The Open Turbostation:TS101 is a member of the Turbostation Family of Network Access Storage Device from QNAP (Taiwan). The device has gigabit LAN and contains space for a single 3.5" SATA drive; as well as connectivity to external USB and e-Sata drives. Full product details and updated firmware are available from Qnap TS101.
Progessive Audio provides a firmware update (and support) for enabling Slimserver in order to stream data to the Squeezebox / Transporter Audio sytems. It is recommended! Alternatively the latest firmware from QNAP allows UPnP streaming using TwonkyMedia.
There appear to be at least two types of PCB boards for the TS101. V1.02 uses an Intel Gigabit ethernet controller, may have the Type III Mini-PCI connector, and a JTAG interface. A later variation? (version unknown) is shown on smallnetbuilder where holes are provided for heatsink mounting on the CPU. The most recent board V200 (decimal point missing?) is identical to the board used in the TS-201 but with some different sata connectors and no heatsink. Compared with the earlier TS-101 boards the JTAG interface has been removed and the Intel Gigabit ethernet replaced by a Realtek version.
|2x PSC A2V56S40BTP; 518ALA00 Taiwan -7||64MB SDRAM - TSOP54 Package||Specifications unknown|
|1x Freescale MPC8241LVR266D; 4K78P; QQKU0528||266MHz PowerPC CPU||Specifications|
|1x Microchip PIC16F627A; 0430360||8 bit Microcontroller||Specifications|
|1x Spansion S29GL128N11TF101; 0508ABA H||128Mbit (16MB) Flash||Specifications|
|1x Silicon Image SiI 3512 ECTU128; QB2170.1-4; 0523 AD03AX2||2x SATA 150 Controller||Specifications|
|1x NEC D720101GJ; 0529PPA72||USB 2.0 Controller||Specifications|
|1x Intel RC82540EM; 0503; FG31301.1||GB Ethernet Controller||Specifications|
|or 1x Realtek RTL8110SCL||GB Ethernet Controller|
The 2x3 Pin connector (labelled JP2) is located on the HDD side of the PCB behind the LED1 / USB light (below the QNAP label). This is a serial port running at TTL 3.3V. It is similar to the Synology DS101 and can be connected to at 115200 baud; 8n1 software handshakes.
At boot time you can press space to interrupt the boot loader - see below for more details. Under normal operation there is no login prompt available on the serial port.
Update: With firmware 2.5.0 Build 0505T there is a login prompt at any time, initialised by the init-process (respawn::getty). To avoid the system to offer this login prompt (while you wish to use the serial port for any other data transfer), comment-out this line in the /etc/inittab, restart the init process with init -q and kill the current getty-process. Don't forget that the kernel will send error-messages to this port anyway.
Further information on connecting the serial port is available on the Serial Communications page.
There is an unpopulated connector (JP1) on the V1.02 board (absent on the V200 boards) that may provide JTAG access to the CPU. This would allow re-flashing of a 'bricked' TS-101, but needs further investigation to see what can be done economically (if at all).
If the connector follows the recommended layout (Pg 50), the pin assignments should be:
The actual pin outs measured on the board are as follows...
|To uP (BGA)||1||2||N/C?|
|To uP (BGA)||3||4||D8 & R155 (N/C) -->VDD|
|RN5/4 (N/C?)||5||6||R163 (N/C?) -->VDD|
|To uP (BGA)||7||8||R162 (N/C?) -->VDD|
|To uP (BGA)||9||10||N/C?|
Since most JTAG references would indicate that the important signals are TDI, TDO, TMS, TCK, possibly TRST_N and SRST_N, then it is likely the outputs match. Note if RN5, R155, R162 and R163 were populated they would connect to VDD (e.g. of SDRAM). JTAG specifications would indicate that there should be a 100 Ohm resistor between VDD and VREF as a current limiter.
A simple parallel port based circuit can be found here.
And a USB schematic based on the FTDI2232 can be found here
Unfortunately there isn't a great selection of free/cheap software compatible with the MPC8241. However the Kurobox community (similar hardware) seem to have come up with a reasonably affordable although not very performant solution based on the parallel port cable and Openwince JTAG tools. USB Openwince tools are in development... e.g. with FX02 or Byteblaster.
This information will move to the JTAG Programming Page.
PIC Serial Programming
The PIC controller can be programmed using the 'In Circuit Serial Programming TM' (ICSP) mode (see page 112 of PIC manual for more info). There are 5 through pins located close to the main SATA connector; Pin 1 is closest to connector. If looking from component side (and LED's are to your right), Pin 1 is closest to the BZ1 label; and CN2 is written on right hand side. The following layout is used
|Pin 1||#12||RB6 / PGC / CKI|
|Pin 2||#13||RB7 / PGD|
|Pin 3||#05||VSS (0V)|
|Pin 4||#14||VDD (+5V)|
|Pin 5||#04||RA5 / VPP|
Further info on the 'in circuit serial programming guide'
There are clearly two empty SDRAM slots on the original PCB board. According to QNAP, the memory cannot be upgraded and is fixed at 64MB. The details of the MPC controller shows that it can support a maximum of 2 Gigabytes of RAM; attached in 1-8 banks of 16,64, 128 156, 512 MB. Quick calculations show that things dont add up; unless you consider that SRAM is addressed in row, column, bank format. Getting to the bottom of this is complicated as there are no public specifications for the existing PSC SDRAM.
Update 31/10/06 According to an archived forum the memory A2V56S40BTP-G75 is SDRAM 16MX16 3.3V 7.5ns TSOP54 LT/LF PSC. The G75 would be representative of using PC133 speed (similar to Micron numbering).
Can we use the empty sockets?
In principle we should be able to - a lot depends upon how the designers connected things.
A further investigation showed that there are some unconnected capacitors associated with the empty SDRAM sockets; these are listed below. Assuming that all SDRAM with the TSOP54 footprint have the same pinouts then using information for the Micron MT48 series should enable the functionality to be deduced. Values are unknown as they are not readable on the SMD components; but they seem to be stabilisation (debounce) capacitors connected between the power supply and isolated DQ power supply. Please fill out the table if further information is found.
- Application examples for VDDQ power supplies indicate a capacitor of approx 10uF between VDDQ and VSSQ.
- With great thanks to Flipflip and the NSLU2 website, it is possible to view high resolution images of the Synology DS106x - a memory upgraded model of the DS106. Two sets of chips have coupling capacitors; and two do not. The memory is however all matched.
Memory Upgrade - Perhaps Not?
It seems that the memory has to be manufacturer matched; in order to make sure the addressing routines are identical. Currently using alternative products (e.g. Micron) do not appear to work; this could be due to the way row, column values are mapped. The U-Boot code indicates that the maximum memory available is 0x10000000 (= 256MByte) using two chips in bank 0. All other banks are disabled. To add extra memory would therefore require recompiling the U-boot firmware. Alternatively it might be possible to remove the existing PSC chips (2x32MB) and replace them with others (e.g. Micron) upto a maximum of 2x128MB.
Can we replace the existing chips?
Based on the fact that the capacitors are purely acting for stability it would seem logical that the existing chips can be extracted and replaced with new ones. Once again getting better specifications on the PSC chips would enable an easy answer. Most of the Micron memory chips are 4 bank devices; and go upto 256MB; thus allowing a theoretical potential of 512MB ram. Practically though it is not clear whether the CPU is running in 32 bit or 64 bit access; or has the full PCB connected capacity for the higher memory options. Unfortunately the CPU is a Ball Grid Array device; and getting access to check all the pins is not easy.
Which chips might work
Any SDRAM TSOP 54 (54 pins) chips which are x16 format could work. To get the 32Mbyte you would need 256MBit; 64Mbyte would then by 512MBit.
- 2x MT48LC16M16A2P-75, PC133 SDRAM (256MBit, 32 MByte)
- 2x MT48LC32M16A2P-75, PC133 SDRAM (512MBit, 64 MByte)
- 2x K4S561632H or E, PC133 SDRAM (256MBit, 32 MByte)
- 2x K4S511632D or B, PC133 SDRAM (512MBit, 64 MByte)
- 2x HYB39S256160FT-7, PC133 SDRAM (256MBit, 32 MByte)
- 2x HYB39S512160AT-7, PC133 SDRAM (512MBit, 64 MByte)
It is also worth checking their website independantly in case they change the release numbers slightly.
Mini PCI Connector
Originally the Turbostation TS101 was announced with a optional wireless card; however this option never materialised. Some of the PCB's released had space and layout for the SMD connection of the connector; but this was left blank. Other boards (>August 2006) seem to have the connectors added. There is currently no known information about which mini-pci (type III) boards may be suitable.
An interesting observation: there is a sealed hole at the end of one of the cases which might be for an ariel for a wifi connector. This may be needed because the casing could cause interference problems.
Update: 11/10/06 QNAP have claimed at the Mini PCI feature is not yet enabled in the firmware. If the board has a Mini PCI slot then it is a new board version and more announcements will follow in the future. Whether old boards can be retrofitted with the correct slot is still unknown.
If you want to put on a mini-PCI connector the following types can be used. NOTE the lower versions are probably not useful due to height clearance. The ideal height should be around 6.2mm!
Molex 67315-0011 (4mm high) or 67391-0011 (5.2mm high); Tyco Electronics 1734835-1 (6.7mm), 1734835-2 (6.7mm), 1734069-3 (6.7mm), 1734661-1 (5.6mm) and 1734027-3 (6.00mm)
Mini PCI Boards
There are lots to choose from - but the NSLU site provides some useful ideas. E.g. Wifi; More SATA / Hardware Raid / VGA / Firewire / Audio...
The USB chip is the same as those used on the kurobox devices; and checking the circuit appears to show that USB ports 1 and 5 are not used. Certainly DM1 appears to be N/C; and RSDM1 held to low. It may be possible to enable them using something like the kurobox usb upgrade.
Technical documents from NEC (pdf) show the proposed circuit layout for driving USB devices. Checking through the physical circuit, it is clear that QNAP followed very similar layouts.
|142||RSDP5||N/C or floating|
|141||DP5||15k (R33) pull down to ground|
|139||DM5||15k (R35) pull down to ground|
|138||RSDM5||N/C or floating|
|115||RSDP1||N/C or floating|
|114||DP1||15k (R16) pull down to ground|
|112||DM1||15k (R3) pull down to ground|
|111||RSDM1||N/C or floating|
To power additional USB ports small 36 Ohm resistors (e.g. SMT 0406) would be needed to connect RSDPx to DPx and RSDMx to DMx. Additionally the DPx and DMx lines would need to be brought out to a USB connector. Power could be drawn from the existing USB ports. This soldering is not for the faint hearted!
USB Swap File
Based on comments from the [forums.slimdevices.com Slimdevices forums] there could be opportunities to add a cheap USB stick to one of the ports; and use this for a swap file. This could help enable hard disks to spin down when not needed.
The firmware is a PC1 encrypted compressed tarball. En/Decryption binaries for Linux x86 is available here. The encryption key used is QNAPNASVERSION4 for TS101. Firmware 2.0.1 contains the following files:
- initrd.boot (2.5M)
- rootfs_ext.tgz (7.8M)
- uImage (1.8M)
The firmware source code and configuration is currently available under GPL from the QNAP website. First head to the Specifications page; select Download and then the 'Technical Docu' link. For convienence the link is here but this could break in the future.
There is 16MB of flash memory from which the system boots, organised as follows:
The QNAP firmware update process updates only the Kernel (uImage), RootFS1 (initrd.boot) and RootFS2 (rootfs_ext).
The boot loader - Das U-Boot (1.1.2).
Compressed kernel image (126.96.36.199 for the 1.2.1 firmware) with a U-Boot header.
The root filesystem, gzip'ed ext2 image with a U-Boot header. This filesystem is loaded into a ramdisk /dev/ram0 during booting.
This is a tar'ed and gzip'ed ext2 filesystem (not sure why they used tar?). It is copied to /dev/sda4 during boot and mounted as /mnt/ext.
An ext2 filesystem image containing an empty autorun.sh file which is run during system startup. This part of the flash may be used to startup any software not supplied with the firmware by writing a customised autorun.sh file.
The boot loader environment.
This partition has a small ext2 filesystem image with two files. One file ETH0.MAC_ADDR defines the unit's MAC address.
The other file seems to have the results output from a hardware test.
QNAP have used U-Boot for the Linux boot loader, with some minor modifications for the Turbostation.
As supplied there are no options for booting from the network or other devices. However it is possible to install a new boot loader to provide more functionality.
More details can be found on the Boot Loader page.
TT===Shell Access as root=== As shipped, the TS-101 may not have any shell access enabled - neither telnet or a login via the serial port. However firmware release 1.2.1 allows you to 'enable' this on the fly using a hidden function in the admin GUI.
Beta firmware releases for 1.3.0, 2.0.0 and 2.1.0 are known to have telnet enabled as default; and users should skip this section.
Enabling the Telnet Port - Firmware 1.2.1
The following is known to work for a standard TS-101 updated to the official 1.2.1 firmware.
Two bits of information are required:
- the Server Name
- the MAC address
Both are available from the admin web interface (System Settings and Network Settings).
A special string is then constructed; first converting all letters to upper case. Lets assume the server name is 'MyTs101' with the MAC address '00:08:9B:8A:64:1A'.
Then, having already been authenticated to the TS-101 administration screens enter the following URL, taking care to use lowercase hex digits:
And you should receive a message saying that console access is enabled (or disabled if you use login=no). Telnet is then available on port 13131. Unfortunately this enabling process needs to be repeated if the TS-101 is power-cycled.
NOTE: For firmware version 2.0.0-Build 0105, Telnet is not enabled by default. It can be enabled using the method described here. Just update the appended firmware version number to 2.0.0. So the special string to encrypt, from the example above, would become:
and the corresponding digest:
leading to this URL:
hint: create a bookmark for the URL to easily re-enable Telnet after a power-cycle.
Accessing the Telnet port
Once enabled (or as default) telnet is running on port 13131. You can log in using the same credentials as for the web administration GUI to get 'root' access. It's only telnet, so you probably don't want to open up port 13131 to the outside world!
Under windows you can use telnet under the command prompt (cmd). Type 'telnet MyTS101 -l administrator 13131 where MyTS101 can also be replaced with the ip address. Or do yourself a favour and get hold of PuTTY instead.
A getty process is also started allowing root login via the serial port.
Installing new packages
The TS-101 firmware is based on uClibc and BusyBox. There is a pre-built PowerPC rootfs available for download from the uClibc site that contains a number of ready-to-run utilities not included in the TS-101 firmware; including gcc and dropbear ssh. These are linked to uclibc0.9.27 which appears to be standard in the 1.3.1 and 2.0.0 firmware.
Information on setting up cross compilers, and new user developed software packages for the Turbostation family can be found on the software page.
An OpenTurbostation mailing list has been created at Yahoo!. Please use this to ask specific questions rather than adding lines to the Wiki. We suggest subscribing on a daily digest basis in order to minimise traffic to your mail boxes.