Hi guys. Maybe and hopefully someone of you can help me here. I bought a used Android system based on the Winca S200 with ZHAN_(NOR) MCU for the Opel Astra J. While looking for new system software I stupidly flashed a newer system version, but...
This unit should be also FYT-based PX5, 2GB RAM/32GB ROM and octa core CPU. I need help here to find the factory firmware and mcu (I flashed wrong mcu, the canbus-box is not detected). Maybe Joying firmware also works on these units? Anyone who has the same hardware and already got support?
Joying got in contact with me and asked me if I would wanted to test one of their new PX5 2GB models on Android version 8.
I decided that I wanted to do so, so I received for some 28 euros a Joying JY-VO130P2.
So what is it:
8" screen 2DIN unit for VW/Skoda/Seat/Audi
ARM Cortex based ARM V8, 1 processor 8 A53 cores (4 running at 1.5 GHz, 4 "low energy" running at 1.2 GHz)
FYT based SOM
2GB internal memory (RAM)
32GB storage (ROM)
Android version 8.0.0
Android 8 supports split-screen functionality out of the box.
Improved radio reception (but needs to be tested over longer period)
Improved sound quality (I think, but I forgot to mention in the review)
Too high temperatures of the cpu
No user configuration of buttons
FYT/syu software the same as on Sofia 3GR (I mean that some "weird" things are still there on the PX5 as well)
FYT/syu applications (radio, bt, music player, etc.) do not support split screen (and it is so simple to enable this)
No Android 8 Automotive integration
Chinese translations could be improved using on-line tooling like weblate.org or crowdin.com (or others) by using the user community.
The really bad:
Too high temperatures of the cpu. It really needs better cooling.
Update Sun 13 May 2018: There is indeed an issue with the WiFi on this new Version 8.0.0 model. I already mentioned in my video review that it did not auto-connect to my WiFi networks.
- When fully rebooting the unit, it connects automatically to my home WiFi. No issue at all.
- When coming from deep-sleep, WiFi is either switched off ór WiFi is still on, but it doesn't connect automatically to my WiFi networks.
See update Fri 18 May
And maybe some explanation: I mentioned in the review that it is very simple to alter the AndroidManifest.xml to allow resizing the app and make it function in split-screen. So why didn't I do that myself?
The Joying apps are signed. Some parts can be easily changed without touching the signing, but the AndroidManifest.xml is part of that signing as it also contains the security options the application needs. Off course I do not have the Joying signature so I can't recompile the app with the same signature while the AndroidManifest.xml is obviously changed. That is exactly how it should work or any hacker could get access.
FYT/syu should change this.
Update Mon 14 May:
There used to be a bug in the older ROMs that where you gave the BT access to your contacts, it would erase all your contacts.
Well, 8.0 also erases all your contacts!
This issue annoys me highly as it is so old and it still isn't solved.
Update Tue 15 May:
The Google Assistant with spoken searches does not work.
When trying to use the voice search function (clicking the microphone in the search bar), It shows very shortly the 'Speak now' indicator before it turns into an error message that mentions "No internet connection". I checked very carefully and my internet connection is fine. I tried with 2 home WiFi networks and via hot-spot on my phone. All internet connections work fine, but Google search still gives this error message.
That's the idea!
I've been using a chinese company (seeed) to print my prototype circuit boards, and I've been assembling them by hand.
The boards have on them;
1) TI PCM1865 ADC. This chip has 4 stereo analog inputs, 1 stereo i2s input, 2 stereo i2s outputs. I have that hooked up such that the i2s input and 1 of the i2s outputs connect to the SBC, the second i2s output is connected to the DACs, 1 stereo analog input for microphone(s), 1 stereo analog input for AMFM radio, and 2 stereo analog auxiliary line inputs. The second DSP on this chip has the ability to selectively mix any combination of inputs (whether analog or digital), adjust their relative gain, and direct them to any i2s ouput, so there is a huge amount of flexibility in the audio routing capability.
2) 2x TI PCM5142 DACs. These chips take an i2s input and convert to analog. They also have a built in programmable DSP and volume controls.
3) STPA003 4x52 watt automotive amplifier.
4) Real time clock: PCF85063A with a supercapacitor backup good for around a couple of weeks. If it runs flat, no biggie because the next network connection will pull a time via NTP, reset it, and recharge it.
5) Level shifter for 3.3v debug interface and/or 4-wire UART expansion.
6) AMFM Radio: NXP TEF6686, and I've actually got the source code to run this thing!!! I've implemented a broadcast radio HAL for it and I have RDS working. I do NOT have AF working, but this is because no radio stations in Canada actually use AF, which means that I have no means of testing it. But all the building blocks needed for it to be implemented *ARE* there for anybody who is in a position to take it on.
7) Microcontroller: ATSAMD21 (ARM Cortex M0+). This is needed for (a) a few 3.3v signals, (b) steering wheel interface ADCs. My code or this is open source, and can be built using Arduino IDE, and installed either from arduino ide, or on the board itself using avrdude. At the moment, I'm running a bit of a kludge with it interfacing with a daemon on the SBC that opens uinput, mainly because an earlier prototype used ATMEGA328p which interfaces with the SBC using UART. The SAMD21 interfaces using USB, so I'll eventually want to reimplement as a USB HID device.
8) 3x input optocouplers for reading the state of car signals (acc, headlight, reverse).
The line-level analog outputs of the DACs are also available on a header before the amplifier, for external amplifiers, and I've included another header that brings out power, i2c, and the i2s output from the ADC, which would make it possible to expand the system with up to 2 additional DACs, for up to 8 channel output. My use of that header is mainly for debug purposes where I can attach a logic analyzer, so I haven't actually designed such a board, but if there is demand, it certainly could be made to happen.
I briefly considered adding a GPS to the board, but you can buy a U-Blox USB GPS for ~$10-$15 new from Acme-zon. Since the thing is going to need an external antenna anyway, it might as well be a more robust self contained unit rather than fiddly coaxial wire connections, and price wise, its just a complete no-brainer.
So the minimal parts list for a completely 100% open source "ultimate" car radio;
1) My mezzanine,
2) A 96boards SBC (currently HiKey960, soon DragonBoard820C, or if you want to dive into the software, technically *ANY* as long as it has implemented the optional i2s input pin or offers some way to recover that pin such as the DragonBoard410C -- though I wouldn't suggest that board due to only 1 GB RAM)
3) Vehicle specific radio pigtail. That's the wire with a plug that fits your car on one side, and a bunch of loose wires on the other side.
4) HDMI+USB Touch display.
5) USB GPS.
6) Analog microphone.
And that's a pretty easy list, I think. The pigtail will need to be soldered onto the mezzanine board, which I set up to be extremely easy to solder to, the display will have to be mounted somehow, and everything else just snaps together.
Another thing I've managed to accomplish, is to completely hijack the 7" 1024x600 displays on joying radios. The LCD was never a problem, just plug it into an HDMI converter board and its working, attach a PWM pin from the microcontroller to the converter board to control the brightness. I had a problem on an earlier attempt to deal with the touch sensor, but more recently discovered that they actually mislabelled the ribbon wire. In fact I have two very different touchscreens sold by joying, and found them both to be mislabelled, which means that it must be intentional. Once that's been discovered, they're just generic GT911 i2c digitizers, and can be used either with a USB touchscreen controller, or goodix driver in the linux kernel.
Optional stuff: USB hub and some UVC cameras. These can be rigged up in any way imaginable. I use 2 for front/back dashcam and record to sdcard, but they can be used for reverse camera or parking assist if so desired.
Oh, did I mention the killer feature? Its 100% open source. AOSP Master! (plus a few of my own pieces, which are also open source. Hope to eventually upstream most of it).
I have a question about CAN (more on topic). I'm trying to understand how the SOM, MCU and CAN box all communicate. I have downloaded the datasheet for my MCU. It's a simple 8 bit ST part (in fact if we could find a disassembler we could easily understand the assembly but so far I have had no luck in finding one as there are only currently 32 bit ones in the wild...I'll keep trying). It has a CAN peripheral but I can't understand why it would be used when there is an external CAN box.
My guess is that the CAN box is configured to filter IDs for a specific car from the factory. It converts CAN messages into some sort of UART standard protocol and then sends that to the MCU. The MCU then relays that on to the SOM, again using a standard protocol.
If my guess is correct it means that the android build should not affect the ability of the unit to interpret CAN information at all since by the time it gets to the SOM it has been converted into a protocol that any build can understand. This would mean that even if a Witson user flashes a Joying ROM but retains their MCU code then all of their CAN functionality should remain.
Understanding this process will also help the process of reverse engineering the MCU code. Is my guess anywhere close? Do you have any further info on this?
I suspect that you will find, in very short order, that these chinese car radios are a lot more frustration than they're worth, at least if your objective is to end up with something that actually works *really well*.
From what I understand of the situation, the real issue is cultural. In China, they don't place a very high value on innovation, rather they place a very high value on conformity. Part of that is political, I'm sure, as you probably don't want to make yourself stand out too much under that type of a political regime. At the end of the day, it means that what you produce is simply regurgitation of what you had before. Yeah, maybe this iteration includes a faster and newer CPU core, which isn't innovative, because they're just licensing (or "borrowing") newer IP from ARM, which is from the UK, where they DO value innovation.
You can actually follow these things backwards and figure out how they ended up in such a disorganized mess. It traces back to building car radios using mobile versions of windows. You see, if you go back and look even at mainstream aftermarket car radios from several years ago, like your kenwoods and pioneers, you can actually open them up and find that each of the primary "applications" will correspond to a separate piece of *hardware*. So you'll have your garmin navigation board. You'll have your bluetooth board. You'll have your radio board. You'll have your windows board... and these pieces will all be tied together by another board with an MCU and a display switch. The buttons and the touchscreen will be connected to the MCU, and the MCU will set some mode for the rest of the system to operate in, will set the display switch to have the corresponding device's output showing on the screen, and will route data from the buttons and the touchscreen to that particular device.
That's pretty cumbersome, but its what you have to do when you're stuck using simplistic, buggy, closed source software.
Now where the cultural problem comes in is this; with the introduction of Android as a replacement for Windows, they failed to take full advantage of the increased flexibility to manipulate the hardware directly. Instead of completely rethinking the hardware, they just plunked Android in place of Windows and called it good. You see, there's no innovation. They just replace one piece for another and keep everything connected the same way. And then something changes -- like the navigation provider no longer offers a board to physically integrate with the unit, instead, they only offer a piece of software. Now for you or me, this seems like an ideal opportunity to restructure things easily, because the MCU mode concept no longer applies to the navigation. But they don't innovate, so they keep the MCU mode concept, and create a layer of software to link the MCU and the state of the navigation software together unnecessarily. And the sound -- they had an external sound mixer controlled by the MCU to decide which sound source should play back, and even though Android can control it (because they had to extend the mode concept into software that runs on Android), they keep it with the MCU.
And what you can see now, is a massively complex piece of horribly buggy and completely unnecessary software that is running just to avoid having to rethink the relationships between the different elements of the system. And this is even after Android is basically forcing a new paradigm on them by implementing the entire IVI interface and providing HALs and state machines to manage all the different aspects of car hardware. Presuming that they aren't outright lying about having stepped up to Android 8, then they must have gone to rather extreme lengths just to keep on with their buggy and horribly out of date approach. And we all know that they make absolutely horrible compromises in the security of the devices in order to accomplish this, things like setting selinux to permissive. Hacks to "make it work".
Now here is the crazy thing.... you have at least two outfits whose business is to actually manufacture the hardware and make these car radios work -- you've got FYT and you've got MTC. Each of them have a bunch of people who are working their butts off to avoid doing anything that is even remotely innovative -- just make the same thing work with the newer hardware, or the newer Android, or whatever. And then on the flip side, you can have *just one guy* do, in his spare time, something like this; https://gitlab.com/HiKey960-Car -- and that is using the full and proper Android 8 (or 9, its all open source...) Automotive IVI interface, and controlling all the hardware properly using HALs that are designed for the particular purposes. The sound is all controlled by the Audio HAL. The AMFM radio is controlled by the broadcastradio HAL. The GPS is controlled by the GPS HAL. etc. There is still an MCU, but that is mainly for its ADC in order to implement the steering wheel interface.
So to address your question about the MCU and its relationship to CAN, why it has both an external CAN controller as well as one built into the MCU.... They're not using the one built into the MCU because doing so would require them to write new code for the MCU in order to do the same thing that they see as already working, and that is borderline innovative, so we can't have that.
The can box doesn't filter much (or anything). There is a poop ton of vehicle specific code for can in their mess of unnecessary java code.
Now to be quite honest with you, I would never even consider attaching the CAN interface of a chinese car radio up to my car. And the reason is that it introduces a *safety* threat. https://www.kaspersky.com/blog/blackhat-jeep-cherokee-hack-explained/9493/ -- if you read that, you'll see that in the vehicle in question, they had to (a) hack the wifi, (b) hack the cellular network connection, (c) hack the IVI, (d) hack from that into another device that had CAN access because this IVI wasn't actually connected to the CAN directly, (e) rewrite the firmware on a CAN interface controller. After all this, they were able to control things like *steering and brakes*, completely remotely over the internet, wherever the vehicle happened to be.
That kind of hack is scary as heck, and in that case, there was a setup that clearly had a whole bunch of security features implemented, like an "air gap" between the radio and the CAN, and a CAN controller that was programmed to read, but not write. Even with all that, they were able to take over the vehicle and crash it off the road. Now if you want my opinion on connecting a chinese car radio directly to a car's CAN... not a chance! That chinese car radio has no air gap. Its CAN controller is NOT programmed to read-only. That radio has security features intentionally disabled by the manufacturer. That radio actually makes network connections to various untrusted/untrustworthy servers all over the world with unknown security problems (connect it to your home wifi/router and take a peek at the TCP connections it establishes).