Clone wiki

phison / ScsiCommands

Vendor-specific SCSI commands

Both BootROM, firmwares and RAM loaders use opcodes (CBWCB[0]) 06, C6, C7 to implement the same set of vendor-specific commands. CBWCB[1] defines vendor command, other bytes define command-specific parameters. Opcodes C6 and C7 limit vendor command to 00-1F, while opcode 06 has no restriction.

Commands

All CBWCBs are 16 byte long. If CBWCB in description is shorter, this means rest is filled with 00s.

READ MEMORY

Read 512 bytes of XDATA at given address

CBWCB: 06 05 'R' 'A' addr_h addr_l
DATA IN: xdata_at_addr[512], junk[16]

WRITE MEMORY

Write 1 byte to a given XDATA address

CBWCB: 06 0C 00 'P' 'h' 'I' addr_h addr_l data

GO PRAM

Jump to PRAM code.

CBWCB: 06 B3

GO PROM

Jump to BootROM

CBWCB: 06 BF

GET STATUS

Get load status

CBWCB: 06 B0 00 00 08
DATA IN: status[8]

Status[0] must be 55 for header load, A5 for body load.

LOAD HEADER

Load code header

CBWCB: 06 B1 03 00 00 00 00 00 01
DATA OUT: data[512]

LOAD BODY

Load code body at address = page*512

CBWCB: 06 B1 02 page_h page_l 00 00 count_h count_l
DATA OUT: data[count*512]

Updated