DJI Osmo unbricking, или Продолжение Издевательств над Осмой

Все части эпопеи

part 1
part 2
part 3
part 4

Вступление

Итак, трансляция с Осмы пашет, всё работает отлично. Но сегодня, запустив осмовское родное приложение на мобиле, увидел я сообщение о том что доступна новая прошивка. А в описании новой прошивки указано - время работы увеличено до 90 минут. Так как до этого осма на одном аккуме жила максимум минут 30-40 и я уж затр... замучался аккум заряжать, данное обновление показалось мне очень уж неплохим, так что палец сам нажал кнопочку "обновить".

Обновилось без проблем, да. Но вот при последующем коннекте к осме оказалось что внутренности радикально поменялись. На хосте 192.168.1.3 линух, но линух какой-то незнакомый, не давинчевый. Оказалось что это амбарела, т.е. узел который за камеру отвечает. Видимо, DJI отрубили модуль с DM368 и весь его функционал реализовали на одном узле с камерой (т.е. на Ambarella). Собссно, отсюда и увеличенное время работы от аккума.

Но весь функционал для трансляции который я забацал был привязан именно к давинчи, а на амбареле кирдык, не пашет. Версия прошивки 01.06.02.10 Откатиться на прошлую версию получилось, но только на 01.05.02.00, а там то же самое. А вот на 01.04.01.80 откатиться не даёт, пишет что данная фирмваря принципиально несовместима с текущей.

Стал разбираться, как снова извратиться чтоб на амбареле это сделать. Но после очередной команды перемонтирования фс в режим rw (что-то типа mount -n -o remount,rw /dev/ubi0_0 /) осма кирдыкнулась. В смысле, брикнулась. Сразу после перемонтирования всё норм, фс реально rw, можно писать куда угодно. Но после рубута осмы на 192.168.1.3 снова висит давинчевый узел, а вот амбарельного нету вообще. Приложение на мобиле подключается, но нет видео. Запись при нажатии на кнопку на ручке тоже не работает. Автоматическое обновление прошивки с флешки не пашет. Короче, полноценный такой кирпичик получился.

Собрался уж вскрытие тушки сделать чтоб к хардварному UART подцепиться, но на всякий случай полазил по менюшкам приложения, мож где чего полезного найдётся для принудительного обновления прошивки. Не помню чего конкретно нажимал и в какой последовательности, помню только что точно нажимал кнопку "очистить SD карту", но приложение ругнулась на то что флешка недоступна. И тут бац - на экране мобилы само собой появилась картинка с осмы, а сама осма начала моргать светодиодиками, сигнализируя о том что пошёл процесс обновления прошивки (флешка с образом прошивки была вставлена заранее). В итоге всё успешно перепрошилось и осма снова пашет. Правда, на старую прошивку откатиться всё равно не удалось.

В общем, ковыряю дальше, будем биться до победного.

UPD> Осма пережила второй брик. Снова восстановлена.
UPD> Осма пережила третий брик. Пока не восстановилась :-(
UPD> Восстановилась. Причём сама. Оказалось что где-то сидит watchdog, который после некоторого кол-ва неудачных попыток старта амбы перезаливает прошивку. В итоге само всё восстанавливается, надо лишь осму ребутнуть через некоторое время.


Итак, что теперь доступно:

Продолжение...

Хост 192.168.1.3

Подключение через SSH, юзер root, пароль 12345678

[code]~ # dmesg
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 3.8.0 (baigaoping@Precision-T5600) (gcc version 4.7.3 (Sourcery CodeBench Lite 2013.05-24) ) #1 PREEMPT Tue Jul 28 16:22:02 CST 2015
[ 0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: Ginkgo
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB= 0x60000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB= 0x70000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM= 0x00000000[0x80000000],0x00500000 16
[ 0.000000] Ambarella: AXI= 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: PPM2= 0x0e600000[0x8e600000],0x319fffff 9
[ 0.000000] On node 0 totalpages: 57600
[ 0.000000] free_area_init_node: node 0, pgdat 4050be38, node_mem_map 40537000
[ 0.000000] Normal zone: 450 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 57150 pages, LIFO batch:15
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 57150
[ 0.000000] Kernel command line: ubi.mtd=8 root=ubi0:linux rootfstype=ubifs console=ttyS2 nr_cpus=1 maxcpus=0
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] __ex_table already sorted, skipping sort
[ 0.000000] Memory: 225MB = 225MB total
[ 0.000000] Memory: 223000k/223000k available, 7400k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x4e800000 - 0x80000000 ( 792 MB)
[ 0.000000] lowmem : 0x40000000 - 0x4e100000 ( 225 MB)
[ 0.000000] modules : 0x3f000000 - 0x40000000 ( 16 MB)
[ 0.000000] .text : 0x40008000 - 0x404b76a4 (4798 kB)
[ 0.000000] .init : 0x404b8000 - 0x404d5514 ( 118 kB)
[ 0.000000] .data : 0x404d6000 - 0x40516560 ( 258 kB)
[ 0.000000] .bss : 0x40516560 - 0x405349cc ( 122 kB)
[ 0.000000] NR_IRQS:416
[ 0.000000] sched_clock: 32 bits at 96MHz, resolution 10ns, wraps every 44739ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] SYSCLK:UART[24000000]
[ 0.000000] console [ttyS2] enabled
[ 0.201735] Calibrating delay loop... 499.71 BogoMIPS (lpj=249856)
[ 0.217685] pid_max: default: 32768 minimum: 301
[ 0.222482] Mount-cache hash table entries: 512
[ 0.227813] CPU: Testing write buffer coherency: ok
[ 0.233226] Setting up static identity map for 0x8ae9f0 - 0x8aea58
[ 0.244419] devtmpfs: initialized
[ 0.263721] NET: Registered protocol family 16
[ 0.269439] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.279923] Ambarella ginkgo:
[ 0.283093] chip id:9000
[ 0.285940] board type:3
[ 0.288761] board revision:65
[ 0.292005] system configuration:0x00000130
[ 0.298529] set ocp = 10000
[ 0.305766] aipc_spin_lock_setup done
[ 0.309653] aipc_mutex_init done
[ 0.373442] bio: create slab <bio-0> at 0
[ 0.382465] remoteproc0: c0_and_c1 is available
[ 0.387260] remoteproc0: Note: remoteproc is still under development and considered experimental.
[ 0.396272] remoteproc0: THE BINARY FORMAT IS NOT YET FINALIZED, and backward compatibility isn't yet guaranteed.
[ 0.407141] remoteproc0: registered virtio0 (type 7)
[ 0.414773] remoteproc0: powering up c0_and_c1
[ 0.419453] remoteproc0: Booting fw image dummy, size 0
[ 0.424826] remoteproc0: remote processor c0_and_c1 is now up
[ 0.432923] virtio_rpmsg_bus virtio0: rpmsg host is online
[ 0.439356] NS announcement: 41 6d 62 61 52 70 64 65 76 5f 43 4c 4b 00 81 80 AmbaRpdev_CLK...
[ 0.439397] NS announcement: 81 80 81 80 81 80 82 80 81 80 81 80 82 80 82 80 ................
[ 0.439416] NS announcement: 00 04 00 00 00 00 00 00 ........
[ 0.439449] virtio_rpmsg_bus virtio0: creating channel AmbaRpdev_CLK addr 0x400
[ 0.448346] Bluetooth: Core ver 2.16
[ 0.453014] NET: Registered protocol family 31
[ 0.457620] Bluetooth: HCI device and connection manager initialized
[ 0.464080] Bluetooth: HCI socket layer initialized
[ 0.468995] Bluetooth: L2CAP socket layer initialized
[ 0.474156] Bluetooth: SCO socket layer initialized
[ 0.480816] NS announcement: 61 69 70 63 5f 72 70 63 00 81 80 81 80 81 80 81 aipc_rpc........
[ 0.480862] NS announcement: 80 81 80 81 80 81 81 81 81 81 81 81 81 81 81 81 ................
[ 0.480882] NS announcement: 01 04 00 00 00 00 00 00 ........
[ 0.480916] virtio_rpmsg_bus virtio0: creating channel aipc_rpc addr 0x401
[ 0.487993] Switching to clocksource ambarella-cs-timer
[ 0.542828] NET: Registered protocol family 2
[ 0.548381] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.555571] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.561989] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.568485] TCP: reno registered
[ 0.571809] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.577744] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.584401] NET: Registered protocol family 1
[ 0.589374] RPC: Registered named UNIX socket transport module.
[ 0.595432] RPC: Registered udp transport module.
[ 0.600179] RPC: Registered tcp transport module.
[ 0.604914] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.612653] NS announcement: 61 69 70 63 5f 76 66 73 00 27 35 a5 e1 27 35 a5 aipc_vfs.'5..'5.
[ 0.612786] NS announcement: e1 27 35 a5 e1 27 35 a5 e1 27 35 a5 e1 25 35 a5 .'5..'5..'5..%5.
[ 0.612818] NS announcement: 02 04 00 00 00 00 00 00 ........
[ 0.612853] virtio_rpmsg_bus virtio0: creating channel aipc_vfs addr 0x402
[ 0.626170] msgmni has been set to 435
[ 0.634136] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[ 0.641775] io scheduler noop registered
[ 0.645758] io scheduler deadline registered
[ 0.650091] io scheduler cfq registered (default)
[ 0.655784] ambarella-uart.2: ttyS2 at MMIO 0x70014000 (irq = 123) is a ambuart
[ 0.666308] brd: module loaded
[ 0.683321] loop: module loaded
[ 0.689193] ambarella-nand ambarella-nand: in ecc-[6]bit mode
[ 0.695100] ambarella_nand: Use On Flash BBT
[ 0.699598] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 64
[ 0.711804] ambarella_nand_config_flash: 0x00000000, 0x03c00150
[ 0.717810] chip->subpagesize = 2048
[ 0.721768] Bad block table found at page 131008, version 0xFF
[ 0.728085] Bad block table found at page 130944, version 0xFF
[ 0.734469] ambarella-nand ambarella-nand: ambarella_nand_scan_partitions: Partition infomation found!
[ 0.744838] Creating 15 MTD partitions on "NAND 256MiB 3,3V 8-bit":
[ 0.751210] 0x000000000000-0x000000020000 : "Bootstrap"
[ 0.759511] 0x000000020000-0x000000060000 : "Partition Table"
[ 0.767985] 0x000000060000-0x0000000a0000 : "Bootloader"
[ 0.777069] 0x0000000a0000-0x0000001a0000 : "SD Firmware Update Code"
[ 0.786654] 0x0000001a0000-0x0000021a0000 : "System Software"
[ 0.795598] 0x0000021a0000-0x0000026a0000 : "DSP uCode"
[ 0.803487] 0x0000026a0000-0x0000035a0000 : "System ROM Data"
[ 0.812368] 0x0000035a0000-0x000003fa0000 : "Linux Kernel"
[ 0.821033] 0x000003fa0000-0x000007ba0000 : "Linux Root FS"
[ 0.829866] 0x000007ba0000-0x0000099a0000 : "Linux Hibernation Image"
[ 0.839479] 0x0000099a0000-0x00000e180000 : "Storage1"
[ 0.847920] 0x00000e180000-0x00000e980000 : "Storage2"
[ 0.856188] 0x00000e980000-0x00000f880000 : "Index for Video Recording"
[ 0.865922] 0x00000f880000-0x00000fe20000 : "User Settings"
[ 0.875138] 0x00000fe20000-0x00000ffc0000 : "Calibration Data"
[ 0.886124] mousedev: PS/2 mouse device common for all mice
[ 0.891996] =====RTC ever lost power=====
[ 0.896096] =====RTC ever lost power=====
[ 0.900147] =====RTC ever lost power=====
[ 0.904180] =====RTC ever lost power=====
[ 0.908215] =====RTC ever lost power=====
[ 0.912944] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[ 0.923553] TCP: cubic registered
[ 0.927062] Initializing XFRM netlink socket
[ 0.931426] NET: Registered protocol family 17
[ 0.935967] NET: Registered protocol family 15
[ 0.940655] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 0.952940] UBI: attaching mtd8 to ubi0
[ 1.101942] UBI: scanning is finished
[ 1.123942] UBI: volume 1 ("pref") re-sized from 34 to 155 LEBs
[ 1.132223] UBI: attached mtd8 (name "Linux Root FS", size 60 MiB) to ubi0
[ 1.139221] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 1.146055] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 1.152787] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 1.159686] UBI: good PEBs: 480, bad PEBs: 0, corrupted PEBs: 0
[ 1.165618] UBI: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 1.172772] UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1839721129
[ 1.181835] UBI: available PEBs: 0, total reserved PEBs: 480, PEBs reserved for bad PEB handling: 40
[ 1.191004] UBI: background thread "ubi_bgt0d" started, PID 409
[ 1.197008] console [netcon0] enabled
[ 1.200804] netconsole: network logging started
[ 1.205634] =====RTC ever lost power=====
[ 1.209949] ambarella-rtc ambarella-rtc: setting system clock to 2016-03-30 14:55:20 UTC (1459349720)
[ 1.311330] UBIFS: mounted UBI device 0, volume 0, name "linux", R/O mode
[ 1.318443] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 1.327873] UBIFS: FS size: 34283520 bytes (32 MiB, 270 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[ 1.337814] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 1.343115] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 9148D385-7749-4C64-B478-7214602D8D58, small LPT model
[ 1.366264] VFS: Mounted root (ubifs filesystem) readonly on device 0:12.
[ 1.385064] devtmpfs: mounted
[ 1.388965] Freeing init memory: 116K
[ 2.502294] =====RTC ever lost power=====
[ 2.576861] NS announcement: 61 69 70 63 5f 72 66 73 00 27 35 a5 e1 27 35 a5 aipc_rfs.'5..'5.
[ 2.576905] NS announcement: a1 27 35 a5 e1 27 35 a5 e1 27 35 a5 e1 27 35 a5 .'5..'5..'5..'5.
[ 2.576927] NS announcement: 03 04 00 00 00 00 00 00 ........
[ 2.576959] virtio_rpmsg_bus virtio0: creating channel aipc_rfs addr 0x403
[ 2.609840] NS announcement: 41 6d 62 61 52 70 64 65 76 5f 4c 69 6e 6b 43 74 AmbaRpdev_LinkCt
[ 2.609889] NS announcement: 72 6c 00 a5 e1 27 35 a5 e1 27 35 a5 e1 27 35 a5 rl...'5..'5..'5.
[ 2.609910] NS announcement: 04 04 00 00 00 00 00 00 ........
[ 2.609956] virtio_rpmsg_bus virtio0: creating channel AmbaRpdev_LinkCtrl addr 0x404
[ 2.643286] NS announcement: 65 63 68 6f 5f 63 6f 72 74 65 78 00 81 81 81 81 echo_cortex.....
[ 2.643328] NS announcement: 81 81 82 81 82 80 82 80 81 80 81 80 80 81 80 81 ................
[ 2.643345] NS announcement: 05 04 00 00 00 00 00 00 ........
[ 2.643382] virtio_rpmsg_bus virtio0: creating channel echo_cortex addr 0x405
[ 2.957333] cfg80211: Calling CRDA to update world regulatory domain
[ 4.100292] PM: Syncing filesystems ... done.
[ 4.487800] Freezing user space processes ... (elapsed 0.01 seconds) done.
[ 4.506450] rpmsg_linkctrl_cmd_hiber_prepare: 0x00a17620
[ 4.512061] PM: Preallocating image memory... done (allocated 3840 pages)
[ 4.566609] PM: Allocated 15360 kbytes in 0.04 seconds (384.00 MB/s)
[ 4.573000] Freezing remaining freezable tasks ... (elapsed 0.01 seconds) done.
[ 4.591746] Suspending console(s) (use no_console_suspend to debug)
[ 4.598092] =====RTC ever lost power=====
[ 4.598612] PM: freeze of devices complete after 0.546 msecs
[ 4.598884] PM: late freeze of devices complete after 0.248 msecs
[ 4.599335] PM: noirq freeze of devices complete after 0.432 msecs
[ 4.599508] PM: Creating hibernation image:
[ 4.599508] PM: Need to copy 3773 pages
[ 4.599508] pm_abaoss_entry returned 0x1
[ 4.599883] PM: noirq restore of devices complete after 0.210 msecs
[ 4.600186] PM: early restore of devices complete after 0.156 msecs
[ 4.616073] =====RTC ever lost power=====
[ 4.616123] PM: restore of devices complete after 0.523 msecs
[ 4.672559] rpmsg_linkctrl_cmd_hiber_exit:
[ 4.676694] Restarting tasks ... done.
[ 4.702318] =====RTC ever lost power=====
[ 4.833192] usbcore: registered new interface driver usbfs
[ 4.862815] usbcore: registered new interface driver hub
[ 4.884427] usbcore: registered new device driver usb
[ 4.973207] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 4.989445] ambarella-ehci ambarella-ehci: Ambarella EHCI
[ 5.002827] ambarella-ehci ambarella-ehci: new USB bus registered, assigned bus number 1
[ 5.019247] ambarella-ehci ambarella-ehci: irq 105, io mem 0xe0018000
[ 5.032776] ambarella-ehci ambarella-ehci: USB 2.0 started, EHCI 1.00
[ 5.039372] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 5.046205] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 5.053482] usb usb1: Product: Ambarella EHCI
[ 5.057870] usb usb1: Manufacturer: Linux 3.8.0 ehci_hcd
[ 5.063202] usb usb1: SerialNumber: AmbUSB
[ 5.072215] hub 1-0:1.0: USB hub found
[ 5.081820] hub 1-0:1.0: 1 port detected
[ 5.141180] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 5.167858] ambarella-ohci ambarella-ohci: Ambarella OHCI
[ 5.184833] ambarella-ohci ambarella-ohci: new USB bus registered, assigned bus number 2
[ 5.200856] ambarella-ohci ambarella-ohci: irq 121, io mem 0xe0019000
[ 5.263914] usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
[ 5.270756] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 5.278005] usb usb2: Product: Ambarella OHCI
[ 5.282387] usb usb2: Manufacturer: Linux 3.8.0 ohci_hcd
[ 5.287751] usb usb2: SerialNumber: AmbUSB
[ 5.297216] hub 2-0:1.0: USB hub found
[ 5.302408] hub 2-0:1.0: 1 port detected
[ 5.554495] usbcore: registered new interface driver cdc_subset
[ 5.620559] usbcore: registered new interface driver cy7c68013a_dji
[ 5.680811] Debug Flag: 0x00000000
[ 5.737187] [lpc1765_driver_init-689]: begin to init the lpc1765 driver.
[ 5.765784] [rpmsg_buf_init-203]: page_num:1
[ 5.765784]
[ 5.780819] usb 1-1: new high-speed USB device number 2 using ambarella-ehci
[ 5.789786] [rpmsg_buf_init-208]: page_order:0
[ 5.789786]
[ 5.805794] [rpmsg_buf_init-230]: rpmsg buffer init success.
[ 5.805794]
[ 5.814386] [audio_rpmsg_register-684]: audio_rpmsg_register: register audio rpmsg success.
[ 5.814386]
[ 5.835863] [init_proc-591]: Init audio proc success.
[ 5.835863]
[ 5.850187] usbcore: registered new interface driver dji_lpc1765_driver
[ 5.872380] [process_message_thread-374]: process_message_thread started
[ 5.923916] usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
[ 5.967885] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[ 6.022929] usb 1-1: Product: USB2.0 Hub
[ 6.055613] hub 1-1:1.0: USB hub found
[ 6.078195] hub 1-1:1.0: 2 ports detected
[ 6.387256] usb 1-1.1: new full-speed USB device number 3 using ambarella-ehci
[ 6.482883] usb 1-1.1: New USB device found, idVendor=1fc9, idProduct=2002
[ 6.489966] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 6.497402] usb 1-1.1: Product: NXP LPC17xx VCOM
[ 6.502234] usb 1-1.1: Manufacturer: NXP SEMICOND
[ 6.507142] usb 1-1.1: SerialNumber: DEMO00000000
[ 6.519215] [usb_lpc1765_probe-588]: start to probe...
[ 6.544714] dji_lpc1765_driver 1-1.1:1.0: LPC1765 USB device product 2002, vendor:1fc9, minor:77 now attached to audiousb-0
[ 6.614005] [usb_lpc1765_probe-614]: ======dev:0x4dea0000
[ 6.644891] NS announcement: 64 6a 69 5f 61 70 70 00 00 00 00 00 01 00 00 00 dji_app.........
[ 6.644924] NS announcement: 20 00 00 00 00 00 00 00 00 00 00 00 70 26 a5 16 ...........p&..
[ 6.644941] NS announcement: 06 04 00 00 00 00 00 00 ........
[ 6.644969] virtio_rpmsg_bus virtio0: creating channel dji_app addr 0x406
[ 6.665139] [usb_lpc1765_probe-622]: lpc1765 probe success
[ 6.698866] NS announcement: 64 6a 69 5f 73 6f 63 6b 00 54 55 4d 00 00 00 00 dji_sock.TUM....
[ 6.698901] NS announcement: 00 00 00 00 00 00 00 00 01 00 00 00 20 00 00 00 ............ ...
[ 6.698919] NS announcement: 07 04 00 00 00 00 00 00 ........
[ 6.698947] virtio_rpmsg_bus virtio0: creating channel dji_sock addr 0x407
[ 6.748488] NS announcement: 64 6a 69 5f 75 73 62 64 72 76 00 00 00 00 00 00 dji_usbdrv......
[ 6.748522] NS announcement: 00 00 00 00 ad 01 00 00 50 00 00 00 4c 69 6e 75 ........P...Linu
[ 6.748538] NS announcement: 08 04 00 00 00 00 00 00 ........
[ 6.748566] virtio_rpmsg_bus virtio0: creating channel dji_usbdrv addr 0x408
[ 6.781676] NS announcement: 64 6a 69 5f 74 65 73 74 00 65 72 6e 61 74 69 6f dji_test.ernatio
[ 6.781854] NS announcement: 6e 20 49 6d 61 67 65 00 00 00 00 00 00 00 00 00 n Image.........
[ 6.781882] NS announcement: 09 04 00 00 00 00 00 00 ........
[ 6.781913] virtio_rpmsg_bus virtio0: creating channel dji_test addr 0x409
[ 6.818313] NS announcement: 64 6a 69 5f 61 75 64 69 6f 00 00 00 49 6e 64 65 dji_audio...Inde
[ 6.818348] NS announcement: 78 20 66 6f 72 20 56 69 64 65 6f 20 52 65 63 6f x for Video Reco
[ 6.818364] NS announcement: 0a 04 00 00 00 00 00 00 ........
[ 6.818394] virtio_rpmsg_bus virtio0: creating channel dji_audio addr 0x40a
[ 6.863045] [audio_rpmsg_probe-628]: audio_rpmsg_probe: dji_audio probed
[ 6.863045]
[ 6.902871] [audio_rpmsg_probe-644]: audio_rpmsg_probe: dji_audio probed success.
[ 6.902871]
[ 9.037455] usb 1-1.2: new high-speed USB device number 4 using ambarella-ehci
[ 9.140528] usb 1-1.2: New USB device found, idVendor=0525, idProduct=a4a2
[ 9.168680] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 9.208580] usb 1-1.2: Product: RNDIS/Ethernet Gadget
[ 9.235479] usb 1-1.2: Manufacturer: Linux 3.10.49 with ath_udc
[ 9.292538] cdc_subset: probe of 1-1.2:1.0 failed with error -22
[ 9.364213] cdc_subset 1-1.2:1.1 usb0: register 'cdc_subset' at usb-AmbUSB-1.2, Linux Device, 06:22:f7:c1:9e:14
[/code]

[code]~ # ifconfig -a
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:19 errors:0 dropped:0 overruns:0 frame:0
TX packets:19 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1804 (1.7 KiB) TX bytes:1804 (1.7 KiB)

usb0 Link encap:Ethernet HWaddr 60:60:1F:10:00:0A
inet addr:192.168.1.3 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2063 errors:0 dropped:648 overruns:0 frame:0
TX packets:765 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:186642 (182.2 KiB) TX bytes:157713 (154.0 KiB)
[/code]

[code]~ # ps
PID USER TIME COMMAND
1 root 0:00 init
2 root 0:00 [kthreadd]
3 root 0:00 [ksoftirqd/0]
4 root 0:01 [kworker/0:0]
5 root 0:00 [kworker/0:0H]
6 root 0:00 [kworker/u:0]
7 root 0:00 [kworker/u:0H]
8 root 0:00 [khelper]
9 root 0:00 [kdevtmpfs]
10 root 0:00 [kworker/u:1]
163 root 0:00 [bdi-default]
165 root 0:00 [kblockd]
177 root 0:00 [kworker/0:1]
269 root 0:00 [rpciod]
279 root 0:00 [kswapd0]
280 root 0:00 [fsnotify_mark]
281 root 0:00 [nfsiod]
283 root 0:00 [crypto]
403 root 0:00 [deferwq]
409 root 0:00 [ubi_bgt0d]
417 root 0:00 /usr/sbin/inetd
456 root 0:00 /usr/bin/ipcbind -b
458 root 0:00 /usr/bin/util_svc -b
465 root 0:00 [cfg80211]
475 root 0:00 telnetd
482 root 0:00 /usr/sbin/sshd -f /etc/ssh/sshd_config
503 root 0:00 [khubd]
537 root 0:00 [usb_lpc1765]
539 root 0:00 rpc_trans
540 root 0:00 cam_server
541 root 0:48 udt_transfer
546 root 0:06 proc_monitor
561 root 0:00 -/bin/sh
571 root 0:00 [sh]
579 root 0:54 file_transfer
589 root 0:00 hdr_merge
593 root 0:00 video_stab
618 root 0:00 sshd: root@notty
622 root 0:00 -sh
677 root 0:00 sshd: root@pts/0
681 root 0:00 -sh
771 root 0:00 ps
[/code]

[code]~ # netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 (null):ftp (null):* LISTEN
tcp 0 0 (null):ssh (null):* LISTEN
tcp 0 0 (null):telnet (null):* LISTEN
tcp 0 52 (null):ssh (null):53208 ESTABLISHED
netstat: /proc/net/tcp6: No such file or directory
udp 0 0 (null):9000 (null):*
udp 0 0 (null):9001 (null):*
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
[/code]

[code]/ # mount
rootfs on / type rootfs (rw)
ubi0:linux on / type ubifs (ro,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=111500k,nr_inodes=27875,mode=755)
proc on /proc type proc (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777)
tmpfs on /tmp type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
a: on /tmp/fuse_a type ambafs (rw,relatime)
c: on /tmp/fuse_d type ambafs (rw,relatime)
a: on /pref type ambafs (rw,relatime)
[/code]

[code]/tmp # cat /ptroc/mtd
dev: size erasesize name
mtd0: 00020000 00020000 "Bootstrap"
mtd1: 00040000 00020000 "Partition Table"
mtd2: 00040000 00020000 "Bootloader"
mtd3: 00100000 00020000 "SD Firmware Update Code"
mtd4: 02000000 00020000 "System Software"
mtd5: 00500000 00020000 "DSP uCode"
mtd6: 00f00000 00020000 "System ROM Data"
mtd7: 00a00000 00020000 "Linux Kernel"
mtd8: 03c00000 00020000 "Linux Root FS"
mtd9: 01e00000 00020000 "Linux Hibernation Image"
mtd10: 047e0000 00020000 "Storage1"
mtd11: 00800000 00020000 "Storage2"
mtd12: 00f00000 00020000 "Index for Video Recording"
mtd13: 005a0000 00020000 "User Settings"
mtd14: 001a0000 00020000 "Calibration Data"
[/code]

[code]/tmp # cat /proc/cmdline
ubi.mtd=8 root=ubi0:linux rootfstype=ubifs console=ttyS2 nr_cpus=1 maxcpus=0
[/code]

Итак, за стрим видео теперь отвечает процесс udt_transfer, который висит на 9000-м порту (UDT)

[code]# udt_transfer
mmap phy addr(0x08000000) -> virt addr(0x26c43000), size: 0x10000000
mmap phy addr(0x20000000) -> virt addr(0x06c43000), size: 0x20000000
MemMap ok
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
get error recvmsg = Bad file descriptor
init ipc ok
get error recvmsg = Bad file descriptor
server is ready at port: 9000: 268465638
init server ok
new connection: 192.168.1.21:60758
Image serv 100075e6(6602):9000 accept one new clnt 100075e5[/code]

На 9001-м порту висит file_transfer. Видимо, для слива фото/видео.

Хост 192.168.1.2

В новой прошивке, похоже, этот хост тоже по другому работать стал. Теперь порта 2001 нету, к фтп подключиться не получается, телнет и ssh тоже в дауне. Точнее, телнет принимает коннект и тут же его рубит. Бедааа...

[code]#nmap -sT -T5 192.168.1.1 -p 1-65535
Starting Nmap 6.47 ( http://nmap.org ) at 2016-04-05 22:09 UTC
Nmap scan report for 192.168.1.2
Host is up (0.019s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
5678/tcp open rrac
MAC Address: 60:60:1F:17:AE:90 (SZ DJI Technology Co.)
Nmap done: 1 IP address (1 host up) scanned in 19.25 seconds[/code]