Open Turbostation:Boot Loader

=Boot Loader= QNAP have used U-Boot for the Linux boot loader, with some minor modifications for the Turbostation. All information below has been determined for the TS-101, but it may be possible to adapt it for the TS-201.

Accessing
The boot loader prompt is accessible from the serial port connection as there is a 1 second timeout in which to interrupt the normal boot process by pressing any key. U-Boot reports the following as the system starts:

And has the following environment configured (printenv) in flash:

QNAP Modifications
Although it isn't in the current download, QNAP will provide the GPL source code on request. They have based their version on the Sandpoint 8245 configuration with a few minor tweaks for a bigger sized flash chip. Unfortunately they have made only the minimum changes to get Linux booting. So although the network boot commands are configured since they were in the original Sandpoint configuration, the network controller (either version) is not initialised since it is different to the one used on the Sandpoint board. There are no disk or USB commands either.

Booting an Alternative Image
Kermit file copy is available and works well with Hyperterm or Minicom over the serial connection, but only at around 75s per 100Kb transferred so it is a bit impractical for testing new kernel builds.

An Improved Version of The Boot Loader
An 'improved' version of U-Boot has been built with Network support, allowing TFTP and NFS booting. Still to do is to try and add disk and USB support and provide some sort of interface to the various buttons and lights on the Turbostation casing.

The General Idea
Close examination of the flash layout reveals that not all of the 'Vendor' flash partition is used in stock QNAP TS-101 Turbostations. There are 6 empty sectors at FFE20000-FFEDFFFF which gives 768K in which the improved version of the boot loader can be stored, together with its own environment. This allows the QNAP boot loader to be retained as a fail-safe, but it can be reconfigured so that at reset it starts the alternative boot loader instead of booting straight into Linux.

Check Your Flash configuration
At the boot loader prompt use the flinfo command to verify that you have the expected empty sectors:

It is essential that sectors FFE60000 - FFEBFFFF are marked with an 'E' indicating that they are unused. If this is not the case stop now (and let us know about your Turbostation).

Copy the U-Boot Image to Flash
Now copy the U-Boot image first to RAM and then to flash. Details on using kermit can be found on the Serial Communications page. The image name is u-boot.bin.

Copy the U-Boot Environment
To start with we just duplicate the QNAP environment so we have something valid in place.

Check it works
We just 'go' the new U-Boot from within the old one. Note that the entry point is 0x100 bytes into the image.

Set some environment variables
You may wish to set a few environment variables (e.g.)

And save them to flash

Check that the Turbostation still Boots
To check that nothing has become broken issue the 'boot' command and make sure that the Turbostation starts without incident.

Daisy Chain the Two Boot Loaders
Reset the system and gain access to the prompt of the original boot loader.

Examine the existing environment:

We want to create a new environment variable to save the current value of bootcmd for reference. We then redfine the same variable to start the new version of U-Boot.

Now reset the system and check that the new boot loader gets started by the original boot loader and then goes on to bring up the whole system.

Replacing the Original Boot Loader
While the daisy-chaining method works fine and preserves the original boot loader, ultimately we would want to replace the QNAP version of U-Boot with the improved version.

At the moment we are in the early stages of verifying that we can restore the original image via JTAG should it be necessary. Once we are certain that is possible we will test the new boot loader by replacing the QNAP image.

Related Information
Some interesting information about Das U-Boot running on the very similar hardware of the Linkstation/Kurobox can be found here or here, especially the part about being able to test some U-Boot modifications without having to carry out any risky re-flashing.