Onda VX747
Port status
- LCD is working
- Backlight is working
- Keys are working
- Touchscreen is working
- RTC is working
- Interrupts are working
- System reboot works + system shutdown
- NAND flash driver is working, but flash layout hasn't been figured out yet
How to upload Rockbox to SDRAM
- Download usbtool from SVN and read the README.
- Download these files and unzip them somewhere
- Compile Rockbox as a Bootloader
- Copy
build/rockboot.vxv747 to [EXTRACT_FOLDER]/onda.bin
- In
[EXTRACT_FOLDER] do usbtool 10 (for help just run usbtool)
Information
Images
Components
|
Ingenic Jz4732 chipset Markings on backside of the board: SG301H V2 0801172010P2 More: 94V-0 E305905 0608 |
|
Truly Semiconductor (Catalog) 3,0" touchscreen (400x240) Markings: A0533B On back: TC300-6-C-P4-J-E S80130173A On connector: Y080309-AB3 TFT9K0259FPC-B1-E TRULY-C 0805
Custom LCD design, based on TFT-G240400RTSW-3W-TP-E LCD Driver IC: Renesas R61509 |
|
Power Tech International PL043759P Other device yields: TS-043759 RSD8J20A |
|
Samsung 749 K9HBG08U1M 2/4/8GB NAND flash (containing bootloader + firmware) Result of NAND_ID: 0xECD7 |
| |
2x Hynix HY57V281620FTP-2 16MB RAM 747A HY57V281620FTP-2 |
|
Unknown FM chip |
| / |
RTC is onboard but apparently not used? |
GPIO configuration
- GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
- GPIO_PXPIN(3) ^ (1 << 0) => VOL UP button
- GPIO_PXPIN(3) ^ (1 << 1) => MENU button
- GPIO_PXPIN(3) ^ (1 << 16) => HOLD switch
- GPIO_PXPIN(3) ^ (1 << 29) => OFF button
Firmware upgrade
Holding the MENU button down while resetting the device boots it into "Jz4740 USB Boot Device" (VID=601A, PID=4740) which is the same as the information provided by Ingenic's USBboot tools.
OEM USB upgrade
The protocol should be compatible with/the same as usbboot-v1.3.zip provided by Ingenic.
Jz4740USBtool is available at utils/jz4740_usbtool in SVN which can upload data from and to the device.
Official flash recovery
Using this program (from MP4Nation) you can always recover from a bad flash.
Recovery procedure:
- hold MENU button while resetting your player
- start the program and press the second top left big button
- press it again after a (Chinese) message appears on your player
- reset your player while holding VOL DOWN
- upload your firmware named as SG301.HXF to the root
- reset your player while holding VOL DOWN
VX747writer's workflow is available here, an older version is below.
- do these steps with log_first.bin, log_second.bin, log_third.bin, log_fourth.bin and log_fifth.bin:
- do a VR_GET_CPU_INFO (returns JZ4740V1)
- (after uploading log_first.bin): do a VR_FLUSH_CACHES
- do a VR_SET_DATA_ADDRESS with value = 0x80000000
- upload log_X.bin to EP1
- do a VR_SET_DATA_LENGTH (returns length of upload)
- download log_X.bin from EP1 (and verify if it's correct)
- do a VR_PROGRAM_START1 with value = 0x80000000 (executing the uploaded code)
- do a VR_SET_DATA_ADDRESS with value = 0xB3020000 = DMAC_DSAR(0)
- do a VR_SET_DATA_LENGTH (returns length = 4 = int32)
- read 4 bytes from EP1
- ... (do some checking?)
- put the device somehow in USB UMS (probably through log_fifth.bin) and erase the NAND
- wait for instructions:
- NAND needs to be formatted as FAT32
- FW image needs to be uploaded as SG301.HXF
Probably ChinaChip modified the standard USBtools a bit (e.g. making VR_SET_DATA_LENGTH some kind of VR_GET_DATA).
Also VR_FLUSH_CACHES clears the current code running the USB tool mode, so you'll want be sure there's other code on the device too which can be runned.
Conclusions after some RE / Port status:
- ChinaChip has used the Ingenic USB boot tools (including the source to be runned on the device itself) for stage 1 at least
- unverified: the initial boot code is get from some ROM place, copied to the 16kb cache and run from there (address unknown, perhaps 0x80000000)
- the stage2 takes over the USB functioning
- the flush caches command kills the initial USB code in cache so if there isn't any replacement code available the player will need to be reset
Links
CategoryFrontpage: Onda VX747 Port Index [New Ports]
|