HDD on SATA: FLASH=nvr.bin HDD=disk.img qemu-boot/run-ssr621q.sh. Ethernet works from both U-Boot and the kernel. With a camera on its network the NVR shows live video: the WAVE5 video decoder is modelled at its firmware's interface and decodes with libavcodec, and CAMERA=1 adds qemu-boot/fake-ipcam.py, an RTSP/ONVIF camera streaming a self-encoded H.264 test pattern. The display and 2D engine models are ported from Daniel Palmer's MStar QEMU work (fifteenhex/qemu), as are the SSD202D register findings the boot chain relies on. Map, boot, devices and the Xiongmai xmuart console switch are in docs/sigmastar.md.

¹ Same die and models as ssr621q; no image was at hand.

² The SSC375 (die "Ifado") in a Dahua IPC-HDW1433V-A-IL2: its NOR boots IPL, U-Boot 2021.10 and Dahua's DHBoot, whose RSA checks of the kernel and device tree pass on the SHA/RSA engine model, to the vendor rootfs. The camera application finds its SC431HAI on the modelled I2C bus, its 3A runs on the VIF/ISP frame clock, and frames flow VIF → ISP → scaler → encoder to its RTSP server: H.264/H.265 from libx264/libx265 and baseline JPEG snapshots, of a test pattern (the ISP does not process pixels), and microphone capture. uuid= gives the die ID its analytics licence is bound to.

³ The MStar MSC313E (die "infinity3"): an unmodified 8 MiB W25Q64 dump of a retail camera (JX-F22 sensor) boots from NOR through the IPL at 0x4000, IPL_CUST, U-Boot 2015.01 and Linux 3.18.30, and its own application runs the whole media pipeline: the sensor over I2C, an ISP that makes the picture (the OpenIPC logo scene) from the sensor's exposure and gain, with the vendor AE/AWB converging on its statistics, the scaler and CMDQ, and the H.264 (CAVLC/CABAC), H.265 and JPEG encoders, with audio, GPIO/IR-cut and the RTC; it serves HTTP and a decodable 1280x720 H.264 RTSP stream.

Allwinner's sun8iw19 camera dies, in hw/arm/allwinner-v83x.c: the H6's "ncat" map with one Cortex-A7 and TrustZone. A camera's SPI NOR dump boots as on silicon: boot0 trains DRAM and loads the boot package over SPI, OP-TEE drops to U-Boot in the normal world, and U-Boot reads its environment and GPT over SPI with DMA, the SD card, and the kernel, which mounts its SquashFS root from the NOR: -M v831,flash-file=dump.bin -drive if=sd,.... Flash writes go back to the file. The EMAC works with the vendor driver (-nic user), even on cameras that ship with Wi-Fi only. The vendor media stack runs on a modelled sensor, video input and IOMMU, and its H.264 encoder produces valid streams of a test picture (the OpenIPC logo) through the modelled video engine. A YI camera (V831) runs to a root shell and the vendor application in a few seconds (qemu-boot/test-v831-boot.sh). Its U-Boot silences the kernel console unless the SD card holds /debug_tty. Map, boot chain and what the firmware depends on are in docs/allwinner-v83x.md.

¹ Same die and models as v831; no image was at hand.

The V3s and the V851s, in hw/arm/allwinner-cam.c: the V831's devices at the H3's and the D1's addresses. OpenIPC's mainline U-Boot boots on both from the NOR or the SD card, and on the V851s OpenIPC's kernel mounts its SquashFS root from the NOR. See docs/allwinner-cam.md.

Fullhan's camera SoCs, in hw/arm/fullhan.c: one memory map across five generations of mostly DesignWare blocks (ICTL, APB timers, UARTs, SSI with Fullhan's SPIC additions, AXI or AHB DMAC, I2C, GPIO, MMC, GMAC, DWC2 USB, watchdog) around Fullhan's PMU, RTC, AES engine and SADC, with an image sensor's ID on I2C0 (sensor=, GalaxyCore / MIS2006 / JX-F37) for the vendor apps and ipcinfo. A camera's SPI NOR dump boots the way the mask ROM does -- U-Boot, FH8632's SPL, or past FH865x's DDR-sizing ramboot -- through the vendor U-Boot, which reads the flash by DMA, to the vendor kernel and application: -M fh8856v200,flash-file=dump.bin -nic user. Flash writes go back to the file. OpenIPC's fh8852v200 and fh8852v100 releases boot on the vendor U-Boot (qemu-boot/fh-openipc-flash.sh) or with -kernel (qemu-boot/test-fullhan-boot.sh) to a login prompt with a DHCP lease. The media pipeline (the ARC coprocessor, ISP, encoders) and audio (the ARC's) are not modelled. Map, boot chain and devices are in docs/fullhan.md.

¹ Same die and models as a tested sibling; no image was at hand.

Grain Media's camera SoCs, in hw/arm/grainmedia.c: a Faraday FA626TE (QEMU's ARM926 with the FA626TE's ID) among Faraday peripherals -- FTINTC030, FTTMR010, FTWDT010, FTGPIO010, FTI2C010, the command-based FTSPI020 flash controller paced by the FTDMAC020, FTGMAC100 Ethernet, FTSDC021 SD hosts and the FOTG210 USB host -- with the PMU's chip ID, boot strap and PLLs (the timers' PCLK), and an OmniVision sensor's ID on the I2C bus (sensor=ov2715). A camera's SPI NOR dump boots the way the mask ROM does: nsboot from flash 0x1000 in SRAM brings up DDR and the CPU clock, then the vendor U-Boot runs the vendor 3.3 kernel and the camera's application: -M gm8136,flash-file=dump.bin -nic user. Flash writes go back to the file. The video pipeline the vendor graph runs is modelled -- VCAP300 capture painting the OpenIPC logo, the 3DNR, the scaler, the MCP280 H.264 encoder producing real slices behind the driver's own headers, the LCD's frame clock -- so a camera dump streams decodable 1080p and D1 H.264 (I frames and motion-following P frames) from its own RTSP server (qemu-boot/test-grainmedia-rtsp.sh). The ISP328 runs frames and feeds AE / AWB / AF statistics through its DMA tables, the GM2D draws OSD, masks and LCD blits, the MCP100 encodes MJPEG through its firmware's mailbox, and the FTSSP010 / ADDA308 capture a 1 kHz tone into the RTSP stream's audio track (or play to -audiodev); the SAR ADC, RTC, PWM, IR receiver (keys from qom-set), FTAES020 and pMonitor are modelled too. OpenIPC's gm8136 and gm8135 releases boot with -kernel (qemu-boot/test-grainmedia-boot.sh) to a login prompt with a DHCP lease and the JFFS2 overlay on the NOR. Map, boot chain and devices are in docs/grainmedia.md.

Novatek's NA51089 camera dies, in hw/arm/novatek.c: an A9 MPCore at 0xFFD00000 and Novatek's own blocks from 0xF0000000 (TOP/chip ID, the clock generator, watchdog, RTC, GPIO), with 16550-compatible UARTs. The OpenIPC nt98562_lite / nt98566_lite kernel carries no device tree; the machine builds one from the SDK's board files, and the kernel boots to a shell with its root on the emulated SPI NOR: qemu-boot/run-nt98562.sh. A whole flash image boots the way the chip does, the machine standing in for the closed DDR-training loader: the SDK's own FW98562A.bin, laid out by qemu-boot/nvtpack2flash.py, runs the vendor U-Boot, kernel and init scripts (FLASH=nor.bin qemu-boot/run-nt98562.sh). The 566 boards' SPI NAND is modelled too: FW98566A.bin boots from a W25N01GV to a UBIFS root (qemu-boot/test-novatek-nand.sh). SD cards attach with -drive if=sd,index=0; Linux (the release's mmc_na51055.ko) and the vendor U-Boot read and write them. An eMMC attaches to the third host (SDIO3) with -drive if=sd,index=2. The USB host (FOTG200) works under the vendor EHCI driver; no shipped kernel enables it, so qemu-boot/build-novatek-test-kernel.sh builds one (with the PWM driver too, which nothing shipped builds either). The three I2C controllers work under the vendor driver, and sensor=sc401ai (or sc501ai) puts a SmartSens chip on I2C 0, which OpenIPC's ipcinfo and load_novatek detect and load the driver for. The crypto engines (AES/DES/3DES with GCM, SHA/HMAC, RSA) pass the kernel's self-tests under the vendor drivers in that test kernel, and the vendor U-Boot's nvt_encrypt runs on them. The HDAL media engines are there too: the release's load_novatek binds all of them, and the SDK's HDAL samples run capture, ISP, H.26x / JPEG encoding, 2D graphics and audio capture to completion (qemu-boot/test-novatek-hdal.sh). The SIE captures a moving test pattern, which the IPP turns into YUV and the JPEG engine into real snapshots, and the 2D graphics and ISE engines compute their jobs. With x264 / x265 installed at build time the H.26x engine codes real H.264 / H.265 under the driver's own headers. Audio capture records a test tone (or the host's input), and playback goes to -audiodev / -audio, at the rate the clock tree sets. The display engine (IDE) shows the panel's picture on QEMU's console, with the display modules from OpenIPC's toolchain loaded. The EVB's serial-RGB LCD and the MIPI DSI panels both work. The AI engines run neural networks: the SDK's ImageNet classifier (BN-Inception, built for this chip in SDK v1.01.007) names its test picture under QEMU, through NUE2's preprocessing, the CNN's convolution / batch norm / ReLU / pooling layers and the NUE's fully connected one; the AI turnkey's detectors find the people, vehicles and faces in their pictures, its pet detector (a sample of ours, as the SDK has none) the cat and the dog, and its face recognition network (the model alone in the package; the sample is ours) tells Obama from Biden. The MDBC motion detection engine raises the SDK sample's alarms while an object moves through its frames, and not otherwise. The machines give Linux 128 MB and the HDAL pool 96 MB, more than the packages hold. The Novatek timer block runs, with timer 0 free at 1 MHz as the loader leaves it: the vendor U-Boot's boot-time stamps and the HDAL read it. reboot works the vendor way, by arming the RTC's power-on alarm and powering off. SDKs, map, device tree, flash and boot notes are in docs/novatek.md.

¹ Ethernet works from the kernel (DHCP, a file over HTTP) and from the vendor U-Boot (ping, dhcp, tftp).

Novatek's NS02501 camera die (NT98532 / NT98533), also in hw/arm/novatek.c: NA51089's peripherals at NA51089's addresses around two ARMv8-AArch32 cores, a GIC-400 and the generic timer, so the NT9856x models serve it. The machine stands in for the loader as on NT9856x, and the SDK's own U-Boot 2021.10 and kernel 5.10 boot from SPI NOR on both cores. The SD card and Ethernet work under the SDK's modules. qemu-boot/build-ns02501-sdk.sh builds everything from the SDK, and qemu-boot/test-nt98533.sh checks it. Notes in docs/novatek.md.

³ Built from the vendor SDK (not distributable, so not in CI beyond test-novatek.py).

Novatek's NA51103 NVR die (NT98331/NT98332/NT98631/NT98632), also in hw/arm/novatek.c: Novatek's blocks above 4 GiB at 0x2_F0000000, most of them NA51089's at new offsets. A whole 16 MiB SPI NOR image boots the way the board does: the machine stands in for the loader (the device tree and U-Boot are LZMA-packed in flash, hw/arm/nvt-lzma.c unpacks them), and the vendor U-Boot loads the kernel from the squashfs, which runs the vendor NVR application. Its GUI shows on the QEMU display through the LCD300 model and takes a USB mouse; the two SATA ports take disks (-drive if=ide), the audio interfaces and the HDAL engines complete their jobs, Ethernet works and the web UI answers: FLASH=nor.bin qemu-boot/run-nt98332.sh. With an emulated XM530 camera on the same QEMU network (qemu-boot/run-xm530-camera.sh), the NVR decodes its H.264 (libavcodec behind the vendor decoder driver) and shows it in its preview window and its single-channel view, records it and plays it back. With qemu-boot/fake-ipcam.py serving H.265 files (LAN=fake) both views show H.265 too. Notes in docs/novatek.md.

² A Xiongmai NBD80N36RA-KL NVR dump (not distributable, so not in CI).

The two Hi35xxDV500 parts share the V5/SS626 0x11xxxxxx peripheral map with CV610 but are 64-bit and boot the gzip self-extracting vendor U-Boot (u-boot-z.bin) via the on-die HW gzip engine — run locally with qemu-boot/run-hi3519dv500.sh <u-boot-z.bin>.

¹ Boot-tested by OpenIPC/u-boot-hi3519dv500's qemu_smoke CI, which builds the U-Boot image fresh and boots it on this machine (so no vendor binary is vendored here). This repo's CI only checks the machines register.

² gk7606v1 (codename "xmfalcon", the Cortex-A55 sibling of GK7206) is a placeholder: it builds and registers, but does not boot yet. Much of its config is inherited from GK7206 and several values — DDR size among them — are still unverified against the vendor SDK.

All 69 machines build and register. Every machine marked "yes" above boots OpenIPC or vendor firmware to a shell prompt (artifacts/scripts staged in qemu-boot/run-<machine>.sh); -machine help on either binary is the authoritative list.

From datasheet Section 1.2.14 and lab identification:

Hi3516DV500 (0x3516D500) and Hi3519DV500 (0x3519D500) are the HISI_OT aarch64 die (Cortex-A55) — same V5 0x11xxxxxx peripheral map, now emulated as the hi3519dv500 / hi3516dv500 machines (confirmed against the SPC011 SDK U-Boot).

The other families' peripherals are listed in their docs/<family>.md.

Notes: stub = regbank stub only. V5 (×3) = CV608/CV610/CV613 (same die, different feature tiers). AV100/3519V101 use GMAC (gigabit) — not emulated, boot without networking. IVE = Intelligent Video Engine with 18 operations validated against real IVE silicon.

qemu/
├── hw/arm/hisilicon.c           # HiSilicon/Goke-rebrand machines (48)
├── hw/misc/hisi-sysctl.c        # SysCtrl (SoC ID, reset, general registers)
├── hw/misc/hisi-crg.c           # CRG clock/reset stub
├── hw/misc/hisi-fmc.c           # HiFMC V100 flash controller (CV200+, flash-file for dumps)
├── hw/misc/hisi-gzip.c          # Hardware GZIP decompressor (U-Boot hw_compressed)
├── hw/misc/hisi-sfc350.c        # HISFC350 flash controller (CV100, AV100)
├── hw/misc/hisi-ddrc-v1.c       # V1 DDR controller/PHY: DDR dead until reg_info runs
├── hw/misc/hisi-himci.c         # DW MMC (himciv200) SD/MMC controller
├── hw/misc/hisi-regbank.c       # Generic RAM-backed register bank
├── hw/misc/hisi-ive.c           # IVE: 18 ops (SAD, CCL, Sub, Thresh, Erode...)
├── hw/misc/hisi-fastboot.c      # Boot ROM fastboot serial protocol (defib compat)
├── hw/misc/hisi-vedu.c          # Video encoder stub (VEDU + JPGE)
├── hw/misc/hisi-mipi-rx.c       # MIPI RX controller stub
├── hw/misc/hisi-rtc.c           # SPI-bridge RTC device
├── hw/net/hisi-femac.c          # Fast Ethernet MAC + MDIO PHY stub
├── hw/i2c/hisi-i2c.c            # HiBVT I2C controller
├── hw/i2c/hisi-imx335.c         # IMX335 image sensor I2C device
├── include/hw/arm/hisilicon.h   # SoC config structure + constants
├── hw/arm/xiongmai.c            # Xiongmai XM510/XM530/XM550 machines
├── hw/misc/xm-sysctl.c          # XM SYS_CTRL: soft reset, PLL lock
├── hw/misc/xm-ddrc.c            # XM510 uPCTL DDR controller (U-Boot)
├── hw/misc/xm-sfc.c             # xmsfc v1/v2 SPI-NOR controller (flash-file)
├── hw/net/xm-dwmac.c            # xmmac: DWMAC 10/100, XM MAC layout
├── include/hw/arm/xiongmai.h    # XmSoCConfig
├── hw/arm/goke.c                # Goke GK7101/GK7102 machines, boot ROM, HAL hand-off
├── hw/misc/gk-vic.c             # Ambarella-style VIC (edge latch, sense/event)
├── hw/misc/gk-timer.c           # Three Ambarella interval timers
├── hw/misc/gk-wdt.c             # Ambarella watchdog (reboot path)
├── hw/misc/gk-sflash.c          # Goke SPI-NOR controller (flash-file)
├── hw/misc/gk-ephy.c            # Internal Ethernet PHY, memory-mapped MII
├── hw/i2c/gk-idc.c              # Ambarella IDC I2C master
├── hw/misc/gk-remap.c           # GK710xS register layouts over the GK710x models
├── hw/misc/gk-dma.c             # GK710xS DMA controller (descriptor chains)
├── hw/arm/fullhan.c             # Fullhan machines, synthetic mask ROM
├── hw/misc/fh-pmu.c             # Fullhan PMU: chip IDs, resets, PLLs -> timer clock
├── hw/intc/fh-intc.c            # DW APB ICTL interrupt controller
├── hw/timer/fh-timer.c          # DW APB timers (clocked by the PMU)
├── hw/timer/fh-pts.c            # FH8632 PTS counter (its clocksource)
├── hw/char/fh-uart.c            # DW APB UART: 16550 + USR
├── hw/gpio/fh-gpio.c            # DW APB GPIO (the flash's chip select)
├── hw/ssi/fh-spi.c              # DW SSI + Fullhan SPIC (swap, data window)
├── hw/dma/fh-axi-dmac.c         # DW AXI DMAC (FH885xV200 / FH865x)
├── hw/dma/fh-ahb-dmac.c         # DW AHB DMAC (older dies)
├── hw/i2c/fh-i2c.c              # DW I2C master
├── hw/rtc/fh-rtc.c              # Fullhan RTC, command-based and v1 layouts
├── hw/watchdog/fh-wdt.c         # DW watchdog
├── hw/misc/fh-efuse.c           # eFuse controller
├── hw/arm/grainmedia.c          # Grain Media GM813x machines, mask ROM stand-in
├── hw/misc/gm-pmu.c             # FTPMU010: chip ID, strap, PLLs -> PCLK, FCS interrupt
├── hw/misc/gm-ddrc.c            # FTDDRC010: init done, DRAM size code
├── hw/intc/gm-intc.c            # FTINTC030 interrupt controller (per-CPU targets)
├── hw/timer/gm-timer.c          # FTTMR010 timers (clocked by the PMU)
├── hw/watchdog/gm-wdt.c         # FTWDT010 watchdog (the reboot path)
├── hw/gpio/gm-gpio.c            # FTGPIO010
├── hw/i2c/gm-i2c.c              # FTI2C010 byte-at-a-time I2C master
├── hw/ssi/gm-spi020.c           # FTSPI020 command-based flash controller, RX FIFO, DMA requests
├── hw/dma/gm-dmac.c             # FTDMAC020 AHB DMA, linked lists, handshake lines
├── hw/usb/gm-otg.c              # FOTG210: FUSBH200 EHCI + OTG glue
├── hw/misc/gm-vcap.c            # VCAP300 capture: link lists, OpenIPC logo picture, sync timer
├── hw/misc/gm-3dnr.c            # FT3DNR200: command lists, frame copy
├── hw/misc/gm-scaler.c          # scaler300: link lists, UYVY scaling / fills
├── hw/misc/gm-h264e.c           # MCP280 H.264: header FIFO + slice data (hantro-h264.c)
├── hw/misc/gm-mcp100.c          # MCP100 codec control (embedded CPU handshake)
├── hw/display/gm-lcd.c          # LCD200 vertical interrupt (the video graph's clock)
├── hw/display/gm-2d.c           # GM2D 2D engine: magic, job completion
├── hw/arm/anyka.c               # Anyka AK39xx machines, synthetic mask ROM
├── hw/misc/ak-sysctrl.c         # AK39 SYSCTRL: chip ID, IRQ controller, timers, WDT, RTC
├── hw/misc/ak-l2.c              # L2 buffer SRAM + DMA (UART / SPI data path)
├── hw/misc/ak-ddrc.c            # DDR2 controller (init-done poll)
├── hw/char/ak-uart.c            # UART on L2 rings
├── hw/ssi/ak-spi.c              # SPI master, PIO + L2
├── hw/ssi/ak-spinor.c           # Byte-wise SPI NOR (flash-file, any JEDEC ID)
├── hw/gpio/ak-gpio.c            # GPIO (pull-up inputs, flash CS on EV330)
├── hw/i2c/ak-i2c.c              # I2C, EV200/EV300 and EV330 layouts
├── hw/usb/ak-usb.c              # MUSB-style OTG, nothing plugged in
├── hw/sd/ak-mci.c               # MCI SD/MMC host (sd-bus, FIFO)
├── include/hw/arm/anyka.h       # AkSoCConfig
├── hw/arm/sigmastar.c           # SigmaStar infinity2m/Ifado/infinity3 machines, synthetic mask ROM
├── hw/misc/sstar-riu.c          # RIU register file under the models, boot status bits
├── hw/intc/sstar-intc.c         # Main interrupt controller (masks on the way to the GIC)
├── hw/timer/sstar-timer.c       # PIU timers + watchdog
├── hw/char/sstar-uart.c         # 16550 on the RIU stride + DesignWare USR
├── hw/ssi/sstar-fsp.c           # ISP/FSP/QSPI SPI-NOR controller, XIU window (flash-file)
├── hw/dma/sstar-bdma.c          # BDMA (flash -> IMI, MIU -> FSP page program)
├── hw/net/sstar-emac.c          # EMAC + internal PHY
├── hw/usb/sstar-uhc.c           # EHCI hosts behind the RIU (fusbh200-ehci-usb)
├── hw/misc/sstar-vpu.c          # WAVE5 video decoder, firmware interface + libavcodec
├── hw/display/mstar-disp.c      # GOP/MOP scan-out, display-top vsync (ported)
├── hw/display/mstar-ge.c        # GE 2D engine (ported)
├── hw/rtc/sstar-rtc.c           # infinity/infinity3 PM RTC (seconds counter, alarm)
├── hw/misc/sstar-vip-gamma.c    # infinity3 scaler gamma SRAM ports (YUV, RGB)
├── hw/misc/sstar-i3-isp.c       # infinity3 ISP/CSI: sensor scene, pixel pipeline, AE/AWB stats
├── hw/misc/sstar-i3-scl.c       # infinity3 scaler interrupts and DMA clients
├── hw/misc/sstar-mfe.c          # infinity3 MFE H.264 encoder (CAVLC, CABAC)
├── hw/misc/sstar-vhe.c          # infinity3 VHE (Hantro H2v3) H.265 encoder
├── hw/misc/sstar-i3-jpe.c       # infinity3 JPEG encoder
├── hw/misc/sstar-i3-bach.c      # infinity3 audio DMA (playback, capture)
├── hw/gpio/sstar-i3-gpio.c      # infinity3 GPIO, SAR ADC, PM-sleep irqchip, day/night
├── include/hw/arm/sigmastar.h   # SsSoCConfig
├── hw/arm/novatek.c             # Novatek NT9856x machines (generated DT), NT98533, NT98332
├── hw/arm/nvt-lzma.c            # LZMA decoder for the NA51103 boot stand-in
├── hw/misc/nvt-dai.c            # NA51103 audio interfaces (I2S DMA, silence)
├── hw/misc/nvt-engine.c         # HDAL media engines: link lists, job done
├── hw/misc/nvt-hdmi.c           # NA51103 HDMI TX status (clock stable, mute)
├── hw/display/nvt-lcd300.c      # NA51103 LCD300: vsync, channel scan-out
├── hw/misc/nvt-h26xdec.c        # NA51103 H.26x decoder: link lists, libavcodec
├── hw/misc/nvt-top.c            # TOP: pinmux storage, chip ID
├── hw/misc/nvt-cg.c             # Clock generator: PLL ratios, gates, resets
├── hw/misc/nvt-wdt.c            # Keyed watchdog, manual reset
├── hw/misc/nvt-otp.c            # OTP / eFuse controller, blank array
├── hw/misc/nvt-crypto.c         # Crypto engine: AES/DES/3DES, ECB..CTR, GCM, descriptor DMA
├── hw/misc/nvt-hash.c           # Hash engine: SHA-1/256 and HMAC, chunked DMA
├── hw/misc/nvt-rsa.c            # RSA engine: modular exponentiation to 2048 bits
├── hw/misc/nvt-media.c          # HDAL media engines: SIE frames, IPP / gfx linked lists, codecs
├── hw/misc/nvt-audio.c          # DAI + EAC: audio DMA at the CG's rate, test tone, audiodev in / out
├── hw/display/nvt-ide.c         # IDE display engine: layers scanned out to QEMU's console (LCD panel)
├── hw/display/nvt-dsi.c         # MIPI DSI host: LP command bytes, frames to the DSI panels
├── hw/misc/nvt-pixel.c          # their pixels: test pattern, RAW packing, Bayer to YUV, JPEG encoder
├── hw/misc/nvt-gfx.c            # 2D graphics ops (copy, arithmetic, fill, pack, ARGB blend, flips), ISE scaling
├── hw/misc/nvt-h26x.c           # H.26x pictures: x264 / x265 slices under the driver's headers, else filler
├── hw/misc/nvt-ai.c             # AI engines: CNN layers, NUE fully connected, NUE2 preprocessing
├── hw/misc/nvt-pwm.c            # PWM: enable/disable, cycle-count runs, stop interrupts
├── hw/timer/nvt-timer.c         # Novatek timers: one-shot / free run, timer 0 at 1 MHz
├── hw/rtc/nvt-rtc.c             # RTC (CSET handshake) + power button, reboot
├── hw/gpio/nvt-gpio.c           # GPIO, 40 interrupt-capable pins
├── hw/ssi/nvt-flash.c           # SPI NOR controller (operation sequencer, flash-file)
├── hw/sd/nvt-sdio.c             # Novatek SD hosts (descriptor / plain DMA, PIO)
├── hw/net/nvt-eqos.c            # DWC Ethernet QoS (GMAC 4.x) + embedded PHY
├── hw/usb/nvt-usb.c             # Novatek FOTG200 host: FUSBH200 EHCI + OTG glue
├── hw/i2c/nvt-i2c.c             # Novatek I2C controllers (PIO chunks)
├── include/hw/arm/novatek.h     # NvtSoCConfig
├── include/hw/arm/goke.h        # GkSoCConfig
└── setup.sh                     # Clone QEMU v10.2.0, copy sources, build
qemu-boot/
├── run-cv100.sh                 # Run scripts for each boot-tested platform
├── run-cv200.sh
├── run-av100.sh
├── run-cv300.sh
├── run-cv500.sh
├── run-3519v101.sh
├── run-ev300.sh
├── run-ev300-flash.sh           # Boot from SPI NOR flash dump (no -kernel needed)
├── mk-ev300-nand.sh             # Assemble OpenIPC ev300 SPI-NAND/UBI image
├── run-ev300-nand.sh            # Boot from SPI NAND image (UBI rootfs)
├── run-gk7205v510-nand.sh       # Boot a GD5F1GM7 SPI-NAND camera dump
├── run-cv610.sh
├── run-xm510.sh                 # Xiongmai XM510, OpenIPC xm510_lite
├── run-gk7102.sh                # Goke GK7102: flash dump, or OpenIPC + vendor HAL
├── run-ssr621q.sh               # SigmaStar SSR621Q NVR: flash dump to the GUI
├── run-nt98562.sh               # Novatek NT98562/NT98566: OpenIPC on NOR, or FLASH= image
├── nvtpack2flash.py             # Novatek NVTPACK (FW9856xA.bin) -> raw NOR / NAND image
├── run-nt98332.sh               # Novatek NT98332: NVR NOR image, GUI, mouse, SATA
├── run-xm530-camera.sh          # XM530 + OpenIPC as a camera on the NT98332's QEMU LAN
├── uboot-env.py                 # Write a U-Boot env (defaults + settings) into a flash image
├── run-fullhan.sh               # Fullhan: boot a NOR image (dump or OpenIPC) on any fh* machine
├── fh-openipc-flash.sh          # Fullhan: OpenIPC release onto a dump's vendor U-Boot
├── test-fullhan-boot.sh         # Fullhan OpenIPC kernel: login, DHCP, JFFS2 written back
├── test-grainmedia-boot.sh      # Grain Media OpenIPC kernel: login, DHCP, JFFS2 written back
├── test-grainmedia-rtsp.sh      # Grain Media camera dump from flash: its RTSP H.264 decodes
├── test-novatek-boot.sh         # NT9856x kernel to a PID-1 check script: NOR r/w, DHCP+HTTP, reboot
├── test-novatek-uboot.sh        # NT9856x vendor U-Boot: stop autoboot, dhcp, tftp, ping, SD card
├── build-novatek-test-kernel.sh # OpenIPC nt9856x kernel + EHCI/usb-storage/PWM/crypto, for the tests below
├── test-novatek-usb.sh          # NT9856x USB stick under the vendor EHCI driver
├── test-novatek-pwm.sh          # NT9856x PWM through /sys/class/pwm (pwm-na51055.c)
├── test-novatek-crypto.sh       # NT9856x crypto engines: testmgr self-tests of the vendor drivers
├── test-novatek-hdal.sh         # NT9856x HDAL: load_novatek binds the media engines; SDK samples run
├── build-novatek-hdal-samples.sh # the SDK's HDAL samples, uClibc-built, for test-novatek-hdal.sh
├── test-novatek-nand.sh         # NT98566 SPI NAND: vendor U-Boot nand r/w, UBIFS across a reboot
├── sstar-env.py                 # Set U-Boot env vars in a SigmaStar flash image
├── fake-ipcam.py                # RTSP/ONVIF camera: synthetic H.264 pattern, or H.264/H.265 files
├── gk710x-halmap.py             # Run the GK710x HAL under Unicorn, print its map
├── test-sysupgrade.sh           # sysupgrade --archive on emulated NOR
├── test-firstboot.sh            # firstboot wipes the overlay, camera boots
├── test-overlay-keep.sh         # firmware#2613: unmountable overlay survives
├── test-ive-init.c              # IVE basic test (hw_id, dma, sad, ccl)
├── test-ive-ops.c               # IVE operations test for QEMU (register-level)
├── test-ive-mpi.c               # IVE operations test for real board (MPI API)
├── test-ive-video-mpi.c         # IVE video processing for real board (MPI API, 352×288)
├── test-ive.c                   # IVE test (standalone)
├── test-ive-video.c             # IVE motion detection on video frames (QEMU)
├── test-ive-abandoned.c         # IVE abandoned object detection (QEMU)
├── test-fastboot.sh             # End-to-end fastboot test (QEMU + defib)
└── test-fastboot-protocol.py    # Protocol-level fastboot test (no defib)
demo/
├── generate_scene.py            # Synthetic CCTV scene generator
├── generate_abandoned.py        # Synthetic abandoned bag scene generator
├── ive_demo.py                  # Host reference SAD+CCL + visualization
├── abandoned_demo.py            # Host reference abandoned object + visualization
└── run_demo.sh                  # End-to-end demo orchestration
docs/
├── xiongmai.md                  # XM510/XM530/XM550 memory map, with kernel sources
├── goke-gk710x.md               # GK7101/GK7102: the HAL, real memory map, boot
├── anyka.md                     # AK39xx: L2 buffer, mask ROM, boot NOR
├── fullhan.md                   # Fullhan: generations, mask ROM, SPIC, DMACs
├── grainmedia.md                # Grain Media GM813x: map, nsboot boot chain, video, audio, MJPEG
├── sigmastar.md                 # SigmaStar/MStar infinity2m/infinity3: RIU banks, boot chain
├── novatek.md                   # NT9856x, NT98533, NT98332: DT, loader stand-in, media
├── ive-registers.md             # IVE register map (from live EV300 capture)
├── ive-applications.md          # IVE-based video analytics for OpenIPC
├── ive-eval-methodology.md      # IVE motion/abandoned detection evaluation
├── meva-dataset-spec.md         # MEVA dataset download + evaluation index
├── xnn-registers.md             # IVE XNN dispatch: registers and task nodes
├── xnn-ioctl-trace-spec.md      # XNN ioctl reverse-engineering spec
└── nnie-vs-npu.md               # NNIE vs SVP_NPU architecture comparison
qemu-src/                        # (generated by setup.sh, not committed)

# Build QEMU
bash qemu/setup.sh

The simplest way to get started. Uses a single binary file — either a pre-built full flash image from OpenIPC or a raw dump from a real IP camera's SPI NOR flash chip.

# Option A: Download a pre-built OpenIPC full flash image
#   Go to https://openipc.org/cameras/vendors/hisilicon/socs/hi3516ev300
#   and click "Download full image" (8MB NOR, lite)
#   Save as e.g. openipc-hi3516ev300-lite-8mb.bin

# Option B: Read flash from a real camera using a programmer
#   flashrom, CH341A, or similar → flash_dump.bin

# Boot (U-Boot and kernel load from flash, just like real hardware)
bash qemu-boot/run-ev300-flash.sh openipc-hi3516ev300-lite-8mb.bin

# Or with a camera flash dump
bash qemu-boot/run-ev300-flash.sh /tmp/flash_dump_ev300.bin

# Or pass the flash image directly via the machine property — works
# for any SoC, regardless of which flash controller it instantiates:
qemu-system-arm -M hi3516ev300,flash-file=$flash -nographic
qemu-system-arm -M hi3516av100,flash-file=$flash -nographic   # also works
qemu-system-arm -M gk7205v200,flash-file=$flash  -nographic   # also works

The emulator includes a boot ROM that copies U-Boot from the flash memory window to DDR and jumps to it — the same boot sequence as real silicon. A hardware GZIP decompressor (hisi-gzip) handles U-Boot's compressed first-stage loader. No separate kernel or rootfs files needed.

The machine-level flash-file property forwards to whichever flash controller (hisi-fmc on V3+/Goke, hisi-sfc350 on V1/V2A) the SoC instantiates, so consumers don't need to know that detail. The legacy device-level globals (-global hisi-fmc.flash-file=… / -global hisi-sfc350.flash-file=…) still work for backward compat.

Default login: root / 12345

XM-flashed Winbond W25Q128s ship from the factory with SR3.WPS = 1 and every individual block-lock bit set. WPS is non-volatile, so it survives power-cycle and even a fresh-U-Boot via the boot ROM — every sf erase / sf write from a recovery agent silently no-ops until firmware issues Winbond Global Block Unlock (0x98) and clears SR3.WPS. The runtime kernel/U-Boot/agent has to do this unlock dance to make the chip writable (OpenIPC kernel workaround).

To exercise that recovery-unlock path under QEMU, use hisi-fmc.nor-wps-locked=on (default off):

qemu-system-arm -M hi3516ev200 -kernel u-boot.bin \
    -global hisi-fmc.nor-wps-locked=on \
    -global hisi-fmc.flash-file=blank-flash.img

When on, the emulator starts the chip in the as-shipped state (SR3.WPS=1, all blocks locked, none ever-unlocked) and logs:

hisi-fmc: factory-locked NOR (SR3.WPS=1, all 128 blocks locked);
firmware must Global-Unlock 0x98 + clear SR3.WPS before erase/program
will succeed

A test passes only if the firmware actually issues the unlock sequence — without the knob, the same firmware silently "works" against an emulator that never had the lock to begin with.

Some Xiongmai hi3518ev200 boards carry a 0xc22017 NOR (sold as MX25L6406E/MX25L6436F) that answers only plain single-I/O reads: every dual- or quad-I/O read comes back as zeros, while writes, erases and status reads keep working. Stock U-Boot then fails with Wrong Image Format for bootm command, and a kernel booted another way panics with VFS: Unable to mount root fs (OpenIPC/firmware#646).

hisi-fmc.nor-single-io-only=on (default off) reproduces that chip: a DMA read whose OP_CFG interface type is anything but standard returns zeros and logs a guest_errors line.

qemu-system-arm -M hi3516cv200,flash-file=$flash -m 64M -nographic \
    -global hisi-fmc.flash-jedec=0xc22017 \
    -global hisi-fmc.nor-single-io-only=on

hisi-fmc also models a SPI-NAND chip (GigaDevice GD5F1GM7 by default: 2 KiB page, 128 KiB block, 128 MiB), so NAND/UBI firmware boots straight from a flash image — boot ROM → U-Boot → UBI → kernel → UBIFS/ubiblock root, the same path as silicon. A flash-file larger than 16 MiB is auto-detected as SPI-NAND, and the SoC's SYSSTAT boot-strap reports the NAND boot device so U-Boot takes the NAND path instead of probing NOR.

# Goke GK7205V510 — boot a real 128 MiB GD5F1GM7 camera dump:
bash qemu-boot/run-gk7205v510-nand.sh nand-dump.bin

# OpenIPC hi3516ev300 NAND build — assemble image, then flash-boot it:
bash qemu-boot/mk-ev300-nand.sh        # u-boot + release rootfs.ubi (UBIFS, /boot/fitImage)
bash qemu-boot/run-ev300-nand.sh

nand-jedec overrides the READ-ID and nand-oob-size the spare-area size (128 for GD5F1GM7, 64 for W25N01GV) for firmware whose ID table differs — e.g. the OpenIPC ev300 U-Boot wants W25N01GV (-global hisi-fmc.nand-jedec=0xEFAA21 -global hisi-fmc.nand-oob-size=64). Dual NOR+NAND boards (NOR boot/env, NAND rootfs) attach the second chip with -global hisi-fmc.nand-file=….

Useful for development when you build kernel and rootfs independently and want to iterate without reflashing.

# Download OpenIPC firmware components
cd qemu-boot
for soc in hi3516cv100 hi3516cv200 hi3516av100 hi3516cv300 hi3516cv500 hi3519v101 hi3516ev300; do
    curl -sL "https://github.com/OpenIPC/firmware/releases/download/latest/openipc.${soc}-nor-lite.tgz" \
        -o "openipc.${soc}-nor-lite.tgz"
    tar xzf "openipc.${soc}-nor-lite.tgz"
done
cd ..

# Boot any platform (pass kernel + rootfs via QEMU -kernel/-initrd)
bash qemu-boot/run-cv300.sh
bash qemu-boot/run-ev300.sh
bash qemu-boot/run-cv500.sh
# etc.

Default login: root / 12345

CV610 uses a FIT image (kernel + DTB in one file). Extract components first:

# Extract kernel, DTB, and rootfs from firmware
cd qemu-boot
dumpimage -T flat_dt -p 0 -o cv610.dtb firmware.bin.hi3516cv610
dumpimage -T flat_dt -p 1 -o kernel.hi3516cv610 firmware.bin.hi3516cv610
# rootfs is at offset 0x2A0000 in the firmware blob
dd if=firmware.bin.hi3516cv610 of=rootfs.squashfs.hi3516cv610 bs=1 skip=$((0x2A0000))

# Boot
bash run-cv610.sh

Each vendor family has its own machine file under qemu/hw/arm/ (hisilicon.c, xiongmai.c, goke.c, anyka.c, sigmastar.c, novatek.c), and within a family the machines are table-driven: one config struct per SoC and one DEFINE_*_MACHINE() line. The HiSilicon core works like this: each SoC is a HisiSoCConfig struct with addresses, IRQs, and peripheral counts, and a single hisilicon_common_init() handles all of them — adding a new HiSilicon variant requires only a new config struct and a one-line DEFINE_HISI_MACHINE() macro call. The rest of this section describes the HiSilicon core; the other families are documented in docs/<family>.md.

OpenIPC uImages for DT-based kernels have an appended device tree. The emulator automatically patches it at boot:

• Adds chosen/stdout-path for console output
• Inserts padding for kernel's atags_to_fdt() initrd patching
• Unifies SP804 split clocks (e.g., AV100's 50 MHz/3 MHz → 3 MHz) to prevent timer storms
• Disables NAND controllers whose register-level polling hangs on stubs

This runs transparently — unmodified firmware artifacts work as-is. CV610 uses a separate DTB file (-dtb flag) instead of appended DTB.

# Create a 64 MB image with FAT32
dd if=/dev/zero of=sdcard.img bs=1M count=64
echo -e "o\nn\np\n1\n\n\nt\nc\nw\n" | fdisk sdcard.img
LOOP=$(sudo losetup --find --show --partscan sdcard.img)
sudo mkfs.vfat -F 32 -n SDCARD "${LOOP}p1"
sudo losetup -d "$LOOP"

# Attach to any platform
bash qemu-boot/run-ev300.sh -drive file=sdcard.img,if=sd,format=raw

The FEMAC device provides a single 8 KiB MMIO region with port, MDIO, and GLB register blocks. An integrated PHY stub at MDIO address 1 reports 100 Mbps full-duplex (PHY ID 0x00446161). TX uses DMA read + qemu_send_packet(); RX uses a 64-entry ring buffer with IRQ notification.

Run scripts pass -nic user for QEMU's SLIRP networking (NAT to host, gateway 10.0.2.2). PHY link-up takes a few seconds — DHCP may need a retry.

Note: AV100 and 3519V101 use GMAC (gigabit) which is not yet emulated; those SoCs boot without networking.

The IVE device (hisi-ive) provides hardware-accelerated image processing for V4 SoCs. Register map reverse-engineered from live EV300 hardware capture (554 register changes, see docs/ive-registers.md). 18 operations implemented, validated against real IVE silicon on EV300 board:

Two test binaries validate the same algorithms through different paths:

Per-pixel output values match between real IVE hardware and QEMU emulation:

            Real HW                    QEMU
sub:        [18,22,26,30]              [18,22,26,30]       ✓
and:        [13,0,17,0]                [13,0,17,0]         ✓
or:         [31,62,63,98]              [31,62,63,98]       ✓
xor:        [18,62,46,98]              [18,62,46,98]       ✓
thresh:     [0,0,0,0]                  [0,0,0,0]           ✓
sobel:      [28,56,56,56]              [28,56,56,56]       ✓
dilate:     [223,255,255,255]          [223,255,255,255]    ✓
erode:      [0,0,0,0]                  [0,0,0,0]           ✓

# QEMU test (register-level, runs as init in initramfs)
CC=path/to/arm-openipc-linux-musleabi-gcc
$CC -static -O2 -o /tmp/init qemu-boot/test-ive-ops.c
mkdir -p /tmp/ive && cp /tmp/init /tmp/ive/init
cd /tmp/ive && find . | cpio -oH newc | gzip > /tmp/ive.gz
qemu-system-arm -M hi3516ev300 -m 128M \
    -kernel qemu-boot/uImage.hi3516ev300 -initrd /tmp/ive.gz \
    -nographic -serial mon:stdio \
    -append "console=ttyAMA0,115200 mem=128M root=/dev/ram0 rdinit=/init"

# Real board test (MPI API, needs SDK libs)
$CC -o test-ive-mpi qemu-boot/test-ive-mpi.c -I$SDK/include -L$LIBS -lmpi -live ...
# Upload and run: load_hisilicon -i; killall majestic; ./test-ive-mpi

The real board test (test-ive-video-mpi) uses a full hardware pipeline with zero CPU pixel loops. Reads Y4M (YUV4MPEG2 Cmono) or legacy raw .bin files. Resolution is parsed from the Y4M header — follows Majestic's approach: MD_SIZE(x) = (x/2) & ~0xF (half sensor resolution, 16-byte aligned).

Frame (960×528) → SAD 4×4 blocks → threshold output (240×132) → CCL → blob regions

# Convert 1080p source to Majestic-equivalent resolution
ffmpeg -y -i source.mp4 -vf "scale=960:528,format=gray" -r 10 \
    -pix_fmt gray -f yuv4mpegpipe output.y4m

# Run on real IVE hardware
ssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \
    /utils/ive-test/meva-school-vehicles.y4m md'
# → FRAME 210: (840,316)-(848,328) area=5  ... vehicle motion detected

Frame → Sub(cur,ref) → Thresh → Erode → Dilate → SAD(mask,zero) → blockify
     → SAD(cur,prev) → Thresh(invert) → AND(fg,stationary) → CCL → blob regions

CPU only reads the CCL blob struct (~3 KB) per frame — no pixel scanning. The SAD(mask, zero_image) trick reduces the full-frame binary mask (960×528) to block-level (240×132), staying within CCL's 64-720 pixel size constraint.

ssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \
    /utils/ive-test/meva-abandon-package.y4m abandoned'
# → FRAME 105: ABANDONED (804,212)-(848,256) area=82 dur=30
# → ... sustained 70+ frames (package left at bus stop)

Frame → Sobel(vertical) → 16BitTo8Bit(abs) → Thresh → Dilate → Erode → CCL
                                                                         ↓
                                               CPU: filter by aspect ratio 2.0-6.0

Detects plate-shaped rectangular regions with dense edges. Evaluated on CCPD dataset (100 images): P=0.065, R=0.560, F1=0.116. High recall when it hits (median IoU 0.67) but too many false positives from non-plate edge regions. Needs NN assistance for production use (see docs/ive-applications.md).

ssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \
    /utils/ive-test/parking.y4m lpr'
# → FRAME 1: PLATE (452,500)-(516,520) area=32 ratio=3.2

In a real camera, VPSS feeds frames via DMA (zero I/O overhead), so the IVE pipeline easily exceeds the 10 fps target. NFS is the bottleneck in the test setup.

Evaluated on 3132 motion events and 131 abandoned-object events from the MEVA (CC BY 4.0) and VIRAT Ground 2.0 datasets. All processing on real EV300 IVE silicon at Majestic-equivalent resolution (960×528 for 1080p, 640×352 for 720p sources).

Motion detection is near-perfect: all motion events detected (vehicles, people walking, carrying objects) with only 6 false alarms across 3132 test events.

Abandoned object detection catches 67% of events (bags, packages, unloaded objects) but has false positives from stationary scene elements (parked cars, furniture) that differ from the learned reference background. Threshold sweep (diff_thr 30-60, sad_thr 100-300, area_thr 4-16) confirmed this is an inherent limitation of background subtraction — the algorithm cannot distinguish "newly abandoned bag" from "car that was parked during reference learning." Production-grade precision requires owner-object tracking or semantic classification (see docs/ive-applications.md).

Plate region detection has decent recall (56%) but very low precision (6.5%) — edge-based detection cannot distinguish plates from bumpers, signs, and window frames. Needs neural network assistance for production use.

Sources: MEVA examples (121 pre-trimmed 1080p clips) + VIRAT Ground 2.0 (83 HD clips). Activities used as ground truth:

# Reproduce evaluation
python3 scripts/eval_download_virat.py       # download VIRAT videos (~18 GB)
python3 scripts/eval_build_dataset.py        # convert to Y4M
bash scripts/eval_run_ive.sh both            # run on real EV300 board
python3 scripts/eval_metrics.py              # compute P/R/F1

See docs/meva-dataset-spec.md for dataset structure, annotation format, and evaluation methodology.

See docs/ive-applications.md for a roadmap of 9 CV applications (tamper detection, line crossing, zone intrusion, loitering, etc.) that can be built with the existing IVE operations.

When QEMU is started without -kernel, the machine emulates the HiSilicon boot ROM serial download protocol. The defib tool can then load firmware over UART — the same way real hardware is recovered.

# Terminal 1: start QEMU in fastboot mode (no -kernel)
qemu-system-arm -M hi3516ev300 -m 64M -nographic \
    -chardev socket,id=ser0,path=/tmp/qemu-hisi.sock,server=on,wait=off \
    -serial chardev:ser0

# Terminal 2: load firmware via defib
defib burn -c hi3516ev300 -p socket:///tmp/qemu-hisi.sock

Defib auto-downloads OpenIPC U-Boot for the chip. To use a local file:

defib burn -c hi3516ev300 -p socket:///tmp/qemu-hisi.sock -f u-boot.bin

The protocol implements three sequential transfers (DDR init → SPL → U-Boot) with CRC-16/CCITT validation on every frame. After the final transfer, QEMU hands the serial port to a PL011 UART and starts the CPU at the U-Boot entry point — U-Boot output appears on the same connection.

Supported chips: all Standard protocol SoCs (Hi3516CV300, Hi3516EV200/EV300, Hi3518EV300, GK7205V200/V300, and others). V500 and CV6xx protocols are not yet implemented.

# Protocol-level test (no defib needed)
qemu-system-arm -M hi3516ev300 -m 64M -display none -monitor none \
    -chardev socket,id=ser0,path=/tmp/hisi-fb,server=on,wait=on \
    -serial chardev:ser0 -d unimp &
python3 qemu-boot/test-fastboot-protocol.py /tmp/hisi-fb

# End-to-end test with defib
bash qemu-boot/test-fastboot.sh

• OpenIPC firmware: https://github.com/openipc/firmware
• ipctool: https://github.com/openipc/ipctool
• SDK device trees:
  • CV100: Hi3518_SDK_V1.0.B.0/.../mach-hi3518/
  • CV200: Hi3518E_SDK_V1.0.4.0/.../hi3518ev20x.dtsi
  • AV100: Hi3516A_SDK_V1.0.8.0/.../hi3516a.dtsi
  • CV300: Hi3516CV300_SDK_V1.0.4.0/.../hi3516cv300.dtsi
  • CV500: Hi3516CV500_SDK_V2.0.2.1/.../hi3516cv500.dtsi
  • 3519V101: Hi3519V101_SDK_V1.0.5.0/...patch (hi3519v101.dtsi)
  • EV300: Hi3516EV200_SDK_V1.0.1.2/.../hi3516ev300.dtsi
  • CV610: Hi3516CV610R001C01SPC020/...tgz (hi3516cv610.dtsi)