Installing U-Boot for LinkStation

Copyright (c) 2006 Mihai Georgian

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. The full text of the license can be obtained by clicking on the above link.

No liability for the contents of this document can be accepted. The information in this document is provided in good faith but no warranty can be made for its accuracy and the author does not take any responsibility. Use the concepts, examples and information at your own risk. There may be errors and inaccuracies, that could be damaging to your system.

Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark. Naming of particular products or brands should not be seen as endorsements.


If you are not prepared to lose your LinkStation, do not attempt to install U-Boot

Flashing the LinkStation with unauthorised firmare voids your warranty. When installing firmware on an embedded computer things can and, sometimes, do go wrong. The power can go down in the middle of the flash operation or the flash write can fail rendering your LinkStation unusable.


U-Boot for the LinkStation is distributed as a source patch against u-boot-1.1.4. To compile it you will need either a cross toolchain installed on your PC or native development tools installed on your LinkStation. These instructions assume that you are running Linux on a X86 PC and that you are using a cross toolchain.

To allow testing of U-Boot on your LinkStation without burning it into flash, a kernel module named uloader.o is provided. Uloader allows you to use Linux to load a RAM build of U-Boot and start it. The RAM build of U-Boot is very close to the ROM build. The only differences are the absence of the basic initialisation code (which cannot run from RAM) and the link address. It is strongly recommended that you test U-Boot on your LinkStation using a RAM build before building the ROM version and attempting to burn it into flash. Once you have the RAM build up and running you can use it to install (burn) the ROM version.

Supported Hardware

The LinkStation port of U-Boot described in this document is for the PowerPC version 1 (model HD-HLAN-1) only. It will not work properly on any other PowerPC LinkStation (although it might work on the Kuro-Box).

This version of U-Boot will certainly not work on the the LinkStation version 2 (model HD-HLAN-2) as the LinkStation version 2 is based on a MIPS processor. The MIPS processor is completely different from the PowerPC processor and attempting to flash a LinkStation version 2 with PowerPC firmware it is guaranteed to make it completely unusable.

Get telnet Access

Try to connect to your LinkStation using telnet. If you see the telnet command prompt, read CGI Exploit (PowerPC) original method of Hacking the LinkStation about how to get telnet access.

If the above method doesn't work for you, read Turn your LinkStation into a Kuro Box (PowerPC) for other methods to get telnet access.

Install the Serial Console

Read Add a Serial port to the PowerPC Linkstation to learn how to install the serial console.

Installing the serial console is not an absolute requirement and it will void your warranty. U-Boot can be installed and controlled without it. However, the serial console will give you the best control over both U-Boot and Linux.

Install nc

You will need to install nc (net console) if you haven't installed the serial console. nc comes standard with most Linux distributions. For more information, visit the netcat home page .

Get the ELDK

If you don't have a cross toolchain installed, download the DENX Embedded Linux Development Kit (ELDK) from, install it and spend some time getting familiar with it.


Create the build directory and set the environment variable UBOOT_BUILD to the path to it

# mkdir <your_build_directory>
# export UBOOT_BUILD=<your_build_directory>

Download the tarball for u-boot-1.1.4 from
Download the LinkStation patch, u-boot-1.1.4-ls-hlan-1.0.diff.gz
Download the uloader module, uloader-1.0.tar.gz

Untar u-boot-1.1.4 and apply the patch.

# tar xjf u-boot-1.1.4.tar.bz2
# cd u-boot-1.1.4
# gunzip ../u-boot-list-v02.diff.gz | patch -p1

Untar the uloader archive. The archive contains the source code, a binary module compiled for the original LinkStation kernel (version 2.4.17_mvl21-sandpoint) and a simple bash script to load and start a RAM build of U-Boot. If you have a different kernel version, you may need to recompile the module for your kernel. Compiling the module requires a fully configured LinkStation kernel tree and gcc 2.95 (cross compiler).

# cd ..
# tar xjf uloader.tar.bz2
# cd u-boot-1.1.4

Source your ELDK environment

# . <path_to_your_ELDK>/config_6xx


Edit include/configs/linkstation.h and set the following variables for your environment:

CONFIG_IPADDR_LS  -  the IP address of your LinkStation while running U-Boot
CONFIG_SERVERIP_LS  -  the IP address of the NFS/TFTP/DHCP/BOOTP server, normally the address of your Linux PC
CONFIG_NCIP_LS  -  the address of the computer running net console, normally the address of your Linux PC

and run:

# make linkstation_config

RAM Build

The distribution defaults to a ROM build. To change it to a RAM build, edit the file board/linkstation/ Comment out the line:

TEXT_BASE = 0xFFF00000

and uncomment the line:

#TEXT_BASE = 0x03F00000

Save the file and build U-Boot:

# make

Rename the U-Boot binary to show that this is a RAM build

# mv u-boot.bin u-boot.ram

Always rename your u-boot binaries to the type of build. This will help you avoid burning the wrong file. If you flash your LinkStation with a RAM build, you will "brick" it.

Minimal Console

This port of U-Boot to the LinkStation is designed to allow some control over the boot process even in the absence of a console. For this, it uses the power button (the big button at the front) and the reset button (the small red button at the back).

When the LinkStation is switched on, the power LED starts blinking and, very quickly, it starts booting the kernel from flash. If U-Boot is installed, the power LED will change from blinking quickly to blinking very slowly. This means that U-Boot has taken over and it is counting down the boot delay before booting the kernel. The default boot delay is 10 sec. From the moment when the power LED starts blinking slowly and for the duration of the boot delay, you can control the boot process with the power and reset buttons.

The Power Button

If you push the power button and keep it pressed for more than 1 sec, the boot process will stop and the LinkStation will wait for a command. A stopped boot process is indicated by the power LED being lit solid. The effect is the same a pressing 's' on the console.

A long push of the power button acts as a toggle. If the boot delay count down is in progress, a long push of the power button stops the boot process. If the boot process is stopped (U-Boot is at the command prompt, even if you can't see it), a long push of the power button restarts the boot process resetting the boot delay to its original value.

By default U-Boot supports three pre-configured boot commands:

  1. The first boot command will boot the original kernel from flash. Please note that the original kernel has a bug in the function that calibrates the decrementer and it will stop for up to 180 sec during boot. This bug is not an U-Boot bug but a kernel bug which is uncovered by the fact that U-Boot activates the decrementer where the original boot loader doesn't.

  2. The second boot command will attempt to load and boot a file named vmlinux.PPCBoot from the first hard disk partition, /dev/hda1. If the file is missing, it will fall back to booting the original kernel from flash.

  3. The third boot command will attempt to load and boot a file named vmlinux.UBoot from the third hard disk partition, /dev/hda3. As above, if the file is missing, it will fall back to booting the original kernel from flash.

You can cycle through the boot commands with the power button.

To see which of the three commands U-Boot is going to execute, press the power button quickly. The HDD LED (the third from the top) will start blinking. The number of times the LED blinks, shows the number of the active boot command. For example, a pattern short on - short off - short on - long off, means that the boot command number 2 is active. U-Boot will repeat the blinking cycle for a total duration of about 5 sec counting from the moment the power button is released.

A short press of the power button while the HDD LED is blinking will advance the boot command to the next one.

The Reset Button

Two consoles are currently configured, the serial console and the net console. The first console is the serial console and the second console is the net console.

The reset button can be used, similarly to the power button, to switch consoles. A press on the reset button (here, it doesn't matter how long you keep the button pressed) displays the currently active console using the HDD LED. Repeatedly pressing the reset button while the HDD LED is blinking will toggle between the two consoles. The blinking pattern is different from the one showing the boot command. The pattern which shows that the second (nc) console is active is short off - short on - short off - long on. U-Boot will repeat the blinking cycle for a total duration of about 5 sec counting from the moment the reset button is released.

Load and Test

Mount the LinkStation SMB public share and copy the following files to it: u-boot.ram, uloader.o,

# mount -t smbfs -o password="" //<your_linkstation_name_or_ip>/share/mnt
# cp u-boot.ram /mnt
# cp ../uloader/uloader.o /mnt
# cp ../uloader/ /mnt
# umount /mmt

Open another window and use minicom to connect to your LinkStation serial console. The serial port settings are 57600,N,8, the same as the settings used by the original Linux kernel.

If you didn't install the serial console, you must have nc installed. Open another window and run board/linkstation/ To quit nc, press ^T (control-T).

# cd $UBOOT_BUILD/u-boot-1.1.4
# board/linkstation/ <ip_of_your_linkstation>

Where <ip_of_your_linkstation> is CONFIG_IPADDR_LS (see Configure U-Boot above). When you run nothing will be written to the screen. This is normal as Linux is not using the net console.

From your original window, use telnet to connect to the LinkStation and launch U-Boot. Replace linkstation in the example below with the name / IP address of your LinkStation. Replace myroot with the login you created when you gained telnet access.

# telnet linkstation
Connected to linkstation.
Escape character is '^]'.


linkstation login: myroot
Linux (none) 2.4.17_mvl21-sandpoint #24 Mon Jul 3 00:26:23 BST 2006 ppc unknown
root@linkstation:~# cd /mnt/share
root@linkstation:/mnt/share# ./
root@list:/mnt/share# Connection closed by foreign host.

If you have a serial console you should see the U-Boot startup messages. Press 's' on your keyboard to stop the boot process.

If are using net console, watch the power LED of your LinkStation. When it starts blinking very slowly, use the power button to stop the boot process. Wait for the power LED to go dim and press and hold the power button until the LED lights up brightly indicating that the boot process has stopped. Now press the reset button twice and you should see the U-Boot command prompt (=>) in your net console window. You can now control U-Boot from the nc window.

When using nc, you will notice that the console is quite unresponsive and loses characters quite often. This is due to the way U-Boot implements the net console. U-Boot calls the net console driver in the main command loop. The driver starts the network controller, and waits for a net console packet. If no packet is received within 1 msec, the driver shuts down the network controller. I have increased the the net console driver timeout from the original 1 msec to 50 msec and, as a result, the net console has become somewhat usable. If a character is not echoed back to you, it was lost. Keep typing it until you see it echoed to the screen. After a while you will get a feel of the best typing speed to minimise the character loss.

Once you get the U-Boot command prompt, start testing it. Read the documentation and try each command you are interested in. A very important command is flinfo which displays information about the flash chip. If the information displayed is correct for your flash, check the flash erase and flash write commands. To do this, you will need to find an empty sector, one for which each byte is 0xFF. Hint: check the last flash sector first, chances are that it's empty. When you are testing commands that write to the flash, always remember that you can write a single byte but you can only erase whole sectors.

Test the flash commands thoroughly before deciding to burn U-Boot into flash.
The flash routines in this version of U-Boot for the LinkStation should be able to identify and handle any CFI flash which uses the AMD standard command set. However, they were tested only on a LinkStation with a Fujitsu MBM29PL32TM flash chip.

ROM Build

Once you are happy with the RAM build, you are ready for the ROM build.

# cd $UBOOT_BUILD/u-boot-1.1.4

Edit the file board/linkstation/ for a ROM build.

Uncomment the line:

#TEXT_BASE = 0xFFF00000

and comment out the line:

TEXT_BASE = 0x03F00000


# make mrproper
# make linkstation_config
# make

Rename the u-boot binary to show that this is a ROM build

# mv u-boot.bin u-boot.rom

and copy it to your LinkStation SMB share.


Flashing U-Boot from U-Boot

The RAM build of U-Boot can be used to load and flash the ROM version. I strongly recommend you use the serial console for this operation.

At the U-Boot command prompt type the following commands:

=> ext2load ide 0:3 800000 u-boot.rom
=> protect off fff00000 fff6ffff
=> era fff00000 fff6ffff
=> cp.b 800000 fff00000 ${filesize}

When the flash finishes, U-Boot returns to the command prompt (=>). Depending on your flash chip, this can take a long time. Wait patiently and do NOT try to power down or otherwise interrupt the flash or you will end up with a "brick".

Double check that the flash was successful:

=> cmp.b 800000 fff00000 ${filesize}


=> reset

The power LED should start blinking slowly and, if you have a serial console, you should see the U-Boot startup messages. Your LinkStation is now running U-Boot.

Flashing U-Boot from Linux

Connect to your LinkStation using either the serial port or telnet.

# cd /mnt/share
# dd if=u-boot.rom of=/dev/fl2 bs=1k
# cmp u-boot.bin /dev/fl2
cmp: EOF on u-boot.bin

If the Flash Fails

If the flash was not written correctly but U-Boot returns at the command prompt you should re-erase the range fff00000 and fff6fff and attempt the copy again.

If the same happens when you attempt to install U-Boot from Linux, try to dd again.

If your flash fails completely, for example due to a power failure, all is not completely lost. You can still use a JTAG cable to re-flash your Linkstation. Unfortunately, this is a relatively complicated and expensive solution as it involves acquiring or building the JTAG cable and soldering the header for it on the LinkStation motherboard. For more information on how to use a JTAG cable with the LinkStation you can visit and