Un-bricking a bad firmware upgrade

Warning! The following post features stunts performed either by professionals or under the supervision of professionals. Accordingly, the post author must insist that no one attempt to recreate or re-enact any stunt or activity performed on this post.

At work I found a 240GB Force GT laying in used computer parts bin and thought, cool, someone had thrown a perfectly good SSD away, so I decided to hook it up to my PC.

However things did not go as thought. The drive shows itself with a 32K size and with a strange model/serial number.

hdparm under linux shows this:

 Model=SandForce{200026BB}, FwRev=20DABBR0, SerialNo=1
Config={ }
RawCHS=0/16/63, TrkSize=0, SectSize=0, ECCbytes=0
BuffType=unknown, BuffSize=unknown, MaxMultSect=16, MultSect=off
CurCHS=0/16/63, CurSects=0, LBA=yes, LBAsects=64
IORDY=on/off, tPIO={min:120,w/IORDY:120}, tDMA={min:120,rec:120}
PIO modes:  pio0 pio1 pio2 pio3 pio4 
DMA modes:  mdma0 mdma1 mdma2 
UDMA modes: udma0 udma1 udma2 udma3 udma4 udma5 *udma6 
AdvancedPM=no WriteCache=disabled
Drive conforms to: unknown:  ATA/ATAPI-4,5,6,7

* signifies the current active mode

Googling the model and firmware revision seems to indicate that it is stuck in bootloader mode, typically caused by a bad firmware flash.

After closer inspection I found that someone had peeled the warranty sticker off and had taken a look inside, which I also then did as there was nothing to lose. Otherwise I would have just RMA-d it.

Inside everything looked in pristine condition, some marks at the unpopulated header holes. 4 holes seemed to be a standard UART connection and on other side an unidentified 2-pin jumper connection. So someone definitely had a go at it before, but unsuccessfully.

Since I work at an electronics facility, I grabbed the nearest UART adapter, some pin headers and hooked it up, connected the SATA power and to my surprise I got output.

*** ROM Rev 20D Dec 20 2010 Build 288571 ***
[ROM] Try BCH[1]: CP=33 EC=54 EP=485
[ROM] Try BCH[2]: CP=29 EC=48 EP=485
[ROM] Try BCH[3]: CP=36 EC=59 EP=485
[ROM] Try BCH[4]: CP=39 EC=64 EP=485
[ROM] Try BCH[5]: CP=16 EC=27 EP=512
[ROM] Root is missing; run MFB to recreate the Root.
[ROM] Root Not Found!
[ROM] Force Download: waiting for Download Microcode Command...
[ROM] Waiting for Link to come up...
[ROM] Link is UP.

That definitely looks like a bootloader or low level hardware initialization. Since it is all quite cryptic, I decided to return to google for answers. It seems like it is waiting for an ATA command, to download itself a new software/firmware, however there seems to be no tools available for that job in public.

My question is, would it be possible to you, Corsair or LSI, to supply the necessary software to recover the firmware in some form? It would be sad to see this, perhaps otherwise perfect, SSD go to waste.

Also if it is not a secret, what does that 2 pin jumper do?

As expected. But thanks anyway.

Void warranty aside, would you happen to know whether the code it expects to get exists in the vic files that can be found from this forum?

That's unfortunate.

However in the meanwhile, reading around the forums I found that hdparm contains a mode for the firmware upload/download as demonstrated in this post.

The default, mode7 did not trigger the download, but mode3 (and -max) did. But uploading padded vic file fails for the exact same reason as noted in that post. But still, this should provide enough evidence that this is possibly fixable in software with the correct file.

Unfortunately, you won't get any help from Corsair employees because they are instructed not to give advice for such low level issues, even if they have the tools (they definitely do) to upload a new firmware this way.

After all, this is what unsupported means: "We don't provide help for operations that you are not supposed to know about."

Thank you for your reply.

As far as I understand some of it is actually what you wrote, but a lot of the other part is also the plain fact that Corsair actually has no clue what goes into these SSD-s. Based on what I've read from other threads from this forum and from LSI internal materials that have leaked to internet, I believe that I have figured out how the system works (or worked).

Basically LSI provides their controllers and software as in all-in-one solution and takes the responsibility of updating or fixing the software. Then the compiled software can be fused with certain data files, which most likely differentiate characteristics of different flash chips. This is where the vic files come from, they are the base firmware + data about the certain flash chips + some other magic. This is obviously very profitable for LSI as they do not have to worry about the fact where the flash comes from, what's the quality of those and they managed to get a lot of vendors to just use their controller; probably way more than they ever could have done by themselves.

It was sort of amusing to find a hidden software flag in the generic firmware upgrade utility which only changed the banner image of the application to the one I supplied. My guess is that Corsair's toolbox works on top of a precompiled library which contents they do not know, that handles all of the firmware upgrade tasks and is supplied by LSI.

The only thing that I cannot explain is where the PCB-s came from and how much anyone outside LSI knows about the controller's technical capabilities.

Remember all of this what I just wrote is hypothetical and I have no confirmation whether it all worked like this. However if this seems to be the case, then any vendor who designs their own controllers, in my opinion deserves a freaking medal.

hi guys

Do i have chance to get back into life a bricked corsair force 3 ssd that already not visible in the bios?

I got speed issues with the drive (slow writing speed) then I decided to try downgrade the firmware.. because I upgraded the firmware few months before and I noticed now it writes very slowly after the upgrade... After the downgrade attempt the ssd disappeard. I cant see from the bios.

I dont mind if I bricked because I have another ssd drive and this one was approx 4 years old, but i would like to know if there is any way to fix.

thanks

Hi nsx82, most likely no. If you can't see the drive at all (even under device manager with some other name), then you have managed to brick it for good.

In my case the bootloader (yes, the SSD controller even has one) survived and this is the reason for the mangled name in device manager. I know the new firmware can be uploaded using an ATA command, but from what I have gathered, the firmwares that Corsair supplies have been prepackaged and encrypted by LSI beforehand and only their software/API-s will unlock it.

It would be interesting to know what do vendors (like Corsair) do in these situations with the bricked devices, solder on a new controller?

Hi nsx82, most likely no. If you can't see the drive at all (even under device manager with some other name), then you have managed to brick it for good.

 

In my case the bootloader (yes, the SSD controller even has one) survived and this is the reason for the mangled name in device manager. I know the new firmware can be uploaded using an ATA command, but from what I have gathered, the firmwares that Corsair supplies have been prepackaged and encrypted by LSI beforehand and only their software/API-s will unlock it.

 

It would be interesting to know what do vendors (like Corsair) do in these situations with the bricked devices, solder on a new controller?

Dear Ingram,

Thanks for the quick answer!

I think then I can throw into the dustbin. :(

I knew, I doing risky things with the firmware downgrade, however with 50mb/sec write im not satisfied on SSD. So even if I don't brick i buy another one anyways...

My other ssd is quite the same (forcre 3 60gb), got the same firmware in the same time as my older ssd (which is bricked now), and slowed down on the same way. Im 100% sure before the 5.5 fw they were faster in write and slower in read speed. My actual speed test results are very different from the old ones... Before the 5.5 fw I did never reach read/write speed more than 420mb/sec.. Now both the ssds read speed was above 540mb/s but the write speed under 60mb/s. Okay...

first I thought the old one is just worn down because of the rough usage in the years (9000gb+ read / 4800gb+ write)

but the newer ssd has the same slow reading speed, and this one was used few GBs read/write only. So I still think that the latest firmware made the difference in speed...

And no, im not benchmarking with he official ATTO benchmark that suggested by corsair because that not showing the real life preformance...

I got my results now and before from crystal disk mark. So i want to compare them/see the same old results..

Ingram: one of my friend's brother works as official data saver, I gonna ask him about my problem and your curiosity too :)

Greets: NSX