PLX7820-based devices can boot from SATA, SPI and NAND. In this sequence
. Which means the if you insert a specially prepared disk, the box will boot from it, no matter what the flash status is.
(So yes, the box is virtually unbrickable)
The Iomega Home Media CE has also a PLX7820, but has no flash at all. So it's disk should boot the Shuttle.Here
you can find information about how to prepare such a disk. We are actually only interested in the first 32MiB, as described in 'Complete Recovery'.
If you have written the 1st 32MiB, the disk has a 1st stage bootloader, a u-boot, a u-boot environment, and a kernel + initrd.
To debrick the Shuttle, we need a Shuttle kernel, as that has knowledge of the flash partitions. Here
you can see the layout of the 32MiB. The kernel and initrd are written at sector 1290 and 16674 and following.
If you extract the KD20.zip file, you'll find a uImage amd rdimg.gz. Those are drop-in replacements for the Iomega kernel and initrd. If you write them to the (already prepared) disk:
dd if=uImage of=/dev/sdX bs=512 skip=1290
dd if=rdimg.gz of=/dev/sdX bs=512 skip=16674
u-boot will load them en boot the Shuttle kernel+initrd.
But, the shuttle initrd is designed to mount the ubi flash partition, and switch_root to that, which is undesireable, at the moment.
rdimg.gz is actually a gzipped ext2 filesystem, with an uImage header. You can extract the filesystem:
tail -c +65 rdimg.gz | gzip -d >initrd
and mount it
mkdir -p initrd.d
mount -o loop initrd initrd.d
Now you can edit the bootscript (/rclinux) to setup the network, and start a telnet daemon. You can also put some partition on the disk (beyond
the 32MiB), format that ext2 (at least that is supported) mount that from /rclinux, and put logfiles on it (redirect output:
exec >/mountpoint/of/partition 2>&1
) because else you're working in the dark.
BTW, after starting a telnet daemon, you'll have to pause the script. If the script exits, you'll have a kernel panic. (Or it boots into the ubifs)
telnetd -l /bin/sh
/bin/sh # a shell on console, to pause the script
If you manage to get telnet access, the script /rclinux contains the code to flash the files from KD20.zip. I think you can suffice with the ubi fs, as that is the only partition which should be editable from the webinterface.
When you have edited your initrd, you can unmount it, gzip the file, and put a new header on it using mkimage from the uboot tools package.
'file rdimg.gz' will tell you how the header should be.