Quick Analysis of Anbernic RG556

Introduction:

I regularly receive developer and pre-production versions of devices from various hardware manufacturers for the purposes of providing mainline Linux and U-Boot support. It's been a bit of a hobby of mine ever since COVID-19 back in 2020. Since 2022, I've received Anbernic devices and provided mainline Linux support for each of them including the Anbernic models RG503, RG353P, RG353PS, RG353V, RG353VS, RG-ARC-D, RG-ARC-S, and RG-Nano. Each of these devices utilize a Rockchip RK3566 SoC with a DSI based display (excluding the RG-Nano, which uses an Allwinner V3L SoC and a horrible SPI based display).

I've also received a few devices for which I've struggled for one reason or another to get traction with. Specifically, this is the RG35XX (the older Actions Semi SoC based version) and each of the 5 and 6 series devices, specifically the RG505, RG405M, RG405V, and RG556. The Actions Semi device has a very old kernel with almost no publicly available documentation or sources. There are slightly more recent versions that could one day be used for a base (such as the Actions Semi S500), but the main impediment would still be unavailable vendor documentation. As for the 5 and 6 series devices, these all utilize a Unisoc SoC for which I have limited familiarity along with restricted or locked bootloaders and very little publicly available vendor documentation. To see an example what I mean, search for "Rockchip RK3566 TRM" or "Allwinner V3S datasheet" on Google and see what kind of documents would be helpful.

The RG556:

I received this device a few days ago, and have thus tried to do a few things I typically do such as getting a UART dump or extracting the vendor device tree. This is the kind of information that is very useful to developers to figure out all the bits and pieces of a given piece of hardware.

So for my very first trick, I took the back cover off and tried to find the pins necessary to get a UART console. Removal of the back cover wasn't too hard, just took a few torx screws along with some very gentle prying. As you can see though, the dominant feature is the large metal heat shield that obscures most of what we're trying to see.

The removal of the heat shield took a few extra screws, but with it gone we could see a few additional interesting bits underneath the right analog trigger. Note how both triggers appear to be hall effect triggers.

There is a button labelled "bb", which I believe is used to enter the bootloader in the event of a problem (but I'll let the Unisoc experts speak to this more). The second is something clearly labelled as "rx", but we'd need to remove the heatpipe to see it more clearly.

There do appear to be pins for serial, clearly labelled "tx", "rx", and "gnd". Additionally with the heat sink removed and thermal paste cleared off we can see at least 4 chips of interest. Clockwise starting at the top we see the SoC itself, labelled as a Unisoc UMS9620S. Beneath that is a Samsung KM8l9001JM combination 8GB DDR4 RAM/128GB UFS storage chip. To the left of the Samsung chip appears to be the power management IC (PMIC) labelled as a UMP9620, and then above it and to the left of the SoC is a smaller PMIC chip labelled as a UMP9621.

So after this I soldered wires for the UART, re-applied thermal paste, and put the device back together. I then proceeded to dump the UART console and ended up with this here. The output of the UART doesn't tell us too much. We can see the section labelled BL31 at the beginning which tells us we're running Arm Trusted Firmware version 1.4, which is about 7 years old at this point (not good). There doesn't at a glance seem to be too much information beyond that. What is unfortunate however is once the Linux kernel takes over it stops talking to UART, so no further debug information could be gathered.

After this, I attempted to dump the device tree. Usually it's just a matter of unlocking the bootloader, getting root, and then copying partitions. Unfortunately when I tried to run unlock guides such as the one provided by Hovatek I was met with an error message that I was unable to unlock my device. Maybe someone else can figure out an unlock in the future, but for now this was a dead-end for me.

As a last ditch attempt, I statically compiled the device tree compiler and was able to run it and dump the devicetree from /proc/device-tree. I've added the results here.

Conclusion:

In summary, I think this is a good little device, but it could benefit from some community love (as could all handhelds). Like the other Unisoc devices it appears to have a locked bootloader, but unlike the others the existing methods don't appear to work for me to unlock it. Hopefully someone can figure that out, and maybe we can stumble upon a device manual from Unisoc to help us better unlock this device's full potential. For now, I'll continue to focus on the newer Anbernic RG35XX devices (which use the Allwinner H700 SoC) as well as the Gameforce Ace and Indiedroid Nova (which use the RK3588s SoC). Those devices still have a lot of work to do, but I expect full mainline support with each of them eventually.