I am looking for somebody with a functioning QNAP TS-228 (32 bit; non-a version).
I had a firmware upgrade gone bad and the firmware got corrupted. I have a usb ttl so I managed to connect to serial console and somewhat fix the box (extracted/decrypted the latest QTS firmware and replaced the faulty files).
Unfortunately - I also managed to break the u-boot. Since there is no recovery firmware for this model, I installed the u-boot image from TS-228a (newer model).
So the NAS now boots fully, but I have to manually run a bootr u-boot command every time i power it on.
< cut messages >
get_bootparam:
------------can't find tmp/factory/000BootParam.h
Factory RO: MMC
Factory RO: seq#:0x1, size:0x200
[ENV] read_env from factory failed
[ENV] Using default environment variables
In: serial
Out: serial
Err: serial
Net: Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
Hit Esc or Tab key to enter console mode or rescue linux: 0
------------can't find tmp/factory/recovery
Press Install Button
(Re)start USB...
USB0: USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
1: Hub, USB Revision 2.0
- u-boot EHCI Host Controller
- Class: Hub
- PacketSize: 64 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms
USB device -1: device type unknown
** Invalid boot device **
Loading "rescue.emmc.dtb" from USB failed.
Enter console mode, disable watchdog ...
Realtek>
Realtek> env print
baudrate=115200
bootargs=console=ttyS0,115200 earlyprintk loglevel=4
bootcmd=bootr
bootdelay=0
ethact=r8168#0
ethaddr=00:10:20:30:40:50
fdt_loadaddr=0x01FF2000
gatewayip=192.168.100.254
ipaddr=192.168.100.1
kernel_loadaddr=0x03000000
mtd_part=mtdparts=rtk_nand:
netmask=255.255.255.0
rescue_audio=bluecore.audio
rescue_cmd=go ru
rescue_dtb=rescue.emmc.dtb
rescue_rootfs=rescue.root.emmc.cpio.gz_pad.img
rescue_vmlinux=emmc.uImage
rootfs_loadaddr=0x02200000
serverip=192.168.100.2
Even though the boot env variable is set to bootr I always have to execute it manually to start up the box:
Realtek> bootr
Start Boot Setup ...
[INFO] fw desc table base: 0x00620000, count: 6
Normal boot fw follow...
Kernel:
FW Image to 0x03000000, size=0x00592a00, 0x2c95 blocks (0x03592a00)
FW Image fr 0x008b7600, fr block 0x45bb (non-lzma)
DT:
FW Image to 0x01ff2000, size=0x000064fa, 0x33 blocks (0x01ff84fa)
FW Image fr 0x00630000, fr block 0x3180 (non-lzma)
resolution = <0x500 0x2d0>
ROOTFS:
FW Image to 0x02200000, size=0x00400000, 0x2000 blocks (0x02600000)
FW Image fr 0x01a4a000, fr block 0xd250 (non-lzma)
Audio FW:
FW Image to 0x01b00000, size=0x0027f528, 0x13fb blocks (0x01d7f528)
FW Image fr 0x00638000, fr block 0x31c0 (non-lzma)
Start A/V Firmware ...
e# Booting kernel from L
gaHDcyM IIm aRgea awt 0E30n0a00b00l e:... M
Also tried to contact the qnap support but they were no help.
Since I don't know exactly what the problem is, I need a full dump of the /dev/mmcblk0 from a TS-228 to fix my box. I would be greatfull to anyone willing to share this with me.
Something like this should do the trick:
gzip </dev/mmcblk0 > /share/Public/emmc.img.gz
Thanks!