Micron P400m - 520 byte to 512 byte - firmware lock?

[TheGiolly]

Hi, I have a Micron RealSSD P400m (MTFDDAK400MAN-2S1AA) that is factory formatted with 520 byte sectors.
(there is also a more "popular" model, the MTFDDAK400MAN-1S1AA, that is factory formatted with 512 byte sectors).
I tried formatting it to 512 byte sectors with sg_format (i noticed that it reports block size of 512 byte but I don't know why) and setblocksize with no luck (log below).
For this I used the internal SATA controller of my motherboard (MSI Z87-G43), is this a problem?
Is it possibile that the SSD is firmware locked to 520 byte?
I also dumped the content of the SPI flash memory (M25P80) that is present on the PCB that I think contains the firmware.

hdparm report:

Code:

ubuntu@ubuntu:~$ sudo hdparm -I /dev/sda

/dev/sda:

ATA device, with non-removable media
   Model Number:       P400m400-MTFDDAK400MAN         118032958
   Serial Number:      ############       
   Firmware Revision:  0222   
   Transport:          Serial, ATA8-AST, SATA 1.0a, SATA II Extensions, SATA Rev 2.5, SATA Rev 2.6, SATA Rev 3.0
Standards:
   Used: unknown (minor revision code 0x0110)
   Supported: 9 8 7 6 5
   Likely used: 9
Configuration:
   Logical      max   current
   cylinders   16383   16383
   heads      16   16
   sectors/track   63   63
   --
   CHS current addressable sectors:    16514064
   LBA    user addressable sectors:   268435455
   LBA48  user addressable sectors:   769230720
   Logical  Sector size:                   520 bytes
   Physical Sector size:                   520 bytes
   Logical Sector-0 offset:                  0 bytes
   device size with M = 1024*1024:      375600 MBytes
   device size with M = 1000*1000:      393846 MBytes (393 GB)
   cache/buffer size  = unknown
   Form Factor: 2.5 inch
   Nominal Media Rotation Rate: Solid State Device
Capabilities:
   LBA, IORDY(can be disabled)
   Queue depth: 32
   Standby timer values: spec'd by Standard, with device specific minimum
   R/W multiple sector transfer: Max = 8   Current = 8
   Advanced power management level: 254
   DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 udma5 *udma6
        Cycle time: min=120ns recommended=120ns
   PIO: pio0 pio1 pio2 pio3 pio4
        Cycle time: no flow control=120ns  IORDY flow control=120ns
Commands/features:
   Enabled   Supported:
      *   SMART feature set
          Security Mode feature set
      *   Power Management feature set
          Write cache
      *   Look-ahead
      *   Host Protected Area feature set
      *   WRITE_BUFFER command
      *   READ_BUFFER command
      *   NOP cmd
      *   DOWNLOAD_MICROCODE
      *   Advanced Power Management feature set
          SET_MAX security extension
      *   48-bit Address feature set
      *   Device Configuration Overlay feature set
      *   Mandatory FLUSH_CACHE
      *   FLUSH_CACHE_EXT
      *   SMART error logging
      *   SMART self-test
      *   General Purpose Logging feature set
      *   WRITE_{DMA|MULTIPLE}_FUA_EXT
      *   64-bit World wide name
      *   IDLE_IMMEDIATE with UNLOAD
      *   WRITE_UNCORRECTABLE_EXT command
      *   {READ,WRITE}_DMA_EXT_GPL commands
      *   Segmented DOWNLOAD_MICROCODE
      *   unknown 119[6]
      *   Gen1 signaling speed (1.5Gb/s)
      *   Gen2 signaling speed (3.0Gb/s)
      *   Gen3 signaling speed (6.0Gb/s)
      *   Native Command Queueing (NCQ)
      *   Host-initiated interface power management
      *   Phy event counters
      *   NCQ priority information
      *   DMA Setup Auto-Activate optimization
          Device-initiated interface power management
      *   Software settings preservation
      *   SMART Command Transport (SCT) feature set
      *   SCT Error Recovery Control (AC3)
      *   SCT Features Control (AC4)
      *   SCT Data Tables (AC5)
      *   SANITIZE feature set
      *   OVERWRITE_EXT command
      *   BLOCK_ERASE_EXT command
      *   Data Set Management TRIM supported (limit 8 blocks)
      *   Deterministic read ZEROs after TRIM
Security:
   Master password revision code = 65534
      supported
   not   enabled
   not   locked
   not   frozen
   not   expired: security count
      supported: enhanced erase
   2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifier: ################
   NAA      : 5
   IEEE OUI   : 00a075
   Unique ID   : #########
Checksum: correct

sg_scan report:

Code:

ubuntu@ubuntu:~$ sudo sg_scan -i
/dev/sg0: scsi3 channel=0 id=0 lun=0 [em]
    ATA       P400m400-MTFDDAK  0222 [rmb=0 cmdq=1 pqual=0 pdev=0x0]
/dev/sg1: scsi7 channel=0 id=0 lun=0 [em]
    Philips   USB Flash Drive   0.00 [rmb=1 cmdq=0 pqual=0 pdev=0x0]
/dev/sg2: scsi6 channel=0 id=0 lun=0 [em]
    General   USB Flash Disk    1100 [rmb=1 cmdq=0 pqual=0 pdev=0x0]

sg_format log:

Code:

ubuntu@ubuntu:~$ sudo sg_format -F -s 512 -v /dev/sg0
    ATA       P400m400-MTFDDAK  0222   peripheral_type: disk [0x0]
      PROTECT=0
      Unit serial number: ############       
      LU name: ################
    mode sense (10) cdb: 5a 00 01 00 00 00 00 00 fc 00
Mode Sense (block descriptor) data, prior to changes:
  Number of blocks=0 [0x0]
  Block size=512 [0x200]

A FORMAT UNIT will commence in 15 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort

A FORMAT UNIT will commence in 10 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort

A FORMAT UNIT will commence in 5 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort
    format unit cdb: 04 18 00 00 00 00
format unit:
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid command operation code
Format unit command: Illegal request, invalid opcode sense key
FORMAT UNIT failed

sg_format (with -6 flag) log:

Code:

ubuntu@ubuntu:~$ sudo sg_format -F -s 512 -6 -v /dev/sg0
    ATA       P400m400-MTFDDAK  0222   peripheral_type: disk [0x0]
      PROTECT=0
      Unit serial number: ############
      LU name: ################
    mode sense (6) cdb: 1a 00 01 00 fc 00
Mode Sense (block descriptor) data, prior to changes:
  Number of blocks=0 [0x0]
  Block size=512 [0x200]

A FORMAT UNIT will commence in 15 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort

A FORMAT UNIT will commence in 10 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort

A FORMAT UNIT will commence in 5 seconds
    ALL data on /dev/sg0 will be DESTROYED
        Press control-C to abort
    format unit cdb: 04 18 00 00 00 00
format unit:
Fixed format, current; Sense key: Illegal Request
Additional sense: Invalid command operation code
Format unit command: Illegal request, invalid opcode sense key
FORMAT UNIT failed

setblocksize log:

Code:

ubuntu@ubuntu:~/Desktop/sbs$ sudo ./setblocksize -b512 /dev/sg0

setblocksize V0.2

Checking parameters ...
   Blocksize specified.
   Done.
New blocksize: 512 Bytes
Format timeout: 120 minutes
Open device file ...
   Done.
Prepare command ...
   Done.
Send INQUIRY command ...
   Done.
Check status ...
   Command successful.
Check for LUN ...
   LUN present.

===============================================================================
SCSI ID     : 0
LUN         : 0
Connected to: Host3 / Channel0
Manufacturer: ATA     
Model       : P400m400-MTFDDAK
Device type : Disk
===============================================================================
Do you really want to reformat this device [y/n]? y

Prepare command ...
   Done.
Send MODE SELECT command ...
   Done.
Check status ...
   Error: Check Condition
[valid=0] Info fld=0x0, Current sense key: Illegal Request
Additional sense indicates: Invalid field in cdb
Raw sense data (in hex):
  70 00 05 00 00 00 00 12 00 00 00 00 24 00 00 c9
   plus...: Driver_status=0x08 (DRIVER_SENSE,SUGGEST_OK)
   Command NOT succesful!

[olegkirillov]

I guess that we're hunting the similar solution.
My SSDs are 200Gb, yours is twice larger, but the recipe, I suppose, will be the same.
https://forum.hddguru.com/viewtopic.php?f=10&t=37603

[fzabkar]

FWIW, some versions of dosmcli.exe (included in the update package) have a "low-level format" option.

-l <x>
--low-format <x> Perform a low-level format of the specified drive.

[TheGiolly]

I guess that we're hunting the similar solution.
My SSDs are 200Gb, yours is twice larger, but the recipe, I suppose, will be the same.
https://forum.hddguru.com/viewtopic.php?f=10&t=37603

Hi, I saw your post.
Where did you find the non OEM firmware for the SSD? Could you share it with me, please?
I dumped my firmware from the SPI flash using a CH341A.
I also checked both the populated header and the other non populated pads (on the pther side of the PCB) with an oscilloscope and there is nothing to see.
I even tried shorting out the 2 pads where there is an U (update?) and S (safe mode?) but nothig changed.

[TheGiolly]

FWIW, some versions of dosmcli.exe (included in the update package) have a "low-level format" option.

-l <x>
--low-format <x> Perform a low-level format of the specified drive.

I cannot find a version with the low-level format option, could you link me the correct one?
Do you think that with that option I can change the block size?

[fzabkar]

http://whp-aus1.cold.extweb.hp.com/pub/softpaq/sp62001-62500/sp62063.html
http://ftp-boi.external.hp.com/pub/softpaq/sp62001-62500/sp62063.exe

NOTES:
- Please note that this firmware update will reformat your Micron SED SSD
drive. Please be sure to backup your data prior to running this update.

The term "format" is ambiguous. It may refer to a software format rather than a true low-level format. In any case I have no idea whether the inluded dosmcli executable works with your model.

[olegkirillov]

Hi, I saw your post.
Where did you find the non OEM firmware for the SSD? Could you share it with me, please?
I dumped my firmware from the SPI flash using a CH341A.
I also checked both the populated header and the other non populated pads (on the pther side of the PCB) with an oscilloscope and there is nothing to see.
I even tried shorting out the 2 pads where there is an U (update?) and S (safe mode?) but nothig changed.

The firmware I managed to dig out is in fact another OEM, but as far as I can see it does support fwdownload with hdparm (it's for x86 + Linux flavor platform), so there's a good chance that it supports a human readable 512 byte sectors and ATAPI comands. I'll upload it to a cloud and send you PM shortly.

Right now I'm setting up a laptop with protocol analyser to sniff a supposed JTAG port.

[olegkirillov]

The term "format" is ambiguous. It may refer to a software format rather than a true low-level format. In any case I have no idea whether the inluded dosmcli executable works with your model.

I suppose the mcli (both DOS/Win/Linux versions) wants to see some standard ATAPI functions that OEM firmware lacks. My version (current Linux msecli 4.17.062018.05) did not format this device.

[TheGiolly]

http://whp-aus1.cold.extweb.hp.com/pub/softpaq/sp62001-62500/sp62063.html
http://ftp-boi.external.hp.com/pub/softpaq/sp62001-62500/sp62063.exe

NOTES:
- Please note that this firmware update will reformat your Micron SED SSD
drive. Please be sure to backup your data prior to running this update.

The term "format" is ambiguous. It may refer to a software format rather than a true low-level format. In any case I have no idea whether the inluded dosmcli executable works with your model.

The sp62063.exe doesn't contain dosmcli.exe.
I'll search for a dosmcli.exe version that also has that "low-level format" option, but I'm not sure that it can help to change the sector size.

[fzabkar]

Would it be possible to find a RAID controller which presents a 512e LBA size to the host while transparently communicating with 520-byte drives?

[fzabkar]

Would it be possible to find a RAID controller which presents a 512e LBA size to the host while transparently communicating with 520-byte drives?

Is this what Dell's PERC cards do? If so, then perhaps Dell's software PERCs can do the same thing ...

[olegkirillov]

No significant progress so far.
TheGiolly tried to flash SPI with firmware from me, but nothing changed. Comparing the SPI dump and this firmware shows that bootloaders are similar, while dump contains a lot of zeroed anf FF areas.
Two ideas so far:
- possibly the bootloader and firmware are somewhere inside Marvell chip and SPI is just for backup. This can explain that our attempts to load the firmware fail. The drive continues to report the original FW version even when msecli reports that both bootloader and firmware upload success;
- the firmware cannot be locked physically, because EMC storage can upgrade firmware through FibreChannel->SATA bridge.

Dosmcli also did not help, it uploads BL successfully, but FW upload fails.

The next attack vectors: disassembling EMC firmware upgrade package (fortunately its x86), dissecting the SPI dump (it's for unknown Marvell architecture), trying to figure out the pinout of internal header and determine the protocol. Having one ground pin and four unknown there is high probability that there is JTAG.

[marwanco]

Hi Oleg,
Any progress, I have Micron SSD P410m 200gb, with 520 bps, that i cannot reformat.
The Mechanicala Hitachi disk where reformatted without a problem using:

sg_format --format --size=512 -v pd2


Thanks

[trn64]

we have the same issue with this micron model.. has anybody so the trick to convert them to 512b? thanks

[JackAss82]

Hi,
I have the same problem, I tried, without success, sg_format in any possible variation found on internet, camcontrol, scu, dd, and probably some other that I don't remember but no success...

I tried writing to Micron tech support begging for help but I receive an error that it cannot send email and return to the contact module.

The next thing that I would like to try is to install the firmware of the 512b version but I cannot find it anywhere, if someone can provide me this firmware I will gladly try since if I cannot make them work I have to thrash them so...

Thanks!