LC1860

The LC1860 is a SoC produced by LeadCore Technology, and is included in almost all newer products of DJI (Mavic, Spark, etc.). It is used as the main processor, but also houses other functionalities such as video encoding and modem. Here is an overview of the LC1860:

• Main ARM
• Hantro video encoders/decoders (2x)
• ISP 20MP
• Mali GPU
• Modem
  • ARM
  • DSP

Main ARM

6-core 2GHz Cortex-A7 (ARMV7-A) running Android 4.4 with an U-Boot bootloader.

Connections

• Micro USB (side on the Mavic)
• SD Card (side, image/video storage)
• UART to FC
• USB to FC for reading out the FC SD-Card

Boot process

All data for booting comes from the eMMC, except from the parts that are stored in the EFUSES.

• Based on the partition status bits either bootarea0 or bootarea1 gets loaded from eMMC
• The LC1860 verifies the SHA256 hash of the public RSA-2048 key(named PRAK, see Authentication keys) at the start of the bootarea with the EFUSES
• On the bootarea U-Boot 2012 is installed and gets relocated to the memory
• U-Boot will read the PRAK RSA key which was stored in front, and will use it to verify several DJI images
• U-Boot will load the Partition table (PL*H image)
• U-Boot will load the OTP keys from the EFUSES
• U-Boot will load the Env partition and all of it's variables
• U-Boot will load the specific key image from the bootarea partition (which is unique for each device encrypted with the UREK and containing the common IAEK)
• U-Boot will load the tl420 partition (unknown where it is used for)
• U-Boot will load the kernel partition and root filesystem based on the environment variables and EFUSES (normal, recovery or factory_out)
• U-Boot starts the kernel

EFUSE layout

• 4B Chip ID
• 16B AES Key
• 32B SHA256 of the PRAK
• 16B Board SN (UTF-8)
• 16B UREK Key
• 16B CREK Key
• 8B Padding 0
• 4B CRC
• 16B Function code (disabling JTAG and EFUSE write etc.)