P2V+ Deleted OpenWRT firmware

[Ernest Himself]

Hello Phantom Pilots

I have had great success following instructions from @linuxkidd to install OpenWRT Luci to the RE700 Range Extender. This allowed me to access the web UI. It worked great and I learned a bunch of things.

Then following the same instructions, I wanted to install Luci to my Phantom 2 v+. Everything went well, and as expected I received the message that the install is blocked by Firewall *.
The instructions show to then remove this Firewall by typing the command: opkg remove firewall3
I typed: opkg remove firewall * So guess what happened next?

This removed all the operating files from the Wifi module. (i think) I received a long running list of "Removing......... lots of files and directories.

After that I was unable to issue any commands. I powered the drone off and on. And thereafter the wifi was not visible anymore. I guess the OpenWRT system will not load without any files.

Totally my mistake.

I then followed the instructions by @okstuv to repair the NAND with a FT232 board. This worked and thank you @okstuv , @gaucho , @andrew_by and @rmhome for all the information with this.
Unfortunately this did not fix my missing files, but it was worth a try.

Now I am not sure where the files are supposed to be. And I have come to the point of asking for help.

Will someone be able to give me information, if this is something to fix and if its possible at all?

I can not find the same problem and I have tried my best to get information. Of course this was all my mistake, so its not something that happened by itself.

Then I hope someone can assist.


Ernest

 

[Ernest Himself]

Hello @quaddamage , I hope you dont mind me asking. I have been reading many pages where you give advice on other topics, and you seem to have more advanced knowledge on this kind of problem.
Do you mind telling me what you think of this, and if it is something this drone could recover from?

Thank you,
Ernest

 

[quaddamage]

Do you mind telling me what you think of this, and if it is something this drone could recover from?

That's definitely recoverable. Though I never did anything similar to the modifications you're making (My old Ph2 was H3-3D model, not Vision). I also never seen the instructions you're referring.

There are many ways to connect to OpenWRT and fix it, as long as Linux is booting. And removal of firewall pipeline definitely didn't damaged it enough to prevent booting. But for details - I don't know. How did you executed the commands you used? Was it through web interface? Maybe you can still connect to it via SSH? Is there a way to connect to wired ethernet inside the module? If not, there's definitely a serial interface somewhere on the board.

You should search OpenWRT forums and guides mentioning the wifi chip used in the device.
For more generic material, the first thing to read is this:

OpenWrt Debricking Guide

OpenWrt Debricking Guide When people say a router is bricked, this very generally means, that it does not function properly any longer and the reasons can be various. First of all, you should calm down, relax and read flash.layout, file systems in OpenWrt and bootloader CLI. Now depending on...

openwrt.org

EDIT:
On the usual wiki, I see board photos where test points doesn't have the names layer printed.. maybe someone has a board which includes the names of pads?
Chip markings are also not visible:
OGs wiki: WM301 Wifi Transceiver board

 

[Ernest Himself]

That's definitely recoverable. Though I never did anything similar to the modifications you're making (My old Ph2 was H3-3D model, not Vision). I also never seen the instructions you're referring.

There are many ways to connect to OpenWRT and fix it, as long as Linux is booting. And removal of firewall pipeline definitely didn't damaged it enough to prevent booting. But for details - I don't know. How did you executed the commands you used? Was it through web interface? Maybe you can still connect to it via SSH? Is there a way to connect to wired ethernet inside the module? If not, there's definitely a serial interface somewhere on the board.

You should search OpenWRT forums and guides mentioning the wifi chip used in the device.
For more generic material, the first thing to read is this:

OpenWrt Debricking Guide

OpenWrt Debricking Guide When people say a router is bricked, this very generally means, that it does not function properly any longer and the reasons can be various. First of all, you should calm down, relax and read flash.layout, file systems in OpenWrt and bootloader CLI. Now depending on...

openwrt.org

EDIT:
On the usual wiki, I see board photos where test points doesn't have the names layer printed.. maybe someone has a board which includes the names of pads?
Chip markings are also not visible:
OGs wiki: WM301 Wifi Transceiver board

Hello Quaddamage

Thank you for helping. I am looking now, and it seems there is a similar way to write OpenWrt back to the board via a Ft232 adapter. I must just connect the correct tx/rx ports on the board and then figure out the rest.

The commands I used was from a post Install OpenWRT WebUI on Repeater/P2V+

It is a great guide, and works 100%. It was just my mistake when typing the command "opkg remove firewall *" that removed all the files necessary to run OpenWRT.

The correct command as in the guide is: "opkg remove firewall3."

Thank you for the link, I will try and come back with results.

 

[Ernest Himself]

Hello @quaddamage
I followed your links and then also ended up at OpenWrt Project: Serial Console where they give good instructions on how to identify the Router Serial Connector Ports/Points "UART" port. Thank you for the lead. It is just what I needed to get this started. There is hope.

I used my multi meter to find the following service pads on the wifi board. GND, V+, TX and RX.
I also added a ~1K resistor in series between router RX and TTL TX not to damage either the main board or the FT232 board. (this was recommended in the instructions.)

Powered it up from my PC usb Ft232 adapter, and it started talking. I opend "TeraTerm" to view the communication from the board. (i will add the text in case it makes sense to someone.)

There is a part where it said, "Press the [f] key and hit [enter] to enter failsafe mode"

I press the f key and enter, and it pauses, then continues to end where nothing happens. I also cant send any commands from there.


Would you be able to share your thoughts from here on? Is there a way to get the OpenWRT software back on via the TeraTerm software?

Somehow I need to write the BIN file from OpenWRT, I downloaded already, to install to this board.

Here is the text from the serial comms page. (I will also add a photo of the board after i soldered the wires.)

Thank you again for your help.

Port 1, Negogiation timeout
eth0: Phy Specific Status=ffff
eth0: Phy Specific Status=ffff
eth0 up
eth0
main_loop before...
Autobooting in 1 seconds
## Booting image at 9f020000 ...
Uncompressing Kernel Image ... Port 0, Negogiation timeout
Port 1, Negogiation timeout
eth0: Phy Specific Status=ffff
eth0: Phy Specific Status=ffff
eth0 up
eth0
main_loop before...
Autobooting in 1 seconds
## Booting image at 9f020000 ...
Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Linux version 3.8.6 (davinci@davinci-desktop) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36312) ) #13 Thu Feb 20 16:43:40 CST 2014
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[ 0.000000] SoC: Atheros AR9342 rev 2
[ 0.000000] Clocks: CPU:535.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.00 0MHz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x01ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=TL-PHANTOM-v2 console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] __ex_table already sorted, skipping sort
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 28856k/32768k available (2153k kernel code, 3912k reserved, 578k data, 272k init, 0k highmem)
[ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 512
[ 0.090000] NET: Registered protocol family 16
[ 0.090000] MIPS: machine is DJI TL-PHANTOM v2
[ 0.310000] bio: create slab <bio-0> at 0
[ 0.320000] Switching to clocksource MIPS
[ 0.330000] NET: Registered protocol family 2
[ 0.330000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 0.330000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 0.340000] TCP: Hash tables configured (established 512 bind 512)
[ 0.340000] TCP: reno registered
[ 0.350000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.350000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.360000] NET: Registered protocol family 1
[ 0.380000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.380000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.390000] msgmni has been set to 56
[ 0.400000] io scheduler noop registered
[ 0.400000] io scheduler deadline registered (default)
[ 0.410000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.430000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[ 0.440000] console [ttyS0] enabled, bootconsole disabled
[ 0.440000] console [ttyS0] enabled, bootconsole disabled
[ 0.450000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[ 0.460000] m25p80 spi0.0: found s25fl064k, expected m25p80
[ 0.470000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[ 0.470000] 5 dji partitions found on MTD device spi0.0
[ 0.480000] Creating 5 MTD partitions on "spi0.0":
[ 0.480000] 0x000000000000-0x000000020000 : "u-boot"
[ 0.490000] 0x000000020000-0x000000114ed8 : "kernel"
[ 0.490000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.510000] 0x000000114ed8-0x0000007f0000 : "rootfs"
[ 0.510000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.530000] mtd: partition "rootfs" set to be root filesystem
[ 0.530000] mtd: partition "rootfs_data" created automatically, ofs=3F0000, len=400000
[ 0.540000] 0x0000003f0000-0x0000007f0000 : "rootfs_data"
[ 0.550000] 0x0000007f0000-0x000000800000 : "art"
[ 0.560000] 0x000000020000-0x0000007f0000 : "firmware"
[ 0.570000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 1.120000] TCP: cubic registered
[ 1.130000] NET: Registered protocol family 17
[ 1.130000] 8021q: 802.1Q VLAN Support v1.8
[ 1.140000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 1.150000] Freeing unused kernel memory: 272k freed
[ 3.020000] eth0: link up (10Mbps/Full duplex)
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
f
- regular preinit -
[ 5.190000] jffs2: notice: (380) jffs2_build_xattr_subsystem: complete building xattr subsystem, 20 of xdatum (1 unchecked, 19 orphan) and 431 of xref (0 dead, 28 orphan) found.
- merge overlay components -
[ 5.240000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00 000200
[ 5.240000]

 

[quaddamage]

I have doubts whether your "f" press was really registered by the device.. is there any difference if you won't press it?

Also, you should be able to enter bootloader by some keys after " Autobooting in 1 seconds ".

Make sure your input is really working.

From the error I see in your log, it's hard to tell anything specific. There is a note about errors in root filesystem, and kernel gives up soon after that - so it is likely due to the rootfs issue. Looks like verbose logging is disabled - can't tell anything more. Also, last line of the log is missing. Looks like the device gives up before the serial transfer of that line is finished.

If you enter bootloader, you can start kernel with different parameters. Maybe if you enable debug and increase log level via the parameters, there will be more specific messages.

 

[Ernest Himself]

I have doubts whether your "f" press was really registered by the device.. is there any difference if you won't press it?

Also, you should be able to enter bootloader by some keys after " Autobooting in 1 seconds ".

Make sure your input is really working.

From the error I see in your log, it's hard to tell anything specific. There is a note about errors in root filesystem, and kernel gives up soon after that - so it is likely due to the rootfs issue. Looks like verbose logging is disabled - can't tell anything more. Also, last line of the log is missing. Looks like the device gives up before the serial transfer of that line is finished.

If you enter bootloader, you can start kernel with different parameters. Maybe if you enable debug and increase log level via the parameters, there will be more specific messages.

When I press "f" there is a slight pause. And "f" "enter" the same.
But no difference with or without the "f". But it looks like the wifi board sees the input.

I appreciate your help. But for now I have given up until sometime.

This is amazing stuff, even for the older Phantom2. And to think some people design these things and make it all work. Crazy. Where do these people hide?

I see the page you shared o-gs/dji-firmware-tools has some info missing. I will add some info to this page about this layout of the boards TX and RX in case someone finds the need for it.

Thanks again @quaddamage for your help.

 

[Rbmoreira]

@Ernest Himself ,
did you get the BIN file for the RE700 card and the Drone?

 

[kapoon]

When I press "f" there is a slight pause. And "f" "enter" the same.
But no difference with or without the "f". But it looks like the wifi board sees the input.

I appreciate your help. But for now I have given up until sometime.

This is amazing stuff, even for the older Phantom2. And to think some people design these things and make it all work. Crazy. Where do these people hide?

I see the page you shared o-gs/dji-firmware-tools has some info missing. I will add some info to this page about this layout of the boards TX and RX in case someone finds the need for it.

Thanks again @quaddamage for your help.

I added some info of connection to "issues", I broken wlan0 interface so now it can't start, now trying to solve via UART

Maybe someone have /etc/config/wireless file? or maybe full working firmware?

 

[crash1sttime]

I added some info of connection to "issues", I broken wlan0 interface so now it can't start, now trying to solve via UART

Maybe someone have /etc/config/wireless file? or maybe full working firmware?

Kinda interested in having a look at this, do you have the pads for tx rx v and ground

 

[kapoon]

Kinda interested in having a look at this, do you have the pads for tx rx v and ground

baud 115200
symbols ANSI