Recovery mode of the QNAP TS-109

QNAP added a recovery mode to their devices that can be used when there is a problem with your installation of Debian that renders your device unbootable. The system recovery mode allows you write a recovery image to flash via the network using the TFTP protocol. This pages describes how you can verify whether your device includes the recovery mode, how to upgrade your firmware to a version that includes the recovery mode, how to create recovery images and finally how to use the recovery mode.

Verifying whether your system has the recovery mode

The QNAP recovery mode is relatively new and is not included in QNAP devices that were manufactured prior to 2009. Even if you have a new QNAP device, you should verify whether your firmware includes the recovery mode. You can do this with the following command:

cksum /dev/mtdblock0

Please compare the first value that is printed with those from the following table to see whether your device has the recovery mode already:

If your device does not have the recovery mode, please read on to see how you can upgrade your firmware. If the value printed by cksum is not listed in this table, please contact me.

Installing the recovery mode

You can install the recovery mode according to two ways, depending on whether you are running the full QNAP firmware or have an uninitialized QNAP system.

Fully Initialized QNAP System

QNAP provides a page about the recovery mode which tells you exactly how to install the recovery mode. In short, you have to install a QPKG provided by QNAP that will automatically install the recovery mode.

Uninitialized QNAP System

You need a USB stick on which you can store some files. Please put the USB stick in your PC, download the zip file for your QNAP device from QNAP's recovery mode page (but ignore the installation instructions from that page). Unzip the file and copy the .qpkg file to the USB stick. Now start your QNAP device and connect the USB stick to it. Login to your QNAP via telnet as the admin user as described in the installation guide and go into the directory where the USB stick is mounted.

First of all, you should make a backup of your flash partitions using the following commands:

cat /dev/mtdblock1 > mtd1
cat /dev/mtdblock2 > mtd2
cat /dev/mtdblock3 > mtd3

Now you can unpack the QPKG file provided by QNAP:

dd if=QNAP_SystemRecovery_1.0_TS-109.qpkg bs=526 skip=1 | tar xzv

This will create two files: qinstall.sh and QNAP_SystemRecovery.tgz. We are only interested in the latter, which you have to unpack with:

tar xzvf QNAP_SystemRecovery.tgz

Now you can start the actual upgrade process. There are two steps you have to follow. First of all, you have to update the Linux kernel. Normally, the Linux kernel is configured so it won't allow you to change mtd0, the flash partition where the u-boot boot loader is stored. The first step is therefore to write a Linux kernel to flash that doesn't protect mtd0, otherwise you couldn't upgrade u-boot to the new version that includes the recovery mode.

Make sure the checksum of the kernel image matches that listed in the cksum file:

cksum uImage
1122474640 1788312 uImage
cat uImage.cksum
1122474640 1788312 .../uImage

If they match, go ahead and write the kernel to flash:

dd if=uImage of=/dev/mtdblock1

You have to restart your machine now so the new kernel is loaded:

cd
umount /share/external/sdi
reboot

Once your system has restarted, login as admin again and go to the directory where your USB stick is mounted. Then verify the checksum of the u-boot binary:

cksum u-boot.bin
3310502457 459100 u-boot.bin
cat u-boot.bin.cksum
3310502457 459100 u-boot.bin

If they match, write the new u-boot to flash using the following command. Make sure that you don't interrupt this process and that your QNAP has a good power source. If the process of writing u-boot to flash is interrupted, your QNAP device might no longer boot!

dd if=u-boot.bin of=/dev/mtdblock0

You have successfully upgraded your firmware to a version that includes the recovery mode. You can now go ahead with the installation of Debian.

Creating recovery images

The QNAP recovery image contains a copy of mtd1, mtd2 and mtd3, i.e. the kernel partition, ramdisk partition and second ramdisk partition.

The official recovery image is 8 MB, but only the first 7 MB are actually used during the recovery process: the first 2 MB for mtd1 (the Linux kernel), 4 MB for mtd2 (the ramdisk) and 1 MB for mtd3 (another ramdisk). The remaining 1 MB are ignored (mtd4 and mtd5 contain device-specific information and mtd0 contains the u-boot boot loader which is not replaced during recovery).

Since only the first 7 MB are important, we generate a 7 MB recovery image.

Making a recovery image of the QNAP backup

Before installing Debian, you should have made a backup of the QNAP firmware and have several mtdX files. You can now make a recovery image out of the backup with this command:

cat mtd1 mtd2 mtd3 > qnapimg.bin

Making a recovery image from a running system

You can easily make a valid recovery image with the following command:

modprobe mtdblock
cat /dev/mtdblock1 /dev/mtdblock2 /dev/mtdblock3 > qnapimg.bin

It is recommended to create periodic recovery images of your flash, so you have a recovery image in case something goes wrong.

Making a recovery image containing the Debian installer

If you want to make a QNAP recovery image containing the Debian installer, you can follow these steps. First of all, download the initrd and kernel for the installer. You now have to pad the kernel so it is the right size:

dd if=kernel of=kernel.pad ibs=2097152 conv=sync

Finally, you can create a recovery image:

cat kernel.pad initrd mtd3 > qnapimg.bin

Note that the mtd3 file in this command refers to the backup you created earlier (before the installation).

Using the recovery mode

In case your Debian system no longer boots after a system upgrade, you can use the QNAP system recovery mode to restore a previous image, an image of the Debian installer, or the QNAP firmware.

The recovery mode will request a recovery image by TFTP from a server on your network. The QNAP will use the IP address 192.168.0.10 and will request a file called qnapimg.bin from the server with the address 192.168.0.11. These addresses cannot be configured.

You can activate the recovery mode by pressing the reset button on the back of your QNAP for about 10 seconds. I suggest you press the reset button and keep it pressed, and then turn on your QNAP device. After about 10 seconds, you will hear two short beeps. Your QNAP will now request a recovery image via TFTP. When it has obtained the recovery image and written it to flash, your QNAP will make one long beep and restart.

More information about the recovery mode can be found on QNAP's System Recovery Mode page.