MCU in RV1106G3

[PJ5168]

There is a MCU in the RV1106. Is there a way to leverage it?
Like SG2002, the big core runs Linux, the small core runs RTOS, and can load code to the 300Mhz 8051 MCU inside.

[luyi1888]

If you are interested in MCU, try this
https://github.com/luyi1888/rv1106-mcu
I have upload a blinky firmware. The RK3566 AMP SDK have RV1106 MCU support.
But please consider it is not usable.
Develop MCU firmware by user is not supported by rockchip. I'm also not figure out a way to connect mcu JTAG.

[PJ5168]

Excellent! I did not notice that there is a MCU inside the RK3566. Check the spec again, it does have the MCU you mentioned.
That's great! I have RK3566, 3588S, and 3588 as well. Refer to the following link, seems that it's possible to leverage the 3566 package!? Thanks!
https://github.com/liamhays/rk3566-mcu.git
https://github.com/liamhays/rk3566-mcu/blob/main/rk3566_mcu_notes.md
https://xpack.github.io/dev-tools/riscv-none-elf-gcc/
BTW, what is this MCU for? And seceret hacking backdoor? Ha~

[luyi1888]

You can check SDK's rkbin folder. They provided RV1106 MCU firmware for camera early initialization. They called it "Thunder Boot"
https://github.com/rockchip-linux/rkbin/tree/master/bin/rv11

For RV3568, I don't known any usage.
According to datasheet, RV3568 has the weakest MCU. It doesn't have cache. It is huge performance difference with/without cache.

[vjoco]

is it possible that the same MCU core is inside RV1103 too??? , in this image is there:

[luckfox-eng33]

is it possible that the same MCU core is inside RV1103 too??? , in this image is there:

same

[luckfox-eng33]

rk does provide some bins but does not provide other technical support or compilation methods.

[luyi1888]

rk does provide some bins but does not provide other technical support or compilation methods.

@luckfox-eng33

Could you help to connect MCU JTAG? The JTAG access is enough for hobby project. The toolchain which they used is not a secret truly. I have try several methods to access JTAG already. But it is not respond. Maybe they disabled in OTP. So we will never get JTAG.

1. Do you have J-LINK v10+? Which support cJTAG. Can you try to access MCU? I use my own cJTAG adapter, But It is not try on any other chip yet. Maybe I'm not implemented cJTAG in right.
2. Could you check on "RV1106 Hardware Design Guide"? They will specify the type of JTAG protocol. They will also tell you JTAG is open or not for customer.
   In RK3399,They listed in Chapter3 Schematic Design -> 3.1Minimum System Design -> 3.1.5 JTAG Debug Interface
3. Could you check on Rockchip redmine? Maybe JTAG documents in here.

[luckfox-eng33]

rk does provide some bins but does not provide other technical support or compilation methods.

@luckfox-eng33

Could you help to connect MCU JTAG? The JTAG access is enough for hobby project. The toolchain which they used is not a secret truly. I have try several methods to access JTAG already. But it is not respond. Maybe they disabled in OTP. So we will never get JTAG.

1. Do you have J-LINK v10+? Which support cJTAG. Can you try to access MCU? I use my own cJTAG adapter, But It is not try on any other chip yet. Maybe I'm not implemented cJTAG in right.
2. Could you check on "RV1106 Hardware Design Guide"? They will specify the type of JTAG protocol. They will also tell you JTAG is open or not for customer.
   In RK3399,They listed in Chapter3 Schematic Design -> 3.1Minimum System Design -> 3.1.5 JTAG Debug Interface
3. Could you check on Rockchip redmine? Maybe JTAG documents in here.

@luyi1888

1. I don’t have J-LINK now, you may need to test it by yourself
2. The JTAG interface of the RV1103G/RV1106G chip complies with the IEEE1149.1 standard. The PC can connect to the DSTREAM emulator through SWD mode (two-wire mode) to debug the ARM Core and MCU Core inside the chip.

[vjoco]

Just to confirm that on rv1103 the MCU is working too,
thanks @luckfox-eng33 & @luyi1888

./mcuload execute 0xff6c0000 rv1106-mcu-led-blinky.bin
MCU reset.
MCU FW load to 0xff6c0000.
MCU boot addr set to 0xff6c0000.
MCU release.

and it's blinking

I'm wonder what compiler you use to make the blinking led binary?

[vjoco]

@luyi1888
I have a j-link... let me investigate.. which pins do you use?

[luyi1888]

@vjoco
I have never used J-Link. Could you try this setup?
"RISC-V behind a CoreSight DAP"
https://wiki.segger.com/J-Link_RISC-V

thanks @luckfox-eng33 It should be most likely setup.

Luckfox setup:
1.Set PINMUX to CPU JTAG(MCU PINMUX not respond to SWD initialization sequence)
That will set Default UART2 to SWD. You will lost console access.
devmem 0xff538008 32 0xff001100
2.Connect to J-Link
SWCLK - GPIO1_B2_d/UART2_TX
SWDIO - GPIO1_B3_u/UART2_RX

ARM core is definitely debug with this setup. You can use it to confirm the PINMUX config is right.

[luyi1888]

If not work, try debug in u-boot. I cannot access memory through SWD in Linux. They maybe set some SGRF registers during Linux boot.

U-Boot command:
mw.l 0xff538008 0xff001100

Verify MCU debug is enable. It should enable by U-boot default.
md.l 0xff076040 1
It should be 0x2, otherwise set it.
mw.l 0xff076040 0xffff0002

[luyi1888]

Toolchain:
https://github.com/xpack-dev-tools/riscv-none-embed-gcc-xpack/releases/tag/v10.2.0-1.2
It is also the toolchain which rockchip used to build firmware.