Open Turbostation:Boot Loader

212,804pages on
this wiki
Add New Page
Add New Page Discuss this page0

QNAP have used U-Boot for the Linux boot loader, with some minor modifications for the Turbostation. All information below has been determined for the TS-101, but it may be possible to adapt it for the TS-201.

Note that the instructions below are believed to be safe for an off-the-shelf QNAP TS-101. However updating the flash does carry some risk of ending up with a non-functioning Turbostation. The author accepts no responsibility for the consequences of following these instructions.


The boot loader prompt is accessible from the serial port connection as there is a 1 second timeout in which to interrupt the normal boot process by pressing any key. U-Boot reports the following as the system starts:

U-Boot 1.1.2 (Aug 28 2005 - 13:37:25) QNAP System, Inc.
CPU: MPC8245 Revision 1.4 at 266.666 MHz: 16 kB I-Cache 16 kB D-Cache
Board: Sandpoint 8245 Unity ##Test not implemented yet##
I2C: ready
FLASH: S29GL128N, 16 MB
In: serial
Out: serial
Err: serial
Net: No ethernet found.

And has the following environment configured (printenv) in flash:

bootargs=console=ttyS0,115200n8 root=/dev/ram
bootcmd=bootm ff000000 ff200000

QNAP Modifications

Although it isn't in the current download, QNAP will provide the GPL source code on request. They have based their version on the Sandpoint 8245 configuration with a few minor tweaks for a bigger sized flash chip. Unfortunately they have made only the minimum changes to get Linux booting. So although the network boot commands are configured since they were in the original Sandpoint configuration, the network controller (either version) is not initialised since it is different to the one used on the Sandpoint board. There are no disk or USB commands either.

Booting an Alternative Kernel Image or RootFs

Kermit file copy is available and works well with Hyperterm or Minicom over the serial connection, but only at around 75s per 100Kb transferred so it is a bit impractical for testing new kernel builds.

A Better Boot Loader

An 'improved' version of U-Boot has been built with network and disk support, allowing TFTP and NFS booting as well as reading boot images from the local disk. Still to do is to try and add USB support and provide some sort of interface to the various buttons and lights on the Turbostation casing.

The following instructions describe how to build the new boot loader and the following section how to install it without having to replace the original QNAP software.

Download U-Boot 1.2.0 and the OpenTS patch

The OpenTS version of U-Boot with network and disk support is available as a patch from u-boot-1.2.0-opents.patch.gz

U-Boot 1.2.0 can be downloaded from DULG.

Apply the patch

Unpack U-Boot and apply the patch:

# tar xjf u-boot-1.2.0.tar.bz2
# cd u-boot-1.2.0
# gunzip < ../u-boot-1.2.0-opents.patch.gz | patch -p1

Special instructions if your board has Intel 82540EM gigabit ethernet

NOTE: E1000 support is work in progress!

If you don't have the V200 board with the Realtek network controller (i.e. you have an Intel Ethernet chip) you need to make modifications to include/configs/qnap.h to change the configured controller from CONFIG_RTL8169 to CONFIG_E1000.

It is also necessary to make further changes to the IO register mapping... (e.g. based on the output of cat /proc/pci)

#define PCI_ETH_IOADDR 0xbfff80
#define PCI_ETH_MEMADDR 0xbffb0000

The Intel based TS-101's do not have an EEPROM for the MAC address - although one can be added at the SMD component TP5 (top left of Intel chip). A suitable 93C46 EEPROM SMT chip costs around 0.22 GBP; so is not expensive! To allow the U-Boot e1000 driver to work without the address available from an EEPROM add the following definition to qnap.h

#define CONFIG_AP1000

And so that the driver has a MAC address to work with, you must set the following environment variable in addition to the ones described further below (e.g. for a fictitious MAC address):

setenv ethaddr 01:02:03:04:05:06

The driver should then work correctly once the environment is saved to flash and U-Boot restarted.

(the Linux driver is able to determine the MAC address from information stored in flash - see TS101 Flash Memory mtdblock6.

Build U-Boot

Building U-Boot is fairly straightforward providing you have powerpc-linux-gcc and powerpc binutils executables in your path. See the software page for details of how to build a cross-compiler toolchain.

make mrproper
make qnap_config
make all

This will build the file u-boot.bin in the top level directory.

Boot Loader Daisy Chains

The General Idea

Close examination of the flash layout reveals that not all of the 'Vendor' flash partition is used in stock QNAP TS-101 Turbostations. There are 6 empty sectors at FFE20000-FFEDFFFF which gives 768K in which the improved version of the boot loader can be stored, together with its own environment. This allows the QNAP boot loader to be retained as a fail-safe, but it can be reconfigured so that at reset it starts the alternative boot loader instead of booting straight into Linux.

Check Your Flash configuration

At the boot loader prompt use the flinfo command to verify that you have the expected empty sectors:

=> flinfo
Bank # 1:

 Brand: AMD Type: S29GL128N (128 Mbit, uniform sector size)
 Size: 16384 KB in 128 Sectors
 Sector Start Addresses:
   FF000000      FF020000      FF040000      FF060000      FF080000

   FFC80000      FFCA0000      FFCC0000      FFCE0000      FFD00000
   FFD20000      FFD40000      FFD60000      FFD80000      FFDA0000
   FFDC0000      FFDE0000      FFE00000      FFE20000 E    FFE40000 E
   FFE60000 E    FFE80000 E    FFEA0000 E    FFEC0000 E    FFEE0000  
   FFF00000   RO FFF20000   RO FFF40000   RO FFF60000      FFF80000   
   FFFA0000      FFFC0000      FFFE0000                               

It is essential that sectors FFE60000 - FFEBFFFF are marked with an 'E' indicating that they are unused. If this is not the case stop now (and let us know about your Turbostation).

Copy the U-Boot Image to Flash

Now copy the U-Boot image first to RAM and then to flash. Details on using kermit can be found on the Serial Communications page. The image name is u-boot.bin and it can be found at the top level of the U-Boot directory.

=> loadb 3000000
## Ready for binary (kermit) download to 0x03000000 at 115200 bps...
## Total Size = 0x0002b74c = 177996 Bytes
## Start Addr = 0x03000000
=> cp.b 3000000 ffe60000 2b800
Copy to Flash... done

If you have edited the U-Boot configuration file you may have a different image size. U-Boot will work better if you always make sure to copy more bytes than were downloaded!

If for any reason you need to copy the image to flash more than once, remember to erase the previous image first.

=> erase ffe60000 ffe9ffff

Copy the U-Boot Environment

To start with we just duplicate the QNAP environment so we have something valid in place.

=> cp.b fff40000 ffea0000 20000
Copy to Flash... done

Check it works

We just 'go' the new U-Boot from within the old one. Note that the entry point is 0x100 bytes into the image.

=> go ffe60100</br>
## Starting application at 0xFFE60100 ...

U-Boot 1.1.6 (Dec 10 2006 - 16:29:02) OpenTS(c)

CPU: MPC8241 Revision 1.4 at 266.666 MHz: 16 kB I-Cache 16 kB D-Cache
Board: QNAP TS-101/TS-201 local bus at 133.333 MHz
I2C: ready
In: serial
Out: serial
Err: serial
Net: RTL8169sc/8110sc... RTL8169#0
IDE: Bus 0: OK Bus 1: not available
Device 0: Model: WDC WD5000KS-00MNB0 Firm: 07.02E07 Ser#: WD-WMANU1546916
Type: Hard Disk
Supports 48-bit addressing
Capacity: 476940.0 MB = 465.7 GB (976773168 x 512)
Device 1: not available
Hit any key to stop autoboot: 1

This procedure probably isn't recommended by the U-Boot authors since it isn't the same thing as a hard reset. However for our board it seems to work fine, so let's not worry too much about minor details!

Set some environment variables

Now is probably a good time to set a few useful environment variables (e.g. using details from my network)

=> setenv bootdelay 5
=> setenv ipaddr
=> setenv netmask
=> setenv serverip

And save them to flash

=> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash...
. done
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors

Check that the Turbostation still Boots

To check that nothing has become broken issue the 'boot' command and make sure that the Turbostation starts without incident.

Daisy Chain the Two Boot Loaders

Reset the system and gain access to the prompt of the original boot loader.

Examine the existing environment:

bootargs=console=ttyS0,115200n8 root=/dev/ram
bootcmd=bootm ff000000 ff200000

We want to create a new environment variable to save the current value of bootcmd for reference. We then redefine the same variable to start the new version of U-Boot.

=> setenv bootcmdqnap bootm ff000000 ff200000
=> setenv bootcmd go ffe60100
=> saveenv

Now reset the system and check that the new boot loader gets started by the original boot loader and then goes on to bring up the whole system.

Replacing the Original Boot Loader

While the daisy-chaining method works fine and preserves the original boot loader, ultimately we would want to replace the QNAP version of U-Boot with the improved version.

At the moment we are in the early stages of verifying that we can restore the original image via JTAG should it be necessary. Once we are certain that is possible we will test the new boot loader by replacing the QNAP image.

Related Information

Some interesting information about Das U-Boot running on the very similar hardware of the Linkstation/Kurobox can be found here or here, especially the part about being able to test some U-Boot modifications without having to carry out any (slightly) risky re-flashing.

Also on Fandom

Random wikia