RTL8735BM programming not working with uartfwburn.linux, ping failure

Technical Discussion
1

When I try to program an image to my device using

./uartfwburn.linux -p /dev/ttyUSB0 -f flash_ntz.nn.bin -b 115200 -U

I get errors like ping failure, as uartfwburn.linux is unable to confirm the device is present. I’m using just RX and TX without any hardware flow control. I know the device is in BootFromUART mode, here is the uart log:

== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[SPIF Err]Invalid ID
[SPIF Err]Invalid ID
[BOOT Err]Flash init error (io_mod=0, pin_sel=0)
Fallback to NAND Flash
Boot from NAND Flash
[BOOT Err]snafc init error
Fallback NOR Flash
BootFromNORFlash
[SPIF Err]Invalid ID
[SPIF Err]Invalid ID
[BOOT Err]Flash init error (io_mod=0, pin_sel=0)
Fallback to NAND Flash
Boot from NAND Flash
[BOOT Err]snafc init error
Fallback NOR Flash
BootFromNORFlash
[SPIF Err]Invalid ID
[SPIF Err]Invalid ID
[BOOT Err]Flash init error (io_mod=0, pin_sel=0)
Fallback to NAND Flash
Boot from NAND Flash
[BOOT Err]snafc init error
Fallback NOR Flash
BootFromUART
Image Load over UART1 baud=115200

Since uartfwburn.linux is closed source I have no idea how to proceed. Is there any documentation on the protocol the RTL8735 uses during the uart boot process?

Thanks anyone for any help!
-Dave

2

The original problem I was having has been resolved, now there’s another issue.

Every thing I try to program a flash image and reboot the device I get an error because it doesn’t pass the certification check:

== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[Start Boot ROM…]
=== Load CERTI ===
[BOOT Err][vrf pbk fail]
[BOOT Err]StartUp@0x0: Invalid RAM Img Signature!Boot_err(0x11)

I very much would like to be able to use these devices, but unless I can program them they’re useless to us.

I have a copy of a correctly certified image, and when I program that the device boots fine:

== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[Start Boot ROM…]
=== Load CERTI ===
[vrf pbk pass]
[vrf sig pass]
=== Load Done ===
=== Load PARTBL ===
[vrf pbk pass]
[vrf sig pass]
[img hash chk pass]
=== Load Done ===
=== Load ISP_IQ ===

etc., so I know the device programming is working.
Please any help or advice would be appreciated!
-Dave

3

Hi @dashxdr, is it possible to provide the source code which this error occurs for me to try at my end?

4

refer to

5

I’m just trying to load one of the Ardruino demos onto the board. The board is equivalent to the AMB82-MINI, same hardware, but for some reason all code except for the original 16 megabyte image won’t run, the UART reports

== Rtl8735b IoT Platform ==
Chip VID: 0, Ver: 0
ROM Version: v3.0

[Normal mode]
BootFromNORFlash
[Start Boot ROM…]
=== Load CERTI ===
[BOOT Err]ld_certi_idx err:-1
[BOOT Err]StartUp@0x0: Invalid RAM Img Signature!Boot_err(0x11)

I just want to be able to run my own code on the device. The RTL8735 is doing some kind of certi check and I don’t want it to.

6

Let me try one last time before I completely abandon the RTL8735 chipset for any project, and go back to using the wonderful ESP32 which has met all my needs so far.

  1. I want detailed technical documents about the boot process of the RTL8735
  2. I want a detailed block diagram showing every component of the RTL8735, with part numbers. There’s some arm chip, right? What’s the exact type of armv8-m on it?
  3. How do I program the flashrom of the RTL8735?
  4. How do I erase the flashrom of the RTL8735?
  5. What bootstrap pins are there on the RTL8735 that change boot behavior? Is there a pin that will disable CERT checking?
  6. What is the process for writing an image that DOES pass the CERT checking requirement of the RTL8735, if there is one?

The hardware I have is equivalent to an AMB82-MINI. Evidently AMB82-MINIs are not available because they’re out of stock. The hardware I’m experimenting with is a Wyze camera I bought at Home Depot on a black Friday discount for $17. They are available now for $20 at Home Depot. The device has an RTL8735 board, a camera, a microphone, and a speaker. All signs indicate it is a reference implementation of the AMB82-MINI board, with a few components added.

I want to repurpose this device to act like an AMB82-MINI. I can reprogram the 128MBIT 8-pin flashrom on the device using the ardruino tools. The only problem is when this device boots up, I get the CERT errors described earlier.

I don’t care about any software or keys or anything that Wyze has done for this product. I want to use it like an AMB82-MINI. My complaint with Realtek is… why not make documentation available for developers like myself? Why is everything so secret? The capability of the RTL8735 is great, I’d like to use it in products. But… why no documentation?

If I don’t get a sense of actual support from Realtek or amebaiot.com whatever that is, I’m giving up.

Thanks for your consideration.
-Dave
ETA: For reference please see this somewhat long ongoing effort to get this working: WYZEDB3 /OG · gtxaspec/wz_mini_hacks · Discussion #638 · GitHub