{"id":48538410,"url":"https://github.com/widgetii/qemu-hisilicon","last_synced_at":"2026-04-08T03:08:30.439Z","repository":{"id":348088756,"uuid":"1194723129","full_name":"widgetii/qemu-hisilicon","owner":"widgetii","description":null,"archived":false,"fork":false,"pushed_at":"2026-03-30T18:00:14.000Z","size":333,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-03-30T20:03:43.091Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/widgetii.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-28T18:19:41.000Z","updated_at":"2026-03-30T18:00:25.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/widgetii/qemu-hisilicon","commit_stats":null,"previous_names":["widgetii/qemu-hisilicon"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/widgetii/qemu-hisilicon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/widgetii%2Fqemu-hisilicon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/widgetii%2Fqemu-hisilicon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/widgetii%2Fqemu-hisilicon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/widgetii%2Fqemu-hisilicon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/widgetii","download_url":"https://codeload.github.com/widgetii/qemu-hisilicon/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/widgetii%2Fqemu-hisilicon/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31537839,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-07T16:28:08.000Z","status":"online","status_checked_at":"2026-04-08T02:00:06.127Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-08T03:08:29.996Z","updated_at":"2026-04-08T03:08:30.433Z","avatar_url":"https://github.com/widgetii.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# QEMU HiSilicon IP Camera SoC Emulator\n\nQEMU machine definitions for HiSilicon IP camera SoCs (V1 through V5 generations),\ntargeting QEMU v10.2.0. Boots unmodified [OpenIPC](https://openipc.org/) firmware\nto a full Linux userspace on all supported platforms.\n\n## Supported Machines (17 total)\n\n| Machine | Generation | CPU | IRQ | Kernel | Boot tested |\n|---------|-----------|-----|-----|--------|-------------|\n| `hi3516cv100` | V1 | ARM926EJ-S | VIC | 3.0.8 | yes |\n| `hi3516cv200` | V2 | ARM926EJ-S | VIC | 4.9.37 | yes |\n| `hi3516av100` | V2A | Cortex-A7 | GIC | 4.9.37 | yes |\n| `hi3516cv300` | V3 | ARM926EJ-S | VIC | 3.18.20 | yes |\n| `hi3516cv500` | V3.5 | Cortex-A7 | GIC | 4.9.37 | yes |\n| `hi3519v101` | V3A | Cortex-A7 | GIC | 3.18.20 | yes |\n| `hi3516ev300` | V4 | Cortex-A7 | GIC | 4.9.37 | yes |\n| `hi3516ev200` | V4 | Cortex-A7 | GIC | — | — |\n| `hi3518ev300` | V4 | Cortex-A7 | GIC | — | — |\n| `hi3516dv200` | V4 | Cortex-A7 | GIC | — | — |\n| `gk7205v200` | V4/Goke | Cortex-A7 | GIC | — | — |\n| `gk7205v300` | V4/Goke | Cortex-A7 | GIC | — | — |\n| `gk7202v300` | V4/Goke | Cortex-A7 | GIC | — | — |\n| `gk7605v100` | V4/Goke | Cortex-A7 | GIC | — | — |\n| `hi3516cv608` | V5 | Cortex-A7 MP2 | GIC | 5.10 | — |\n| `hi3516cv610` | **V5** | Cortex-A7 MP2 | GIC | **5.10** | yes |\n| `hi3516cv613` | V5 | Cortex-A7 MP2 | GIC | 5.10 | — |\n\n### V5 Model Suffix → Chip ID Mapping\n\nFrom datasheet Section 1.2.14 and lab identification:\n\n| Model | Chip | SoC ID | NPU | Max Res | DDR | Package |\n|-------|------|--------|-----|---------|-----|---------|\n| — | Hi3516CV608 | 0x3516C608 | 0.2 TOPS | 3M | DDR2 512Mb | QFN |\n| 10B | Hi3516CV610 | 0x3516C610 | 0.5 TOPS | 5M | DDR2 512Mb | QFN |\n| 20S | Hi3516CV613 | 0x3516C613 | 1 TOPS | 4K | DDR3 1Gb | QFN |\n| 00S | unknown | — | 1 TOPS | 4K | DDR3 1Gb | QFN |\n| 20G | unknown | — | 1 TOPS | 4K | DDR3 1Gb | QFN, GB35114 |\n| 00G | unknown | — | 1 TOPS | 4K | ext DDR3 4Gb | BGA, GB35114 |\n\nipctool also lists Hi3516DV500 (`0x3516D500`) and Hi3519DV500 (`0x3519D500`)\nas `HISI_OT` generation — likely same V5 address map, awaiting SDK/lab confirmation.\n\n## Peripheral Support Matrix\n\n| Peripheral | CV100 | CV200 | AV100 | CV300 | CV500 | 3519V101 | V4 (×8) | **V5 (×3)** |\n|---|---|---|---|---|---|---|---|---|\n| **Flash** | SFC350 | HiFMC | SFC350 | HiFMC | HiFMC | HiFMC | HiFMC | HiFMC |\n| **Ethernet** | FEMAC | FEMAC | — | FEMAC | FEMAC | — | FEMAC | FEMAC |\n| **SD/MMC** | himci×1 | himci×2 | himci×2 | himci×3 | himci×3 | himci×3 | SDHCI×2 | SDHCI×2 |\n| **UARTs** | 3 | 3 | 4 | 3 | 3 | 5 | 3 | 3 |\n| **SPI (PL022)** | — | 2 | 2 | 2 | 3 | 4 | 2 | 2 |\n| **GPIO (PL061)** | 12 | 9 | 15 | 9 | 11 | 17 | 8-10 | 11 |\n| **I2C** | — | 3 | 3 | 2 | 7 | 4 | 3 | 3 |\n| **DMA (PL080)** | yes | yes | — | yes | — | — | — | — |\n| **MIPI RX** | — | — | stub | — | yes | stub | yes | yes |\n| **RTC** | — | — | yes | — | yes | yes | yes | yes |\n| **VEDU/JPGE** | — | — | stub | — | yes | stub | yes | yes |\n| **Watchdog** | yes | yes | yes | yes | yes | yes | yes | yes |\n| **Sensor I2C** | — | — | — | — | — | — | yes | — |\n| **IVE (18 ops)** | — | — | — | — | — | — | **yes** | — |\n| **NPU** | — | — | — | — | — | — | — | stub |\n\nNotes: `stub` = regbank stub only. V5 (×3) = CV608/CV610/CV613 (same die, different feature\ntiers). AV100/3519V101 use GMAC (gigabit) — not emulated, boot without networking.\nIVE = Intelligent Video Engine with 18 operations validated against real IVE silicon.\n\n## Project Structure\n\n```\nqemu/\n├── hw/arm/hisilicon.c           # Machine definitions (all 17 SoCs)\n├── hw/misc/hisi-sysctl.c        # SysCtrl (SoC ID, reset, general registers)\n├── hw/misc/hisi-crg.c           # CRG clock/reset stub\n├── hw/misc/hisi-fmc.c           # HiFMC V100 flash controller (CV200+, flash-file for dumps)\n├── hw/misc/hisi-gzip.c          # Hardware GZIP decompressor (U-Boot hw_compressed)\n├── hw/misc/hisi-sfc350.c        # HISFC350 flash controller (CV100, AV100)\n├── hw/misc/hisi-himci.c         # DW MMC (himciv200) SD/MMC controller\n├── hw/misc/hisi-regbank.c       # Generic RAM-backed register bank\n├── hw/misc/hisi-ive.c           # IVE: 18 ops (SAD, CCL, Sub, Thresh, Erode...)\n├── hw/misc/hisi-fastboot.c      # Boot ROM fastboot serial protocol (defib compat)\n├── hw/misc/hisi-vedu.c          # Video encoder stub (VEDU + JPGE)\n├── hw/misc/hisi-mipi-rx.c       # MIPI RX controller stub\n├── hw/misc/hisi-rtc.c           # SPI-bridge RTC device\n├── hw/net/hisi-femac.c          # Fast Ethernet MAC + MDIO PHY stub\n├── hw/i2c/hisi-i2c.c            # HiBVT I2C controller\n├── hw/i2c/hisi-imx335.c         # IMX335 image sensor I2C device\n├── include/hw/arm/hisilicon.h   # SoC config structure + constants\n└── setup.sh                     # Clone QEMU v10.2.0, copy sources, build\nqemu-boot/\n├── run-cv100.sh                 # Run scripts for each boot-tested platform\n├── run-cv200.sh\n├── run-av100.sh\n├── run-cv300.sh\n├── run-cv500.sh\n├── run-3519v101.sh\n├── run-ev300.sh\n├── run-ev300-flash.sh           # Boot from SPI NOR flash dump (no -kernel needed)\n├── run-cv610.sh\n├── test-ive-init.c              # IVE basic test (hw_id, dma, sad, ccl)\n├── test-ive-ops.c               # IVE operations test for QEMU (register-level)\n├── test-ive-mpi.c               # IVE operations test for real board (MPI API)\n├── test-ive-video-mpi.c         # IVE video processing for real board (MPI API, 352×288)\n├── test-ive.c                   # IVE test (standalone)\n├── test-ive-video.c             # IVE motion detection on video frames (QEMU)\n├── test-ive-abandoned.c         # IVE abandoned object detection (QEMU)\n├── test-fastboot.sh             # End-to-end fastboot test (QEMU + defib)\n└── test-fastboot-protocol.py    # Protocol-level fastboot test (no defib)\ndemo/\n├── generate_scene.py            # Synthetic CCTV scene generator\n├── generate_abandoned.py        # Synthetic abandoned bag scene generator\n├── ive_demo.py                  # Host reference SAD+CCL + visualization\n├── abandoned_demo.py            # Host reference abandoned object + visualization\n└── run_demo.sh                  # End-to-end demo orchestration\ndocs/\n├── ive-registers.md             # IVE register map (from live EV300 capture)\n└── nnie-vs-npu.md               # NNIE vs SVP_NPU architecture comparison\nqemu-src/                        # (generated by setup.sh, not committed)\n```\n\n## Quick Start\n\n```bash\n# Build QEMU\nbash qemu/setup.sh\n```\n\n### Method 1: Boot from flash image (recommended)\n\nThe simplest way to get started. Uses a single binary file — either a pre-built\nfull flash image from [OpenIPC](https://openipc.org/) or a raw dump from a real\nIP camera's SPI NOR flash chip.\n\n```bash\n# Option A: Download a pre-built OpenIPC full flash image\n#   Go to https://openipc.org/cameras/vendors/hisilicon/socs/hi3516ev300\n#   and click \"Download full image\" (8MB NOR, lite)\n#   Save as e.g. openipc-hi3516ev300-lite-8mb.bin\n\n# Option B: Read flash from a real camera using a programmer\n#   flashrom, CH341A, or similar → flash_dump.bin\n\n# Boot (U-Boot and kernel load from flash, just like real hardware)\nbash qemu-boot/run-ev300-flash.sh openipc-hi3516ev300-lite-8mb.bin\n\n# Or with a camera flash dump\nbash qemu-boot/run-ev300-flash.sh /tmp/flash_dump_ev300.bin\n```\n\nThe emulator includes a boot ROM that copies U-Boot from the flash memory\nwindow to DDR and jumps to it — the same boot sequence as real silicon.\nA hardware GZIP decompressor (`hisi-gzip`) handles U-Boot's compressed\nfirst-stage loader. No separate kernel or rootfs files needed.\n\nDefault login: `root` / `12345`\n\n### Method 2: Boot with separate kernel and rootfs\n\nUseful for development when you build kernel and rootfs independently and\nwant to iterate without reflashing.\n\n```bash\n# Download OpenIPC firmware components\ncd qemu-boot\nfor soc in hi3516cv100 hi3516cv200 hi3516av100 hi3516cv300 hi3516cv500 hi3519v101 hi3516ev300; do\n    curl -sL \"https://github.com/OpenIPC/firmware/releases/download/latest/openipc.${soc}-nor-lite.tgz\" \\\n        -o \"openipc.${soc}-nor-lite.tgz\"\n    tar xzf \"openipc.${soc}-nor-lite.tgz\"\ndone\ncd ..\n\n# Boot any platform (pass kernel + rootfs via QEMU -kernel/-initrd)\nbash qemu-boot/run-cv300.sh\nbash qemu-boot/run-ev300.sh\nbash qemu-boot/run-cv500.sh\n# etc.\n```\n\nDefault login: `root` / `12345`\n\n### CV610 Boot (FIT image)\n\nCV610 uses a FIT image (kernel + DTB in one file). Extract components first:\n\n```bash\n# Extract kernel, DTB, and rootfs from firmware\ncd qemu-boot\ndumpimage -T flat_dt -p 0 -o cv610.dtb firmware.bin.hi3516cv610\ndumpimage -T flat_dt -p 1 -o kernel.hi3516cv610 firmware.bin.hi3516cv610\n# rootfs is at offset 0x2A0000 in the firmware blob\ndd if=firmware.bin.hi3516cv610 of=rootfs.squashfs.hi3516cv610 bs=1 skip=$((0x2A0000))\n\n# Boot\nbash run-cv610.sh\n```\n\n## Architecture\n\nThe emulator uses a table-driven design. Each SoC is a `HisiSoCConfig` struct\nwith addresses, IRQs, and peripheral counts. A single `hisilicon_common_init()`\nfunction handles all platforms — adding a new SoC variant requires only a new\nconfig struct and a one-line `DEFINE_HISI_MACHINE()` macro call.\n\n### Memory Map Eras\n\n| Era | SoCs | SysCtrl | UARTs | RAM | IRQ | GIC base |\n|-----|------|---------|-------|-----|-----|----------|\n| V1/V2 (0x20xx) | CV100, CV200 | 0x20050000 | 0x20080000 | 0x80M | VIC | — |\n| V2A (0x20xx+GIC) | AV100 | 0x20050000 | 0x20080000 | 0x80M | GIC | 0x20301000 |\n| V3 (0x12xx) | CV300 | 0x12020000 | 0x12100000 | 0x80M | VIC | — |\n| V3.5 (unique) | CV500 | 0x12020000 | 0x120A0000 | 0x80M | GIC | 0x10301000 |\n| V3A (0x12xx+GIC) | 3519V101 | 0x12020000 | 0x12100000 | 0x80M | GIC | 0x10301000 |\n| V4 (0x12xx) | EV300, Goke | 0x12020000 | 0x12040000 | 0x40M | GIC | 0x10301000 |\n| **V5 (0x11xx)** | **CV610** | **0x11020000** | **0x11040000** | **0x40M** | **GIC** | **0x12401000** |\n\n### Appended DTB Auto-Patching\n\nOpenIPC uImages for DT-based kernels have an appended device tree. The emulator\nautomatically patches it at boot:\n\n- Adds `chosen/stdout-path` for console output\n- Inserts padding for kernel's `atags_to_fdt()` initrd patching\n- Unifies SP804 split clocks (e.g., AV100's 50 MHz/3 MHz → 3 MHz) to prevent timer storms\n- Disables NAND controllers whose register-level polling hangs on stubs\n\nThis runs transparently — unmodified firmware artifacts work as-is.\nCV610 uses a separate DTB file (`-dtb` flag) instead of appended DTB.\n\n## SD Card Emulation\n\n```bash\n# Create a 64 MB image with FAT32\ndd if=/dev/zero of=sdcard.img bs=1M count=64\necho -e \"o\\nn\\np\\n1\\n\\n\\nt\\nc\\nw\\n\" | fdisk sdcard.img\nLOOP=$(sudo losetup --find --show --partscan sdcard.img)\nsudo mkfs.vfat -F 32 -n SDCARD \"${LOOP}p1\"\nsudo losetup -d \"$LOOP\"\n\n# Attach to any platform\nbash qemu-boot/run-ev300.sh -drive file=sdcard.img,if=sd,format=raw\n```\n\n## Ethernet\n\nThe FEMAC device provides a single 8 KiB MMIO region with port, MDIO, and GLB\nregister blocks. An integrated PHY stub at MDIO address 1 reports 100 Mbps\nfull-duplex (PHY ID `0x00446161`). TX uses DMA read + `qemu_send_packet()`;\nRX uses a 64-entry ring buffer with IRQ notification.\n\nRun scripts pass `-nic user` for QEMU's SLIRP networking (NAT to host,\ngateway `10.0.2.2`). PHY link-up takes a few seconds — DHCP may need a retry.\n\nNote: AV100 and 3519V101 use GMAC (gigabit) which is not yet emulated;\nthose SoCs boot without networking.\n\n## IVE (Intelligent Video Engine)\n\nThe IVE device (`hisi-ive`) provides hardware-accelerated image processing\nfor V4 SoCs. Register map reverse-engineered from live EV300 hardware capture\n(554 register changes, see `docs/ive-registers.md`). 18 operations implemented,\nvalidated against real IVE silicon on EV300 board:\n\n| Category | Operations | Status |\n|----------|-----------|--------|\n| Memory | DMA (copy with stride) | ✓ HW verified |\n| Motion detection | SAD (4×4 block diff + threshold), CCL (connected components) | ✓ HW verified |\n| Pixel-wise | Sub, Add (weighted blend), And, Or, Xor | ✓ HW verified |\n| Thresholding | Thresh (binary), Hist (256-bin histogram) | ✓ HW verified |\n| Convolution | Filter (5×5 kernel), Sobel (3×3 edge detection) | ✓ HW verified |\n| Morphology | Dilate (5×5 max), Erode (5×5 min) | ✓ HW verified |\n| Analysis | Integ (integral image), Map (LUT), NCC (cross-correlation) | ✓ verified |\n| Background | GMM2 (Gaussian Mixture Model, stateful per-pixel) | ✓ verified |\n\n### Validation against real hardware\n\nTwo test binaries validate the same algorithms through different paths:\n\n| Test | Platform | Path | Image size |\n|------|----------|------|-----------|\n| `test-ive-mpi` | Real EV300 board | MPI API → libmpi.so → kernel module → IVE silicon | 64×64 |\n| `test-ive-ops` | QEMU | Register writes → hisi-ive.c device | 64×64 |\n\nPer-pixel output values match between real IVE hardware and QEMU emulation:\n```\n            Real HW                    QEMU\nsub:        [18,22,26,30]              [18,22,26,30]       ✓\nand:        [13,0,17,0]                [13,0,17,0]         ✓\nor:         [31,62,63,98]              [31,62,63,98]       ✓\nxor:        [18,62,46,98]              [18,62,46,98]       ✓\nthresh:     [0,0,0,0]                  [0,0,0,0]           ✓\nsobel:      [28,56,56,56]              [28,56,56,56]       ✓\ndilate:     [223,255,255,255]          [223,255,255,255]    ✓\nerode:      [0,0,0,0]                  [0,0,0,0]           ✓\n```\n\n```bash\n# QEMU test (register-level, runs as init in initramfs)\nCC=path/to/arm-openipc-linux-musleabi-gcc\n$CC -static -O2 -o /tmp/init qemu-boot/test-ive-ops.c\nmkdir -p /tmp/ive \u0026\u0026 cp /tmp/init /tmp/ive/init\ncd /tmp/ive \u0026\u0026 find . | cpio -oH newc | gzip \u003e /tmp/ive.gz\nqemu-system-arm -M hi3516ev300 -m 128M \\\n    -kernel qemu-boot/uImage.hi3516ev300 -initrd /tmp/ive.gz \\\n    -nographic -serial mon:stdio \\\n    -append \"console=ttyAMA0,115200 mem=128M root=/dev/ram0 rdinit=/init\"\n\n# Real board test (MPI API, needs SDK libs)\n$CC -o test-ive-mpi qemu-boot/test-ive-mpi.c -I$SDK/include -L$LIBS -lmpi -live ...\n# Upload and run: load_hisilicon -i; killall majestic; ./test-ive-mpi\n```\n\n### Full Hardware Pipeline\n\nThe real board test (`test-ive-video-mpi`) uses a **full hardware pipeline** with\nzero CPU pixel loops. Reads Y4M (YUV4MPEG2 Cmono) or legacy raw .bin files.\nResolution is parsed from the Y4M header — follows Majestic's approach:\n`MD_SIZE(x) = (x/2) \u0026 ~0xF` (half sensor resolution, 16-byte aligned).\n\n| Platform | Binary | IVE path | Notes |\n|----------|--------|----------|-------|\n| Real EV300 board | `test-ive-video-mpi` | MPI API → libmpi.so → kernel module → IVE silicon | Ground truth |\n| QEMU | `test-ive-video` | Register writes → hisi-ive.c device | Emulation |\n| Host | `ive_demo.py` / `abandoned_demo.py` | Python reference + visualization | Demo video |\n\n#### Motion Detection: SAD → CCL (2 IVE ops)\n\n```\nFrame (960×528) → SAD 4×4 blocks → threshold output (240×132) → CCL → blob regions\n```\n\n```bash\n# Convert 1080p source to Majestic-equivalent resolution\nffmpeg -y -i source.mp4 -vf \"scale=960:528,format=gray\" -r 10 \\\n    -pix_fmt gray -f yuv4mpegpipe output.y4m\n\n# Run on real IVE hardware\nssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \\\n    /utils/ive-test/meva-school-vehicles.y4m md'\n# → FRAME 210: (840,316)-(848,328) area=5  ... vehicle motion detected\n```\n\n#### Abandoned Object Detection: 9-step IVE pipeline\n\n```\nFrame → Sub(cur,ref) → Thresh → Erode → Dilate → SAD(mask,zero) → blockify\n     → SAD(cur,prev) → Thresh(invert) → AND(fg,stationary) → CCL → blob regions\n```\n\nCPU only reads the CCL blob struct (~3 KB) per frame — no pixel scanning.\nThe `SAD(mask, zero_image)` trick reduces the full-frame binary mask (960×528)\nto block-level (240×132), staying within CCL's 64-720 pixel size constraint.\n\n```bash\nssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \\\n    /utils/ive-test/meva-abandon-package.y4m abandoned'\n# → FRAME 105: ABANDONED (804,212)-(848,256) area=82 dur=30\n# → ... sustained 70+ frames (package left at bus stop)\n```\n\n#### License Plate Region Detection: 6-step IVE pipeline\n\n```\nFrame → Sobel(vertical) → 16BitTo8Bit(abs) → Thresh → Dilate → Erode → CCL\n                                                                         ↓\n                                               CPU: filter by aspect ratio 2.0-6.0\n```\n\nDetects plate-shaped rectangular regions with dense edges. Evaluated on CCPD\ndataset (100 images): P=0.065, R=0.560, F1=0.116. High recall when it hits\n(median IoU 0.67) but too many false positives from non-plate edge regions.\nNeeds NN assistance for production use (see `docs/ive-applications.md`).\n\n```bash\nssh root@ev300-board 'killall majestic; /utils/ive-test/test-ive-video-mpi \\\n    /utils/ive-test/parking.y4m lpr'\n# → FRAME 1: PLATE (452,500)-(516,520) area=32 ratio=3.2\n```\n\n#### Benchmark: 960×528 on real EV300 IVE silicon\n\n| Component | Motion detection | Abandoned detection | Plate region |\n|-----------|-----------------|-------------------|--------------|\n| **IVE hardware** | **2.4 ms/frame** | **6.7 ms/frame** | **9.1 ms/frame** |\n| CPU (blob parse) | 0.0 ms/frame | 0.1 ms/frame | 0.2 ms/frame |\n| I/O (NFS read) | 40.8 ms/frame | 9.9 ms/frame | 33.3 ms/frame |\n| **IVE capacity** | **416 fps** | **149 fps** | **110 fps** |\n| Total (with NFS) | 23 fps | 60 fps | 24 fps |\n\nIn a real camera, VPSS feeds frames via DMA (zero I/O overhead), so the IVE\npipeline easily exceeds the 10 fps target. NFS is the bottleneck in the test setup.\n\n### Quantitative Evaluation (MEVA + VIRAT Ground Truth)\n\nEvaluated on **3132 motion events** and **131 abandoned-object events** from the\n[MEVA](https://mevadata.org/) (CC BY 4.0) and [VIRAT Ground 2.0](https://viratdata.org/)\ndatasets. All processing on **real EV300 IVE silicon** at Majestic-equivalent resolution\n(960×528 for 1080p, 640×352 for 720p sources).\n\n#### Event-level metrics\n\n| Algorithm | Precision | Recall | F1 | Events | Dataset |\n|-----------|-----------|--------|------|--------|---------|\n| **Motion detection** | **0.998** | **1.000** | **0.999** | 3132 | MEVA+VIRAT |\n| **Abandoned object** | **0.361** | **0.673** | **0.470** | 131 | MEVA+VIRAT |\n| **Plate region** | **0.065** | **0.560** | **0.116** | 100 | CCPD |\n\n**Motion detection** is near-perfect: all motion events detected (vehicles, people\nwalking, carrying objects) with only 6 false alarms across 3132 test events.\n\n**Abandoned object detection** catches 67% of events (bags, packages, unloaded objects)\nbut has false positives from stationary scene elements (parked cars, furniture) that\ndiffer from the learned reference background. Threshold sweep (diff_thr 30-60,\nsad_thr 100-300, area_thr 4-16) confirmed this is an inherent limitation of\nbackground subtraction — the algorithm cannot distinguish \"newly abandoned bag\" from\n\"car that was parked during reference learning.\" Production-grade precision requires\nowner-object tracking or semantic classification (see `docs/ive-applications.md`).\n\n**Plate region detection** has decent recall (56%) but very low precision (6.5%) —\nedge-based detection cannot distinguish plates from bumpers, signs, and window frames.\nNeeds neural network assistance for production use.\n\n#### Dataset composition\n\nSources: MEVA examples (121 pre-trimmed 1080p clips) + VIRAT Ground 2.0 (83 HD clips).\nActivities used as ground truth:\n\n| Eval task | Positives | Negatives | Activity types |\n|-----------|-----------|-----------|---------------|\n| Motion | 3126 events | 6 static clips | walking, vehicle_moving, carrying, riding, ... |\n| Abandoned | 52 events | 79 clips | Abandon_Package, SetDown, Unloading, Drop |\n\n```bash\n# Reproduce evaluation\npython3 scripts/eval_download_virat.py       # download VIRAT videos (~18 GB)\npython3 scripts/eval_build_dataset.py        # convert to Y4M\nbash scripts/eval_run_ive.sh both            # run on real EV300 board\npython3 scripts/eval_metrics.py              # compute P/R/F1\n```\n\nSee `docs/meva-dataset-spec.md` for dataset structure, annotation format, and\nevaluation methodology.\n\nSee `docs/ive-applications.md` for a roadmap of 9 CV applications\n(tamper detection, line crossing, zone intrusion, loitering, etc.)\nthat can be built with the existing IVE operations.\n\n## Fastboot Protocol (Serial Boot ROM Emulation)\n\nWhen QEMU is started **without** `-kernel`, the machine emulates the HiSilicon\nboot ROM serial download protocol. The [defib](https://github.com/OpenIPC/defib)\ntool can then load firmware over UART — the same way real hardware is recovered.\n\n```bash\n# Terminal 1: start QEMU in fastboot mode (no -kernel)\nqemu-system-arm -M hi3516ev300 -m 64M -nographic \\\n    -chardev socket,id=ser0,path=/tmp/qemu-hisi.sock,server=on,wait=off \\\n    -serial chardev:ser0\n\n# Terminal 2: load firmware via defib\ndefib burn -c hi3516ev300 -p socket:///tmp/qemu-hisi.sock\n```\n\nDefib auto-downloads OpenIPC U-Boot for the chip. To use a local file:\n\n```bash\ndefib burn -c hi3516ev300 -p socket:///tmp/qemu-hisi.sock -f u-boot.bin\n```\n\nThe protocol implements three sequential transfers (DDR init → SPL → U-Boot)\nwith CRC-16/CCITT validation on every frame. After the final transfer, QEMU\nhands the serial port to a PL011 UART and starts the CPU at the U-Boot entry\npoint — U-Boot output appears on the same connection.\n\nSupported chips: all Standard protocol SoCs (Hi3516CV300, Hi3516EV200/EV300,\nHi3518EV300, GK7205V200/V300, and others). V500 and CV6xx protocols are not\nyet implemented.\n\n### Automated test\n\n```bash\n# Protocol-level test (no defib needed)\nqemu-system-arm -M hi3516ev300 -m 64M -display none -monitor none \\\n    -chardev socket,id=ser0,path=/tmp/hisi-fb,server=on,wait=on \\\n    -serial chardev:ser0 -d unimp \u0026\npython3 qemu-boot/test-fastboot-protocol.py /tmp/hisi-fb\n\n# End-to-end test with defib\nbash qemu-boot/test-fastboot.sh\n```\n\n## References\n\n- OpenIPC firmware: https://github.com/openipc/firmware\n- ipctool: https://github.com/openipc/ipctool\n- SDK device trees:\n  - CV100: `Hi3518_SDK_V1.0.B.0/.../mach-hi3518/`\n  - CV200: `Hi3518E_SDK_V1.0.4.0/.../hi3518ev20x.dtsi`\n  - AV100: `Hi3516A_SDK_V1.0.8.0/.../hi3516a.dtsi`\n  - CV300: `Hi3516CV300_SDK_V1.0.4.0/.../hi3516cv300.dtsi`\n  - CV500: `Hi3516CV500_SDK_V2.0.2.1/.../hi3516cv500.dtsi`\n  - 3519V101: `Hi3519V101_SDK_V1.0.5.0/...patch (hi3519v101.dtsi)`\n  - EV300: `Hi3516EV200_SDK_V1.0.1.2/.../hi3516ev300.dtsi`\n  - CV610: `Hi3516CV610R001C01SPC020/...tgz (hi3516cv610.dtsi)`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwidgetii%2Fqemu-hisilicon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwidgetii%2Fqemu-hisilicon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwidgetii%2Fqemu-hisilicon/lists"}