AMD XHCI: Difference between revisions
Jump to navigation
Jump to search
(embedded microcontroller in FCH XHCI controller is not a V850, but probably a V850E1) |
(some more info on the fch xhci controller) |
||
| Line 32: | Line 32: | ||
The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored. | The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored. | ||
The firmware entry point seems to be at the beginning of the firmware blob (right after the version bytes). | |||
At the end of the firmware there is some kind of function hook table. | |||
== address space layout of the embedded microcontroller == | |||
0x00000000-0x00007FFF: internal mask ROM | |||
0x00008000-0x0000FFFF: loaded firmware (without version bytes) | |||
Revision as of 12:15, 22 January 2015
AMD XHCI
The AMD XHCI controller in Hudson chip seems to be IP Core of Renesas uPD720200/200A. It looks the firmware consists of multi parts:
| Offset | Size in bytes | What | |
|---|---|---|---|
| 0x0000 | 2 | Signature 0x55aa | |
| 0x0002 | 2 | Offset to the BCD (type0?) | |
| 0x0004 | 2 | BCD size | |
| 0x0006 | 2 | Offset to Main FW (type1?) | |
| 0x0008 | 2 | Main FW size | |
| 0x000a | 2 | Offset to the ACD (type2?) | |
| 0x000c | 2 | Offset to the ACD |
| Offset | Size in bytes | What | |
|---|---|---|---|
| 0x0000 | 2 | Firmware version - 0x3032 means 3.0.3.2 | |
| 0x0002 | - | Firmware data, most likely V850E1 controller |
The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored.
The firmware entry point seems to be at the beginning of the firmware blob (right after the version bytes).
At the end of the firmware there is some kind of function hook table.
address space layout of the embedded microcontroller
0x00000000-0x00007FFF: internal mask ROM
0x00008000-0x0000FFFF: loaded firmware (without version bytes)