Fixing flash in DM365 chip within Ph3 Pro gimbal

[quaddamage]

One last follow up: for the serial connection, I should be on the 368_u0_tx/rx pins correct?

Yes. The output you shared suggests you're on correct pins, and transmission parameters are correct.

 

[okstuv]

Thanks. I'm 0 for 2. I'll try this again when I have another defunct p3pro board.

Have anyone revived defunct p3std top gimbal boards yet? I have a few of those to try... I don't know which pins and it sounds like ambrella binaries would be the best bet since they don't have davinci hardware...

Cheers

 

[Wrecked]

Great to hear about your success quaddamage!

I have another board Im messing with now. Its from a P3 advanced. Its not outputting anything even with the bootpins to 3.3V. No light in the LED either. Its consuming 600mA on 5V.
Any suggestions? or is this board simply dead?

 

[PriEgor]

Great to hear about your success quaddamage!

I have another board Im messing with now. Its from a P3 advanced. Its not outputting anything even with the bootpins to 3.3V. No light in the LED either. Its consuming 600mA on 5V.
Any suggestions? or is this board simply dead?

Looks like Ambarella dead or Ambarella NAND. No output because Advanced board doesn't have DaVinci chip.

 

[quaddamage]

Looks like Ambarella dead or Ambarella NAND.

Agreed. For Ambarella, we don't have neither a way of writing bootloader nor the image - though I suspect firmware update may contain all partitions, so it's possible that nothing more is necessary. I wish someone shared the A9 datasheet. But since we don't have it, I would start with reading A7 datasheet for info about boot modes and flashing tools.

No output because Advanced board doesn't have DaVinci chip.

Agreed again. For Advanced, you have to connect to Ambarella UART to get any output.

 

[Wrecked]

Oh.. I thought an Advanced board could be flashed the same way as a Pro.

Thanks anyway guys!

 

[quaddamage]

Here's an image showing than I can't draw at all, but also how exactly the video goes between chips in Phantom 3 Pro.

Ph3_pro_video_feed_pipeline

• quaddamage
• Jan 23, 2018

Tried a new painting tool today.

Anyway, this is video pipeline in Phantom 3 Professional.

 

[Keebs107]

Hi, What is the Nand chip part # for replacements?

Here is the NAND chip with number "3" drawn on it:

Ph3_pro_gimbal_board_before

• quaddamage
• Dec 4, 2017
• 2

Phantom 3 Pro gimbal board with dm365 NAND chip "3" visible.

So I bought a few replacement NAND chips in China. Removed the old chip, cleaned the pads with wick, put a little soldering paste on it and soldered a new chip, placing it very carefully to the white outline of the chip visible on the board.

Nand_flash_chips

• quaddamage
• Dec 3, 2017

F1Bit flash chips for DM365 processor within Ph3

 

[quaddamage]

Hi, What is the Nand chip part # for replacements?

There are two models on the wiki (look at first post), and other manufacturers also have compatible chips.

 

[Keebs107]

Hi, Thank you. I did not notice that! Tried Mouser and DigiKey with no luck. Found them at Arrow (1st time using them) and ordered 4. Shipped today and should arrive by Wednesday. Great info on your post too! I hope I have the same success.

 

[quaddamage]

Could you post more detailed part of the commands to record a new chip? I can load the ubl and ubot, the chip starts Ok, but I can not load the UBI part, it is not very clear in the wiki explanation, I manage serial well by Uart but I do not understand well enter by usb, I would appreciate it very much if you can put a scheme or details of the commands to load all the files exactly so that it starts the whole system

@GUCCI40 I used the exact commands from the wiki:
o-gs/dji-firmware-tools

Try reading the part about kernel; the commands which are used during UbiFS flashing are explained in the kernel chapter.
You don't have to use USB to load the UbiFS, though. You can use yModem transfer as well.

 

[GUCCI40]

Thank you very much for your explanation! I managed to load everything OK via USB, I only need one step, I would appreciate it if you can help me

Step 1. first. set DM 365 BOOT Bsel pins at 3.3v, via command CMD flash ubl u bot (as I did before in the Phantom 2 V plus without FPV video). Perfect OK


Step 2. Lift Bsel wire, start terminal, send Uimage and Uimage _ recovery Perfect OK (achieve with USB reader) perfect kernel boot OK.


Step 3. Send dm365_secret.bin, Achievement Load OK OK.


Step 4. Send dm365_recovery_rootfs.bin Achievement Load OK.


Step 5. I follow the steps and commands of the WiKi Linux console start OK

to load the dm365_root_ubifs.ubi and "in this step the error occurs to me".

I'd leave you with the error code. Greetings and many thanks. What

I can bring you, I'm good for the electronic and mechanical part but little experience in programming by commands. My latest research that may interest you is the current failure in many Gimbal of PH4 Pro and Adv, if you use any of these data, I will gladly send my humble experience in repairing them without changing parts, detect failure in construction of gimbal engines that fail prematurely.

greetings thank you!!. I leave you the error:


cd /tmp; mkdir sdcard

root@Dji-Pro:/tmp# mount /dev/sda sdcard

[ 60.090000] [EXFAT] trying to mount...

mount: mounting /dev/sda on sdcard failed: Input/output error

root@Dji-Pro:/tmp# ubiformat /dev/mtd2 --sub-page-size=512 --vid-hdr-offset=2048

-f sdcard/dm365_root_ubifs.ubi

ubiformat: mtd2 (nand), size 118489088 bytes (113.0 MiB), 904 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes

libscan: scanning eraseblock 903 -- 100 % complete

ubiformat: 904 eraseblocks have valid erase counter, mean value is 1

ubiformat: error!: cannot open "sdcard/dm365_root_ubifs.ubi"

error 2 (No such file or directory)

root@Dji-Pro:/tmp#



Note: the SD is in the reader with the UBI file of 23 mb in the root directory of the SD as I did with the other files, I did it one by one deleting the previous one. the Wiki indicates doing it one by one. Or do you send the entire set in the DJI folder in one go? many thanks.

 

[quaddamage]

root@Dji-Pro:/tmp# mount /dev/sda sdcard
[ 60.090000] [EXFAT] trying to mount...
mount: mounting /dev/sda on sdcard failed: Input/output error

Either the SD-card is damaged, or you're using unsupported file system on the sd-card.

To get details, try adding "-v" to the mount command. You may also want to check kernel logs, ie.:

dmesg | tail -n 20

My latest research that may interest you is the current failure in many Gimbal of PH4 Pro and Adv, if you use any of these data, I will gladly send my humble experience in repairing them without changing parts, detect failure in construction of gimbal engines that fail prematurely.

Sure, I'll be happy to check that; I don't have Ph4 now, but who knows.
Also, if you have any high quality photos of the boards, I'm sure the Github guys would be happy to add these to their wiki. Send me the photos and I will arrange that.

the SD is in the reader with the UBI file of 23 mb in the root directory of the SD as I did with the other files, I did it one by one deleting the previous one. the Wiki indicates doing it one by one. Or do you send the entire set in the DJI folder in one go?

I had all the files in root folder at the same time. There is no need for copying them one by one.

 

[GUCCI40]

Here is a success story I wanted to share.

I had a Phantom 3 Pro gimbal which didn't allowed me to see the FPV feed. Photos and movies were recorded on sd-card, there was just no live video - only grey background - in Dji Go.

By connecting another gimbal, I narrowed down the problem to gimbal itself - a different gimbal (which had the same firmware installed) worked fine.

Then I disassembled the gimbal. I looked at available information about the board:
WM320 Gimbal top board · mefistotelis/phantom-firmware-tools Wiki · GitHub

On the schematic, video feed is encoded by media processor model DM365:
dji-hardware-schematics/phantom_3_pro_overview.pdf at master · mefistotelis/dji-hardware-schematics · GitHub

To check whether the media processor is working correctly, I tapped to UART interface of the DM365 chip with TTL-to-USB converter (aka FTDI). See here for details:
Firmware m0800 · mefistotelis/phantom-firmware-tools Wiki · GitHub

I opened PuTTY on the interface before connecting 5V power for the board, then connected the power. There was no output on the console while the board was booting. But the board was booting - I was able to see the diode blinking on it. Which means either my FTDI configuration was bad, or the chip just wasn't producing any output.

To check which is true (and also fix the issue if this turns out to be a chip boot issue), I shorted the boot pins to 3.3V and connected the board to PC again. This should cause the DM365 chip to boot internally, without use of NAND. This time I was able to see a series of "BOOTME BOOTME BOOTME" messages. This ment my FTDI configuration is fine, the DM365 chip really wasn't printing anything when trying to boot from NAND.

Here is the NAND chip with number "3" drawn on it:

Ph3_pro_gimbal_board_before

• quaddamage
• Dec 4, 2017
• 2

Phantom 3 Pro gimbal board with dm365 NAND chip "3" visible.

If DM365 chip isn't printing anything, then the bootloader on NAND is damaged. I tried flashing the bootloader using instructions from here:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub

But I wasn't able to flash the image. Flashing was ending with message about failure to open NAND:

Waiting for SFT on the DM36x...
        Target: Starting UART Boot...
        Target: BOOTUBL
BOOTUBL commmand received. Returning CMD and command...
CMD value sent.  Waiting for DONE...
        Target:    DONE
DONE received. Command was accepted.
Sending the UBL image
Waiting for SENDIMG sequence...
        Target: NAND_open() failed!Starting UART Boot...
        Target: BOOTUBL

Conclusion - The NAND chip is either not touching the board correctly and needs re-flowing the solder, or is damaged and needs replacing. I gathered a cheapest BGA soldering equipment I could find:

Equipment_1

• quaddamage
• Dec 3, 2017

Cheapest BGA Soldering Equipment

Equipment_2

• quaddamage
• Dec 3, 2017

Cheapest BGA Soldering Equipment

With the equipment received from China, I went to action. I used heat-resistant tape to shield the components around NAND. First I tried heating-up the NAND chip and re-flowing it, but nothing changed - still "NAND_open() failed". Then I heated it up again and gently pressed the chip, to make any smaller solder balls connect. Unfortunately, that connected too much - the chip became a short, and caused the whole FTDI to disconnect because of high current draw. I tried heating up the chip even more to make it wiggle and re-form the solder balls, but couldn't do this - the chip is so large that it won't dance under the hot air, and the ultra-cheap soldering station won't allow me to increase the air flow enoughly.

So I bought a few replacement NAND chips in China. Removed the old chip, cleaned the pads with wick, put a little soldering paste on it and soldered a new chip, placing it very carefully to the white outline of the chip visible on the board.

Nand_flash_chips

• quaddamage
• Dec 3, 2017

F1Bit flash chips for DM365 processor within Ph3

Then, when I connected it back to PC - I was able to write bootloader to the flash. It worked! I had to do several tries though, probably because of poor quality (or too long) cables. [EDIT: now I know it was not due to cables, but because my USB port couldn't deliver enough (over 700mA @5V) power] Here is my flashing configuration:

Dm365_fix_phase1

• quaddamage
• Dec 3, 2017

DM365 UART connection, including boot pads shorted to allow writing bootloader

After the bootloader was flashed, I disconnected the green cable which was causing it to boot internally and spew BOOTME:

Dm365_fix_plase2

• quaddamage
• Dec 3, 2017

DM365 UART connection, without boot pads shorted

Without this cable, the chip should get back to trying to boot from NAND. I connected it back to PC to check whether bootloader works. And it does!

Dm365_uboot_clean_dscard_boot

• quaddamage
• Dec 3, 2017

DM365 boot from new flash, only bootloader present

Now, I need a full image of a working NAND to make the rest of it work, but it's already a success.
Anyway, if anyone happens to have such image, or has FTDI connected and can download it from the board - I'll be interested in that.

I upload some photos of me about this experience to complement your excellent post. It is very easy in this model that nand Chip, is broken crush crack by the pressure exerted by the arm of the camera when it is forced in a fall to the floor, the crack in the chip is almost imperceptible to the eye, obviously this does not happen ne the ADV or 4k version and what do they use the dm365 with their nand flash.

 

[Flightrun]

@quaddamage great work and thanks for sharing. I‘ve signed up here, because I also have a board from a P3A. Voltage seems okay on ever TP, but no LED or Video or gimbal-movement.
So I tried to connect to U0_T and U0_R but I didn‘t see anything on the output. Is this okay or is the Ambarella dead?
Because on U1_T1 and U1_R1 I get just “repeating garbage” or is it encrypted? And on U1RT and U1TT I get some output

ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !..app exist !..

Thanks for any help

 

[quaddamage]

I also have a board from a P3A. Voltage seems okay on ever TP, but no LED or Video or gimbal-movement.
So I tried to connect to U0_T and U0_R but I didn‘t see anything on the output. Is this okay or is the Ambarella dead?[/CODE]

I never had damaged Ambarela. From the Wiki:
o-gs/dji-firmware-tools
And sub-wiki about m0100:
o-gs/dji-firmware-tools
you can conclude that yes, you should always get the log if you connect to U0_* pins.

Because on U1_T1 and U1_R1 I get just “repeating garbage” or is it encrypted? And on U1RT and U1TT I get some output

ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !..app exist !..

If you see binary data, that might be an interface with internal communication between the drone components. You can capture the communication by this tool:
o-gs/dji-firmware-tools

These are interesting findings; I don't think anyone looked into these interfaces in detail. If you can capture the binary packets, I'd be interested in looking at them.[/QUOTE]

 

[Flightrun]

Okay, so the Ambarella is damaged or not correctly connected to the board. At the moment I just have a Windows-PC and have no clue how to get Python started. The funny thing about the garbage-log: I tried different baud-rates and bit-length. 57600 and 7-bit gives the best result.
Another funny thing: When I short U1_T1 with U1_R1 I get another output.

ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !. ====== Enter Loader wait data to upgrade devive ======

 

[quaddamage]

The funny thing about the garbage-log: I tried different baud-rates and bit-length. 57600 and 7-bit gives the best result.

I checked your capture_text.txt. While it clearly shows packets are sent, the format doesn't match DUML structure which the drone uses internally. It is possible that different format is used for that interface, but it is far more likely that the transmission parameters are just not right. Try finding parameters which make each packet start with 0x55.

Another funny thing: When I short U1_T1 with U1_R1 I get another output.

ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !. ====== Enter Loader wait data to upgrade devive ======

Nice find! So we now know how to enter bootloader mode, though we can't be sure whether it's Ambarella or STM32. I checked whether these messages are part of any firmware module - but no. This must be a stage-1 bootloader which is not a part of firmware update.

 

[greniu]

HI,

Thanks for very helpful post. I have stuck on step 5.
My system says that it cannot find sda device. Any Advices?
I formated miniSD card ant put into gimbal port. I have copier there ubi file too in the root directory.

My output from the console:


root@Dji-Pro:~# mount /dev/sda
mount: can't find /dev/sda in /etc/fstab
root@Dji-Pro:~# more /etc/fstab
# stock fstab - you probably want to override this with a machine specific one

rootfs / auto defaults 1 1
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
devpts /dev/pts devpts mode=0620,gid=5 0 0
#usbfs /proc/bus/usb usbfs defaults 0 0
tmpfs /var/volatile tmpfs defaults,size=16M 0 0
tmpfs /dev/shm tmpfs mode=0777 0 0
#tmpfs /media/ram tmpfs defaults,size=16M 0 0

# uncomment this if your device has a SD/MMC/Transflash slot
#/dev/mmcblk0p1 /media/card auto defaults,sync,noauto 0 0
root@Dji-Pro:~#

Step 3. Send dm365_secret.bin, Achievement Load OK OK.


Step 4. Send dm365_recovery_rootfs.bin Achievement Load OK.


Step 5. I follow the steps and commands of the WiKi Linux console start OK

to load the dm365_root_ubifs.ubi and "in this step the error occurs to me".

 

[GUCCI40]

I checked your capture_text.txt. While it clearly shows packets are sent, the format doesn't match DUML structure which the drone uses internally. It is possible that different format is used for that interface, but it is far more likely that the transmission parameters are just not right. Try finding parameters which make each packet start with 0x55.



Ok friend, I see that we are in the same, I know a lot of the electronic part but little linux, I follow the steps of the wiki and I stay in the ubi file part. input output error, I understand that you load all in one, I do one by one as the wiki says, the quaddamage friend, has a successful experience in this, I will thank you as they package everything in a single operation or if the UBI to do it apart what commands they would use and where I place the folders in windows is good to help each other, much greetings,