Fixing flash in DM365 chip within Ph3 Pro gimbal

GUCCI40 · Aug 1, 2018

GUCCI40 said:
Board fpv dead for fail upgrade, i only flash UBL using Bsel . start 8fps and righ now junp at 30FPS perfect.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>WM610<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

Filesystem Product Vesion : DJI-WM610-Filesystem-1.0-rc3(2014-06-06)

Runing /etc/init.d/rcS

[ 3.780000] CMEMK module: built on Jan 13 2015 at 19:24:09

[ 3.780000] Reference Linux version 2.6.32

[ 3.800000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c

[ 3.820000] allocated heap buffer 0xc7000000 of size 0x2456000

[ 3.840000] heap fallback enabled - will try heap if pool buffer is not available

[ 3.860000] CMEM Range Overlaps Kernel Physical - allowing overlap

[ 3.860000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)

[ 3.870000] cmemk initialized

[ 3.900000] IRQK module: built on Jan 13 2015 at 19:23:41

[ 3.920000] Reference Linux version 2.6.32

[ 3.920000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c

[ 3.940000] irqk initialized

[ 3.990000] EDMAK module: built on Jan 13 2015 at 19:23:04

[ 4.010000] Reference Linux version 2.6.32

[ 4.010000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c

sulogin: no password entry for root

login[442]: root login on 'ttyS0'

#Process /etc/profile...

root@Dji-Pro:~#

encode_usb V00.02.02.00(Jul 18 2015 16:52:39).

Entry Encrypt qury mode

init libusb successed!!!

open 68013 succe[ 6.390000] EVM: switch to ambarella video input

ed VENDOR_ID = 0x0547

Claiming libusb_claim_interface 68013 successed

Auto to detect video input type:

Default video input [ 6.400000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124

selected:Hdmi_yu[ 6.410000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config

v

Setting video[ 6.420000] vpfe-capture vpfe-capture: IPIPE Chained

standard to: 0x[ 6.430000] vpfe-capture vpfe-capture: Resizer present

100000000000000

Capture input s[ 6.440000] EVM: switch to ambarella video input

et to Hdmi_yuv:1[ 6.440000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1

1

Capture video[ 6.450000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400

[ 6.460000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1

[ 6.470000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400

videoFrameRate=30000, width=1280, height=720

Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800

GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001

osdThrFxn: process ID is 447 ***********

watchdog timeout:5

ctrlThrFxn: process ID is 439 ***********

Frmae:1 Pslice = 0, Islice = 8[38ms]

GetFPGAstatus err!

FPGA[1,0,1,0]-1.000000:0

hdmi status is 1

ARM Load: 58% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:01 Resolution: 1280x720

GetFPGAstatus err!

FPGA[1,0,1,0]-1.000000:0

hdmi status is 1

ARM Load: 4% Video fps: 8 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution: 1280x720

GetFPGAstatus err!

FPGA[1,0,1,0]-1.000000:0

hdmi status is 1

ARM Load: 5% Video fps: 8 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:03 Resolution: 1280x720

GetFPGAstatus err!

FPGA[1,0,1,0]-1.000000:0

hdmi status is 1

ARM Load: 5% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution: 1280x720

Frmae:33 Pslice = 0, Islice = 8[28ms]

Frmae:34 Pslice = 0, Islice = 8[26ms]

Encrypt passed!

FPGA[40,100,1,0]-1.000000:4000000

hdmi status is 1

ARM Load: 19% Video fps: 19 fps Video bit rate: 1423 kbps PHY Bandwidth: 4000 kbps Time: 00:00:05 Resolution: 1280x720

FPGA[40,100,1,0]-1.000000:4000000

hdmi status is 1

ARM Load: 27% Video fps: 30 fps Video bit rate: 2826 kbps PHY Bandwidth: 4000 kbps Time: 00:00:06 Resolution: 1280x720

Frmae:82 Pslice = 0, Islice = 8[26ms]

FPGA[80,100,1,0]-1.000000:8000000

hdmi status is 1

ARM Load: 35% Video fps: 30 fps Video bit rate: 4676 kbps PHY Bandwidth: 8000 kbps Time: 00:00:07 Resolution: 1280x720

What do you think quadd? Any clue to be able to restore our boards to 30 FPS.? regards

quaddamage · Aug 2, 2018

GUCCI40 said:
What do you think quadd? Any clue to be able to restore our boards to 30 FPS.? regards

This is where I am with this issue so far:

1. When the issue happens, the log does not contain "Encrypt passed!" line. This line shold always be few lines after "Entry Encrypt qury mode".

2. The code which logs the lines is within DaVinci firmware in file `encode_usb`:

Code:

void * encryptThrFxn(void *arg)
{
  puts("Entry Encrypt qury mode");
  while ( !Encrypt_Request(1) )
    sleep(1);
  return puts("Encrypt passed!");
}

The function Encrypt_Request() sends an encryption request to Ambarella, and then compares the result with encryption done within DaVinci, using "/etc/key.bin" (a file within DaVinci firmware) as encryption key. It fails when the encryption results are different, which basically means Ambarella uses different key than DaVinci.

3. It is clear that the issue is caused by non-matching encryption keys in Ambarella and DaVinci. Unfortunately we cannot just copy the key file from Ambarella to DaVinci, as the keys are encrypted as well - using hardware encryption with AT88 chip. This means only Ambarella can decrypt the copy stored on Ambarella, and only DaVinci can decrypt the copy stored on DaVinci.

We need to write the new key through AT88 chip so it is properly encrypted. For that we either need to craft and compile a special binary which would use internal firmware functions to write the file through AT88, or figure out an existing way which DJI service uses to sync the keys.

4. With help of Mefistotelis, I was able to find a way which Dji uses to sync the keys. There is a special packet which when sent, changes the keys to what's inside the packet.

To experiment with that packet, I asked Mefistotelis for a command line tool to send packets. And he did made such tool - its called "comm_serialtalk.py".

Now I need to make more tests, but as of now I didn't had time for that. I tried a "Encrypt GetChipState" command which should return the current encryption config, but it failed - did not returned what I wanted:

Code:

python3 comm_serialtalk.py COM5 -vv --sender_type=ANY --sender_index=1 --receiver_type=Camera --ack_type=ACK_After_Exec --cmd_set=General --cmd_id=48 --payload_hex="01" --seq_num=1000

For more details regarding the packet, search for "General - Encrypt Config - 0x30" in the dissector:
o-gs/dji-firmware-tools

5yoda5 · Aug 8, 2018

5yoda5 said:
Why do I think that a flexible cable is not currently the cause:
1. There was a crash, cute off the lower part of the from the top part gimbal. On the bottom cover of the top board there was a trail of impact (crack of the cover). The top board is without visible damage.
2. The arm yaw and the flexible ribbon cable were replaced (yes, not original).
3. The image from the camera was, the gimbal was stabilized, but the image looked like this (attach).
4. Since there was a message in Go about the old firmware, it was decided to update the firmware. The update was not completed normally.
Preliminary diagnosis - damage to the memory nand (may solder bounced in the BGA).

Yesterday I completely restored my Phantom. It is a pain.... (in my case)
1. I bought a new top gimbal board. I put it, I did not have any stabilization, the camera did not started completely, but there were weak sounds.
2. After that I ATTENTIVELY looked at the flex ribbon cable. On closer examination, the difference in the connector pad on the matrix board (the lower part of the gimbal) was noticed. And I saw on it the marking P01107.09. While all sellers on Aliexpress and Ebay had a loop version of P01107.08. And even seller of the original version! (but also for Phantom 3 adv/pro) With great difficulty, I found MY version of the cable.
I ordered the correct flex ribbon, I put it with a new top plate of the gimbal. When i turned on, there was a change of firmware. After the reboot, the stabilization of the camera appeared, and the image in the GO.
After that, I brought back the old ("broken") top gimbal board. The camera has flashed. After the reboot everything worked! NAND memory did not re-solder.

It was all in the wrong cable version. After installing the correct revision of the flex ribbon cable, the all has been working properly.
I'm happy.

My old cable:

I buy:

quaddamage · Aug 9, 2018

5yoda5 said:
It was all in the wrong cable version. After installing the correct revision of the flex ribbon cable, the all has been working properly.

Congrats on fixing the gimbal!

Regarding the difference in the flat film cables you noticed, do you mean the power pads on the right? While the difference in copper filling is noticeable there, I can't spot any difference in the actual contact points...

(please note that the flat film cable is not a ribbon cable; I have no idea why so many people use the wrong names; it confuses me every time)

5yoda5 · Aug 9, 2018

quaddamage said:
Congrats on fixing the gimbal!

Thank you!

quaddamage said:
Regarding the difference in the flat film cables you noticed, do you mean the power pads on the right?

Exactly.

quaddamage said:
While the difference in copper filling is noticeable there, I can't spot any difference in the actual contact points...

Correctly. Both versions are suitable for my camera. Therefore, they have one revision number.
Here's to compare the photo cable, which is mostly sold everywhere:

(not correct for my)
Here the points of contact are different from my version. But also sold as a cable for Phantom 3 adv/pro.

quaddamage said:
(please note that the flat film cable is not a ribbon cable; I have no idea why so many people use the wrong names; it confuses me every time)

So it is called all the sellers, and so it is easier to search in the online store. I would just call it a gimbal flat cable.

romster2018 · Aug 16, 2018

Hello pilots!
there is a problem with the GL300A after rebuilding the bootloader when connecting a smartphone (xiaomi note 3 pro) writes in the logs of the terminal:

[ 105.010000] usb 1-1.1: new high speed USB device using musb_hdrc and address 4
[ 105.130000] usb 1-1.1: configuration #1 chosen from 1 choice
DummyRead68013 0.000000kb
**********android device add vid = 0x2717**********
thread_connection_fun thread running * * * * * * *
conn failed, type:0, port:22345
error: device not found
conn failed, type:0, port:22346
conn failed, type:0, port:22345
DummyRead68013 0.000000kb
error: device unauthorized. Please check the confirmation dialog on your device.
conn failed, type:0, port:22346
DummyRead68013 0.000000kb

what's wrong ?

quaddamage · Aug 16, 2018

romster2018 said:
there is a problem with the GL300A after rebuilding the bootloader when connecting a smartphone (xiaomi note 3 pro) writes in the logs of the terminal:

How exactly were you able to read the logs on your smartphone? I had to solder to pads on the Interface Board to get this log..

Code:

conn failed, type:0, port:22345
error: device not found
conn failed, type:0, port:22346
conn failed, type:0, port:22345
DummyRead68013 0.000000kb
error: device unauthorized. Please check the confirmation dialog on your device.
conn failed, type:0, port:22346
DummyRead68013 0.000000kb

Strange.. I can't tell if there's an issue with mobile device, or with connection between Interface Board and GL300 Main Board.

romster2018 · Aug 16, 2018

This is the download log of linux gl300a I copied with putty on a PC connected to uart dm368 gl300a

Attention please on the line:
error: device unauthorized. Please check the confirmation dialog on your device.

Maybe everything is fine, just gl300a does not support xiaomi note 3 pro and I need to try the luck of connecting with another smartphone from the official list of compatible ones?

quaddamage · Aug 17, 2018

romster2018 said:
This is the download log of linux gl300a I copied with putty on a PC connected to uart dm368 gl300a

Oh I see, I misinterpreted your statement.

romster2018 said:
Maybe everything is fine, just gl300a does not support xiaomi note 3 pro and I need to try the luck of connecting with another smartphone

Yes, you should try that. Also, make sure primary kernel is booting, not the recovery one.

romster2018 · Aug 17, 2018

quaddamage said:
Also, make sure primary kernel is booting, not the recovery one.

I see, you are very well versed, please see the full log of the launch GL300A

DM36x initialization passed!
UBL Product Vesion : DJI-GSP-UBL-1.0-rc10(2014-08-15)
Dji UBL Version: 1.51(Aug 15 2014 - 17:05:12)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Uboot Checksum:0x7E25B44B
Actua Checksum:0x7E25B44B

U-Boot Product Vesion : DJI-GSP-Uboot-1.0-rc4(2014-07-23)
U-Boot 2010.12-rc2-svn-Dji (Jul 23 2014 - 11:14:40)
Cores: ARM 432 MHz
DDR: 297 MHz
I2C: ready
DRAM: 128 MiB
NAND: 128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net: Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds

Loading from nand0, offset 0x4a0000
** Unknown image type
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Loading from nand0, offset 0x900000
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-02-12 3:09:59 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3665856 Bytes = 3.5 MiB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-02-12 3:09:59 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 3665856 Bytes = 3.5 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 0.000000] Kernel Product Vesion : DJI-GRC-Kernel-1.0-rc8(2014-11-21)
[ 0.000000] Linux version 2.6.32.17-davinci1 (u@dji) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #1 PREEMPT Thu Feb 12 11:09:57 HKT 2015
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: DaVinci DM36x EVM
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] DaVinci dm36x_rev1.2 variant 0x8
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 12192
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rw dm365_imp.oper_mode=0 video=davincifb:vid0=0,10K:vid1=0,10K

sd0=1920x1080X16,8100K mem=48MB davinci_enc_mngr.ch0_output=COMPOSITE davinci_enc_mngr.ch0_mode=pal ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs ip=off lpj=1077248
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 48MB = 48MB total
[ 0.000000] Memory: 44836KB available (3304K code, 409K data, 108K init, 0K highmem)
[ 0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:245
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] Calibrating delay loop (skipped) preset value.. 215.44 BogoMIPS (lpj=1077248)
[ 0.000000] Mount-cache hash table entries: 512
[ 0.000000] CPU: Testing write buffer coherency: ok
[ 0.000000] DaVinci: 8 gpio irqs
[ 0.000000] NET: Registered protocol family 16
[ 0.080000] bio: create slab <bio-0> at 0
[ 0.080000] SCSI subsystem initialized
[ 0.090000] usbcore: registered new interface driver usbfs
[ 0.090000] usbcore: registered new interface driver hub
[ 0.090000] usbcore: registered new device driver usb
[ 0.100000] cfg80211: Using static regulatory domain info
[ 0.100000] cfg80211: Regulatory domain: US
[ 0.100000] (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 0.100000] (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
[ 0.100000] (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.100000] (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.100000] (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.100000] (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.100000] (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
[ 0.100000] cfg80211: Calling CRDA for country: US
[ 0.100000] Switching to clocksource timer0_1
[ 0.110000] musb_hdrc: version 6.0, pio, host, debug=0
[ 0.130000] musb_hdrc: USB Host mode controller at fec64000 using PIO, IRQ 12
[ 0.130000] musb_hdrc musb_hdrc: MUSB HDRC host driver
[ 0.130000] musb_hdrc musb_hdrc: new USB bus registered, assigned bus number 1
[ 0.130000] usb usb1: configuration #1 chosen from 1 choice
[ 0.130000] hub 1-0:1.0: USB hub found
[ 0.130000] hub 1-0:1.0: 1 port detected
[ 0.130000] NET: Registered protocol family 2
[ 0.130000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.130000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.130000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.130000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.130000] TCP reno registered
[ 0.130000] NET: Registered protocol family 1
[ 0.130000] RPC: Registered udp transport module.
[ 0.130000] RPC: Registered tcp transport module.
[ 0.130000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.140000] kfile init
[ 0.140000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.140000] msgmni has been set to 87
[ 0.150000] alg: No test for stdrng (krng)
[ 0.150000] io scheduler noop registered (default)
[ 0.210000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.210000] serial8250.0: ttyS0 at MMIO 0x1c20000 (irq = 40) is a 16550A
[ 0.580000] console [ttyS0] enabled
[ 0.590000] serial8250.0: ttyS1 at MMIO 0x1d06000 (irq = 41) is a 16550A
[ 0.600000] brd: module loaded
[ 0.610000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
[ 0.620000] Creating 4 MTD partitions on "davinci_nand.0":
[ 0.620000] 0x000000000000-0x0000004a0000 : "bootloader"
[ 0.630000] 0x0000004a0000-0x000000e00000 : "kernel"
[ 0.640000] 0x000000e00000-0x000007f00000 : "filesystem"
[ 0.650000] 0x000000000000-0x000008000000 : "all"
[ 0.660000] davinci_nand davinci_nand.0: controller rev. 2.3
[ 0.670000] UBI: attaching mtd2 to ubi0
[ 0.670000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.680000] UBI: logical eraseblock size: 126976 bytes
[ 0.680000] UBI: smallest flash I/O unit: 2048
[ 0.690000] UBI: sub-page size: 512
[ 0.690000] UBI: VID header offset: 2048 (aligned 2048)
[ 0.700000] UBI: data offset: 4096
[ 0.820000] usb 1-1: new high speed USB device using musb_hdrc and address 2
[ 0.970000] usb 1-1: configuration #1 chosen from 1 choice
[ 0.970000] hub 1-1:1.0: USB hub found
[ 0.990000] hub 1-1:1.0: 2 ports detected
[ 1.210000] UBI: attached mtd2 to ubi0
[ 1.220000] UBI: MTD device name: "filesystem"
[ 1.220000] UBI: MTD device size: 113 MiB
[ 1.230000] UBI: number of good PEBs: 904
[ 1.230000] UBI: number of bad PEBs: 0
[ 1.230000] UBI: max. allowed volumes: 128
[ 1.240000] UBI: wear-leveling threshold: 4096
[ 1.240000] UBI: number of internal volumes: 1
[ 1.250000] UBI: number of user volumes: 1
[ 1.250000] UBI: available PEBs: 0
[ 1.260000] UBI: total number of reserved PEBs: 904
[ 1.260000] UBI: number of PEBs reserved for bad PEB handling: 9
[ 1.270000] UBI: max/mean erase counter: 53/1
[ 1.270000] UBI: image sequence number: 1259737329
[ 1.280000] UBI: background thread "ubi_bgt0d" started, PID 272
[ 1.290000] console [netcon0] enabled
[ 1.290000] netconsole: network logging started
[ 1.300000] Initializing USB Mass Storage driver...
[ 1.300000] usbcore: registered new interface driver usb-storage
[ 1.310000] USB Mass Storage support registered.
[ 1.310000] usbcore: registered new interface driver usbtest
[ 1.320000] i2c /dev entries driver
[ 1.320000] watchdog watchdog: heartbeat 1 sec
[ 1.330000] TCP cubic registered
[ 1.330000] NET: Registered protocol family 17
[ 1.340000] lib80211: common routines for IEEE802.11 drivers
[ 1.340000] ksocket init
[ 1.370000] encrypt device:atsha204 found
[ 1.470000] mfi_i2c_client addr:17
[ 1.470000] Clocks: disable unused vpss_master
[ 1.470000] Clocks: disable unused mmcsd0
[ 1.470000] Clocks: disable unused mmcsd1
[ 1.470000] Clocks: disable unused spi0
[ 1.470000] Clocks: disable unused spi1
[ 1.470000] Clocks: disable unused spi2
[ 1.470000] Clocks: disable unused spi3
[ 1.470000] Clocks: disable unused spi4
[ 1.470000] Clocks: disable unused pwm0
[ 1.470000] Clocks: disable unused pwm1
[ 1.470000] Clocks: disable unused pwm2
[ 1.470000] Clocks: disable unused pwm3
[ 1.470000] Clocks: disable unused timer1
[ 1.470000] Clocks: disable unused timer3
[ 1.470000] Clocks: disable unused emac
[ 1.470000] Clocks: disable unused voice_codec
[ 1.470000] Clocks: disable unused asp0
[ 1.470000] Clocks: disable unused rto
[ 1.470000] Clocks: disable unused mjcp
[ 1.550000] davinci_emac_probe: using random MAC addr: 92:42:63:1b:24:2a
[ 1.560000] emac-mii: probed
[ 1.600000] UBIFS: recovery needed
[ 1.650000] UBIFS: recovery completed
[ 1.650000] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 1.660000] UBIFS: file system size: 110342144 bytes (107756 KiB, 105 MiB, 869 LEBs)
[ 1.660000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 1.670000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 1.680000] UBIFS: default compressor: lzo
[ 1.680000] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 1.690000] VFS: Mounted root (ubifs filesystem) on device 0:13.
[ 1.700000] Freeing init memory: 108K

Filesystem Product Vesion : DJI-Filesystem-1.0-rc2
Runing /etc/init.d/rcS
[ 3.430000] CMEMK module: built on Jul 30 2014 at 10:21:45
[ 3.450000] Reference Linux version 2.6.32
[ 3.450000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c
[ 3.470000] allocated heap buffer 0xc7000000 of size 0x4400000
[ 3.500000] heap fallback enabled - will try heap if pool buffer is not available
[ 3.510000] CMEM Range Overlaps Kernel Physical - allowing overlap
[ 3.520000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)
[ 3.520000] cmemk initialized
[ 3.550000] IRQK module: built on Jul 30 2014 at 10:21:09
[ 3.570000] Reference Linux version 2.6.32
[ 3.570000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c
[ 3.590000] irqk initialized
[ 3.640000] EDMAK module: built on Jul 30 2014 at 10:19:34
[ 3.660000] Reference Linux version 2.6.32
[ 3.660000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c
[ 3.880000] exFAT: Version 1.2.9
settime failed
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[ 11.500000] usbcore: registered new interface driver usb_applehid
[ 11.530000] usb applehid module init ok
[ 11.560000] usbcore: registered new interface driver usb_68013
[ 11.590000] usb 68013 module init ok
sulogin: no password entry for root
login[407]: root login on 'ttyS0'
#Process /etc/profile...
root@Dji-Pro:~# encrypt check ok
init libusb successed!!!
usbmuxd disabled
usbsocket_init OK
usbsocket_create_handle ok, port:22345, bCanRecv:1
usbsocket_create_handle ok, port:22346, bCanRecv:0
watchdog timeout:5
DummyRead68013 0.000000kb
umount: can't umount /mnt/usb: No such file or directory
rmdir: '/mnt/usb': No such file or directory
DummyRead68013 0.000000kb
DummyRead68013 0.000000kb
DummyRead68013 0.000000kb
DummyRead68013 0.000000kb
DummyRead68013 0.000000kb
encrypt chip exist
DummyRead68013 0.000000kb
error: device not found
conn failed, type:0, port:22345
conn failed, type:0, port:22346
conn failed, type:0, port:22345
DummyRead68013 0.000000kb
error: device not found
conn failed, type:0, port:22346
conn failed, type:0, port:22345
conn failed, type:0, port:22346
conn failed, type:0, port:22345

quaddamage · Aug 17, 2018

romster2018 said:
I see, you are very well versed, please see the full log of the launch GL300A

Yup, primary kernel is damaged, recovery is booting.

Code:

Loading from nand0, offset 0x4a0000
** Unknown image type
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Loading from nand0, offset 0x900000

Can you start firmware update from the app? That would flash it for you.

romster2018 · Aug 17, 2018

quaddamage said:
Can you start firmware update from the app?

In recovery boot recovery mode, should the smartphone be connected?
p.s. I'm reading this article o-gs/dji-firmware-tools, can I then just flashing on this instruction?

quaddamage · Aug 17, 2018

romster2018 said:
In recovery boot recovery mode, should the smartphone be connected?

I don't know. Since you said it doesn't work, it probably shouldn't.

romster2018 said:
p.s. I'm reading this article o-gs/dji-firmware-tools, can I then just flashing on this instruction?

Yes.

romster2018 · Aug 17, 2018

OK, I suspect that I need to continue from this point? o-gs/dji-firmware-tools
I apologize, I am very poorly versed, but there is a strong desire to win ))

romster2018 · Aug 17, 2018

I have:

uImage_recovery
dm365_secret.bin
dm365_root_ubifs.ubi

can not find Primary Kernel.

quaddamage · Aug 17, 2018

romster2018 said:
can not find Primary Kernel.

Did you read that?

wiki said:
you will want to flash the primary kernel, uImage, which you can get from any firmware update (see chapter about flashing bootloader for firmware module marking)

romster2018 · Aug 17, 2018

I loaded 'uImage_recovery' in the board, can I now start the kernel recovery from USB from file P3X_FW_V01.03.0020.bin?
it's a mockery of some people, please post a file Primary Kernel gl300a

romster2018 · Aug 19, 2018

I have a problem with unpacking the firmware, error:

C:\Users\11\Desktop\P3P>dji_fwcon.py -vvv -x -p P3X_FW_V01.03.0020.bin
Traceback (most recent call last):
File "C:\Users\11\Desktop\P3P\dji_fwcon.py", line 15, in <module>
from Crypto.Cipher import AES
ModuleNotFoundError: No module named 'Crypto.Cipher'

Installed: Python3.7
Modules:Crypto,Cipher,Cryptodome

quaddamage · Aug 20, 2018

romster2018 said:
ModuleNotFoundError: No module named 'Crypto.Cipher'

You either don't have that module installed, or you have two Python versions and you're using one without it.

romster2018 · Aug 20, 2018

Yahoo !!! I finally managed to decompose FW
on windows 7 installed python3.6.0 on it installed the module (the only well established and did not pull the caravan ... MS C ++) pycryptodome-3.6.6
Then I was helped by my home Web server on ubuntu decrypted using openssl.
Now I'm waiting for the end of the working day to download Primary kernel and etc. I hope everything will work, it was a very big work.