General [Review] Joying PX5 2GB+32GB on Android version 8.0.0 (FYT unit)

Search This thread

droidmanuser

Senior Member
Sep 27, 2017
126
12
Lower Saxony
Maybe someone can help me here in my own thread:

This unit should be also FYT-based PX5, 2GB RAM/32GB ROM and octa core CPU. I need help here to find the factory firmware and mcu (I flashed wrong mcu, the canbus-box is not detected). Maybe Joying firmware also works on these units? Anyone who has the same hardware and already got support?

Thanks in advance.
 

Kyle M.

Senior Member
@surfer63 Hi, hope you're doing well. Am I right in thinking the upper board with the heatsink (labelled FYT 6026) is the "android system" part of the head unit and the lower board it connects to, the "interface" side where the MCU lives and the SOC interfaces to get I/O? If so, could it be that the upper side is a generic board with SOC and that it would be possible to just upgrade it by getting a newer board from Rockchip?

I'm asking, because my unit (EU-JY-BO123P4) which I got in 2018, has started to show its age and sometimes it plays up. I've been really happy with it till now and was wondering whether swapping that board gives me a cheap upgrade path or whether I'm talking nonsense again :)
 

surfer63

Senior Member
May 4, 2010
5,736
3,062
Zwolle
github.com
@surfer63 Hi, hope you're doing well. Am I right in thinking the upper board with the heatsink (labelled FYT 6026) is the "android system" part of the head unit and the lower board it connects to, the "interface" side where the MCU lives and the SOC interfaces to get I/O? If so, could it be that the upper side is a generic board with SOC and that it would be possible to just upgrade it by getting a newer board from Rockchip?
I don't know. They really do reuse a lot of components.

I started with a Joying Sofia 3GR on a FYT 5009 SOM (1.0 GHz), but that got toasted pretty fast. Then they sent me a FYT 6021 SOM (1.2GHz) which I could simply replace. But that was still the same CPU, like going now from a uis7862 to a UIS7862S.

And note that also the other components will show their age. If I were you and you don't want to spent a lot of money, I would buy a Mekede M400S or M500S, or even a M300S, but not with less memory. It might even be equal or cheaper than buying a new SOC/SOM to place into your old unit. And realize that you will go from 1024x600 to 1280x700 with a new unit.
And if you can and do want to spend the money go for a Mekede M6 Pro (plus ), where plus is 2000x1200 resolution.
 
  • Like
Reactions: Kyle M.

Kyle M.

Senior Member
I don't know. They really do reuse a lot of components.

I started with a Joying Sofia 3GR on a FYT 5009 SOM (1.0 GHz), but that got toasted pretty fast. Then they sent me a FYT 6021 SOM (1.2GHz) which I could simply replace. But that was still the same CPU, like going now from a uis7862 to a UIS7862S.

And note that also the other components will show their age. If I were you and you don't want to spent a lot of money, I would buy a Mekede M400S or M500S, or even a M300S, but not with less memory. It might even be equal or cheaper than buying a new SOC/SOM to place into your old unit. And realize that you will go from 1024x600 to 1280x700 with a new unit.
And if you can and do want to spend the money go for a Mekede M6 Pro (plus ), where plus is 2000x1200 resolution.
I see, must be one of these things where "it's possible in theory" but in practice would complicate things.
Never heard of this Mekede brand but if that's what you stand by, I'll see if they have anything for my 26-year old BMW E39, although I kind of prefer physical buttons like I have right now.

Having said that, considering I'm keeping the BMW for as long as possible, in the long run might be worthwhile learning how to make my own upgrades to these HU because eventually they will stop making them for my car.

PS: From what I can see the Mekede stuff have this big screen that sticks in front of the air-vents. What about Xtrons? The external look is much closer to what the E39 originally had, just don't know if the Xtrons internal hardware and software is reliable enough.
 
Last edited:

surfer63

Senior Member
May 4, 2010
5,736
3,062
Zwolle
github.com
PS: From what I can see the Mekede stuff have this big screen that sticks in front of the air-vents. What about Xtrons? The external look is much closer to what the E39 originally had, just don't know if the Xtrons internal hardware and software is reliable enough.
They also have universal models which they call "host models" (don't ask my why). I do not know if that one will fit your E39.

I can't say much about the Xtrons apart from the fact that they are not FYT.

Joying also has several models for tyhe BMW E39.
 
  • Like
Reactions: Kyle M.

Kyle M.

Senior Member
They also have universal models which they call "host models" (don't ask my why). I do not know if that one will fit your E39.

I can't say much about the Xtrons apart from the fact that they are not FYT.

Joying also has several models for tyhe BMW E39.
Yep, Joying is what I have at the moment. It's worked pretty well overall, I've got only a few things here and there to complain about, but overall it's been fantastic considering its price.

Real shame I couldn't find anyone who'd make custom roms for them to keep them up-to-date. I think it's still on android 8 or 8.1. It's become quite slow although at its worst, it's never been as bad as the Xonrich in my wife's Opel.
 

j0hn83

Senior Member
Jan 5, 2012
302
170
I see, must be one of these things where "it's possible in theory" but in practice would complicate things.
Never heard of this Mekede brand but if that's what you stand by, I'll see if they have anything for my 26-year old BMW E39, although I kind of prefer physical buttons like I have right now.
I also have the Mekede M500s, the same unit as @surfer63

This looks like the range of Mekedes for your BMW.
 
  • Like
Reactions: Kyle M.

Kyle M.

Senior Member
They are based on the uis7862 (M300, M500, M600, M700) and the uis8581a (M200, M400)
If I may change the subject a bit and take a step back from post #583, the reason I asked about the SoM was because my unit seems to have crapped out on me:

One fine morning (without having done anything to the unit for the past year or so) the unit (JY-EU-BO123P4) has gotten stuck on the boot logo without fully booting up. After around 5 mins, it tries to restart itself and does the same all over again. This fault seems to have come out of nowhere so there isn't much I can point to.

One thing I noticed is that my phone is showing that the bluetooth is automatically connecting ie. the bluetooth service is starting. pressing the keys on the unit does not do anything (not even the beeps). I've pulled it out on and sat it on my desk today and I've been trying to flash the firmware again with an SD Card as I've done the last time I've updated it. However it is not responding to any of that and it just continues its endless bootloop.

Any ideas?


PS: quick update, after attempting many times to reset it, it finally recognised there was an SD card inside and went to recovery and reflashed the MCU. However it did not reflash the ROM or anything and when it restarted, it went to the same old bootlogo and did the whole endless loop all over again.

EDIT: after persisting many times resetting over and over again, it finally flashed and went back to normal, ie. starting from a clean unit. Leaving the post here in case someone else comes across the same problem.

Here's the basics for my Unit for the E39/X5:
- Use the RH SD card slot (LH slot is inop on these particular units)
- unzip the downloaded file from Joying and place just the content in the SD card
- reset the unit multiple times
-offer a human sacrifice to the Rockchip gods
 
Last edited:
  • Like
Reactions: surfer63

Top Liked Posts

  • There are no posts matching your filters.
  • 10
    Joying got in contact with me and asked me if I would wanted to test one of their new PX5 2GB models on Android version 8.
    I decided that I wanted to do so, so I received for some 28 euros a Joying JY-VO130P2.

    So what is it:
    8" screen 2DIN unit for VW/Skoda/Seat/Audi
    ARM Cortex based ARM V8, 1 processor 8 A53 cores (4 running at 1.5 GHz, 4 "low energy" running at 1.2 GHz)
    FYT based SOM
    2GB internal memory (RAM)
    32GB storage (ROM)
    Android version 8.0.0
    particularities: DVD-player

    I made a video review of it which you can find here:https://youtu.be/MH1snfDIU5A

    The Good:
    • seems minimally faster than the Sofia 3GR
    • FYT/syu software the same as on Sofia 3GR.
    • Android 8.0.0, longer support
    • Android 8 supports split-screen functionality out of the box.
    • Improved radio reception (but needs to be tested over longer period)
    • Improved sound quality (I think, but I forgot to mention in the review)

    The bad:
    • Too high temperatures of the cpu
    • No user configuration of buttons
    • FYT/syu software the same as on Sofia 3GR (I mean that some "weird" things are still there on the PX5 as well)
    • FYT/syu applications (radio, bt, music player, etc.) do not support split screen (and it is so simple to enable this)
    • No Android 8 Automotive integration
    • Chinese translations could be improved using on-line tooling like weblate.org or crowdin.com (or others) by using the user community.

    The really bad:
    • Too high temperatures of the cpu. It really needs better cooling.

    Update Sun 13 May 2018:
    There is indeed an issue with the WiFi on this new Version 8.0.0 model. I already mentioned in my video review that it did not auto-connect to my WiFi networks.
    - When fully rebooting the unit, it connects automatically to my home WiFi. No issue at all.
    - When coming from deep-sleep, WiFi is either switched off ór WiFi is still on, but it doesn't connect automatically to my WiFi networks.

    See update Fri 18 May

    And maybe some explanation: I mentioned in the review that it is very simple to alter the AndroidManifest.xml to allow resizing the app and make it function in split-screen. So why didn't I do that myself?
    The Joying apps are signed. Some parts can be easily changed without touching the signing, but the AndroidManifest.xml is part of that signing as it also contains the security options the application needs. Off course I do not have the Joying signature so I can't recompile the app with the same signature while the AndroidManifest.xml is obviously changed. That is exactly how it should work or any hacker could get access.
    FYT/syu should change this.

    Update Mon 14 May:
    There used to be a bug in the older ROMs that where you gave the BT access to your contacts, it would erase all your contacts.
    Well, 8.0 also erases all your contacts!
    This issue annoys me highly as it is so old and it still isn't solved.

    Update Tue 15 May:
    The Google Assistant with spoken searches does not work.
    When trying to use the voice search function (clicking the microphone in the search bar), It shows very shortly the 'Speak now' indicator before it turns into an error message that mentions "No internet connection". I checked very carefully and my internet connection is fine. I tried with 2 home WiFi networks and via hot-spot on my phone. All internet connections work fine, but Google search still gives this error message.

    Update Fri 18 May:
    See post #44

    Update Wed 23 May (test of Android auto):
    See post #54

    Update Sunday 10 June:
    See post #77
    - OK Google solved.

    Update Tuesday 12 June:
    Some update about the BT app erasing your Google contacts: Joying is now working full steam on it. Another user made a nice video on youtube about it
    4
    Do you mean there is going to be a commercial product?

    That's the idea!
    I've been using a chinese company (seeed) to print my prototype circuit boards, and I've been assembling them by hand.
    The boards have on them;
    1) TI PCM1865 ADC. This chip has 4 stereo analog inputs, 1 stereo i2s input, 2 stereo i2s outputs. I have that hooked up such that the i2s input and 1 of the i2s outputs connect to the SBC, the second i2s output is connected to the DACs, 1 stereo analog input for microphone(s), 1 stereo analog input for AMFM radio, and 2 stereo analog auxiliary line inputs. The second DSP on this chip has the ability to selectively mix any combination of inputs (whether analog or digital), adjust their relative gain, and direct them to any i2s ouput, so there is a huge amount of flexibility in the audio routing capability.
    2) 2x TI PCM5142 DACs. These chips take an i2s input and convert to analog. They also have a built in programmable DSP and volume controls.
    3) STPA003 4x52 watt automotive amplifier.
    4) Real time clock: PCF85063A with a supercapacitor backup good for around a couple of weeks. If it runs flat, no biggie because the next network connection will pull a time via NTP, reset it, and recharge it.
    5) Level shifter for 3.3v debug interface and/or 4-wire UART expansion.
    6) AMFM Radio: NXP TEF6686, and I've actually got the source code to run this thing!!! I've implemented a broadcast radio HAL for it and I have RDS working. I do NOT have AF working, but this is because no radio stations in Canada actually use AF, which means that I have no means of testing it. But all the building blocks needed for it to be implemented *ARE* there for anybody who is in a position to take it on.
    7) Microcontroller: ATSAMD21 (ARM Cortex M0+). This is needed for (a) a few 3.3v signals, (b) steering wheel interface ADCs. My code or this is open source, and can be built using Arduino IDE, and installed either from arduino ide, or on the board itself using avrdude. At the moment, I'm running a bit of a kludge with it interfacing with a daemon on the SBC that opens uinput, mainly because an earlier prototype used ATMEGA328p which interfaces with the SBC using UART. The SAMD21 interfaces using USB, so I'll eventually want to reimplement as a USB HID device.
    8) 3x input optocouplers for reading the state of car signals (acc, headlight, reverse).

    The line-level analog outputs of the DACs are also available on a header before the amplifier, for external amplifiers, and I've included another header that brings out power, i2c, and the i2s output from the ADC, which would make it possible to expand the system with up to 2 additional DACs, for up to 8 channel output. My use of that header is mainly for debug purposes where I can attach a logic analyzer, so I haven't actually designed such a board, but if there is demand, it certainly could be made to happen.

    I briefly considered adding a GPS to the board, but you can buy a U-Blox USB GPS for ~$10-$15 new from Acme-zon. Since the thing is going to need an external antenna anyway, it might as well be a more robust self contained unit rather than fiddly coaxial wire connections, and price wise, its just a complete no-brainer.

    So the minimal parts list for a completely 100% open source "ultimate" car radio;
    1) My mezzanine,
    2) A 96boards SBC (currently HiKey960, soon DragonBoard820C, or if you want to dive into the software, technically *ANY* as long as it has implemented the optional i2s input pin or offers some way to recover that pin such as the DragonBoard410C -- though I wouldn't suggest that board due to only 1 GB RAM)
    3) Vehicle specific radio pigtail. That's the wire with a plug that fits your car on one side, and a bunch of loose wires on the other side.
    4) HDMI+USB Touch display.
    5) USB GPS.
    6) Analog microphone.

    And that's a pretty easy list, I think. The pigtail will need to be soldered onto the mezzanine board, which I set up to be extremely easy to solder to, the display will have to be mounted somehow, and everything else just snaps together.

    Another thing I've managed to accomplish, is to completely hijack the 7" 1024x600 displays on joying radios. The LCD was never a problem, just plug it into an HDMI converter board and its working, attach a PWM pin from the microcontroller to the converter board to control the brightness. I had a problem on an earlier attempt to deal with the touch sensor, but more recently discovered that they actually mislabelled the ribbon wire. In fact I have two very different touchscreens sold by joying, and found them both to be mislabelled, which means that it must be intentional. Once that's been discovered, they're just generic GT911 i2c digitizers, and can be used either with a USB touchscreen controller, or goodix driver in the linux kernel.

    Optional stuff: USB hub and some UVC cameras. These can be rigged up in any way imaginable. I use 2 for front/back dashcam and record to sdcard, but they can be used for reverse camera or parking assist if so desired.

    Oh, did I mention the killer feature? Its 100% open source. AOSP Master! (plus a few of my own pieces, which are also open source. Hope to eventually upstream most of it).
    4
    whos ready to test a custom rom? post here!
    4
    This works to turn off the keypad tone

    "Go to the setting - factory - password 3368 - AMP Enable - No Amp, then back to setting - device - sound, you will got the Keypad tone option"
    3
    That's awesome news!

    I have a question about CAN (more on topic). I'm trying to understand how the SOM, MCU and CAN box all communicate. I have downloaded the datasheet for my MCU. It's a simple 8 bit ST part (in fact if we could find a disassembler we could easily understand the assembly but so far I have had no luck in finding one as there are only currently 32 bit ones in the wild...I'll keep trying). It has a CAN peripheral but I can't understand why it would be used when there is an external CAN box.

    My guess is that the CAN box is configured to filter IDs for a specific car from the factory. It converts CAN messages into some sort of UART standard protocol and then sends that to the MCU. The MCU then relays that on to the SOM, again using a standard protocol.

    If my guess is correct it means that the android build should not affect the ability of the unit to interpret CAN information at all since by the time it gets to the SOM it has been converted into a protocol that any build can understand. This would mean that even if a Witson user flashes a Joying ROM but retains their MCU code then all of their CAN functionality should remain.

    Understanding this process will also help the process of reverse engineering the MCU code. Is my guess anywhere close? Do you have any further info on this?

    I suspect that you will find, in very short order, that these chinese car radios are a lot more frustration than they're worth, at least if your objective is to end up with something that actually works *really well*.

    From what I understand of the situation, the real issue is cultural. In China, they don't place a very high value on innovation, rather they place a very high value on conformity. Part of that is political, I'm sure, as you probably don't want to make yourself stand out too much under that type of a political regime. At the end of the day, it means that what you produce is simply regurgitation of what you had before. Yeah, maybe this iteration includes a faster and newer CPU core, which isn't innovative, because they're just licensing (or "borrowing") newer IP from ARM, which is from the UK, where they DO value innovation.

    You can actually follow these things backwards and figure out how they ended up in such a disorganized mess. It traces back to building car radios using mobile versions of windows. You see, if you go back and look even at mainstream aftermarket car radios from several years ago, like your kenwoods and pioneers, you can actually open them up and find that each of the primary "applications" will correspond to a separate piece of *hardware*. So you'll have your garmin navigation board. You'll have your bluetooth board. You'll have your radio board. You'll have your windows board... and these pieces will all be tied together by another board with an MCU and a display switch. The buttons and the touchscreen will be connected to the MCU, and the MCU will set some mode for the rest of the system to operate in, will set the display switch to have the corresponding device's output showing on the screen, and will route data from the buttons and the touchscreen to that particular device.

    That's pretty cumbersome, but its what you have to do when you're stuck using simplistic, buggy, closed source software.

    Now where the cultural problem comes in is this; with the introduction of Android as a replacement for Windows, they failed to take full advantage of the increased flexibility to manipulate the hardware directly. Instead of completely rethinking the hardware, they just plunked Android in place of Windows and called it good. You see, there's no innovation. They just replace one piece for another and keep everything connected the same way. And then something changes -- like the navigation provider no longer offers a board to physically integrate with the unit, instead, they only offer a piece of software. Now for you or me, this seems like an ideal opportunity to restructure things easily, because the MCU mode concept no longer applies to the navigation. But they don't innovate, so they keep the MCU mode concept, and create a layer of software to link the MCU and the state of the navigation software together unnecessarily. And the sound -- they had an external sound mixer controlled by the MCU to decide which sound source should play back, and even though Android can control it (because they had to extend the mode concept into software that runs on Android), they keep it with the MCU.

    And what you can see now, is a massively complex piece of horribly buggy and completely unnecessary software that is running just to avoid having to rethink the relationships between the different elements of the system. And this is even after Android is basically forcing a new paradigm on them by implementing the entire IVI interface and providing HALs and state machines to manage all the different aspects of car hardware. Presuming that they aren't outright lying about having stepped up to Android 8, then they must have gone to rather extreme lengths just to keep on with their buggy and horribly out of date approach. And we all know that they make absolutely horrible compromises in the security of the devices in order to accomplish this, things like setting selinux to permissive. Hacks to "make it work".

    Now here is the crazy thing.... you have at least two outfits whose business is to actually manufacture the hardware and make these car radios work -- you've got FYT and you've got MTC. Each of them have a bunch of people who are working their butts off to avoid doing anything that is even remotely innovative -- just make the same thing work with the newer hardware, or the newer Android, or whatever. And then on the flip side, you can have *just one guy* do, in his spare time, something like this; https://gitlab.com/HiKey960-Car -- and that is using the full and proper Android 8 (or 9, its all open source...) Automotive IVI interface, and controlling all the hardware properly using HALs that are designed for the particular purposes. The sound is all controlled by the Audio HAL. The AMFM radio is controlled by the broadcastradio HAL. The GPS is controlled by the GPS HAL. etc. There is still an MCU, but that is mainly for its ADC in order to implement the steering wheel interface.


    So to address your question about the MCU and its relationship to CAN, why it has both an external CAN controller as well as one built into the MCU.... They're not using the one built into the MCU because doing so would require them to write new code for the MCU in order to do the same thing that they see as already working, and that is borderline innovative, so we can't have that.

    The can box doesn't filter much (or anything). There is a poop ton of vehicle specific code for can in their mess of unnecessary java code.

    Now to be quite honest with you, I would never even consider attaching the CAN interface of a chinese car radio up to my car. And the reason is that it introduces a *safety* threat. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9493/ -- if you read that, you'll see that in the vehicle in question, they had to (a) hack the wifi, (b) hack the cellular network connection, (c) hack the IVI, (d) hack from that into another device that had CAN access because this IVI wasn't actually connected to the CAN directly, (e) rewrite the firmware on a CAN interface controller. After all this, they were able to control things like *steering and brakes*, completely remotely over the internet, wherever the vehicle happened to be.

    That kind of hack is scary as heck, and in that case, there was a setup that clearly had a whole bunch of security features implemented, like an "air gap" between the radio and the CAN, and a CAN controller that was programmed to read, but not write. Even with all that, they were able to take over the vehicle and crash it off the road. Now if you want my opinion on connecting a chinese car radio directly to a car's CAN... not a chance! That chinese car radio has no air gap. Its CAN controller is NOT programmed to read-only. That radio has security features intentionally disabled by the manufacturer. That radio actually makes network connections to various untrusted/untrustworthy servers all over the world with unknown security problems (connect it to your home wifi/router and take a peek at the TCP connections it establishes).