Onda VX747 / VX747+ / VX777

Port status

• LCD is working
• Backlight is working
• Touchscreen & keys are working
• RTC is working, but if you boot the OF and then boot Rockbox it will lose all the RTC settings
• Interrupts are working
• System reboot/shutdown is working
• NAND flash driver is working, but flash translation layout (FTL) hasn't been ported
• Audio & external speaker are working
• USB is working (minor problems with interrupt transfers though <- only needed for USB HID)
• SD driver is working, but hotswap isn't committed yet (due to problems with the Rockbox storage internals)
• Dual boot is working

Known problems:

• Pictureflow hangs (never worked)
• MPEGplayer doesn't work (crashes)
• Rockboy seems to need optimizations for MIPS/Jz4740 targets (too slow)

How to upload Rockbox to SDRAM

• Download usbtool from SVN and read the README (or download it here: Windows/Linux).
• Compile Rockbox as Normal or Bootloader (see DevelopmentGuide for more information).
• Normal:
  • Add the line #define USB_BOOT to autoconf.h, compile Rockbox, run make zip and extract rockbox.zip to your SD card
• Bootloader:
  • Add the line #define USB_BOOT to autoconf.h and compile Rockbox.
• Run usbtool 10 [file] (with sudo under Linux) with [file] being either ccpmp.bin (bootloader) or rockbox.bin (normal version)

How to upload the Rockbox bootloader to NAND

• Compile the bootloader (this will generate a ccpmp.bin file)
• Download the Original Firmware (OF) package (called VX747.HXF or SG301.HXF; vx777.HXF for the VX777): link
• Compile ChinaChipPatcher in rbutil/chinachippatcher/ (run make in the dir)
• Run ../rbutil/chinachippatcher/chinachip VX747.HXF ccpmp.bin output.HXF ccpmp.old in the dir where you compiled your bootloader
• Put output.HXF in the root of the NAND drive (boot into the OF as Rockbox currently can't access the NAND storage) and name it SG301.HXF (or VX747.HXF on some targets)
• Reset your player while holding VOL DOWN (on the VX777 you don't need to hold any buttons)

If you want to have dual-boot capabilities:

• Copy ccpmp.old (name it ccpmp.bin) to the root of your SD card

(The bootloader will boot into the OF (loaded from ccpmp.bin from the SD card) when you switch the HOLD switch on, it will show a boot menu when pressing VOL UP (or POWER; for the VX777) and if nothing is pressed it will boot Rockbox from the SD)

You can also do all these steps (except compiling the bootloader) using RockboxUtility, but currently you'll need to edit rbutil.ini to get this working; as there's no bootloader on the download server (yet).

Information

Images

• VX747 disassembled by mcuelenaere
• VX747 disassembled by v15i.com
• VX777 disassembled by imp3.net
• VX767 disassembled by mydigit.cn

Components

		VX747	VX747+	VX777	VX757	VX757+	VX767
	Ingenic Jz4732 chipset Markings on backside of the board: SG301H V2 0801172010P2 More: 94V-0 E305905 0608 VX777: SG303HT V2 VX747: SG301HC	X	X	X	X	X	X
	Truly Semiconductor (Catalog) 3,0" touchscreen (400x240) Markings: A0533B On back: TC300-6-C-P4-J-E S80130173A On connector: Y080309-AB3 TFT9K0259FPC-B1-E TRULY-C 0805 (datasheet) Custom LCD design, based on TFT-G240400RTSW-3W-TP-E LCD Driver IC: Renesas R61509 (datasheet)	X	? (compatible)	? (compatible)	?	?
	Power Tech International PL043759P Other device yields: TS-043759 RSD8J20A LI-ION 4.2V 800mAh	X	?	?	?	?	?
	Samsung 749 K9HBG08U1M 2/4/8GB NAND flash (containing bootloader + firmware) VX747 (8GB) NAND_ID: 0xECD7 VX747+ (4GB) NAND_ID: 0xECD5	X	?	?	?	?	?
	2x Hynix HY57V281620FTP-2 SDRAM Total: 32MB 747A		?		?	?	X
	2x Hynix HY57V641620FTP-7 SDRAM Total: 16MB 818A C	X	?	X	?	?
	TEA5767 FM chip	X	X	X	?	?	X
	TV-output: Chrontel CH7024B-DF (datasheet)			X		X	X
	Speaker amplifier: LM4890 (datasheet) or TPA2005D1	X	X	?
	TQ7051 Standalone Linear Lithium Battery Charger (datasheet)	X	X	?	?	?	?
	OV2640 2Mpixel camera (datasheet)		X

Schematic

More information can be found here

GPIO configuration

VX747

• GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
• GPIO_PXPIN(3) ^ (1 << 0) => VOL UP button
• GPIO_PXPIN(3) ^ (1 << 1) => MENU button
• GPIO_PXPIN(3) ^ (1 << 16) => HOLD switch
• GPIO_PXPIN(3) ^ (1 << 29) => OFF button
• GPIO_PXPIN(1) ^ (1 << 29) => microSD card insertion
• GPIO_PXPIN(3) & (1 << 28) => ADP_CHK (g_USB_charge)
• GPIO_PXDATS(1) | (1 << 30) => enable charging?
• GPIO_PXDATS(2) | (1 << 27) => enable internal speaker

VX747+

• GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
• GPIO_PXPIN(3) ^ (1 << 19) => VOL UP button
• GPIO_PXPIN(3) ^ (1 << 20) => MENU button
• GPIO_PXPIN(2) ^ (1 << 22) => HOLD switch
• GPIO_PXPIN(3) ^ (1 << 29) => OFF button

VX777

UART pins

VX747

The UART connections on the VX747 board has been found by some folks at linuxforum.net (here and here)

VX777

Some info available here (translated)

Boot log

Text between [] has been added to indicate the different booting steps.

[ROM code -> https://www.rockbox.org/realwiki/pub/Main/OndaVX747/rom_dump.bin] [NAND first bootloader (NAND sectors 0 -> 3) -> https://www.rockbox.org/realwiki/pub/Main/OndaVX747/first_bootloader.bin] NAND Booting...ECD55525.0003EDA0.OK [ECD55525 -> NAND id of first bank, 0003EDA0 -> length of second bootloader in bytes]  [NAND second bootloader (NAND sectors 128 -> ...) -> https://www.rockbox.org/realwiki/pub/Main/OndaVX747/second_bootloader.bin] NAND Loading... loader normal mode... Creating ftl device... id:EC D5 55 25 68 id:EC D5 55 25 68 id:00 00 00 00 00 id:00 00 00 00 00 OK. usb_connect = 1 loader -- into lcd_init. Start decode... OK 153601. loader -- out lcd_init. get_lcd_brightness -- value = 4. len is 0x 500000 os_len = 0x 1e2d78. checksum = 0x0989877a. 0000818B:1.00008191:1.ret = 1 Run image...  [Main firmware -> ccpmp.bin] c_main enter------!! kseg init OK! intc init OK! intc lib OK!  the os is start 

Firmware upgrade

Holding the MENU button down while resetting the device boots it into "Jz4740 USB Boot Device" (VID=601A, PID=4740) which is the same as the information provided by Ingenic's USBboot tools.

OEM USB upgrade

The protocol should be compatible with/the same as usbboot-v1.3.zip provided by Ingenic.

Jz4740USBtool is available at utils/jz4740_usbtool in SVN which can upload data from and to the device.

NOTE: Source code from the Ingenic tool is available at Qi-hardware, which is regularly synced with Ingenic

Official flash recovery

Using this program (from MP4Nation) you can always recover from a bad flash.

Recovery procedure:

• hold MENU button while resetting your player
• start the program and press the second top left big button
• press it again after a (Chinese) message appears on your player
• reset your player while holding VOL DOWN
• upload your firmware named as SG301.HXF to the root
• reset your player while holding VOL DOWN

VX747writer's workflow is available here, an older version is below.

• do these steps with log_first.bin, log_second.bin, log_third.bin, log_fourth.bin and log_fifth.bin:
  1. do a VR_GET_CPU_INFO (returns JZ4740V1)
  2. (after uploading log_first.bin): do a VR_FLUSH_CACHES
  3. do a VR_SET_DATA_ADDRESS with value = 0x80000000
  4. upload log_X.bin to EP1
  5. do a VR_SET_DATA_LENGTH (returns length of upload)
  6. download log_X.bin from EP1 (and verify if it's correct)
  7. do a VR_PROGRAM_START1 with value = 0x80000000 (executing the uploaded code)
  8. do a VR_SET_DATA_ADDRESS with value = 0xB3020000 = DMAC_DSAR(0)
  9. do a VR_SET_DATA_LENGTH (returns length = 4 = int32)
  10. read 4 bytes from EP1
  11. ... (do some checking?)
• put the device somehow in USB UMS (probably through log_fifth.bin) and erase the NAND
• wait for instructions:
  • NAND needs to be formatted as FAT32
  • FW image needs to be uploaded as SG301.HXF

Probably ChinaChip modified the standard USBtools a bit (e.g. making VR_SET_DATA_LENGTH some kind of VR_GET_DATA).
Also VR_FLUSH_CACHES clears the current code running the USB tool mode, so you'll want be sure there's other code on the device too which can be runned.

Conclusions after some RE:

• ChinaChip has used the Ingenic USB boot tools (including the source to be runned on the device itself) for stage 1 at least
• The initial boot code is get from ROM (0x1FC00000), copied to the 16kb cache and run from there (0x080000000)
  • the stage2 takes over the USB functioning
  • the flush caches command kills the initial USB code in cache so if there isn't any replacement code available the player will need to be reset

Known issues

RTC is working, but if you boot the OF and then boot Rockbox it will lose all the RTC settings

This is due the 'sync' function: Rockbox will synchron time with OF, but the Onda OF has no time function.

NAND flash driver is working, but flash translation layout (FTL) hasn't been ported yet

We now have 3 choice:

• Use Apple iPod2G's FTL, but it will make it lose OF compatibility
• Write a patch and use it to boot Rockbox from OF. In this case, the OF's FTL code is used directly. Because only the SDK of VX777 1.1 OF can be found, we must use VX777 OF instead of the others.
• Just try to find the FTL which Onda's OF uses

Minor problems with interrupt transfers though <- only needed for USB HID

Links

• Firmware format
• Ingenic Jz4740 information
• OndaVX767
• AinolV2000SE

External links

• Forum thread
• Manufacturers site
• Firmware archive
• Jz-Hacking (Linux on the Onda)
• Rockbox Chinese Forum (PMP-Firmware)

---

CategoryFrontpage: Onda VX747 Port Index [New Ports]