diff --git a/en/device-IPC-RM1-BLK7202V3-M43A-WIFI.md b/en/device-IPC-RM1-BLK7202V3-M43A-WIFI.md
index 6c476719..c32aa0eb 100644
--- a/en/device-IPC-RM1-BLK7202V3-M43A-WIFI.md
+++ b/en/device-IPC-RM1-BLK7202V3-M43A-WIFI.md
@@ -147,7 +147,7 @@ curl -v -u user:pass -H "Content-Type: application/json" -X POST --data-binary @
# Flashing
Stock firmware is pwd locked and LAN interface does not present, so I'm guessing following methods are available to flash this board:
-- [burn](https://github.com/OpenIPC/burn) + [u-boot-gk7202v300-universal.bin](https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-gk7202v300-universal.bin) and then upload FW via X/Y/ZMODEM (e.g. **loady**. Tip: use **baud** option for speed up) or from SD card (power supply required, [see above](#SD-Card))
+- [defib](https://github.com/OpenIPC/defib) (start `defib burn -c gk7202v300 -p /dev/ttyUSB0 -b -t`, then power the camera on; it loads [u-boot-gk7202v300-nor.bin](https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-gk7202v300-nor.bin)) and then upload FW via X/Y/ZMODEM (e.g. **loady**. Tip: use **baud** option for speed up) or from SD card (power supply required, [see above](#SD-Card))
- load full image thru stock web interface (untested)
- flash programmer
- somehow get into stock bootloader
diff --git a/en/fpv.md b/en/fpv.md
index 04a3a3af..0c383c34 100644
--- a/en/fpv.md
+++ b/en/fpv.md
@@ -135,17 +135,20 @@ When working with a hot air soldering gun it is desirable to remove the lens and
-* Fill [U-Boot](https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-gk7205v200-universal.bin) into a new 16 megabyte flash (at the beginning of the memory) and solder it to the board. Verify that U-Boot starts and you get to the prompt.
+* Fill [U-Boot](https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-gk7205v200-nor.bin) into a new 16 megabyte flash (at the beginning of the memory) and solder it to the board. Verify that U-Boot starts and you get to the prompt.
* On the workstation, install a TFTP server, download and unzip to the [archive](https://github.com/OpenIPC/firmware/releases/download/latest/openipc.gk7205v200-nor-fpv.tgz) directory with the FPV firmware
* Give commands in U-Boot (where `192.168.1.17` is your TFTP server and `192.168.1.33` is the temporarily assigned address to the camera):
```
setenv ipaddr 192.168.1.33; setenv serverip 192.168.1.17; saveenv
- run setnor16m
- #
- run uknor16m; run urnor16m
+ run ur; run uk
+ reset
```
+ This U-Boot finds the flash layout itself: `run ur` writes the root
+ filesystem first, and a rootfs over 5 MiB selects the 16 MB slots, then
+ `run uk` writes the kernel (see the note further down).
+
### Installation on the camera (general finalization)
* After booting the system, verify that it has obtained an IP address via Ethernet (it can be accessed via SSH as root@; a camera that has not been set up yet has no password and asks you to choose one before handing over a shell). Using a modern operating system and the name `openipc.local` you can find the camera within the local network without knowing its IP address.
@@ -245,35 +248,40 @@ You can see that QGS is also already displaying video. The delay in 4.0.11 is qu

-### Pour the image onto an empty flash using burn (if you don't have a programmer)
+### Pour the image onto an empty flash using defib (if you don't have a programmer)
-Run [burn](https://github.com/OpenIPC/burn) with the board turned off:
+Start [defib](https://github.com/OpenIPC/defib) with the board turned off, then
+power the board on. defib downloads `u-boot-gk7205v200-nor.bin`, loads it into
+RAM, stops its autoboot (`-b`) and opens the console (`-t`):
```
-./burn --chip gk7205v200 --file=u-boot-gk7205v200-universal.bin -d ; screen -L /dev/ttyUSB0 115200
+defib burn -c gk7205v200 -p /dev/ttyUSB0 -b -t
```
-turn on the board power and wait for U-Boot to be filled and the command line to appear. Then we execute the following commands, where `192.168.0.8` is the TFTP server address and `192.168.0.200` is the temporary IP address of the camera.
+Wait for the U-Boot command line to appear. Then we execute the following commands, where `192.168.0.8` is the TFTP server address and `192.168.0.200` is the temporary IP address of the camera.
```
setenv ipaddr 192.168.0.200
setenv serverip 192.168.0.8
sf probe 0; sf lock 0
-mw.b 0x42000000 ff 1000000; tftpboot 0x42000000 u-boot-gk7205v200-universal.bin; sf probe 0
+mw.b 0x42000000 ff 1000000; tftpboot 0x42000000 u-boot-gk7205v200-nor.bin; sf probe 0
sf erase 0x0 0x50000; sf write 0x42000000 0x0 ${filesize}
reset
-run setnor16m
-
setenv ipaddr 192.168.0.200
setenv serverip 192.168.0.8
-run uknor16m ; run urnor16m
+run ur ; run uk
saveenv
reset
```
+`run ur` writes `rootfs.squashfs.gk7205v200` first: a rootfs over 5 MiB selects
+the 16 MB slots (kernel 3 MiB at `0x50000`, rootfs 10 MiB at `0x350000`), and
+`run uk` then writes `uImage.gk7205v200`. This U-Boot finds the layout on the
+flash at every boot, so there is no `setnor16m` to run.
+
### Further refinements
#### Development of the adapter board
diff --git a/en/nor-split-layout.md b/en/nor-split-layout.md
index 45cf9e5b..54210b45 100644
--- a/en/nor-split-layout.md
+++ b/en/nor-split-layout.md
@@ -16,6 +16,7 @@ and only their sum has to fit the chip. These SoCs use it:
| SoC | Boot area | Firmware from | Bootloader | Packages |
|-----|-----------|---------------|------------|----------|
| GK7205V200, GK7205V300, GK7202V300, GK7605V100 | 256K boot + 64K env | `0x50000` | `u-boot--nor.bin` | `-split` and the fixed-slot one |
+| Hi3516CV300, Hi3516EV100 | 256K boot + 64K env | `0x50000` | `u-boot--nor.bin` | `-split` and the fixed-slot one |
| Hi3516CV610, Hi3516CV608 | 256K boot + 64K env | `0x50000` | `boot-[-]-nor.bin` | `-split` only |
| Hi3519DV500 | 512K boot + 256K env | `0xC0000` | `boot-hi3519dv500--nor.bin` | `-split` only |
@@ -281,11 +282,19 @@ The same goes for a vendor U-Boot on Hi3516CV6xx or Hi3519DV500, as long as it
reads the kernel from the firmware offset: 2 MiB from `0x50000`, or 6 MiB from
`0xc0000` on Hi3519DV500. Its boot image has to match the board's DDR, as above.
+On Hi3516CV300 and Hi3516EV100 the older OpenIPC U-Boot 2010.06
+(`u-boot--universal.bin`) boots the split image unchanged: its `bootcmdnor`
+reads 3 MiB from `0x50000`, and the kernel ignores the `root=` and the fixed
+`mtdparts=` it passes. A Hi3516CV300 board with that U-Boot and its 16 MB
+`mtdparts` booted `firmware.bin` from `0x50000` this way. For the scan, `fwupd`
+and SD/USB recovery, install `u-boot--nor.bin` (U-Boot 2022.10).
+
### Going back to fixed slots
On the GK7205V200 family: write `uImage.` at `0x50000` and
`rootfs.squashfs.` at the fixed rootfs slot, as in
[Upgrade firmware](sysupgrade.md) (*From U-Boot*). On a U-Boot environment from
this bootloader, `run ur; run uk` does the same. The bootloader sees the uImage
-at `0x50000` and boots the fixed slots again. Hi3516CV6xx and Hi3519DV500 are
-built only for the split layout.
+at `0x50000` and boots the fixed slots again. Hi3516CV300 and Hi3516EV100 go
+back the same way. Hi3516CV6xx and Hi3519DV500 are built only for the split
+layout.
diff --git a/en/sysupgrade.md b/en/sysupgrade.md
index 70a5fa07..1a6f574e 100644
--- a/en/sysupgrade.md
+++ b/en/sysupgrade.md
@@ -21,8 +21,10 @@ There are other options available so you can use a local copy of the Linux kerne
__ATTENTION! Upgrading firmware can lead to "bricking" your camera. Make sure you are prepared both morally and skill wise. Have your rescue SD card and/or UART adapter ready. Be prepared to de-solder and reprogram flash chip as the last resort. Do not upgrade production cameras unless you really have to!__
On GK7205V200, GK7205V300, GK7202V300 and GK7605V100 with the OpenIPC
-`u-boot--nor.bin` bootloader, and on Hi3516CV610, Hi3516CV608 and
-Hi3519DV500, `sysupgrade -k -r` installs the
+`u-boot--nor.bin` bootloader, on Hi3516CV300 and Hi3516EV100 (with that
+bootloader or the older OpenIPC U-Boot 2010.06, which boots the split image as
+well), and on Hi3516CV610, Hi3516CV608 and Hi3519DV500, `sysupgrade -k -r`
+installs the
[NOR split layout](nor-split-layout.md) from `openipc.-nor--split.tgz`
and carries your settings across (Hi3516CV610 and Hi3516CV608 share one package,
`openipc.hi3516cv6xx-nor--split.tgz`). The offsets in *From U-Boot* below