HCL:TS228

The QNAP TS-228 is a Network Attached Storage (NAS).

Technical data

Realtek RTD1195 SoC
- 2x Arm Cortex-A7
2x 3.5" SATA hard drive bay
1x USB 2.0 host
1x USB 3.0 host
1x SD card reader
1x 1 Gb/s Ethernet
1x fan
1x UART connector (JST PH 2.0 4 Pin)
- 3,3 Volt
- https://www.ebay.de/itm/125977611392 fits perfectly

Manual installation

U-Boot

General informations

TFTP support is compiled in and can be used to load kernel, initrd and device tree to boot the device without modification to the original firmware.

Pressing poweron button and reset button at the same time will go into recovery mode and try to load the following files from usb. If they are not present it will present you with U-Boot shell.

rescue_dtb=rescue.emmc.dtb

rescue_rootfs=rescue.root.emmc.cpio.gz_pad.img

rescue_vmlinux=emmc.uImage

Start output

U-Boot 2012.07 (Jan 27 2016 - 17:16:49)

CPU  : Cortex-A7 dual core
Board: Realtek Demo Board
DRAM:  1 GiB
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
MMC:   rtk_emmc : Detect chip rev. >= B
RTD1195 eMMC: 0
rtk_emmc : Detect chip rev. >= B
mmc->version=0x00010000
version=0x00000004
SDR select (sample/push) : 0x00/0x00
[LY] cardtype=57, mmc->card_caps=0f
[LY] TBD : to support DDR50/HS200
[LY] SDR bus width=2
SDR select (sample/push) : 0x00/0x00
[LY] mmc->boot_caps = 203
[LY] sdr50 : 0
exit from mmc_startup(),err=0
Device: RTD1195 eMMC
Manufacturer ID: 11
OEM: 100
Name: 004G6
Tran Speed: 31975000000000a
Rd Block Len: 512
MMC version 4.0
High Capacity: No
Capacity: 3.7 GiB
Bus Width: 8-bit
Speed: SDR50
Factory: MMC
Factory: pp:1, seq#:0x184, size:0x21600
get_bootparam:
------------can't find tmp/factory/000BootParam.h
Factory RO: MMC
[FAC_RO] No factory_ro data in eMMC
In:    serial
Out:   serial
Err:   serial
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery

Press Install Button

(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found

1: Hub,  USB Revision 2.0
 - u-boot EHCI Host Controller
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms


USB device -1: device type unknown

** Invalid boot device **
Loading "rescue.emmc.dtb" from USB failed.
Enter console mode, disable watchdog ...

Builtin commands

bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootr   - boot realtek platform
burn    - burn image to factory via uart by rtice
dcache  - enable or disable data cache
env     - environment handling commands
facro   - FACTORY read-only sub system
factory - FACTORY sub system
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fdt     - flattened device tree utility commands
go      - start application at address 'addr' or start running fw
help    - print command description/usage
icache  - enable or disable instruction cache
keyset  - keyset  - write keyset file onto factory area

loady   - load binary file over serial line (ymodem mode)
md      - memory display
mmc     - MMC sub system (patch for rtd299x)
mtest   - simple RAM read/write test
mw      - memory write (fill)
ping    - send ICMP ECHO_REQUEST to network host
reset   - Perform RESET of the CPU
rtkmmc  - RTK MMC direct read function
saveenv - save environment variables to persistent storage
source  - run script from memory
tftp    - download image from TFTP server
tftpput - TFTP put command, for uploading files to a server
uart_write- for uart mp tool burn mac and sn key

unzip   - unzip a memory region
usb     - USB sub-system
verify  - verify image in factory

BDINFO

arch_number = 0x0000138A
boot_params = 0x00100100
DRAM bank   = 0x00000000
-> start    = 0x0000B000
-> size     = 0x40000000
ethaddr     = 00:10:20:30:40:50
ip_addr     = 192.168.100.1
baudrate    = 115200 bps
TLB addr    = 0x000D0000
*** bdinfo pll ***
SCPU  PLL   =  800 MHz
ACPU  PLL   =  576 MHz
VCPU  PLL   =  324 MHz
DDSA  PLL   =  432 MHz
DDSB  PLL   =  432 MHz
DCSB  PLL   =  351 MHz
BUS   PLL   =  459 MHz
GPU   PLL   =  378 MHz
LVDS  PLL   =  243 MHz
DDR   PLL   = 1333 MHz
*** bdinfo ddr ***
DDR   SIZE = 512*2 = 1024 MB  (Evaluated from DC1 0xb8008004/0x18008740)

environment variables

baudrate=115200
bootargs=console=ttyS0,115200 earlyprintk loglevel=4 
bootcmd=bootr
bootdelay=0
ethact=r8168#0
ethaddr=00:10:20:30:40:50
fdt_loadaddr=0x01FF2000
gatewayip=192.168.100.254
ipaddr=192.168.100.1
kernel_loadaddr=0x03000000
mtd_part=mtdparts=rtk_nand:
netmask=255.255.255.0
rescue_audio=bluecore.audio
rescue_cmd=go ru
rescue_dtb=rescue.emmc.dtb
rescue_rootfs=rescue.root.emmc.cpio.gz_pad.img
rescue_vmlinux=emmc.uImage
rootfs_loadaddr=0x02200000
serverip=192.168.100.2

Environment size: 520/131068 bytes

Kernel

The mainline Kernel has (very) basic support for the SoC.

It looks like the device is heavy based on Realtek 119x Horseradish