Samsung HM641JI

[MasterT]

At power on drive does not spin.

Terminal output is:

Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Nothing else. Any ideea what it could be?

[fzabkar]

Power Up In Standby (PUIS)?

[MasterT]

How can i tell if it's PUIS or not? If it's PUIS how do i overcome / disable?

I've tried with donor pcb and it goes like this:

Pacient drive - pacient pcb - pacient rom

No spin up, Terminal --> Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Pacient drive - donor pcb - pacient rom

No spin up, Terminal --> Apple Macpro RAID connect phy calibration PLL locked! ChipRev = 63B0

Pacient drive - pacient pcb - donor rom -->

Drive spins up, Terminal -->

ChipRev = 63B0
*PA VID=0007 PN=0000 Rev=0004
*PA VID=0007 PN=0000 Rev=0004
U
S_0Shock Sensor Circuit Enabled
SO_1
Shock Sensor Circuit Enabled
IS=1
CLA #36/72
Handoff RPM=619
SPOK
mS1 00000003
A1O=127 A1G=443
O=513 S=3
***** No Gray
SoUL!
PK_3 C: 21760 H:0
A1O=127 A1G=444
O=514 S=3
SK C: 10078 H:1
Platform Invalid MC Head
Loaded FIT ( 0: 0: 1)
CalibTable Loaded. Rev:0x17
ResoTable Loaded. Rev:0x01
Bump Limit Loaded. Rev:0x00
RRO1xTable Loaded. Rev:0x01
Ovly loaded to 0x0001CD00
Ovly loaded to 0x1005B800
[DEBUG HALT @\ðå\ðå<ðå<ðå<ðå<ðå<ðå():100349D7 L0 0000FFFF]
EPOK
Cur_SP=04007410
FIQ_SP=04007410
IRQ_SP=04007410
SVC_SP=04007410

*** HALT ***

I also read rom chip in external reader. After 2 reads and compare i noticed at certain offset there are some diffrences.

Well i made another 10 reads and it looks like it that area some bits are constantly changing at each read.

I'm not sure if problem is related or not but i'll compare tomorrow with similar rom version, and maybe use diffrent rom chip to test.

[fzabkar]

You can enable/disable PUIS using HDAT2.

I have written a Samsung ROM analysis tool. I could check your ROM dumps for you.

Can you measure the voltage at the Tx/Rx pins? Are you using a 3.3V TTL adapter?

[MasterT]

Here are the rom chip dumps.

Voltage at the Tx/Rx pins is 2.47V. I use usb Terminal 3, i can jumper select 2.5v or 3.3v.

Attachments

Samsung HM641JI.rar

(174.55 KiB) Downloaded 726 times

[Mikippp]

Hi,
FIPS was bad
Try this...

Mikippp

Attachments

Read 01_FIPS.zip

(177.25 KiB) Downloaded 770 times

[MasterT]

Thanks Mikippp, it works like a charm. I'd like to know how to do it myself next time it occurs.

fzabkar, can you share your Samsung ROM analysis tool?

Acelab was confident that it's not FIPS related ...

Case succesfully solved.

[fzabkar]

fzabkar, can you share your Samsung ROM analysis tool?

http://www.users.on.net/~fzabkar/temp/samROMv3.exe
http://www.users.on.net/~fzabkar/temp/samROMv3.bas

[BGman]

Acelab was confident that it's not FIPS related ...

Case succesfully solved.

In the most cases it's not FIPS related - just a bad soldering of the FLASH chip.
A simple resoldering of it does the "miracle" ...

[MasterT]

In the most cases it's not FIPS related - just a bad soldering of the FLASH chip.
A simple resoldering of it does the "miracle" ...

It happened to me before. So i know this trick.

Maybe FIPS problem is not so common after all.

Actually it's the first time i had such a case.

[Jan]

Could You guys please verify my ROM? I can't run this rom tools

Attachments

20210417_102729_FLASH_25040.zip

(173 KiB) Downloaded 446 times

[Mikippp]

Hi,
Try this

Mikippp

Attachments

20210417_102729_FLASH_25040_FIPS.zip

(176.75 KiB) Downloaded 434 times

[fzabkar]

http://www.users.on.net/~fzabkar/FreeBasic_W32/Samsung/samROMv4.bas
http://www.users.on.net/~fzabkar/FreeBasic_W32/Samsung/samROMv4.exe

Code:

Verifying Samsung SpinPoint ROM:  C:\Samsung\Firmware\HM641JI\20210417_102729_FLASH_25040.bin

Checksum of Boot Block header = 0x0B  - OK
Checksum of Boot Block (Actual/Expected) = 0x2B / 0x2B  - OK

Searching for FIPS block (expected checksum = 0x0000) ...

Found FIPS text string at 0x0116E6
Checksum for 0x0400 byte FIPS block = 0xC53D  - BAD
Checksum for 0x0800 byte FIPS block = 0x0860  - BAD
Checksum for 0x0C00 byte FIPS block = 0x6E57  - BAD
Checksum for 0x1000 byte FIPS block = 0x3E49  - BAD

Found FIPS text string at 0x01E5B0
Checksum for 0x0400 byte FIPS block = 0x26FA  - BAD
Checksum for 0x0800 byte FIPS block = 0xE2EA  - BAD
Checksum for 0x0C00 byte FIPS block = 0xF040  - BAD
Checksum for 0x1000 byte FIPS block = 0xF3A8  - BAD

Found FIPS text string at 0x01F8B8
Checksum for 0x0400 byte FIPS block = 0xA5BD  - BAD
Checksum for 0x0800 byte FIPS block = 0x65DB  - BAD
Checksum for 0x0C00 byte FIPS block = 0x961C  - BAD
Checksum for 0x1000 byte FIPS block = 0xFA03  - BAD

Could not find a FIPS block with valid checksum

Searching for FLASHTBL ...

Found FLASHTBL text string at 0x000534
Parsing FLASHTBL at 0x000510 ...

ID Attr Byt3    Size   ROM address range   RAMaddrs  Cksm (Exp/Act)
-----------------------------------------------------------------
00  00   FF         0                             0            N/A
01  02   FF       320      510 - 82F       FFF00510  FA 7A   - BAD (Note 2)
02  08   FF      1650      830 - 1E7F      FFF00830  FF FF   - OK
03  00   FF     1C9A8     1E88 - 1E82F            0  AC AC   - OK
04  01   FF      3254    1E838 - 21A8B        1CD00  00 08   - BAD (Note 1)
05  00   FF      1060    1E840 - 1F89F      4000000  E4 E4   - OK
06  00   FF         0                       4005960            N/A
07  00   FF       22C    1F8B0 - 1FADB      4005A00  72 72   - OK
08  00   FF         0                       4006000            N/A
09  00   FF     1C840    1FAEC - 3C32B     1002D800  73 73   - OK
0A  01   FF     16998    3C334 - 52CCB     1005B800  00 A4   - BAD (Note 1)
0B  00   FF       610    3C33C - 3C94B     14000000  FF FF   - OK
0C  00   FF      1E94    3C954 - 3E7E7     1407C800  64 64   - OK
0D  00   FF         0                      1C000000            N/A
0E  00   FF         0                      1FFE0000            N/A
0F  00   FF      1740    3E800 - 3FF3F     FFF3E800  3C 3D   - BAD (Note 3)

Found FLASHTBL text string at 0x031B03
Inconsistent ID

Found FLASHTBL text string at 0x031B4F
Inconsistent ID


Searching for SERVOTBL ...

SERVOTBL text string not found

Size            - size of module in ROM expressed in bytes
ROM address     - absolute address range of module in ROM
RAMaddrs        - load point of module in RAM
Cksm (Exp/Act)  - Expected Checksum / Actual Checksum


Note 1:  The address range of affected module may conflict with another module,
          in which case this is probably a false negative.

Note 2:  If this module is the FLASHTBL or SERVOTBL, then this is most likely
          a false negative.

Note 3:  This may or may not be a genuinely BAD module. Examine the checksum
          of the first half of the ROM. If 0x0000, then module is probably OK,
          otherwise it may or may not be bad. Also examine the "adjusted"
          checksum, if applicable.

Note 4:  The address range of the module is outside the limits of the ROM.


FLASHTBL header contains no extents information


Calculating ROM checksums ...
Checksum for 0x000000 - 0x03FFFF = 0x0000
Checksum for 0x040000 - 0x07FFFF = 0x0802
Checksum for entire ROM = 0x0802