Vendor-specific SCSI commands
Both BootROM, firmwares and RAM loaders use opcodes (CBWCB) 06, C6, C7 to implement the same set of vendor-specific commands. CBWCB defines vendor command, other bytes define command-specific parameters. Opcodes C6 and C7 limit vendor command to 00-1F, while opcode 06 has no restriction.
All CBWCBs are 16 byte long. If CBWCB in description is shorter, this means rest is filled with 00s.
Read 512 bytes of XDATA at given address
CBWCB: 06 05 'R' 'A' addr_h addr_l
DATA IN: xdata_at_addr, junk
Write 1 byte to a given XDATA address
CBWCB: 06 0C 00 'P' 'h' 'I' addr_h addr_l data
Jump to PRAM code.
CBWCB: 06 B3
Jump to BootROM
CBWCB: 06 BF
Get load status
CBWCB: 06 B0 00 00 08
DATA IN: status
Status must be 55 for header load, A5 for body load.
Load code header
CBWCB: 06 B1 03 00 00 00 00 00 01
DATA OUT: data
Load code body at address = page*512
CBWCB: 06 B1 02 page_h page_l 00 00 count_h count_l
DATA OUT: data[count*512]