Micron M600 SMART

[outbreak198x]

Hello,

i got a Micron M600 - and get's ready fast, but no data access possible - ID correct, size correct, chips connection looks fine.

tried to create translator, but not possible (of course it's not supported - but trying is always good)

tried heating up, cooling down - nothing helps, when try to ready via utility, i get sectors, but useless of course without translator.

any ideas? when try to open with universal utility it tells me something about SMART error.

Tech-key................................ : Ok

Capacity.......................................... : 256 GB
Channels count.................................... : 8
Channel 0:
CE 0: Logical chip 0........................ : 0x2C846454
CE 1: Logical chip 8........................ : 0x2C846454
Channel 1:
CE 0: Logical chip 1........................ : 0x2C846454
CE 1: Logical chip 9........................ : 0x2C846454
Channel 2:
CE 0: Logical chip 2........................ : 0x2C846454
CE 1: Logical chip 10........................ : 0x2C846454
Channel 3:
CE 0: Logical chip 3........................ : 0x2C846454
CE 1: Logical chip 11........................ : 0x2C846454
Channel 4:
CE 0: Logical chip 4........................ : 0x2C846454
CE 1: Logical chip 12........................ : 0x2C846454
Channel 5:
CE 0: Logical chip 5........................ : 0x2C846454
CE 1: Logical chip 13........................ : 0x2C846454
Channel 6:
CE 0: Logical chip 6........................ : 0x2C846454
CE 1: Logical chip 14........................ : 0x2C846454
Channel 7:
CE 0: Logical chip 7........................ : 0x2C846454
CE 1: Logical chip 15........................ : 0x2C846454

[gold6565]

Connect the terminal and see what it doesn't like.

[outbreak198x]

do you have pinout for me?

Attachments

[gold6565]

On the other side of the SSD, there are three contacts, the middle one being ground

[outbreak198x]

so you mean those 2(3) correct? - the middle one is ground, RX TX on the others, tried both directions (3,3V)

Nothing happens there on terminal

Attachments

[gold6565]

Give the command: SER ON , then TAB

[outbreak198x]

nice a lot of commands here, when i try to read a sector it tells me

Write Protect, Status 0x00000051
cmd:00000010,qEr 0950

[outbreak198x]

so i guess it hits the TBW? and now is in read only or something like that - but can't read anyway

[gold6565]

Save the resources from the SSD and send them to me.

[outbreak198x]

Save the resources from the SSD and send them to me.

sent - hope it's read correct

[gold6565]

In the terminal, issue the command: SHOWCMD ON, and check everything possible, smart, reading, and see what is in the terminal.

[outbreak198x]

I already read (what i can read) and the only thing i found is 477 bad blocks.

An option just to disable „write protection“- am i right?

I‘ll do some screenshots tomorrow

[outbreak198x]

ssd log Attached, with a lot of commands run

Attachments

ssdlog.txt

(324.66 KiB) Downloaded 636 times

[gold6565]

This SSD can read, try PIO 1 sector

[outbreak198x]

you mean just read in PIO Mode?

because in Pc3k i tried all modies, no reading possible - with utility it's possible, but of course no translator... so useless data.

[westcoast]

same m600 drive, after failure and repair it starts as uninitialized - consumption from 5V USB static

i had NOR backup from last year, flashed it

now it appears as it is BSY, consumption variable 205-220mA, every 5-6 minutes jump to 270mA for 1-3 seconds

hook up serial, initially a bunch of <DR> PASS messages, the console is flooded but in log every 5 minutes or so then appears <DR> FAIL with one same block

what to do with this block? i read elsewhere these drives take around 5 minutes for first launch after repair to reassemble data structure which correspond to my case

[westcoast]

it couldn't do anything with the backup, same action was looping over and over (inittmpBB) bitching about that one block.

restored the NOR dump after failure, it gets ready, through UART can be seen that there is 49 free blocks and more than 900 data blocks which is what it was before it failed.

same problem as OP, Write Protect, Status 0x00000051

if it's possible to patch security erase via JTAG, maybe it's possible to do the same for the routine that sets it to write-protect mode.

[westcoast]

JTAG connection was straightforward. even openocd auto detected ID which later found in dragonite target

there are several sections in NAND and one of them is firmware, which is working, otherwise there would be no boot or possibility to access commands from UART as all these commands are in NAND fw, not in bootcode that resides in NOR flash

i think i should try to download fw from NAND, not sure yet how. maybe the fw loaded into memory is 1:1 copy of the NAND and hasn't been modified in any place. that would make it easy

looking for strings in several downloaded fw updates there is Write Protect, Status and also SED error (this message is stored in NOR log with code 10C). first should load fw from NAND into disassembler then look around these messages

in UART outputs noticed there are several 'pending rebuild' tasks, might be worth to try trigger these rebuilds somehow to see if they can reassemble lookup tables

[westcoast]

maybe the fw loaded into memory is 1:1 copy of the NAND

of course this wasnt the case. it appears is executed at the load address and some other parts split it, so it ends up at larger offset than its length+load addr
load addr is 0x80002600

M603 seems almost identical to MU05

the code has changed in place where old bug needed to be patched to reset the drive to factory settings, but if it is still a problem it seems it can be easily patched even in new firmwares

not important at this point

when booted after failure idiot reset all important parameters, like metainfo. this could be DSSR data or section in NOR at 0x100000

Code:

Err! InitMi media read err!
Warning! InitMi Id 001 data default to 0!
Warning! InitMi Id 003 data default to 0!
Warning! InitMi Id 004 data default to 0!
Warning! InitMi Id 006 data default to 0!

DCO flag 00000020

Warning! InitMi Id 00E data default to 0!
Warning! InitMi Id 011 data default to 0!
Warning! InitMi Id 012 data default to 0!
Warning! InitMi Id 013 data default to 0!

~~~~ATA Save 00000014
Err! SaveMi Wr Protected!
Security Feature ERR!
SEDERR: 0000010C

either way booting a NOR backup these warnings are not shown and also no SEDERR 10C which might be related to WP

with the backup the error is single page in block

Code:

E 0
C:2
L:FFFFFFFF,FFFFFFFF
P:000CC5D6,100CC5D6
ECC:FF,FF
U:11,O:0,Err:3
BlkVer:F7F34E0D
wBufIdx:0
<DR>000CC5D6
ATLVP0 ATLWP0
CH:0 CE:0 LUN:0 BLK:CC4 PAGE:1D6
IsSLC:0 Edg:0 Odd:0 Lo:1 Lvp:0 LpO:1 PG:1 EG:0 RG:0

Former nand trim: R10:A1 R00:AE R01:75

<Vp M0 blkCC4 page1D6>

Tg:0/F Vp:0/F
FD:1 BB:1
<DR>FAIL
<InitTmpBB>Ptu:000CC5D6
<RdPre>Next P:0x00000000
<RdPre>PreLtu Failed!
L Spare:0775F350, L Err:FFFFFFFF

<DR>100CC5D6
ATLVP0 ATLWP0
CH:0 CE:0 LUN:0 BLK:CC4 PAGE:1D6
IsSLC:0 Edg:0 Odd:0 Lo:1 Lvp:0 LpO:1 PG:1 EG:0 RG:0

Former nand trim: R10:A1 R00:AE R01:75

<Vp M0 blkCC4 page1D6>

Tg:0/F Vp:0/F
FD:1 BB:1
<DR>FAIL
<InitTmpBB>Ptu:100CC5D6
L Spare:0775F350, L Err:FFFFFFFF
SCnt:8
SCnt:8
<Rd>DRPTU:000CC5D6-Sts:00000002
<Rd>DRPTU:100CC5D6-Sts:00000002
<EH>Empty
<CleanET>Ptu:000CC5D6, AuCnt:2
<EH>EH:3455947us.
******EH...Good Bye******

******EH...Good Luck******
<StoreET>Ptu:000CC5D6, AuCnt:2
BPC: Enable
Block BPC mode:
000:   00 00 00 00 00 00 C0 00
040:   00 00 00 00 00 10 00 00
080:   80 00 00 00 00 00 00 00
0C0:   00 00 00 00 00 20 02 00
100:   00 00 00 20 00 08 00 00
140:   10 40 00 00 00 00 00 00
180:   02 80 00 00 02 01 00 00
1C0:   00 00 00 00 00 00 00 00
200:   00 00 00 80 00 00 00 00
240:   00 00 00 00 08 00 00 00
280:   00 00 00 08 80 05 00 00
2C0:   00 00 00 00 00 00 00 00
300:   00 00 00 00 00 80 00 00
340:   00 02 00 82 00 00 00 00
380:   00 00 00 00 20 00 00 00
3C0:   00 00 01 00 00 00 00 00
400:   00 00 10

Lun BPC mode:
0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Nand BPC mode:
0 0.0.0:00000102
1 1.0.0:00000100
1 2.0.0:00000100
1 3.0.0:00000100
1 0.1.0:00000100
1 1.1.0:00000100
1 2.1.0:00000100
1 3.1.0:00000100
1 4.0.0:00000100
1 5.0.0:00000100
1 6.0.0:00000100
1 7.0.0:00000100
1 4.1.0:00000100
1 5.1.0:00000100
1 6.1.0:00000100
1 7.1.0:00000100
1 0.0.1:00000100
1 1.0.1:00000100
1 2.0.1:00000100
1 3.0.1:00000100
1 0.1.1:00000100
1 1.1.1:00000100
1 2.1.1:00000100
1 3.1.1:00000100
1 4.0.1:00000100
1 5.0.1:00000100
1 6.0.1:00000100
1 7.0.1:00000100
1 4.1.1:00000100
1 5.1.1:00000100
1 6.1.1:00000100
1 7.1.1:00000100

Nand SFBL(0x10)/FA91(0x08) mode:
0.0.0: 33/3F
1.0.0: 33/3F
2.0.0: 33/3F
3.0.0: 33/3F
0.1.0: 33/3F
1.1.0: 33/3F
2.1.0: 33/3F
3.1.0: 33/3F
4.0.0: 33/3F
5.0.0: 33/3F
6.0.0: 33/3F
7.0.0: 33/3F
4.1.0: 33/3F
5.1.0: 33/3F
6.1.0: 33/3F
7.1.0: 33/3F
0.0.1: 33/3F
1.0.1: 33/3F
2.0.1: 33/3F
3.0.1: 33/3F
0.1.1: 33/3F
1.1.1: 33/3F
2.1.1: 33/3F
3.1.1: 33/3F
4.0.1: 33/3F
5.0.1: 33/3F
6.0.1: 33/3F
7.0.1: 33/3F
4.1.1: 33/3F
5.1.1: 33/3F
6.1.1: 33/3F
7.1.1: 33/3F

BlkPgCnt: 00000100
LP:000000FF
TuCnt:00010000
P2lPC:00000020
P2lTuC:00000040
XorPC:00000100
XorTuC:00000200

E 0
C:2
L:FFFFFFFF,FFFFFFFF
P:008CC5D6,108CC5D6
ECC:FF,FF
U:11,O:0,Err:3

BlkVer:F7F34E0D
wBufIdx:0
<DR>008CC5D6
ATLVP0 ATLWP0
CH:0 CE:0 LUN:0 BLK:CC4 PAGE:1D6
IsSLC:0 Edg:0 Odd:0 Lo:1 Lvp:0 LpO:1 PG:1 EG:0 RG:0

Former nand trim: R10:A1 R00:AE R01:75

<Vp M0 blkCC4 page1D6>

Tg:0/F Vp:0/F
FD:1 BB:1
<DR>FAIL
<InitTmpBB>Ptu:008CC5D6
<RdPre>Next P:0x00000000
<RdPre>PreLtu Failed!
L Spare:0775F350, L Err:FFFFFFFF

<DR>108CC5D6
ATLVP0 ATLWP0
CH:0 CE:0 LUN:0 BLK:CC4 PAGE:1D6
IsSLC:0 Edg:0 Odd:0 Lo:1 Lvp:0 LpO:1 PG:1 EG:0 RG:0

Former nand trim: R10:A1 R00:AE R01:75

<Vp M0 blkCC4 page1D6>
Tg:0/F Vp:0/F
FD:1 BB:1
<DR>FAIL
<InitTmpBB>Ptu:108CC5D6
L Spare:0775F350, L Err:FFFFFFFF
SCnt:8
SCnt:8
<Rd>DRPTU:008CC5D6-Sts:00000002
<Rd>DRPTU:108CC5D6-Sts:00000002
<EH>Empty
<CleanET>Ptu:000CC5D6, AuCnt:2
<CleanET>Ptu:008CC5D6, AuCnt:2

<EH>EH:4109029us.
******EH...Good Bye******
wSpareVer 0038E361
wVer F7F34E0D

DBG_ASSERT: ../Lib/Lib_InfoPage.c, line 1318

Fail save serial log into NOR

<InitTmpBB>Ptu:008CC5D6
<InitTmpBB>Ptu:008CC5D6
<InitTmpBB>Ptu:008CC5D6


full.log

(952.18 KiB) Downloaded 499 times

[westcoast]

in the log on startup there is Force All LUN to MLC

yet all the <DR>PASS blocks have been scanned as SLC
IsSLC:1

the failing block is the first one with IsSLC:0 in the log

RBIT command with multiple DUAL COPY FAIL messages

who knows how to flash fw on these drives? first the NAND part (aka fwa) then bootloader and msp (aka fwb and fwc) is it the right order?