Firmware m0802

Table of Contents

Target
Purpose
Versions
Structure
Boot process
OS and Libraries
Flashing
Interfaces

Target

The firmware programs Vision Processing Unit which handles video analysis required for collision avoidance and intelligent functions (within Tello, it does everything the drone can do). Location of this chip:

• in WM220, Movidius MA2100A VPU; is on WM220 Core Board A
• in WM004, Movidius MA2155 VPU; is on WM004 Main Processing Core Board
• in other products, the location is unknown

Purpose

When used for collision avoidance and intelligent flight, the chip has several cameras connected and uses them to assess distance to surrounding obstacles, with amount of cameras and their direction dependent on specific product.

Within WM004 the focus of this chip is different, as there it is used for flight control. That solution utilizes PWM outputs of the chip to control brushed motors, and the chip also acts as CMOS sensor driver.

Versions

TODO

Structure

The firmware comes in a Myriad 2 specific container, with magic FourCC identifier MA2x. Within other Myriad 2 firmware packages, such files typically have mvcmd extension. They are generated using moviConvert tool from Myriad Development Kit.

Typically mvcmd files are plaintext code and data, generated from ELF file compiled with the Myriad toolchain, with RSA signature. But there is possibility to also encrypt the data with AES when running moviConvert. DJI firmwares have the content encrypted and signed. Keys to be used are provided to moviConvert as parameters; the same tool also has capability to generate new keys.

Boot process

After reset signal pulls to zero, control is given to embedded bootrom. The bootrom is made by Movidius. It contains code to read MA2x application image, verify its signature and decrypt it if needed. Keys used for that are not a part of bootrom. Application image is acquired from serial flash chip and decrypted to memory. The flash chip stores MA2x image directly. Then bootrom jumps to it with execution.

No further analysis of the booting procedure were performed.

OS and Libraries

The DJI firmware does not seem to use any of high level frameworks prepared by Movidius. It goes with bare metal programming instead, being compiled and linked using tools available in Myriad Development Kit. These contain both clang-based compiler (moviCompile) and gcc-based cross-compile toolchain; it is unsure which one was used by DJI.

Flashing

Since the chip uses bootrom provided by Movidius, their flashing methods apply.

The firmware is stored on serial flash, so the flash chip can also be reflashed without involvement of Myriad 2 chip.

It's also possible to run custom firmware without flashing it, by uploading the MA2x file with moviUsbBoot tool from Myriad Development Kit.

TODO

Interfaces

TODO