Rockchip SoCs include a powerful USB-based recovery boot mechanism called MaskROM mode, which activates when the bootROM fails to load a second-stage bootloader. In this mode, the SoC exposes a USB device using Rockchip's vendor ID and accepts two vendor control requests (0x471 and 0x472) to load DRAM initialization code and a usbplug binary into RAM. The usbplug binary then implements the rockUSB protocol, enabling commands like reading chip info or writing to boot media. A step-by-step guide covers building the loader from Rockchip's rkbin repository, compiling rkdeveloptool, and issuing rockUSB commands. The post also covers how snagboot leverages this mechanism to support recovery on Rockchip devices by loading U-Boot TPL/SPL over USB, enabling device recovery even when all storage boot locations are corrupted.
