Firmware updates and SMART monitoring for every SSD in a multi-node homelab — four Lenovo OEM drives flashed, three methods, zero bricks, and one "encrypted" binary that turned out to be plaintext.
Built entirely through agentic coding with Claude Code. The agent researched firmware versions, extracted binaries from Lenovo packages, deployed tools over SSH, and flashed drives in-place on Linux — while the human handled the one step that required hands: swapping an NVMe between chassis for the SATA flash.
A homelab-wide SMART scan revealed that several nodes were running Lenovo OEM SSDs with outdated firmware. One drive (.156's Intel Pro 5400s) had 252 reallocated sectors, 92 uncorrectable errors, and 12 CRC errors on only 2,226 power-on hours — a pattern consistent with previous-owner PSU abuse. Firmware updates wouldn't fix physical NAND damage, but they could improve block management and address known bugs.
The complication: Lenovo OEM drives use proprietary firmware tracks (L-prefix for Intel, leading-digit revision for Samsung) that aren't available through standard tools. Solidigm Storage Tool says "No Firmware Update Available." Samsung Magician refuses to touch OEM drives. LVFS/fwupd has nothing. The firmware exists only inside Lenovo's Windows-only installer packages.
| Node | Drive | Model | Before | After | Gap |
|---|---|---|---|---|---|
| .180 | Intel Pro 7600p 256GB NVMe | SSDPEKKF256G8L | L08P | L15P | 7 versions behind |
| .178 | Intel Pro 7600p 256GB NVMe | SSDPEKKF256G8L | L12P | L15P | 3 versions behind |
| .172 | Samsung PM981 256GB NVMe | MZVLB256HAHQ-000L7 | 0L2QEXD7 | 1L2QEXD7 | 1 revision behind |
| .156 | Intel Pro 5400s 240GB SATA | SSDSC2KF240H6L | LSFL43P | LSFL44P | 1 version behind |
Before the firmware work began, .156's boot drive was migrated from a Samsung 860 EVO 500GB (SATA) to the Intel Pro 5400s 240GB (SATA). The Samsung was larger but the Intel was the target drive. Since dd wouldn't work (465G source > 224G destination, despite only 135G used), the migration used filesystem-level copy:
- Partition sda (Intel) as GPT: 512M EFI (FAT32) + rest as ext4
rsync -axHAXfrom the running root to the new partition- Copy EFI contents
- Update
/etc/fstabwith new UUIDs chroot+grub-install+grub-mkconfig
One gotcha: the initial rsync missed /usr entirely (11GB, showed as 4K on the copy). A second targeted rsync /usr/ /mnt/newroot/usr/ fixed it. The usr-is-merged symlink structure was intact but the contents weren't copied on the first pass.
Lenovo distributes SSD firmware through model-specific packages on their support site. The key packages:
- fwnva70 — Windows NVMe firmware for Intel Pro 7600p, Samsung PM981, and others
- isful03 — Linux-native Intel NVMe firmware updater (
irmfuubinary +.somodules). Same download page, separate zip. - fwsa14w — Windows SATA firmware for Intel Pro 2500/5400s series and others. Same download page, separate zip.
The isful03.zip package contains a Linux ELF binary (irmfuu_7.1.25_64) with firmware modules as shared libraries (.so files instead of Windows .dll). It runs directly on the target node:
chmod +x irmfuu_7.1.25_64
sudo ./irmfuu_7.1.25_64 show # dry run — confirms drive detection
sudo ./irmfuu_7.1.25_64 # flashThe tool auto-detects the drive, validates the firmware, and flashes to NVMe firmware slot 1 with the old firmware preserved in slot 2 as fallback. The SM2260 controller supports activation without reset, so the firmware goes live immediately.
.180 was flashed in-place over SSH (L08P -> L15P). Later, .178's NVMe was temporarily installed in .156 via NVMe-to-miniPCIe riser and flashed there too (L12P -> L15P) — the same riser setup was reused to boot .178's Windows for the SATA flash (see section 4).
The Lenovo fwnva70 package contains Samsung firmware as 1L2QEXD7_Noformat_ENC.bin — the "ENC" suggesting encryption. The file has Shannon entropy of 7.98 bits/byte, confirming it looks fully random.
However, the lolyinseo/samsung-nvme-firmware GitHub repo hosts the same firmware for the same model. Comparing the two:
SHA256 (Lenovo ENC): 5d6b8374cbeab6e676310303d28e7b228e9ee777e04ef18d320986fa5ed5feff
SHA256 (GitHub): 5d6b8374cbeab6e676310303d28e7b228e9ee777e04ef18d320986fa5ed5feff
Identical. The "ENC" in the filename is a misnomer — or the "encryption" is internal to the firmware blob itself (Samsung's own signing), not an additional layer. The binary is directly flashable via standard NVMe commands:
sudo nvme fw-download /dev/nvme0n1 --fw=1L2QEXD7.bin
sudo nvme fw-commit /dev/nvme0n1 --slot=2 --action=3 # action=3: activate immediately without resetThe PM981 supports 3 firmware slots and activation without reset (frmw: 0x16). Old firmware preserved in slot 1 as fallback.
Samsung doesn't document their 8-character version format. The following is inferred from cross-referencing dozens of versions across consumer and OEM drives:
| Position | Char | Meaning |
|---|---|---|
| 1 | 0/1 |
Sequential revision number (higher = newer) |
| 2 | L |
OEM code (L = Lenovo, B = consumer retail, M = Lenovo PM981a) |
| 3-4 | 2Q |
Product generation / NAND config |
| 5-7 | EXD |
Firmware code branch |
| 8 | 7 |
Constant |
So 0L2QEXD7 -> 1L2QEXD7 is a genuine revision bump, not an OEM relabeling.
The SATA firmware tool (fwwinsd.exe from fwsa14w) is Windows-only, no WinPE support, and the target node (.156) runs Linux. DeskPC had no SATA ports. USB-SATA adapters aren't supported by the tool.
Solution: pull .178's Windows NVMe, install it in .156 via NVMe-to-miniPCIe riser, boot Windows, run the firmware tool against the local SATA drive. The tool detected the drive (identifying it as "Intel SSD Pro 5400s Series Opal Ready" — not Pro 2500 as previously assumed) and flashed LSFL43P -> LSFL44P.
Bonus: Post-firmware-update, SMART showed reallocated sectors dropped from 252 to 191 and available reserved space increased from 94% to 96%. The new firmware's improved block management reclaimed sectors that the old firmware had prematurely retired.
Along the way, the existing router health dashboard (NiceGUI on .180:8090) was expanded with a /smart page:
- Summary table with color-coded health indicators across all nodes
- Temperature and reallocated sector history charts
smart_report.shcollector deployed to all nodes via cron (every 6 hours)- API:
POST /api/smartfor ingestion,GET /api/smart/latestfor current state
| Tool | Used for |
|---|---|
irmfuu (Lenovo/Intel Linux binary) |
Intel NVMe firmware flashing |
nvme-cli (fw-download + fw-commit) |
Samsung NVMe firmware flashing |
fwwinsd.exe (Lenovo Windows GUI) |
Intel SATA firmware flashing |
smartctl / smartmontools |
SMART health monitoring |
innoextract |
Extracting Inno Setup packages (fwnva70.exe) |
7z |
Extracting PE resources from firmware DLLs |
| NVMe firmware slots | Fallback preservation (old FW in slot 2) |
NVMe frmw capability bits |
Checking slot count and reset-free activation support |
archive/
smart_report.sh # SMART collector script (deployed to all nodes)
smart_dashboard_diff.md # Changes made to router-health main.py
firmware_matrix.md # Complete firmware version matrix for all 8 drives
- LVFS/fwupd — Both drives detected as "Updatable" but LVFS has no Lenovo OEM firmware. Dead end.
- Solidigm Storage Tool — Says "No Firmware Update Available" for OEM drives. Only supports Intel retail firmware tracks.
- Samsung Magician — Refuses to recognize OEM PM981 drives entirely.
- Intel SSD Firmware Update Tool v4.x — Removed all NAND SSD support; only covers Optane now.
- hdparm --fwdownload — Viable for SATA but no raw Intel firmware binaries exist publicly to feed it.
- Windows PE — Lenovo readme explicitly states "FW update is not supported on Windows PE."
# Identify NVMe drive and current firmware
sudo nvme id-ctrl /dev/nvme0n1 | grep -E "^fr |^mn |frmw"
# Check firmware slot count, active slot, and slot contents
sudo nvme fw-log /dev/nvme0n1
# frmw bits: bit 4 = activation without reset supported
# bits 3:1 = number of firmware slots
# SATA drive firmware version
sudo smartctl -i /dev/sda | grep "Firmware Version"
# Extract Inno Setup installer (e.g., fwnva70.exe)
innoextract -e fwnva70.exe
# Extract PE resources from firmware DLLs
7z x firmware_module.dll -o/tmp/extracted/
# Measure entropy of a binary (Python one-liner)
python3 -c "import math,collections; d=open('file.bin','rb').read(); e=-sum((c/len(d))*math.log2(c/len(d)) for c in collections.Counter(d).values()); print(f'{e:.2f} bits/byte')"Every Lenovo OEM drive in the homelab is now on latest firmware. The four non-OEM drives (Samsung 870 EVO, Samsung 860 EVO, Crucial BX500, SEIWHALE S3500) were already on latest or have no updates available. Continuous SMART monitoring is in place to catch any future degradation.