Firmware m0100
Target
Purpose
Versions
Structure
Boot process
OS and Libraries
Flashing
Interfaces
The module programs application part of Ambarella firmware. Location of this chip:
- in WM610, Ambarella A9SE is on WM610 X5 Camera Hi Res Encoder Gimbal Control board
- in P3X and P3S, Ambarella A9SE is on WM320 Gimbal top board
- in P3C and P3XW, Ambarella A9SE is on WM321 Camera encoder board
- in WM330, Ambarella A9SE is on WM330 Camera Encoder board
- in OSMO, the location is unknown
- in WM160, Ambarella H22 is on WM160 Main Processing Core Board
The Ambarella firmware does RAW image processing and then encoding of the video and photos to be saved on the SD card. On lower tier platforms, this firmware contains a secondary processing pipeline which prepares low-bandwidth video stream to be sent to the remote controller for FPV functionality (ie. in P3C).
There are multiple versions, all unencrypted.
| Marking | Packages | Timestamp | Overview |
|---|---|---|---|
| 00.01.5204 | OSMO_FC350Z_FW_V01.00.00.03 | 2016-05-25 | |
| 00.01.5217 | OSMO_FC350Z_FW_V01.00.00.05 | 2016-06-06 | |
| 00.01.5277 | OSMO_FC350Z_FW_V01.00.00.06 OSMO_FC350Z_FW_V01.00.00.07 | 2016-06-29 ... 2016-07-08 | |
| 00.01.5343 | OSMO_FC350Z_FW_V01.00.00.08 | 2016-07-22 | |
| 00.01.5346 | OSMO_FC350Z_FW_V01.00.00.09 | 2016-07-26 | |
| 00.01.5365 | OSMO_FC350Z_FW_V01.00.00.11 | 2016-08-04 | |
| 00.02.0002 | OSMO_FC550R_FW_V01.01.00.01 | 2016-04-12 | |
| 00.02.0007 | OSMO_FC550R_FW_V01.01.00.03 | 2016-04-21 | |
| 00.02.0009 | OSMO_FC550R_FW_V01.01.00.04 | 2016-04-26 | |
| 00.02.0012 | OSMO_FC550R_FW_V01.01.00.10 OSMO_FC550R_FW_V01.03.00.30 | 2016-05-03 ... 2016-06-16 | |
| 00.02.0013 | OSMO_FC550R_FW_V01.02.00.11 | 2016-05-09 | |
| 00.02.0015 | OSMO_FC550R_FW_V01.03.00.40 | 2016-08-24 | |
| 01.01.4539 | P3XW_FW_V01.01.0000 | 2015-12-15 | |
| 01.01.4553 | P3XW_FW_V01.02.0010 P3XW_FW_V01.03.0010 | 2016-01-22 ... 2016-03-09 | |
| 01.02.4935 | P3XW_FW_V01.03.0020 P3XW_FW_V01.04.0030 P3XW_FW_V01.04.0036 P3XW_FW_V01.05.0040 | 2016-03-15 ... 2016-05-09 | |
| 01.05.2735 | P3X_FW_V01.01.1003 | 2015-04-30 | |
| 01.05.3319 | P3C_FW_V01.00.0014_Beta | 2015-07-21 | |
| 01.06.2736 | P3X_FW_V01.01.0006 P3X_FW_V01.01.0008 P3X_FW_V01.01.0009 | 2015-05-01 ... 2015-05-12 | |
| 01.07.2735 | P3S_FW_V01.01.0008 P3S_FW_V01.01.0009 | 2015-05-06 ... 2015-05-12 | |
| 01.09.3435 | P3C_FW_V01.00.0017_Beta | 2015-07-30 | |
| 01.10.3548 | P3C_FW_V01.00.0020 P3C_FW_V01.01.0030 | 2015-08-12 ... 2015-09-02 | |
| 01.11.4696 | OSMO_FC550_FW_V01.01.00.02 | 2016-01-19 | |
| 01.13.4312 | P3C_FW_V01.02.0040 P3C_FW_V01.03.0050 P3C_FW_V01.04.0050 | 2015-11-23 ... 2016-03-09 | |
| 01.14.3061 | P3S_FW_V01.02.0007 | 2015-06-13 | |
| 01.14.3090 | P3S_FW_V01.02.0008 | 2015-06-17 | |
| 01.14.4920 | P3C_FW_V01.04.0060 P3C_FW_V01.04.0060 P3C_FW_V01.05.0070 P3C_FW_V01.05.0074 P3C_FW_V01.06.0083 P3C_FW_V01.06.0086 P3C_FW_V01.07.0082 P3C_FW_V01.07.0084 P3C_FW_V01.07.0086 P3C_FW_V01.07.0090 | 2016-03-15 ... 2016-11-08 | |
| 01.15.3056 | P3X_FW_V01.01.1007 P3X_FW_V01.02.0006 | 2015-06-12 ... 2015-07-10 | |
| 01.15.4872 | OSMO_FC550_FW_V01.01.00.03 | 2016-02-24 | |
| 01.16.4879 | OSMO_FC550_FW_V01.01.00.04 OSMO_FC550_FW_V01.01.00.05 | 2016-02-24 ... 2016-03-01 | |
| 01.19.4923 | WM610_FC550_FW_V01.08.00.92 | 2016-03-24 | |
| 01.20.3419 | P3S_FW_V01.03.0020 | 2015-07-24 | |
| 01.21.3647 | P3S_FW_V01.04.0010 | 2015-09-02 | |
| 01.21.4982 | OSMO_FC550_FW_V01.01.00.07 | 2016-03-14 | |
| 01.22.4095 | P3S_FW_V01.05.0030 P3S_FW_V01.06.0040 | 2015-11-23 ... 2015-12-22 | |
| 01.22.5037 | OSMO_FC550_FW_V01.01.00.08 | 2016-03-25 | |
| 01.23.3419 | P3X_FW_V01.03.0020 P3X_FW_V01.04.0005 P3X_FW_V01.04.0010 | 2015-07-24 ... 2015-09-02 | |
| 01.23.4920 | P3S_FW_V01.07.0060 P3S_FW_V01.08.0080 P3S_FW_V01.09.0060 | 2016-03-13 ... 2016-05-19 | |
| 01.23.5071 | OSMO_FC550_FW_V01.01.00.09 | 2016-04-01 | |
| 01.24.5087 | OSMO_FC550_FW_V01.01.00.11 | 2016-04-07 | |
| 01.25.5119 | OSMO_FC550_FW_V01.01.00.13 | 2016-04-14 | |
| 01.25.5432 | P3S_FW_V01.10.0090 | 2016-11-07 | |
| 01.26.4315 | P3X_FW_V01.05.0030 P3X_FW_V01.06.0040 P3X_FW_V01.07.0043_beta | 2015-11-23 ... 2015-12-30 | |
| 01.27.5134 | OSMO_FC550_FW_V01.03.00.30 | 2016-06-16 | |
| 01.29.4920 | P3X_FW_V01.07.0060 | 2016-03-13 | |
| 01.29.5379 | OSMO_FC550_FW_V01.03.00.40 | 2016-08-24 | |
| 01.30.5036 | P3X_FW_V01.08.0080 P3X_FW_V01.09.0060 | 2016-04-05 ... 2016-05-19 | |
| 01.32.5432 | P3X_FW_V01.10.0090 | 2016-11-07 | |
| 02.29.4149 | OSMO_FW_V01.00.01.19 | 2015-10-15 | |
| 02.47.4492 | OSMO_FW_V01.04.01.80 | 2015-12-26 | |
| 02.56.4772 | OSMO_FW_V01.05.01.88 | 2016-01-31 | |
| 02.57.4788 | OSMO_FW_V01.05.01.89 | 2016-02-05 | |
| 02.59.4875 | OSMO_FW_V01.05.01.92 OSMO_FW_V01.05.01.93 OSMO_FW_V01.05.01.94 | 2016-02-25 ... 2016-03-02 | |
| 02.60.4918 | OSMO_FW_V01.05.01.95 | 2016-03-04 | |
| 02.61.4968 | OSMO_FW_V01.05.01.96 | 2016-03-10 | |
| 02.62.4985 | OSMO_FW_V01.05.01.97 | 2016-03-11 | |
| 02.63.4998 | OSMO_FW_V01.05.02.00 | 2016-03-16 | |
| 02.65.5033 | OSMO_FW_V01.06.02.10 WM610_FW_V01.08.00.92 | 2016-03-24 ... 2016-03-24 | |
| 02.67.5234 | OSMO_FW_V01.08.02.30 | 2016-06-16 | |
| 02.68.5367 | OSMO_FC350Z_FW_V01.00.00.12 OSMO_FC350Z_FW_V01.00.00.13 OSMO_FC350Z_FW_V01.00.00.14 OSMO_FC350Z_FW_V01.00.00.15 | 2016-08-08 ... 2016-08-26 | |
| 02.68.5408 | OSMO_FC350Z_FW_V01.00.00.16 | 2016-08-26 | |
| 02.68.5411 | OSMO_FC350Z_FW_V01.00.00.17 OSMO_FC350Z_FW_V01.00.00.20 | 2016-08-29 | |
| 02.69.5423 | OSMO_FC350Z_FW_V01.01.00.21 OSMO_FC350Z_FW_V01.01.00.30 OSMO_FW_V01.08.02.35 | 2016-09-06 ... 2016-09-21 | |
| 02.70.5440 | OSMO_FW_V01.08.02.36 OSMO_FW_V01.08.02.40 | 2016-09-24 ... 2016-09-26 | |
| 02.70.5442 | OSMO_FC350Z_FW_V01.02.00.32 OSMO_FC350Z_FW_V01.02.00.33 | 2016-09-30 | |
| 02.71.5449 | OSMO_FC350Z_FW_V01.02.00.38 OSMO_FC350Z_FW_V01.02.00.40 | 2016-10-08 ... 2016-10-17 | |
| 02.73.5514 | OSMO_FC350Z_FW_V01.03.00.50 WM610_FC350Z_FW_V01.09.01.40 | 2016-11-09 ... 2016-11-14 |
It is the largest firmware module in related products. It is never encrypted.
The Ambarella A9 SoC consists of two ARM processors and a DSP. The firmware module contains programming for all these components.
The unencrypted firmware is an Ambarella firmware container, and it contains several partitions. In case of P3X, the partitions are as follows:
-
sys- System Software - contains a memory image of ARM (Cortex A9) binary. During startup, it is being loaded into memory at address 0x8020000 and executed by a loader. Such memory images are usually prepared by first linking the file with all libraries, and then usingobjcopy -O binaryto get the final file without ELF header. The ELF header can be re-created if the address and boundaries of sections are known. -
dsp_fw- DSP uCode - Contains programming for the internal Digital Signal Processor within the Ambarella chip. -
rom_fw- System ROM Data - Contains files in Ambarella ROM FS partition format. This is Ambarella proprietary format, with resemblance to TAR format rather than any file system. The partition contains binary configuration files, which can be used to configure video filtering and adjustments. -
lnx- Linux Kernel - Linux boot partition containing the kernel. The Linux is used to boot the second ARM core. -
rfs- Linux Root FS - Contains a disk image in UBI FS partition format. Unsorted Block Image File System is specifically designed for NAND flash memory, and can be mounted using NAND simulation.
Examples for each of these partitions, and their creation method, is included in Ambarella SDK.
No analysis of the booting procedure were performed.
Different partitons of the Ambarella firmware are based on different OSes and technologies:
-
lnx,rfs- These partitions make up the Linux part of the firmware. In most cameras based on Ambarella A9, it is used to control the internal LCD display, switch options and show preview. It is a simple Linux distribution provided within Ambarella SDK. -
sys- The ARM binary within this image uses ThreadX RTOS. It is responsible of writing data to SD card, it also controls firmware updates in case a new firmware is found on the card during startup. -
dsp_fw- The DSP binary format is not known in detail.
Since this firmware is used on many different products, some of the flashing methods may not be listed here.
This method requires the current sys partition firmware be in working order, as it will be responsible on performing the update.
See Flashing firmware via SD-card by official package in camera for details.
This method requires the current sys partition firmware be in working order, as it will be responsible on performing the update. It also works properly only if the new firmware is unencrypted.
See Flashing firmware via SD-card by firmware module in camera for details.
Within "Ambarella A7L System Hardware" specification document, there is a description of boot methods in chapter "Power-On Configuration". One of the boot methods is "USB boot". This method is selected by setting bit pair VD1_OUT[10,16] to 0x0, from its original value 0x2 which indicates NAND boot.
It is speculated that Ambarella A9 contains equivalent boot method, and the input which allows boot from USB is exposed as one of service pads.
A drive image required to boot Ambarella chip from USB can be generated using Ambarella SDK.
There are probably other methods of flashing provided by Ambarella. Since technical documentation of Ambarella A9 is not available online, the methods are not known.
The SD-card connected to Ambarella chip has several uses:
- can store videos and photos recorded by the camera
- can update firmware of the whole drone or separate modules
- stores camera related logs (firmware update log and camera shell log)
Ambarella sys component shell log can be enabled by creating an empty file "0x40003000.dji" on the sd-card root. The result will be creation of "CameraLogCur.log" in the hidden MISC folder, which will look similar to the log shown below:
[00000002][CA9_0] [Version 1.0.11824], Oct 16 2015, 14:06:35
[00000002][CA9_0] ----------------AmbaDSP_TotalUsedNonCachedMem = 513MB
[00000002][CA9_0] ----------------AmbDSP_UserCameraModeBufSize = 174MB
[00000002][CA9_0] [DJI firmware version] v01.30.5036
[00000002][CA9_0] ********** Wake Up REASON **********
[00000002][CA9_0] Wake-Up by Alarm.
[00000002][CA9_0] ************************************
[00000002][CA9_0] *********** RESET REASON ***********
[00000002][CA9_0] 0: Power off reset.
[00000002][CA9_0] 1: Power off reset.
[00000002][CA9_0] 2: Power off reset.
[00000002][CA9_0] 3: Power off reset.
[00000002][CA9_0] 4: Power off reset.
[00000002][CA9_0] ************************************
[00000011][CA9_0] ROM (0): initialized
[00000012][CA9_0] ROM (1): initialized
[00000022][CA9_0] current RetryCnt :5
[00000023][CA9_0] [DJI_LED] DjiLedInit: Led init Start.
[00000023][CA9_0] [DJI_LED] DjiLedInit: Led init OK.
[00000023][CA9_0] [DJI_MIS] DjiMiscInit: Misc init start.
[00000023][CA9_0] [DJI_MIS] DjiMiscInit: Misc init OK.
[00000023][CA9_0] [DJI_MIS] DjiRTCInit: RTC init start.
[00000061][CA9_0] [DjiRTCInit] current time:2014.01.01 - 00:00:00
[00000061][CA9_0] [DJI_MIS] DjiRTCInit: RTC init OK.
[00000061][CA9_0] [DJI_UST] DjiUstInit: User setting init start.
[00000081][CA9_0] [DJI_UST] DjiUstInit: User setting init OK.
[00000082][CA9_0] Amba NFTL Init Lock 'NFTL_ID_STORAGE'
[00000116][CA9_0] DjiOpModeInit: OpMode value(7) unsupport, set to capture mode.
[00000116][CA9_0] [DJI_UST] DjiUstOpModeSet: Setting value(0).
[00000116][CA9_0] [DJI_UST] DjiUstOpModeSet: Start setting, id=29.
[00000116][CA9_0] [DJI_CMM] DjiCmmOpModeSwitchInner: Operation mode(0) is not actually switched.
[00000116][CA9_0] [DJI_UST] DjiUstOpModeSet: End setting, id=29.
[00000116][CA9_0] [DJI_UST] DjiUstModeDialSet: Setting value(1).
[00000116][CA9_0] [DJI_UST] DjiUstModeDialSet: Start setting, id=33.
[00000116][CA9_0] [DJI_UST] DjiUstModeDialSet: End setting, id=33.
[00000116][CA9_0] AmbaPref Load done
...
*****************************************************************
* *
* AmbaShell ;) *
* *
*****************************************************************
Type 'help' for help
a:\> [00000013][CA9_0] DRAM Clk 396000000
[00000013][CA9_0] IDSP Clk 264000000
[00000013][CA9_0] Core Clk 288000000
[00000013][CA9_0] DjiInitStage[L244]: =========================== DJI stage 0 start ===========================
[00000013][CA9_0] *********** RESET REASON ***********
[00000013][CA9_0] 0: Power off reset.
[00000013][CA9_0] 1: Power off reset.
[00000013][CA9_0] 2: Power off reset.
[00000013][CA9_0] 3: Power off reset.
[00000013][CA9_0] 4: Power off reset.
[00000013][CA9_0] ************************************
[00000013][CA9_0] DjiLogInit[L127]: DJI log init start.
[00004111][CA9_0] DjiTaskCreate[L142]: success to create DjiWriteLogToSd task, ExclusionMap = 0x00000000
[00004111][CA9_0] DjiLog2SdDetectProc[L222]: DjiLog2SdDetectProc: detect log record config file enable sd record log
[00004111][CA9_0] DjiLog2SdDetectProc[L243]: saving elog@0x3ff041b4,524288 to C:\elog_0
[00004927][CA9_0]
---- Anti flicker : 60Hz. ----
[00010598][CA9_0] ***[DJI_IPC] IPC_Rpc_Ctrl_Svc[L756]: recv msg(1)
[00010598][CA9_0] [DJI_MCCTRL] MCCTRL_RpcCtrlSvc[L1305]: Recive Linux Bootup Ack
[00010627][CA9_0] ***[DJI_IPC] IPC_Rpmsg_Alloc[L545]: IPC RPMsg Channel(dji_test, 0x85cdd60) Create Success
[00010669][CA9_0] ***[DJI_IPC] IPC_Rpmsg_Alloc[L545]: IPC RPMsg Channel(dji_usr, 0x8666860) Create Success
[00010737][CA9_0] ***[DJI_IPC] IPC_Rpmsg_Alloc[L545]: IPC RPMsg Channel(dji_drv, 0x8666900) Create Success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21760] to channel[0] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21761] to channel[1] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21762] to channel[2] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21766] to channel[3] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21763] to channel[4] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21764] to channel[5] success
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAlloc[L1257]: dji ipc alloc Pid[21765] to channel[6] success
[00010737][CA9_0] [DJI_MCCTRL] MCCTRL_PostLinuxReady[L1291]: Call Linux Bootup recall function
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAttach[L1133]: dji ipc Pid[21764] to channel 5 attach success
[00010737][CA9_0] [DJI_MCCTRL] MCCTRL_Init[L174]: McCtrl Init Success!
[00010737][CA9_0] ***[DJI_IPC] DjiIpcAttach[L1133]: dji ipc Pid[21762] to channel 2 attach success
[00010738][CA9_0] DjiTaskCreate[L142]: success to create DjiRlvMgr task, ExclusionMap = 0x00000000
[00010738][CA9_0] ===[DJI_RLV] RLV_TaskCreate[L1381]: success
[00010738][CA9_0] [DJI_MCCTRL] MCCTRL_BandWidthAlloc[L931]: alloc band width sub part(0), 100/100 of G
[00010738][CA9_0] ===[DJI_RLV] RLV_ChangeBitrate[L750]: Change RLV Bitrate to 2000 kbps
[00010738][CA9_0] ===[DJI_AVENC] AVENC_VideoChangeBitRate[L1611]: change video(1)'s bitrate to 2000 kbps
[00010738][CA9_0] ===[DJI_RLV] RLV_Init[L1463]: RLV Init Success!
[00010738][CA9_0] ***[DJI_IPC] DjiIpcAttach[L1133]: dji ipc Pid[21765] to channel 6 attach success
[00010738][CA9_0] DjiTaskCreate[L142]: success to create DjiTransSrv task, ExclusionMap = 0x00000000
[00010738][CA9_0] [DJI_MCCTRL] MCCTRL_BandWidthAlloc[L931]: alloc band width sub part(1), 100/100 of NonG
[00010738][CA9_0] ===[DJI_RLV] RLV_ChangeBitrate[L750]: Change RLV Bitrate to 2000 kbps
[00010738][CA9_0] ===[DJI_AVENC] AVENC_VideoChangeBitRate[L1611]: change video(1)'s bitrate to 2000 kbps
[00010738][CA9_0] [DJI_TRANS] TRANSSRV_SetLinkBandWidth[L2138]: Band Width 31 control to 29 KB/s
[00010738][CA9_0] [DJI_TRANS] TRANSSRV_Init[L5636]: Trans Init Success
[00010738][CA9_0] ***[DJI_IPC] DjiIpcAttach[L1133]: dji ipc Pid[21763] to channel 4 attach success
[00010738][CA9_0] [DJI_MCCTRL] MCCTRL_SendInitInfo[L626]: Send Init Info to Linux
[00010738][CA9_0] ===[DJI_RLV] RLV_ManagerTaskEntry[L1257]: Rlv Manager Task Entry
[00010739][CA9_0] [DJI_TRANS] TRANSSRV_MainTaskEntry[L5312]: Trans Wait Flag: 0x0000003b
[00010740][CA9_0] DjiBootUpLinuxInit[L619]: Linux Boot Time[7230ms]
[00010740][CA9_0] DjiInitStage[L262]: =========================== DJI stage 3 end ===========================
[00010740][CA9_0] DjiSysBootUpTaskEntry[L530]: [DJI system boot up] Done.
[00010740][CA9_0] DjiBoardCheckInit[L1532]: Dji Board Check Init Begin
[00010742][CA9_0] DjiMsgPktAssemble[L856]: DjiMsgPktAssemble: Invalid SOF! SOF[0x00]
Note that this is sys component log - it shows RTOS boot, not Linux boot.
The serial interface can be used to access the Ambarella sys component shell.
Specific service pads can be found on the page for specific target board.
A typical boot sequence which can be seen on the U0 interface is as follows:
---------------------------------------------
Cortex Boot-Up Success
Cortex freq: 504000000
ARM freq: 17600000
DDR freq: 396000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 24000000
SD1 freq: 24000000
---------------------------------------------
...
Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting done ......
[00000002][CA9_0] [DJI] Start WDT of 20 seconds for boot up......
[00000002][CA9_0] [Version 1.0.11824], May 29 2015, 18:59:46
[00000002][CA9_0] [DJI] SD Updater Version [v01.22.4095] Build Oct 9 2015 14:32:09
[00000502][CA9_0] [DJI] Stop WDT.
[00000502][CA9_0] [DJI] Firmware updating......
[00000502][CA9_0] Card In Slot.
[00000803][CA9_0] SD clock source, frequency = 216000000
[00000803][CA9_0] SDCalcClk for SD card initiation:: Actual Clk = 140625, pCLK = 128
[00000822][CA9_0] start to check media
[00000829][CA9_0] AmbaSD_InitCard - SD_CARD OK
The "Cortex Boot-Up Success" table is often repeated a few times - this is normal.
Transmission configuration is 115200 8N1.
To access Ambarella Linux console in P3X, you can attach to Firmware m0800 Debug serial interface, and from there connect to Ambarella via internal Ethernet.
The interface reads data from the CMOS sensor for processing within the Ambarella chip.
The interface exports video stream for FPV transmission.
- In P3X, Ambarella sends video to DaVinci media processor on the same board via HDMI output.
- In P3S, video is encoded within Ambarella and sent to OFDM Receiver board via USB.
- In P3C, video is encoded within Ambarella and sent to Gimbal Top board.
This page is created by drone enthusiasts for drone enthusiasts.
If you see a mistake, or you know more about specific subject, or you see an area for improvement for the wiki - create an issue in this project and attach your patch (or describe the change you propose).