release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Wiki > Main > SigmaTelScsi (compare)

Difference: SigmaTelScsi (r8 vs. r7)

Sigmatel Vendor SCSI Commands


Overview

This page documents the vendor specific SCSI commands used by Sigmatel in their SDK. This mostly applies to the STMP37xx/I.MX233 series but some of it can also apply to the STMP36xx series. The following devices are known to implement these commands:

VendorDeviceProtocol
Creative Zen X-Fi2 6.0
Creative Zen X-Fi3 6.0
Sandisk Sansa Fuze+ 6.1

Protocol Overview

The protocol works as follows. All commands are sent as vendor specific SCSI commands. The Command Data Block (CDB) usually consists of 10 bytes. The first byte is always 0xC0 for read commands are 0xC1 for write commands. The second byte is the actually command. The third byte is usually a tag or a type or an ID. The following commands are known to exist:

CommandTypeValue
GET PROTOCOL VERSION Read 00
GET LOGICAL MEDIA INFO Read 02
GET LOGICAL TABLE Read 05
ALLOCATE LOGICAL MEDIA Write 06
ERASE LOGICAL MEDIA Write 07
GET LOGICAL DRIVER INFO Read 12
READ LOGICAL DRIVE SECTOR Read 13
SET LOGICAL DRIVE INFO Write 20
WRITE LOGICAL DRIVE SECTOR Write 23
ERASE LOGICAL DRIVE Write 2F
GET CHIP MAJOR REV ID Read 30
CHIP RESET Write 31
GET CHIP SERIAL NUMBER Read 32
GET ROM REV ID Read 37
GET JANUS STATUS Read 40
INITIALIZE JANUS Write 41
RESET TO RECOVERY Write 42
INITIALIZE DATA STORE Write 43
RESET TO UPDATER Write 44
GET DEVICE INFO Read 45

Get Protocol Version

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 00 Command
2 14 00 Padding
Response
Offset Length Value Comment
0 1 xx Major version
1 1 yy Minor version

Note: we don't really know what is minor and the major version and we don't know if it's really useful.

Get Logical Media Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 02 Command
2 1 xx Info
3 13 00 Padding

The response depends on the information requested. The following information are known:

InformationValue
unknown 0
unknown 1
unknwon 5
Media Type 6
unknown 7
unknown 8
unknown 9
unknown 11
Media Vendor 12
unknown 13
unknown 14

Media Info 0

Response
Offset Length Value Comment
0 2 xxxx unknown (big-endian)

Media Info 1

Response
Offset Length Value Comment
0 8 xxxx unknown (big-endian)

Media Info 5

Response
Offset Length Value Comment
0 1 xx unknown

Media Type

Response
Offset Length Value Comment
0 4 xxxx type (big-endian)

The following types are known

TypeValue
NAND 0
SD/MMC 1
HDD 2
RAM 3
iNAND 4

Media Info 7

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

Media Info 8

Response
Offset Length Value Comment
0 52 xxxx unknown

Media Info 9

Response
Offset Length Value Comment
0 1 xx unknown

Media Info 11

Response
Offset Length Value Comment
0 4 xx unknown (big-endian)

Media Vendor

Response
Offset Length Value Comment
0 4 xx vendor (big-endian)

The following vendors are known:

VendorValue
Renesas 07
ST Micro 20
Micron 2C
Sandisk 45
Intel 89
Toshiba 98
Hynix AD
Samsung EC

Media Info 13

Response
Offset Length Value Comment
0 8 xx unknown (big-endian)

Media Info 14

Response
Offset Length Value Comment
0 4 xx unknown (big-endian)

Get Logical Table

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 05 Command
2 1 xx Entry Count
3 13 00 Padding

The response size is the table header plus the entry count multiplied by the size of one entry (11 bytes)

Response
Offset Length Value Comment
0 2 xxxx entry count (big-endian)
2 11 xxxx first entry
13 11 xxxx second entry
2 + 11*n 11 xxxx nth entry

An entry has the following layout:

Logical Media Entry
Offset Length Value Comment
0 1 xx drive number
1 1 xx type
2 1 xx tag
3 8 xx size (big-endian)

Allocate Logical Media

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 06 Command
2 1 xx Entry Count
3 13 00 Padding

The data command size is the entry count multiplied by the size of an entry (11 bytes).

Data
Offset Length Value Comment
0 11 xxxx first entry
11 11 xxxx second entry
11*n 11 xxxx nth entry

The entry layout is the same as for Get Logical Media Entry.

Erase Logical Media

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 07 Command
2 1 xx Drive
3 13 00 Padding

Get Logical Drive Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 12 Command
2 1 xx Info
3 1 xx Extra Info
4 12 00 Padding

The response depends on the information requested. The following information are known:

InformationValue
Sector Size 0
unknown 1
Total Size 2
unknown 3
Sector Count 4
Drive Type 5
unknown 6
unknown 7
unknown 8
unknown 9
unknown 10
unknown 11

Sector Size

Response
Offset Length Value Comment
0 4 xxxx sector size (big-endian)

Drive Info 1

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

Total Size

Response
Offset Length Value Comment
0 8 xxxx total size (big-endian)

Drive Info 3

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

Sector Count

Response
Offset Length Value Comment
0 8 xxxx sector count (big-endian)

Drive Type

Response
Offset Length Value Comment
0 4 xxxx drive type (big-endian)

The following types are known.

TypeValue
User ? 0
System 1
DRM/Janus ? 2

Drive Info 6

Response
Offset Length Value Comment
0 1 xx unknown

Drive Info 7

Response
Offset Length Value Comment
0 52 xxxx unknown

Drive Info 8

Response
Offset Length Value Comment
0 52 xxxx unknown

Drive Info 9

Response
Offset Length Value Comment
0 1 xx unknown

Drive Info 10

Response
Offset Length Value Comment
0 2 xxxx unknown (big-endian)

Drive Info 11

Response
Offset Length Value Comment
0 yyyy xxxx unknown

Read Logical Drive Sector

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 13 Command
2 1 xx Drive
3 8 xxxx Address
11 4 xxxx Count
15 1 00 Padding

The data command size is the sector count multiplied by the sector size.

Write Logical Drive Sector

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 23 Command
2 1 xx Drive
3 8 xxxx Address
11 4 xxxx Count
15 1 00 Padding

The data command size is the sector count multiplied by the sector size.

Erase Logical Drive

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 2f Command
2 1 xx Drive
3 13 00 Padding

Get Chip Major Revision ID

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 30 Command
2 14 00 Padding
Response
Offset Length Value Comment
0 2 xxxx Revision (big-endian)

Get ROM Chip Reset Revision ID

CDB
Offset Length Value Comment
0 1 C0 C1 Read Write
1 1 37 31 Command
2 14 00 Padding

Get Chip Serial Number

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 32 Command
2 1 xx Type
3 13 00 Padding

The following types are known:

TypeValue
Size 0
Serial Number 1

Serial Number Size

Response
Offset Length Value Comment
0 2 xxxx Serial number size (big-endian)

Serial Number

Response
Offset Length Value Comment
0 yyyy xxxx Serial number

Get Chip Major Revision ID

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 30 Command
2 14 00 Padding
Response
Offset Length Value Comment
0 2 xxxx Revision (big-endian)

Reset To Recovery

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 42 Command
2 14 00 Padding

Reset To Updater

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 44 Command
2 4 xxxx Type (big-endian)
6 10 00 Padding

The exact meaning of the type is unknwon and 0 seems to be always used.

Get Device Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 45 Command
2 1 xx Info
3 3 00 Padding

The following device information are known.

InformationValue
unknown 0
unknown 1

Device Info 0

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

Device Info 1

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

-- AmauryPouly - 11 Dec 2012

r12 - 12 Dec 2013 - 12:52:21 - AmauryPouly

Revision r8 - 03 Jul 2013 - 11:53 - AmauryPouly
Revision r7 - 03 Jul 2013 - 09:41 - AmauryPouly
Copyright by the contributing authors.