Thursday, July 28, 2016

Of Samsung SSD's, LSI HBA's and SSD firmwares.

Introduction

Everyone loves SSD's, that's no doubt but when it comes to updating the of-so-very-important firmware things become quite complicated quickly:

First, I don't run Windows or OSX on my most important hardware (the hypervisors/workstations).

Second, I run most of my SSD's behind an LSI HBA (to benefit from the cache and from the processing power of the LSI card).

Here's how I did -without- Windows or OSX and -without- taking my SSD's out of my boxes.

A few words of warning

This post is not a full "Method Of Procedure" and is very specific.
It is -NOT- for the average user and it requires some good Linux knowledge.
If things go wrong, it may brick/destroy your SSD, your PC and even your HD TV.
It will most likely require to be adapted in most cases unless you have a very similar setup.
The purpose of this post is to show that there are alternative ways available and that you do NOT have to tear up your gear only to update firmware.

Chances are that this might work for SSD's from Intel, Crucial and others but you won't know until you've found a way to decrypt/un-obfuscate their firmwares.

Please do not attempt to go through these steps unless you know what you are doing.

Hardware Setup

- Dell Precision T5610 (128Gb RAM, dual 6-cores Xeons, LSI Megaraid 9271-8i 1Gb)
- RHEL 6.8.z
- Samsung SSD 840 EVO m-Sata with StarTech  2.5-Inch SATA to Mini-SATA SSD Adapter

Here's a view from the LSI HBA of the above setup (SSD firmware highlighted blue):

# megaclisas-status
-- Controller information --
-- ID | H/W Model                | RAM    | Temp | BBU    | Firmware
c0    | LSI MegaRAID SAS 9271-8i | 1024MB | 55C  | Absent | FW: 23.34.0-0005
-- Array information --
-- ID | Type   |    Size |  Strpsz |   Flags | DskCache |   Status |  OS Path | CacheCade |InProgress
c0u0  | RAID-0 |    931G |  256 KB | ADRA,WT |  Enabled |  Optimal | /dev/sda | None      |None
c0u1  | RAID-0 |   3637G |  256 KB | ADRA,WB |  Default |  Optimal | /dev/sdb | None      |None
-- Disk information --
-- ID  | Type | Drive Model                                            | Size     | Status          | Speed    | Temp | Slot ID  | LSI Device ID
c0u0p0 | SSD  | S1KRNEAFB01520M Samsung SSD 840 EVO 1TB mSATA EXT42B6Q | 931.0 GB | Online, Spun Up | 6.0Gb/s  | 36C  | [252:0]  | 1
c0u1p0 | HDD  | WD-WCC4E0346870WDC WD40EFRX-68WT0N0 80.00A80           | 3.637 TB | Online, Spun Up | 6.0Gb/s  | 36C  | [252:1]  | 0

In short, deep within that Precision T5610 running RHEL6.8, there'a Samsung mSata SSD inside a small SATA enclosure connected to an LSI HBA.
Thankfully, MegaCli can upgrade arbitrary firmware on drives connected to an LSI HBA.

Technical Procedure

Obtain firmware from Samsung

If you have a Samsung SSD from before the 850 times, you're in luck because you don't have to go through the Windows-Only Samsung Magician Application. For 850's and later, the firmware is included in Samsung Magician and not available as a separate download anymore.

Download your firmware from Samsung at: Samsung SSD Tools Download
For that SSD, it came in the form of a Win/Mac ISO image:

# ls -l *iso
-rw-r--r-- 1 root root 3117056 May  2 06:47 Samsung_SSD_840_EVO_mSATA_EXT43B6Q_Win_Mac.iso

Extract firmware payload from download

The firmware image is deep within the download. Let's extract it:

# mount -o loop $(pwd)/Samsung_SSD_840_EVO_mSATA_EXT43B6Q_Win_Mac.iso /mnt
# losetup /dev/loop4 /mnt/isolinux/btdsk.img
# mkdir /tmp/2
# mount /dev/loop4 /tmp/2
mount: block device /dev/loop4 is write-protected, mounting read-only
# cp -afv /tmp/2/samsung/DSRD/FW .
`/tmp/2/samsung/DSRD/FW' -> `./FW'
`/tmp/2/samsung/DSRD/FW/EXT43B6Q' -> `./FW/EXT43B6Q'
`/tmp/2/samsung/DSRD/FW/EXT43B6Q/EXT43B6Q.enc' -> `./FW/EXT43B6Q/EXT43B6Q.enc'

Here's the firmware image (note that its name is related to the actual firmware version):

# ls -l
-rwxr-xr-x 1 root root 1048576 Sep 23  2015 EXT43B6Q.enc

Decrypt firmware

Several posts on the net mentionned that the above image was encrypted. It surely did look like some binary garbage and not like a firmware of any kind.

Then, I found this post where someone had posted a simply python script to decrypt the encrypted payload downloaded from Samsung's site.

Since I wasn't sure if the drive would accept an excrypted firmware through MegaCli, I decided to decrypt the firmware first. I placed a copy of the python script here.

# python ./samsung_ssd_decode.py EXT43B6Q.enc
# ls -lrt
-rwxr-xr-x   1 root root 1048576 Jul 22 11:03 EXT43B6Q.enc
-rw-r--r--   1 root root 1048576 Jul 22 11:03 EXT43B6Q.enc.decoded

Find the PhysDrv ID and apply firmware

# megaclisas-status
-- Controller information --
-- ID | H/W Model                | RAM    | Temp | BBU    | Firmware     
c0    | LSI MegaRAID SAS 9271-8i | 1024MB | 55C  | Absent | FW: 23.34.0-0005 
-- Array information --
-- ID | Type   |    Size |  Strpsz |   Flags | DskCache |   Status |  OS Path | CacheCade |InProgress   
c0u0  | RAID-0 |    931G |  256 KB | ADRA,WT |  Enabled |  Optimal | /dev/sda | None      |None         
c0u1  | RAID-0 |   3637G |  256 KB | ADRA,WB |  Default |  Optimal | /dev/sdb | None      |None         
-- Disk information --
-- ID  | Type | Drive Model                                            | Size     | Status          | Speed    | Temp | Slot ID  | LSI Device ID
c0u0p0 | SSD  | S1KRNEAFB01520M Samsung SSD 840 EVO 1TB mSATA EXT42B6Q | 931.0 GB | Online, Spun Up | 6.0Gb/s  | 36C  | [252:0]  | 1       
c0u1p0 | HDD  | WD-WCC4E0346870WDC WD40EFRX-68WT0N0 80.00A80           | 3.637 TB | Online, Spun Up | 6.0Gb/s  | 36C  | [252:1]  | 0       

# MegaCli -pdfwdownload -physdrv[252:0] -f EXT43B6Q.enc.decoded -a0


Flashing firmware image size 0x8000 (0x0 0x0 0xa0). Please wait...
Flashing firmware image size 0x8000 (0x0 0x0 0xa0). Please wait...
Flashing firmware image size 0x8000 (0x0 0x0 0xa0). Please wait...
[.....]
Flashing firmware image size 0x8000 (0x0 0x0 0xa0). Please wait...
Flashing firmware image size 0x8000 (0x0 0x0 0xa0). Please wait...
Flashing firmware image size 0x100000 (0x0 0x0 0xa0). Please wait...

Exit Code: 0x00


Reboot and Power Cycle (just to be sure)

Immediately after applying firmware, the drive showed up with the new firmware:


# megaclisas-status
-- Controller information --
-- ID | H/W Model                | RAM    | Temp | BBU    | Firmware     
c0    | LSI MegaRAID SAS 9271-8i | 1024MB | 57C  | Absent | FW: 23.34.0-0005 
-- Array information --
-- ID | Type   |    Size |  Strpsz |   Flags | DskCache |   Status |  OS Path | CacheCade |InProgress   
c0u0  | RAID-0 |    931G |  256 KB | ADRA,WT |  Enabled |  Optimal | /dev/sda | None      |None         
c0u1  | RAID-0 |   3637G |  256 KB | ADRA,WB |  Default |  Optimal | /dev/sdb | None      |None         
-- Disk information --
-- ID  | Type | Drive Model                                            | Size     | Status          | Speed    | Temp | Slot ID  | LSI Device ID
c0u0p0 | SSD  | S1KRNEAFB01520M Samsung SSD 840 EVO 1TB mSATA EXT43B6Q | 931.0 GB | Online, Spun Up | 6.0Gb/s  | 45C  | [252:0]  | 1       
c0u1p0 | HDD  | WD-WCC4E0346870WDC WD40EFRX-68WT0N0 80.00A80           | 3.637 TB | Online, Spun Up | 6.0Gb/s  | 38C  | [252:1]  | 0       


Since I didn't want to take risks, I rebooted the workstation and verified that it came back cleanly.

Once it did, I powered off the system and brought it back on. Again, it came back properly.

Now if I could extract 850 firmware from Samsung Magician app, I'd be a happy camper.



LVM2 bootdisk encapsulation on RHEL7/Centos7

Introduction Hi everyone, Life on overcloud nodes was simple back then and everybody loved that single 'root' partition on th...