DJI Phantom 2 Vision FC200 EGG camera - Black video FPV solution to fix

[quaddamage]

what to do next?

I am able to extracts part of the images myself. Then will compare them to find most reliable one. Will contact O-Gs as well when I'm done, so they can update their wiki.

You stated before that the reason of my current board is sometimes starting sometimes not is a damaged ubifs?

So you see these issues even if you're not pressing ctrl+c at boot?
I assumed that's all because you're terminating random things at startup.

 

[szupek]

So you see these issues even if you're not pressing ctrl+c at boot?

yes, exactly, even if I am not touching anything, I can see:
No valid boot image found!
NAND Boot failed.
Aborting...

Sometimes a few power cycles in a row, it is booting up normally, other time, a few times in a row I can see above message.

 

[szupek]

uboot damaged?

DM36x initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Valid magicnum, 0xA1ACED66, found in block 0x0000001C.
Valid magicnum, 0xA1ACED66, found in block 0x0000001F.
Valid magicnum, 0xA1ACED66, found in block 0x00000022.
Valid magicnum, 0xA1ACED66, found in block 0x00000025.
Valid magicnum, 0xA1ACED66, found in block 0x00000028.
Valid magicnum, 0xA1ACED66, found in block 0x0000002B.
Valid magicnum, 0xA1ACED66, found in block 0x0000002E.
No valid boot image found!
NAND Boot failed.
Aborting...
DM36x initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Valid magicnum, 0xA1ACED66, found in block 0x0000001C.
Valid magicnum, 0xA1ACED66, found in block 0x0000001F.
Valid magicnum, 0xA1ACED66, found in block 0x00000022.
Valid magicnum, 0xA1ACED66, found in block 0x00000025.
Valid magicnum, 0xA1ACED66, found in block 0x00000028.
Valid magicnum, 0xA1ACED66, found in block 0x0000002B.
Valid magicnum, 0xA1ACED66, found in block 0x0000002E.
No valid boot image found!
NAND Boot failed.
Aborting...
DM36x initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Valid magicnum, 0xA1ACED66, found in block 0x0000001C.
Valid magicnum, 0xA1ACED66, found in block 0x0000001F.
Valid magicnum, 0xA1ACED66, found in block 0x00000022.
Valid magicnum, 0xA1ACED66, found in block 0x00000025.
Valid magicnum, 0xA1ACED66, found in block 0x00000028.
Valid magicnum, 0xA1ACED66, found in block 0x0000002B.
Valid magicnum, 0xA1ACED66, found in block 0x0000002E.
No valid boot image found!
NAND Boot failed.
Aborting...
DM36x initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
   DONE
Jumping to entry point at 0x81080000.


U-Boot 2010.12-rc2 (Sep 04 2013 - 20:37:37)

Cores: ARM 297 MHz
DDR:   243 MHz
I2C:   ready
DRAM:  128 MiB
NAND:  boot ==1
uboot-v1.0-uboot-block0
128 MiB
MMC:   davinci: 0, davinci: 1
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
Net:   Read from EEPROM @ 0x50 failed
Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Hit any key to stop autoboot:  0

Loading from nand0, offset 0x680000
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2013-07-23   3:12:28 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2118348 Bytes = 2 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Booting kernel from Legacy Image at 80700000 ...
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2013-07-23   3:12:28 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2118348 Bytes = 2 MiB
   Load Address: 80008000
   Entry Point:  80008000

After each aborting I am repowering the board.

 

[quaddamage]

uboot damaged?

Yes, that would suggest u-boot damage. Though you just dumped u-boot and it doesn't look that bad (though some copies are different for some reason...).

You may try re-flashing u-boot, but I suspect there may be a HW failure.

Here's the kernel and u-boot:

easyupload.io

easyupload.io

easyupload.io

 

[Habb]

Thank you Habb!
Yes i have 3.3V to BSEL me too because also my TP10 has voltage lower than 2.8V; but if i put 5V instead of 3.3V to TP8 the ExtraPutty don't connects to the board at all;

Maintaining BSEL connected to 3.3V, my bootloader reflashing process never go to end;
disconnecting BSEL after joinig BOOTME status and then launching the reflash twice it goes to
similar to the loop i seen the first time i connected the board to Putty...

Which pad do you feed 5V? TP8 or other?
To reflash the bootloader do you keep BSEL always connected or not?

Thank you again

yes TP8 is getting 5 volts. I’ve actually wired a switch in the 5v circuit to have a little more control over when it gets power. (In an effort to prepare for reflashing the kernel.)
I keep bsel always connected during the flash. It’s worth mentioning that the board did funny things with the 3.3v wired to the wrong side of the resistor.

I know it’s a little blurry but this is how I’ve soldered to bsel.
i have flashed the the guacho boot image on this board. as soon as the kernel is uploaded I’ll give it a go.

 

[quaddamage]

I got informed that the kernel I uploaded is really two kernels.. I'm not sure if I can separate them.
I can't see two copies of something similar if I look inside.

EDIT: Instructions on the wiki are now updated; you can get a proper kernel there:

Flashing firmware on DaVinci media processors

Tools for handling firmwares of DJI products, with focus on quadcopters. - o-gs/dji-firmware-tools

github.com

 

[szupek]

Guys, I am succesful with ubl and u-boot flashing.
In my case I provided 5V as a power, there were 3.8V on TP10, I connected TP 10 with the middle resistor out of three (on the side, where adjacent 4 resistors are located).
Everything went smooth, a lof of data was moved after ubifs was mounted.
The primary kernel has some CRC issues, recovery was started.

My question is how I can flash primary kernel in case I cannot abort autoboot.
right before loading from nand, ESC should do the job. In case of P3PRO board it is one second to abort it, here 0 id being displayed immediately. Is it a parameter that can be extended somehow? Provided some kernel is booting it should be doable fro the console, but what when both kernel images are corrupted?

ad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
Net:   Read from EEPROM @ 0x50 failed
Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Hit any key to stop autoboot:  0

Loading from nand0, offset 0x680000

 

[quaddamage]

My question is how I can flash primary kernel in case I cannot abort autoboot.

Isn't that obvious? Press the key, then connect power.

For how to change that - read u-boot documentation. u-boot is an open-source project.

Provided some kernel is booting it should be doable fro the console, but what when both kernel images are corrupted?

If both kernels are corrupted, u-boot will automatically put you into its console. After all, there's no other place to go in such case.

 

[szupek]

Isn't that obvious? Press the key, then connect power.

I tried this option as well no result I tried stroking Escape, keept it pressed - no reaction.


I tried reflashing ubl and U-boot on the other board, the one I originally used for a FW dumping and **** hit the fan :|

 initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
 initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
 initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
 initialization passed!
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...

It is in a continous loop. I am wondering why there is " initialization passed!" instead of "DM36x initialization passed!"

I am affrad that this is a NAND mallfunction.

 

[quaddamage]

I tried this option as well no result I tried stroking Escape, keept it pressed - no reaction.

Oh.. then I guess the only option would be to modify the bootloader so it stops for longer.

 

[popeye]

It is in a continous loop. I am wondering why there is " initialization passed!" instead of "DM36x initialization passed!"

I am affrad that this is a NAND mallfunction.

I'm stuck with this damned boot loop too, since the first time I opened a Putty window...and even flashing the new .img files you extracted, the situation has not changed.

 

[szupek]

I had something similiar with my last p3x board, I was able to flash it without a problem, but it either ended up in a continous loop or got stuck at a certain point. The remedy was to resolder the NAND chip, flash ubl and uboot, then secondary kernel, then small linux distrubution where a primary kernel should be, boot it, take care of ubifs, flash primary kernel and voila

@quaddamage, is the uboot you posted a few posts earlier derived from mu dump? Or you had something else?

 

[quaddamage]

@quaddamage, is the uboot you posted a few posts earlier derived from mu dump?

Yes.

I think the "wait for ESC" part is in the smaller part.. maybe you can combine smaller part from Lightbridge with larger part from FC200?
I think this may work, and may give you the 1s delay.

 

[popeye]

I had something similiar with my last p3x board, I was able to flash it without a problem, but it either ended up in a continous loop or got stuck at a certain point. The remedy was to resolder the NAND chip, flash ubl and uboot, then secondary kernel, then small linux distrubution where a primary kernel should be, boot it, take care of ubifs, flash primary kernel and voila

Oh, this is a bit beyond my abilities...
I think the time has come for me to abandon this board, and start taking apart the second faulty egg i have!

 

[Habb]

I tried reflashing ubl and U-boot on the other board, the one I originally used for a FW dumping and **** hit the fan :|

I reflashed my project board with the ubl and U-boot posted and had similar (unsuccessful) results. Was able to recover what I think is proper boot sequence with the gaucho images. I have not tried the kernel you uploaded yet yesterday. I previously tried the amberella kernel and no dice (was not really expecting it to work).
To get command in the DJI# console I wired a switch in the 5v circuit that powers the board. I found it easier to time hitting esc at the right time with this method.

 

[popeye]

Oh god of Phantoms!

Habb, my great friend Habb, after reading your last message I went to take back my fu@@ing board that I had already set aside, and now ...

So, now let's go fight with the kernel!

 

[quaddamage]

So, now let's go fight with the kernel!

Hm, this bootloader probably isn't from FC200.. memory map doesn't match:
O-Gs wiki: DeVinci FW structure and mem map

Are you sure you got one from the archive I published?

If you force-change the memory map, you will have to rewrite all partitions at new places.

 

[popeye]

No i used the gaucho .img files, like Habb before...the only ones with which I managed to restore the boot (no luck with your GL300's, and no luck with the FC200's recently posted).

But until now you always said that the boot should work fine even if reflashed with those...so isn't it? We must necessarily use the img files from szupek's FC200?

 

[quaddamage]

But until now you always said that the boot should work fine even if reflashed with those...so isn't it? We must necessarily use the img files from szupek's FC200?

Yes, looks like it.. The bootloader seem to store the memory map.
So in the past, I was wrong. I am not sure if you need both of the bootloader files though, or only one.

 

[Habb]

Oh god of Phantoms!

Habb, my great friend Habb, after reading your last message I went to take back my fu@@ing board that I had already set aside, and now ...
So, now let's go fight with the kernel!

excellent!
I’m worried there’s more to it than what we’ve got so far. I’m thinking the kernel we uploaded may need some work/tweaking. I wouldn’t flash it yet unless you’re like me and just have to test everything ? . I went through it this morning and it’s still showing a bad kernel.( Or a bad root and I’m not sure I can recover from that.) Although I suppose if you do flash it and it’s successful than that will tell me something about mine.
I’ll tinker some more when I get time and I’ll try to get a putty log posted.
also, getting command with a bad kernel is super hard with extraputty, Teraterm is a little easier.