Onda VX747 / VX747+ / VX777

Port status

• LCD is working
• Backlight is working
• Keys are working
• Touchscreen is working
• RTC is working
• Interrupts are working
• System reboot/shutdown is working
• NAND flash driver is working, but flash layout (FLT) hasn't been figured out yet
• Audio is working
• USB is working
• SD driver is working
• Speaker is working

How to upload Rockbox to SDRAM

• Download usbtool from SVN and read the README (or download it here: Windows/Linux).
• Compile Rockbox as Normal (or download latest SVN here) and Bootloader (see SimpleGuideToCompiling for more information).
• Normal:
  • Precompiled: Unzip rockbox.zip to your SD card
  • Compiling your own: Compile Rockbox, run make zip and extract rockbox.zip to your SD card
• Bootloader:
  • Compile Rockbox.
• Run usbtool 10 [file] (with sudo under Linux) with [file] being either rockboot.vx747 (bootloader) or rockbox.bin (normal, not precompiled version)

Information

Images

• VX747 disassembled by mcuelenaere
• VX747 disassembled by v15i.com
• VX777 disassembled by imp3.net
• VX767 disassembled by mydigit.cn

Components

		VX747	VX747+	VX777	VX757	VX757+	VX767
	Ingenic Jz4732 chipset Markings on backside of the board: SG301H V2 0801172010P2 More: 94V-0 E305905 0608 VX777: SG303HT V2 VX747: SG301HC	X	X	X	X	X	X
	Truly Semiconductor (Catalog) 3,0" touchscreen (400x240) Markings: A0533B On back: TC300-6-C-P4-J-E S80130173A On connector: Y080309-AB3 TFT9K0259FPC-B1-E TRULY-C 0805 (datasheet) Custom LCD design, based on TFT-G240400RTSW-3W-TP-E LCD Driver IC: Renesas R61509 (datasheet)	X	? (compatible)	? (compatible)	?	?
	Power Tech International PL043759P Other device yields: TS-043759 RSD8J20A LI-ION 4.2V 800mAh	X	?	?	?	?	?
	Samsung 749 K9HBG08U1M 2/4/8GB NAND flash (containing bootloader + firmware) VX747 (8GB) NAND_ID: 0xECD7 VX747+ (4GB) NAND_ID: 0xECD5	X	?	?	?	?	?
	2x Hynix HY57V281620FTP-2 SDRAM Total: 32MB 747A		?		?	?	X
	2x Hynix HY57V641620FTP-7 SDRAM Total: 16MB 818A C	X	?	X	?	?
	TEA5767 FM chip	X	X	X	?	?	X
	TV-output: Chrontel CH7024B-DF (datasheet)			X		X	X
	Speaker amplifier: LM4890 (datasheet) or TPA2005D1	X	X	?
	TQ7051 Standalone Linear Lithium Battery Charger (datasheet)	X	X	?	?	?	?
	OV2640 2Mpixel camera (datasheet)		X

Schematic

GPIO configuration

VX747

• GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
• GPIO_PXPIN(3) ^ (1 << 0) => VOL UP button
• GPIO_PXPIN(3) ^ (1 << 1) => MENU button
• GPIO_PXPIN(3) ^ (1 << 16) => HOLD switch
• GPIO_PXPIN(3) ^ (1 << 29) => OFF button
• GPIO_PXPIN(1) ^ (1 << 29) => microSD card insertion
• GPIO_PXPIN(3) & (1 << 28) => ADP_CHK (g_USB_charge)
• GPIO_PXDATS(1) | (1 << 30) => enable charging?
• GPIO_PXDATS(2) | (1 << 27) => enable internal speaker

VX747+

• GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
• GPIO_PXPIN(3) ^ (1 << 19) => VOL UP button
• GPIO_PXPIN(3) ^ (1 << 20) => MENU button
• GPIO_PXPIN(2) ^ (1 << 22) => HOLD switch
• GPIO_PXPIN(3) ^ (1 << 29) => OFF button

VX777

UART pins

VX747

VX777

Boot log

[ROM code -> /twiki/pub/Main/OndaVX747/rom_dump.bin]
[NAND first bootloader (NAND sectors 0 -> 3) -> /twiki/pub/Main/OndaVX747/first_bootloader.bin]
NAND Booting...ECD55525.0003EDA0.OK [ECD55525 -> NAND id of first bank, 0003EDA0 -> length of second bootloader in bytes]

[NAND second bootloader (NAND sectors 128 -> ...) -> /twiki/pub/Main/OndaVX747/second_bootloader.bin]
NAND Loading...
loader normal mode...
Creating ftl device...
id:EC D5 55 25 68
id:EC D5 55 25 68
id:00 00 00 00 00
id:00 00 00 00 00
OK.
usb_connect = 1
loader -- into lcd_init.
Start decode...
OK 153601.
loader -- out lcd_init.
get_lcd_brightness -- value = 4.
len is 0x 500000
os_len = 0x 1e2d78. checksum = 0x0989877a.
0000818B:1.00008191:1.ret = 1
Run image...

[Main firmware -> ccpmp.bin]
c_main enter------!!
kseg init OK!
intc init OK!
intc lib OK!

the os is start

Firmware upgrade

Holding the MENU button down while resetting the device boots it into "Jz4740 USB Boot Device" (VID=601A, PID=4740) which is the same as the information provided by Ingenic's USBboot tools.

OEM USB upgrade

The protocol should be compatible with/the same as usbboot-v1.3.zip provided by Ingenic.

Jz4740USBtool is available at utils/jz4740_usbtool in SVN which can upload data from and to the device.

Official flash recovery

Using this program (from MP4Nation) you can always recover from a bad flash.

Recovery procedure:

• hold MENU button while resetting your player
• start the program and press the second top left big button
• press it again after a (Chinese) message appears on your player
• reset your player while holding VOL DOWN
• upload your firmware named as SG301.HXF to the root
• reset your player while holding VOL DOWN

VX747writer's workflow is available here, an older version is below.

• do these steps with log_first.bin, log_second.bin, log_third.bin, log_fourth.bin and log_fifth.bin:
  1. do a VR_GET_CPU_INFO (returns JZ4740V1)
  2. (after uploading log_first.bin): do a VR_FLUSH_CACHES
  3. do a VR_SET_DATA_ADDRESS with value = 0x80000000
  4. upload log_X.bin to EP1
  5. do a VR_SET_DATA_LENGTH (returns length of upload)
  6. download log_X.bin from EP1 (and verify if it's correct)
  7. do a VR_PROGRAM_START1 with value = 0x80000000 (executing the uploaded code)
  8. do a VR_SET_DATA_ADDRESS with value = 0xB3020000 = DMAC_DSAR(0)
  9. do a VR_SET_DATA_LENGTH (returns length = 4 = int32)
  10. read 4 bytes from EP1
  11. ... (do some checking?)
• put the device somehow in USB UMS (probably through log_fifth.bin) and erase the NAND
• wait for instructions:
  • NAND needs to be formatted as FAT32
  • FW image needs to be uploaded as SG301.HXF

Probably ChinaChip modified the standard USBtools a bit (e.g. making VR_SET_DATA_LENGTH some kind of VR_GET_DATA).
Also VR_FLUSH_CACHES clears the current code running the USB tool mode, so you'll want be sure there's other code on the device too which can be runned.

Conclusions after some RE:

• ChinaChip has used the Ingenic USB boot tools (including the source to be runned on the device itself) for stage 1 at least
• The initial boot code is get from ROM (0x1FC00000), copied to the 16kb cache and run from there (0x080000000)
  • the stage2 takes over the USB functioning
  • the flush caches command kills the initial USB code in cache so if there isn't any replacement code available the player will need to be reset

Links

• Firmware format
• Ingenic Jz4740 information
• OndaVX767
• AinolV2000SE

External links

• Forum thread
• Manufacturers site
• Firmware archive
• Jz-Hacking (Linux on the Onda)

Attachment	Action	Size	Date	Who	Comment
ER620-M-0_V1.0.pdf	manage	203.4 K	29 Jan 2009 - 01:52	MaurusCuelenaere	ChinaChip player schematics (similar to the VX747)
K9HBG08U1M.pdf	manage	1135.8 K	29 Jan 2009 - 01:53	MaurusCuelenaere	Samsung K9HBG08U1M NAND flash datasheet
Log_Files.rar	manage	73.8 K	23 Jun 2008 - 14:31	MaurusCuelenaere	Log files
TFT-G240400RTSW-3W-TP-E(3.0D)v1.0.pdf	manage	778.2 K	29 Jan 2009 - 01:54	MaurusCuelenaere	Truly TFT datasheet
TLB_dump.txt	manage	5.6 K	23 Aug 2008 - 02:48	MaurusCuelenaere	TLB dump
TQ7051.pdf	manage	262.9 K	29 Jan 2009 - 01:51	MaurusCuelenaere	TQ7051 datasheet
eR61509_1.02.pdf	manage	2635.8 K	29 Jan 2009 - 01:55	MaurusCuelenaere	Renesas R61509 LCD IC datasheet
first_bootloader.bin	manage	8.0 K	03 Mar 2009 - 00:12	MaurusCuelenaere	Code at NAND sectors 0 -> 3
log.htm	manage	44.0 K	20 Jun 2008 - 23:01	MaurusCuelenaere
rom_dump.bin	manage	16.0 K	23 Aug 2008 - 02:45	MaurusCuelenaere	On-chip Boot ROM dump
second_bootloader.bin	manage	250.0 K	03 Mar 2009 - 01:07	MaurusCuelenaere	Code at NAND sectors 128 -> 190
usbtool	manage	39.9 K	10 Apr 2009 - 14:37	MaurusCuelenaere	Precompiled USB-tool for Linux (compiled on Debian 5)
usbtool.exe	manage	50.3 K	20 Mar 2009 - 23:53	MaurusCuelenaere	Precompiled USB-tool for Windows