hi3516cv610:20s — bootrom upload fails after DDR training ("Failed to send U-Boot"), stock boot prints "DDR size" but burn never does

Hardware

Module with Hi3516CV610 + IMX662 (seller listing "K662C6S"), 16 MB SPI NOR (MX25L12835F/45G, ID c2 20 18), DDR3 128 MB
Stock boot (UART0, 115200): U-Boot 2022.07 (Jan 14 2026 09:12:04) hi3516cv610-debug, "bootshell = 0",
boot table build time 2026/01/14 09:11:55,
boot table file name Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm,
"DDR size: 0x00000080" printed ~35 ms after the table file name, kernel FIT at 0x50000 (size 0x300000)
Same stock log as installing OpenIPC on Hi3516cv610 w/ IMX662 sensor? u-boot#71 (another user, same module, same issue)

What I ran (defib from current upstream master, macOS, FT232R, 115200 8N1)
defib burn -c hi3516cv610:20s -f boot-hi3516cv610-20s-nor.bin -p /dev/cu.usbserial-... --debug

Result

Handshake OK, GSL (23 frames) and DDR table (15 frames) ACKed with 0xAA, incl. TAIL
The SPL prints the table header; the table file name arrives intact on the UART
"DDR size" is never printed, even with the training wait raised to 30 s
U-Boot HEAD frame (fe 00 ff 01, 14 bytes): no byte received -> ACK TIMEOUT after ~4.0 s
-> "Failed to send U-Boot"
Instrumented the pre-HEAD and post-timeout UART buffer: "PRE-UBOOT: UART bytes waiting=0"
and "UART bytes waiting after timeout: 0" both times -> the SPL is completely silent
after printing the table header, not just slow or sending something defib doesn't parse.
Same result with 10b, cv608 (DDR2 tables, wrong binning), 20g (same DDR table as 20s,
different U-Boot). 00s/00g declare a 512MB BGA table, not applicable to this 128MB/QFN module.
Also tried the "_24M" variant of the same 128MB/QFN DDR table (from the
u-boot-hi3516cv6xx repo, reginfo/..._QFN_24M.bin) in place of the standard one, swapped
in-place in the composite (same offset, same size, re-parses fine with parse_cv6xx_boot).
Identical result: SPL prints the _24M table header, then the same silent timeout.
This rules out a quartz/clock-binning mismatch as the cause.
Cables/link checked clean: the table file name is received bit-exact after resoldering
the UART pads; a 60s stock-boot capture decodes with zero corruption.

Question
Is there another DDR table/boot image for this specific module, or another way to read the
flash via the bootrom (no U-Boot shell on stock because bootshell = 0)? Happy to test more
and to post full --debug logs / .dcap captures.

Side note: hisilicon_cv6xx.py around the post-DDR-training read logged
"UART bytes waiting after timeout: <coroutine object ...>" before a recent fix added
the await — now fixed upstream, just flagging in case other reports predate it.

Is this something that can be fixed or otherwise worked around? or does it mean this specific board ( "K662C6S") cannot be supported?... TIA.

I tested this on a Hi3516CV608 board (DDR2 64 MB) with defib master. Short version: your log points at the DDR table itself, not at defib's protocol or the GSL.

What all the cv6xx boot images share. The five boot-hi3516cv610-*-nor.bin images and boot-hi3516cv608-nor.bin carry byte-identical GSL and DDR-parameter headers. Only the 12 KB DDR table differs. The CV608 board goes through that same GSL and the same defib transfer code every time:

boot table version     :V0.1
boot table build time  :2026/03/01 17:22:29
boot table file name   :Hi3516CV608-DMEB_4L_DDR2_1333M_64MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000040

and U-Boot then loads. So the GSL upload, the board-ID query and the DDR-table upload work, as your log shows too (all ACKed).

What a table the SPL won't use looks like. I ran your exact command, -c hi3516cv610:20s with boot-hi3516cv610-20s-nor.bin, on this CV608. The SPL checks the table first and says so:

boot table file name   :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsmThe table is incorrect.
flash
boot table board switch:0x00000000
boot table file name   :Hi3516CV608-DMEB_4L_DDR2_1333M_64MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000040
System startup

It falls back to the boot table in flash and starts the U-Boot there, which is why nothing ACKs the upload.

Your log has none of that. The SPL prints the header and then nothing. So on your module it accepted OpenIPC's 128 MB/QFN table and then hung in DDR init: the table loads, but its parameters don't train your module's memory.

Where the difference likely is. OpenIPC's 20s/20g table has the same file name as your stock one, but it's a different build: V0.2, built 2026/03/01 17:22:42. Your stock boot says 2026/01/14 09:11:55. Since the _24M variant behaved the same, a later revision of the vendor's table not suiting this module (or its DDR3 part) is the most likely explanation. I can't confirm that without your stock table.

Questions and next steps:

Could you post the boot table version line from your stock boot log? It's printed just before the build time.
The table that works is the one in your flash. With no U-Boot shell (bootshell = 0), the practical way to get it is to read the first 256 KB of the NOR with an SPI programmer or clip (the MX25L128 is fine with a CH341A at 3.3 V). If you post that dump, or just its DDR table, we can swap it into the 20s composite the same way you did with _24M. That should get the OpenIPC U-Boot running from RAM.
defib's flash agent won't help here, because it loads into DDR, which never comes up.

defib side. In both cases defib reported only Failed to send U-Boot, so a table that never trains and a refused table looked the same. #165 makes the DDR-training stage read the SPL's output:

a refusal is reported as such;
a header with no DDR size is reported as a table that doesn't train this board's memory, after up to 10 s more.

It doesn't change anything that trains.

cv6xx: say what the SPL made of the DDR table, not "Failed to send U-…

Could you post the boot table version line from your stock boot log? It's printed just before the build time. flashddr param version 20250416 boot table board switch:0x00000000 boot table version :V0.2 boot table build time :2026/01/14 09:11:55 boot table file name :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm DDR size: 0x00000080 System startup Uncompress Ok! U-Boot 2022.07 (Jan 14 2026 - 09:12:04 +0000)hi3516cv610-debug DRAM: Relocation Offset is: 02785000 Relocating to 43f85000, new gd at 43b74ed0, sp at 43b74eb0 Core: 1 devices, 1 uclasses SPI Nor: fmc_ip_ver_check(32): Check Flash Memory Controller v100 ...fmc_ip_ver_check(38): Found fmc_spi_nor_probe(1562): SPI Nor ID Table Version 1.0 match_chip_id(1529): SPI Nor(cs 0) ID: 0xc2 0x20 0x18 fmc_init_print(1413): Block:64KB fmc_init_print(1414): Chip:16MB fmc_init_print(1415): Name:"MX25L12835F/45G" fmc100_spi_nor_probe(126): SPI Nor total size: 16MB NAND: 0 MiB Loading Environment from SPIFlash... OK In: serial Out: serial Err: serial Net: eth0 Error: eth0 address not set. bootshell = 0 device 0 offset 0x50000, size 0x300000 SF: 3145728 bytes @ 0x50000 Read: OK ## Loading kernel from FIT Image at 41000000 ... Using 'config-1' configuration Trying 'linux_kernel' kernel subimage Description: Linux Type: Kernel Image Compression: uncompressed Data Start: 0x41003cdc Data Size: 2985224 Bytes = 2.8 MiB Architecture: ARM OS: Linux Load Address: 0x40018000 Entry Point: 0x40018000 ## Loading fdt from FIT Image at 41000000 ... Using 'config-1' configuration Trying 'fdt-1' fdt subimage Description: dtb Type: Flat Device Tree Compression: uncompressed Data Start: 0x410000b0 Data Size: 15276 Bytes = 14.9 KiB Architecture: ARM Load Address: 0x40000000 Loading fdt from 0x410000b0 to 0x40000000 Booting using the fdt blob at 0x40000000 ## Loading loadables from FIT Image at 41000000 ... Trying 'linux_kernel' loadables subimage Description: Linux Type: Kernel Image Compression: uncompressed Data Start: 0x41003cdc Data Size: 2985224 Bytes = 2.8 MiB Architecture: ARM OS: Linux Load Address: 0x40018000 Entry Point: 0x40018000 Loading loadables from 0x41003cdc to 0x40018000 ## Loading loadables from FIT Image at 41000000 ... Trying 'fdt-1' loadables subimage Description: dtb Type: Flat Device Tree Compression: uncompressed Data Start: 0x410000b0 Data Size: 15276 Bytes = 14.9 KiB Architecture: ARM Load Address: 0x40000000 Loading loadables from 0x410000b0 to 0x40000000 Loading Kernel Image Using Device Tree in place at 40000000, end 40006bab Starting kernel ...

A correction to my last comment. I said the likely difference was OpenIPC's build of the DDR table. New evidence from a CV608 board points at the GSL (the first stage, which runs DDR training) instead.

On OpenIPC/u-boot#69, a Hi3516CV608 shows your exact signature with the OpenIPC boot image: it prints the table header, then stops, with no DDR size. The reporter attached their stock boot area (#70), so the two could be compared directly:

DDR table: same name as OpenIPC's, and it differs in 7 of 12288 bytes, all in the build-date string. The parameters are identical.
GSL: about 17 KB of 22 KB differs. OpenIPC's is the prebuilt image_tool/input/gsl.bin (SDK 1.0.2.0 lineage, 2026-03-01); the stock one is a later build (2026-03-16).

That fits what you saw: swapping in other tables, _24M included, changed nothing, because the table was never the problem.

On our CV608, a hybrid of that board's stock GSL with OpenIPC's DDR table and U-Boot trains DDR and starts the OpenIPC U-Boot. #69 has the recipe and a RAM-only defib burn test.

For your CV610, the same test needs your stock GSL. So the SPI-programmer dump of the first 256 KB is still the useful next step. With it, we can build the hybrid for your module and check whether it trains.

@packlet

@packlet thanks, and sorry I missed this before writing my correction above. It answers the question:

Stock table: V0.2, built 2026/01/14 09:11:55.
OpenIPC's 20s/20g table: also V0.2, built 2026/03/01 17:22:42.

So the table version is the same, which fits the correction: the table isn't the likely difference, the GSL is.

The first line of your log adds a strong hint. Your stock first stage prints flashddr param version 20250416. That string isn't in OpenIPC's GSL (neither the prebuilt image_tool/input/gsl.bin in boot-hi3516cv610-*-nor.bin nor the SDK 1.0.2.0 gsl/ source). It isn't in the stock CV608 GSL from OpenIPC/u-boot#70 either. So the GSL on this module is a different vendor build from both, with a DDR-parameter version of its own.

To confirm it, the next step is still the first 256 KB of the flash, read with an SPI programmer. That holds this GSL, and with it we can build the same RAM-only hybrid that works on a CV608 (stock GSL + OpenIPC DDR table + OpenIPC U-Boot; recipe in OpenIPC/u-boot#69) and see whether your module trains.

@snokvist

An update for this module. #76 in OpenIPC/u-boot is merged (ported from u-boot-hi3516cv6xx#6 by @snokvist). The 20s and 20g boot images now carry the K662C6S's own factory GSL, ddr param version 20250416: the same version this module's stock log prints. On a K662C6S, the contributor booted it with the OpenIPC U-Boot to Linux userspace.

Getting it. It is published: boot-hi3516cv610-20s-nor.bin in OpenIPC/firmware latest (updated 2026-10-25) carries the new GSL.

Try it from RAM first. This writes nothing to flash:

defib burn -c hi3516cv610:20s -f boot-hi3516cv610-20s-nor.bin -p <port> -b

Expected with the new GSL: DDR size: 0x00000080, then the OpenIPC # prompt.
If it boots: defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p <port> --power-cycle installs it.

The new GSL is used only for 20s/20g. On a Hi3516CV608 it trains DDR, but Linux then can't probe that board's FM25Q64A flash, so it isn't the default. If your module's flash isn't the MX25L12835F, please post the boot log either way.

I manged to dump NOR content (but upload won;t let me attach .bin file?). Then again, you seem to have got it already or not needed?

C:\Users\pozze\Downloads>defib burn -c hi3516cv610:20s -f boot-hi3516cv610-20s-nor.bin -p COM5 -b Protocol: HiSilicon CV6xx Port: COM5 INFO:defib.transport.serial_platform:Using standard SerialTransport for win32 Starting HiSilicon CV6xx handshake for hi3516cv610:20s Sending 204288 bytes of firmware... INFO:defib.protocol.hisilicon_cv6xx:CV6xx boot file: GSL=22528 bytes, DDR tables=1 (size=12288), U-Boot=167424 bytes gsl ------------------------------ 100% 0:00:02INFO:defib.protocol.hisilicon_cv6xx:Board ID: 0, CPU ID: 0x1 gsl ------------------------------ 100% 0:00:02 ddr_table ------------------------------ 100% 0:00:01INFO:defib.protocol.hisilicon_cv6xx:DDR training: boot table version :V0.2 boot table build time :2026/03/01 17:22:42 gsl ------------------------------ 100% 0:00:02 Waiting for U-Boot to start (up to 15s)... Autoboot detected, sending Ctrl-C... U-Boot console ready gsl ------------------------------ 100% 0:00:02 ddr_table ------------------------------ 100% 0:00:01 uboot ------------------------------ 100% 0:00:19 Done! (31983ms) C:\Users\pozze\Downloads>

reconnect with Putty and Iget the OpenIPC # prompt:

OpenIPC # printenv
arch=arm
baudrate=115200
board=hi3516cv610
board_name=hi3516cv610
bootargs=mem=64M console=tty0,115200 clk_ignore_unused root=/dev/mtdblock2 rootf stype=squashfs rw mtdparts=sfc:320K(boot),3M(kernel),4M(rootfs),8384K(appfs),512 K(configs)
bootcmd=sf probe 0; sf read 0x41000000 0x50000 0x300000; bootm 0x41000000
bootcount=1
bootdelay=0
bootshell=0
cpu=armv7
ethact=eth0
ethaddr=9a:b2:a5:27:83:c9
fdt_high=0xffffffff
fwfile=firmware.bin.hi3516cv6xx
fwsize=0xfb0000
fwwrite=sf probe 0; if itest ${filesize} -gt 0; then if itest ${filesize} -le ${ fwsize}; then sf erase ${kernaddr} ${fwsize}; sf write ${baseaddr} ${kernaddr} $ {filesize}; else echo fwwrite: ${filesize} bytes do not fit ${fwsize} from ${ker naddr}, nothing written; fi; else echo fwwrite: empty file, nothing written; fi
kernaddr=0x00050000
kernsize=0x300000
mtdparts=sfc:256k(u-boot),64k(env),3072k(kernel),5120k(rootfs),8192k@0x50000(fir mware),-(rootfs_data)
mtds=256k(u-boot),64k(env),3072k(kernel),5120k(rootfs),8192k@0x50000(firmware),- (rootfs_data)
rootaddr=0x00350000
rootsize=0x500000
soc=hi3516cv610
stderr=serial
stdin=serial
stdout=serial
totalmem=128M
vendor=hiface
ver=U-Boot 2022.10-g641a8247 (Oct 25 2026 - 17:13:38 +0000)hi3516cv610
verify=n

Environment size: 1221/65532 bytes
OpenIPC #

BUT no luck with the install:

downloaded tgz from: https://github.com/OpenIPC/firmware/releases/download/nightly-20261025-ff695ca/openipc.hi3516cv6xx-nor-ultimate-split.tgz

C:\Users\pozze\Downloads>defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --power-cycle OpenIPC Firmware Install Chip: hi3516cv610:20s Port: COM5 Flash: NOR 8MB Tarball missing uImage or rootfs (squashfs/ubi)

"What am I doing wrong and why does it let me?" :-)

@packlet

@packlet great, thank you: that's the result we were hoping for. ver=U-Boot 2022.10-g641a8247 … hi3516cv610 is the new 20s image with this module's own GSL, and reaching OpenIPC # means DDR training now works on the K662C6S. The dump isn't needed any more; that GSL is already in the image. (If you ever want to share a .bin, GitHub accepts it zipped.)

Nothing wrong with the tarball. Your copy of defib is just older than the firmware format. Your output still says Chip: and Flash: NOR 8MB, which defib replaced on 2026-09-16, and support for the cv6xx split image (openipc.hi3516cv6xx-nor-ultimate-split.tgz, a single firmware.bin) only arrived on 2026-10-20. Current defib master takes that exact tarball, recognises the split layout and fetches the new 20s U-Boot itself. defib burn worked for you because the boot ROM upload hasn't changed.

defib is installed straight from git and doesn't update itself. Upgrade with whichever tool you installed it with:

uv tool upgrade defib        # if installed with uv
pipx reinstall defib         # if installed with pipx

Then run the same command again:

defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --power-cycle

It should now print Profile: and Flash: NOR auto-detect. That matters here: the old version assumed 8 MB, and your flash is a 16 MB MX25L12835F. It's also worth backing up the stock flash first with defib dump-flash (you already have your own dump, so that's covered).

One expectation to set: the IMX622 still has no sensor driver in the cv6xx firmware, so OpenIPC will boot and be reachable over the network, but won't stream video yet.

hmmm...

C:\Users\pozze\Downloads>uv tool upgrade defib Updated https://github.com/OpenIPC/defib (6459158) Built defib @ git+https://github.com/OpenIPC/defib@64591582c22a85fd0a7a896249c6a3378924112c Reinstalled defib v0.1.0 - defib==0.1.0 (from git+https://github.com/OpenIPC/defib@05d347198cf5b9eaffd243af8deef9a9a4279dac) + defib==0.1.0 (from git+https://github.com/OpenIPC/defib@64591582c22a85fd0a7a896249c6a3378924112c) - pydantic==2.13.5 + pydantic==2.14.1 - pydantic-core==2.46.5 + pydantic-core==2.50.1 - typer==0.27.2 + typer==0.27.3 Installed 1 executable: defib

C:\Users\pozze\Downloads>defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --power-cycle OpenIPC Firmware Install Profile: hi3516cv610:20s Port: COM5 Flash: NOR auto-detect Image: firmware.bin.hi3516cv6xx (9371648 bytes; split NOR layout, uImage + squashfs at 0x50000) Downloading U-Boot for hi3516cv610:20s... U-Boot: boot-hi3516cv610-20s-nor.bin (204288 bytes → padded to 262144) Power controller error: DEFIB_POE_HOST env var required for RouterOS power control

leaving off the "--power-cycle" to get further
add "--nic Ethernet" (Windows, duh)
run command prompt as Administrator (also duh) and...

C:\Users\pozze\Downloads>defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --nic Ethernet OpenIPC Firmware Install Profile: hi3516cv610:20s Port: COM5 Flash: NOR auto-detect Image: firmware.bin.hi3516cv6xx (9371648 bytes; split NOR layout, uImage + squashfs at 0x50000) U-Boot: boot-hi3516cv610-20s-nor.bin (204288 bytes → padded to 262144) Phase 1: Burning U-Boot to RAM Power-cycle the camera now! Starting HiSilicon CV6xx handshake for hi3516cv610:20s Waiting for bootrom... power-cycle the device now! BootROM handshake complete Sending 204288 bytes of firmware... Querying board ID... Board ID: 0 Waiting for DDR training... DDR training complete Recovery complete U-Boot loaded in 35109ms Autoboot detected, sending Ctrl-C... U-Boot shell mode Phase 2: Flash via TFTP U-Boot does not expose a usable sf lock command; continuing and relying on erase/write result checks. SPI flash detected: 16 MiB (detected), erase block 0x10000 NIC: Ethernet, Host IP: 192.168.1.10 IP assigned TFTP server started on 192.168.1.10:69 Device IP: 192.168.1.20, server: 192.168.1.10 Flashing U-Boot → 0x0 (262144 bytes) TFTP CRC verified: AE78FD54 Erase: 0x0+0x40000 (payload 0x40000) Flash verified: AE78FD54 U-Boot OK kernel: the uImage at the start of firmware.bin (written by the rootfs stage). Nothing to do. Flashing firmware.bin → 0x50000 (9371648 bytes) TFTP CRC verified: D5623963 Erase: 0x50000+0xFB0000 (payload 0x8F0000) Flash verified: D5623963 firmware.bin OK rootfs-data: the rootfs stage erased everything after firmware.bin; the first boot makes an empty overlay there. Nothing to do. Setting boot environment (U-Boot scans the NOR layout) U-Boot default environment loaded, totalmem 128M Restoring factory ethaddr: 46:ee:1b:c2:95:55 Environment saved Resetting device... Install complete! Device is rebooting into OpenIPC.

But have the 20 second boot loop...

U-Boot 2022.10-g44b7cebc (Oct 26 2026 - 05:09:52 +0000)hi3516cv610

DRAM: 128 MiB
Core: 1 devices, 1 uclasses
MMC: sdhci_setup_cfg: Hardware doesn't specify base clock frequency
MMC Device 0 not found
mmc device not found!!
No SD device found !

Loading Environment from SPIFlash... Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L12835F/45G"
SPI Nor: SR1=0x00 SR2=0x00 SR3=0x07
SPI Nor: unlocked SR3 0x07 -> 0x03 (WPS)
SPI Nor: still protected (SR1=0x02 SR2=0x00 SR3=0x07), erase and write will be discarded
SPI Nor total size: 16MB
OK
In: serial
Out: serial
Err: serial
MMC Device 0 not found
USB0: Register 1000140 NbrPorts 1
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Automatic flash layout detection...
Scanning 0x50000-0x450000 ...
Found Kernel at 0x00050000
Found RootFS at 0x00250000 (7066k)
Net: eth0
Warning: eth0 (eth0) using random MAC address - 46:a8:25:93:a7:67

Hit Ctrl-C to stop autoboot: 1
device 0 offset 0x50000, size 0x200000
SF: 2097152 bytes @ 0x50000 Read: OK

Booting kernel from Legacy Image at 42080000 ...

Image Name: Linux-5.10.221-hi3516cv6xx
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2078797 Bytes = 2 MiB
Load Address: 40018000
Entry Point: 40018000
Loading Kernel Image

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 5.10.221 (runner@runnervmr9t6g) (buildroot-gcc-13.3.0) #1 SMP Sun Oct 25 18:41:35 UTC 2026
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
OF: fdt: Machine model: Hisilicon Hi3516CV610 DEMO Board
earlycon: pl11 at MMIO 0x11040000 (options '')
printk: bootconsole [pl11] enabled
hisi_mem: DRAM 128M (probed), cma, OS 32M, mmz=anonymous,0,0x42000000,96M
Memory policy: Data cache writealloc
cma: Reserved 96 MiB at 0x42000000
Zone ranges:
Normal [mem 0x0000000040000000-0x0000000047ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000040000000-0x0000000047ffffff]
Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
percpu: Embedded 14 pages/cpu s26828 r8192 d22324 u57344
Built 1 zonelists, mobility grouping on. Total pages: 32512
Kernel command line: mem=32M earlycon=pl011,0x11040000 console=ttyAMA0,115200 panic=20 root=/dev/mtdblock3 rootfstype=squashfs init=/init mtdparts=sfc:256k(u-boot),64k(env),2048k(kernel),7104k(rootfs),9152k@0x50000(firmware),-(rootfs_data) init=/init
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
mem auto-init: stack:all(zero), heap alloc:on, heap free:off
Memory: 24776K/131072K available (3072K kernel code, 180K rwdata, 1016K rodata, 1024K init, 142K bss, 7992K reserved, 98304K cma-reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
arch_timer: cp15 timer(s) running at 24.00MHz (phys).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
Switching to timer-based delay loop, resolution 41ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
CPU: Testing write buffer coherency: ok
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x40100000 - 0x40100038
rcu: Hierarchical SRCU implementation.
smp: Bringing up secondary CPUs ...
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated (96.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
SCSI subsystem initialized
ssp-pl022 11070000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11070000.spi: deassert reset
ssp-pl022 11071000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11071000.spi: deassert reset
usb_ver: 5.10 - 2.3
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[UPS-PHY][ups_phy_module_init]registered new ups phy driver
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
NET: Registered protocol family 1
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
brd: module loaded
loop: module loaded
bsp-sfc bsp_spi_nor.0: SPI Nor ID Table Version 1.2
cmd read ID 0xc2 0x20 0x18
bsp-sfc bsp_spi_nor.0: all blocks is unlocked.
bsp-sfc bsp_spi_nor.0: spi nor register fail!
bsp-sfc: probe of bsp_spi_nor.0 failed with error -5
Get ld_trim_compensation -1 from dts.
FEPHY:addr=0, la_am=0xc, ldo_am=0x5, r_tuning=0x25
attached port 0 PHY 0 to driver Generic PHY
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver rndis_host
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver usb-storage
i2c /dev entries driver
bsp-i2c 11060000.i2c: deassert reset
bsp-i2c 11060000.i2c: IRQ index 0 not found
bsp-i2c 11061000.i2c: deassert reset
bsp-i2c 11061000.i2c: IRQ index 0 not found
bsp-i2c 11062000.i2c: deassert reset
bsp-i2c 11062000.i2c: IRQ index 0 not found
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
dwc3 10300000.dwc3: Configuration mismatch. dr_mode forced to host
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0.auto: hcc params 0x0220fe6d hci version 0x110 quirks 0x0000000020010010
xhci-hcd xhci-hcd.0.auto: irq 71, io mem 0x10300000
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
hub 2-0:1.0: USB hub found
hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[WING-USB][wing_usb_module_init]register wing usb driver
mmc0: SDHCI controller on 10030000.eMMC [10030000.eMMC] using ADMA
mmc1: SDHCI controller on 10040000.SDIO1 [10040000.SDIO1] using ADMA
NET: Registered protocol family 17
Registering SWP/SWPB emulation handler
uart-pl011 11040000.uart: deassert reset
11040000.uart: ttyAMA0 at MMIO 0x11040000 (irq = 30, base_baud = 0) is a PL011 rev2
printk: console [ttyAMA0] enabled
printk: console [ttyAMA0] enabled
printk: bootconsole [pl11] disabled
printk: bootconsole [pl11] disabled
uart-pl011 11041000.uart: deassert reset
11041000.uart: ttyAMA1 at MMIO 0x11041000 (irq = 31, base_baud = 0) is a PL011 rev2
uart-pl011 11042000.uart: deassert reset
11042000.uart: ttyAMA2 at MMIO 0x11042000 (irq = 32, base_baud = 0) is a PL011 rev2
pl061_gpio 11090000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11091000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11092000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11093000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11094000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11095000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11096000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11097000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11098000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11099000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 1109a000.gpio_chip: PL061 GPIO chip registered
clk: Disabling unused clocks
/dev/root: Can't open blockdev
VFS: Cannot open root device "mtdblock3" or unknown-block(0,0): error -6
Please append a correct "root=" boot option; here are the available partitions:
0100 65536 ram0
(driver?)
0101 65536 ram1
(driver?)
0102 65536 ram2
(driver?)
0103 65536 ram3
(driver?)
0104 65536 ram4
(driver?)
0105 65536 ram5
(driver?)
0106 65536 ram6
(driver?)
0107 65536 ram7
(driver?)
0108 65536 ram8
(driver?)
0109 65536 ram9
(driver?)
010a 65536 ram10
(driver?)
010b 65536 ram11
(driver?)
010c 65536 ram12
(driver?)
010d 65536 ram13
(driver?)
010e 65536 ram14
(driver?)
010f 65536 ram15
(driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (panic+0xb3/0x228)
[] (panic) from [] (mount_block_root+0x1e3/0x260)
[] (mount_block_root) from [] (prepare_namespace+0x67/0x17c)
[] (prepare_namespace) from [] (kernel_init+0x7/0xbc)
[] (kernel_init) from [] (ret_from_fork+0x11/0x38)
Exception stack(0xc0c25fb0 to 0xc0c25ff8)
5fa0: 00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
CPU0: stopping
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (do_handle_IPI+0x4d/0xc8)
[] (do_handle_IPI) from [] (ipi_handler+0xd/0x14)
[] (ipi_handler) from [] (generic_handle_irq+0x15/0x1e)
[] (generic_handle_irq) from [] (__handle_domain_irq+0x55/0x64)
[] (__handle_domain_irq) from [] (gic_handle_irq+0x53/0x64)
[] (gic_handle_irq) from [] (__irq_svc+0x65/0x94)
Exception stack(0xc0701f38 to 0xc0701f80)
1f20: 0000092c 00000000
1f40: 0000092c c010cfa1 00000001 c0703e98 c0700000 c0703edc c061aa58 410fc075
1f60: 50c5387d 00000000 c070003c c0701f88 c0106113 c010610a 40000033 ffffffff
[] (__irq_svc) from [] (arch_cpu_idle+0xc/0x1e)
[] (arch_cpu_idle) from [] (default_idle_call+0x1b/0x24)
[] (default_idle_call) from [] (do_idle+0x73/0xa4)
[] (do_idle) from [] (cpu_startup_entry+0x13/0x14)
[] (cpu_startup_entry) from [] (start_kernel+0x2bb/0x36e)
[] (start_kernel) from [<00000000>] (0x0)
Rebooting in 20 seconds..

flashddr param version 20250416

boot table board switch:0x00000000
boot table version :V0.2
boot table build time :2026/03/01 17:22:42
boot table file name :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000080

System startup

Uncompress Ok!

U-Boot 2022.10-g44b7cebc (Oct 26 2026 - 05:09:52 +0000)hi3516cv610

DRAM: 128 MiB
Core: 1 devices, 1 uclasses
MMC: sdhci_setup_cfg: Hardware doesn't specify base clock frequency
MMC Device 0 not found
mmc device not found!!
No SD device found !

Loading Environment from SPIFlash... Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L12835F/45G"
SPI Nor: SR1=0x00 SR2=0x00 SR3=0x07
SPI Nor: unlocked SR3 0x07 -> 0x03 (WPS)
SPI Nor: still protected (SR1=0x02 SR2=0x00 SR3=0x07), erase and write will be discarded
SPI Nor total size: 16MB
OK
In: serial
Out: serial
Err: serial
MMC Device 0 not found
USB0: Register 1000140 NbrPorts 1
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Automatic flash layout detection...
Scanning 0x50000-0x450000 ...
Found Kernel at 0x00050000
Found RootFS at 0x00250000 (7066k)
Net: eth0
Warning: eth0 (eth0) using random MAC address - 6e:a1:c9:a6:fa:bb

Hit Ctrl-C to stop autoboot: 1
OpenIPC #
OpenIPC #

How to fix that, please?

One expectation to set: the IMX622 still has no sensor driver in the cv6xx firmware, so OpenIPC will boot and be reachable over the network, but won't stream video yet.

https://github.com/snokvist/waybeam_venc/tree/master/sensors/cv610/imx662

14. > One expectation to set: the IMX622 still has no sensor driver in the cv6xx firmware, so OpenIPC will boot and be reachable over the network, but won't stream video yet.
     https://github.com/snokvist/waybeam_venc/tree/master/sensors/cv610/imx662

Yes, was going to look into that once sorted here. Is Waybeam suitable for PoE ethernet-connected cameras? or only wifi? My use case is hard-wired home security using Blue Iris... TIA.

Part 1: Camera (VTX) setup

1.1 Prerequisites

Before you begin, make sure that:

✅ OpenIPC firmware is installed on the camera
✅ WFB-ng (wfb_tx) is installed and working
✅ A WiFi adapter (RTL8812EU or RTL8812AU) is connected

@packlet

@packlet thanks for the full log, that was enough to find it, and to reproduce it here on a Hi3516CV608. Your camera isn't bricked: U-Boot, DDR and the flash contents are all fine (Flash verified for both U-Boot and firmware.bin).

Cause. The factory GSL that fixed DDR training on this module also switches on the flash controller's write-protect output, holding the flash's WP# pin low (bit 6 of FMC register 0x10000004). With WP# held, the flash refuses status-register writes. Linux's flash driver writes and re-reads one while probing, gets a mismatch and gives up (spi nor register fail!, -5), so there's no root filesystem → panic → reboot every 20 s. U-Boot's still protected … line is the same thing.

Permanent fix: OpenIPC/u-boot#82 makes U-Boot release WP# at startup. Once it's merged and published, re-running defib install (as before) or just flashing the new U-Boot will fix it.

To get going now, from your working U-Boot:

Press Ctrl-C at Hit Ctrl-C to stop autoboot to get OpenIPC #.
Enter, line by line:

mw.l 0x10000004 0x84
setenv bootcmd 'mw.l 0x10000004 0x84; run bootflash'
saveenv
reset

The first line releases WP# now, so saveenv can actually write. The new bootcmd releases it on every boot before Linux starts. Linux should then show MX25L12835F … (16384 Kbytes) instead of register fail and boot to the login prompt.

Once the fixed U-Boot is installed, setenv bootcmd 'run bootflash'; saveenv returns bootcmd to normal (not env default -a, which would also drop the factory MAC that defib saved), though leaving it as it is does no harm. (The IMX622 still has no sensor driver, so expect a booted system but no video yet.)

@packlet

@packlet the U-Boot fix is published. boot-hi3516cv610-20s-nor.bin in the OpenIPC/firmware latest release (2026-10-26 17:31 UTC) is U-Boot 2022.10-g74413262 with your module's GSL. At startup it releases the flash controller's WP#, so Linux can find the flash (OpenIPC/u-boot#82).

One catch first: older defib keeps the boot image it downloaded yesterday and would reuse it. The simplest fix is uv tool upgrade defib again: since #167 it checks a cached image against the release and fetches the new one itself. Or delete the cached copy by hand:

del "%LOCALAPPDATA%\defib\firmware\boot-hi3516cv610-20s-nor.bin"

(Or download the file yourself and pass it with --uboot boot-hi3516cv610-20s-nor.bin.)

Then re-run the same install:

defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --nic Ethernet

What to look for in the boot log:

U-Boot should print U-Boot 2022.10-g74413262.
Linux should show your MX25L12835F detected, instead of spi nor register fail!.
It should then boot to the openipc-hi3516cv6xx login: prompt.

If you applied the bootcmd workaround from my last comment, it does no harm. The install resets the environment anyway, apart from the MAC.

Please post the boot log either way; the fix has only been run on a CV608 here, not on your module.

firmware: check a cached boot image against the release before reusin…

@snokvist

@snokvist thank you, that's a much better answer than mine. A correction first: this module's sensor is the IMX662 (the K662C6S), not "IMX622"; I picked up a typo and repeated it above and in OpenIPC/u-boot#71.

For @packlet: snokvist's sensors/cv610/imx662 is a source-built HiSilicon V5 sensor plugin for exactly this board (SIP-K662C6S, 4-lane, linear, 1080p at 30/60 fps RAW12 and 90/100 fps RAW10). Its README has the build. Today it pairs with snokvist's waybeam_venc streamer, not majestic, so that's the route to video on this module right now.

@snokvist, would you be happy to have it in OpenIPC's tree? It already builds against OpenHisilicon's public headers and libraries/sensor/hi3516cv6xx/common, and exports a standard g_sns_imx662_obj. So it would sit next to the other cv6xx sensors as libraries/sensor/hi3516cv6xx/sony_imx662 in OpenIPC/openhisilicon, the way the SP2308 port landed. OpenIPC/firmware would then ship libsns_imx662.so and a sensor profile so majestic can use it too.

I'm glad to do the port with your authorship kept, or you can open the PR yourself, whichever you prefer. The repo has no license file, so I'd rather ask than assume.

@snokvist

Go ahead and swipe it, its AI generated. Need calibration touchup and a good bin. Its blue tinted in its current default settings.

I dont need authorship, didnt write a single line of code, all claude :)
Its better for you to integrate it in the best way for OpenIPC instead of me botching a PR

@snokvist, would
I'm glad to do the port with your authorship kept, or you can open the PR yourself, whichever you prefer. The repo has no license file, so I'd rather ask than assume.

none of that worked for me. still have 20 sec boot loop. I'll park this for a while and let the dust settle... thanx.

OpenIPC #
OpenIPC # mw.l 0x10000004 0x84
OpenIPC # setenv bootcmd 'mw.l 0x10000004 0x84; run bootflash'
OpenIPC # saveenv
Saving Environment to SPIFlash... Erasing SPI flash...Writing to SPI flash...done
OK
OpenIPC # reset
resetting ...

flashddr param version 20250416

boot table board switch:0x00000000
boot table version :V0.2
boot table build time :2026/03/01 17:22:42
boot table file name :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000080

System startup

Uncompress Ok!

U-Boot 2022.10-g74413262 (Oct 26 2026 - 17:19:25 +0000)hi3516cv610

DRAM: 128 MiB
Core: 1 devices, 1 uclasses
MMC: sdhci_setup_cfg: Hardware doesn't specify base clock frequency
MMC Device 0 not found
mmc device not found!!
No SD device found !

Loading Environment from SPIFlash... Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L12835F/45G"
SPI Nor: SR1=0x00 SR2=0x00 SR3=0x07
SPI Nor: unlocked SR3 0x07 -> 0x03 (WPS)
SPI Nor: still protected (SR1=0x02 SR2=0x00 SR3=0x07), erase and write will be discarded
SPI Nor total size: 16MB
OK
In: serial
Out: serial
Err: serial
MMC Device 0 not found
USB0: Register 1000140 NbrPorts 1
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Automatic flash layout detection...
Scanning 0x50000-0x450000 ...
Found Kernel at 0x00050000
Found RootFS at 0x00250000 (7066k)
Net: eth0
Hit Ctrl-C to stop autoboot: 1
device 0 offset 0x50000, size 0x200000
SF: 2097152 bytes @ 0x50000 Read: OK

Booting kernel from Legacy Image at 42080000 ...

Image Name: Linux-5.10.221-hi3516cv6xx
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2078797 Bytes = 2 MiB
Load Address: 40018000
Entry Point: 40018000
Loading Kernel Image

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 5.10.221 (runner@runnervmr9t6g) (buildroot-gcc-13.3.0) #1 SMP Sun Oct 25 18:41:35 UTC 2026
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
OF: fdt: Machine model: Hisilicon Hi3516CV610 DEMO Board
earlycon: pl11 at MMIO 0x11040000 (options '')
printk: bootconsole [pl11] enabled
hisi_mem: DRAM 128M (probed), cma, OS 32M, mmz=anonymous,0,0x42000000,96M
Memory policy: Data cache writealloc
cma: Reserved 96 MiB at 0x42000000
Zone ranges:
Normal [mem 0x0000000040000000-0x0000000047ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000040000000-0x0000000047ffffff]
Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
percpu: Embedded 14 pages/cpu s26828 r8192 d22324 u57344
Built 1 zonelists, mobility grouping on. Total pages: 32512
Kernel command line: mem=32M earlycon=pl011,0x11040000 console=ttyAMA0,115200 panic=20 root=/dev/mtdblock3 rootfstype=squashfs in it=/init mtdparts=sfc:256k(u-boot),64k(env),2048k(kernel),7104k(rootfs),9152k@0x50000(firmware),-(rootfs_data) init=/init
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
mem auto-init: stack:all(zero), heap alloc:on, heap free:off
Memory: 24776K/131072K available (3072K kernel code, 180K rwdata, 1016K rodata, 1024K init, 142K bss, 7992K reserved, 98304K cma- reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
arch_timer: cp15 timer(s) running at 24.00MHz (phys).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
Switching to timer-based delay loop, resolution 41ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
CPU: Testing write buffer coherency: ok
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x40100000 - 0x40100038
rcu: Hierarchical SRCU implementation.
smp: Bringing up secondary CPUs ...
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated (96.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
SCSI subsystem initialized
ssp-pl022 11070000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11070000.spi: deassert reset
ssp-pl022 11071000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11071000.spi: deassert reset
usb_ver: 5.10 - 2.3
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[UPS-PHY][ups_phy_module_init]registered new ups phy driver
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
NET: Registered protocol family 1
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
brd: module loaded
loop: module loaded
bsp-sfc bsp_spi_nor.0: SPI Nor ID Table Version 1.2
cmd read ID 0xc2 0x20 0x18
bsp-sfc bsp_spi_nor.0: all blocks is unlocked.
bsp-sfc bsp_spi_nor.0: spi nor register fail!
bsp-sfc: probe of bsp_spi_nor.0 failed with error -5
Get ld_trim_compensation -1 from dts.
FEPHY:addr=0, la_am=0xc, ldo_am=0x5, r_tuning=0x25
attached port 0 PHY 0 to driver Generic PHY
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver rndis_host
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver usb-storage
i2c /dev entries driver
bsp-i2c 11060000.i2c: deassert reset
bsp-i2c 11060000.i2c: IRQ index 0 not found
bsp-i2c 11061000.i2c: deassert reset
bsp-i2c 11061000.i2c: IRQ index 0 not found
bsp-i2c 11062000.i2c: deassert reset
bsp-i2c 11062000.i2c: IRQ index 0 not found
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
dwc3 10300000.dwc3: Configuration mismatch. dr_mode forced to host
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0.auto: hcc params 0x0220fe6d hci version 0x110 quirks 0x0000000020010010
xhci-hcd xhci-hcd.0.auto: irq 71, io mem 0x10300000
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
hub 2-0:1.0: USB hub found
hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[WING-USB][wing_usb_module_init]register wing usb driver
mmc0: SDHCI controller on 10030000.eMMC [10030000.eMMC] using ADMA
mmc1: SDHCI controller on 10040000.SDIO1 [10040000.SDIO1] using ADMA
NET: Registered protocol family 17
Registering SWP/SWPB emulation handler
uart-pl011 11040000.uart: deassert reset
11040000.uart: ttyAMA0 at MMIO 0x11040000 (irq = 30, base_baud = 0) is a PL011 rev2
printk: console [ttyAMA0] enabled
printk: console [ttyAMA0] enabled
printk: bootconsole [pl11] disabled
printk: bootconsole [pl11] disabled
uart-pl011 11041000.uart: deassert reset
11041000.uart: ttyAMA1 at MMIO 0x11041000 (irq = 31, base_baud = 0) is a PL011 rev2
uart-pl011 11042000.uart: deassert reset
11042000.uart: ttyAMA2 at MMIO 0x11042000 (irq = 32, base_baud = 0) is a PL011 rev2
pl061_gpio 11090000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11091000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11092000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11093000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11094000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11095000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11096000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11097000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11098000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11099000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 1109a000.gpio_chip: PL061 GPIO chip registered
clk: Disabling unused clocks
/dev/root: Can't open blockdev
VFS: Cannot open root device "mtdblock3" or unknown-block(0,0): error -6
Please append a correct "root=" boot option; here are the available partitions:
0100 65536 ram0
(driver?)
0101 65536 ram1
(driver?)
0102 65536 ram2
(driver?)
0103 65536 ram3
(driver?)
0104 65536 ram4
(driver?)
0105 65536 ram5
(driver?)
0106 65536 ram6
(driver?)
0107 65536 ram7
(driver?)
0108 65536 ram8
(driver?)
0109 65536 ram9
(driver?)
010a 65536 ram10
(driver?)
010b 65536 ram11
(driver?)
010c 65536 ram12
(driver?)
010d 65536 ram13
(driver?)
010e 65536 ram14
(driver?)
010f 65536 ram15
(driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (panic+0xb3/0x228)
[] (panic) from [] (mount_block_root+0x1e3/0x260)
[] (mount_block_root) from [] (prepare_namespace+0x67/0x17c)
[] (prepare_namespace) from [] (kernel_init+0x7/0xbc)
[] (kernel_init) from [] (ret_from_fork+0x11/0x38)
Exception stack(0xc0c25fb0 to 0xc0c25ff8)
5fa0: 00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
CPU0: stopping
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (do_handle_IPI+0x4d/0xc8)
[] (do_handle_IPI) from [] (ipi_handler+0xd/0x14)
[] (ipi_handler) from [] (generic_handle_irq+0x15/0x1e)
[] (generic_handle_irq) from [] (__handle_domain_irq+0x55/0x64)
[] (__handle_domain_irq) from [] (gic_handle_irq+0x53/0x64)
[] (gic_handle_irq) from [] (__irq_svc+0x65/0x94)
Exception stack(0xc0701f38 to 0xc0701f80)
1f20: 00000c40 00000000
1f40: 00000c40 c010cfa1 00000001 c0703e98 c0700000 c0703edc c061aa58 410fc075
1f60: 50c5387d 00000000 c070003c c0701f88 c0106113 c010610a 40000033 ffffffff
[] (__irq_svc) from [] (arch_cpu_idle+0xc/0x1e)
[] (arch_cpu_idle) from [] (default_idle_call+0x1b/0x24)

flashddr param version 20250416

boot table board switch:0x00000000
boot table version :V0.2
boot table build time :2026/03/01 17:22:42
boot table file name :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000080

System startup

Uncompress Ok!

U-Boot 2022.10-g74413262 (Oct 26 2026 - 17:19:25 +0000)hi3516cv610

DRAM: 128 MiB
Core: 1 devices, 1 uclasses
MMC: sdhci_setup_cfg: Hardware doesn't specify base clock frequency
MMC Device 0 not found
mmc device not found!!
No SD device found !

Loading Environment from SPIFlash... Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L12835F/45G"
SPI Nor: SR1=0x00 SR2=0x00 SR3=0x07
SPI Nor: unlocked SR3 0x07 -> 0x03 (WPS)
SPI Nor: still protected (SR1=0x02 SR2=0x00 SR3=0x07), erase and write will be discarded
SPI Nor total size: 16MB
OK
In: serial
Out: serial
Err: serial
MMC Device 0 not found
USB0: Register 1000140 NbrPorts 1
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Automatic flash layout detection...
Scanning 0x50000-0x450000 ...
Found Kernel at 0x00050000
Found RootFS at 0x00250000 (7066k)
Net: eth0
Hit Ctrl-C to stop autoboot: 1
device 0 offset 0x50000, size 0x200000
SF: 2097152 bytes @ 0x50000 Read: OK

Booting kernel from Legacy Image at 42080000 ...

Image Name: Linux-5.10.221-hi3516cv6xx
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2078797 Bytes = 2 MiB
Load Address: 40018000
Entry Point: 40018000
Loading Kernel Image

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 5.10.221 (runner@runnervmr9t6g) (buildroot-gcc-13.3.0) #1 SMP Sun Oct 25 18:41:35 UTC 2026
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
OF: fdt: Machine model: Hisilicon Hi3516CV610 DEMO Board
earlycon: pl11 at MMIO 0x11040000 (options '')
printk: bootconsole [pl11] enabled
hisi_mem: DRAM 128M (probed), cma, OS 32M, mmz=anonymous,0,0x42000000,96M
Memory policy: Data cache writealloc
cma: Reserved 96 MiB at 0x42000000
Zone ranges:
Normal [mem 0x0000000040000000-0x0000000047ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x0000000040000000-0x0000000047ffffff]
Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
percpu: Embedded 14 pages/cpu s26828 r8192 d22324 u57344
Built 1 zonelists, mobility grouping on. Total pages: 32512
Kernel command line: mem=32M earlycon=pl011,0x11040000 console=ttyAMA0,115200 panic=20 root=/dev/mtdblock3 rootfstype=squashfs init=/init mtdparts=sfc:256k(u-boot),64k(env),2048k(kernel),7104k(rootfs),9152k@0x50000(firmware),-(rootfs_data) init=/init
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
mem auto-init: stack:all(zero), heap alloc:on, heap free:off
Memory: 24776K/131072K available (3072K kernel code, 180K rwdata, 1016K rodata, 1024K init, 142K bss, 7992K reserved, 98304K cma-reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
rcu: Hierarchical RCU implementation.
rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
arch_timer: cp15 timer(s) running at 24.00MHz (phys).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
Switching to timer-based delay loop, resolution 41ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
CPU: Testing write buffer coherency: ok
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x40100000 - 0x40100038
rcu: Hierarchical SRCU implementation.
smp: Bringing up secondary CPUs ...
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
smp: Brought up 1 node, 2 CPUs
SMP: Total of 2 processors activated (96.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes, linear)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Serial: AMBA PL011 UART driver
SCSI subsystem initialized
ssp-pl022 11070000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11070000.spi: deassert reset
ssp-pl022 11071000.spi: ARM PL022 driver, device ID: 0x00800022
ssp-pl022 11071000.spi: deassert reset
usb_ver: 5.10 - 2.3
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
[UPS-PHY][ups_phy_module_init]registered new ups phy driver
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
NET: Registered protocol family 1
workingset: timestamp_bits=30 max_order=15 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
brd: module loaded
loop: module loaded
bsp-sfc bsp_spi_nor.0: SPI Nor ID Table Version 1.2
cmd read ID 0xc2 0x20 0x18
bsp-sfc bsp_spi_nor.0: all blocks is unlocked.
bsp-sfc bsp_spi_nor.0: spi nor register fail!
bsp-sfc: probe of bsp_spi_nor.0 failed with error -5
Get ld_trim_compensation -1 from dts.
FEPHY:addr=0, la_am=0xc, ldo_am=0x5, r_tuning=0x25
attached port 0 PHY 0 to driver Generic PHY
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver rndis_host
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver usb-storage
i2c /dev entries driver
bsp-i2c 11060000.i2c: deassert reset
bsp-i2c 11060000.i2c: IRQ index 0 not found
bsp-i2c 11061000.i2c: deassert reset
bsp-i2c 11061000.i2c: IRQ index 0 not found
bsp-i2c 11062000.i2c: deassert reset
bsp-i2c 11062000.i2c: IRQ index 0 not found
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
dwc3 10300000.dwc3: Configuration mismatch. dr_mode forced to host
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0.auto: hcc params 0x0220fe6d hci version 0x110 quirks 0x0000000020010010
xhci-hcd xhci-hcd.0.auto: irq 71, io mem 0x10300000
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
hub 2-0:1.0: USB hub found
hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[WING-USB][wing_usb_module_init]register wing usb driver
mmc0: SDHCI controller on 10030000.eMMC [10030000.eMMC] using ADMA
mmc1: SDHCI controller on 10040000.SDIO1 [10040000.SDIO1] using ADMA
NET: Registered protocol family 17
Registering SWP/SWPB emulation handler
uart-pl011 11040000.uart: deassert reset
11040000.uart: ttyAMA0 at MMIO 0x11040000 (irq = 30, base_baud = 0) is a PL011 rev2
printk: console [ttyAMA0] enabled
printk: console [ttyAMA0] enabled
printk: bootconsole [pl11] disabled
printk: bootconsole [pl11] disabled
uart-pl011 11041000.uart: deassert reset
11041000.uart: ttyAMA1 at MMIO 0x11041000 (irq = 31, base_baud = 0) is a PL011 rev2
uart-pl011 11042000.uart: deassert reset
11042000.uart: ttyAMA2 at MMIO 0x11042000 (irq = 32, base_baud = 0) is a PL011 rev2
pl061_gpio 11090000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11091000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11092000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11093000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11094000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11095000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11096000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11097000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11098000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 11099000.gpio_chip: PL061 GPIO chip registered
pl061_gpio 1109a000.gpio_chip: PL061 GPIO chip registered
clk: Disabling unused clocks
/dev/root: Can't open blockdev
VFS: Cannot open root device "mtdblock3" or unknown-block(0,0): error -6
Please append a correct "root=" boot option; here are the available partitions:
0100 65536 ram0
(driver?)
0101 65536 ram1
(driver?)
0102 65536 ram2
(driver?)
0103 65536 ram3
(driver?)
0104 65536 ram4
(driver?)
0105 65536 ram5
(driver?)
0106 65536 ram6
(driver?)
0107 65536 ram7
(driver?)
0108 65536 ram8
(driver?)
0109 65536 ram9
(driver?)
010a 65536 ram10
(driver?)
010b 65536 ram11
(driver?)
010c 65536 ram12
(driver?)
010d 65536 ram13
(driver?)
010e 65536 ram14
(driver?)
010f 65536 ram15
(driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (panic+0xb3/0x228)
[] (panic) from [] (mount_block_root+0x1e3/0x260)
[] (mount_block_root) from [] (prepare_namespace+0x67/0x17c)
[] (prepare_namespace) from [] (kernel_init+0x7/0xbc)
[] (kernel_init) from [] (ret_from_fork+0x11/0x38)
Exception stack(0xc0c25fb0 to 0xc0c25ff8)
5fa0: 00000000 00000000 00000000 00000000
5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5fe0: 00000000 00000000 00000000 00000000 00000013 00000000
CPU0: stopping
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.221 #1
Hardware name: HI35XX
[] (unwind_backtrace) from [] (show_stack+0xb/0xc)
[] (show_stack) from [] (dump_stack+0x5b/0x70)
[] (dump_stack) from [] (do_handle_IPI+0x4d/0xc8)
[] (do_handle_IPI) from [] (ipi_handler+0xd/0x14)
[] (ipi_handler) from [] (generic_handle_irq+0x15/0x1e)
[] (generic_handle_irq) from [] (__handle_domain_irq+0x55/0x64)
[] (__handle_domain_irq) from [] (gic_handle_irq+0x53/0x64)
[] (gic_handle_irq) from [] (__irq_svc+0x65/0x94)
Exception stack(0xc0701f38 to 0xc0701f80)
1f20: 00000900 00000000
1f40: 00000900 c010cfa1 00000001 c0703e98 c0700000 c0703edc c061aa58 410fc075
1f60: 50c5387d 00000000 c070003c c0701f88 c0106113 c010610a 40000033 ffffffff
[] (__irq_svc) from [] (arch_cpu_idle+0xc/0x1e)
[] (arch_cpu_idle) from [] (default_idle_call+0x1b/0x24)
[] (default_idle_call) from [] (do_idle+0x73/0xa4)
[] (do_idle) from [] (cpu_startup_entry+0x13/0x14)
[] (cpu_startup_entry) from [] (start_kernel+0x2bb/0x36e)
[] (start_kernel) from [<00000000>] (0x0)
Rebooting in 20 seconds..

out of frustration, i reverted to the original .bin from my dump and tried to install again. I think I broke it good now...

C:\Users\pozze\Downloads>defib install -c hi3516cv610:20s --firmware openipc.hi3516cv6xx-nor-ultimate-split.tgz -p COM5 --nic Ethernet OpenIPC Firmware Install Profile: hi3516cv610:20s Port: COM5 Flash: NOR auto-detect Image: firmware.bin.hi3516cv6xx (9371648 bytes; split NOR layout, uImage + squashfs at 0x50000) U-Boot: boot-hi3516cv610-20s-nor.bin (204288 bytes → padded to 262144) Phase 1: Burning U-Boot to RAM Power-cycle the camera now! Starting HiSilicon CV6xx handshake for hi3516cv610:20s Waiting for bootrom... power-cycle the device now! BootROM handshake complete Sending 204288 bytes of firmware... Querying board ID... Board ID: 0 Waiting for DDR training... DDR training complete Recovery complete U-Boot loaded in 36445ms Autoboot detected, sending Ctrl-C... U-Boot shell mode Phase 2: Flash via TFTP U-Boot does not expose a usable sf lock command; continuing and relying on erase/write result checks. SPI flash detected: 16 MiB (detected), erase block 0x10000 NIC: Ethernet, Host IP: 192.168.1.10 IP assigned TFTP server started on 192.168.1.10:69 Device IP: 192.168.1.20, server: 192.168.1.10 Flashing U-Boot → 0x0 (262144 bytes) TFTP CRC verified: BAEEB1BE Erase: 0x0+0x40000 (payload 0x40000) U-Boot transport failed while running 'crc32 0x42000000 0x40000': Timed out waiting for '# ' after U-Boot command 'crc32 0x42000000 0x40000'; partial response: tecture: ARM Load Address: 0x40000000 Loading loadables from 0x410000b0 to 0x40000000 Loading Kernel Image Using Device Tree in place at 40000000, end 40006bab Starting kernel ... 1 C:\Users\pozze\Downloads>

serial console at startup:

flashddr param version 20250416

boot table board switch:0x00000000
boot table version :V0.2
boot table build time :2026/03/01 17:22:42
boot table file name :Hi3516CV610-DMEB_4L_DDR3_2133M_128MB_16bit-A7_950M_QFN.xlsm
DDR size: 0x00000080

System startup

Uncompress Ok!

U-Boot 2022.10-g74413262 (Oct 26 2026 - 17:19:25 +0000)hi3516cv610

DRAM: 128 MiB
Core: 1 devices, 1 uclasses
MMC: sdhci_setup_cfg: Hardware doesn't specify base clock frequency
MMC Device 0 not found
mmc device not found!!
No SD device found !

Loading Environment from SPIFlash... Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L12835F/45G"
SPI Nor: SR1=0x00 SR2=0x00 SR3=0x07
SPI Nor: unlocked SR3 0x07 -> 0x03 (WPS)
SPI Nor: still protected (SR1=0x02 SR2=0x00 SR3=0x07), erase and write will be discarded
SPI Nor total size: 16MB
OK
In: serial
Out: serial
Err: serial
MMC Device 0 not found
USB0: Register 1000140 NbrPorts 1
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Automatic flash layout detection...
Scanning 0x50000-0x450000 ...
Found Kernel at 0x00050000
Found RootFS at 0x00350000 (4017k)
Net: eth0
Warning: eth0 (eth0) using random MAC address - e2:5d:34:d8:78:57

Hit Ctrl-C to stop autoboot: 0
device 0 offset 0x50000, size 0x300000
SF: 3145728 bytes @ 0x50000 Read: OK

Loading kernel from FIT Image at 41000000 ...

Using 'config-1' configuration
Trying 'linux_kernel' kernel subimage
Description: Linux
Type: Kernel Image
Compression: uncompressed
Data Start: 0x41003cdc
Data Size: 2985224 Bytes = 2.8 MiB
Architecture: ARM
OS: Linux
Load Address: 0x40018000
Entry Point: 0x40018000

Loading fdt from FIT Image at 41000000 ...

Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: dtb
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x410000b0
Data Size: 15276 Bytes = 14.9 KiB
Architecture: ARM
Load Address: 0x40000000
Loading fdt from 0x410000b0 to 0x40000000
Booting using the fdt blob at 0x40000000

Loading loadables from FIT Image at 41000000 ...

Trying 'linux_kernel' loadables subimage
Description: Linux
Type: Kernel Image
Compression: uncompressed
Data Start: 0x41003cdc
Data Size: 2985224 Bytes = 2.8 MiB
Architecture: ARM
OS: Linux
Load Address: 0x40018000
Entry Point: 0x40018000
Loading loadables from 0x41003cdc to 0x40018000

Loading loadables from FIT Image at 41000000 ...

Trying 'fdt-1' loadables subimage
Description: dtb
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x410000b0
Data Size: 15276 Bytes = 14.9 KiB
Architecture: ARM
Load Address: 0x40000000
Loading loadables from 0x410000b0 to 0x40000000
Loading Kernel Image
Using Device Tree in place at 40000000, end 40006bab

Starting kernel ...

and it hangs there. sorry to be such a putz, but i think i've reached my level of incompetence here.

@packlet

@packlet you didn't do anything wrong, and the camera isn't bricked. Thank you for persisting this far; parking it is sensible. Your logs show the WP# fix didn't solve it on your module, so the problem is on our side.

Where your camera is now. The interrupted install wrote the new OpenIPC U-Boot (g74413262) to flash before the session dropped, but kept the stock kernel and rootfs from your dump. OpenIPC's U-Boot can't boot the stock kernel, hence Starting kernel ... and nothing after. The boot ROM path still works, so you can put the stock firmware back with your full 16 MB dump:

defib restore -c hi3516cv610:20s -i <your-dump>.bin -p COM5 --nic Ethernet

(Run it from an Administrator prompt, as for install, and power-cycle when it asks. It loads the OpenIPC U-Boot into RAM, which trains DDR on this module, then writes the whole dump back over TFTP. After a power cycle the camera runs its stock firmware again. If it drops mid-way like the last install did, just run it again: nothing is final until it finishes.)

Why OpenIPC still doesn't boot on it. Releasing WP# fixed the same Linux spi nor register fail on a Hi3516CV608 here. That board's flash (FM25Q64A) enables quad mode through a different status register than yours. Your MX25L12835F goes through the Macronix path, which writes and verifies SR1 bit 6, and on your board that write still doesn't stick. I can't reproduce it: none of my boards has that flash. So I don't have a fix to offer you yet.

@snokvist, two questions that would narrow it down:

Which SPI NOR is on your K662C6S? Is it also MX25L12835F/45G (c2 20 18)?
When your image booted to Linux userspace, which kernel was it? Was it OpenIPC's hisilicon-hi3516cv6xx (bsp-sfc), and did dmesg show the flash probe as mx25l12835f (16384 Kbytes)?

If yours is the same part and an OpenIPC kernel probed it, the difference between the two setups is where the bug is.

@snokvist

@snokvist thanks, much appreciated. It's in OpenIPC/openhisilicon#282 as libraries/sensor/hi3516cv6xx/sony_imx662, credited to you in the commit and PR text, as you asked, rather than as author.

What changed: I used openhisilicon's Makefile and gave sys_config an imx662 sensor clock of 37.125 MHz (so 100 fps would still need 27 MHz). I also rewrote the README and two comments to drop waybeam's live IQ API.
What I noted: what you said about calibration and the blue tint.
Testing: it builds clean with the cv6xx toolchain at -Wall -Wextra -Werror, but I have no IMX662 board, so it's build-tested only.

Once that lands, OpenIPC/firmware will ship libsns_imx662.so with a majestic profile. ipctool doesn't identify the IMX662 yet, so a K662C6S will need fw_setenv sensor imx662 until it does.

That still leaves the flash problem above, which is what stops OpenIPC booting on @packlet's module at all. If your K662C6S has the same MX25L12835F and an OpenIPC kernel found it, I'd like to know how.

sensor: add imx662 for hi3516cv6xx (#282)

Can I send this module to you for the lab? At this point, I'm happy to donate it if it would help build proper complete support for the K662C6S and/or IMX662. Just need an address to send it to, and it's yours to keep...

@flyrouter

29. Can I send this module to you for the lab? At this point, I'm happy to donate it if it would help build proper complete support for the K662C6S and/or IMX662. Just need an address to send it to, and it's yours to keep...

Good afternoon, my name is Igor and I am the project coordinator.
You can contact me on Telegram by reaching out to me as @flyrouter to discuss the details of how it will be convenient for you to send the device to one of our labs.
Thank you.

Navigation Menu

Repository navigation

hi3516cv610:20s — bootrom upload fails after DDR training ("Failed to send U-Boot"), stock boot prints "DDR size" but burn never does #148

Booting kernel from Legacy Image at 42080000 ...

Booting kernel from Legacy Image at 42080000 ...

Booting kernel from Legacy Image at 42080000 ...

Loading kernel from FIT Image at 41000000 ...

Loading fdt from FIT Image at 41000000 ...

Loading loadables from FIT Image at 41000000 ...

Loading loadables from FIT Image at 41000000 ...

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

hi3516cv610:20s — bootrom upload fails after DDR training ("Failed to send U-Boot"), stock boot prints "DDR size" but burn never does #148

Description

Activity

packlet commented on Oct 14, 2026

widgetii commented on Oct 24, 2026

packlet commented on Oct 24, 2026

widgetii commented on Oct 25, 2026

widgetii commented on Oct 25, 2026

widgetii commented on Oct 25, 2026

packlet commented on Oct 26, 2026

widgetii commented on Oct 26, 2026

packlet commented on Oct 26, 2026

Booting kernel from Legacy Image at 42080000 ...

snokvist commented on Oct 26, 2026

packlet commented on Oct 26, 2026

widgetii commented on Oct 26, 2026

widgetii commented on Oct 26, 2026

widgetii commented on Oct 26, 2026

snokvist commented on Oct 26, 2026

packlet commented on Oct 27, 2026

Booting kernel from Legacy Image at 42080000 ...

Booting kernel from Legacy Image at 42080000 ...

packlet commented on Oct 27, 2026

Loading kernel from FIT Image at 41000000 ...

Loading fdt from FIT Image at 41000000 ...

Loading loadables from FIT Image at 41000000 ...

Loading loadables from FIT Image at 41000000 ...

widgetii commented on Oct 27, 2026

widgetii commented on Oct 27, 2026

packlet commented on Oct 27, 2026

flyrouter commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions