Yes. The output you shared suggests you're on correct pins, and transmission parameters are correct.
Fixing flash in DM365 chip within Ph3 Pro gimbal
- Thread starter quaddamage
- Start date
Yes. The output you shared suggests you're on correct pins, and transmission parameters are correct.
Thanks. I'm 0 for 2. I'll try this again when I have another defunct p3pro board.
Have anyone revived defunct p3std top gimbal boards yet? I have a few of those to try... I don't know which pins and it sounds like ambrella binaries would be the best bet since they don't have davinci hardware...
Cheers
Have anyone revived defunct p3std top gimbal boards yet? I have a few of those to try... I don't know which pins and it sounds like ambrella binaries would be the best bet since they don't have davinci hardware...
Cheers
Great to hear about your success quaddamage!
I have another board Im messing with now. Its from a P3 advanced. Its not outputting anything even with the bootpins to 3.3V. No light in the LED either. Its consuming 600mA on 5V.
Any suggestions? or is this board simply dead?
I have another board Im messing with now. Its from a P3 advanced. Its not outputting anything even with the bootpins to 3.3V. No light in the LED either. Its consuming 600mA on 5V.
Any suggestions? or is this board simply dead?
Looks like Ambarella dead or Ambarella NAND. No output because Advanced board doesn't have DaVinci chip.
Agreed. For Ambarella, we don't have neither a way of writing bootloader nor the image - though I suspect firmware update may contain all partitions, so it's possible that nothing more is necessary. I wish someone shared the A9 datasheet. But since we don't have it, I would start with reading A7 datasheet for info about boot modes and flashing tools.
Agreed again. For Advanced, you have to connect to Ambarella UART to get any output.
Hi, What is the Nand chip part # for replacements?
Here is the NAND chip with number "3" drawn on it:
So I bought a few replacement NAND chips in China. Removed the old chip, cleaned the pads with wick, put a little soldering paste on it and soldered a new chip, placing it very carefully to the white outline of the chip visible on the board.
There are two models on the wiki (look at first post), and other manufacturers also have compatible chips.
Hi, Thank you. I did not notice that! Tried Mouser and DigiKey with no luck. Found them at Arrow (1st time using them) and ordered 4. Shipped today and should arrive by Wednesday. Great info on your post too! I hope I have the same success.
GUCCI40 said:
@GUCCI40 I used the exact commands from the wiki:
o-gs/dji-firmware-tools
Try reading the part about kernel; the commands which are used during UbiFS flashing are explained in the kernel chapter.
You don't have to use USB to load the UbiFS, though. You can use yModem transfer as well.
- Joined
- May 9, 2018
- Messages
- 20
- Reaction score
- 4
- Age
- 55
Thank you very much for your explanation! I managed to load everything OK via USB, I only need one step, I would appreciate it if you can help me
Step 1. first. set DM 365 BOOT Bsel pins at 3.3v, via command CMD flash ubl u bot (as I did before in the Phantom 2 V plus without FPV video). Perfect OK
Step 2. Lift Bsel wire, start terminal, send Uimage and Uimage _ recovery Perfect OK (achieve with USB reader) perfect kernel boot OK.
Step 3. Send dm365_secret.bin, Achievement Load OK OK.
Step 4. Send dm365_recovery_rootfs.bin Achievement Load OK.
Step 5. I follow the steps and commands of the WiKi Linux console start OK
to load the dm365_root_ubifs.ubi and "in this step the error occurs to me".
I'd leave you with the error code. Greetings and many thanks. What
I can bring you, I'm good for the electronic and mechanical part but little experience in programming by commands. My latest research that may interest you is the current failure in many Gimbal of PH4 Pro and Adv, if you use any of these data, I will gladly send my humble experience in repairing them without changing parts, detect failure in construction of gimbal engines that fail prematurely.
greetings thank you!!. I leave you the error:
cd /tmp; mkdir sdcard
root@Dji-Pro:/tmp# mount /dev/sda sdcard
[ 60.090000] [EXFAT] trying to mount...
mount: mounting /dev/sda on sdcard failed: Input/output error
root@Dji-Pro:/tmp# ubiformat /dev/mtd2 --sub-page-size=512 --vid-hdr-offset=2048
-f sdcard/dm365_root_ubifs.ubi
ubiformat: mtd2 (nand), size 118489088 bytes (113.0 MiB), 904 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 903 -- 100 % complete
ubiformat: 904 eraseblocks have valid erase counter, mean value is 1
ubiformat: error!: cannot open "sdcard/dm365_root_ubifs.ubi"
error 2 (No such file or directory)
root@Dji-Pro:/tmp#
Note: the SD is in the reader with the UBI file of 23 mb in the root directory of the SD as I did with the other files, I did it one by one deleting the previous one. the Wiki indicates doing it one by one. Or do you send the entire set in the DJI folder in one go? many thanks.
Step 1. first. set DM 365 BOOT Bsel pins at 3.3v, via command CMD flash ubl u bot (as I did before in the Phantom 2 V plus without FPV video). Perfect OK
Step 2. Lift Bsel wire, start terminal, send Uimage and Uimage _ recovery Perfect OK (achieve with USB reader) perfect kernel boot OK.
Step 3. Send dm365_secret.bin, Achievement Load OK OK.
Step 4. Send dm365_recovery_rootfs.bin Achievement Load OK.
Step 5. I follow the steps and commands of the WiKi Linux console start OK
to load the dm365_root_ubifs.ubi and "in this step the error occurs to me".
I'd leave you with the error code. Greetings and many thanks. What
I can bring you, I'm good for the electronic and mechanical part but little experience in programming by commands. My latest research that may interest you is the current failure in many Gimbal of PH4 Pro and Adv, if you use any of these data, I will gladly send my humble experience in repairing them without changing parts, detect failure in construction of gimbal engines that fail prematurely.
greetings thank you!!. I leave you the error:
cd /tmp; mkdir sdcard
root@Dji-Pro:/tmp# mount /dev/sda sdcard
[ 60.090000] [EXFAT] trying to mount...
mount: mounting /dev/sda on sdcard failed: Input/output error
root@Dji-Pro:/tmp# ubiformat /dev/mtd2 --sub-page-size=512 --vid-hdr-offset=2048
-f sdcard/dm365_root_ubifs.ubi
ubiformat: mtd2 (nand), size 118489088 bytes (113.0 MiB), 904 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 903 -- 100 % complete
ubiformat: 904 eraseblocks have valid erase counter, mean value is 1
ubiformat: error!: cannot open "sdcard/dm365_root_ubifs.ubi"
error 2 (No such file or directory)
root@Dji-Pro:/tmp#
Note: the SD is in the reader with the UBI file of 23 mb in the root directory of the SD as I did with the other files, I did it one by one deleting the previous one. the Wiki indicates doing it one by one. Or do you send the entire set in the DJI folder in one go? many thanks.
Either the SD-card is damaged, or you're using unsupported file system on the sd-card.
To get details, try adding "-v" to the mount command. You may also want to check kernel logs, ie.:
Code:
dmesg | tail -n 20Sure, I'll be happy to check that; I don't have Ph4 now, but who knows.
Also, if you have any high quality photos of the boards, I'm sure the Github guys would be happy to add these to their wiki. Send me the photos and I will arrange that.
I had all the files in root folder at the same time. There is no need for copying them one by one.
Last edited:
- Joined
- May 9, 2018
- Messages
- 20
- Reaction score
- 4
- Age
- 55
I upload some photos of me about this experience to complement your excellent post. It is very easy in this model that nand Chip, is broken crush crack by the pressure exerted by the arm of the camera when it is forced in a fall to the floor, the crack in the chip is almost imperceptible to the eye, obviously this does not happen ne the ADV or 4k version and what do they use the dm365 with their nand flash.Here is a success story I wanted to share.
I had a Phantom 3 Pro gimbal which didn't allowed me to see the FPV feed. Photos and movies were recorded on sd-card, there was just no live video - only grey background - in Dji Go.
By connecting another gimbal, I narrowed down the problem to gimbal itself - a different gimbal (which had the same firmware installed) worked fine.
Then I disassembled the gimbal. I looked at available information about the board:
WM320 Gimbal top board · mefistotelis/phantom-firmware-tools Wiki · GitHub
On the schematic, video feed is encoded by media processor model DM365:
dji-hardware-schematics/phantom_3_pro_overview.pdf at master · mefistotelis/dji-hardware-schematics · GitHub
To check whether the media processor is working correctly, I tapped to UART interface of the DM365 chip with TTL-to-USB converter (aka FTDI). See here for details:
Firmware m0800 · mefistotelis/phantom-firmware-tools Wiki · GitHub
I opened PuTTY on the interface before connecting 5V power for the board, then connected the power. There was no output on the console while the board was booting. But the board was booting - I was able to see the diode blinking on it. Which means either my FTDI configuration was bad, or the chip just wasn't producing any output.
To check which is true (and also fix the issue if this turns out to be a chip boot issue), I shorted the boot pins to 3.3V and connected the board to PC again. This should cause the DM365 chip to boot internally, without use of NAND. This time I was able to see a series of "BOOTME BOOTME BOOTME" messages. This ment my FTDI configuration is fine, the DM365 chip really wasn't printing anything when trying to boot from NAND.
Here is the NAND chip with number "3" drawn on it:
If DM365 chip isn't printing anything, then the bootloader on NAND is damaged. I tried flashing the bootloader using instructions from here:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub
But I wasn't able to flash the image. Flashing was ending with message about failure to open NAND:
Code:Waiting for SFT on the DM36x... Target: Starting UART Boot... Target: BOOTUBL BOOTUBL commmand received. Returning CMD and command... CMD value sent. Waiting for DONE... Target: DONE DONE received. Command was accepted. Sending the UBL image Waiting for SENDIMG sequence... Target: NAND_open() failed!Starting UART Boot... Target: BOOTUBL
Conclusion - The NAND chip is either not touching the board correctly and needs re-flowing the solder, or is damaged and needs replacing. I gathered a cheapest BGA soldering equipment I could find:
With the equipment received from China, I went to action. I used heat-resistant tape to shield the components around NAND. First I tried heating-up the NAND chip and re-flowing it, but nothing changed - still "NAND_open() failed". Then I heated it up again and gently pressed the chip, to make any smaller solder balls connect. Unfortunately, that connected too much - the chip became a short, and caused the whole FTDI to disconnect because of high current draw. I tried heating up the chip even more to make it wiggle and re-form the solder balls, but couldn't do this - the chip is so large that it won't dance under the hot air, and the ultra-cheap soldering station won't allow me to increase the air flow enoughly.
So I bought a few replacement NAND chips in China. Removed the old chip, cleaned the pads with wick, put a little soldering paste on it and soldered a new chip, placing it very carefully to the white outline of the chip visible on the board.
Then, when I connected it back to PC - I was able to write bootloader to the flash. It worked! I had to do several tries though, probably because of poor quality (or too long) cables. [EDIT: now I know it was not due to cables, but because my USB port couldn't deliver enough (over 700mA @5V) power] Here is my flashing configuration:
After the bootloader was flashed, I disconnected the green cable which was causing it to boot internally and spew BOOTME:
Without this cable, the chip should get back to trying to boot from NAND. I connected it back to PC to check whether bootloader works. And it does!
Now, I need a full image of a working NAND to make the rest of it work, but it's already a success.
Anyway, if anyone happens to have such image, or has FTDI connected and can download it from the board - I'll be interested in that.
@quaddamage great work and thanks for sharing. I‘ve signed up here, because I also have a board from a P3A. Voltage seems okay on ever TP, but no LED or Video or gimbal-movement.
So I tried to connect to U0_T and U0_R but I didn‘t see anything on the output. Is this okay or is the Ambarella dead?
Because on U1_T1 and U1_R1 I get just “repeating garbage” or is it encrypted? And on U1RT and U1TT I get some output
Thanks for any help
So I tried to connect to U0_T and U0_R but I didn‘t see anything on the output. Is this okay or is the Ambarella dead?
Because on U1_T1 and U1_R1 I get just “repeating garbage” or is it encrypted? And on U1RT and U1TT I get some output
Code:
ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !..app exist !..Thanks for any help
I never had damaged Ambarela. From the Wiki:
o-gs/dji-firmware-tools
And sub-wiki about m0100:
o-gs/dji-firmware-tools
you can conclude that yes, you should always get the log if you connect to U0_* pins.
If you see binary data, that might be an interface with internal communication between the drone components. You can capture the communication by this tool:
o-gs/dji-firmware-tools
These are interesting findings; I don't think anyone looked into these interfaces in detail. If you can capture the binary packets, I'd be interested in looking at them.[/QUOTE]
Last edited:
Okay, so the Ambarella is damaged or not correctly connected to the board. At the moment I just have a Windows-PC and have no clue how to get Python started. The funny thing about the garbage-log: I tried different baud-rates and bit-length. 57600 and 7-bit gives the best result.
Another funny thing: When I short U1_T1 with U1_R1 I get another output.
Another funny thing: When I short U1_T1 with U1_R1 I get another output.
Code:
ÎÈÏñ¼ü<ïéÇ¿? ÖйúÉîÛÚÕÒ´ó½®!...====== start from loader ====== ..= 55aa55aa !. ====== Enter Loader wait data to upgrade devive ======I checked your capture_text.txt. While it clearly shows packets are sent, the format doesn't match DUML structure which the drone uses internally. It is possible that different format is used for that interface, but it is far more likely that the transmission parameters are just not right. Try finding parameters which make each packet start with 0x55.
Nice find! So we now know how to enter bootloader mode, though we can't be sure whether it's Ambarella or STM32. I checked whether these messages are part of any firmware module - but no. This must be a stage-1 bootloader which is not a part of firmware update.
HI,
Thanks for very helpful post. I have stuck on step 5.
My system says that it cannot find sda device. Any Advices?
I formated miniSD card ant put into gimbal port. I have copier there ubi file too in the root directory.
My output from the console:
root@Dji-Pro:~# mount /dev/sda
mount: can't find /dev/sda in /etc/fstab
root@Dji-Pro:~# more /etc/fstab
# stock fstab - you probably want to override this with a machine specific one
rootfs / auto defaults 1 1
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
devpts /dev/pts devpts mode=0620,gid=5 0 0
#usbfs /proc/bus/usb usbfs defaults 0 0
tmpfs /var/volatile tmpfs defaults,size=16M 0 0
tmpfs /dev/shm tmpfs mode=0777 0 0
#tmpfs /media/ram tmpfs defaults,size=16M 0 0
# uncomment this if your device has a SD/MMC/Transflash slot
#/dev/mmcblk0p1 /media/card auto defaults,sync,noauto 0 0
root@Dji-Pro:~#
Thanks for very helpful post. I have stuck on step 5.
My system says that it cannot find sda device. Any Advices?
I formated miniSD card ant put into gimbal port. I have copier there ubi file too in the root directory.
My output from the console:
root@Dji-Pro:~# mount /dev/sda
mount: can't find /dev/sda in /etc/fstab
root@Dji-Pro:~# more /etc/fstab
# stock fstab - you probably want to override this with a machine specific one
rootfs / auto defaults 1 1
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
devpts /dev/pts devpts mode=0620,gid=5 0 0
#usbfs /proc/bus/usb usbfs defaults 0 0
tmpfs /var/volatile tmpfs defaults,size=16M 0 0
tmpfs /dev/shm tmpfs mode=0777 0 0
#tmpfs /media/ram tmpfs defaults,size=16M 0 0
# uncomment this if your device has a SD/MMC/Transflash slot
#/dev/mmcblk0p1 /media/card auto defaults,sync,noauto 0 0
root@Dji-Pro:~#
- Joined
- May 9, 2018
- Messages
- 20
- Reaction score
- 4
- Age
- 55
Similar threads
