> reg ===== ARM registers (0) r0 (/32): 0x10020810 (dirty) (1) r1 (/32): 0x4D435442 (dirty) (2) r2 (/32): 0x4D524453 (3) r3 (/32): 0x00000004 (4) r4 (/32): 0x00824F3C (5) r5 (/32): 0x00000001 (6) r6 (/32): 0x00000000 (7) r7 (/32): 0x00803400 (8) r8 (/32): 0x00002600 (9) r9 (/32): 0x00824F3C (10) r10 (/32): 0x00803400 (11) r11 (/32): 0x4D435442 (12) r12 (/32): 0x00000800 (13) sp_usr (/32) (14) lr_usr (/32) (15) pc (/32): 0x000108DE (16) r8_fiq (/32) (17) r9_fiq (/32) (18) r10_fiq (/32) (19) r11_fiq (/32) (20) r12_fiq (/32) (21) sp_fiq (/32) (22) lr_fiq (/32) (23) sp_irq (/32) (24) lr_irq (/32) (25) sp_svc (/32): 0x00827C00 (26) lr_svc (/32): 0x0000994F (27) sp_abt (/32) (28) lr_abt (/32) (29) sp_und (/32) (30) lr_und (/32) (31) cpsr (/32): 0x200001F3 (32) spsr_fiq (/32) (33) spsr_irq (/32) (34) spsr_svc (/32) (35) spsr_abt (/32) (36) spsr_und (/32) (37) sp (/32) (38) lr (/32) (39) sp_mon (/32) (40) lr_mon (/32) (41) spsr_mon (/32) > arm disassemble 0x108de 20 thumb 0x000108de 0x428a CMP r2, r1 0x000108e0 0xd1fc BNE 0x000108dc 0x000108e2 0x4770 BX r14 0x000108e4 0x4817 LDR r0, [pc, #0x5c] ; 0x00010944 0x000108e6 0x3008 ADDS r0, #0x08 0x000108e8 0xe7f8 B 0x000108dc 0x000108ea 0x4916 LDR r1, [pc, #0x58] ; 0x00010944 0x000108ec 0x1f09 SUBS r1, r1, #4 0x000108ee 0x680a LDR r2, [r1, #0] 0x000108f0 0x4282 CMP r2, r0 0x000108f2 0xd1fc BNE 0x000108ee 0x000108f4 0x1c40 ADDS r0, r0, #1 0x000108f6 0x6008 STR r0, [r1, #0] 0x000108f8 0x4770 BX r14 0x000108fa 0xb118 CBZ r0, 0x00010904 0x000108fc 0x4811 LDR r0, [pc, #0x44] ; 0x00010944 0x000108fe 0x1d00 ADDS r0, r0, #4 0x00010900 0x6001 STR r1, [r0, #0] 0x00010902 0x4770 BX r14 0x00010904 0x480f LDR r0, [pc, #0x3c] ; 0x00010944 > poll background polling: on TAP: auto0.tap (enabled) mex1: target state: halted target halted in Thumb state due to debug-request, current mode: Supervisor cpsr: 0x200001f3 pc: 0x000108de D-Cache: disabled, I-Cache: disabled (25) sp_svc (/32): 0x00827C00 (26) lr_svc (/32): 0x0000994F > mdw 0x827be0 80 0x00827be0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0x00827c00: 0081c620 00824fe8 0081e4cc 0080818c 00000000 00000000 00000000 00000000 0x00827c20: 00000800 000099c5 0081c620 00005e1f 0081c620 00824ebc 0081e4cc 0080818c 0x00827c40: 00000000 000067ff 0000009c 0081d8b4 0000000a 008080f8 0000000f 0081e350 0x00827c60: 0081c620 0081c620 0081e4d4 00000000 00000000 000068eb 00000000 0000a670 When booting the bad SSD, it has the following status: > halt mex3: target state: halted target halted in Thumb state due to debug-request, current mode: Supervisor cpsr: 0x60000173 pc: 0x80081576 D-Cache: disabled, I-Cache: disabled > targets 1 use 'mex2' as target identifier, not '1' > halt mex2: target state: halted target halted in Thumb state due to debug-request, current mode: Supervisor cpsr: 0x20000173 pc: 0x800479f8 D-Cache: disabled, I-Cache: disabled > targets 0 use 'mex1' as target identifier, not '0' > halt mex1: target state: halted target halted in Thumb state due to debug-request, current mode: Supervisor cpsr: 0x200001f3 pc: 0x000108de D-Cache: disabled, I-Cache: disabled When we skip mex1 to 0x108e2 and resume, it ends up in an endless loop around 0x9a80 (in the function sub_9a6a) > targets 0 use 'mex1' as target identifier, not '0' > reg ===== ARM registers (0) r0 (/32): 0x10020810 (dirty) (1) r1 (/32): 0x4D435442 (2) r2 (/32): 0x4D524453 (3) r3 (/32): 0x00000004 (4) r4 (/32): 0x00824F3C (5) r5 (/32): 0x00000001 (6) r6 (/32): 0x00000000 (7) r7 (/32): 0x00803400 (8) r8 (/32): 0x00002600 (9) r9 (/32): 0x00824F3C (10) r10 (/32): 0x00803400 (11) r11 (/32): 0x4D435442 (12) r12 (/32): 0x00000800 (13) sp_usr (/32) (14) lr_usr (/32) (15) pc (/32): 0x000108DE (16) r8_fiq (/32) (17) r9_fiq (/32) (18) r10_fiq (/32) (19) r11_fiq (/32) (20) r12_fiq (/32) (21) sp_fiq (/32) (22) lr_fiq (/32) (23) sp_irq (/32) (24) lr_irq (/32) (25) sp_svc (/32): 0x00827C00 (26) lr_svc (/32): 0x0000994F (27) sp_abt (/32) (28) lr_abt (/32) (29) sp_und (/32) (30) lr_und (/32) (31) cpsr (/32): 0x200001F3 (32) spsr_fiq (/32) (33) spsr_irq (/32) (34) spsr_svc (/32) (35) spsr_abt (/32) (36) spsr_und (/32) (37) sp (/32) (38) lr (/32) (39) sp_mon (/32) (40) lr_mon (/32) (41) spsr_mon (/32) > targets 1 use 'mex2' as target identifier, not '1' > reg ===== ARM registers (0) r0 (/32): 0x00000000 (dirty) (1) r1 (/32): 0x00000004 (2) r2 (/32): 0x8A740000 (3) r3 (/32): 0x00000000 (4) r4 (/32): 0x80067D4C (5) r5 (/32): 0x8A868000 (6) r6 (/32): 0x00000000 (7) r7 (/32): 0x00000004 (8) r8 (/32): 0x00000004 (9) r9 (/32): 0x00000001 (10) r10 (/32): 0x00000000 (11) r11 (/32): 0x00000004 (12) r12 (/32): 0x00000001 (13) sp_usr (/32) (14) lr_usr (/32) (15) pc (/32): 0x800479F8 (16) r8_fiq (/32) (17) r9_fiq (/32) (18) r10_fiq (/32) (19) r11_fiq (/32) (20) r12_fiq (/32) (21) sp_fiq (/32) (22) lr_fiq (/32) (23) sp_irq (/32) (24) lr_irq (/32) (25) sp_svc (/32): 0x00827B30 (26) lr_svc (/32): 0x80047AEB (27) sp_abt (/32) (28) lr_abt (/32) (29) sp_und (/32) (30) lr_und (/32) (31) cpsr (/32): 0x20000173 (32) spsr_fiq (/32) (33) spsr_irq (/32) (34) spsr_svc (/32) (35) spsr_abt (/32) (36) spsr_und (/32) (37) sp (/32) (38) lr (/32) (39) sp_mon (/32) (40) lr_mon (/32) (41) spsr_mon (/32) > targets 2 use 'mex3' as target identifier, not '2' > reg ===== ARM registers (0) r0 (/32): 0x00015FE1 (dirty) (1) r1 (/32): 0x8009780E (2) r2 (/32): 0x00000000 (3) r3 (/32): 0x00000001 (4) r4 (/32): 0x00000000 (5) r5 (/32): 0x00000000 (6) r6 (/32): 0x2050F000 (7) r7 (/32): 0x00000000 (8) r8 (/32): 0x00825C24 (9) r9 (/32): 0x00000000 (10) r10 (/32): 0x00000000 (11) r11 (/32): 0x00000000 (12) r12 (/32): 0x00000641 (13) sp_usr (/32) (14) lr_usr (/32) (15) pc (/32): 0x80081576 (16) r8_fiq (/32) (17) r9_fiq (/32) (18) r10_fiq (/32) (19) r11_fiq (/32) (20) r12_fiq (/32) (21) sp_fiq (/32) (22) lr_fiq (/32) (23) sp_irq (/32) (24) lr_irq (/32) (25) sp_svc (/32): 0x00827BB0 (26) lr_svc (/32): 0x80097813 (27) sp_abt (/32) (28) lr_abt (/32) (29) sp_und (/32) (30) lr_und (/32) (31) cpsr (/32): 0x60000173 (32) spsr_fiq (/32) (33) spsr_irq (/32) (34) spsr_svc (/32) (35) spsr_abt (/32) (36) spsr_und (/32) (37) sp (/32) (38) lr (/32) (39) sp_mon (/32) (40) lr_mon (/32) (41) spsr_mon (/32)