search

LuckfoxTECH / luckfox-pico

luckfox-pico sdk
291 stars 113 forks source link

MCU in RV1106G3 #99

Open PJ5168 opened 5 months ago

PJ5168 commented 5 months ago

There is a MCU in the RV1106. Is there a way to leverage it? Like SG2002, the big core runs Linux, the small core runs RTOS, and can load code to the 300Mhz 8051 MCU inside. RV1106

luyi1888 commented 5 months ago

If you are interested in MCU, try this https://github.com/luyi1888/rv1106-mcu I have upload a blinky firmware. The RK3566 AMP SDK have RV1106 MCU support. But please consider it is not usable. Develop MCU firmware by user is not supported by rockchip. I'm also not figure out a way to connect mcu JTAG.

PJ5168 commented 5 months ago

Excellent! I did not notice that there is a MCU inside the RK3566. Check the spec again, it does have the MCU you mentioned. That's great! I have RK3566, 3588S, and 3588 as well. Refer to the following link, seems that it's possible to leverage the 3566 package!? Thanks! https://github.com/liamhays/rk3566-mcu.git https://github.com/liamhays/rk3566-mcu/blob/main/rk3566_mcu_notes.md https://xpack.github.io/dev-tools/riscv-none-elf-gcc/ BTW, what is this MCU for? And seceret hacking backdoor? Ha~

luyi1888 commented 5 months ago

You can check SDK's rkbin folder. They provided RV1106 MCU firmware for camera early initialization. They called it "Thunder Boot" https://github.com/rockchip-linux/rkbin/tree/master/bin/rv11

For RV3568, I don't known any usage. According to datasheet, RV3568 has the weakest MCU. It doesn't have cache. It is huge performance difference with/without cache.

vjoco commented 5 months ago

is it possible that the same MCU core is inside RV1103 too??? , in this image is there:

image

luckfox-eng33 commented 5 months ago

is it possible that the same MCU core is inside RV1103 too??? , in this image is there:

image

same

luckfox-eng33 commented 5 months ago

rk does provide some bins but does not provide other technical support or compilation methods.

luyi1888 commented 5 months ago

rk does provide some bins but does not provide other technical support or compilation methods.

@luckfox-eng33

Could you help to connect MCU JTAG? The JTAG access is enough for hobby project. The toolchain which they used is not a secret truly. I have try several methods to access JTAG already. But it is not respond. Maybe they disabled in OTP. So we will never get JTAG.

  1. Do you have J-LINK v10+? Which support cJTAG. Can you try to access MCU? I use my own cJTAG adapter, But It is not try on any other chip yet. Maybe I'm not implemented cJTAG in right.
  2. Could you check on "RV1106 Hardware Design Guide"? They will specify the type of JTAG protocol. They will also tell you JTAG is open or not for customer. In RK3399,They listed in Chapter3 Schematic Design -> 3.1Minimum System Design -> 3.1.5 JTAG Debug Interface
  3. Could you check on Rockchip redmine? Maybe JTAG documents in here.
luckfox-eng33 commented 5 months ago

rk does provide some bins but does not provide other technical support or compilation methods.

@luckfox-eng33

Could you help to connect MCU JTAG? The JTAG access is enough for hobby project. The toolchain which they used is not a secret truly. I have try several methods to access JTAG already. But it is not respond. Maybe they disabled in OTP. So we will never get JTAG.

  1. Do you have J-LINK v10+? Which support cJTAG. Can you try to access MCU? I use my own cJTAG adapter, But It is not try on any other chip yet. Maybe I'm not implemented cJTAG in right.
  2. Could you check on "RV1106 Hardware Design Guide"? They will specify the type of JTAG protocol. They will also tell you JTAG is open or not for customer. In RK3399,They listed in Chapter3 Schematic Design -> 3.1Minimum System Design -> 3.1.5 JTAG Debug Interface
  3. Could you check on Rockchip redmine? Maybe JTAG documents in here.

@luyi1888

  1. I don’t have J-LINK now, you may need to test it by yourself
  2. The JTAG interface of the RV1103G/RV1106G chip complies with the IEEE1149.1 standard. The PC can connect to the DSTREAM emulator through SWD mode (two-wire mode) to debug the ARM Core and MCU Core inside the chip.
vjoco commented 5 months ago

Just to confirm that on rv1103 the MCU is working too, thanks @luckfox-eng33 & @luyi1888 

./mcuload execute 0xff6c0000 rv1106-mcu-led-blinky.bin
MCU reset.
MCU FW load to 0xff6c0000.
MCU boot addr set to 0xff6c0000.
MCU release.

and it's blinking

I'm wonder what compiler you use to make the blinking led binary?

vjoco commented 5 months ago

@luyi1888 I have a j-link... let me investigate.. which pins do you use?

luyi1888 commented 5 months ago

@vjoco I have never used J-Link. Could you try this setup? "RISC-V behind a CoreSight DAP" https://wiki.segger.com/J-Link_RISC-V

thanks @luckfox-eng33 It should be most likely setup.

Luckfox setup: 1.Set PINMUX to CPU JTAG(MCU PINMUX not respond to SWD initialization sequence) That will set Default UART2 to SWD. You will lost console access. devmem 0xff538008 32 0xff001100 2.Connect to J-Link SWCLK - GPIO1_B2_d/UART2_TX SWDIO - GPIO1_B3_u/UART2_RX

ARM core is definitely debug with this setup. You can use it to confirm the PINMUX config is right.

luyi1888 commented 5 months ago

If not work, try debug in u-boot. I cannot access memory through SWD in Linux. They maybe set some SGRF registers during Linux boot.

U-Boot command: mw.l 0xff538008 0xff001100

Verify MCU debug is enable. It should enable by U-boot default. md.l 0xff076040 1 It should be 0x2, otherwise set it. mw.l 0xff076040 0xffff0002

luyi1888 commented 5 months ago

Toolchain: https://github.com/xpack-dev-tools/riscv-none-embed-gcc-xpack/releases/tag/v10.2.0-1.2 It is also the toolchain which rockchip used to build firmware.

vjoco commented 5 months ago

@luyi1888 I need to make some time for the jlink tests...

Meanwhile, @luckfox-eng33 , is it possible that rockchip is able to move the sc3336 camera load to an MCU driver: I found this repository from them: https://github.com/rockchip-linux/rkbin/tree/master/bin/rv11 rv1106_hpmcu_tb_sc3336_sc3338_v1.91.bin

actually this file is part of the source/uboot/rkbin/bin/rv11 folder (rv1106_hpmcu_tb_sc3336_sc3338_v1.61.bin) of the luckfox SDK ... is it used anywhere in the build?

vjoco commented 5 months ago

Toolchain: https://github.com/xpack-dev-tools/riscv-none-embed-gcc-xpack/releases/tag/v10.2.0-1.2 It is also the toolchain which rockchip used to build firmware.

sorry to bug again... is that toolchain contain examples for a blinky led, how you link it to the rv1106 gpios?

luyi1888 commented 5 months ago

Finally, found a way to connect HPMCU JTAG.

  1. Set GPIO1_B2/B3 to HPMCU_JTAG. devmem 0xff538008 32 0xff003300
  2. Use cJTAG debugger to connect. Example Syntacore SCR1 OpenOCD config file IDCODE is 0xDEB11001
luyi1888 commented 5 months ago

Toolchain: https://github.com/xpack-dev-tools/riscv-none-embed-gcc-xpack/releases/tag/v10.2.0-1.2 It is also the toolchain which rockchip used to build firmware.

sorry to bug again... is that toolchain contain examples for a blinky led, how you link it to the rv1106 gpios?

HPMCU and ARM share the same memory mapping. HPMCU use the same way to access GPIO.

Blinky program use RK3566_AMP_SDK. It have minimal effort to porting to RV1106 MCU.

smzahraee commented 3 days ago

hello where is the RK3566_AMP_SDK?