Goldshell – Firmware Downgrade / Rollback Method

Confirm the regression with a clean cold-boot and 20-minute observation window. Pull AC for 30 seconds, power up, wait 20 minutes, re-check the metric (hashrate at pool, reject rate, `chip init` log line, fan curve, target-temp behavior). Goldshell upgrades occasionally need one full reboot cycle to re-tune the chip voltage table — a regression at minute 5 is sometimes an unfinished post-update tuning run. If still regressed after cold boot + 20 min, proceed.

Locate the older firmware `.zip` for your exact model and hardware revision. Sources in priority order: your local archive folder; the GitHub goldshellminer/firmware repo for releases and historical commits; the Goldshell support helpdesk which emails older builds on request with serial-number verification; community archives on VoskCoinTalk and BitcoinTalk. Verify SHA256 against any community-published hash before flashing — never flash a `.zip` from an untrusted source.

Connect the miner via wired ethernet — never WiFi. Goldshell Zendesk KB 16805936980633 is explicit on this rule. WiFi packet loss during upload truncates the `.zip`, the upgrade script writes a corrupted image to eMMC, and a clean rollback becomes a brick. Run an ethernet cable. No exceptions.

Take a screenshot of every settings page in the current firmware before you flash. Pool URL, worker name, password, frequency overrides, target temperature, fan curve, miner name, IP configuration. Settings persistence across firmware versions is imperfect in either direction — you'll want originals to restore from.

Open the web UI → Settings → System Update (or Firmware Upgrade depending on model and version) → upload the older `.zip` → click Upgrade. Do not refresh the browser tab. Do not close it. Set a 15-minute timer from the last progress-bar advance. Goldshell's upgrade flow goes silent during the eMMC write phase — the bar can sit at 66% or 89% for 8–12 minutes. Pulling power early is the leading cause of mid-rollback bricks.

After the miner reboots, cold-boot one more time — pull AC for 30 seconds, power back up. Verify the new firmware version string in the web UI matches your target. If it matches, the rollback succeeded at the web-UI tier.

Restore your configuration manually from the screenshots taken in Step 4. Pool URL, worker, password, frequency, target temp, fan curve. Save and apply each section, then cold-boot once more. Confirm the miner is hashing at the pool with your worker name showing.

Run a 24-hour burn-in window before declaring victory. Watch the regression metric. Hashrate should be back to pre-upgrade baseline within 1%. Reject rate should drop back to baseline. Log lines that appeared post-upgrade should be gone or back to pre-upgrade frequency.

Archive both firmware versions to your local disk in a structured folder — one folder per model, one subfolder per version, with the `.zip` and a SHA256SUMS text file containing the hash. Future you will need this. The day Goldshell ships a regression on a model you depend on, the older `.zip` is gone from their site within the same release cycle.

Document the rollback in your fleet log. Date, model, serial, from-version, to-version, regression observed, time-to-rollback, post-rollback verification metrics. If you run more than two Goldshell miners, this log is what tells you whether to skip a future release across the fleet or roll out gradually.

If the web UI rejected your older `.zip` with a signature error, you're on Pro / II silicon (KD-MAX, LT6, CK6, KD-BOX II, AL-BOX II) with stricter verification, OR Goldshell rotated the signing key between your installed and target versions. The web UI path is closed. Don't keep retrying. Move to SD-card recovery.

Email Goldshell support at support@goldshell.com (or open a helpdesk ticket) with: miner serial number, current firmware version, target firmware version, and short justification (regression description). Request the `burn-<model>-<version>.img` SD-card recovery image for the target version. Goldshell distributes these by email, not via the public download page. Response time typically 1–5 business days.

Prepare the microSD card — minimum 8 GB, ideally a known-good brand (SanDisk Industrial, Samsung Endurance) rather than a generic noname card. Generics are responsible for a meaningful share of recovery failures because they don't sustain the write throughput needed for the eMMC overwrite. Use balenaEtcher to flash the `.img` onto the SD; `dd` works too if you're on Linux and comfortable with raw block writes, but Etcher's verification step catches truncated images before you waste a recovery attempt.

Power off the miner. Insert the microSD into the slot on the control board (underside on KD-BOX family; remove bottom cover on Mini-DOGE). Power on. The miner will boot from the SD, detect the recovery image, and overwrite eMMC with the target firmware. Takes 8–15 minutes depending on model. Both LEDs typically alternate during the write — this is the recovery-running pattern, not a brick. Do not pull power.

When both LEDs return to a steady normal pattern (typically green-solid for hashing models), power off, remove the SD card, power back on. The miner now boots from the freshly-overwritten eMMC and you're on the target firmware. Restore your config from screenshots (Step 7). Run the 24-hour burn-in (Step 8).

Stop DIY: two failed SD-card recovery attempts with a verified `burn-<model>.img` and a known-good microSD; OR signature rejection on the web UI AND Goldshell support unable to provide the `burn-*.img` for the target version; OR rollback succeeded but the regression is still present. You're past what's recoverable from the operator side. Book a D-Central ASIC Repair slot.

D-Central bench process for Goldshell rollback recovery: per-model firmware archive going back as far as we have legitimate `.zip` and `burn-*.img` sources; serial-console adapters and pinout documentation for direct U-Boot intervention on KD-BOX, Mini-DOGE, HS-BOX, ST-BOX, CK-BOX, KA-BOX; working relationships with Goldshell support to source `burn-*.img` images when the public path fails. eMMC chip replacement if write failures indicate worn flash.

Ship the miner safely: anti-static bag for the control board, double-boxed with at least 5 cm of foam, include a written note with current firmware version, target firmware version, what you've already attempted (web UI flash result, SD-card flash result), and the regression you observed. The note saves us diagnostic time, which saves you money.