Author Topic: BlackVue DR650S-2CH the operation was successful, but the patient died  (Read 292 times)

0 Members and 1 Guest are viewing this topic.

Offline tocsa120ls

  • Regular Contributor
  • *
  • Posts: 76
  • Country: hu
  • Electronic hobbyist living in Stuttgart
Things that grind my gears: when I pay $400 for a supposedly premium product that dies without making it to the 4 year mark.

I bought this dashcam in 2017 for my weekend car (the insurance suggested I buy something with GPS tracking) - it did it's duty problem-free until now. I was getting ready to leave a parking lot when I didn't hear the familiar "Parking mode off" announcement. Strange, my wiring must've been bad (telling this to myself) - I dug the original cigarette lighter plug out of the trunk, plugged it in and--- nothing.

Since the unit is long out of warranty, I busted out the screwdrivers. It is not that hard to take apart, you push in two tabs on the part that locks into the windshield mount, pull off a 'cap' and the two sides pop apart. There is one hidden little screw on the other side under the BlackVue/WiFi window - it is glued in, you need to pry it up.




The unit is made out of two modules, one is the camera / DSP part, the other is the PSU that turns the 12V power to 5, 3.3, 1.8 and the rest of the voltages -- the two panels are connected with 3 interconnects, pretty stiff, but can be pulled apart. There was a teeny Lithium backup battery for the GPS/RTC unit, it was completely dead. Replaced it and to nobody's surprise the unit stayed dark.

Onto the other panel with the 4 chips (main CPU, RAM, Serial video receiver and the NAND flash)



Who puts a 70°C rated part into a product that lives behind a windshield? Pittasoft, that's who.
(I believe this is the point where I did the first fuckup, but more on that later.)
This Samsung part is of course out of production, (and there aren't any stocks anywhere I could look) but I can't imagine there is not a replacement or equivalent part.
I found the ISSI IS34ML01G081TLIR that seemed to match the bigger numbers (package, storage size, data port width, and voltage). I gave it my confidence, and when the Mouser box arrived I busted out my hotair station.



Here's it removed and in the ubiquitous T56 programmer. No wonder, I couldn't get a successful read off of it, not even with coldspray.


One of many failed attempts.

In the end I just turned off verification, blasted it with cold air and did reads until I got 3 that were only 1% different.
I plugged in the new ISSI flash, wrote what I got out of the old broken one and soldered it back on the board.



Checked my soldering twice over with a multimeter and needle tip probes, everything seems to be connected just fine, big breath, I plugged in the power and got - a single blue "GPS" led. No sound, nothing.
Darn.

Let's check the UART -- the unit has a 3-pin connector, and after setting the usual 115200 baud rate, I got this.



Well, it _is_ booting, but the user partition is MIA, so there is a very good chance that this was as far as I came.
Yes, Pittasoft has downloadable software updates, but those are about 30MB in size, while the full dump is more like 130, so I assume there are parts that just never got updated and guess what got damaged on the old flash.

So... boxed it up until I find either a full NAND dump or get a better idea how to fix this. The good news is the unit is working, just the software is dead.

Code: [Select]
U-Boot 2010.06 (Jun 26 2013 - 15:42:37)

DRAM:  512 MiB
NAND:  Special Nand id table Version 1.23
Nand ID: 0xC8 0xD1 0x80 0x95 0x42 0x7F 0x7F 0x7F
Nand(Hardware): Block:128KB Page:2KB Chip:128MB*1 OOB:64B ECC:1bit
128 MiB
Can't find a valid spi flash chip.
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
user init finish.
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x100000, size 0x500000
 5242880 bytes read: OK
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-2.6.35.7
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2229244 Bytes = 2.1 MiB
   Load Address: 80800000
   Entry Point:  80800000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.7 (root@ubuntu26-Hisilicon) (gcc version 4.4.1 (Hisilicon_v                                            100(gcc4.4-290+uclibc_0.9.30.2+eabi+linuxpthread)) ) #1 Mon Jan 26 12:40:02 KST                                             2015
CPU: ARMv7 Processor [412fc098] revision 8 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: godeyes
HIETH[hieth_mdio_intf_parse_tag] mdio_intf use:rgmii!
Memory policy: ECC disabled, Data cache writeback
l2cache_flush_all:l2cache_flag = 0,L2 cache may not enable!
l2cache_flush_range:l2cache_flag = 0,L2 cache may not enable!
l2cache_flush_range:l2cache_flag = 0,L2 cache may not enable!
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 34290
Kernel command line: mem=135M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfst                                            ype=yaffs2 mtdparts=hinand:1M(boot),15M(kernel),40M(rootfs),64M(patch),-(test)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 135MB = 135MB total
Memory: 132520k/132520k available, 5720k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc8800000 - 0xe0000000   ( 376 MB)
    lowmem  : 0xc0000000 - 0xc8700000   ( 135 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc001f000   (  92 kB)
      .text : 0xc001f000 - 0xc03bb000   (3696 kB)
      .data : 0xc03d2000 - 0xc03f7160   ( 149 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:96
Console: colour dummy device 80x30
Calibrating delay loop... 878.18 BogoMIPS (lpj=4390912)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
NET: Registered protocol family 16
L2cache cache controller enabled
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 46) is a AMBA/PL011
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 47) is a AMBA/PL011
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
fuse init (API version 7.14)
msgmni has been set to 258
alg: No test for stdrng (krng)
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
brd: module loaded
loop: module loaded
nbd: registered device at major 43
Spi id table Version 1.22
Hisilicon Spi Flash Controller V300             Device Driver, Version 1.10
Special nand id table Version 1.33
Hisilicon Nand Flash Controller V301 Device Driver, Version 1.10
Nand ID: 0xC8 0xD1 0x80 0x95 0x42 0x7F 0x7F 0x7F
Nand(Hardware): Block:128KB Page:2KB Chip:128MB OOB:64B ECC:1bit
NAND device: Manufacturer ID: 0xc8, Chip ID: 0xd1 (Unknown NAND 128MiB 3,3V 8-bi                                            t)
5 cmdlinepart partitions found on MTD device hinand
Creating 5 MTD partitions on "hinand":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000001000000 : "kernel"
0x000001000000-0x000003800000 : "rootfs"
0x000003800000-0x000007800000 : "patch"
0x000007800000-0x000008000000 : "test"
Fixed MDIO Bus: probed
hi_gmac_mii: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 68, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 69, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
mice: PS/2 mouse device common for all mice
usbcore: registered new interface driver hiddev
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 2
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
yaffs: dev is 32505858 name is "mtdblock2" rw
yaffs: passed flags ""
usb 1-1: new high speed USB device using hiusb-ehci and address 2
mmc0: new high speed SDHC card at address 0007
mmcblk0: mmc0:0007 SD16G 14.4 GiB
 mmcblk0: p1
VFS: Mounted root (yaffs2 filesystem) on device 31:2.
devtmpfs: mounted
Freeing init memory: 92K

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S00devs
mknod: /dev/ttyAMA0: File exists
mknod: /dev/ttyAMA1: File exists
[RCS]: /etc/init.d/S01udev
[RCS]: /etc/init.d/S02pitta
###############################################
###############################################
### application start...                 ######
###############################################
###############################################
/etc/init.d/S02pitta: cd: line 11: can't cd to /usr/ko/
[board ver check]>>>>>>>>>> revision num : 0x00
/etc/init.d/S02pitta: line 38: ./DR550_load3516: not found
/dev/mmcblk0p1 mount....
yaffs: dev is 32505859 name is "mtdblock3" rw
yaffs: passed flags ""
[RCS]: /etc/init.d/S03urandom
Initializing random number generator... done.
[RCS]: /etc/init.d/S80network
Auto login as root ...
Jan  1 00:00:04 login[597]: root login on 'ttyS000'
mount: mounting /dev/mmcblk0p1 on /mnt/mmc failed: Device or resource busy
/dev/mmcblk0p1 mount....
-sh: awk: not found
-sh: expr: not found
-sh: expr: not found
-sh: expr: not found
find TimeZone


« Last Edit: July 12, 2021, 11:52:29 am by tocsa120ls »
-------
Short circuit - long fire
 

Offline tocsa120ls

  • Regular Contributor
  • *
  • Posts: 76
  • Country: hu
  • Electronic hobbyist living in Stuttgart
BTW if someone is in need, the serial connector is a Molex Picoblade
* pigtail 15134-0300
* socket if you ruin it 53261-7003
-------
Short circuit - long fire
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf