-
Notifications
You must be signed in to change notification settings - Fork 458
Firmware m1300
Target
Purpose
Versions
Structure
OS and Libraries
Flashing
Interfaces
The module programs the TMS320DM365 firmware. Location of this chip is GL300 Interface board.
Complementary DM36x chip exists within the drone gimbal; the air part is programmed by module m0800.
The firmware is used on all boards with HDMI output, and on GL300a boards even if no HDMI output is present. Other RC models have the DM365 chip removed, so the firmware is not used.
The DaVinci firmware handles video transcoding between Lightbridge compression and the compression for mobile app. In the boards with HDMI output, it also prepares the uncompressed video signal for that output.
There are multiple versions, always unencrypted.
| Marking | Packages | Timestamp | Overview |
|---|---|---|---|
| 02.12.0000 | P3X_FW_V01.01.0006 P3X_FW_V01.01.1003 | 2015-04-30 ... 2015-05-01 | |
| 02.13.0000 | P3S_FW_V01.01.0008 P3S_FW_V01.01.0009 P3S_FW_V01.02.0007 P3S_FW_V01.02.0008 P3X_FW_V01.01.0008 P3X_FW_V01.01.0009 P3X_FW_V01.01.1007 P3X_FW_V01.02.0006 | 2015-05-06 ... 2015-07-10 | |
| 02.18.0001 | C1_FW_V01.03.0020 P3S_FW_V01.03.0020 P3XS_FW_RC_V01.03.0020 P3X_FW_V01.03.0020 | 2015-07-24 ... 2015-08-04 | |
| 02.18.0002 | C1_FW_V01.02.0021 C1_FW_V01.03.00.21 C1_FW_V01.04.0030 | 2015-07-28 ... 2015-09-29 | |
| 02.24.0000 | C1_FW_V01.05.0070 C1_FW_v01.05.0071 | 2015-11-24 ... 2016-02-01 | |
| 02.26.0000 | C1_FW_V01.01.0020 C1_FW_V01.01.0092 C1_FW_V01.05.0080 C1_FW_V01.06.0000 C1_FW_v01.01.0030 C1_FW_v01.01.0035 C1_FW_v01.01.0040 C1_FW_v01.01.0050 C1_FW_v01.01.0051 C1_FW_v01.01.0053 C1_FW_v01.01.0054 C1_FW_v01.01.0055 C1_FW_v01.01.0060 C1_FW_v01.01.0080 C1_FW_v01.01.0090 C1_FW_v01.07.0002 C1_FW_v01.07.0030 C1_FW_v01.07.0040 | 2016-03-15 ... 2016-12-08 | |
| 02.29.0000 | C1_FW_v01.06.0001 C1_FW_v01.07.0000 C1_FW_v01.08.0000 | 2016-08-13 ... 2016-09-12 | |
| 02.31.0000 | C1_FW_v01.09.0000 | 2016-11-08 | |
| 02.32.0000 | C1_FW_V01.01.0093 C1_FW_v01.07.0060 | 2016-11-10 ... 2016-12-29 |
The module is encrypted using OpenSSL salted format. Password is "Dji123456". Here is an example decryption command:
openssl des3 -d -k Dji123456 -in C1_FW_V01.06.0000_m1300.bin -out C1_FW_V01.06.0000_m1300_decrypted.tar.gz
Unencrypted firmware is a TAR GZip archive containing some Linux tools compiled for ARM, boot configuration and kernel modules. It also contains partition images which can be flashed.
In order to use the decrypted bootloader images dji/data/*.img with sfh_DM36x or other chip manufacturers tools, first 0x800 bytes of the files have to be removed, ie.:
dd if=dji/data/u-boot.img of=u-boot_prop.img bs=2048 skip=1 dd if=dji/data/ubl1.img of=ubl1_prop.img bs=2048 skip=1
The files included in firmware update are written in appropriate places of the 128MB NAND flash memory. Map of the flash memory is as follows:
| Offset | Description | Content |
|---|---|---|
| 0020000 | U-boot init | ubl?.img, a copy every 0x20000 bytes; initial startup code for u-boot |
| 0320000 | U-boot app | u-boot.img, a copy every 0x60000 bytes; main part of the u-boot bootloader |
| 04a0000 | Primary kernel | uImage; the Linux Kernel normally used for booting |
| 0900000 | Recovery kernel | uImage_recovery, not included in FW updates; the Linux Kernel which is used when primary kernel gets corrupted |
| 0d60000 | Encrypted data | Hardware-encrypted partition |
| 0e00000 | Root Filesystem | ubifs-partition.ubi; Linux Root Filesystem, using UbiFS; contains kernel modules, tools and applications |
| 7f00000 | End of flash | also end of Root Filesystem partition |
The firmware consists of U-Boot boot loader and DaVinci Linux as OS.
Additional Kernel Modules and User Mode Applications are providing communication to Cypress USB Controller and video transcode functions.
Here are the known ways to flash the U-Boot bootloader and DaVinci Linux. Some of the flashing methods may not be listed here.
The official way of flashing the firmware is by selecting upgrade (or downgrade) in the mobile app. The app will download the firmware, extract modules from the package and distribute them to proper target components. In older versions of the firmware, it was also possible to update by inserting a flash drive containing new firmware to the USB port.
It is also possible to boot the chip into a mode which allows programming it via serial port. Since the board requires 3.3V serial interface, you will need USB to TTL converter (aka FTDI adapter) which supports this voltage.
To switch the boot mode, short the Boot Select service pad to 3.3V. Connect your 3.3V TTL converter to service pads 368_RX, 368_TX and GND. Don't worry about connecting RX and TX incorrectly, switching them will not damage anything, it just won't work. Then, use TI utilities on connected PC to flash your new image:
sfh_DM36x -nandflash -v -p "COM21" ubl1.img u-boot.img
You will need the unencrypted images of TI DaVinci Linux and the U-boot bootloader to do the flashing.
You can look at the description of the flashing procedure for Lightbridge for some details.
This method is based on Serial Boot and Flash Loading Utility provided by Texas Instruments.
Texas Instruments maintains an extensive Wiki with information about ways of Writing Image to NAND Flash for their processors.
What they propose as primary method is to update the firmware via Ethernet controller by using U-Boot boot loader functionalities. The wiki also discusses flashing the U-Boot itself, and contains links to descriptions of other flashing methods.
TODO
This page is created by drone enthusiasts for drone enthusiasts.
If you see a mistake, or you know more about specific subject, or you see an area for improvement for the wiki - create an issue in this project and attach your patch (or describe the change you propose).