Using U-Boot on the QNAP TS-109

If you have a serial console for your QNAP TS-109, you can use U-Boot, the boot loader used on the TS-109, to restore the original QNAP firmware or load images via the network.

Loading the installer image

You can load the Debian installer image (or other images) via TFTP. First of all, configure the IP address of the TFTP server and of your QNAP:

setenv serverip 192.168.1.2
setenv ipaddr 192.168.1.139

Then specify the command line that should be passed to the kernel. This tells the kernel that the serial console should be activated and that there's a ramdisk that is 4 MB in size.

setenv bootargs console=ttyS0,115200n8 root=/dev/ram rw initrd=0x800000,0x3fffff

Finally, load the image via the network with TFTP and start it:

tftpboot 0x0800000 initrd.gz
tftpboot 0x400000 kernel
bootm 0x400000

If you'd like to load a kernel image you saved from /boot, please see the instructions on how to prepare the image.

Preparing Debian images from /boot to load

If you copy your Debian kernel and ramdisk from /boot to another machine for backup, you can load them via TFTP as described above after making some small modifications to the kernel and ramdisk images.

You have to make two modifications to the kernel. First, you have to set the machine ID of your QNAP device by prepending a few bytes to the kernel image. This can easily be done with the devio command in Debian. Second, you have to generate a U-Boot image from the kernel image. Let's take the vmlinuz-2.6.32-5-orion5x file as an example:

tmp=$(tempfile)
devio > $tmp 'wl 0xe3a01c06,4' 'wl 0xe381101d,4' # TS-109/209
cat vmlinuz-2.6.32-5-orion5x >> $tmp
mkimage -A arm -O linux -T kernel -C none -a 0x00008000 -e 0x00008000 -d $tmp vmlinuz-2.6.32-5-orion5x.uboot

Next, you have to pad the initrd image so it will be exactly 4 MB:

dd if=initrd.img-2.6.32-5-orion5x of=initrd.img-2.6.32-5-orion5x.padded ibs=4194304 conv=sync

Now copy vmlinuz-2.6.32-5-orion5x.uboot and initrd.img-2.6.32-5-orion5x.padded to your TFTP server and load them in memory or write them to flash as described above.