P3P refuses to start upgrade process after forced downgrades

[DannyBoyCJ]

Hello guys, I am new to this so go easy on me please... I upgraded my P3P to version P3X_FW_V01.10.0090, following the DJI guide, and got a failed upgrade signal and the dreaded message in the log file:

[15 00][00] device not detected [08 00][00] device not detected

After this, there was no video transmission. Then I googled the issue and found a guy who said he resolved this by downgrading all the way to the first version available to him (by the "debug" file method), and then upgrading again, step by step, up to version P3X_FW_V01.08.0080, at which time he got a successful upgrade process, and a functional drone. I proceeded to do the same, but when I tried to go from 1.2.3 to 1.1.9, it went wrong. The process didn't finish, and I found the drone with a limp gimbal, the camera just hanging at an angle underneath, beeping. The last thing written in the log file is:

[00055385]Firmware upgrading[1]... [00066342][01 00] Firmware upgrade start...

My problem is that now I can't get it to enter the upgrade mode no matter what firmware version I place on the card, with or without the "Debug" file. When I try to force start the upgrade process by pressing the link button during startup, the gimbal immediately goes limp and starts beeping (but not the normal beeps it emits during upgrade). It actually resumes the state in which I found it after the last failed upgrade. It does nothing and writes no log, no matter how long I leave it at it.

This is the last log file, written at the time of that last failed downgrade: P3X_FW_LOG_AB.txt

So, if you have any ideas, or know of a procedure to make it upgrade again (via serial service pads, or any other method), please help. Also, if you need more info, just let me know. Thank you!

[DannyBoyCJ]

I didn't try 1.09.0060, but "Phantom_3_Professional_Firmware_v1.1.9_en", the one before 1.2.6. The last log my drone wrote is from 6 weeks ago, when it got screwed up during downgrading. It hasn't written a log since. This is it, the log from 6 weeks ago: P3X_FW_LOG_AB.txt

[MrBurnsAT]

Ur Putty log says something different

[0m[00000820][CA9_0] Packet Detected / c:\P3X_FW_V01.09.0060.bin /.

[DannyBoyCJ]

You are right, I probably wanted to use 1.1.9 and used 1.09 instead... Anyway it does exactly the same thing no matter what version of firmware is on the card, but only if the camera is disconnected from the gimbal main board. If the drone is fully assembled, the serial log looks like this:

putty_10_07_2017_U0.txt

It's like it never detects there's a firmware file on the SD card. So, my guess is that when it can't detect the camera, it tries to update, because it thinks it's a hardware error. But when the camera is present, it has no reason to look for an upgrade. It would be useful to know which process is responsible for starting the upgrade process. Maybe it can be initiated manually, from the linux prompt. For reference, here is a list of active processes, displayed with the "top" command:

 PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND 428 1 root S < 83256185.9 0 61.4 /opt/dji/bin/encode_usb -a -s 437 431 root R 3140 7.0 0 7.6 top 431 430 root S 3144 7.0 0 0.0 -sh 1 0 root S 3140 7.0 0 0.0 init 430 1 root S 3140 7.0 0 0.0 {autologin} /bin/sh /sbin/autologi 427 1 root S 1748 3.9 0 0.0 /opt/dji/bin/monitor 5 2 root SW 0 0.0 0 0.0 [khelper] 4 2 root SW 0 0.0 0 0.0 [events/0] 3 2 root SW 0 0.0 0 0.0 [ksoftirqd/0] 2 0 root SW 0 0.0 0 0.0 [kthreadd] 8 2 root SW 0 0.0 0 0.0 [async/mgr] 137 2 root SW 0 0.0 0 0.0 [sync_supers] 139 2 root SW 0 0.0 0 0.0 [bdi-default] 141 2 root SW 0 0.0 0 0.0 [kblockd/0] 155 2 root SW 0 0.0 0 0.0 [khubd] 158 2 root SW 0 0.0 0 0.0 [kseriod] 190 2 root SW 0 0.0 0 0.0 [rpciod/0] 199 2 root SW 0 0.0 0 0.0 [kswapd0] 200 2 root SW 0 0.0 0 0.0 [aio/0] 201 2 root SW 0 0.0 0 0.0 [nfsiod]

[MrBurnsAT]

Here are the files from 1.02.0006

i added it 2 times!

2 files with old filename (without P at start, and without 3 at end) 2 files with new filename (with P at start, and with 3 at end)

1.02.0006.zip

[DannyBoyCJ]

Thank you! I'll give them a run, see what happens!

[DannyBoyCJ]

Ok, so good news so far. I copied the files with P at start, and with 3 at end on the SD card, and my bird started updating. And it finished succesfully! However, it still won't take the normal 1.2.6 bin placed on SD. So I'm thinking: can we do the same thing for all the modules? Maybe flashing all of them this way will finally put a consistent (and fully working) firmware on the drone. Here is the log it wrote now: P3X_FW_LOG_AB.txt The way I see it from the log file, last time it didn't finish upgrading module 0100. So maybe that's where my problem is. Is m0100 upgradeable in this way? Anyway, very good work, MrBurnsAT !!

[MrBurnsAT]

pls here is m0100

PFC300XFw3.zip

[DannyBoyCJ]

Awesome, let's see how this goes :)

[DannyBoyCJ]

Ok, so it looks like it starts updating, but it actually doesn't. This is the log: P3X_FW_LOG_AB.txt And this is the log from Ambarella console (U0 pads): putty_11_07_2017_PFC300XFw3.txt What I find strange is that although the putty log states that it can't find firmware on the SD, the AB log shows that it is trying to program m0100, but fails with the same error as last time. There's something obviously wrong with module 0100. From what I see, modules 0100 and 0101 are part of Ambarella firmware. Hmm... Should I try this with the files for all the modules on the SD? I know that they don't work if they are encrypted, so... can the encrypted ones be decrypted and prepared for flashing?

[MrBurnsAT]

No they dont Need to be decrypted!

Only rename to right Name. And put on sd

[MrBurnsAT]

here is the whole 1.2.0006 with all modules extracted

with little manual info.txt and filenames.txt

https://www.dropbox.com/s/dtgrz2bb2l4rzcq/P3X_FW_V01.02.0006_extracted.zip?dl=0

[DannyBoyCJ]

Ok, thank you very much, I'll try the whole package next :)

[DannyBoyCJ]

Apparently, upgrading only fails when the upgrade for m0100 (PFC300XFw3.bin) is detected. Is there another way to flash this particular package? Also, where is this firmware stored on the gimbal board (what chip)? Can it be accessed by any service pads?

[mefistotelis]

Here you can check which chips are bound to which: https://github.com/mefistotelis/phantom-firmware-tools/wiki/WM320-Gimbal-top-board#programming

I updated the Ambarella firmware page with all I know; when you'll learn the other methods please describe them so that I can update: https://github.com/mefistotelis/phantom-firmware-tools/wiki/Firmware-m0100

The "other methods" may be either something listed in Ambarella SDK, or a way of flashing the NAND chip directly.

[DannyBoyCJ]

Thanks, I'll write here as soon as I got something.

[jjhdtv]

Looks like this thread is a few months old, however I have started a journey down a very similar path. Using MrBurnsAT tools and ubl1.img , u-boot.img files I have successfully restored my nand chip. I used the following command (sfh_DM36x.exe -nandflash -v -p "COM3" ubl1.img u-boot.img).

Boot log when not attached to any other device gets to a point, throws a few errors and continuous reboots itself repeating the same sequence. Below are the last few lines from putty just prior to the rebooting. I'm at a lost on what I should try next. Like DannBoyCJ problem, my issue started with getting a failed firmware update attempt. Log showed the infamous 08/15 error. Appreciate any help or suggestions. thanks. (putty log portion below) ............

root@Dji-Pro:~#
encode_usb V00.02.02.00(Jul 18 2015 16:52:39).
Entry Encrypt qury mode
init  libusb successed!!!
!!!!!!!!!!!!!!!![    6.720000] EVM: switch to ambarella video input
!!!!!!! open 68013 failed   VENDOR_ID = 0x0547
Init libusb  faild!
Auto to detect video input type:
Default video input selected:Hdmi_yuv
S[    6.730000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
etting video standard to: 0x1000[    6.740000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
00000000000
Cap[    6.750000] vpfe-capture vpfe-capture: IPIPE Chained
ture input set t[    6.760000] vpfe-capture vpfe-capture: Resizer present
o Hdmi_yuv:11
Capture videoStd[    6.770000] EVM: switch to ambarella video input
Old=0000000b
[    6.770000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[    6.780000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[    6.790000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[    6.800000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
videoFrameRate=30000, width=1280, height=720
Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800
GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001
osdThrFxn: process ID is 433 ***********
watchdog timeout:5
ctrlThrFxn: process ID is 425 ***********
Frmae:1 Pslice = 0, Islice = 8[44ms]

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1

usblink status check~~~~~~~~~~~~~~~~
GetFPGAstatus err!!
inptVD=0547
USB device go down, need to reboot system
usb bus error dectected!
No USB device ID:547
try reset 68013....!
umount: can't remount none read-only
umount: mdev busy - remounted read-only
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
[   10.470000] Restarting system.

DM36x initialization passed!
UBL Product Vesion : DJI-NOHDMI-WM610-UBL-1.0-rc0(2015-01-13)
Dji UBL Version: 1.51(Jan 13 2015 - 16:42:11)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
   DONE
Jumping to entry point at 0x81080000.

U-Boot Product Vesion : DJI-WM610-Uboot-1.0-rc4(2014-08-13)
U-Boot 2010.12-rc2-svn-Dji (Aug 13 2014 - 10:55:23)
Cores: ARM 297 MHz
DDR:   270 MHz
I2C:   ready
DRAM:  128 MiB
NAND:  128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net:   Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC
Press ESC to abort autoboot in 1 seconds

Loading from nand0, offset 0x4a0000
** Unknown image type
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Loading from nand0, offset 0x900000
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Booting kernel from Legacy Image at 80700000 ...
   Image Name:   Linux-2.6.32.17-davinci1
   Created:      2015-03-30   9:54:39 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4032832 Bytes = 3.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

[mefistotelis]

I don't see any error messages besides those caused by the board not being connected to OFDM.

Have you tried just connecting it?

[jjhdtv]

Not yet. I have the gimbal all apart. You think I could plug in the external connectors (leave the camera disconnected) and power with the 3.3v connected to the mainboard pins? or some other temporary setup.

I was curious about the usb error and the "open 68013 failed VENDOR_ID = 0x0547"

On Thu, Sep 14, 2017 at 6:29 AM, mefistotelis notifications@github.com wrote:

I don't see any error messages besides those caused by the board not being connected to OFDM.

Have you tried just connecting it?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/mefistotelis/phantom-firmware-tools/issues/37#issuecomment-329482065, or mute the thread https://github.com/notifications/unsubscribe-auth/AbkABSrIMYlGkzr0ZeUuKU2uBhHIIGt9ks5siSpWgaJpZM4OLr75 .

[mefistotelis]

You think I could plug in the external connectors (leave the camera disconnected) and power with the 3.3v

As long as ground voltages are leveled, everything will work.

I was curious about the usb error and the "open 68013 failed VENDOR_ID = 0x0547"

Davinci is connected to CY68013 chip (on OFDM board) via USB interface. CY68013 is an USB controller, after all.

To get an understanding how boards are connected, you can study the simplified schematics: https://github.com/mefistotelis/dji-hardware-schematics/blob/master/phantom_3_pro_overview/phantom_3_pro_overview.pdf

[jjhdtv]

Ok - im back at it. Let me explain my progress (or in this case lack of progress) I connected the main gimbal board (without the motors and camera attached) to the 2 connectors on the p3p frame. I powered up the quad with its own battery and left my ftdi attached as before (u368 pins).

Powered up the p3p and made a terminal connection in Putty. Gimbal board led green was blinking but no data was transmitted to my ftdi - putty screen blank - ftdi no data flow lights blinking.

I disconnected the main board from the ofdm and esc board connector, applied 3.3v to pads, and started a terminal connection. As before I got the boot log displayed above in my previous post.

I also tried updating the firmware by the sd card method (P3X_FW_V01.11.0020.bin) while the mainboard was attached to the p3p as described above. It did not work. I'm assuming if the camera is not connected - the sd card is not read but not sure.

So, I'm a bit confused on how to proceed. Should I bite the bullet and assemble everything (camera, gimbal motors, mainboard, external plugs to ofdm and esc board)? and hope everything boots ok. Or is there a way of further testing firmware and hardware without putting everything back together?

Not sure why not RX TX data is captured when only the mainboard is connected to the OFDM and ESC boards. Do I need to connect to the other RX TX pins on the board?

[jjhdtv]

correction to above

Not sure why not RX TX data is not captured when only the mainboard is connected to the OFDM and ESC boards. Do I need to connect to the other RX TX pins on the board?

[mefistotelis]

Remember you need RX TX and GND for FTDI.

If DM365 gives no sign of life, maybe it's the most usual problem - power not connected. Check voltages on the board.

[jjhdtv]

Success!! I plugged everything back in (camera, ofdm, esc). Reconnected ground, pwr, rx,tx to the ftdi. Powered the p3p with battery - opened Putty connection. All appears good. Connected with the RC, received the live video image. See boot log below. Now does anyone know how to prevent the nand corruption in the future? Access to reflash is a pain. Thanks for the assistance.

Filesystem Product Vesion : DJI-WM610-Filesystem-1.0-rc3(2014-06-06)
Runing /etc/init.d/rcS
[    4.060000] CMEMK module: built on Jan 13 2015 at 19:24:09
[    4.060000]   Reference Linux version 2.6.32
[    4.080000]   File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c
[    4.100000] allocated heap buffer 0xc7000000 of size 0x2456000
[    4.130000] heap fallback enabled - will try heap if pool buffer is not available
[    4.130000] CMEM Range Overlaps Kernel Physical - allowing overlap
[    4.150000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)
[    4.160000] cmemk initialized
[    4.200000] IRQK module: built on Jan 13 2015 at 19:23:41
[    4.200000]   Reference Linux version 2.6.32
[    4.220000]   File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c
[    4.240000] irqk initialized
[    4.300000] EDMAK module: built on Jan 13 2015 at 19:23:04
[    4.320000]   Reference Linux version 2.6.32
[    4.320000]   File /home/DJI2/Project/enc_nohdmi_wm610/src/dvsdk/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c
sulogin: no password entry for root
login[437]: root login on 'ttyS0'
#Process /etc/profile...
root@Dji-Pro:~#
encode_usb V00.02.02.00(Jul 18 2015 16:52:39).
Entry Encrypt qury mode
init  libusb successed!!!
open 68013 succe[    6.790000] EVM: switch to ambarella video input
ed  VENDOR_ID = 0x0547
Claiming libusb_claim_interface 68013 successed
Auto to detect video input type:
Default video input selected:Hdmi_yu[    6.810000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
v
Setting video standard to: 0x[    6.820000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
[    6.820000] vpfe-capture vpfe-capture: IPIPE Chained

Capture input s[    6.830000] vpfe-capture vpfe-capture: Resizer present
et to Hdmi_yuv:11
Capture videoStd[    6.840000] EVM: switch to ambarella video input
Old=0000000b
[    6.840000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[    6.850000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[    6.860000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[    6.870000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
videoFrameRate=30000, width=1280, height=720
Venc1.c : minNumOutBufs 2, minOutBufSize[0] 1382400, minOutBufSize[1] 800
GOP interval:30, outBufSize:1382400, enAdpBW:1, airRate=0, slice=6, VUI=4,timeScale=60001
osdThrFxn: process ID is 442 ***********
watchdog timeout:5
ctrlThrFxn: process ID is 434 ***********
Frmae:1 Pslice = 0, Islice = 8[44ms]
GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 61% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:01 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 4% Video fps: 8 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 6% Video fps: 7 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:03 Resolution: 1280x720

GetFPGAstatus err!
FPGA[1,0,1,0]-1.000000:0
hdmi status is 1
ARM Load: 3% Video fps: 8 fps Video bit rate: 0 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution: 1280x720

Frmae:32 Pslice = 0, Islice = 8[32ms]
FPGA[40,100,1,0]-1.000000:4000000
hdmi status is 1
ARM Load: 7% Video fps: 8 fps Video bit rate: 564 kbps PHY Bandwidth: 4000 kbps Time: 00:00:05 Resolution: 1280x720

Frmae:41 Pslice = 0, Islice = 8[28ms]
Encrypt passed!
FPGA[80,100,1,0]-1.000000:8000000
hdmi status is 1
ARM Load: 16% Video fps: 18 fps Video bit rate: 2643 kbps PHY Bandwidth: 8000 kbps Time: 00:00:06 Resolution: 1280x720

FPGA[80,100,1,0]-1.000000:8000000
hdmi status is 1
ARM Load: 34% Video fps: 30 fps Video bit rate: 5053 kbps PHY Bandwidth: 8000 kbps Time: 00:00:07 Resolution: 1280x720

[mefistotelis]

does anyone know how to prevent the nand corruption in the future?

Two simple commandments:

1. You shall not upgrade firmware unless you have genuine issue with current one.
2. You shall not turn on your bird without flying, as this overheats the gimbal top board.

[MrBurnsAT]

One commandment if me.

If u dont use ur Phantom for long time. Turn on ur Phantom once every Month for at least 2 Minutes. That the DM368 firmware can find new bad blocks and exclude them.

[jjhdtv]

Thanks again for all of the good suggestions. Video transmission is still working. Unrelated, issue the gimbal yaw motor is behaving erratically. Everything appears to boot fine, but then after initializing the gimbal starts to turn side to side max distance (about 10 to 20 seconds after initialization). Tried all of the calibrations (imu, gimbal). Did not fix.

I'm guessing something went wrong with my reassembly. Any Ideas? Set screw is solid on the flat part of the shaft. Seems more like a sensor or motor issue.

[mefistotelis]

Hard to tell. Any of the gimbal arms could cause that, by either having circuit issue, potentiometer issue or flat wire connection issue.

[jjhdtv]

Only touched the yaw gimbal motor on the mainboard. All over cables and motors left intact. Gimbal has never been in a crash. I'll start at the mainboard and yaw motor.

[chainwood008]

My P3Pro Camera mode is clean but when change to video mode showing the purple color for a few second and clean again. this purple color several time showing on video mode. pls help me... Thanks You

[DannyBoyCJ]

Ok, I am back at it. I tried to flash all modules of the P3X_FW_V01.03.0020 separately, leaving out m0100, the one that didn't want to update. I got errors on m0305 and m0306, and their corresponding "bin" files have been renamed to "PMCAPPFw3_damaged.bin" and "PMCLDRFw3_damaged.bin" during the update process. The gimbal is now unresponsive and doesn't go through the initial checks when starting. I believe this happened because of the modules being encrypted, I forgot to check for that before flashing. So... is there a way to flash those modules with the unencrypted versions, other then by official firmware on sd? Or is it really dead this time...

[mefistotelis]

I got errors on m0305 and m0306, and their corresponding "bin" files have been renamed to "PMCAPPFw3_damaged.bin" and "PMCLDRFw3_damaged.bin" during the update process.

And is the flight controller working? Can you start the motors? Non-working FC can be spotted by motors starting to beep forever soon after startup.

The gimbal is now unresponsive and doesn't go through the initial checks when starting. I believe this happened because of the modules being encrypted

It is possible, m0400 is usually encrypted.

So... is there a way to flash those modules with the unencrypted versions, other then by official firmware on sd?

If you want to write m0400, it should be possible to use ST-link, as in all STM micro-controllers. You'll have to figure out what should be connected where though, I never tried to do this.

[DannyBoyCJ]

I can't start the motors, but then again, neither could I start them before this. The remote has very limited connectivity and I can't issue any commands, it only gets some info from the drone, possibly because the firmware on the remote is now so far away (1.10) from the one on the bird (1.03). The motors don't beep at all. However, the log reports the m0400 upgrade as successful:

 [00366526]========== remo-con disconnect. boot(15) ============
 [00366603]Firmware [C:\PGIMBALFw3.bin] detected, card sn [0x28537f3c].
 [00366686][04 00] Firmware upgrade start...
 [00424013][04 00] Firmware upgrade finished successfully.
 [00424097]Done.

The only failed modules are m0305 and m0306:

[00524453]========== remo-con disconnect. boot(15) ============
 [00524530]Firmware [C:\PMCLDRFw3.bin] detected, card sn [0x28537f3c].
 [00524612][03 05] Firmware upgrade start...
 [00553203][03 05] Firmware upgrade finish failed (step = 4, err = 0xf7, idx = 29, los = 0, ng = 30).
 [00583295]Done.

 [00038889]========== remo-con disconnect. boot(15) ============
 [00038966]Firmware [C:\PMCAPPFw3.bin] detected, card sn [0x28537f3c].
 [00039049][03 06] Firmware upgrade start...
 [00081627][03 06] Firmware upgrade finish failed (step = 2, err = 0xaa).
 [00111712]Done.

So, could the gimbal unresponsiveness be due to firmware inconsistency, then? Because the DJI app now reports it that way. I'm attaching the whole log from the update here for reference. The firmware version I am trying to use is P3X_FW_V01.03.0020 (one step up from the one I think is on the drone).

P3X_FW_LOG_AB.txt

I later on discovered that you had provided an updated version of dji_fwcon.py in the tools section, with decryption capabilities, and used that to extract m0305 an m0306. They still fail updating, as visible in the log above.

If you want to write m0400, it should be possible to use ST-link, as in all STM micro-controllers. You'll have to figure out what should be connected where though, I never tried to do this.

I wasn't referring to m0400, but to m0305 and m0306, because they were the only unsuccessful ones.

[garykrogman]

I have repaired a few P3P cameras using the methods on this page. Thank you all for your help! I also have a inspire 1. I have a X3 and an X5 camera. X3 works fine so the problem is not the aircraft or rc. The X5 has the same symptoms as the P3P gimbal you guys have figured out how to repair. 08 00 and 15 00 device not detected. Gimbal functions and video is written to the sd properly. Before I crack open the X5 does anybody have any experience with the X5?

[mefistotelis]

Inspire 1 contains the same circuit as Ph3 Pro, just fitted on different boards.

If you have any good quality camera, you may help us by taking photos of each board within your X5. We currently don't have photos which would allow to identify all components. Remember to do both sides of each board.

[garykrogman]

Here are a few pictures of the x5. I will be sending more. I have 2 that I will not be able to put back together until I find a source for the yaw motors. If you want I can ship you one. Both have the same symptom, able to record to the sd but no video stream. Gary

[mefistotelis]

You did not shared any pictures...

[garykrogman]

I now have better photos of The Zenmuse x5 video processor board. I am trying to what test points to connect my serial interface to. I would think it would be U0_TX and RX. Does anyone know if it is the same firmware package as the NAND on the p3p? Then there would be b+ and boot configuration.

[mefistotelis]

Thanks for the photos!

You should be able to extract DM36x firmware, and further extract boot loader from it, using the Inspire FW package. There is no reason to risk using P3X firmware.

Also, this board does NOT contain DM3xx.. this is not the one you should program if you want to program DaVinci. There's only Ambarella, its NAND (Micron chip) and its RAM (Elpida chip). Plus gimbal control (STM32). The rest is just power supply for these chips.

If your camera writes vids and photos correctly on SD-card, then Ambarella chip is fully functional.

[garykrogman]

You were correct! It was on the tilt gimbal side. I have been in computers and electronics all my life, but extracting firmware and a boot loader from a firmware package, I need help with. Here is the board with the CMOS and the one with the DM368.

[garykrogman]

I have the TI utility. I believe I need to extract m0800 and m1500 bin files from the full bin file, then repackage them and apply it to the DM368. I s this the correct plan?

[mefistotelis]

I believe I need to extract m0800 and m1500 bin files from the full bin file, then repackage them and apply it to the DM368. I s this the correct plan?

No, no need to re-package.

1. You only need to fix m0800. The Cypress chip (m1500) is missing only because communication to it is forwarded through m0800.

2. You only need to extract the FW. The usual cause for this error is that bootloader got damaged on NAND which contains programming for DM3xx. You only need to extract the bootloader.

3. When you have the bootloader files, you just have to flash them via serial. See details here: https://github.com/o-gs/dji-firmware-tools/wiki/Flashing-firmware-on-DaVinci-media-processors

Note that there is a chance that the issue is not with bootloader - ie. another part of DaVinci Linux needs to be reflashed, or the NAND chip is permanently damaged and needs replacing. But in most cases reflashing bootloader works.

EDIT: Can you make a photo of the 2nd side of the DM368 board as well?

[garykrogman]

Yes, I will take a shot of the other side. I have made some progress. I user python to extract all the module files. What do I use to extract the bootloaders from the m0080.bin file?

[mefistotelis]

What do I use to extract the bootloaders from the m0080.bin file?

https://github.com/o-gs/dji-firmware-tools/wiki/Firmware-m0800#structure

[garykrogman]

I now have img files extracted from m0800 bin. The processor speed is 432. I notice there are 2 432 img files with the same size. Should they be combined some how, or what one do I use?

2nd side of the DM368 board

[mefistotelis]

I notice there are 2 432 img files with the same size. Should they be combined some how, or what one do I use?

It doesn't matter, they're identical. Just remember to remove their headers as the 'structure' section explains.