Fixing flash in DM365 chip within Ph3 Pro gimbal

[quaddamage]

Your boot stops at a specific line. I googled that line. Didn't got a fix in google, but adding "dm365" to the search I got a few logs where this issue is not present, ie. this one:

Log from boot of HDMI module

In this log, I see:

[    1.500000] usbmouse: v1.6:USB HID Boot Protocol mouse driver
[    1.510000] TCP cubic registered
[    1.510000] NET: Registered protocol family 17
[    1.520000] lib80211: common routines for IEEE802.11 drivers <--- THIS IS WHERE YOUR BOOT STOPS
[    1.520000] ksocket init
[    1.550000] encrypt device:atsha204 found
[    1.630000] mfi_i2c_client addr:17
[    1.640000] Clocks: disable unused mmcsd0
[    1.640000] Clocks: disable unused mmcsd1
[    1.640000] Clocks: disable unused spi0
[    1.640000] Clocks: disable unused spi1
[    1.640000] Clocks: disable unused spi2
[    1.640000] Clocks: disable unused spi3
[    1.640000] Clocks: disable unused spi4
[    1.640000] Clocks: disable unused pwm0
[    1.640000] Clocks: disable unused pwm1
[    1.640000] Clocks: disable unused pwm2
[    1.640000] Clocks: disable unused pwm3
[    1.640000] Clocks: disable unused timer1
[    1.640000] Clocks: disable unused timer3
[    1.640000] Clocks: disable unused emac
[    1.640000] Clocks: disable unused voice_codec
[    1.640000] Clocks: disable unused asp0
[    1.640000] Clocks: disable unused rto
[    1.640000] Clocks: disable unused mjcp
[    1.710000] davinci_emac_probe: using random MAC addr: 7a:d5:d4:1e:06:1b
[    1.720000] emac-mii: probed
[    1.760000] UBIFS: recovery needed
[    1.810000] UBIFS: recovery completed

Soon after your freeze, there's "encrypt device:atsha204 found" message. Maybe this is the module which stopped the boot? Did you flash the secret partition?

Is there an image of the first main core? how do I get it out of the firmware ?

The commands are in my first 3 "story" posts.

 

[Vadzimsychou]

I didn't update the secret section, so I guess I should try it? can I explain in more detail how to use the main section? I've read your post more than once, but I don't know much about programming, maybe there is a video or more detailed instructions?

 

[quaddamage]

I didn't update the secret section, so I guess I should try it? can I explain in more detail how to use the main section? I've read your post more than once, but I don't know much about programming, maybe there is a video or more detailed instructions?

I made a very detailed guide for fixing the same chip in GL300. Everything there applies to the gimbal as well.

Fixing flash programming in DM365 chip within GL300 remote controller

Here you will find not only instructions to blindly follow, but an explanation of what you're really doing. Fixing is also preceded by diagnosis - this is how all repairs should look like. So, here is the link to my DM365 chip reflashing tutorial, with specific tasks performed on GL300 RC...

phantompilots.com

 

[Vadzimsychou]

Thank you for your answer, based on the operating Board, we can see that the main core and the recovery core are completely identical? Are they identical? Can I upload a booting kernel file to the main kernel???


Loading from nand0, offset 0x4a0000
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-06-23 9:37:05 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4065664 Bytes = 3.9 MiB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.32.17-davinci1
Created: 2015-06-23 9:37:05 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4065664 Bytes = 3.9 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK

 

[quaddamage]

You should take more care writing posts. Not only because of the grammar, but also because I'm pretty sure answers to your questions are in the GL300 fixing guide I made.

So the bootlader is trying to load kernel. Now let's make sure it is succeeding in the loading. If it does, then the bootloader work should end with Starting kernel ... as above. But wait! There are two copies of the kernel stored, and only one of these is proper, working kernel. The other is a recovery kernel, used to make it easier to fix stuff in case primary kernel dies. This recovery kernel can't correctly connect to the Mobile Device.

Recovery kernel is normally different than primary kernel, but you can write the same image of primary kernel to both locations and that won't change how the board works.

 

[ADI8421]

Thank you for your answer, based on the operating Board, we can see that the main core and the recovery core are completely identical? Are they identical? Can I upload a booting kernel file to the main kernel???
............................

You must read each and every post in this thread, especially if you are not familiar with Python interpreter.
This thread has a fairly lengthy learning curve, but the results pay for your effort in the end.
Quaddamage is the guru here, so treat him nicely !

 

[ADI8421]

Спасибо за ваш ответ, можете посмотреть, что я получил, я обновил секретный раздел и основное ядро. Что скажешь? Обновить файловую систему сейчас?
..................

мы не понимаем русский

 

[Vadzimsychou]

this is the whole problem, when translating, I do not understand everything that is written in your posts. I don't understand how I can extract the primary core..I updated the secret section, and loaded the recovery kernel in the primary, it turned out two identical. here's what the terminal prints

DM36x initialization passed!
UBL Product Vesion : DJI-GSP-UBL-1.0-rc10(2014-08-15)
Dji UBL Version: 1.51(Aug 15 2014 - 17:05:12)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Uboot Checksum:0x7E25B44B
Actua Checksum:0x7E25B44B
DM36x initialization passed!
UBL Product Vesion : DJI-GSP-UBL-1.0-rc10(2014-08-15)
Dji UBL Version: 1.51(Aug 15 2014 - 17:05:12)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Uboot Checksum:0x7E25B44B
Actua Checksum:0x7E25B44B

U-Boot Product Vesion : DJI-GSP-Uboot-1.0-rc4(2014-07-23)
U-Boot 2010.12-rc2-svn-Dji (Jul 23 2014 - 11:14:40)
Cores: ARM 432 MHz
DDR:   297 MHz
I2C:   ready
DRAM:  128 MiB
NAND:  128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net:   Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds

Loading from nand0, offset 0x4a0000
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Booting kernel from Legacy Image at 80700000 ...
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

[    0.000000] Kernel Product Vesion : DJI-NOHDMI-WM610-Kernel-1.0-rc6(2015-03-30)
[    0.000000] Linux version 2.6.32.17-davinci1 (root@dji) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #16 PREEMPT Mon Mar 30 17:54:38 HKT 2015
[    0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: DaVinci DM36x EVM
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] DaVinci dm36x_rev1.2 variant 0x8
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 12192
[    0.000000] Kernel command line: console=ttyS0,115200n8 rw dm365_imp.oper_mode=0 video=davincifb:vid0=0,10K:vid1=0,10K:osd0=1920x1080X16,8100K mem=48MB davinci_enc_mngr.ch0_output=COMPOSITE davinci_enc_mngr.ch0_mode=pal ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs ip=off lpj=1077248
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 48MB = 48MB total
[    0.000000] Memory: 44452KB available (3640K code, 451K data, 116K init, 0K highmem)
[    0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:245
[    0.000000] Console: colour dummy device 80x30
[    0.000000] Calibrating delay loop (skipped) preset value.. 215.44 BogoMIPS (lpj=1077248)
[    0.000000] Mount-cache hash table entries: 512
[    0.000000] CPU: Testing write buffer coherency: ok
[    0.000000] DaVinci: 8 gpio irqs
[    0.000000] NET: Registered protocol family 16
[    0.110000] bio: create slab <bio-0> at 0
[    0.110000] DM365 IPIPE initialized in Continuous mode
[    0.110000] SCSI subsystem initialized
[    0.120000] usbcore: registered new interface driver usbfs
[    0.120000] usbcore: registered new interface driver hub
[    0.120000] usbcore: registered new device driver usb
[    0.120000] vpss vpss: dm365_vpss vpss probed
[    0.120000] vpss vpss: dm365_vpss vpss probe success
[    0.120000] dm365_afew_hw_init
[    0.130000] ch0 default output "COMPOSITE", mode "PAL"
[    0.130000] VPBE Encoder Initialized
[    0.130000] cfg80211: Using static regulatory domain info
[    0.130000] cfg80211: Regulatory domain: US
[    0.130000]  (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[    0.130000]  (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
[    0.130000]  (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[    0.130000]  (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[    0.130000]  (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[    0.130000]  (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[    0.130000]  (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
[    0.130000] cfg80211: Calling CRDA for country: US
[    0.130000] LogicPD encoder initialized
[    0.130000] Switching to clocksource timer0_1
[    0.140000] musb_hdrc: version 6.0, pio, host, debug=0
[    0.160000] musb_hdrc: USB Host mode controller at fec64000 using PIO, IRQ 12
[    0.160000] musb_hdrc musb_hdrc: MUSB HDRC host driver
[    0.160000] musb_hdrc musb_hdrc: new USB bus registered, assigned bus number 1
[    0.160000] usb usb1: configuration #1 chosen from 1 choice
[    0.160000] hub 1-0:1.0: USB hub found
[    0.160000] hub 1-0:1.0: 1 port detected
[    0.160000] NET: Registered protocol family 2
[    0.160000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.160000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.160000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.160000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.160000] TCP reno registered
[    0.160000] NET: Registered protocol family 1
[    0.160000] RPC: Registered udp transport module.
[    0.160000] RPC: Registered tcp transport module.
[    0.160000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.170000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.170000] msgmni has been set to 86
[    0.180000] alg: No test for stdrng (krng)
[    0.180000] io scheduler noop registered (default)
[    0.210000] VBUS on (a_wait_vrise), devctl 19
[    0.220000] davincifb davincifb.0: dm_osd0_fb: Initial window configuration is invalid.
[    0.300000] Console: switching to colour frame buffer device 240x67
[    0.390000] davincifb davincifb.0: dm_osd0_fb: 1920x1080x16@0,0 with framebuffer size 8100KB
[    0.390000] davincifb davincifb.0: dm_vid0_fb: 0x0x16@0,0 with framebuffer size 10KB
[    0.390000] davincifb davincifb.0: dm_osd1_fb: 720x576x4@0,0 with framebuffer size 810KB
[    0.400000] davincifb davincifb.0: dm_vid1_fb: 0x0x16@0,0 with framebuffer size 10KB
[    0.460000] DM365 IPIPEIF probed
[    0.460000] imp serializer initialized
[    0.460000] davinci_previewer initialized
[    0.460000] davinci_resizer initialized
[    0.460000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.470000] serial8250.0: ttyS0 at MMIO 0x1c20000 (irq = 40) is a 16550A
[    0.930000] console [ttyS0] enabled
[    0.940000] serial8250.0: ttyS1 at MMIO 0x1d06000 (irq = 41) is a 16550A
[    0.950000] brd: module loaded
[    0.960000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
[    0.970000] Creating 4 MTD partitions on "davinci_nand.0":
[    0.970000] 0x000000000000-0x0000004a0000 : "bootloader"
[    0.980000] 0x0000004a0000-0x000000e00000 : "kernel"
[    0.990000] 0x000000e00000-0x000007f00000 : "filesystem"
[    1.000000] 0x000000000000-0x000008000000 : "all"
[    1.010000] davinci_nand davinci_nand.0: controller rev. 2.3
[    1.010000] UBI: attaching mtd2 to ubi0
[    1.020000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    1.020000] UBI: logical eraseblock size:    126976 bytes
[    1.030000] UBI: smallest flash I/O unit:    2048
[    1.030000] UBI: sub-page size:              512
[    1.040000] UBI: VID header offset:          2048 (aligned 2048)
[    1.050000] UBI: data offset:                4096
[    1.530000] UBI: attached mtd2 to ubi0
[    1.530000] UBI: MTD device name:            "filesystem"
[    1.540000] UBI: MTD device size:            113 MiB
[    1.540000] UBI: number of good PEBs:        904
[    1.550000] UBI: number of bad PEBs:         0
[    1.550000] UBI: max. allowed volumes:       128
[    1.560000] UBI: wear-leveling threshold:    4096
[    1.560000] UBI: number of internal volumes: 1
[    1.560000] UBI: number of user volumes:     0
[    1.570000] UBI: available PEBs:             891
[    1.570000] UBI: total number of reserved PEBs: 13
[    1.580000] UBI: number of PEBs reserved for bad PEB handling: 9
[    1.580000] UBI: max/mean erase counter: 2/1
[    1.590000] UBI: image sequence number: 0
[    1.590000] UBI: background thread "ubi_bgt0d" started, PID 331
[    1.600000] console [netcon0] enabled
[    1.600000] netconsole: network logging started
[    1.610000] Initializing USB Mass Storage driver...
[    1.620000] usbcore: registered new interface driver usb-storage
[    1.620000] USB Mass Storage support registered.
[    1.630000] i2c /dev entries driver
[    1.630000] Linux video capture interface: v2.00
[    1.640000] vpfe_init
[    1.640000] vpfe-capture: vpss clock vpss_master enabled
[    1.650000] vpfe-capture vpfe-capture: v4l2 device registered
[    1.650000] vpfe-capture vpfe-capture: video device registered
[    1.660000] EVM: switch to ambarella video input
[    1.660000] vpfe-capture vpfe-capture: v4l2 sub device ambarella registered
[    1.670000] vpfe_register_ccdc_device: DM365 ISIF
[    1.680000] DM365 ISIF is registered with vpfe.
[    1.680000] Trying to register davinci display video device.
[    1.690000] layer=c1080c00,layer->video_dev=c1080d64
[    1.690000] Trying to register davinci display video device.
[    1.700000] layer=c1081000,layer->video_dev=c1081164
[    1.710000] davinci_init:DaVinci V4L2 Display Driver V1.0 loaded
[    1.710000] watchdog watchdog: heartbeat 1 sec
[    1.720000] TCP cubic registered
[    1.720000] NET: Registered protocol family 17
[    1.730000] lib80211: common routines for IEEE802.11 drivers
[    1.760000] Clocks: disable unused mmcsd0
[    1.760000] Clocks: disable unused mmcsd1
[    1.760000] Clocks: disable unused spi0
[    1.760000] Clocks: disable unused spi1
[    1.760000] Clocks: disable unused spi2
[    1.760000] Clocks: disable unused spi3
[    1.760000] Clocks: disable unused spi4
[    1.760000] Clocks: disable unused pwm0
[    1.760000] Clocks: disable unused pwm1
[    1.760000] Clocks: disable unused pwm2
[    1.760000] Clocks: disable unused pwm3
[    1.760000] Clocks: disable unused timer1
[    1.760000] Clocks: disable unused timer3
[    1.760000] Clocks: disable unused emac
[    1.760000] Clocks: disable unused voice_codec
[    1.760000] Clocks: disable unused asp0
[    1.760000] Clocks: disable unused rto
[    1.760000] Clocks: disable unused mjcp
[    1.830000] nnnn===0
[    1.830000] davinci_emac_probe: using random MAC addr: fe:a1:76:f8:b6:96
[    1.840000] emac-mii: probed
[    1.850000] UBIFS error (pid 1): ubifs_get_sb: cannot open "ubi0:rootfs", error -19
[    1.850000] VFS: Cannot open root device "ubi0:rootfs" or unknown-block(0,0)
[    1.860000] Please append a correct "root=" boot option; here are the available partitions:
[    1.870000] 1f00            4736 mtdblock0 (driver?)
[    1.870000] 1f01            9600 mtdblock1 (driver?)
[    1.880000] 1f02          115712 mtdblock2 (driver?)
[    1.890000] 1f03          131072 mtdblock3 (driver?)
[    1.890000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.900000] Rebooting in 1 seconds..DM36x initialization passed!
UBL Product Vesion : DJI-GSP-UBL-1.0-rc10(2014-08-15)
Dji UBL Version: 1.51(Aug 15 2014 - 17:05:12)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
Uboot Checksum:0x7E25B44B
Actua Checksum:0x7E25B44B

 

[quaddamage]

The log is matching what you've done so far. Add missing partitions and it will start booting.

For firmware extraction - be more specific about the place where you're stuck. If it's just at start - google a way to run Python script in your OS.

 

[crash1sttime]

This is where I am with this issue so far:

1. When the issue happens, the log does not contain "Encrypt passed!" line. This line shold always be few lines after "Entry Encrypt qury mode".

2. The code which logs the lines is within DaVinci firmware in file `encode_usb`:

void * encryptThrFxn(void *arg)
{
  puts("Entry Encrypt qury mode");
  while ( !Encrypt_Request(1) )
    sleep(1);
  return puts("Encrypt passed!");
}

The function Encrypt_Request() sends an encryption request to Ambarella, and then compares the result with encryption done within DaVinci, using "/etc/key.bin" (a file within DaVinci firmware) as encryption key. It fails when the encryption results are different, which basically means Ambarella uses different key than DaVinci.

3. It is clear that the issue is caused by non-matching encryption keys in Ambarella and DaVinci. Unfortunately we cannot just copy the key file from Ambarella to DaVinci, as the keys are encrypted as well - using hardware encryption with AT88 chip. This means only Ambarella can decrypt the copy stored on Ambarella, and only DaVinci can decrypt the copy stored on DaVinci.

We need to write the new key through AT88 chip so it is properly encrypted. For that we either need to craft and compile a special binary which would use internal firmware functions to write the file through AT88, or figure out an existing way which DJI service uses to sync the keys.

4. With help of Mefistotelis, I was able to find a way which Dji uses to sync the keys. There is a special packet which when sent, changes the keys to what's inside the packet.

To experiment with that packet, I asked Mefistotelis for a command line tool to send packets. And he did made such tool - its called "comm_serialtalk.py".

Now I need to make more tests, but as of now I didn't had time for that. I tried a "Encrypt GetChipState" command which should return the current encryption config, but it failed - did not returned what I wanted:

python3 comm_serialtalk.py COM5 -vv --sender_type=ANY --sender_index=1 --receiver_type=Camera --ack_type=ACK_After_Exec --cmd_set=General --cmd_id=48 --payload_hex="01" --seq_num=1000

For more details regarding the packet, search for "General - Encrypt Config - 0x30" in the dissector:
o-gs/dji-firmware-tools

Did you get anywhere with this, i have the same issue with a board ?, the link you provide doesnt work anymore

 

[quaddamage]

Did you get anywhere with this, i have the same issue with a board ?, the link you provide doesnt work anymore

Yes. This is now solved. Though not by "fixing" the key - we can't do that. The key can be only written once, and it's done at factory.

You need to do a small modification to firmware and remove that encryption check; then everything works.

The firmware modification can be done by the 'hardcoder' tool:

GitHub - o-gs/dji-firmware-tools: Tools for handling firmwares of DJI products, with focus on quadcopters.

Tools for handling firmwares of DJI products, with focus on quadcopters. - o-gs/dji-firmware-tools

github.com

I published a pack of pre-modded firmwares in one of initial posts in this thread. If yours is not there - install Python and use dji-firmware-tools to modify the firmware by yourself.

 

[crash1sttime]

Yes. This is now solved. Though not by "fixing" the key - we can't do that. The key can be only written once, and it's done at factory.

You need to do a small modification to firmware and remove that encryption check; then everything works.

The firmware modification can be done by the 'hardcoder' tool:

GitHub - o-gs/dji-firmware-tools: Tools for handling firmwares of DJI products, with focus on quadcopters.

Tools for handling firmwares of DJI products, with focus on quadcopters. - o-gs/dji-firmware-tools

github.com

I published a pack of pre-modded firmwares in one of initial posts in this thread. If yours is not there - install Python and use dji-firmware-tools to modify the firmware by yourself.

Brilliant, I found the tool pack, but unsure which needs applying, the gimbal light doesnt come on when powered on, comes on when the unit was flashed though, here is the output from putty, im guessing its Option B - replace encode_usb only:


[SERIAL/DIRECT] CONNECTED TO PORT COM5 (115200-8N1)

7d9½¹É}±±Ayrj¤[ 1.020000] UBI: attaching mtd2 to ubi0
[ 1.020000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 1.030000] UBI: logical eraseblock size: 126976 bytes
[ 1.040000] UBI: smallest flash I/O unit: 2048
[ 1.040000] UBI: sub-page size: 512
[ 1.050000] UBI: VID header offset: 2048 (aligned 2048)
[ 1.050000] UBI: data offset: 4096
[ 1.530000] UBI: attached mtd2 to ubi0
[ 1.540000] UBI: MTD device name: "filesystem"
[ 1.540000] UBI: MTD device size: 113 MiB
[ 1.550000] UBI: number of good PEBs: 904
[ 1.550000] UBI: number of bad PEBs: 0
[ 1.560000] UBI: max. allowed volumes: 128
[ 1.560000] UBI: wear-leveling threshold: 4096
[ 1.570000] UBI: number of internal volumes: 1
[ 1.570000] UBI: number of user volumes: 1
[ 1.580000] UBI: available PEBs: 0
[ 1.580000] UBI: total number of reserved PEBs: 904
[ 1.590000] UBI: number of PEBs reserved for bad PEB handling: 9
[ 1.590000] UBI: max/mean erase counter: 174/1
[ 1.600000] UBI: image sequence number: 943561574
[ 1.600000] UBI: background thread "ubi_bgt0d" started, PID 332
[ 1.610000] console [netcon0] enabled
[ 1.610000] netconsole: network logging started
[ 1.620000] Initializing USB Mass Storage driver...
[ 1.620000] usbcore: registered new interface driver usb-storage
[ 1.630000] USB Mass Storage support registered.
[ 1.630000] i2c /dev entries driver
[ 1.640000] Linux video capture interface: v2.00
[ 1.650000] vpfe_init
[ 1.650000] vpfe-capture: vpss clock vpss_master enabled
[ 1.650000] vpfe-capture vpfe-capture: v4l2 device registered
[ 1.660000] vpfe-capture vpfe-capture: video device registered
[ 1.670000] EVM: switch to ambarella video input
[ 1.670000] vpfe-capture vpfe-capture: v4l2 sub device ambarella registered
[ 1.680000] vpfe_register_ccdc_device: DM365 ISIF
[ 1.680000] DM365 ISIF is registered with vpfe.
[ 1.690000] Trying to register davinci display video device.
[ 1.700000] layer=c1094c00,layer->video_dev=c1094d64
[ 1.700000] Trying to register davinci display video device.
[ 1.710000] layer=c1095000,layer->video_dev=c1095164
[ 1.720000] davinci_initaVinci V4L2 Display Driver V1.0 loaded
[ 1.720000] watchdog watchdog: heartbeat 1 sec
[ 1.730000] TCP cubic registered
[ 1.730000] NET: Registered protocol family 17
[ 1.740000] lib80211: common routines for IEEE802.11 drivers
[ 1.760000] Clocks: disable unused mmcsd0
[ 1.760000] Clocks: disable unused mmcsd1
[ 1.760000] Clocks: disable unused spi0
[ 1.760000] Clocks: disable unused spi1
[ 1.760000] Clocks: disable unused spi2
[ 1.760000] Clocks: disable unused spi3
[ 1.760000] Clocks: disable unused spi4
[ 1.760000] Clocks: disable unused pwm0
[ 1.760000] Clocks: disable unused pwm1
[ 1.760000] Clocks: disable unused pwm2
[ 1.760000] Clocks: disable unused pwm3
[ 1.760000] Clocks: disable unused timer1
[ 1.760000] Clocks: disable unused timer3
[ 1.760000] Clocks: disable unused emac
[ 1.760000] Clocks: disable unused voice_codec
[ 1.760000] Clocks: disable unused asp0
[ 1.760000] Clocks: disable unused rto
[ 1.760000] Clocks: disable unused mjcp
[ 1.840000] nnnn===0
[ 1.840000] davinci_emac_probe: using random MAC addr: 9a:51:9c:69:1a:ca
[ 1.850000] emac-mii: probed
[ 1.890000] UBIFS: recovery needed
[ 1.940000] UBIFS: recovery completed
[ 1.940000] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 1.950000] UBIFS: file system size: 110342144 bytes (107756 KiB, 105 MiB, 869 LEBs)
[ 1.960000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 1.960000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 1.970000] UBIFS: default compressor: lzo
[ 1.970000] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 1.980000] VFS: Mounted root (ubifs filesystem) on device 0:13.
[ 1.990000] Freeing init memory: 116K

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>WM610<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

Filesystem Product Vesion : DJI-WM610-Filesystem-1.0-rc3(2014-06-06)
Runing /etc/init.d/rcS
[ 3.740000] UBI: scrubbed PEB 370 (LEB 0:263), data moved to PEB 598
[ 3.860000] CMEMK module: built on Jan 13 2015 at 19:24:09
[ 3.890000] Reference Linux version 2.6.32
[ 3.890000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils
_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c
[ 3.940000] allocated heap buffer 0xc7000000 of size 0x2456000
[ 3.940000] heap fallback enabled - will try heap if pool buffer is not available
[ 3.960000] CMEM Range Overlaps Kernel Physical - allowing overlap
[ 3.960000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)
[ 3.980000] cmemk initialized
[ 4.010000] UBI: scrubbed PEB 392 (LEB 0:158), data moved to PEB 630
[ 4.040000] IRQK module: built on Jan 13 2015 at 19:23:41
[ 4.040000] Reference Linux version 2.6.32
[ 4.050000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils
_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c
[ 4.080000] irqk initialized
[ 4.120000] EDMAK module: built on Jan 13 2015 at 19:23:04
[ 4.120000] Reference Linux version 2.6.32
[ 4.140000] File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils
_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c
[ 4.250000] usbcore: registered new interface driver usb_68013
[ 4.280000] usb 68013 module init ok
sulogin: no password entry for root
login[437]: root login on 'ttyS0'
#Process /etc/profile...
root@Dji-Pro:~#
encode_usb V00.02.02.00(Nov 3 2015 11:23:52).
Entry Encrypt qury mode
Init libusb faild!
Auto to detect v[ 6.580000] EVM: switch to ambarella video input
ideo input type:
Default video input selected:Hdmi_yuv
Setting video standard to: 0x100000000000000
Capture input set to Hdmi[ 6.600000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
_yuv:11
[ 6.610000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
[ 6.620000] vpfe-capture vpfe-capture: IPIPE Chained
[ 6.620000] vpfe-capture vpfe-capture: Resizer present
Capture videoStd[ 6.630000] EVM: switch to ambarella video input
Old=0000000b
[ 6.630000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 6.640000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline
= 1280, sizeimage = 1382400
[ 6.650000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 6.660000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline
= 1280, sizeimage = 1382400
videoFrameRate=30000, width=1280, height=720
Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800
GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001
osdThrFxn: process ID is 442 ***********
watchdog timeout:5
ctrlThrFxn: process ID is 434 ***********
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 52% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution
: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:03 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 4% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:05 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:06 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:07 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 3% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:08 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:09 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:10 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:11 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:12 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:13 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:14 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:15 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:16 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 0% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:17 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:18 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 3% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:19 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 0% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:20 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 0% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:21 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:22 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:23 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:24 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:25 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 3% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:26 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:27 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:28 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 2% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:29 Resolution:
1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
video lost
libusb send error--1
ARM Load: 1% Video fps: 0 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:30 Resolution:
1280x720

 

[Katana423]

Hello everyone! I'm trying to fix my P3X after a crash. I followed the instructions from this thread and o-gs GitHub page and video feed is now works! But camera doesn't able to switch mode to "video capture" in DJI Go app. And not storing photos at SD card. But gimbal creates folders and logs in SD. I checked serial console at U0 and DM36x pins. It seems to be working. But in DJI Go app i see "Camera error (code 01)". SD card is not formatting via gimbal (Formatting failed error) and drone wasn't updating by official firmware file. But it's updating by single (a.k.a raw) modules. I need to update FC firmware but it's encrypted. How can i decrypt a module for successful flashing via SD card?

P.S. If you know what's wrong with my drone, please help
Thanks!

 

[linkintheory]

The log is matching what you've done so far. Add missing partitions and it will start booting.

For firmware extraction - be more specific about the place where you're stuck. If it's just at start - google a way to run Python script in your OS.

Hello, i'm trying to fix a WM320 from a P3X that have no FPV but can capture pics and movie to SD card.
After flashing UB1 and U-boot, UImage file, the board freeze at "Starting kernel ..."

DM36x initialization passed!
UBL Product Vesion : DJI-297M-UBL-1.0-rc0(2015-10-30)
Dji UBL Version: 1.51(Nov  2 2015 - 15:45:39)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
   DONE
Jumping to entry point at 0x81080000.

U-Boot Product Vesion : DJI-ENC-Uboot-1.0-rc0(2015-11-02)
U-Boot 2010.12-rc2-svn3205-Dji (Nov 02 2015 - 19:07:26)
Cores: ARM 297 MHz
DDR:   270 MHz
I2C:   ready
DRAM:  128 MiB
NAND:  128 MiB
MMC:   davinci: 0
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net:   Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds

Loading from nand0, offset 0x4a0000
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-11-02   7:28:36 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4050848 Bytes = 3.9 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Booting kernel from Legacy Image at 80700000 ...
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-11-02   7:28:36 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4050848 Bytes = 3.9 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Nand read and write go smoothly with no problem, but the board cannot boot and no FPV at all, did you ever get this problem?

 

[quaddamage]

After flashing UB1 and U-boot, UImage file, the board freeze at "Starting kernel ..."

That is quite unusual. Kernel is clearly loaded from NAND to memory, and its verification passes. But starting it leads to a freeze.

Kernel checksum is correctly verified. It would be quite unusual for it ti be corrupted in just a correct way so that the crc check still passes.

The first check would be to press the ESC when asked, and type commands to load recovery kernel instead of primary. If the second kernel does the same thing, then there is hardware issue unrelated to the NAND. If second kernel boots - then the primary kernel is clearly corrupted.

Commands to execute should be somewhere on o-gs instruction of DM36x flashing on github.

 

[linkintheory]

That is quite unusual. Kernel is clearly loaded from NAND to memory, and its verification passes. But starting it leads to a freeze.

Kernel checksum is correctly verified. It would be quite unusual for it ti be corrupted in just a correct way so that the crc check still passes.

The first check would be to press the ESC when asked, and type commands to load recovery kernel instead of primary. If the second kernel does the same thing, then there is hardware issue unrelated to the NAND. If second kernel boots - then the primary kernel is clearly corrupted.

Commands to execute should be somewhere on o-gs instruction of DM36x flashing on github.

Tried it and freeze at loading kernel, i guess the flash or the DRAM are defective

 

[fotoluvr2003]

Yesterday I completely restored my Phantom. It is a pain.... (in my case)
1. I bought a new top gimbal board. I put it, I did not have any stabilization, the camera did not started completely, but there were weak sounds.
2. After that I ATTENTIVELY looked at the flex ribbon cable. On closer examination, the difference in the connector pad on the matrix board (the lower part of the gimbal) was noticed. And I saw on it the marking P01107.09. While all sellers on Aliexpress and Ebay had a loop version of P01107.08. And even seller of the original version! (but also for Phantom 3 adv/pro) With great difficulty, I found MY version of the cable.
I ordered the correct flex ribbon, I put it with a new top plate of the gimbal. When i turned on, there was a change of firmware. After the reboot, the stabilization of the camera appeared, and the image in the GO.
After that, I brought back the old ("broken") top gimbal board. The camera has flashed. After the reboot everything worked! NAND memory did not re-solder.

It was all in the wrong cable version. After installing the correct revision of the flex ribbon cable, the all has been working properly.
I'm happy.

My old cable:
View attachment 102241

I buy:
View attachment 102242

5yoda5, sir, you are amazing. I can't thank you enough for this post. I bought a phantom 3 Advanced used that came with everything except the gimbal board. I knew it was a bit of a project, but I got a new board, and I used the new ribbon cable the guy gave me with the drone. I tried two different gimbal boards (I bought both used online), and the new ribbon cable. The bird never worked right. I had the SAME EXACT issues as you - the repeated green light flashing, zero movement in the gimbal, the endless reboots, and the P3A showing as P3P in DJI Go. I worked on this for over a month, but could not understand what was going on. I was doing the same serial interface to interface to the UART, etc. I was about to give up, and I found your post. I still thought that there is no way the ribbon cable was going to fix it (the guy gave me the one he bought - P01107.09), but for $15 or so, I figured it couldn't hurt to buy the P01107.08 version. I connected it, and was shocked and amazed to watch the camera do it's "dance" when I powered up the bird. It now identified as a P3A, the video was perfect, and it even shut down properly as well now. Thank you, thank you, thank you for posting your experience! I am so happy that I didn't have to scrap my investment.

 

[guewald]

I have an P3 4k.
Have reballed the ambarella. Update it to the last firmware successfully but i dont have video feed in the app.
Store proper photos and videos in the SD.
The connection between gimbal top board and ofdm is good.
All devices ok in the log file.

 

[quaddamage]

Have reballed the ambarella. Update it to the last firmware successfully but i dont have video feed in the app.

Make sure the RC is updated to matching version.

Store proper photos and videos in the SD.
The connection between gimbal top board and ofdm is good.
All devices ok in the log file.

No idea. I know nothing about that model, and there are no photos of boards on O-Gs wiki.

Check connectivity between the boards with multimeter?
Look into Ambarella logs from UART pins to figure out whether it successfully sends the video stream?

EDIT:
Btw, if you are able to prepare high quality photos of the boards, both sides - that would help to elevate general knowledge on P3 4K.

 

[joshoreefe]

Oh.. I thought an Advanced board could be flashed the same way as a Pro.

Thanks anyway guys!

Did you ever find a way to have the P3A video feed back to life?