1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
RK Protocol
request
=======
[00] 55 53 42 43 U S B C
[04] 01 02 03 04 random value, echoed by device in response
[08] 00 00 00 00 reserved
[12] 80 flag
[13] 00 reserved
[14] 06 foo
[15] 01 command
[16] 00 bar
[17] 01 02 03 04 address, in sectors, big endian
[21] 00
[22] 01 02 number of sectors (512 bytes/sector), big endian
or number of bytes (e.g. ReadSDRAM)
[24] 00 00 used during ExecuteSDRAM
[26] 00 reserved
[27] 00 00 00 00 reserved
31 bytes
notes:
[17-20] and [22-25] seem to form a full 64-bit address to jump to
[16-19] four fuses during WriteEfuse
[20-23] zero or next four fuses
response
========
[00] 55 53 42 53 U S B S
[04] 01 02 03 04 random
[08] 00 00 00 unknown
[11] 06 unknown, sometimes 6, sometimes 0
[12] 01 error_flag, 0 = OK, 1 = ERROR
13 bytes
notes:
[08-11] are two 16-bit big endian words with an error code if error_flag == 1
12 14 15
flag foo cmd
-------+-------+-------
0x80 0x06 0x00 TestUnitReady 0
0x80 0x06 0x01 ReadFlashID 5 bytes
0x80 0x06 0x1a ReadFlashInfo 11|512 bytes
0x80 0x06 0x1b ReadChipInfo 16 bytes
0x80 0x06 0x20 ReadEfuse 8 bytes
0x00 0x06 0x02 SetDeviceInfo 0
0x00 0x06 0x16 EraseSystemDisk 0
0x00 0x06 0x1e SetResetFlag 0
0x00 0x06 0xff ResetDevice 0
0x80 0x0a 0x03 TestBadBlock 64 bytes
0x80 0x0a 0x04 ReadSector 512|528 bytes
0x80 0x0a 0x14 ReadLBA n*512 bytes
0x80 0x0a 0x17 ReadSDRAM n bytes
0x80 0x0a 0x21
0x00 0x0a 0x05 WriteSector 512|528 bytes
0x00 0x0a 0x06 EraseSectors 0
0x00 0x0a 0x0b
0x00 0x0a 0x15 WriteLBA n*512 bytes
0x00 0x0a 0x18 WriteSDRAM n bytes
0x00 0x0a 0x19 ExecuteSDRAM 0
0x00 0x0a 0x1f WriteEfuse 0 (fuses are in command pkt)
0x00 0x0a 0x22
0x80 0x10 0x07 WriteSpare n bytes
0x80 0x10 0x08 ReadSpare n bytes
0x00 0x00 0x1c LowerFormat 0
0x00 0x00 0x30 write 16k to device 16k bytes, resp is 18 bytes
11|512 bytes of FlashInfo [0-511]
---------------------------------
[0-3] = Number of sectors
[4-5] = Page size
[6] =
[7-8] =
[9] = 00 - Samsung
01 - Toshiba
02 - Hynix
03 - Infineon
04 - Renesas
05 - ST
06 - Intel
[10] =
|
