release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > SigmaTelScsi

Sigmatel Vendor SCSI Commands


Overview

This page documents the vendor specific SCSI commands used by Sigmatel in their SDK. This mostly applies to the STMP37xx/I.MX233 series but some of it can also apply to the STMP36xx series. The following devices are known to implement these commands:

Vendor Device Protocol
Creative Zen X-Fi2 6.0
Creative Zen X-Fi3 6.0
Creative Zen MX 6.0
Sandisk Sansa Fuze+ 6.1

Protocol Overview

The protocol works as follows. All commands are sent as vendor specific SCSI commands. The Command Data Block (CDB) usually consists of 16 bytes. The first byte is always 0xC0 for read commands are 0xC1 for write commands. The second byte is the actually command. The third byte is usually a tag or a type or an ID. The following commands are known to exist:

Command Type Value
GET PROTOCOL VERSION Read 00
GET LOGICAL MEDIA INFO Read 02
GET LOGICAL TABLE Read 05
ALLOCATE LOGICAL MEDIA Write 06
ERASE LOGICAL MEDIA Write 07
GET LOGICAL DRIVER INFO Read 12
READ LOGICAL DRIVE SECTOR Read 13
SET LOGICAL DRIVE INFO Write 20
WRITE LOGICAL DRIVE SECTOR Write 23
ERASE LOGICAL DRIVE Write 2F
GET CHIP MAJOR REV ID Read 30
CHIP RESET Write 31
GET CHIP SERIAL NUMBER Read 32
GET ROM REV ID Read 37
GET JANUS STATUS Read 40
INITIALIZE JANUS Write 41
RESET TO RECOVERY Write 42
INITIALIZE DATA STORE Write 43
RESET TO UPDATER Write 44
GET DEVICE INFO Read 45

Get Protocol Version

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 00 Command
2 14 00 Padding

Response
Offset Length Value Comment
0 1 xx Major version
1 1 yy Minor version

Note: we don't really know what is minor and the major version and we don't know if it's really useful.

Get Logical Media Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 02 Command
2 1 xx Info
3 13 00 Padding

The response depends on the information requested. The following information are known:

Information Value
Number of Drives 0
Size 1
Allocation Unit Size 2
Is Initialised 3
State 4
Is Write Protected 5
Media Type 6
Serial Number Size 7
Serial Number 8
Is System Media 9
Is Media Present 10
unknown 11
Media Vendor 12
unknown 13
unknown 14

Number of Drives

Response
Offset Length Value Comment
0 2 xxxx number of drives (big-endian)

This field seem to be set to 0 on recent versions of the protocol.

Size

Response
Offset Length Value Comment
0 8 xxxx Size in bytes (big-endian)

Allocation Unit Size

Response
Offset Length Value Comment
0 4 xxxx Allocation unit size (big-endian)

This field seem to be set to 0 on recent versions of the protocol.

Is Intialised

Response
Offset Length Value Comment
0 1 xxxx Is Initialised

State

Response
Offset Length Value Comment
0 1 xxxx State

The following states are known:

State Value
Unknown 0
Erased 1
Allocated 2

This field seem to be set to 0 on recent versions of the protocol.

Is Write Protected

Response
Offset Length Value Comment
0 1 xx Is write protected

Media Type

Response
Offset Length Value Comment
0 4 xxxx type (big-endian)

The following types are known

Type Value
NAND 0
SD/MMC 1
HDD 2
RAM 3
iNAND 4

Serial Number Size

Response
Offset Length Value Comment
0 4 xxxx Serial number size (big-endian)

Serial Number

Response
Offset Length Value Comment
0 ? xxxx Serial number

Is System Media

Response
Offset Length Value Comment
0 1 xx Is system media

Is Media Present

Response
Offset Length Value Comment
0 1 xx Is media present

Media Info 11

Response
Offset Length Value Comment
0 4 xx unknown (big-endian)

Media Vendor

Response
Offset Length Value Comment
0 4 xx vendor (big-endian)

The following vendors are known:

Vendor Value
Renesas 07
ST Micro 20
Micron 2C
Sandisk 45
Intel 89
Toshiba 98
Hynix AD
Samsung EC

Media Info 13

Response
Offset Length Value Comment
0 8 xx unknown (big-endian)

Media Info 14

Response
Offset Length Value Comment
0 4 xx unknown (big-endian)

Get Logical Table

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 05 Command
2 1 xx Entry Count
3 13 00 Padding

The response size is the table header plus the entry count multiplied by the size of one entry (11 bytes)

Response
Offset Length Value Comment
0 2 xxxx entry count (big-endian)
2 11 xxxx first entry
13 11 xxxx second entry
2 + 11*n 11 xxxx nth entry

An entry has the following layout:

Logical Media Entry
Offset Length Value Comment
0 1 xx drive number
1 1 xx type
2 1 xx tag
3 8 xx size (big-endian)

Allocate Logical Media

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 06 Command
2 1 xx Entry Count
3 13 00 Padding

The data command size is the entry count multiplied by the size of an entry (11 bytes).

Data
Offset Length Value Comment
0 11 xxxx first entry
11 11 xxxx second entry
11*n 11 xxxx nth entry

The entry layout is the same as for Get Logical Media Entry.

Erase Logical Media

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 07 Command
2 1 xx Drive
3 13 00 Padding

Get Logical Drive Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 12 Command
2 1 xx Info
3 1 xx Extra Info
4 12 00 Padding

The response depends on the information requested. The following information are known:

Information Value
Sector Size 0
Erase Size 1
Total Size (bytes) 2
Total Size (MB) 3
Sector Count 4
Drive Type 5
Drive Tag 6
Component Version 7
Project Version 8
Is Write Protected 9
Serial Number Size 10
Serial Number 11
Media Present 12
Media Change 13
Sector Allocation 14

Sector Size

Response
Offset Length Value Comment
0 4 xxxx Sector size (big-endian)

Erase Size

Response
Offset Length Value Comment
0 4 xxxx Erase size (big-endian)

Total Size

Response
Offset Length Value Comment
0 8 xxxx Total size (big-endian)

Total Size (MB)

Response
Offset Length Value Comment
0 4 xxxx Total size in MB (big-endian)

Seems to 0 all the time.

Sector Count

Response
Offset Length Value Comment
0 8 xxxx Sector count (big-endian)

Drive Type

Response
Offset Length Value Comment
0 4 xxxx Drive type (big-endian)

The following types are known.

Type Value
Data 0
System 1
Hidden 2
Unknown 3

Drive Tag

Response
Offset Length Value Comment
0 1 xx Drive tag

This field seem to be set to 0 on recent versions of the protocol.

The following tags are known:

Type Value
System 0
Hostlink 1
Resource 2
Extra 3
Resource1 4
OTG 5
Host Resource 6
Data 10
Hidden 11
? 12
Boot 0x50
Updater 0xff

Component Version

Response
Offset Length Value Comment
0 52 xxxx Component version

Recent version of the protocol always return 6 bytes and seem to be formatted this way:

Offset Length Value Comment
0 2 xxxx Major Version (big-endian)
2 2 xxxx Minor Version (big-endian)
4 2 xxxx Revision (big-endian)

Project Version

Response
Offset Length Value Comment
0 52 xxxx Project version

Recent version of the protocol always return 6 bytes and seem to be formatted this way:

Offset Length Value Comment
0 2 xxxx Major Version (big-endian)
2 2 xxxx Minor Version (big-endian)
4 2 xxxx Revision (big-endian)

Is Write Protected

Response
Offset Length Value Comment
0 1 xx Is write protected

Serial Number Size

Response
Offset Length Value Comment
0 2 xxxx Serial number size (big-endian)

Serial Number

Response
Offset Length Value Comment
0 yyyy xxxx Serial number

Media Present

Response
Offset Length Value Comment
0 1 xxxx Is media present

This property has never been observed on any drive currently and is always reported as illegal.

Media Change

Response
Offset Length Value Comment
0 1 xxxx Media change

This property has never been observed on any drive currently and is always reported as illegal.

Sector Allocation

Response
Offset Length Value Comment
0 4 xxxx Sector allocation (big-endian)

This property has never been observed on any drive currently and is always reported as illegal.

Read Logical Drive Sector

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 13 Command
2 1 xx Drive
3 8 xxxx Address
11 4 xxxx Count
15 1 00 Padding

The data command size is the sector count multiplied by the sector size.

Write Logical Drive Sector

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 23 Command
2 1 xx Drive
3 8 xxxx Address
11 4 xxxx Count
15 1 00 Padding

The data command size is the sector count multiplied by the sector size.

Erase Logical Drive

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 2f Command
2 1 xx Drive
3 13 00 Padding

Get Chip Major Revision ID

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 30 Command
2 14 00 Padding

Response
Offset Length Value Comment
0 2 xxxx Revision (big-endian)

Chip Reset

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 31 Command
2 14 00 Padding

Get Chip Serial Number

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 32 Command
2 1 xx Type
3 13 00 Padding

The following types are known:

Type Value
Size 0
Serial Number 1

Serial Number Size

Response
Offset Length Value Comment
0 2 xxxx Serial number size (big-endian)

Serial Number

Response
Offset Length Value Comment
0 yyyy xxxx Serial number

Get Chip Major Revision ID

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 30 Command
2 14 00 Padding

Response
Offset Length Value Comment
0 2 xxxx Revision (big-endian)

Reset To Recovery

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 42 Command
2 14 00 Padding

Reset To Updater

CDB
Offset Length Value Comment
0 1 C1 Write
1 1 44 Command
2 4 xxxx Type (big-endian)
6 10 00 Padding

The exact meaning of the type is unknwon and 0 seems to be always used.

Get Device Info

CDB
Offset Length Value Comment
0 1 C0 Read
1 1 45 Command
2 1 xx Info
3 3 00 Padding

The following device information are known.

Information Value
unknown 0
unknown 1

Device Info 0

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

Device Info 1

Response
Offset Length Value Comment
0 4 xxxx unknown (big-endian)

-- AmauryPouly - 11 Dec 2012

r13 - 02 Apr 2021 - 20:46:07 - UnknownUser

Copyright © by the contributing authors.