HydraFW binary NAND Flash mode guide

HydraFW binary NAND mode guide

This guide is updated towards firmware release HydraFW v0.9 Beta and later

This mode allows to control NAND Flash

• NAND Flash pins: CE=PB4, RB=PB0, WE=PB1, RE=PB5, AL=PB2, CL=PB3, D0-D7 are mapped to PC0-PC7

For more details see https://github.com/hydrabus/hydrafw/wiki/HydraFW-NAND-Flash-guide

Commands

Once the NAND mode has been selected, the following commands are available :

• 0b00000000 Return to main mode. Returns BBIO1
• 0b00000001 Mode identification. Returns FLA1
• 0b00000010 Puts the CE pin low. Returns 0x01
• 0b00000011 Puts the CE pin high. Returns 0x01
• 0b00000100 Write-then-read (see below)
• 0b00000110 Write command
• 0b00000111 Read byte
• 0b00001000 Wait for RB#
• 0b0001xxxx Write address

Command details

Write-then-read operation (0b00000100 - 0b00000101)

This command is used to send at most 4096 bytes and will read at most 4096 bytes of data. Format :

Byte 1           2          3          4          5         6        ...
|----------|----------|----------|----------|----------|----------|------...
 [command]    [Bytes to write]      [Bytes to read]       [Data to write

The bytes to read/write are in big-endian format. All data will be buffered before being sent to the Flash bus. Read data will also be buffered on the Hydrabus before being sent back to the user.

Write command (0b00000110)

This command will read the next byte, then send it to the flash with the CL line high. Hydrabus will send a 0x01 (acknowledge) once the operation is done.

Write address (0b0001xxxx)

In this mode, the last 4 bits of the command define the number of bytes to write (from 1 to 16) (Command 0b00010000 will send 1 byte). The same number of bytes will be read and sent to the flash with the AL line high. Hydrabus will send a 0x01 (acknowledge) once the operation is done.

Read byte (0b00000111)

This command will read a byte from the flash, send a 0x01 (acknowledge), then the read byte.

Wait for RB# (0b00001000)

This command will wait until thr RB# line is high, then send a 0x01 (acknowledge).

Usage with DumpFlash

We forked DumpFlash to make it work with Hydrabus Flash binary mode. Here are a few examples to make it work.

Read chip information

$ python2 DumpFlash.py -d /dev/hydrabus -i                                                                                                                                                  [master]
Into BBIO mode
Switching to flash mode
Setting chip enable
Full ID:	AD73AD73AD73
ID Length:	6
Name:		NAND 16MiB 3,3V 8-bit
ID:		0x73
Page size:	0x200
OOB size:	0x10
Page count:	0x8000
Size:		0x10
Erase size:	0x4000
Block count:	1024
Options:	0
Address cycle:	3
Bits per Cell:	4
Manufacturer:	Hynix

Read sequential data

$ python2 DumpFlash.py -d /dev/hydrabus -r /tmp/dump-bin -s                                                                                                                                 [master]
Into BBIO mode
Switching to flash mode
Setting chip enable
Full ID:	AD73AD73AD73
ID Length:	6
Name:		NAND 16MiB 3,3V 8-bit
ID:		0x73
Page size:	0x200
OOB size:	0x10
Page count:	0x8000
Size:		0x10
Erase size:	0x4000
Block count:	1024
Options:	0
Address cycle:	3
Bits per Cell:	4
Manufacturer:	Hynix

* ReadPages: -1 ~ -1
Reading 0% Page: 0/32768 Block: 0/1024 Speed: 156710 bytes/s
Reading 0% Page: 32/32768 Block: 1/1024 Speed: 156998 bytes/s
Reading 0% Page: 64/32768 Block: 2/1024 Speed: 156800 bytes/s
[...]