AMD XHCI: Difference between revisions

From coreboot
Jump to navigation Jump to search
(embedded microcontroller in FCH XHCI controller is not a V850, but probably a V850E1)
m (acronym expansion of BCD and ACD)
 
(One intermediate revision by the same user not shown)
Line 21: Line 21:
|0x000c || 2 || Offset to the ACD ||
|0x000c || 2 || Offset to the ACD ||
|}
|}
BCD = Boot Configuration Data
ACD = Application Configuration Data


{|
{|
Line 32: Line 35:


The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored.
The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored.
The firmware entry point seems to be at the beginning of the firmware blob (right after the version bytes).
At the end of the firmware there is some kind of function hook table.
== address space layout of the embedded microcontroller ==
0x00000000-0x00007FFF: internal mask ROM
0x00008000-0x0000FFFF: loaded firmware (without version bytes)

Latest revision as of 16:53, 23 April 2015

AMD XHCI

The AMD XHCI controller in Hudson chip seems to be IP Core of Renesas uPD720200/200A. It looks the firmware consists of multi parts:

XHCI firmware layout header 0xe bytes
Offset Size in bytes What
0x0000 2 Signature 0x55aa
0x0002 2 Offset to the BCD (type0?)
0x0004 2 BCD size
0x0006 2 Offset to Main FW (type1?)
0x0008 2 Main FW size
0x000a 2 Offset to the ACD (type2?)
0x000c 2 Offset to the ACD

BCD = Boot Configuration Data ACD = Application Configuration Data

Main FW
Offset Size in bytes What
0x0000 2 Firmware version - 0x3032 means 3.0.3.2
0x0002 - Firmware data, most likely V850E1 controller

The firmware in blobs repository is 3.0.3.2, quite common version 3.0.3.4.0.8 found on the internet matches well 0xcf0 bytes. It is not know where the 0.8 subversion is stored.

The firmware entry point seems to be at the beginning of the firmware blob (right after the version bytes).

At the end of the firmware there is some kind of function hook table.

address space layout of the embedded microcontroller

0x00000000-0x00007FFF: internal mask ROM

0x00008000-0x0000FFFF: loaded firmware (without version bytes)