Sigmatel Vendor SCSI Commands

---

Overview

This page documents the vendor specific SCSI commands used by Sigmatel in their SDK. This mostly applies to the STMP37xx/I.MX233 series but some of it can also apply to the STMP36xx series. The following devices are known to implement these commands:

Vendor	Device	Protocol
Creative	Zen X-Fi2	6.0
Creative	Zen X-Fi3	6.0
Creative	Zen MX	6.0
Sandisk	Sansa Fuze+	6.1

Protocol Overview

The protocol works as follows. All commands are sent as vendor specific SCSI commands. The Command Data Block (CDB) usually consists of 16 bytes. The first byte is always 0xC0 for read commands are 0xC1 for write commands. The second byte is the actually command. The third byte is usually a tag or a type or an ID. The following commands are known to exist:

Command	Type	Value
GET PROTOCOL VERSION	Read	00
GET LOGICAL MEDIA INFO	Read	02
GET LOGICAL TABLE	Read	05
ALLOCATE LOGICAL MEDIA	Write	06
ERASE LOGICAL MEDIA	Write	07
GET LOGICAL DRIVER INFO	Read	12
READ LOGICAL DRIVE SECTOR	Read	13
SET LOGICAL DRIVE INFO	Write	20
WRITE LOGICAL DRIVE SECTOR	Write	23
ERASE LOGICAL DRIVE	Write	2F
GET CHIP MAJOR REV ID	Read	30
CHIP RESET	Write	31
GET CHIP SERIAL NUMBER	Read	32
GET ROM REV ID	Read	37
GET JANUS STATUS	Read	40
INITIALIZE JANUS	Write	41
RESET TO RECOVERY	Write	42
INITIALIZE DATA STORE	Write	43
RESET TO UPDATER	Write	44
GET DEVICE INFO	Read	45

Get Protocol Version

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	00	Command
2	14	00	Padding

Response
Offset	Length	Value	Comment
0	1	xx	Major version
1	1	yy	Minor version

Note: we don't really know what is minor and the major version and we don't know if it's really useful.

Get Logical Media Info

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	02	Command
2	1	xx	Info
3	13	00	Padding

The response depends on the information requested. The following information are known:

Information	Value
Number of Drives	0
Size	1
Allocation Unit Size	2
Is Initialised	3
State	4
Is Write Protected	5
Media Type	6
Serial Number Size	7
Serial Number	8
Is System Media	9
Is Media Present	10
unknown	11
Media Vendor	12
unknown	13
unknown	14

Number of Drives

Response
Offset	Length	Value	Comment
0	2	xxxx	number of drives (big-endian)

This field seem to be set to 0 on recent versions of the protocol.

Size

Response
Offset	Length	Value	Comment
0	8	xxxx	Size in bytes (big-endian)

Allocation Unit Size

Response
Offset	Length	Value	Comment
0	4	xxxx	Allocation unit size (big-endian)

This field seem to be set to 0 on recent versions of the protocol.

Is Intialised

Response
Offset	Length	Value	Comment
0	1	xxxx	Is Initialised

State

Response
Offset	Length	Value	Comment
0	1	xxxx	State

The following states are known:

State	Value
Unknown	0
Erased	1
Allocated	2

This field seem to be set to 0 on recent versions of the protocol.

Is Write Protected

Response
Offset	Length	Value	Comment
0	1	xx	Is write protected

Media Type

Response
Offset	Length	Value	Comment
0	4	xxxx	type (big-endian)

The following types are known

Type	Value
NAND	0
SD/MMC	1
HDD	2
RAM	3
iNAND	4

Serial Number Size

Response
Offset	Length	Value	Comment
0	4	xxxx	Serial number size (big-endian)

Serial Number

Response
Offset	Length	Value	Comment
0	?	xxxx	Serial number

Is System Media

Response
Offset	Length	Value	Comment
0	1	xx	Is system media

Is Media Present

Response
Offset	Length	Value	Comment
0	1	xx	Is media present

Media Info 11

Response
Offset	Length	Value	Comment
0	4	xx	unknown (big-endian)

Media Vendor

Response
Offset	Length	Value	Comment
0	4	xx	vendor (big-endian)

The following vendors are known:

Vendor	Value
Renesas	07
ST Micro	20
Micron	2C
Sandisk	45
Intel	89
Toshiba	98
Hynix	AD
Samsung	EC

Media Info 13

Response
Offset	Length	Value	Comment
0	8	xx	unknown (big-endian)

Media Info 14

Response
Offset	Length	Value	Comment
0	4	xx	unknown (big-endian)

Get Logical Table

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	05	Command
2	1	xx	Entry Count
3	13	00	Padding

The response size is the table header plus the entry count multiplied by the size of one entry (11 bytes)

Response
Offset	Length	Value	Comment
0	2	xxxx	entry count (big-endian)
2	11	xxxx	first entry
13	11	xxxx	second entry
2 + 11*n	11	xxxx	nth entry

An entry has the following layout:

Logical Media Entry
Offset	Length	Value	Comment
0	1	xx	drive number
1	1	xx	type
2	1	xx	tag
3	8	xx	size (big-endian)

Allocate Logical Media

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	06	Command
2	1	xx	Entry Count
3	13	00	Padding

The data command size is the entry count multiplied by the size of an entry (11 bytes).

Data
Offset	Length	Value	Comment
0	11	xxxx	first entry
11	11	xxxx	second entry
11*n	11	xxxx	nth entry

The entry layout is the same as for Get Logical Media Entry.

Erase Logical Media

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	07	Command
2	1	xx	Drive
3	13	00	Padding

Get Logical Drive Info

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	12	Command
2	1	xx	Info
3	1	xx	Extra Info
4	12	00	Padding

The response depends on the information requested. The following information are known:

Information	Value
Sector Size	0
Erase Size	1
Total Size (bytes)	2
Total Size (MB)	3
Sector Count	4
Drive Type	5
Drive Tag	6
Component Version	7
Project Version	8
Is Write Protected	9
Serial Number Size	10
Serial Number	11
Media Present	12
Media Change	13
Sector Allocation	14

Sector Size

Response
Offset	Length	Value	Comment
0	4	xxxx	Sector size (big-endian)

Erase Size

Response
Offset	Length	Value	Comment
0	4	xxxx	Erase size (big-endian)

Total Size

Response
Offset	Length	Value	Comment
0	8	xxxx	Total size (big-endian)

Total Size (MB)

Response
Offset	Length	Value	Comment
0	4	xxxx	Total size in MB (big-endian)

Seems to 0 all the time.

Sector Count

Response
Offset	Length	Value	Comment
0	8	xxxx	Sector count (big-endian)

Drive Type

Response
Offset	Length	Value	Comment
0	4	xxxx	Drive type (big-endian)

The following types are known.

Type	Value
Data	0
System	1
Hidden	2
Unknown	3

Drive Tag

Response
Offset	Length	Value	Comment
0	1	xx	Drive tag

This field seem to be set to 0 on recent versions of the protocol.

The following tags are known:

Type	Value
System	0
Hostlink	1
Resource	2
Extra	3
Resource1	4
OTG	5
Host Resource	6
Data	10
Hidden	11
?	12
Boot	0x50
Updater	0xff

Component Version

Response
Offset	Length	Value	Comment
0	52	xxxx	Component version

Recent version of the protocol always return 6 bytes and seem to be formatted this way:

Offset	Length	Value	Comment
0	2	xxxx	Major Version (big-endian)
2	2	xxxx	Minor Version (big-endian)
4	2	xxxx	Revision (big-endian)

Project Version

Response
Offset	Length	Value	Comment
0	52	xxxx	Project version

Recent version of the protocol always return 6 bytes and seem to be formatted this way:

Offset	Length	Value	Comment
0	2	xxxx	Major Version (big-endian)
2	2	xxxx	Minor Version (big-endian)
4	2	xxxx	Revision (big-endian)

Is Write Protected

Response
Offset	Length	Value	Comment
0	1	xx	Is write protected

Serial Number Size

Response
Offset	Length	Value	Comment
0	2	xxxx	Serial number size (big-endian)

Serial Number

Response
Offset	Length	Value	Comment
0	yyyy	xxxx	Serial number

Media Present

Response
Offset	Length	Value	Comment
0	1	xxxx	Is media present

This property has never been observed on any drive currently and is always reported as illegal.

Media Change

Response
Offset	Length	Value	Comment
0	1	xxxx	Media change

This property has never been observed on any drive currently and is always reported as illegal.

Sector Allocation

Response
Offset	Length	Value	Comment
0	4	xxxx	Sector allocation (big-endian)

This property has never been observed on any drive currently and is always reported as illegal.

Read Logical Drive Sector

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	13	Command
2	1	xx	Drive
3	8	xxxx	Address
11	4	xxxx	Count
15	1	00	Padding

The data command size is the sector count multiplied by the sector size.

Write Logical Drive Sector

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	23	Command
2	1	xx	Drive
3	8	xxxx	Address
11	4	xxxx	Count
15	1	00	Padding

The data command size is the sector count multiplied by the sector size.

Erase Logical Drive

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	2f	Command
2	1	xx	Drive
3	13	00	Padding

Get Chip Major Revision ID

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	30	Command
2	14	00	Padding

Response
Offset	Length	Value	Comment
0	2	xxxx	Revision (big-endian)

Chip Reset

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	31	Command
2	14	00	Padding

Get Chip Serial Number

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	32	Command
2	1	xx	Type
3	13	00	Padding

The following types are known:

Type	Value
Size	0
Serial Number	1

Serial Number Size

Response
Offset	Length	Value	Comment
0	2	xxxx	Serial number size (big-endian)

Serial Number

Response
Offset	Length	Value	Comment
0	yyyy	xxxx	Serial number

Get Chip Major Revision ID

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	30	Command
2	14	00	Padding

Response
Offset	Length	Value	Comment
0	2	xxxx	Revision (big-endian)

Reset To Recovery

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	42	Command
2	14	00	Padding

Reset To Updater

CDB
Offset	Length	Value	Comment
0	1	C1	Write
1	1	44	Command
2	4	xxxx	Type (big-endian)
6	10	00	Padding

The exact meaning of the type is unknwon and 0 seems to be always used.

Get Device Info

CDB
Offset	Length	Value	Comment
0	1	C0	Read
1	1	45	Command
2	1	xx	Info
3	3	00	Padding

The following device information are known.

Information	Value
unknown	0
unknown	1

Device Info 0

Response
Offset	Length	Value	Comment
0	4	xxxx	unknown (big-endian)

Device Info 1

Response
Offset	Length	Value	Comment
0	4	xxxx	unknown (big-endian)

-- AmauryPouly - 11 Dec 2012