Flashing An HP H220 To IT Mode For TrueNAS - The Hard Way And The Easy Way

Please note: presented here as-is. Flashing firmware can brick your hardware. I’m not responsible if you break anything and I can’t provide technical support - this is just documentation of what I did. You have been warned.

Quick Navigation

If you’re here for the commands and can’t be bothered with the story - entirely fair - jump straight to The Short Version.

• Introduction
• Why The H220?
• What You’re Actually Dealing With
• What You’ll Need
• Step 1: Identify The Card And Record The SAS Address
• Step 2: Flash The Firmware With lsiutil
• Step 3: Remove The Boot ROM
• Step 4: Verify
• If Your Card Arrives With A Blank Flash
• Things That Don’t Work
• The Short Version
• Was It Worth It?

Introduction

I needed more SATA ports. My TrueNAS box had all four onboard connectors occupied, and I wanted to bring four retired 8TB drives back into service as a backup pool. The usual answer to this is a SAS HBA flashed to IT mode, which presents drives directly to the operating system with no RAID layer in the way - exactly what ZFS wants.

The HP H220 is a popular choice because it’s the same SAS2308 silicon as the LSI 9207-8i, and used ones turn up on eBay for around thirty quid. I bought one, found a dozen guides telling me to boot a UEFI shell and run sas2flash.efi, and settled in for a quick job.

Six hours later I had a card with no firmware on it at all, a UEFI shell that refused to flash it, a Linux utility that couldn’t see it, FreeDOS throwing an error nobody could explain, and a Python script that was one keystroke away from bricking the thing permanently.

The card works perfectly now. So does the second one, which took twenty minutes and never left an SSH session.

This post is both halves of that: the method that works, and a list of everything that doesn’t, so you can skip the part where you stare at an error message at midnight wondering what you’ve done.

Why The H220?

Why An HBA, And Why IT Mode

ZFS wants to own the disks. Not a RAID controller’s idea of the disks - the actual drives, with their actual sectors and their actual SMART data. A hardware RAID card sits in between and hides all of that behind an abstraction, which breaks SMART monitoring, and in the worst case will tell the OS a write has completed while it’s still sitting in a volatile cache. That’s precisely the scenario ZFS’s consistency guarantees are designed to survive, and a RAID card quietly undermines them.

A Host Bus Adapter in IT mode (Initiator Target) does none of that. There’s no RAID layer, no volume abstraction, no caching games - just drives, passed straight through to the operating system. It’s what the TrueNAS community has standardised on for over a decade.

The catch is that the card has to be in IT mode, and cards like the H220 ship from the factory in HP’s own firmware. Hence this post.

What The H220 Actually Is

It’s an LSI 9207-8i wearing an HP badge. Same SAS2308 controller, same silicon, different sticker and different firmware.

Two SFF-8087 connectors, each breaking out to four SATA drives with a forward breakout cable - host to target. Reverse cables exist and do the opposite job, and buying the wrong ones is a classic afternoon-waster.

One wrinkle: some H220s are silkscreened 9205-8i rather than 9207-8i. Both carry the SAS2308 and both take the same firmware, so it doesn’t change anything here. The lspci check in Step 1 is what settles it - if it reports SAS2308, you’re in the right place.

Why It’s So Cheap

These shipped by the thousand in HP ProLiant Gen8 servers, and that generation is now being decommissioned en masse. The result is a glut of a component that has no consumer brand recognition, no retail box, and no obvious second life for the average buyer - so it lands on eBay for around thirty quid while a new LSI-branded equivalent costs several times that.

You’re buying surplus enterprise hardware, not a bargain-bin consumer part. That’s an important distinction, because it means the engineering is good and the supply is plentiful; it’s only the marketing that’s worthless.

Why Being Old Doesn’t Matter

This is the part that puts people off, and it shouldn’t. Run the numbers:

• 6Gb/s per port is roughly 600MB/s. A 7200rpm spinning disk manages 200-250MB/s at the outer tracks on a good day.
• PCIe 3.0 x8 is around 7.9GB/s. Eight hard drives all reading flat out might reach 2GB/s between them.

You cannot saturate this card with mechanical drives. It isn’t close. The 6Gb/s figure only becomes a real limit if you’re filling all eight ports with modern SATA SSDs, and if that’s your plan you want different hardware anyway.

The other half of the argument is software. The mpt3sas driver has been in mainline Linux for years, it’s what every TrueNAS installation exercises daily, and it’s the configuration that actually gets tested by the people who’d notice a problem. Novelty is not a virtue in a storage controller.

The Honest Caveats

• It runs hot. These were designed for server chassis with aggressive front-to-back airflow, and the passive heatsink gets genuinely toasty in a quiet desktop case. Check temperatures after a scrub. A 40mm fan zip-tied to the heatsink is the standard fix.
• It draws 10-15W at idle, round the clock. Not nothing on an always-on box.
• It needs a real x8 slot (or an x16). An x1 slot won’t physically take it.
• Spin-down is unreliable. LSI controllers in IT mode are historically indifferent to drive standby, so if you were relying on your drives parking themselves, that may stop happening.

What To Avoid

• Anything Marvell 88SE92xx based - a long and unhappy history with ZFS.
• Anything advertising a port multiplier, or claiming eight or ten SATA ports on a single PCIe lane. That last one is the clearest red flag on the market.
• RAID cards that can’t be flashed to IT mode at all. Plenty of cheap controllers are RAID-only by design.

If you genuinely only have a PCIe x1 slot to work with, the sane alternatives are an ASM1166 (6 ports) or JMB585 (5 ports). Both are real AHCI controllers with no port multiplier trickery, and both draw far less power than an LSI. The trade-off is that PCIe 2.0 x1 gives you about 500MB/s shared across every drive on the card - fine for media playback, tight during a resilver.

What You’re Actually Dealing With

An HP H220 is an LSI 9207-8i with HP firmware and, crucially, an HP subsystem ID of 0x41. The LSI firmware image you want to flash carries a subsystem ID of 0x3020.

From P15 onwards, sas2flash compares the two and refuses to proceed if they don’t match. You get this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
        Executing Operation: Flash Firmware Image

                Firmware Image has a Valid Checksum.
                Firmware Version 20.00.07.00
                Firmware Image compatible with Controller.

                Valid NVDATA Image found.
                NVDATA Version 14.01.00.00
        Checking for a compatible NVData image...

        NVDATA Device ID and Chip Revision match verified.
        ERROR: NVDATA Image does not match Controller SubSystem ID!
                NVDATA Subsystem ID: 0x3020
                Controller Subsystem ID: 0x41

        ERROR: No compatible NVDATA Image(s) found!

                Firmware Image Validation Failed!

P14 is the last version of sas2flash without that check - and as far as I can tell, Broadcom only ever shipped P14 for MS-DOS, Windows and Linux. There is no P14 build of sas2flash.efi. That’s the trap: the UEFI route is the one every guide recommends, and it’s the one route that categorically cannot flash this card.

lsiutil does not perform the subsystem ID check at all. That’s the whole trick, and it’s why this post exists.

What You’ll Need

Broadcom’s downloads are on the Downloads tab of the product page and don’t need an account. Despite the MS-DOS and Windows naming, the firmware .bin inside that package is just a firmware image - it’s the same file whatever OS you flash from.

A word on finding lsiutil. This is the awkward one. It’s the tool that makes the whole job possible, and Broadcom stopped distributing it after acquiring LSI, so there’s no official download any more. It survives on community mirrors, forum attachments and GitHub archives of varying completeness. Version 1.72 is the one you want, and you need the Linux x86_64 build. If you track down a copy, hang onto it - I keep mine alongside the firmware on the NAS for exactly this reason.

You do not need a UEFI shell, a FreeDOS USB stick, or any physical access beyond installing the card.

A Note On Firmware Versions

P20 20.00.07.00 is both the latest and the last firmware for this chip. The SAS2 generation is end-of-life; Broadcom stopped development after P20, released in February 2016. There’s nothing newer to miss out on.

The reason everyone writes the full point release rather than just “P20” is that P20 shipped as several builds. Versions 20.00.00.00 through 20.00.02.00 had real problems including drives dropping off the bus. 20.00.04.00 fixed the worst of it, and 20.00.07.00 is the final, settled build. A card advertised on eBay as “P20 IT mode” isn’t automatically on the right one, so check.

There’s a second reason for precision: the Linux mpt3sas driver and the card firmware negotiate closely, and a mismatch tends to produce intermittent, awkward-to-diagnose faults rather than clean failures.

Step 1: Identify The Card And Record The SAS Address

Install the card and boot normally. HP firmware works fine, so the driver will attach and everything below can be done over SSH.

1
2
3
sudo lspci -nn | grep -i -e sas -e lsi
cat /sys/class/scsi_host/host*/version_fw
cat /sys/class/scsi_host/host*/host_sas_address

1
2
3
01:00.0 Serial Attached SCSI controller [0107]: Broadcom / LSI SAS2308 PCI-Express Fusion-MPT SAS-2 [1000:0087] (rev 05)
15.10.05.00
0x500605b009ce9ca0

Three things to check here:

• SAS2308 and PCI ID 1000:0087 confirms it’s an H220 and that 9207-8.bin is the correct firmware. If you see SAS2008 instead, you have an H200 or H210 and you want 2118it.bin from the 9211-8i package.
• 15.10.05.00 is typical HP stock firmware. Note the OEM-style version number - genuine LSI releases look like 15.00.00.00.
• Write down the SAS address. It is unique to each card. If you’re doing two cards, do not reuse the first one’s address on the second; two controllers sharing a SAS address causes problems that are miserable to diagnose.

If you have more than one of these cards, do them one at a time with only that card installed. Otherwise the controller index becomes ambiguous and you risk flashing the wrong one.

Step 2: Flash The Firmware With lsiutil

Put lsiutil and 9207-8.bin somewhere executable. On TrueNAS that means a pool dataset or /root - not /tmp or a mounted USB stick, which are often noexec.

1
2
chmod +x lsiutil
sudo ./lsiutil

Select the controller, then option 2 - Download firmware (update the FLASH):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
LSI Logic MPT Configuration Utility, Version 1.72, Sep 09, 2014

1 MPT Port found

     Port Name         Chip Vendor/Type/Rev    MPT Rev  Firmware Rev  IOC
 1.  ioc0              LSI Logic SAS2308 D1      200      0f0a0500     0

Select a device:  [1-1 or 0 to quit] 1

Main menu, select an option:  [1-99 or e/p/w or 0 to quit] 2

Enter firmware filename: 9207-8.bin
Firmware image's version is MPTFW-20.00.07.00-IT
  LSI Logic
  Not Packaged Yet
  MPTFW-20.00.07.00-BL
  LSI Logic
  Not Packaged Yet

Do you want to continue?  [Yes or No, default is No] Yes

Downloading image...
Download succeeded

Verifying download...
Verification succeeded

No subsystem ID complaint, no override flags, no drama. Don’t touch anything while it runs, and don’t power off.

Quit out with 0 twice, then reboot so the driver picks up the new firmware.

1
cat /sys/class/scsi_host/host*/version_fw

1
20.00.07.00

Step 3: Remove The Boot ROM

This step is optional, but if the card isn’t your boot device there’s no reason to keep the option ROM. Removing it kills the MPT2BIOS splash screen and cuts a noticeable chunk off your POST time, because the ROM scans the SAS bus and waits for drives to spin up on every single boot.

The Linux build of sas2flash can flash but cannot erase, which is why most guides send you to a UEFI shell at this point. You don’t need to - lsiutil option 4 does it.

1
sudo ./lsiutil

Select the device, then option 4 - Download/erase BIOS and/or FCode (update the FLASH). The utility tells you exactly how to erase rather than download:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Main menu, select an option:  [1-99 or e/p/w or 0 to quit] 4

To erase an image:
  1.  hit RETURN when asked for a image file name
  2.  answer No if asked to preserve an existing image

Enter x86 BIOS filename:
Current x86 BIOS image's version is MPT2BIOS-7.25.06.00 (2013.08.31)
  7.25.06(2013.08.31)-BIOS
  LSI Corporation
  7.25.06.00(2013.08.30)-CU IR exe@(#)LSI Corporation
  7.25.06.00(2013.08.31)-CU
  LSI Corporation
  7.25.06.00(2013.08.31)-CU
  LSI Corporation

Do you want to preserve the current x86 BIOS?  [Yes or No, default is Yes] No

Enter FCode filename:
No FCode image exists in FLASH, and image won't be downloaded

Enter EFI BIOS filename:
No EFI BIOS image exists in FLASH, and image won't be downloaded

Do you want to continue?  [Yes or No, default is No] Yes

Downloading image...
Download succeeded

So: Return at the x86 BIOS filename prompt, No to preserving it, Return through the FCode and EFI prompts, then Yes to continue.

Step 4: Verify

1
sudo ./sas2flash -c 0 -list

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
        Controller Number              : 0
        Controller                     : SAS2308_2(D1)
        PCI Address                    : 00:01:00:00
        SAS Address                    : 500605b-0-09ce-9ca0
        NVDATA Version (Default)       : 14.01.00.06
        NVDATA Version (Persistent)    : 14.01.00.06
        Firmware Product ID            : 0x2214 (IT)
        Firmware Version               : 20.00.07.00
        NVDATA Vendor                  : LSI
        NVDATA Product ID              : SAS9207-8i
        BIOS Version                   : N/A
        UEFI BSD Version               : N/A
        FCODE Version                  : N/A
        Board Name                     : H220
        Board Assembly                 : H3-25278-05D
        Board Tracer Number            : SV44735056

What you’re looking for:

Board Name will still say H220, and that’s fine. That string lives in the card’s manufacturing region, which nothing in this process touches. The firmware and NVDATA are what matter, and both now say LSI.

Finally, check the driver is happy and your drives are visible:

1
2
3
sudo dmesg | grep -i mpt3sas
lsblk
sudo smartctl -a /dev/sda | head -20

That last one is the real payoff of IT mode - SMART data passing straight through to the host, which you need for any kind of drive health monitoring.

If Your Card Arrives With A Blank Flash

lsiutil works through the kernel driver, and the driver won’t attach to a card with no working firmware. If you’ve bought a card someone else half-flashed, or you’ve erased it yourself before reading this, you’re in a chicken-and-egg situation: the flasher needs the driver, the driver needs firmware, and the firmware needs the flasher.

lsirec solves it. It mmaps the controller’s PCI BAR directly - no driver, no working firmware required - and can load a firmware image into the card’s RAM and start it.

TrueNAS has no compiler and its package manager is deliberately disabled, so build it elsewhere. I used a Debian LXC container, then copied the binary across:

1
2
3
4
sudo apt update && sudo apt install -y build-essential git python3
git clone https://github.com/marcan/lsirec.git
cd lsirec && make LDFLAGS=-static
file lsirec      # must say "statically linked"

Static linking matters - TrueNAS’s glibc is older than Debian’s and a dynamically linked binary may refuse to run.

Then on the TrueNAS host:

1
2
3
4
sudo ./lsirec 0000:01:00.0 reset
sudo ./lsirec 0000:01:00.0 unbind
sudo ./lsirec 0000:01:00.0 halt
sudo ./lsirec 0000:01:00.0 hostboot 9207-8.bin

1
2
3
4
5
6
7
8
9
10
11
12
13
Device in MPT mode
Resetting adapter in HCB mode...
Trying unlock in MPT mode...
Device in MPT mode
IOC is RESET
Setting up HCB...
HCDW virtual: 0x7efe3d600000
HCDW physical: 0x218600000
Loading firmware...
Loaded 809436 bytes
Booting IOC...
IOC is READY
IOC Host Boot successful.

hostboot doesn’t rebind the driver, so do that by hand:

1
2
echo -n "0000:01:00.0" | sudo tee /sys/bus/pci/drivers/mpt3sas/bind
sudo dmesg | tail -20

You want to see mpt3sas attaching with FWVersion(20.00.07.00). At that point the card is alive, the driver is bound, and you can run lsiutil exactly as in Step 2 to write the firmware to flash properly.

The hostbooted firmware lives only in RAM. Don’t reboot until lsiutil reports success, or you’re back where you started.

Things That Don’t Work

Every one of these was tried and failed on an HP H220. If you find a guide recommending one, this is why it won’t help you.

• sas2flash.efi P15, P16 or P20 - fails the subsystem ID check described above.
• sas2haxp20.efi - the community-patched build that skips vendor verification. Same error. Worth two minutes to try, but don’t pin your hopes on it.
• The -nossid flag - documented by Broadcom for the SAS3 tool, but not implemented in sas2flash P20 for SAS2. Returns an invalid command error.
• P14 UEFI - doesn’t exist. P14 was only ever shipped for MS-DOS, Windows and Linux.
• Linux sas2flash on a card with a blank flash - No LSI SAS adapters found!. It works through the kernel driver, and the driver won’t attach to a card with no firmware.
• Linux sas2flash after a hostboot - ERROR: Failed to Upload Image!. It tries to read the existing flash image before writing, and an erased flash has nothing to read.
• sbrtool.py - this one deserves a warning. It’s the companion tool to lsirec for rewriting the SBR, which is where the subsystem ID lives. It misparses the SAS2308 layout. On my card it reported the PCI vendor ID as HwConfig and the PCI device ID as SubsysVID, with every field offset by six bytes. Writing its output back would have overwritten the PCI identifiers, and a card with corrupt PCI IDs doesn’t enumerate at all - it vanishes from lspci, taking lsirec’s own access with it. It was written for the SAS2008 and the SAS2308 lays the structure out differently. Do not use it on a 2308.
• FreeDOS with sas2flsh P10 or P14 - Failed to initialize PAL, even booted fully legacy with CSM enabled and no UEFI boot entry available. I never resolved this. The two documented causes are a missing XMS memory manager (boot FreeDOS with HIMEMX or JEMMEX loaded rather than the minimal option) and Above 4G Decoding being enabled in the motherboard BIOS. Neither fixed it for me, and by that point lsiutil had already done the job.

The Short Version

What You Need

The Process

1
2
3
4
5
6
7
8
9
10
11
12
13
# 1. Record the SAS address first - it's unique to each card
cat /sys/class/scsi_host/host*/host_sas_address

# 2. Flash the firmware (lsiutil option 2, file: 9207-8.bin)
sudo ./lsiutil

# 3. Reboot

# 4. Erase the boot ROM (lsiutil option 4, Return / No / Return / Return / Yes)
sudo ./lsiutil

# 5. Verify
sudo ./sas2flash -c 0 -list

The single most important thing: don’t erase the flash first. Everything that went wrong the first time traces back to that one decision. Erasing killed the driver, which killed every Linux tool, which left only the UEFI flasher - the one thing that refuses HP cards. Flash the new firmware while the card still has working HP firmware on it, and the whole problem disappears.

Was It Worth It?

For the second card: absolutely, it took twenty minutes. For the first: I learned considerably more about the MPT firmware stack than I ever wanted to, and I now have two identical HBAs running current firmware with no boot ROM, eight ports apiece, and SMART passthrough working properly.

At around £30 a card for something that would cost three or four times that new, the H220 remains a bargain for a TrueNAS build - as long as you know about the subsystem ID lock before you start, rather than after you’ve erased the flash.

If you liked this post please consider following me on Instagram or BlueSky!