-1

I am looking for somebody with a functioning QNAP TS-228 (32 bit; non-a version). I had a firmware upgrade gone bad and the firmware got corrupted. I have a usb ttl so I managed to connect to serial console and somewhat fix the box (extracted/decrypted the latest QTS firmware and replaced the faulty files).
Unfortunately - I also managed to break the u-boot. Since there is no recovery firmware for this model, I installed the u-boot image from TS-228a (newer model). So the NAS now boots fully, but I have to manually run a bootr u-boot command every time i power it on.

< cut messages >
get_bootparam:
------------can't find tmp/factory/000BootParam.h
Factory RO: MMC
Factory RO: seq#:0x1, size:0x200
[ENV] read_env from factory failed
[ENV] Using default environment variables

In:    serial
Out:   serial
Err:   serial
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery

Press Install Button

(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found

1: Hub,  USB Revision 2.0
 - u-boot EHCI Host Controller
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms


USB device -1: device type unknown

** Invalid boot device **
Loading "rescue.emmc.dtb" from USB failed.
Enter console mode, disable watchdog ...

Realtek>

Realtek> env print
baudrate=115200
bootargs=console=ttyS0,115200 earlyprintk loglevel=4
bootcmd=bootr
bootdelay=0
ethact=r8168#0
ethaddr=00:10:20:30:40:50
fdt_loadaddr=0x01FF2000
gatewayip=192.168.100.254
ipaddr=192.168.100.1
kernel_loadaddr=0x03000000
mtd_part=mtdparts=rtk_nand:
netmask=255.255.255.0
rescue_audio=bluecore.audio
rescue_cmd=go ru
rescue_dtb=rescue.emmc.dtb
rescue_rootfs=rescue.root.emmc.cpio.gz_pad.img
rescue_vmlinux=emmc.uImage
rootfs_loadaddr=0x02200000
serverip=192.168.100.2

Even though the boot env variable is set to bootr I always have to execute it manually to start up the box:

Realtek> bootr
Start Boot Setup ...
[INFO] fw desc table base: 0x00620000, count: 6
Normal boot fw follow...
Kernel:
         FW Image to 0x03000000, size=0x00592a00, 0x2c95 blocks (0x03592a00)
         FW Image fr 0x008b7600, fr block 0x45bb (non-lzma)
DT:
         FW Image to 0x01ff2000, size=0x000064fa, 0x33 blocks (0x01ff84fa)
         FW Image fr 0x00630000, fr block 0x3180 (non-lzma)
resolution = <0x500 0x2d0>
ROOTFS:
         FW Image to 0x02200000, size=0x00400000, 0x2000 blocks (0x02600000)
         FW Image fr 0x01a4a000, fr block 0xd250 (non-lzma)
Audio FW:
         FW Image to 0x01b00000, size=0x0027f528, 0x13fb blocks (0x01d7f528)
         FW Image fr 0x00638000, fr block 0x31c0 (non-lzma)
Start A/V Firmware ...
e# Booting kernel from L
 gaHDcyM IIm aRgea awt  0E30n0a00b00l e:... M

Also tried to contact the qnap support but they were no help.

Since I don't know exactly what the problem is, I need a full dump of the /dev/mmcblk0 from a TS-228 to fix my box. I would be greatfull to anyone willing to share this with me.

Something like this should do the trick:

gzip </dev/mmcblk0 > /share/Public/emmc.img.gz

Thanks!

Sleepwalk3r
  • 9
  • 1
  • Maybe you just need a proper config file for u-boot. It might tell you on the console, that it is looking for it but it is not found. Usually the name of this file is uboot.env or uboot.txt. It is a binary file, but easily created with u-boot utils in Linux. Another option might be to write the new environment directly in console. – d.c. Mar 03 '21 at 22:34
  • there is no boot config on the system - at least i didn't find any. there's a `can't find tmp/factory/000BootParam.h` message during the boot that might be what you are talking about. But still - i don't have that and don't know where to get it (without having an u-boot dump) – Sleepwalk3r Mar 04 '21 at 08:50

2 Answers2

1
[~] # dd if=/dev/mmcblk0boot0  of=/share/Stuff/uboot.img
8192+0 records in
8192+0 records out
[~] #

Here is the dump: https://easyupload.io/txq4cw

Northy
  • 11
  • 1
  • Thank you! This helps a lot. – Sleepwalk3r Mar 06 '21 at 11:53
  • Unfortunately it didn't solve my issue. It however did confirm my suspicion that the mmcblk0bootX paritions on X28 are empty (when looking at the image with a hex editor, it's just zeroes). If you would be so kind, can you maybe dump the whole emmc so that I can compare it with my own to figure out what is wrong? It is a ~1G file (compressed) though so I understand if you don't want to bother with it. If you - by any chance - would like to do it, this should do the trick (it takes several minutes to complete). `gzip /share/Stuff/mmc.img.gz` – Sleepwalk3r Mar 06 '21 at 12:00
0

Here is the file mmc.img.gz. https://easyupload.io/m47313 c75889a913eb82d5cbbf695ea92d7875 emmc.img.gz

new link : https://easyupload.io/4kpr56

Thomas Genty
  • 1
  • 2