Ghidra Cypress FX2 processor definition

Ghidra processor definition for Cypress FX2, an 8051-based USB controller.

All register definitions were created to match the "EZ-USB FX2 Technical Reference Manual" document from Cypress.

Place cypress_fx2.pspec in Ghidra/Processors/8051/data/languages/

Place ApplyCypressFX2RegisterEnums.java in Ghidra/Processors/8051/ghidra_scripts/

Add the following language definition to Ghidra/Processors/8051/data/languages/8051.ldefs:

  <language processor="8051"
            endian="big"
            size="16"
            variant="fx2"
            version="2.0"
            slafile="8051.sla"
            processorspec="cypress_fx2.pspec"
            manualindexfile="../manuals/8051.idx"
            id="8051:BE:16:fx2">
    <description>Cypress FX2</description>
    <compiler name="default" spec="8051.cspec" id="default"/>
    <external_name tool="IDA-PRO" name="8051"/>
  </language>

Optional - Adding register enums

Adding register enums makes a major difference to the readability of code, since you get the names of all the bits.

Load CypressFX2.h using File -> Parse C Header. There are two ways of loading it:

• In the UI, save one of the existing prf profiles with a new name, delete all the files, clear the Parse Options, then add just the CypressFX2.h file.
• Go to %userprofile%/.ghidra/parserprofiles/ and create a file called CypressFX2.prf, then write the path into it. In the Parse C Header window, click "Refresh User Profiles", then use the one you created.

Either method should load the enum types into your program's data type manager.

Next, run the provided ApplyCypressFX2RegisterEnums.java script from the Script Manager. This will repack the enums to 1 byte (currently there's no way to specify enum sizes in .h imports, so they default to 4 bytes) and automatically apply all the types to the pre-defined register symbols.

Working with I2C dumps

Cypress FX2 doesn't directly copy the data from the EEPROM into RAM. Instead, the EEPROM contains some structure that describes the layout of the data. If you've dumped firmware from an I2C EEPROM, you can't just load it directly into Ghidra.

If you open your dump in a hex editor and find that the first byte is 0xC2, that's a C2 Load image. This is the most common - it configures custom VID/PID/DID values for the USB descriptor, and describes how to load blocks of EEPROM into RAM. You can use the c2_load_iic_to_mem.linq LinqPad script from this repository to transform the I2C dump into a memory image suitable for loading into Ghidra. The script should be compatible with LinqPad 6 for .NET Core (cross platform). If you don't want to use C# / LinqPad, you should be able to easily port it yourself just by reading the code.

If the first byte in your dump is 0xC0, this is a slightly different format. Search "Cypress FX2 C0 Load" online for more information. I don't have an example of a C0 Load image and the documentation was somewhat vague, so I didn't implement that here.

Current status

The following registers are covered:

Registers marked N/A do not contain any bits that can be usefully represented by an enum. These are usually registers that contain addresses or other values.

Registers marked "no" are on the todo list.