Time for a final act of the story.
The wiki was recently updated with downloads of all firmware partitions for the Gimbal Top board:
Flashing firmware on DaVinci media processors · mefistotelis/phantom-firmware-tools Wiki · GitHub
Well, to be exact, all besides the partitions which are part of every firmware update. But these can be easily extracted from any of the firmware updates:
Code:
./dji_fwcon.py -vvv -x -p P3X_FW_V01.07.0060.bin
openssl des3 -d -k Dji123456 -in P3X_FW_V01.07.0060_m0800.bin -out P3X_FW_V01.07.0060_m0800_decrypted.tar.gz
tar -zxf P3X_FW_V01.07.0060_m0800_decrypted.tar.gz
After the files are extracted, dji/data/uImage file can be just flashed directly as primary kernel, and u-boot partitions need one more operation:
Code:
dd if=dji/data/u-boot.img of=u-boot_prop.img bs=2048 skip=1
dd if=dji/data/ubl_297m_1.img of=ubl_297m_1_prop.img bs=2048 skip=1
So the commands above, plus the downloads from wiki, gave me the complete set of partitions:
- two u-boot images (u-boot_prop.img and ubl_297m_1_prop.img)
- primary kernel (uImage)
- recovery kernel (uImage_recovery)
- secret partition (dm365_secret.bin)
- root filesystem (dm365_root_ubifs.ubi)
I wrote all the images as instructed on the wiki. Only root filesystem is a bit tricky - it is written in a different way than other images, and also it is the largest image. Not too large though - transferring it over serial shouldn't take more than 2 hours (I was able to use USB, so the transfer was very fast).
On the USB - while mine was working, it looks like only on some boards the USB is easy to start. If it doesn't want to work, it is better to just use serial - the root filesystem image is small enough to fit on ramdisk while the recovery system is started (the wiki describes how to prepare a recovery system).
After everything has been flashed, the board started restarting continously due to no connection to OFDM board:
Code:
DM36x initialization passed!
UBL Product Vesion : DJI-297M-UBL-1.0-rc0(2015-10-30)
Dji UBL Version: 1.51(Nov 2 2015 - 15:45:39)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
DONE
Jumping to entry point at 0x81080000.
U-Boot Product Vesion : DJI-ENC-Uboot-1.0-rc0(2015-11-02)
U-Boot 2010.12-rc2-svn3205-Dji (Nov 02 2015 - 19:07:26)
Cores: ARM 297 MHz
DDR: 270 MHz
I2C: ready
DRAM: 128 MiB
NAND: 128 MiB
MMC: davinci: 0
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment
Net: Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds
Loading from nand0, offset 0x4a0000
** Unknown image type
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Loading from nand0, offset 0x900000
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-03-30 9:54:39 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4032832 Bytes = 3.8 MiB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-03-30 9:54:39 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4032832 Bytes = 3.8 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
[ 0.000000] Kernel Product Vesion : DJI-NOHDMI-WM610-Kernel-1.0-rc6(2015-03-30)
[ 0.000000] Linux version 2.6.32.17-davinci1 (root@dji) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #16 PREEMPT Mon Mar 30 17:54:38 HKT 2015
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: DaVinci DM36x EVM
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] DaVinci dm36x_rev1.2 variant 0x8
[...]
[ 7.650000] usbcore: registered new interface driver usb_68013
[ 7.680000] usb 68013 module init ok
sulogin: no password entry for root
login[453]: root login on 'ttyS0'
#Process /etc/profile...
root@Dji-Pro:~#
encode_usb V00.02.02.00(Nov 3 2015 11:23:52).
Entry Encrypt qury mode
Init libusb faild!
Auto to detect v[ 10.050000] EVM: switch to ambarella video input
ideo input type:
Default video input selected:Hdmi_yuv
Setting video standard to: 0x100000000000000
Capture input set to Hdmi[ 10.060000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
_yuv:11
[ 10.070000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
[ 10.080000] vpfe-capture vpfe-capture: IPIPE Chained
[ 10.080000] vpfe-capture vpfe-capture: Resizer present
Capture videoStd[ 10.090000] EVM: switch to ambarella video input
Old=0000000b
[ 10.090000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 10.100000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[ 10.110000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 10.120000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
videoFrameRate=30000, width=1280, height=720
Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800
GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001
osdThrFxn: process ID is 458 ***********
watchdog timeout:5
ctrlThrFxn: process ID is 450 ***********
Frmae:1 Pslice = 0, Islice = 8[44ms]
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 61% Video fps: 4 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution: 1280x720
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution: 1280x720
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 5% Video fps: 3 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:05 Resolution: 1280x720
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
No USB device ID:547
try reset 68013....!
ARM Load: 9% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:07 Resolution: 1280x720
umount: can't remount none read-only
umount: mdev busy - remounted read-only
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
I reassembled the gimbal, tested it, and (after two more partial re-assemblies due to my mistakes) - everything started working.
FPV video on tablet is restored.
UPDATE - Regarding 8 FPS FPV after NAND replace:
A few people contacted me about an issue which happens after replacing the NAND chip in the way I described. The issue is that live feed on the mobile device is choppy - works only at 8 frames per second.
The issue was diagnosed as related to SHA204 chip which provides encryption capabilities. The chip is generally unused, but when encryption mismatch is detected, it re-tries the encryption tests over and over, consuming big chunk of processing power.
Recently a tool was published which can be used to modify DM365 firmware and remove re-tries mechanism, bringing FPV back to full rate. The tool is here:
dji-firmware-tools - dm3xx_encode_usb_hardcoder
