Skip to content

Firmware m0100

Jump to bottom
mefistotelis edited this page Jul 15, 2017 · 32 revisions

Table of Contents

Target
Purpose
Versions
Structure
OS and Libraries
Flashing
Interfaces

Target

The module programs application part of Ambarella A9SE firmware. Location of this chip:

Purpose

The Ambarella firmware does RAW image processing and then encoding of the video and photos to be saved on the SD card. On P3S, this firmware contains a secondary processing pipeline which prepares low-bandwidth video stream to be sent via Lightbridge technology to the remote controller for FPV functionality.

Versions

There are multiple versions, all unencrypted.

Marking Packages Timestamp Overview
00.01.5204 OSMO_FC350Z_FW_V01.00.00.03 2016-05-25
00.01.5217 OSMO_FC350Z_FW_V01.00.00.05 2016-06-06
00.01.5277 OSMO_FC350Z_FW_V01.00.00.06 OSMO_FC350Z_FW_V01.00.00.07 2016-06-29 ... 2016-07-08
00.01.5343 OSMO_FC350Z_FW_V01.00.00.08 2016-07-22
00.01.5346 OSMO_FC350Z_FW_V01.00.00.09 2016-07-26
00.01.5365 OSMO_FC350Z_FW_V01.00.00.11 2016-08-04
00.02.0002 OSMO_FC550R_FW_V01.01.00.01 2016-04-12
00.02.0007 OSMO_FC550R_FW_V01.01.00.03 2016-04-21
00.02.0009 OSMO_FC550R_FW_V01.01.00.04 2016-04-26
00.02.0012 OSMO_FC550R_FW_V01.01.00.10 OSMO_FC550R_FW_V01.03.00.30 2016-05-03 ... 2016-06-16
00.02.0013 OSMO_FC550R_FW_V01.02.00.11 2016-05-09
00.02.0015 OSMO_FC550R_FW_V01.03.00.40 2016-08-24
01.01.4539 P3XW_FW_V01.01.0000 2015-12-15
01.01.4553 P3XW_FW_V01.02.0010 P3XW_FW_V01.03.0010 2016-01-22 ... 2016-03-09
01.02.4935 P3XW_FW_V01.03.0020 P3XW_FW_V01.04.0030 P3XW_FW_V01.04.0036 P3XW_FW_V01.05.0040 2016-03-15 ... 2016-05-09
01.05.2735 P3X_FW_V01.01.1003 2015-04-30
01.05.3319 P3C_FW_V01.00.0014_Beta 2015-07-21
01.06.2736 P3X_FW_V01.01.0006 P3X_FW_V01.01.0008 P3X_FW_V01.01.0009 2015-05-01 ... 2015-05-12
01.07.2735 P3S_FW_V01.01.0008 P3S_FW_V01.01.0009 2015-05-06 ... 2015-05-12
01.09.3435 P3C_FW_V01.00.0017_Beta 2015-07-30
01.10.3548 P3C_FW_V01.00.0020 P3C_FW_V01.01.0030 2015-08-12 ... 2015-09-02
01.11.4696 OSMO_FC550_FW_V01.01.00.02 2016-01-19
01.13.4312 P3C_FW_V01.02.0040 P3C_FW_V01.03.0050 P3C_FW_V01.04.0050 2015-11-23 ... 2016-03-09
01.14.3061 P3S_FW_V01.02.0007 2015-06-13
01.14.3090 P3S_FW_V01.02.0008 2015-06-17
01.14.4920 P3C_FW_V01.04.0060 P3C_FW_V01.04.0060 P3C_FW_V01.05.0070 P3C_FW_V01.05.0074 P3C_FW_V01.06.0083 P3C_FW_V01.06.0086 P3C_FW_V01.07.0082 P3C_FW_V01.07.0084 P3C_FW_V01.07.0086 P3C_FW_V01.07.0090 2016-03-15 ... 2016-11-08
01.15.3056 P3X_FW_V01.01.1007 P3X_FW_V01.02.0006 2015-06-12 ... 2015-07-10
01.15.4872 OSMO_FC550_FW_V01.01.00.03 2016-02-24
01.16.4879 OSMO_FC550_FW_V01.01.00.04 OSMO_FC550_FW_V01.01.00.05 2016-02-24 ... 2016-03-01
01.19.4923 WM610_FC550_FW_V01.08.00.92 2016-03-24
01.20.3419 P3S_FW_V01.03.0020 2015-07-24
01.21.3647 P3S_FW_V01.04.0010 2015-09-02
01.21.4982 OSMO_FC550_FW_V01.01.00.07 2016-03-14
01.22.4095 P3S_FW_V01.05.0030 P3S_FW_V01.06.0040 2015-11-23 ... 2015-12-22
01.22.5037 OSMO_FC550_FW_V01.01.00.08 2016-03-25
01.23.3419 P3X_FW_V01.03.0020 P3X_FW_V01.04.0005 P3X_FW_V01.04.0010 2015-07-24 ... 2015-09-02
01.23.4920 P3S_FW_V01.07.0060 P3S_FW_V01.08.0080 P3S_FW_V01.09.0060 2016-03-13 ... 2016-05-19
01.23.5071 OSMO_FC550_FW_V01.01.00.09 2016-04-01
01.24.5087 OSMO_FC550_FW_V01.01.00.11 2016-04-07
01.25.5119 OSMO_FC550_FW_V01.01.00.13 2016-04-14
01.25.5432 P3S_FW_V01.10.0090 2016-11-07
01.26.4315 P3X_FW_V01.05.0030 P3X_FW_V01.06.0040 P3X_FW_V01.07.0043_beta 2015-11-23 ... 2015-12-30
01.27.5134 OSMO_FC550_FW_V01.03.00.30 2016-06-16
01.29.4920 P3X_FW_V01.07.0060 2016-03-13
01.29.5379 OSMO_FC550_FW_V01.03.00.40 2016-08-24
01.30.5036 P3X_FW_V01.08.0080 P3X_FW_V01.09.0060 2016-04-05 ... 2016-05-19
01.32.5432 P3X_FW_V01.10.0090 2016-11-07
02.29.4149 OSMO_FW_V01.00.01.19 2015-10-15
02.47.4492 OSMO_FW_V01.04.01.80 2015-12-26
02.56.4772 OSMO_FW_V01.05.01.88 2016-01-31
02.57.4788 OSMO_FW_V01.05.01.89 2016-02-05
02.59.4875 OSMO_FW_V01.05.01.92 OSMO_FW_V01.05.01.93 OSMO_FW_V01.05.01.94 2016-02-25 ... 2016-03-02
02.60.4918 OSMO_FW_V01.05.01.95 2016-03-04
02.61.4968 OSMO_FW_V01.05.01.96 2016-03-10
02.62.4985 OSMO_FW_V01.05.01.97 2016-03-11
02.63.4998 OSMO_FW_V01.05.02.00 2016-03-16
02.65.5033 OSMO_FW_V01.06.02.10 WM610_FW_V01.08.00.92 2016-03-24 ... 2016-03-24
02.67.5234 OSMO_FW_V01.08.02.30 2016-06-16
02.68.5367 OSMO_FC350Z_FW_V01.00.00.12 OSMO_FC350Z_FW_V01.00.00.13 OSMO_FC350Z_FW_V01.00.00.14 OSMO_FC350Z_FW_V01.00.00.15 2016-08-08 ... 2016-08-26
02.68.5408 OSMO_FC350Z_FW_V01.00.00.16 2016-08-26
02.68.5411 OSMO_FC350Z_FW_V01.00.00.17 OSMO_FC350Z_FW_V01.00.00.20 2016-08-29
02.69.5423 OSMO_FC350Z_FW_V01.01.00.21 OSMO_FC350Z_FW_V01.01.00.30 OSMO_FW_V01.08.02.35 2016-09-06 ... 2016-09-21
02.70.5440 OSMO_FW_V01.08.02.36 OSMO_FW_V01.08.02.40 2016-09-24 ... 2016-09-26
02.70.5442 OSMO_FC350Z_FW_V01.02.00.32 OSMO_FC350Z_FW_V01.02.00.33 2016-09-30
02.71.5449 OSMO_FC350Z_FW_V01.02.00.38 OSMO_FC350Z_FW_V01.02.00.40 2016-10-08 ... 2016-10-17
02.73.5514 OSMO_FC350Z_FW_V01.03.00.50 WM610_FC350Z_FW_V01.09.01.40 2016-11-09 ... 2016-11-14

Structure

It is the largest firmware module in related products. It is never encrypted.

The unencrypted firmware is an Ambarella firmware container, and it contains several partitions. In case of P3X, the partitions are as follows:

  • sys - System Software - contains a memory image of ARM (Cortex A9) binary. During startup, it is being loaded into memory at address 0x8020000 and executed by a loader. Such memory images are usually prepared by first linking the file with all libraries, and then using objcopy -O binary to get the final file without ELF header. The ELF header can be re-created if the address and boundaries of sections are known.
  • dsp_fw - DSP uCode - Contains programming for the internal Digital Signal Processor within the Ambarella chip.
  • rom_fw - System ROM Data - Contains files in Ambarella ROM FS partition format. This is Ambarella proprietary format, with resemblance to TAR format rather than any file system. The partition contains binary configuration files, which can be used to configure video filtering and adjustments.
  • lnx - Linux Kernel - Linux boot partition containing the kernel.
  • rfs - Linux Root FS - Contains a disk image in UBI FS partition format. Unsorted Block Image File System is specifically designed for NAND flash memory, and can be mounted using NAND simulation.

Examples for each of these partiton, and their creation method, is included in Ambarella SDK.

OS and Libraries

Different partitons of the Ambarella firmware are based on different OSes and technologies:

  • lnx, rfs - These partitions make up the Linux part of the firmware. In most cameras based on Ambarella A9, it is used to control the internal LCD display, switch options and show preview. It is a simple Linux distribution provided within Ambarella SDK.
  • sys - The ARM binary within this image uses ThreadX RTOS. It is responsible of writing data to SD card, it also controls firmware updates in case a new firmware is found on the card during startup.
  • dsp_fw - The DSP binary format is not known in detail.

Flashing

Since this firmware is used on many various products, some of the flashing methods may not be listed here.

By official package in camera

The official way of flashing the firmware is by inserting an SD-card with firmware package file into the drone camera. The current sys partition firmware must be in working order, as it will be responsible on performing the update. The sys partition software will extract modules from the package and distribute them to proper target components. It requires the firmware in bin form to exist in root directory of the SD-card.

In order for the firmware to be accepted:

  • it cannot be compressed on the SD-card
  • no newer firmware should exist on the card
  • the firmware must have original file name, specific to the product
  • the firmware must match the product being updated
  • the new firmware needs to be newer than current, or current needs to allow rollback to the target version
  • if a proper FW_DEBUG file (ie. P3X_FW_DEBUG for P3X) exists in the root directory of SD-card, the version checking rules above does not apply

After the upgrade, two logs will be created on the SD-card. The more verbose log will be in a MISC/LOG folder which has the hidden attribute set. It is best to check that log for a result information.

By firmware module in camera

The camera can also upgrade specific modules of the drone if properly named files are found on the SD-card. The current sys partition firmware must be in working order, as it will be responsible on performing the update. The firmware module file needs to be unencrypted - flashing an encrypted firmware this way will cause the updated device to crash during startup, and the only way to bring it back to life will be to hook to it directly and flash it using a hardware programmer stick.

The proper file names:

  • For P3C the name is "PFC300CFw3.bin".
  • For P3S and current firmware lower than P3S_FW_V01.04.0010 the name is "FC300SFw.bin". For newer current firmware version, the accepted file name in P3X and P3S is "PFC300SFw3.bin".
  • For P3X and current firmware lower than P3X_FW_V01.05.0030 the name is "FC300XFw.bin". For newer current firmware version, the accepted file name in P3X and P3S is "PFC300XFw3.bin".

After the upgrade, log files will be created on SD-card, similar to the method with package.

By chip maker method

There are probably other methods of flashing provided by Ambarella. This subject was not pursued, so the methods are not known.

Interfaces

SD-card interface

The interface can be used to write videos and photos, but also to update firmware in the whole drone.

Debug serial interface U0

The serial interface can be used to access the Ambarella sys component.

A typical boot sequence which can be seen on the U0 interface is as follows:

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting done ......
[00000002][CA9_0] [DJI] Start WDT of 20 seconds for boot up......
[00000002][CA9_0] [Version 1.0.11824], May 29 2015, 18:59:46
[00000002][CA9_0] [DJI] SD Updater Version [v01.22.4095] Build Oct  9 2015 14:32:09
[00000502][CA9_0] [DJI] Stop WDT.
[00000502][CA9_0] [DJI] Firmware updating......
[00000502][CA9_0] Card In Slot.
[00000803][CA9_0] SD clock source, frequency = 216000000
[00000803][CA9_0] SDCalcClk for SD card initiation:: Actual Clk = 140625, pCLK = 128
[00000822][CA9_0] start to check media
[00000829][CA9_0] AmbaSD_InitCard - SD_CARD OK

Ambarella Linux console via ETH

To access Ambarella Linux console in P3X, you can attach to Firmware m0800 Debug serial interface, and from there connect to Ambarella via internal Ethernet.

Video sensor input interface

The interface reads data from the CMOS sensor for processing within the Ambarella chip.

Video stream output

The interface exports video stream for FPV transmission. It was suggested that in P3X, Ambarella sends video to DaVinci compressor via Ethernet.

This page is created by drone enthusiasts for drone enthusiasts.

If you see a mistake, or you know more about specific subject, or you see an area for improvement for the wiki - create an issue in this project and attach your patch (or describe the change you propose).

Clone this wiki locally