We are talking about that piece of hardware: seagate_stak200_arm_kirkwood_cheapest_nas_possible_x-d


With a little soldering it is even possible to attach 3.5″ SATA Disks (default is 2.5″)


It has a similar hardware than the QNAP 219+. (same chipset kirkwood)

While having a much smaler price tag.

with a little effort it is possible to run a full blown debian: http://doncharisma.com/2013/09/22/build-your-own-pro-nas-seagate-goflex-net-with-debian-linux-raid1-and-openmediavault/

(but probably not with an nfs kernel?)

DO NOT BUY@ AMAZON! THEY DON’T PAY THEIR TAXES! http://www.amazon.de/gp/product/B003R02R2O?*Version*=1&*entries*=0



if you allready did: you have to register the device online (!) to reenable ssh.



go to settings:


pogoplug enable ssh

The backend fires those commands, to enable ssh and set password root for root:

it has something to do with: https://goflexnet.pogoplug.com/svc/api/json/featureCommand

Let’s check out what’s going on on the box when there is an incoming command:

sudo nc -l -p 4389 > tcpump.txt & # on server

ssh root@192.168.XXX.XXX # ssh into pogoplug device
cd /tmp; # go to temporary space
wget http://web.eecs.umich.edu/~timuralp/tcpdump-arm # download tcpdump for arm
# mirror: tcpdump-arm

chmod u+x tcpdump-arm; # make it executable
./tcpdump-arm -vvv -X | nc 4389 # send it's output in detail to server

full dump: tcpump.txt

maybe someone can help?

# this is probably an interesting package... but it seems encrpyted:

17:08:31.745010 IP (tos 0x8, ttl 47, id 0, offset 0, flags [DF], proto UDP (17), length 181) > UDP, length 153
        0x0000:  4508 00b5 0000 4000 2f11 20b9 2654 4252  E.....@./...&TBR
        0x0010:  c0a8 0129 110d 8002 00a1 803e 0080 0f08  ...).......>....
        0x0020:  0059 71d5 0000 0000 0000 0000 0000 0000  .Yq.............

17:08:29.960595 IP (tos 0x0, ttl 64, id 19752, offset 0, flags [DF], proto TCP (6), length 52)
    gateway.intern.4389 > Flags [.], seq 1, ack 91136, win 1452, options [nop,nop,TS[|tcp]>
        0x0000:  4500 0034 4d28 4000 4006 69ec c0a8 0136  E..4M(@.@.i....6
        0x0010:  c0a8 0129 1125 cff3 8c88 ae47 2bb5 99fc  ...).%.....G+...
        0x0020:  8010 05ac 3155 0000 0101 080a 0031 e90a  ....1U.......1..
17:08:30.333889 00:00:00:00:00:00 (oui Ethernet) > Broadcast, RRCP-0x03 query
        0x0000:  0300 0000 0000 0000 0000 0000 0000 0000  ................
        0x0010:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 0000 0000



CPU Ram Flash Network USB Serial JTAG SATA
Marvell Kirkwood@1200MHz 128 MiB 256 MiB 1 gigE 1x 2.0 Yes Yes 2x data+power
Seriennummer (SN): NA1Y0PPE Teilenummer (PN:) 9ZT5D0-570
Modellnummer: STAK200 Familie: FREEAGENTGOFLEXNET 0.1 FAMILY


Architecture: ARM armv5te
Vendor: Marvell
Bootloader: U-Boot
System-On-Chip: Marvell MV88F6281 A0 (DDR2) with ARM926EJ-S CPU (Marvell Feroceon)
CPU Speed: 1200 Mhz
Flash size: 256 MiB / 1x Micron 29F2G08AAD
RAM: 128 MiB / 1x Nanya NT5TU64M16DG-AC
Wireless: n/a
Ethernet: 1x GigE port / Marvell „Alaska“ 88E1116R
USB: 1x USB 2.0 port
Serial: Yes
SATA: 2x (data & power)

i discovered the Seagate’s Box IP via sharkwire (when it asked for DHCP and DHCP assigned .41 to it)


Flash Layout

original u-boot flash layout
mtdparts mtd0 mtd1 mtd2 mtd3
start (hex) 0x000000 0x100000 0x500000 0x2500000
size (hex) 0x100000 0x400000 0x2000000 0xdb00000
size (MB) 1 4 32 219
name u-boot kernel rootfs data
file system raw uImage? JFFS2 ?


openwrt-kirkwood-dockstar-u-boot.kwb flash layout
mtdparts mtd0 mtd1 mtd2 mtd3 mtd4
start (hex) 0x000000 0x100000 0x200000 0x500000 0x2500000
size (hex) 0x100000 0x100000 0x300000 0x2000000 0xdb00000
size (MB) 1 1 3 32 219
name u-boot second_stage_u-boot kernel rootfs data
file system raw raw uImage? JFFS2 ?

Specific Configuration


The default network configuration is:

Interface Name Description Default configuration
eth0 Ethernet port DHCP


The GoFlexNet cannot be put into failsafe mode by pressing the button.

It can however be put in failsafe mode using serial console and pressing ‚f‘ and <enter> when prompted during boot-up


The GoFlexNet’s only button is not configurable and inevitably performs a hard reset when pressed, the button open the bridge between the positive pole and the power cord.

Crypto Hardware Acceleration


for serial cable (nokia’s DKU-5, CA-42 and etc ttl…), 115200 8n1:

NOTE: The pins to use are the ones „covered up“ by the tips of the arrows, i.e. the pins in the row toward the outer edge of the PCB. (for comparison, see here)


for enable 3.5″ disks (3 pins sata power to +12V DC):

NOTE: The ellipse in the picture indicates three pins for Serial ATA +12 V. (Multiple pins are used for current (Ampere) considerations,

The SATA standard specifies a power connector sharply differing from those used by PATA drives and many other computer components. It is wafer-based, 15-pin shape. The seemingly large number of pins are used to supply three different voltages — 3.3 V, 5 V, and 12 V.

Each voltage is supplied by three pins ganged together (and 5 pins for ground). This is because the small pins cannot supply sufficient current for some devices. One pin from each of the three voltages is also used for hotplugging. The same physical connections are used on 3.5-inch and 2.5-inch notebook  hard disks.

Pin Signal PSU Color Wire
1 +3.3VDC orange
2 +3.3VDC orange
3 +3.3VDC orange
4 GND black
5 GND black
6 GND black
7 +5VDC red
8 +5VDC red
9 +5VDC red
10 GND black
11 Optional black
12 GND black
13 +12VDC yellow
14 +12VDC yellow
15 +12VDC yellow

<- solder those 3x together… and connect to 12V from PowerSupply.

Pins 3,7,13 are pre-charge.

Pin 11 can be used for activity indication and/or staggered spin-up.

Pins 1, 2, and 3 are optional as well, as evidenced by some adapter cables that connect the drives to older PSUs. These are usually Y-adapters that have the four-pin drive connector on the other end. Currently, SATA drives rarely use 3.3 volts. That may be because there are too many people using adapters so the drive makers don’t want the headaches which come with using 3.3 volts. But in the future, 3.3 volt drives may become common so you need to be careful when using SATA power cables which don’t implement 3.3 volts.

It looks like the powersupply can take the „heat“ of two 3.5″ SATA Disks… but i still have to long-term test.

compare https://en.wikipedia.org/wiki/Serial_ATA#Power_connectors.)

seagate_goflex_net_2 seagate_goflex_net_3 seagate_goflex_net_4

Opening the case

There are no screws – the bottom cover is held by ten plastic snap on clips, three on the sides and two on the edges. To open the case, gently pry all around with a thin screwdriver until it is open.

The serial pins are accessible without further disassembly.


Connect device to Ethernet port. To prevent automatic updates by cloud engines (which may disable ssh access), use a separate switch or disconnect your router from the internet. If the ssh access was disabled by the automatic cloud engine update service, you need to login there and re-activate ssh.

Find IP address, BE and EF are the last two bytes of the MAC of your device (printed on the bottom of the GoFlexNet)

root@host ~ # ifconfig eth0
root@host ~ # nmap -e eth0 -sP $(printf "169.254.%d.%d" 0xbe 0xef)

Connect to IP address via


usr: root

pwd: stxadmin

to see if it works.

(if you set something different via https://my.pogoplug.com -ssh-setup then use that root password)

Backup original firmware

Login to the original firmware via SSH (enable it first in popoplug site) or Serial cable (nokia’s CA-52, DKU-5 and etc ttl…). Plug the flash drive (FAT32) to USB port in Seagate GoFlex Net, then:

mkdir /tmp/backup;
mount /dev/sda1 /tmp/backup;
cd /tmp/backup;
wget http://download.doozan.com/uboot/nanddump;
# alternative mirror nandump for arm: http://dwaves.de/wp-content/uploads/2015/03/nanddump.gz

chmod +x nanddump;
./nanddump -nof uboot-mtd0-dump /dev/mtd0;
./nanddump -nof uboot-original -s 0 -l 0x80000 /dev/mtd0;
./nanddump -nof uImage-mtd1-dump /dev/mtd1;
./nanddump -nof rootfs-mtd2-dump /dev/mtd2;
umount /dev/sda1;

tar czf ./Seagate_FreeAgent_GoFlex_Net_FirmwareBackup.tar.gz uboot-mtd0-dump uboot-original uImage-mtd1-dump rootfs-mtd2-dump; # pack it all in one file

# You can transfer the backup to another machine
scp root@ /PROJECTS/hackThePlanet.org/SeagateGoFlexNet/

If you lost your firmware files, here is my backup: http://dwaves.de/software/recovery/SeagateGoFlexNet/Seagate_FreeAgent_GoFlex_Net_FirmwareBackup.tar.gz
To create an image of mtd0, you need to dump the nand without ecc. using „dd if=/dev/mtd0 of=mtd0.DOESNOTWORK“ will automatically do ecc for you and will result in a corrupt image.

Restore original firmware via serial cable and tftp-server (i just hope i won’t need it)

#set goflex net ip
setenv ipaddr ''
#set tftp-server ip
setenv serverip ''

#original uImage (backuped before)
tftpboot 0x800000 uImage-mtd1-dump
nand erase 0x100000 0x400000
nand write.e 0x800000 0x100000 0x400000

#original rootfs (backuped before)
tftpboot 0x800000 rootfs-mtd2-dump
nand erase 0x500000 0x2000000
nand write.e 0x800000 0x500000 0x2000000


Hit any key to stop autoboot:  0

setenv bootcmd 'nand read.e 0x800000 0x100000 0x300000; setenv bootargs $(console) $(bootargs_root); bootm 0x800000'

#change value to your device
setenv ethaddr '00:10:75:26:3D:9F'
setenv ceserialno 'NA1Y0EG1'
setenv ceboardver 'DISCOVERY:0.1'


Install OpenWrt into NAND via serial cable and tftp-server

Files needed:



mirror: http://dwaves.de/software/recovery/SeagateGoFlexNet/uboot.mtd0.kwb-2011.12-goflexnet-L2Coff-IDEpatched.tar.gz

(untar – this is uboot with working sata!)



Hit any key to stop autoboot in the uboot and set goflexnet ip, tftp-server ip, goflexnet mac:

setenv ipaddr ''
setenv serverip ''
setenv ethaddr '00:10:75:26:28:7D'

download from tftp-server file uboot.mtd0.kwb-2011.12-goflexnet-L2Coff-IDEpatched to RAM start offset 0x6400000

tftp 0x6400000 uboot.mtd0.kwb-2011.12-goflexnet-L2Coff-IDEpatched

Bytes transferred = 524288 (80000 hex) ← this number is needed for nand writeerase nand start from 0 size 0x100000

nand erase 0x0 0x100000

write nand from RAM start offset 0x6400000 to nand start 0x0 size 0x80000

nand write.e 0x6400000 0x0 0x80000

download from tftp-server file openwrt-kirkwood-uImage to RAM start offset 0x6400000

tftp 0x6400000 openwrt-kirkwood-uImage

Bytes transferred = 1266344 (1352a8 hex) ← this number is needed for nand writeerase nand start from 0x200000 size 0x300000

nand erase 0x200000 0x300000

write nand from RAM start offset 0x6400000 to nand start 0x200000 size 0x1352a8

nand write.e 0x6400000 0x200000 0x1352a8

download from tftp-server file openwrt-kirkwood–jffs2-nand-2048-128k.img to RAM start offset 0x6400000

tftp 0x6400000 openwrt-kirkwood--jffs2-nand-2048-128k.img

Bytes transferred = 1837056 (1c0800 hex) ← this number is needed for nand writeerase nand start from 0x500000 size 0xfb00000

nand erase 0x500000 0xfb00000

write nand from RAM start offset 0x6400000 to nand start 0x500000 size 0x1c0800

nand write.e 0x6400000 0x500000 0x1c0800

reboot device


Hit any key to stop autoboot! and set your mac-address from bottom side of the box (if you don’t do this – ethernet wont work) and set other openwrt’s environment

setenv baudrate '115200'
setenv bootcmd '${x_bootcmd_kernel}; setenv bootargs ${x_bootargs} ${x_bootargs_root}; ${x_bootcmd_usb}; bootm 0x6400000;'
setenv bootdelay '3'
setenv ethact 'egiga0'
setenv ethaddr '00:10:75:26:28:7D'
setenv ipaddr ''
setenv serverip ''
setenv stderr 'serial'
setenv stdin 'serial'
setenv stdout 'serial'
setenv x_bootargs 'console=ttyS0,115200 mtdparts=orion_nand:1M(u-boot),1M@1M(second_stage_u-boot),3M@2M(kernel),251M@5M(rootfs) rw'
setenv x_bootargs_root 'root=/dev/mtdblock3 rw rootfstype=jffs2'
setenv x_bootcmd_kernel 'nand read 0x6400000 0x200000 0x300000'
setenv x_bootcmd_usb 'usb start'
setenv machid c11

Voilà, we did it! 🙂

U-Boot 2011.12 (Apr 18 2012 - 23:08:20)
Seagate GoFlexNet

SoC:   Kirkwood 88F6281_A0
DRAM:  128 MiB
WARNING: Caches not enabled
NAND:  256 MiB
In:    serial
Out:   serial
Err:   serial
Net:   egiga0
88E1116 Initialized on egiga0
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x200000, size 0x300000
 3145728 bytes read: OK
(Re)start USB...
USB:   Register 10011 NbrPorts 1
scanning bus for devices... 1 USB Device(s) found
       scanning bus for storage devices... 0 Storage Device(s) found
## Booting kernel from Legacy Image at 06400000 ...
   Image Name:   Linux-3.3.8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1266192 Bytes = 1.2 MiB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.3.8 (openwrt@OpenWRT) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r38047) ) #1 Thu Sep 19 01:30:05 MST 2013
[    0.000000] CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: Marvell eSATA SheevaPlug Reference Board
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200 mtdparts=orion_nand:1M(u-boot),1M@1M(second_stage_u-boot),3M@2M(kernel),251M@5M(rootfs) rw root=/dev/mtdblock3 rw rootfstype=jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 128MB = 128MB total
[    0.000000] Memory: 126284k/126284k available, 4788k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xff000000   ( 872 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0324000   (3184 kB)
[    0.000000]       .init : 0xc0324000 - 0xc0342000   ( 120 kB)
[    0.000000]       .data : 0xc0342000 - 0xc035fb20   ( 119 kB)
[    0.000000]        .bss : 0xc035fb44 - 0xc0389a90   ( 168 kB)
[    0.000000] NR_IRQS:114
[    0.000000] gpiochip_add: registered GPIOs 0 to 31 on device: orion_gpio0
[    0.000000] gpiochip_add: registered GPIOs 32 to 49 on device: orion_gpio1
[    0.000000] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 21474ms
[   15.378138] Calibrating delay loop... 1191.11 BogoMIPS (lpj=5955584)
[   15.468126] pid_max: default: 32768 minimum: 301
[   15.468266] Mount-cache hash table entries: 512
[   15.468584] CPU: Testing write buffer coherency: ok
[   15.468840] Setting up static identity map for 0x2757e8 - 0x275824
[   15.470513] NET: Registered protocol family 16
[   15.472748] Kirkwood: MV88F6281-A0, TCLK=200000000.
[   15.472764] Feroceon L2: Enabling L2
[   15.472801] Feroceon L2: Cache support initialised.
[   15.480475] bio: create slab <bio-0> at 0
[   15.481375] SCSI subsystem initialized
[   15.481930] usbcore: registered new interface driver usbfs
[   15.482067] usbcore: registered new interface driver hub
[   15.482226] usbcore: registered new device driver usb
[   15.483324] Switching to clocksource orion_clocksource
[   15.484874] NET: Registered protocol family 2
[   15.485020] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[   15.485321] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[   15.485420] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[   15.485474] TCP: Hash tables configured (established 4096 bind 4096)
[   15.485484] TCP reno registered
[   15.485494] UDP hash table entries: 256 (order: 0, 4096 bytes)
[   15.485516] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[   15.485690] NET: Registered protocol family 1
[   15.487175] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[   15.487189] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[   15.487525] msgmni has been set to 246
[   15.487555] io scheduler noop registered
[   15.487563] io scheduler deadline registered (default)
[   15.554884] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[   15.577632] serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
[   15.918534] console [ttyS0] enabled
[   15.923472] ONFI flash detected
[   15.926716] ONFI param page 0 valid
[   15.930224] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron MT29F2G08AAD)
[   15.937929] Scanning device for bad blocks
[   16.094164] 4 cmdlinepart partitions found on MTD device orion_nand
[   16.100459] Creating 4 MTD partitions on "orion_nand":
[   16.105637] 0x000000000000-0x000000100000 : "u-boot"
[   16.111557] 0x000000100000-0x000000200000 : "second_stage_u-boot"
[   16.118542] 0x000000200000-0x000000500000 : "kernel"
[   16.124386] 0x000000500000-0x000010000000 : "rootfs"
[   16.130502] mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4
[   16.137474] mv643xx_eth smi: probed
[   16.142824] mv643xx_eth_port mv643xx_eth_port.0: eth0: port 0 with MAC address 00:10:75:26:28:7d
[   16.151794] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   16.158406] orion-ehci orion-ehci.0: Marvell Orion EHCI
[   16.163725] orion-ehci orion-ehci.0: new USB bus registered, assigned bus number 1
[   16.193367] orion-ehci orion-ehci.0: irq 19, io mem 0xf1050000
[   16.213355] orion-ehci orion-ehci.0: USB 2.0 started, EHCI 1.00
[   16.219848] hub 1-0:1.0: USB hub found
[   16.223640] hub 1-0:1.0: 1 port detected
[   16.228077] Initializing USB Mass Storage driver...
[   16.233153] usbcore: registered new interface driver usb-storage
[   16.239200] USB Mass Storage support registered.
[   16.244122] cpuidle: using governor ladder
[   16.249582] mmc0: mvsdio driver initialized, using GPIO 47 for card detection
[   16.256984] leds-gpio: probe of leds-gpio failed with error -22
[   16.263254] TCP cubic registered
[   16.266519] NET: Registered protocol family 17
[   16.271047] Bridge firewalling registered
[   16.275254] 8021q: 802.1Q VLAN Support v1.8
[   16.279588] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[   17.972758] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   17.991751] VFS: Mounted root (jffs2 filesystem) on device 31:3.
[   17.998179] Freeing init memory: 120K
procd: Console is alive
[   20.599310] Uniform Multi-Platform E-IDE driver
[   20.623458] sata_mv sata_mv.0: slots 32 ports 2
[   20.629741] scsi0 : sata_mv
[   20.632984] scsi1 : sata_mv
[   20.636119] ata1: SATA max UDMA/133 irq 21
[   20.640234] ata2: SATA max UDMA/133 irq 21
[   20.993364] ata1: SATA link down (SStatus 0 SControl F300)
[   21.503369] ata2: SATA link up 1.5 Gbps (SStatus 113 SControl F300)
[   21.883398] ata2.00: ATA-6: TOSHIBA MK1032GSX, AS021G, max UDMA/100
[   21.889697] ata2.00: 195371568 sectors, multi 16: LBA48 NCQ (depth 31/32)
[   21.953398] ata2.00: configured for UDMA/100
[   21.957957] scsi 1:0:0:0: Direct-Access     ATA      TOSHIBA MK1032GS AS02 PQ: 0 ANSI: 5
[   21.967355] sd 1:0:0:0: [sda] 195371568 512-byte logical blocks: (100 GB/93.1 GiB)
[   21.975267] sd 1:0:0:0: [sda] Write Protect is off
[   21.980167] sd 1:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[   22.030739]  sda: sda1
[   22.034046] sd 1:0:0:0: [sda] Attached SCSI disk
[   22.045058] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[   22.052996] uhci_hcd: USB Universal Host Controller Interface driver
kmod: ran 28 iterations
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
mount_root: mounting /dev/root
procd: - early -
procd: - init -
Please press Enter to activate this console.
[   28.126425] NET: Registered protocol family 10
[   28.193973] aoe: AoE v47 initialised.
[   28.253711] RPC: Registered named UNIX socket transport module.
[   28.259662] RPC: Registered udp transport module.
[   28.264413] RPC: Registered tcp transport module.
[   28.269131] RPC: Registered tcp NFSv4.1 backchannel transport module.
[   28.287417] NTFS driver 2.1.30 [Flags: R/O MODULE].
[   28.315502] tun: Universal TUN/TAP device driver, 1.6
[   28.320580] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   28.387485] Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
[   28.411442] nf_conntrack version 0.5.0 (1975 buckets, 7900 max)
[   28.437469] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   28.513508] sd 1:0:0:0: Attached scsi generic sg0 type 0
[   28.543385] u32 classifier
[   28.546104]     input device check on
[   28.549775]     Actions configured
[   28.564556] Mirror/redirect action on
[   28.624722] netem: version 1.3
[   28.663524] fuse init (API version 7.18)
[   28.680251] ip_tables: (C) 2000-2006 Netfilter Core Team
[   28.726045] usbcore: registered new interface driver usblp
[   28.823510] xt_time: kernel timezone is -0000
[   28.851447] PPP generic driver version 2.4.2
[   28.861255] NET: Registered protocol family 24
[   33.545126] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   36.346205] mv643xx_eth_port mv643xx_eth_port.0: eth0: link up, 1000 Mb/s, full duplex, flow control disabled
[   36.356457] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
procd: - init complete -

BusyBox v1.19.4 (2013-09-19 01:21:59 MST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 BARRIER BREAKER (Bleeding Edge, r38047)
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                  251.0M     22.5M    228.5M   9% /
/dev/root               251.0M     22.5M    228.5M   9% /
tmpfs                    61.7M    236.0K     61.5M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/sda1                93.2G     88.6M     93.1G   0% /tmp/run/mountd/sda1

redstone63 rescue

all files are here: redstone_v63


ce_kernel_redstone_v63.img: c31ca085da5999651384cf4bb9978692

ce_ramdisk_v2.0b.img.gz: 80787eea2389a1fe96ffc6715ec65d4c

setenv ipaddr ''
setenv serverip ''
nand erase 0x100000 0x400000
tftp 0x800000 ce_kernel_redstone_v63.img
nand write.e 0x800000 0x100000 0x1e30f0
tftp 0x1000000 ce_ramdisk_v2.0b.img.gz
setenv bootargs $(console) root=/dev/mtdblock2 initrd=0x1000000,0xb39a59
bootm 0x800000

Recovery of a bricked uboot *without* jtag

Unlike the dockstar, the goflexnet has a newer bootrom which supports serial boot. [http://forum.doozan.com/read.php?3,7852,7852]

wget ftp://ftp.denx.de/pub/u-boot/u-boot-2013.10.tar.bz2
tar jxf u-boot-2013.10.tar.bz2
cd u-boot-2013.10/tools/
gcc -o kwboot kwboot.c
./kwboot -b /tmp/openwrt-kirkwood-goflexhome-u-boot.kwb -t -p -B 115200 /dev/ttyUSB0

Now the uboot is loaded into ram and executed. You have to flash u-boot into nand. See below how to flash it.


information from console of BusPirate (SeeedStudio) „HiZ>i“ – Bus Pirate v3.5 Firmware v6.1 r1676 Bootloader v4.4 in bash of Cygwin

git clone git://git.code.sf.net/p/openocd/code
cd code
./configure --enable-maintainer-mode --disable-werror --disable-at91rm9200 --enable-buspirate
make && make install && make clean

put buspirate.cfg to /usr/local/share/openocd/scripts/interface/
put dockstar.cfg to /usr/local/share/openocd/scripts/board/
put uboot.mtd0.goflexnet.original.kwb from http://download.doozan.com/uboot/files/uboot/uboot.mtd0.goflexnet.original.kwb to /usr/local/share/openocd/scripts/

cd /usr/local/share/openocd/scripts

(Seeed Studio BusPirate - GoFlex.net)  (GoFlex.net - Seeed Studio BusPirate)
(            nc         -   1  nc   )  ( 10  GND   -    serial cable GND   )
(     6  blue   (aux)   -   2  IN   )  (  9  RxD   -    serial cable TxD   )
(     8  gray   (mosi)  -   3  TDI  )  (  8  TxD   -    serial cable RxD   )
(     9  white  (cs)    -   4  TMS  )  (  7  CN    -           nc          )
(     7  purple (clk)   -   5  TCK  )  (  6  DOT   -    10  black (miso)   )
power on goflex.net, serial, buspirate

openocd.exe -f board/dockstar.cfg

in telnet 4444:
type 'halt' - press reset - press enter - release reset

(repeat while not see this:
target state: halted
target halted in ARM state due to debug-request, current fashion: Supervisor
CPSR: 0x000000d3 pc: 0xffff0000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
if you not see this - you can try command 'soft_reset_halt')


(here are two options to choose from)
load_image uboot.mtd0.goflexnet.original.kwb 0x800000
(wait ~214 sec)
resume 0x800200
or you can erease nand and native write to nand:
nand probe 0
nand erase 0 0x0 0xa0000
nand write 0 uboot.mtd0.goflexnet.original.kwb 0 oob_softecc_kw
(wait ~569 sec)
(then poweroff goflexnet & buspirate, wait 5 secs adns poweron goflexnet)

in serial console:
Hit any key to stop autoboot:  0
nand erase
nand write.e 0x800000 0x0 0x80000


interface buspirate
buspirate_port /dev/ttyS15
buspirate_speed fast #normal or fast
buspirate_vreg 0
buspirate_mode open-drain
buspirate_pullup 0
reset_config srst_only


# Marvell SheevaPlug

# I'm using a wiggler compatible cable
source [find interface/buspirate.cfg]
source [find target/feroceon.cfg]
jtag_khz 500
jtag_nsrst_delay 500

$_TARGETNAME configure 
	-work-area-phys 0x100000 
	-work-area-size 65536 
	-work-area-backup 0

# Disabled for the dockstar
#arm7_9 dcc_downloads enable

# this assumes the hardware default peripherals location before u-Boot moves it
nand device $_FLASHNAME orion 0 0xd8000000

proc dockstar_init { } {

	# We need to assert DBGRQ while holding nSRST down.
	# However DBGACK will be set only when nSRST is released.
	# Furthermore, the JTAG interface doesn't respond at all when
	# the CPU is in the WFI (wait for interrupts) state, so it is
	# possible that initial tap examination failed.  So let's
	# re-examine the target again here when nSRST is asserted which
	# should then succeed.
	jtag_reset 0 1
	feroceon.cpu arp_examine
	halt 0
	jtag_reset 0 0

	arm mcr 15 0 0 1 0 0x00052078

	mww 0xD0001400 0x43000C30
	mww 0xD0001404 0x39543000
	mww 0xD0001408 0x22125451
	mww 0xD000140C 0x00000833
	mww 0xD0001410 0x000000CC
	mww 0xD0001414 0x00000000
	mww 0xD0001418 0x00000000
	mww 0xD000141C 0x00000C52
	mww 0xD0001420 0x00000042
	mww 0xD0001424 0x0000F17F
	mww 0xD0001428 0x00085520
	mww 0xD000147c 0x00008552

	# 1st bank is 128 MB
	mww 0xD0001504 0x07FFFFF1
	# 2nd bank of DRAM is not used
	mww 0xD0001508 0x00000000
	mww 0xD000150C 0x00000000
	# Commented the 3 following	lines
	#mww 0xD0001504 0x0FFFFFF1
	#mww 0xD0001508 0x10000000
	#mww 0xD000150C 0x0FFFFFF5
	mww 0xD0001514 0x00000000
	mww 0xD000151C 0x00000000
	mww 0xD0001494 0x003C0000
	mww 0xD0001498 0x00000000
	mww 0xD000149C 0x0000F80F
	mww 0xD0001480 0x00000001
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000
	mww 0xD0020204 0x00000000

	mww 0xD0010000 0x01111111
	mww 0xD0010004 0x11113322
	mww 0xD0010008 0x00001111

	mww 0xD0010418 0x003E07CF
	mww 0xD001041C 0x000F0F0F
	mww 0xD0010470 0x01C7D943


proc sheevaplug_reflash_uboot { } {

	# reflash the u-Boot binary and reboot into it
	nand probe 0
	nand erase 0 0x0 0xa0000
	nand write 0 uboot.bin 0 oob_softecc_kw


proc sheevaplug_reflash_uboot_env { } {

	# reflash the u-Boot environment variables area
	nand probe 0
	nand erase 0 0xa0000 0x40000
	nand write 0 uboot-env.bin 0xa0000 oob_softecc_kw


proc sheevaplug_load_uboot { } {

	# load u-Boot into RAM and execute it
	#load_image uboot.elf
	#verify_image uboot.elf
	load_image u-boot
	verify_image u-boot
	resume 0x00600000


proc dockstar_reset_cpu { } {

#	System and User mode registers
#		  r0: 00000000       r1: 00000000       r2: 00000000       r3: 00000000
#		  r4: 00000000       r5: 00000000       r6: 00000000       r7: 00000000
#		  r8: 00000000       r9: 00000000      r10: 00000000      r11: 00000000
#		 r12: 00000000   sp_usr: 7dddee86   lr_usr: dffebe46       pc: ffff0a42
#		cpsr: 400000f3

	reg r1 0
	reg r2 0
	reg r3 0
	reg r4 0
	reg r5 0
	reg r6 0
	reg r7 0
	reg r8 0
	reg r9 0
	reg r10 0
	reg r11 0
	reg r12 0
	reg sp_usr 0
	reg lr_usr 0
	reg pc 0
	# Set the CPU in Supervisor mode
	reg cpsr 0x13

#	FIQ mode shadow registers
#	  r8_fiq: fbcfff64   r9_fiq: d7dfafd6  r10_fiq: 1fff6d2e  r11_fiq: 1db65df4
#	 r12_fiq: ff5a6de4   sp_fiq: 745fe7d5   lr_fiq: 89f7ae3e spsr_fiq: 00000000

	reg r8_fiq 0
	reg r9_fiq 0
	reg r10_fiq 0
	reg r11_fiq 0
	reg r12_fiq 0
	reg sp_fiq 0
	reg lr_fiq 0
	reg spsr_fiq 0

#	Supervisor mode shadow registers
#	  sp_svc: fffeff84   lr_svc: ffff0a43 spsr_svc: 00000000

	reg sp_svc 0
	reg lr_svc 0
	reg spsr_svc 0

#	Abort mode shadow registers
#	  sp_abt: 51fe66f7   lr_abt: d7abaef7 spsr_abt: 00000000

	reg sp_abt 0
	reg lr_abt 0
	reg spsr_abt 0

#	IRQ mode shadow registers
#	  sp_irq: 7fdb4ed5   lr_irq: 6d41122e spsr_irq: 00000000

	reg sp_irq 0
	reg lr_irq 0
	reg spsr_irq 0

#	Undefined instruction mode shadow registers
#	  sp_und: 75ffef7e   lr_und: d75b6cd1 spsr_und: 00000000

	reg sp_und 0
	reg lr_und 0
	reg spsr_und 0


original/default GoFlex.net uBoot environment (printenv/setenv)

bootargs_root=root=/dev/mtdblock2 ro
bootargs=console=ttyS0,115200 root=/dev/mtdblock2 ro
bootcmd=nand read.e 0x800000 0x100000 0x300000; setenv bootargs $(console) $(bootargs_root); bootm 0x800000

Port Scan the Seagate Box

apt-get install nmap # install
nmap -v -A # scan

# results
80/tcp open http HBHTTP DISCOVERY – – Linux # here a blank page loads
443/tcp open ssl/https HBHTTP DISCOVERY – – Linux # here a blank page loads

| ssl-cert: Subject: commonName=YW99ABT78DHT6PX88PAB46TPSW/organizationName=Cloud Engines, Inc./stateOrProvinceName=California/countryName=US
| Issuer: commonName=Pogoplug CA/organizationName=Cloud Engines, Inc./stateOrProvinceName=California/countryName=US
| Public Key type: rsa
| Public Key bits: 2048

MAC Address: 00:10:75:26:64:DC (Segate Technology)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o:linux:linux_kernel:2.6.22

OS details: Linux 2.6.22 (embedded, ARM), Linux 2.6.22 – 2.6.23




… and not the 3TB or 4TB models.

As such, the WD RED plates are perfect for use in NAS servers suitable: fast (for 5400 rpm), quiet, reliable, energy saving, reasonable price / performance ratio.

Unfortunately, WD has a real shot at some Bock 3TB and 4TB all models of without pretreatment for 24/7 server operating disqualified the plates: the so-called IDLE3 timer is set to 8 seconds, ie, After 8 seconds without touching the heads are parked. Since the 24/7 server operating very quickly accessed is typically done this very rapidly increases the number of parking cycles (the so-called. Load Cycle Count, LCC), with me about 600 cycles per day (the value can be SMART Tools be read). Extrapolated to the park 600000 cycles for the WD RED plates are designed, this means that after 2-3 years of the end of life is reached and a defect of the disk is a risk of data loss. Although this is still in the three-year warranty, but probably because only a part of the sold WD RED plates in fact, 24/7 operation is running, probably the most records will be broken until after the warranty period, so that the WD warranty no longer applies ( a rogue who thinks evil doing).

Remedy the tool WDIDLE3.EXE (DOS) or the idle3 tools under Linux (googling), with which you can adjust or completely disable the IDLE3 timer to a reasonably high value. There are plenty of instructions on the net.