Markus Schmidl
Research Assistant and Student at Technische Universität Dresden
View My GitHub Profile
View My LinkedIn Profile
Notes on the AMD 17h processor SMU
- Cadence Xtensa IP core (probably LX3 or LX6)
- Xtensa ISA Manual
- Firmware can be extracted from BIOS-Image with PSPTool
- Ghidra support for Xtensa is missing some required instructions, i.e.
loop,loopgtzandloopnez. - Radare works flawlessly
- binutils (xtensa-objdump etc.) for xtensa target on nixos:
nix-shell -p '(binutils-unwrapped.overrideAttrs(old: { configureFlags = old.configureFlags ++ [ "--target=xtensa-elf" "--program-prefix=xtensa-" ]; doInstallCheck = false; configurePlatforms = [ ]; }))'
Firmware Function
- Implements the Host System Management Port (HSMP) Interface
Firmware Image Format
| Offset | Length | Description |
|---|---|---|
| 0x00 | 0x100 ? | Header ? |
| 0x00 | 0x10 | Bytes SMURULESSMURULES (But only in newer firmware versions) |
| 0x14 | 0x04 | Length of Firmware (00h ffh 03h 00h = 0x3ff00) ? |
| 0x60 | 0x04 | Version in little endian (e.g. 4.19.5A.0 is 00h 5Ah 19h 04h) |
| 0x100 | Value from 0x14 ? | Start of Firmware ? |
| 0x3FFFC | 0x04 | SMU_OFFCHIP_FW~0x8: 00h 00h 00h 00h, SMU_OFF_CHIP_FW_2~0x12: 44h 33h 22h 11h ? |