Skip to content

nor: split layout on the hi3516cv500 family, hi3536dv100 and hi3516av100/dv100; sf on HiSFC350 - #62

Merged
widgetii merged 5 commits into
openipc-hisiliconfrom
nor/split-round2
Oct 24, 2026
Merged

widgetii merged 5 commits into
openipc-hisiliconfrom
nor/split-round2

Conversation

@widgetii

Copy link
Copy Markdown
Member

Four commits.

1. cmd: sf builds on the HiSFC350 boards fixes a bug unrelated to the split layout. CMD_SF depended on DM_SPI_FLASH || SPI_FLASH || FMC_SPI_NOR, but not HISFC350_SPI_NOR. So olddefconfig drops the CMD_SF=y from openipc_config on every HiSFC350 board: hi3516av100, hi3516dv100, hi3516cv100, hi3518av100, hi3518cv100, hi3518ev100, hi3515av100, hi3520av100, hi3520dv100 and hi3520dv200.

  • Their u-boot-<soc>-nor.bin has no sf. The env still loads and the layout scan still finds the kernel, because both call the spi_flash API directly. But bootcmd's sf probe; sf read fails, bootm finds no image, and the board resets until the boot limit leaves it at the prompt.
  • In qemu-hisilicon, the published u-boot-hi3516av100-nor.bin (b1e0950) does exactly that, even on a fixed-slot image.
  • The HiSFC350 driver provides the spi_flash_probe() and ops cmd/sf.c calls, so sf builds against it unchanged.

2–4. CONFIG_OPENIPC_NOR_SPLIT for families whose kernels now find the split layout from their device tree. Each board's misc_init_r() now sets verify=n before openipc_helper(), as #52 and #61 did. Fixed-slot cameras boot as before, and the NAND builds compile the split code out.

SoCs configs kernel
hi3516cv500, hi3516dv300, hi3516av300 hi3516cv500_config, hi3516dv300_config, hi3516av300_config OpenIPC/linux#142
hi3536dv100 hi3536dv100_config OpenIPC/linux#143
hi3516av100, hi3516dv100 hi3516av100_config, hi3516dv100_config OpenIPC/linux#144

NOR images, all inside the 256K boot area: cv500 205144, dv300/av300 205328, 36dv100 144216, av100/dv100 126236 bytes.

Tested in qemu-hisilicon with each family's lite build on its new kernel. hi3516cv500 runs on 16 MB flash, the other two on 8 MB.

Case hi3516cv500 hi3536dv100 hi3516av100
split image: scan, root-less command line, kernel's split yes, root on 31:4, login yes, root on 31:4, login yes, rootfs (mtd4) set as root
fixed-slot package fixed mtdparts, root on 31:3 same fixed mtdparts, mtd3 set as root
fwupd over TFTP from fixed slots byte-identical, boots split same same
damaged kernel → fails its CRC → recovery byte-identical, boots split same same

On hi3516av100, qemu-hisilicon's model stops the boot after the MTD probe, before root is mounted. It does that on either layout, and with the kernel OpenIPC ships today too. Not run on hardware.

CONFIG_OPENIPC_NOR_SPLIT for hi3516cv500, hi3516dv300 and hi3516av300,
whose kernel (OpenIPC/linux hisilicon-hi3516cv500) finds the split layout
from its device tree. misc_init_r() sets verify=n before
openipc_helper(). The NAND builds compile the split code out.

NOR images 205136-205316 bytes; NAND images build as before.
CONFIG_OPENIPC_NOR_SPLIT for hi3536dv100, whose kernel (OpenIPC/linux
hisilicon-hi3536dv100) finds the split layout from its device tree.
misc_init_r() sets verify=n before openipc_helper().

NOR image: u-boot-hi3536dv100-nor.bin 144304 bytes.
CONFIG_OPENIPC_NOR_SPLIT for hi3516av100 and hi3516dv100, whose kernel
(OpenIPC/linux hisilicon-hi3516av100) finds the split layout from its
device tree. misc_init_r() sets verify=n before openipc_helper().
CMD_SF depended on DM_SPI_FLASH, SPI_FLASH or FMC_SPI_NOR, not on
HISFC350_SPI_NOR. openipc_config sets CMD_SF=y, but olddefconfig drops it
on every board whose flash controller is the HiSFC350: hi3516av100,
hi3516dv100, hi3516cv100, hi3518av100, hi3518cv100, hi3518ev100,
hi3515av100, hi3520av100, hi3520dv100 and hi3520dv200. Their
u-boot-<soc>-nor.bin then has no sf command. The environment still loads
and the layout scan still finds the kernel (both call the spi_flash API
directly), but bootcmd's "sf probe; sf read" fails ("Unknown command
'sf'"), bootm finds no image, and the board resets until the boot limit
leaves it at the prompt. The published hi3516av100 image (b1e0950) does
exactly that in qemu-hisilicon, on a fixed-slot image too.

The HiSFC350 driver provides spi_flash_probe() and the spi_flash ops that
cmd/sf.c calls, so sf builds against it unchanged.

Tested: hi3516av100 builds with CONFIG_CMD_SF=y (u-boot-hi3516av100-nor.bin
126152 bytes, inside the 256K boot area). In qemu-hisilicon (hi3516av100,
8 MB) bootcmd now reads the kernel and boots it, from fixed slots and from
the split layout, and fwupd's sf erase/write recovers a fixed-slot or
damaged install (byte-identical on flash). Not run on hardware.
@qodo-free-for-open-source-projects

Copy link
Copy Markdown

PR Summary by Qodo

Enable split NOR layouts on six HiSilicon boards and restore HiSFC350 sf

✨ Enhancement 🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

Grey Divider

AI Description

• Enable split NOR detection on six boards whose kernels derive partitions from their device trees.
• Preserve fixed-slot boot behavior while enabling CRC verification for split images.
• Restore the sf command on HiSFC350 boards so boot commands can read flash.
Diagram

graph TD
  Config["Board configs"] --> Init["Board initialization"] --> Layout{"NOR layout"} --> Split["Split image"] --> DT["Kernel device tree"]
  Layout --> Fixed["Fixed slots"]
  Command["CMD_SF dependency"] --> Driver["HiSFC350 driver"]
Loading
High-Level Assessment

The per-board opt-in matches the kernels that support split partitions without changing other boards or NAND behavior. Reordering initialization uses the existing scan, and extending CMD_SF's dependency directly addresses the missing command; a global layout change or new flash-command implementation would add unnecessary risk.

Files changed (12) +35 / -6

Enhancement (5) +10 / -5
board.cSet verification default before the av100 layout scan +2/-1

Set verification default before the av100 layout scan

• Moves verify=n ahead of openipc_helper() so the scan can clear it for split images and retain it for fixed-slot images.

board/hisilicon/hi3516av100/board.c

hi3516av300.cSet verification default before the av300 layout scan +2/-1

Set verification default before the av300 layout scan

• Moves verify=n ahead of openipc_helper(), allowing split-image CRC checks without changing the fixed-slot default.

board/hisilicon/hi3516av300/hi3516av300.c

hi3516cv500.cSet verification default before the cv500 layout scan +2/-1

Set verification default before the cv500 layout scan

• Moves verify=n ahead of openipc_helper(), allowing the split-image path to enable CRC verification.

board/hisilicon/hi3516cv500/hi3516cv500.c

hi3516dv300.cSet verification default before the dv300 layout scan +2/-1

Set verification default before the dv300 layout scan

• Moves verify=n ahead of openipc_helper() so split-image handling can clear the setting before boot.

board/hisilicon/hi3516dv300/hi3516dv300.c

board.cSet verification default before the dv100 layout scan +2/-1

Set verification default before the dv100 layout scan

• Moves verify=n ahead of openipc_helper(), preserving the fixed-slot default while permitting split-image verification.

board/hisilicon/hi3536dv100/board.c

Bug fix (1) +1 / -1
KconfigAllow sf with HiSFC350 SPI NOR +1/-1

Allow sf with HiSFC350 SPI NOR

• Adds HISFC350_SPI_NOR to CMD_SF's dependencies. This prevents olddefconfig from dropping an explicitly enabled sf command on HiSFC350 boards.

cmd/Kconfig

Other (6) +24 / -0
hi3516av100_configEnable split NOR handling for hi3516av100 +4/-0

Enable split NOR handling for hi3516av100

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for kernels that partition firmware using their device tree.

openipc/hi3516av100_config

hi3516av300_configEnable split NOR handling for hi3516av300 +4/-0

Enable split NOR handling for hi3516av300

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for the hi3516cv500-family kernel layout.

openipc/hi3516av300_config

hi3516cv500_configEnable split NOR handling for hi3516cv500 +4/-0

Enable split NOR handling for hi3516cv500

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for its kernel's device-tree-driven firmware partitions.

openipc/hi3516cv500_config

hi3516dv100_configEnable split NOR handling for hi3516dv100 +4/-0

Enable split NOR handling for hi3516dv100

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for the hi3516av100-family kernel layout.

openipc/hi3516dv100_config

hi3516dv300_configEnable split NOR handling for hi3516dv300 +4/-0

Enable split NOR handling for hi3516dv300

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for the hi3516cv500-family kernel layout.

openipc/hi3516dv300_config

hi3536dv100_configEnable split NOR handling for hi3536dv100 +4/-0

Enable split NOR handling for hi3536dv100

• Opts the board into CONFIG_OPENIPC_NOR_SPLIT for its kernel's device-tree-driven firmware partitions.

openipc/hi3536dv100_config

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Remediation recommended

1. Recovery scripts cannot flash full images ✓ Resolved
Description
Enabling the split update command makes fwwrite require ${fwsize}, but firmware_scan()
initializes that value only after openipc_helper() has executed recovery scripts. On any of the
six newly enabled NOR boards with a fresh environment, a script.txt that runs fwupd and
downloads a whole-firmware image reaches the size guard without fwsize, so the erase and write
commands do not run.
Code

openipc/hi3516cv500_config[23]

+CONFIG_OPENIPC_NOR_SPLIT=y
Evidence
All six added split configurations select the fwupd and fwwrite definitions that test
${fwsize}. Recovery gives script.txt precedence and executes it before the only normal
assignment of fwsize in the subsequent scan; with a fresh environment, the guard prevents
flashing.

openipc/hi3516cv500_config[20-23]
openipc/hi3516av100_config[46-49]
openipc/hi3536dv100_config[39-42]
include/configs/openipc-common.h[204-222]
common/openipc.c[533-568]
common/openipc.c[576-583]
common/openipc.c[819-829]
common/openipc.c[1084-1113]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
On newly enabled split-NOR boards, recovery `script.txt` may run `fwupd` before `firmware_scan()` sets `fwsize`, preventing whole-image flashing.
## Fix Focus Areas
- common/openipc.c[1084-1113]
- common/openipc.c[819-829]
- include/configs/openipc-common.h[204-222]
## Recommended Fix
Make the split whole-image update command usable during removable-media recovery by deriving and setting a valid firmware-area size from the probed flash and firmware start before executing recovery scripts. Preserve the existing post-recovery layout scan and its RAM-only updates.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Tip of the day
💡 Did you know, you can choose which labels appear on a finding, and whether they show icons or text

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread openipc/hi3516cv500_config
From review: fwwrite writes only a file that fits ${fwsize}, the firmware
area from kernaddr to the end of the chip, and only the layout scan set
it. Removable-media recovery runs before the scan, so on a fresh
environment a script.txt that loads firmware.bin and runs fwwrite found
no fwsize and wrote nothing ("do not fit"). openipc_helper() now sets
fwsize from the probed flash before recovery, and the scan sets it again
from what it finds. Every split board's NOR build gets it; NAND and
fixed-only builds compile it out.

Tested in qemu-hisilicon (hi3516cv500, 16 MB, fixed-slot install, fresh
environment) with an SD card holding a script.txt that runs "fatload mmc
0 ${baseaddr} firmware.bin.hi3516cv500; run fwwrite": the script sees
fwsize=0xfb0000, fwwrite erases from 0x50000 to the end and writes the
image (byte-identical on flash), and the camera boots the split layout,
root on 31:4, login. Builds for hi3516cv500, hi3516av100, hi3516ev300 and
gk7205v500 with no new warnings. Not run on hardware.
@widgetii
widgetii merged commit 5cd9f58 into openipc-hisilicon Oct 24, 2026
74 checks passed
widgetii added a commit to OpenIPC/wiki that referenced this pull request Oct 24, 2026
…image

From review: the older u-boot-<soc>-universal.bin (2010.06) that these
cameras run loads the split image's kernel, which takes the device tree's
layout over the fixed-slot mtdparts it is given (checked in qemu-hisilicon,
hi3516av100). An -nor.bin from before OpenIPC/u-boot#62 boots nothing, so
no camera runs it to upgrade from.
widgetii added a commit to OpenIPC/wiki that referenced this pull request Oct 24, 2026
…mily (#622)

* nor-split: the Hi3516CV500 family, Hi3536DV100 and the Hi3516AV100 family

They ship the split package beside the fixed-slot one since
OpenIPC/firmware#2669, on OpenIPC/linux#142, #143 and #144 and
OpenIPC/u-boot#62. The Hi3516AV100 family's u-boot-<soc>-nor.bin boots
only from #62 on: earlier builds had no sf command, so their bootcmd
could not read the kernel. sysupgrade -k -r takes the split package on
them, and they go back to fixed slots the same way.

Checked in qemu-hisilicon (hi3516cv500 16 MB, hi3536dv100 and hi3516av100
8 MB). Not run on hardware.

* nor-split: the Hi3516AV100 family's universal U-Boot boots the split image

From review: the older u-boot-<soc>-universal.bin (2010.06) that these
cameras run loads the split image's kernel, which takes the device tree's
layout over the fixed-slot mtdparts it is given (checked in qemu-hisilicon,
hi3516av100). An -nor.bin from before OpenIPC/u-boot#62 boots nothing, so
no camera runs it to upgrade from.
widgetii added a commit that referenced this pull request Oct 27, 2026
* nor: split layout on the GK710x

The GK7101, GK7101S, GK7102 and GK7102S kernels register the split NOR
layout from the images themselves since OpenIPC/linux#152
(goke-gk710x), and OpenIPC/firmware#2692 ships gk7102 and gk7102s
split packages. This U-Boot booted them only because it loads the
kernel from 0x50000; it had no split scan, fwupd or recovery for them.

- common/openipc.c as on openipc-hisilicon now: the split scan, the
  kernel CRC check that sends a damaged split kernel to recovery (#56),
  fwsize set before recovery (#62), verify dropped for recovery only,
  the saved-environment migrations. One change: the fallback kernel
  offset is OPENIPC_KERNADDR, which both branches define, rather than
  CONFIG_ENV_KERNADDR, an ad-hoc CONFIG_ this branch's check-config
  refuses (openipc-hisilicon turned that check off).
- common/Kconfig: OPENIPC_NOR_SPLIT, enabled in the four gk710x configs.
- openipc-common.h: with it, fwupd takes firmware.bin.<soc> when the
  server has one and writes it over the whole firmware area (fwwrite
  refuses a file that does not fit), else the fixed-slot pair as before;
  the legacy fwupd is this branch's "run mtdslite; run ur; run uk".
  OPENIPC_FW_FILE was "firmware.${soc}", never used until now and naming
  no file any package carries; it is now "firmware.bin." CONFIG_PRODUCT_SOC,
  spelled out at build time as urfile is, since U-Boot does not expand
  a variable inside another's value.

Tested in qemu-hisilicon (gk7102, 8 MB, 64 MB RAM; the flash
byte-swapped as the controller stores it) with a gk7102_lite build on
the split kernel (firmware.bin 5248K):
- split image: "Found Kernel at 0x00050000", "Found RootFS at
  0x001b0000", the kernel's split layout, root on 31:4; a second boot
  reads the seed the first saved in the overlay;
- fixed slots: found at 0x250000, 6 cmdlinepart partitions, root on 31:3;
- fwupd over TFTP from fixed slots: firmware.bin.gk7102 fetched, the
  firmware area erased and written, the split layout booted;
- a split kernel with one byte flipped: "fails its CRC", recovery fetches
  and writes firmware.bin.gk7102, the split layout booted;
- after both, the flash at 0x50000 is byte-identical to firmware.bin.
Built for gk7101, gk7101s, gk7102 and gk7102s; only gk7102 run. Not run
on hardware.

* nor: an oversized firmware file falls back to the fixed-slot pair

fwupd took the firmware file whenever the download succeeded, and
fwwrite then refused one larger than the firmware area and wrote
nothing: recovery reset and fetched the same file again. fwupd now runs
fwwrite only for a file that downloaded and fits (0 < filesize <=
fwsize), and otherwise installs the fixed-slot pair, as for a missing
file.

qemu-hisilicon (gk7102): a 9 MB firmware.bin.gk7102 beside the pair on
the server -> the pair written at 0x250000 and 0x50000, fixed slots
booted (root on 31:3); a firmware.bin that fits -> written at 0x50000,
the split layout booted (root on 31:4).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant