Welcome! Log In Create A New Profile

Advanced

Hacking into a stock GoFlexHome unit

Posted by balanga 
Forum List Message List New Topic
balanga
Hacking into a stock GoFlexHome unit
January 29, 2018 05:07PM
I've just acquired another GoFlexHome unit which is still running the stock software.

What's the most straightforward way of getting a new uBoot onto it?

I don't really want to follow the Arch Linux instructions here :-

https://archlinuxarm.org/platforms/armv5/seagate-goflex-home
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 29, 2018 11:58PM
balanga ,

> What's the most straightforward way of getting a
> new uBoot onto it?
>
> I don't really want to follow the Arch Linux
> instructions here :-
>
> https://archlinuxarm.org/platforms/armv5/seagate-goflex-home

That instruction is pretty good. But if you don't want to proceed to far into Arch Linux installation then try to gain SSH as instructed:

Quote

ssh USERNAME_hipserv2_seagateplug_XXXX-XXXX-XXXX-XXXX@GOFLEX_HOME_IP
Gain root access:
sudo -E -s

Once you've connected with SSH and gained root inside the stock OS, you can easily proceed to install new Debian rootfs, and my new u-boot. So do that first.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
habibie
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 08:36AM
bodhi Wrote:
-------------------------------------------------------
> Once you've connected with SSH and gained root inside the stock OS, you can easily proceed to install new Debian rootfs, and my new u-boot.
>
Bodhi,

Where do I download the new debian rootfs?

This debian armel ISO-CD only has both the netinst and/or xfce ISO and I gather it requires a USB-CDROM to install, right?

I still have one Seagate GoFLEX/Home with a 3TB SATA HDD that I can try.
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 11:04AM
bodhi Wrote:
-------------------------------------------------------
> balanga ,
>
> > What's the most straightforward way of getting
> a
> > new uBoot onto it?
> >
> > I don't really want to follow the Arch Linux
> > instructions here :-
> >
> >
> https://archlinuxarm.org/platforms/armv5/seagate-goflex-home
>
> That instruction is pretty good. But if you don't
> want to proceed to far into Arch Linux
> installation then try to gain SSH as instructed:
>
>
Quote

ssh
> USERNAME_hipserv2_seagateplug_XXXX-XXXX-XXXX-XXXX@GOFLEX_HOME_IP
> Gain root access:
> sudo -E -s
>
> Once you've connected with SSH and gained root
> inside the stock OS, you can easily proceed to
> install new Debian rootfs, and my new u-boot. So
> do that first.

I seem to be having a hard time with these units :(....

This one doesn't boot properly, although I'm sure it did earlier. Now the green led never stops blinking. I tried upgrading the firmware but just ended up with a steady orange.

I tried a serial connection but nothing showed up, but eventually I jiggled the wires around which seemed to wake the thing up.
Here's what I got:- 
Connected


	 -- NAS EXPLORER --
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** QSI BOARD: NAS-PLUG LE 

U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27
QSI NAS version: 1.0.4

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 128MB 
DRAM Total size 128MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 0x100000, size 0x600000

Reading data from 0x6ff800 -- 100% complete.
 6291456 bytes read: OK
## Booting image at 00800000 ...
   Image Name:   Linux-2.6.22.18
   Created:      2010-06-17   5:37:59 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2095148 Bytes =  2 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux.................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (ramang@es5x86.axentra.com) (gcc version 4.3.2 (sdk3.2rc1-ct-ng-1.4.1) ) #16 Thu Jun 17 01:37:53 EDT 2010
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 32512
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 125568KB available (3844K code, 261K data, 128K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB 
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB 

  Marvell Development Board (LSP Version KW_LSP_4.3.4_patch22)-- SHEEVA PLUG  Soc: 88F6281 A1 LE

 Detected Tclk 200000000 and SysClk 400000000 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c057b600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
RTC has been updated!!!
RTC registered
XOR registered 2 channels
XOR 2nd invalidate WA enabled
cesadev_init(c0011854)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
JFFS2 version 2.2. (NAND) ���� 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload enabled
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported
  o SKB Recycle supported
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
    o  register under eth%d platform
    o eth0, ifindex = 1, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c7e17000): 1024 entries, 4096 bytes
Intel(R) PRO/1000 Network Driver - version 7.3.20-k2-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.17-k4-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00700000 : "uImage"
0x00700000-0x10000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "root"
UBI: MTD device size:            249 MiB
UBI: number of good PEBs:        1992
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 1992
UBI: number of PEBs reserved for bad PEB handling: 38
UBI: max/mean erase counter: 4/0
UBI: background thread "ubi_bgt0d" started, PID 296
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
usb 1-1: new high speed USB device using ehci_marvell and address 2
usb 1-1: configuration #1 chosen from 1 choice
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
scsi2 : SCSI emulation for USB Mass Storage devices
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
Linux telephony interface: v1.00
Marvell Telephony Driver:

Warning Tdm is Powered Off
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     91 MB/s
raid6: int32x2    109 MB/s
raid6: int32x4    119 MB/s
raid6: int32x8     94 MB/s
raid6: using algorithm int32x4 (119 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :  1084.400 MB/sec
   8regs     :   822.000 MB/sec
   32regs    :   803.200 MB/sec
raid5: using function: arm4regs (1084.400 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
UBIFS: recovery needed
UBIFS error (pid 1): layout_cnodes: LPT out of space
[<c00f2e84>] (dump_stack+0x0/0x14) from [<c021d0a8>] (ubifs_lpt_start_commit+0x700/0x764)
[<c021c9a8>] (ubifs_lpt_start_commit+0x0/0x764) from [<c0211058>] (do_commit+0xc8/0x6f8)
[<c0210f90>] (do_commit+0x0/0x6f8) from [<c0211714>] (ubifs_run_commit+0x8c/0xa0)
 r8:c0561c18 r7:c7e78000 r6:00000678 r5:c7ed0084 r4:c7ed0000
[<c0211688>] (ubifs_run_commit+0x0/0xa0) from [<c021a008>] (ubifs_rcvry_gc_commit+0x218/0x228)
 r5:c7ed0000 r4:00000000
[<c0219df0>] (ubifs_rcvry_gc_commit+0x0/0x228) from [<c0206f4c>] (ubifs_get_sb+0xc50/0xfe8)
 r8:c7e78200 r7:00000000 r6:0001e5a0 r5:00000001 r4:00000000
[<c02062fc>] (ubifs_get_sb+0x0/0xfe8) from [<c01664cc>] (vfs_kern_mount+0x58/0x94)
[<c0166474>] (vfs_kern_mount+0x0/0x94) from [<c0166564>] (do_kern_mount+0x3c/0xd8)
 r8:c03f8648 r7:c7f51000 r6:00000000 r5:c7f53000 r4:00008000
[<c0166528>] (do_kern_mount+0x0/0xd8) from [<c017c8ac>] (do_mount+0x578/0x5c8)
 r9:00000000 r8:00008000 r7:c7f53000 r6:00000000 r5:00000000
r4:00008000
[<c017c334>] (do_mount+0x0/0x5c8) from [<c017c988>] (sys_mount+0x8c/0xd4)
[<c017c8fc>] (sys_mount+0x0/0xd4) from [<c0008d84>] (do_mount_root+0x28/0xb0)
 r7:00008000 r6:c05e7000 r5:c0023858 r4:c05e7000
[<c0008d5c>] (do_mount_root+0x0/0xb0) from [<c000900c>] (mount_block_root+0x100/0x220)
 r4:c05e7000
[<c0008f0c>] (mount_block_root+0x0/0x220) from [<c00092cc>] (prepare_namespace+0xa4/0x170)
 r8:00000000 r7:c0560000 r6:00000000 r5:c0023858 r4:c0023864
[<c0009228>] (prepare_namespace+0x0/0x170) from [<c00085fc>] (kernel_init+0x240/0x29c)
 r5:c00223a4 r4:c040e300
[<c00083bc>] (kernel_init+0x0/0x29c) from [<c01256f8>] (do_exit+0x0/0x7f0)
UBIFS error (pid 1): do_commit: commit failed, error -28
UBIFS warning (pid 1): ubifs_ro_mode: switched to read-only mode, error -28
VFS: Cannot open root device "ubi0:rootfs" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
1f00       1024 mtdblock0 (driver?)
1f01       6144 mtdblock1 (driver?)
1f02     254976 mtdblock2 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Is there anything I can do with this?
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 01:27PM
The stock FW in NAND seems to be corrupted. You can do factory reset:

http://support.goflexhome.hipserv.com/en/reflash/index.html

Quote

I tried a serial connection but nothing showed up, but eventually I jiggled the wires around which seemed to wake the thing up.

Be careful, don't brick another the serial header :) You did not wake it up. The serial connection was not done properly so you did not see output, but this should have nothing to do with whether the box is booting or not.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 01:29PM
habibie Wrote:
-------------------------------------------------------
> bodhi Wrote:
> -------------------------------------------------------
> > Once you've connected with SSH and gained root
> inside the stock OS, you can easily proceed to
> install new Debian rootfs, and my new u-boot.
> >
> Bodhi,
>
> Where do I download the new debian rootfs?

Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2

From the release thread:
https://forum.doozan.com/read.php?2,12096

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 03:04PM
bodhi Wrote:
-------------------------------------------------------
> The stock FW in NAND seems to be corrupted. You
> can do factory reset:
>
> http://support.goflexhome.hipserv.com/en/reflash/index.html
>
>
Quote

I tried a serial connection but nothing
> showed up, but eventually I jiggled the wires
> around which seemed to wake the thing up.
>
>
> Be careful, don't brick another the serial header
> :) You did not wake it up. The serial connection
> was not done properly so you did not see output,
> but this should have nothing to do with whether
> the box is booting or not.

I've already tried a factory reset about five times but they end up with a solid orange light.

I notice the boot process shows:-

Quote

Hit any key to stop autoboot: 0

Is there anything I can enter there?
Reply Quote
daviddyer
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 03:15PM
Sometimes any key means "enter". Since you have serial cable, you should be able to stop autoboot and enter the old uboot. Power it on with serial cable, then press enter until you see Marvell
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 04:22PM
balanga,

At this point you should:

1. kwboot it using uboot.2017.07-tld-1.goflexhome.bodhi.tar. And while this u-boot running, boot the rootfs Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2

2. Inside the Debian rootfs, flash this uboot.2017.07-tld-1 image and its default env image.

Once you have this Debian rootfs running, and the new u-boot in NAND working, you can then proceed to play with booting FreeBSD (kwboot the version that has the bootelf and API).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 06:37PM
root Access to GoFlex Home without Registering Device

Just posting this link for reference, so I don't lose it....

https://archlinuxarm.org/forum/viewtopic.php?f=53&t=4334
Reply Quote
daviddyer
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 07:34PM
Well, in my experience with dockstar, when you connect serial cable, let the stock system boot, your serial console will boot into system with root...No login / password needed!
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 09:42PM
daviddyer Wrote:
-------------------------------------------------------
> Well, in my experience with dockstar, when you
> connect serial cable, let the stock system boot,
> your serial console will boot into system with
> root...No login / password needed!

True. All these Kirkwood plugs are like that. However, balanga's box has a corrupted stock rootfs.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
habibie
Re: Hacking into a stock GoFlexHome unit
January 30, 2018 10:53PM
bodhi Wrote:
-------------------------------------------------------
> Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2
>
>
> From the release thread:
> https://forum.doozan.com/read.php?2,12096
>
Bodhi,

Thank you.
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 12:52AM
bodhi,

bodhi Wrote:
-------------------------------------------------------
> daviddyer Wrote:
> -------------------------------------------------------
> > Well, in my experience with dockstar, when you
> > connect serial cable, let the stock system
> boot,
> > your serial console will boot into system with
> > root...No login / password needed!
>
> True. All these Kirkwood plugs are like that.
> However, balanga's box has a corrupted stock
> rootfs.

I got to the bottom of this:- 
	 -- NAS EXPLORER --
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** QSI BOARD: NAS-PLUG LE 

U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27
QSI NAS version: 1.0.4

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 128MB 
DRAM Total size 128MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
<Explorer> Enter USB firmware instllation by RESET IO.
USB:   scanning bus for devices... 2 USB Device(s) found
1 Storage Device(s) found
reading uImage
...
...............................................................................................................................................................................................................
Device NOT ready
   Request Sense returned 00 00 00

2359296 bytes read
Device NOT ready
   Request Sense returned 00 00 00
** Can't read from device 0 **

** Unable to use usb 0:1 for fatload **
<Explorer> Firmware installation error(4)!
<Explorer> Please power off system retry again!

I tried installing the firmware on a different USB stick and it worked!
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 01:03AM
daviddyer Wrote:
-------------------------------------------------------
> Well, in my experience with dockstar, when you
> connect serial cable, let the stock system boot,
> your serial console will boot into system with
> root...No login / password needed!

That is not my experience. Here is a full boot log with attempt to login as root with no password. This is a GoFlexHome so it may be different to a dockstar. 

	 -- NAS EXPLORER --
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** QSI BOARD: NAS-PLUG LE 

U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27
QSI NAS version: 1.0.4

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz 

DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 128MB 
DRAM Total size 128MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled 
Write allocate disabled


USB 0: host mode
PEX 0: interface detected no Link.
Net:   egiga0 [PRIME]
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 0x100000, size 0x600000

Reading data from 0x6ff800 -- 100% complete.
 6291456 bytes read: OK
## Booting image at 00800000 ...
   Image Name:   Linux-2.6.22.18
   Created:      2010-06-17   5:37:59 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2095148 Bytes =  2 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux.................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (ramang@es5x86.axentra.com) (gcc version 4.3.2 (sdk3.2rc1-ct-ng-1.4.1) ) #16 Thu Jun 17 01:37:53 EDT 2010
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 32512
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 125568KB available (3844K code, 261K data, 128K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB 
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB 
PEX0_IO ....base f2000000, size   1MB 
INTER_REGS ....base f1000000, size   1MB 
NFLASH_CS ....base fa000000, size   2MB 
SPI_CS ....base f4000000, size  16MB 
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB 

  Marvell Development Board (LSP Version KW_LSP_4.3.4_patch22)-- SHEEVA PLUG  Soc: 88F6281 A1 LE

 Detected Tclk 200000000 and SysClk 400000000 
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c057b600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
RTC registered
XOR registered 2 channels
XOR 2nd invalidate WA enabled
cesadev_init(c0011854)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
JFFS2 version 2.2. (NAND) ���� 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload enabled
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o SKB Reuse supported
  o SKB Recycle supported
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
    o  register under eth%d platform
    o eth0, ifindex = 1, GbE port = 0

Warning: Giga 1 is Powered Off

mvFpRuleDb (c7da7000): 1024 entries, 4096 bytes
Intel(R) PRO/1000 Network Driver - version 7.3.20-k2-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.17-k4-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00700000 : "uImage"
0x00700000-0x10000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "root"
UBI: MTD device size:            249 MiB
UBI: number of good PEBs:        1992
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 1992
UBI: number of PEBs reserved for bad PEB handling: 38
UBI: max/mean erase counter: 1/0
UBI: background thread "ubi_bgt0d" started, PID 296
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
Linux telephony interface: v1.00
Marvell Telephony Driver:

Warning Tdm is Powered Off
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     91 MB/s
raid6: int32x2    109 MB/s
raid6: int32x4    119 MB/s
raid6: int32x8     94 MB/s
raid6: using algorithm int32x4 (119 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :  1072.400 MB/sec
   8regs     :   822.000 MB/sec
   32regs    :   803.200 MB/sec
raid5: using function: arm4regs (1072.400 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   239857664 bytes (234236 KiB, 228 MiB, 1889 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       4 (latest is 4)
UBIFS: default compressor: zlib
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem).
Freeing init memory: 128K
Failed to execute /linuxrc.  Attempting defaults...
INIT: version 2.86 booting
		Welcome to HipServ
		Press 'I' to enter interactive startup.
Setting clock : Sun Jan  2 08:31:05 EST 2000 [  OK  ]
Starting udev: [  OK  ]
Setting hostname axentraserver.localdomain:  [  OK  ]
Setting up Logical Volume Management:   No volume groups found
[  OK  ]
Checking filesystems
Checking all file systems.
[  OK  ]
Mounting local filesystems:  mount: sysfs already mounted or /sys busy
mount: according to mtab, /sys is already mounted on /sys
[FAILED]
Enabling /etc/fstab swaps:  [  OK  ]
INIT: Entering runlevel: 3
Entering non-interactive startup
HipServ startup:[  OK  ]
Starting reset:  [  OK  ]
Starting seagate-lifecycle:[  OK  ]
Bringing up loopback interface:  [  OK  ]
Bringing up interface eth0:  
Determining IP information for eth0... done.
/etc/init.d/iptables: line 42: /etc/sysconfig/networking/oe-profiles/default/ifcfg-eth0: No such file or directory
Flushing all current rules and user defined chains: [  OK  ]
Clearing all current rules and user defined chains: [  OK  ]
Applying iptables firewall rules: 
[  OK  ]
[  OK  ]
check_igd.pl: no process killed
Starting igd-daemon:sh: /usr/sbin/oe-gateway-check: No such file or directory
sh: /usr/sbin/oe-gateway-check: No such file or directory
error reading information on service transmission.init: No such file or directory
[  OK  ]
Starting system logger: [  OK  ]
Starting kernel logger: [  OK  ]
Starting locator:[  OK  ]
Starting system message bus: [  OK  ]
Starting sshd: [  OK  ]
Starting cups: [  OK  ]
Starting vsftpd for vsftpd: [  OK  ]
Starting httpd: [  OK  ]
Starting appserver: [  OK  ]
Starting crond: [  OK  ]
Starting Netatalk services: 
  Starting cnid_metad:[  OK  ]
  Starting afpd:[  OK  ]

Starting SMB services: [  OK  ]
Starting NMB services: [  OK  ]
Starting OEone System Proxy: SPD starting....log level=1, uid=0

[  OK  ]
Starting access-patrol:[  OK  ]
Starting Avahi daemon... [  OK  ]
Starting /usr/sbin/minidlna ... 
Starting S99lld2: [  OK  ]
0
Starting DAAP server: [  OK  ]
Starting mynetworkd:[  OK  ]
    HipServ - Checking if RAID needs to be rebuilt
        HipServ - No RAID found
    HipServ - Bringing up iptables
    HipServ - Updating date...
        success
    HipServ - Enabling swap
    HipServ - Cleaning USB mountpoints
    HipServ - Mounting USB devices

    HipServ -  Checking for FTPS certificate
        HipServ - Found vsftpd key file
    HipServ -  Ensuring that table structures are up-to-date
    HipServ - Starting usbreaderd: [  OK  ]
    HipServ - Checking for updates...
        success
HipServ - boot complete
Starting spindownd.init:  [  OK  ]
Starting xMySyncMount.php:  [FAILED]

axentraserver.localdomain login: root
Password: 
Login incorrect

login: ~
[EOT]
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 01:58AM
balanga Wrote:
-------------------------------------------------------
> root Access to GoFlex Home without Registering
> Device
>
> Just posting this link for reference, so I don't
> lose it....
>
> https://archlinuxarm.org/forum/viewtopic.php?f=53&t=4334

Interesting snippet from this link, which I haven't tried yet, but wondered if it would be worth using the latest Debian rootfs instead of ArchLinux... 

Method 2
Through a serial connection using the Arch Linux ARM image:
1. Unpack the latest Arch Linux ARM armv5te files (from ArchLinuxARM-armv5te-latest.tar.gz) to a USB drive
2. Insert the USB drive into the device
3. Establish a serial connection with the device
4. Enter the UBoot environment by hitting a key when prompted with:
CODE: SELECT ALL
Hit any key to stop autoboot:

5. Set the architect number and mainlineLinux environment variables (if they are not already set):
CODE: SELECT ALL
  NAS>> setenv arcNumber 3089
  NAS>> setenv mainlineLinux yes
  NAS>> saveenv
  NAS>> reset

NOTE: The mainlineLinux ?and arcNumber? settings are only checked when U-Boot first starts, so if you change their values you must reset the device.
6. After the reset, enter the UBoot environment and boot the Arch Linux ARM image by running the following commands:
CODE: SELECT ALL
  NAS>> usb start
  NAS>> setenv bootargs console=ttyS0,115200 root=/dev/sda1 rootdelay=10 usb_rootfstype=ext2 mtdparts=orion_nand:1M(u-boot),4M(uImage),32M(rootfs),-(data)
  NAS>> ext2load usb 0:1 0x800000 /boot/uImage
  NAS>> bootm 0x800000
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 02:46AM
balanga,

> axentraserver.localdomain login: root
> Password:
> Login incorrect

Try root/ceadmin or root/stxadmin

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 02:50AM
bodhi Wrote:

Correction:

> Many of these Kirkwood plugs are like that.
> However, balanga's box has a corrupted stock
> rootfs.

The old Kirwood boxes credential is either root/ceadmin or root/stxadmin.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 05:53AM
bodhi Wrote:
-------------------------------------------------------
> balanga,
>
> > axentraserver.localdomain login: root
> > Password:
> > Login incorrect
>
> Try root/ceadmin or root/stxadmin

Thanks, but neither worked... Any other ideas?
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 10:38AM
bodhi Wrote:
-------------------------------------------------------
> balanga,
>
> At this point you should:
>
> 1. kwboot it using
> uboot.2017.07-tld-1.goflexhome.bodhi.tar.
> And while this u-boot running, boot the rootfs
> Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2
>
>
> 2. Inside the Debian rootfs, flash this
> uboot.2017.07-tld-1 image and its default env
> image.

I was surprised that I managed to boot using:-

./kwboot -t -B 115200 /dev/ttyUSB0 -b uboot.2017.05-tld-2.goflexhome.mtd0.kwb -p

so it sounds like I don't even have to login to the stock system before replacing it.

> Once you have this Debian rootfs running, and the
> new u-boot in NAND working, you can then proceed
> to play with booting FreeBSD (kwboot the version
> that has the bootelf and API).

So what is the next target?

I'm not sure which rootfs, kernel and uBoot to use.
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 11:30AM
As I said above:


Quote

At this point you should:

1. kwboot it using uboot.2017.07-tld-1.goflexhome.bodhi.tar. And while this u-boot running, boot the rootfs Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2

2. Inside the Debian rootfs, flash this uboot.2017.07-tld-1 image and its default env image.

Once you have this Debian rootfs running, and the new u-boot in NAND working, you can then proceed to play with booting FreeBSD (kwboot the version that has the bootelf and API).


Use the rootfs Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2 as is. No need to install new kernel. Install uboot.2017.07-tld-1.goflexhome.bodhi.tar.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 12:16PM
I thought I should use

uboot.2017.05-tld-2.goflexhome.mtd0.kwb

that's the one which supports bootelf and the one I almost had working...
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 01:20PM
balanga Wrote:
-------------------------------------------------------
> I thought I should use
>
> uboot.2017.05-tld-2.goflexhome.mtd0.kwb
>
> that's the one which supports bootelf and the one
> I almost had working...

You can kwboot that uboot.2017.05-tld-2 version for testing, after done with installation.

This uboot.2017.05-tld-2.goflexhome is a little bit too big. So a slightly different flashing instruction is needed. Dont use the instruction in the release thread to flash it.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
balanga
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 05:45PM
bodhi Wrote:
-------------------------------------------------------
> balanga Wrote:
> -------------------------------------------------------
> > I thought I should use
> >
> > uboot.2017.05-tld-2.goflexhome.mtd0.kwb
> >
> > that's the one which supports bootelf and the
> one
> > I almost had working...
>
> You can kwboot that uboot.2017.05-tld-2 version
> for testing, after done with installation.
>
> This uboot.2017.05-tld-2.goflexhome is a little
> bit too big. So a slightly different flashing
> instruction is needed. Dont use the instruction in
> the release thread to flash it.

Using uboot.2017.05-tld-2.goflexhome.mtd0.kwb which includes this uEnv.txt:- 

fatdev=usb 0:1
loaderdev=usb 0:1
bootfile=ubldr
fdtfile=db88f6281.dtb
kernel_addr_r=0x01000000
loadaddr=0x02000000
pxefile_addr_r=0x00100000
ramdisk_addr_r=0x02100000
scriptaddr=0x00000000
bootcmd=usb start;fdt addr 0x100;fatload ${fatdev} ${loadaddr} ${bootfile} && bootelf ${loadaddr}

and these commands:- 
setenv load_bsdenv 'usb start; load usb 0:1 0x810000 /boot/uEnv.txt; env import -t 0x810000 $filesize'
setenv boot_bsd 'run load_bsdenv; boot'
printenv
run boot_bsd

I was able to boot up to the FreeBSD loader

FreeBSD/arm U-Boot loader, Revision 1.2 

Sending boot message. Please reboot the target.../
Sending boot image...
  0 % [......................................................................]
  1 % [......................................................................]
  3 % [......................................................................]
  5 % [......................................................................]
  6 % [......................................................................]
  8 % [......................................................................]
 10 % [......................................................................]
 11 % [......................................................................]
 13 % [......................................................................]
 15 % [......................................................................]
 17 % [......................................................................]
 18 % [......................................................................]
 20 % [......................................................................]
 22 % [......................................................................]
 23 % [......................................................................]
 25 % [......................................................................]
 27 % [......................................................................]
 29 % [......................................................................]
 30 % [......................................................................]
 32 % [......................................................................]
 34 % [......................................................................]
 35 % [......................................................................]
 37 % [......................................................................]
 39 % [......................................................................]
 41 % [......................................................................]
 42 % [......................................................................]
 44 % [......................................................................]
 46 % [......................................................................]
 47 % [......................................................................]
 49 % [......................................................................]
 51 % [......................................................................]
 53 % [......................................................................]
 54 % [......................................................................]
 56 % [......................................................................]
 58 % [......................................................................]
 59 % [......................................................................]
 61 % [......................................................................]
 63 % [......................................................................]
 64 % [......................................................................]
 66 % [......................................................................]
 68 % [......................................................................]
 70 % [......................................................................]
 71 % [......................................................................]
 73 % [......................................................................]
 75 % [......................................................................]
 76 % [......................................................................]
 78 % [......................................................................]
 80 % [......................................................................]
 82 % [......................................................................]
 83 % [......................................................................]
 85 % [......................................................................]
 87 % [......................................................................]
 88 % [......................................................................]
 90 % [......................................................................]
 92 % [......................................................................]
 94 % [......................................................................]
 95 % [......................................................................]
 97 % [......................................................................]
 99 % [....................................]
[Type Ctrl-\ + c to quit]


U-Boot 2017.05-tld-2 (Jul 26 2017 - 02:37:42 -0700)
Seagate GoFlex Home

SoC:   Kirkwood 88F6281_A1
DRAM:  128 MiB
WARNING: Caches not enabled
NAND:  256 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E1116 Initialized on egiga0
Hit any key to stop autoboot:  0 
GoFlexHome> setenv load_bsdenv 'usb start; load usb 0:1 0x810000 uenv.txt; env import -t 0x810000 $filesize'
GoFlexHome> setenv boot_bsd 'run load_bsdenv; boot'
GoFlexHome> printenv
api_address=7b12860
arcNumber=3338
baudrate=115200
boot_bsd=run load_bsdenv; boot
bootcmd=run bootcmd_uenv; run scan_disk; run set_bootargs; run bootcmd_exec; reset
bootcmd_exec=run load_uimage; if run load_initrd; then if run load_dtb; then bootm $load_uimage_addr $load_initrd_addr $load_dtb_addr; else bootm $load_uimage_addr $load_initrd_addr; fi; else if run load_dtb; then bootm $load_uimage_addr - $load_dtb_addr; else bootm$load_uimage_addr; fi; fi
bootcmd_uenv=run uenv_load; if test $uenv_loaded -eq 1; then run uenv_import; fi
bootdelay=10
bootdev=usb
console=console=ttyS0,115200
device=0:1
devices=usb ide
disks=0 1 2 3
dtb_file=/boot/dts/kirkwood-goflexhome.dtb
ethact=egiga0
ethaddr=52:3b:20:9c:11:51
if_netconsole=ping $serverip
ipaddr=192.168.0.231
led_error=orange blinking
led_exit=green off
led_init=green blinking
load_bsdenv=usb start; load usb 0:1 0x810000 uenv.txt; env import -t 0x810000 $filesize
load_dtb=echo loading DTB $dtb_file ...; load $bootdev $device $load_dtb_addr $dtb_file
load_dtb_addr=0x1c00000
load_initrd=echo loading uInitrd ...; load $bootdev $device $load_initrd_addr /boot/uInitrd
load_initrd_addr=0x1100000
load_uimage=echo loading uImage ...; load $bootdev $device $load_uimage_addr /boot/uImage
load_uimage_addr=0x800000
mainlineLinux=yes
mtdids=nand0=orion_nand
mtdparts=mtdparts=orion_nand:1M(u-boot),4M(uImage),32M(rootfs),-(data)
partition=nand0,2
preboot_nc=run if_netconsole start_netconsole
scan_disk=echo running scan_disk ...; scan_done=0; setenv scan_usb "usb start";  setenv scan_ide "ide reset";  setenv scan_mmc "mmc rescan"; for dev in $devices; do if test $scan_done -eq 0; then echo Scan device $dev; run scan_$dev; for disknum in $disks; do if test $scan_done -eq 0; then echo device $dev $disknum:1; if load $dev $disknum:1 $load_uimage_addr /boot/uImage 1; then scan_done=1; echo Found bootable drive on $dev $disknum; setenv device $disknum:1; setenv bootdev $dev; fi; fi; done; fi; done
serverip=192.168.0.220
set_bootargs=setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10 $mtdparts $custom_params
start_netconsole=setenv ncip $serverip; setenv bootdelay 10; setenv stdin nc; setenv stdout nc; setenv stderr nc; version;
stderr=serial
stdin=serial
stdout=serial
uenv_addr=0x810000
uenv_import=echo importing envs ...; env import -t $uenv_addr $filesize
uenv_init_devices=setenv init_usb "usb start";  setenv init_ide "ide reset";  setenv init_mmc "mmc rescan"; for devtype in $devices; do run init_$devtype; done;
uenv_load=run uenv_init_devices; setenv uenv_loaded 0; for devtype in $devices;  do for disknum in 0; do run uenv_read_disk; done; done;
uenv_read=echo loading envs from $devtype $disknum ...; if load $devtype $disknum:1 $uenv_addr /boot/uEnv.txt; then setenv uenv_loaded 1; fi
uenv_read_disk=if test $devtype -eq mmc; then if $devtype part; then run uenv_read;  fi; else if $devtype part $disknum; then run uenv_read; fi;  fi
usb_ready_retry=15

Environment size: 3043/131068 bytes
GoFlexHome> run boot_bsd
starting USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 
Use USB retry period from the environment: 15 second(s)
1 Storage Device(s) found
reading uenv.txt
287 bytes read in 63 ms (3.9 KiB/s)
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
reading ubldr
295973 bytes read in 90 ms (3.1 MiB/s)
CACHE: Misaligned operation at range [01000098, 01030c04]
CACHE: Misaligned operation at range [01030c04, 01031707]
CACHE: Misaligned operation at range [01031708, 010330f0]
CACHE: Misaligned operation at range [010330f0, 0103558b]
CACHE: Misaligned operation at range [01035590, 01036c98]
CACHE: Misaligned operation at range [01036c98, 01036cf4]
CACHE: Misaligned operation at range [01036cf4, 01036d5c]
CACHE: Misaligned operation at range [01036d5c, 01036e30]
CACHE: Misaligned operation at range [01036e30, 01036e3c]
## Starting application at 0x01000098 ...
Consoles: U-Boot console  
Compatible U-Boot API signature found @0x7b12860

FreeBSD/arm U-Boot loader, Revision 1.2
(Thu Nov 30 14:06:37 GMT 2017 root@Test)

DRAM: 128MB
Number of U-Boot devices: 2
U-Boot env: loaderdev='usb 0:1'
Found U-Boot device: disk
  Checking unit=0 slice=1 partition=<auto>... good.
Booting from disk0s1:
-
can't load 'kernel'

Type '?' for a list of commands, 'help' for more detailed help.
loader> ?
Available commands:
  boot             boot a file or loaded kernel
  autoboot         boot automatically after a delay
  help             detailed help
  ?                list commands
  show             show variable(s)
  set              set a variable
  unset            unset a variable
  echo             echo arguments
  read             read input from the terminal
  more             show contents of a file
  lsdev            list all devices
  include          read commands from a file
  ls               list files
  load             load a kernel or module
  load_geli        load a geli key
  unload           unload all modules
  lsmod            list loaded modules
  heap             show heap usage
  reboot           reboot the system
  devinfo          show U-Boot devices
  sysinfo          show U-Boot system info
  ubenv            show or import U-Boot env vars
loader> reboot

so I'm effectively loading FreeBSD, and it's just a matter amending uEnv.txt and/or changing the commands entered when autoboot is stopped.

Essentially I've hacked in to the stock unit which was my aim.

Thanks for the help.

To be continued in https://forum.doozan.com/read.php?3,49039 ....
Reply Quote
bodhi
Re: Hacking into a stock GoFlexHome unit
January 31, 2018 10:52PM
balanga,

> FreeBSD/arm U-Boot loader, Revision 1.2
> (Thu Nov 30 14:06:37 GMT 2017 root@Test)
>
> DRAM: 128MB
> Number of U-Boot devices: 2
> U-Boot env: loaderdev='usb 0:1'
> Found U-Boot device: disk
> Checking unit=0 slice=1 partition=<auto>...
> good.
> Booting from disk0s1:
> -
> can't load 'kernel'

At this point, the FreeBSD ubldr is running. The kernel has not been loaded yet.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
Newer Topic Older Topic
Author:

Subject:
Spam prevention:
Please, enter the code that you see below in the input field. This is for blocking bots that try to post this form automatically. If the code is hard to read, then just try to guess it right. If you enter the wrong code, a new image is created and you get another chance to enter it right.
Message: