Fixing flash in DM365 chip within Ph3 Pro gimbal

Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Here is a success story I wanted to share.

I had a Phantom 3 Pro gimbal which didn't allowed me to see the FPV feed. Photos and movies were recorded on sd-card, there was just no live video - only grey background - in Dji Go.

By connecting another gimbal, I narrowed down the problem to gimbal itself - a different gimbal (which had the same firmware installed) worked fine.

If you need to diagnose the cause of your issue, do not just assume it's the same as described here; to through the diagnosis graph to find your cause:
Fix no video feed / black screen / no image transmission / no FPV on Ph3 Pro


Then I disassembled the gimbal. I looked at available information about the board:
WM320 Gimbal top board · mefistotelis/phantom-firmware-tools Wiki · GitHub

On the schematic, video feed is encoded by media processor model DM365:
dji-hardware-schematics/phantom_3_pro_overview.pdf at master · mefistotelis/dji-hardware-schematics · GitHub

To check whether the media processor is working correctly, I tapped to UART interface of the DM365 chip with TTL-to-USB converter (aka FTDI). See here for details:
Firmware m0800 · mefistotelis/phantom-firmware-tools Wiki · GitHub

I opened PuTTY on the interface before connecting 5V power for the board, then connected the power. There was no output on the console while the board was booting. But the board was booting - I was able to see the diode blinking on it. Which means either my FTDI configuration was bad, or the chip just wasn't producing any output.

To check which is true (and also fix the issue if this turns out to be a chip boot issue), I shorted the boot pins to 3.3V and connected the board to PC again. This should cause the DM365 chip to boot internally, without use of NAND. This time I was able to see a series of "BOOTME BOOTME BOOTME" messages. This ment my FTDI configuration is fine, the DM365 chip really wasn't printing anything when trying to boot from NAND.

Here is the NAND chip with number "3" drawn on it:

If DM365 chip isn't printing anything, then the bootloader on NAND is damaged. I tried flashing the bootloader using instructions from here:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub

But I wasn't able to flash the image. Flashing was ending with message about failure to open NAND:
Code:
Waiting for SFT on the DM36x...
        Target: Starting UART Boot...
        Target: BOOTUBL
BOOTUBL commmand received. Returning CMD and command...
CMD value sent.  Waiting for DONE...
        Target:    DONE
DONE received. Command was accepted.
Sending the UBL image
Waiting for SENDIMG sequence...
        Target: NAND_open() failed!Starting UART Boot...
        Target: BOOTUBL
Conclusion - The NAND chip is either not touching the board correctly and needs re-flowing the solder, or is damaged and needs replacing. I gathered a cheapest BGA soldering equipment I could find:

With the equipment received from China, I went to action. I used heat-resistant tape to shield the components around NAND. First I tried heating-up the NAND chip and re-flowing it, but nothing changed - still "NAND_open() failed". Then I heated it up again and gently pressed the chip, to make any smaller solder balls connect. Unfortunately, that connected too much - the chip became a short, and caused the whole FTDI to disconnect because of high current draw. I tried heating up the chip even more to make it wiggle and re-form the solder balls, but couldn't do this - the chip is so large that it won't dance under the hot air, and the ultra-cheap soldering station won't allow me to increase the air flow enoughly.

So I bought a few replacement NAND chips in China. Removed the old chip, cleaned the pads with wick, put a little soldering paste on it and soldered a new chip, placing it very carefully to the white outline of the chip visible on the board.

Then, when I connected it back to PC - I was able to write bootloader to the flash. It worked! I had to do several tries though, probably because of poor quality (or too long) cables. [EDIT: now I know it was not due to cables, but because my USB port couldn't deliver enough (over 700mA @5V) power] Here is my flashing configuration:

After the bootloader was flashed, I disconnected the green cable which was causing it to boot internally and spew BOOTME:

Without this cable, the chip should get back to trying to boot from NAND. I connected it back to PC to check whether bootloader works. And it does!

Now, I need a full image of a working NAND to make the rest of it work, but it's already a success.
Anyway, if anyone happens to have such image, or has FTDI connected and can download it from the board - I'll be interested in that.
 
Last edited:
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Since transferring 128MB image over serial port is risky, I soldered female USB port to the board, so that I can connect SD-card reader to DaVinci Linux. The port is working - I was able to transfer the kernel through it, based on the instructions here:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub

Here is the photo of the gimbal board with port attached:

To avoid damaging the ribbon cable which connects gimbal to OFDM, I soldered the USB data cables to a pin socket with 1.25mm spacing I bough in china. As seen on the photo, the socket has 8 pins and the cable plug has only 6 - but I was able to plug it without issues.

Now I only need the full image to flash.
 
Last edited:
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Time for a final act of the story.

The wiki was recently updated with downloads of all firmware partitions for the Gimbal Top board:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub

Well, to be exact, all besides the partitions which are part of every firmware update. But these can be easily extracted from any of the firmware updates:
Code:
./dji_fwcon.py -vvv -x -p P3X_FW_V01.07.0060.bin
openssl des3 -d -k Dji123456 -in P3X_FW_V01.07.0060_m0800.bin  -out P3X_FW_V01.07.0060_m0800_decrypted.tar.gz
tar -zxf P3X_FW_V01.07.0060_m0800_decrypted.tar.gz
After the files are extracted, dji/data/uImage file can be just flashed directly as primary kernel, and u-boot partitions need one more operation:
Code:
dd if=dji/data/u-boot.img of=u-boot_prop.img bs=2048 skip=1
dd if=dji/data/ubl_297m_1.img of=ubl_297m_1_prop.img bs=2048 skip=1
So the commands above, plus the downloads from wiki, gave me the complete set of partitions:
- two u-boot images (u-boot_prop.img and ubl_297m_1_prop.img)
- primary kernel (uImage)
- recovery kernel (uImage_recovery)
- secret partition (dm365_secret.bin)
- root filesystem (dm365_root_ubifs.ubi)

I wrote all the images as instructed on the wiki. Only root filesystem is a bit tricky - it is written in a different way than other images, and also it is the largest image. Not too large though - transferring it over serial shouldn't take more than 2 hours (I was able to use USB, so the transfer was very fast).

On the USB - while mine was working, it looks like only on some boards the USB is easy to start. If it doesn't want to work, it is better to just use serial - the root filesystem image is small enough to fit on ramdisk while the recovery system is started (the wiki describes how to prepare a recovery system).

After everything has been flashed, the board started restarting continously due to no connection to OFDM board:
Code:
DM36x initialization passed!
UBL Product Vesion : DJI-297M-UBL-1.0-rc0(2015-10-30)
Dji UBL Version: 1.51(Nov  2 2015 - 15:45:39)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
   DONE
Jumping to entry point at 0x81080000.

U-Boot Product Vesion : DJI-ENC-Uboot-1.0-rc0(2015-11-02)
U-Boot 2010.12-rc2-svn3205-Dji (Nov 02 2015 - 19:07:26)
Cores: ARM 297 MHz
DDR:   270 MHz
I2C:   ready
DRAM:  128 MiB
NAND:  128 MiB
MMC:   davinci: 0
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net:   Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds

Loading from nand0, offset 0x4a0000
** Unknown image type
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Loading from nand0, offset 0x900000
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Booting kernel from Legacy Image at 80700000 ...
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    0.000000] Kernel Product Vesion : DJI-NOHDMI-WM610-Kernel-1.0-rc6(2015-03-30)
[    0.000000] Linux version 2.6.32.17-davinci1 ([email protected]) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #16 PREEMPT Mon Mar 30 17:54:38 HKT 2015
[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: DaVinci DM36x EVM
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] DaVinci dm36x_rev1.2 variant 0x8
[...]
[    7.650000] usbcore: registered new interface driver usb_68013
[    7.680000] usb 68013 module init ok
sulogin: no password entry for root
login[453]: root login on 'ttyS0'

#Process /etc/profile...
[email protected]:~#

encode_usb V00.02.02.00(Nov  3 2015 11:23:52).
Entry Encrypt qury mode
Init libusb  faild!
Auto to detect v[   10.050000] EVM: switch to ambarella video input
ideo input type:
Default video input selected:Hdmi_yuv
Setting video standard to: 0x100000000000000
Capture input set to Hdmi[   10.060000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
_yuv:11
[   10.070000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
[   10.080000] vpfe-capture vpfe-capture: IPIPE Chained
[   10.080000] vpfe-capture vpfe-capture: Resizer present
Capture videoStd[   10.090000] EVM: switch to ambarella video input
Old=0000000b
[   10.090000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[   10.100000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[   10.110000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[   10.120000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
videoFrameRate=30000, width=1280, height=720
Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800
GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001
osdThrFxn: process ID is 458 ***********
watchdog timeout:5
ctrlThrFxn: process ID is 450 ***********
Frmae:1 Pslice = 0, Islice = 8[44ms]
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 61% Video fps: 4 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 5% Video fps: 3 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:05 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 9% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:07 Resolution: 1280x720

umount: can't remount none read-only
umount: mdev busy - remounted read-only

The system is going down NOW!

Sent SIGTERM to all processes

Sent SIGKILL to all processes

Requesting system reboot
I reassembled the gimbal, tested it, and (after two more partial re-assemblies due to my mistakes) - everything started working.
FPV video on tablet is restored.

UPDATE - Regarding 8 FPS FPV after NAND replace:

A few people contacted me about an issue which happens after replacing the NAND chip in the way I described. The issue is that live feed on the mobile device is choppy - works only at 8 frames per second.

The issue was diagnosed as related to SHA204 chip which provides encryption capabilities. The chip is generally unused, but when encryption mismatch is detected, it re-tries the encryption tests over and over, consuming big chunk of processing power.

Recently a tool was published which can be used to modify DM365 firmware and remove re-tries mechanism, bringing FPV back to full rate. The tool is here:
dji-firmware-tools - dm3xx_encode_usb_hardcoder

A few popular versions of P3X firmware have the modified files already generated in this archive:
P3X_FW_fix_for_encrypt_8fps-v4.7z

There is some info on how to use these files in README within that archive, but it lacks details.
Thanks to cooperation with @GUCCI40, we have a detailed instruction of using this archive to fix the 8fps issue:

1. rename proper .elf file to encode_usb (with no extension)
2. start the board with serial connected and "PuTTY Extra" opened
3. when the board ends booting, type in the shell:
Code:
stop
4. move to a directory where you can write files without issues, ie.:
Code:
cd /tmp
5. type in the shell:
Code:
lrz --ymodem –b
and in "PuTTY Extra" menu select the file to transfer
6. wait for the transfer; the file will be written in current directory. Check whether the file is there with "ls -a".
7. make backup of original `encode_usb` by typing in shell:
Code:
mv /opt/dji/bin/encode_usb /opt/dji/bin/encode_usb.bkp
8. move the file transferred over yModem at its place by typing in shell:
Code:
mv ./encode_usb /opt/dji/bin/encode_usb
9. mark the new file as executable by typing in shell:
Code:
chmod a+x /opt/dji/bin/encode_usb
That's it - if no errors were shown after the commands, 8fps issue is fixed.
 
Last edited:
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Hopefully I also helped other people who might want to try their luck at repair.

If the repair would have failed, I'd probably modify the board to demote it from Ph3 Pro to Ph3 Advanced - it looks like this only requires moving a few resistors, plus updating the software within Ambarella.
 
  • Like
Reactions: Bad Andy
Joined
Feb 8, 2017
Messages
25
Reaction score
0
Age
33
Hopefully I also helped other people who might want to try their luck at repair.

If the repair would have failed, I'd probably modify the board to demote it from Ph3 Pro to Ph3 Advanced - it looks like this only requires moving a few resistors, plus updating the software within Ambarella.
How to do that
 
Joined
Feb 8, 2017
Messages
25
Reaction score
0
Age
33
Hopefully I also helped other people who might want to try their luck at repair.

If the repair would have failed, I'd probably modify the board to demote it from Ph3 Pro to Ph3 Advanced - it looks like this only requires moving a few resistors, plus updating the software within Ambarella.
I have been done that way ,but the video delay and the frame is lower as previous,how to solve this problem
 
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
How to do that [modify from Ph3 Pro to Ph3 Advanced]
Look at schematics:
dji-hardware-schematics/phantom_3_pro_gimbal_top_board at master · mefistotelis/dji-hardware-schematics · GitHub

Just use KiCad, not PDFs - PDFs are often outdated there.

I have been done that way ,but the video delay and the frame is lower as previous,how to solve this problem
Details. What you did, what are you using, where are you testing, what tests you did, what is the issue.
 
Joined
Jun 5, 2017
Messages
3
Reaction score
0
Age
35
I wanna ask, after replace nand flash live feed was laggy? Like only 8fps
 
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
I wanna ask, after replace nand flash live feed was laggy? Like only 8fps
No. No issues.

For laggy live feed, I would blame either radio link or mobile device. It is unlikely that such issue originates at compression.
 
Joined
Jun 5, 2017
Messages
3
Reaction score
0
Age
35
No. No issues.

For laggy live feed, I would blame either radio link or mobile device. It is unlikely that such issue originates at compression.
Code:
FPGA[190,100,1,0]-1.000000:19000000
hdmi status is 1
ARM Load: 18% Video fps: 8 fps Video bit rate: 1315 kbps PHY Bandwidth: 19000 kbps Time: 00:00:59 Resolution: 1280x720
Looks like DaVinci receive 8fps video from Ambarella. Why? This happened when replace Dm365 nand. The same happen when replace dm365 nand's between working units
 
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Looks like DaVinci receive 8fps video from Ambarella. Why? This happened when replace Dm365 nand. The same happen when replace dm365 nand's between working units
Interesting. I will try to take a look at Ambarella when I'm able. Since we don't have any technical documentation of the chip, I don't know too much about it. I have no idea how this could have happened by change in software.
 
Joined
Dec 18, 2016
Messages
41
Reaction score
10
Age
50
@quaddamage
I'm attempting to repair the boot image on a p3pro top gimbal board as well. Your coverage of this and narrative has been helpful.

I get this response from the 368_u0 serial pins when booting up (below).
However, I am having trouble getting it into Boot flashing mode, aka to return "BOOT ME," so I can send it the proper boot images via Texas Instrument's flashing utilitity...


I've tried tying:

  • BT01 to 3.3VD
  • BT00 to 3.3VD
  • Boot0 to 3.3VD
  • BT01 and BT00 to 3.3VD
  • etc...
to no avail... Thoughts?

Code:
DM36x initialization passed!
UBL Product Vesion : DJI-NOHDMI-WM610-UBL-1.0-rc0(2015-01-13)
Dji UBL Version: 1.51(Jan 13 2015 - 16:42:11)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Valid magicnum, 0xA1ACED66, found in block 0x0000001D.
No valid boot image found!
NAND Boot failed.
Aborting...
 
Joined
Jun 30, 2016
Messages
805
Reaction score
234
Location
PL
Check with multimeter whether the wires you soldered really provide 3.3V to the BT00/BT01 pins.

If they do, and the chip doesn't enter the boot mode - that would probably mean that the pins are not connected to the chip.
 
Joined
Sep 28, 2015
Messages
6,943
Reaction score
2,319
Location
San Francisco, CA
I’m impressed with the work quaddamage did. Congrats.
 
Joined
Dec 18, 2016
Messages
41
Reaction score
10
Age
50
@quaddamage
Thanks for the tip. I checked that both bt00 and bt01 we're getting 3.3v and they were... Darn, guess thateans the pads aren't connected to the pins!

One last follow up: for the serial connection, I should be on the 368_u0_tx/rx pins correct?
 

New Threads

Forum statistics

Threads
133,036
Messages
1,378,203
Members
97,134
Latest member
psimbaku