Open Turbostation:TS101

System Overview
The TS101 is a member of the Turbostation Family of Network Access Storage Device from QNAP (Taiwan). The device has gigabit LAN and contains space for a single 3.5" SATA drive; as well as connectivity to external USB and e-Sata drives. Full product details and updated firmware are available from Qnap TS101.

Progessive Audio provides a firmware update (and support) for enabling Slimserver in order to stream data to the Squeezebox / Transporter Audio sytems. It is recommended! Alternatively the latest firmware from QNAP allows UPnP streaming using TwonkyMedia.

Circuit Boards
The images below were taken from TS101 with the V1.02 PCB board. Many others do not have the type III mini pci connector in place.



Parts List
The earlier V1.02 boards seem to have the Intel Ethernet controller, whereas the newer V200 boards have the Realtek controller.

Serial Port
The 2x3 Pin connector (labelled JP2) is located on the HDD side of the PCB behind the LED1 / USB light (below the QNAP label). This is a serial port running at TTL 3.3V. It is similar to the Synology DS101 and can be connected to at 115200 baud; 8n1 software handshakes.

At boot time you can press space to interrupt the boot loader - see below for more details. Under normal operation there is no login prompt available on the serial port.

Further information on connecting the serial port is available on the Serial Communications page.

JTAG Access
There is an unpopulated connector (JP1) on the V1.02 board (absent on the V200 boards) that may provide JTAG access to the CPU. This would allow re-flashing of a 'bricked' TS-101, but needs further investigation to see what can be done economically (if at all).

If the connector follows the recommended layout, the pin assignments should be:

The actual pin outs measured on the board are as follows... Since most JTAG references would indicate that the important signals are TDI, TDO, TMS, TCK, possibly TRST_N and SRST_N, then it is likely the outputs match. Note if RN5, R155, R162 and R163 were populated they would connect to VDD (e.g. of SDRAM). JTAG specifications would indicate that there should be a 100 Ohm resistor between VDD and VREF as a current limiter.

Connectors
A simple parallel port based circuit can be found here.

And a USB schematic based on the FTDI2232 can be found here

Unfortunately there isn't a great selection of free/cheap software compatible with the MPC8241. However the Kurobox community (similar hardware) seem to have come up with a reasonably affordable although not very performant solution based on the parallel port cable and Openwince JTAG tools.

This information will move to the JTAG Programming Page.

PIC Serial Programming
The PIC controller can be programmed using the 'In Circuit Serial Programming TM' (ICSP) mode (see page 112 of PIC manual for more info). There are 5 through pins located close to the main SATA connector; Pin 1 is closest to connector. If looking from component side (and LED's are to your right), Pin 1 is closest to the BZ1 label; and CN2 is written on right hand side. The following layout is used

Further info on the 'in circuit serial programming guide'

Memory
There are clearly two empty SDRAM slots on the original PCB board. According to QNAP, the memory cannot be upgraded and is fixed at 64MB. The details of the MPC controller shows that it can support a maximum of 2 Gigabytes of RAM; attached in 1-8 banks of 16,64, 128 156, 512 MB. Quick calculations show that things dont add up; unless you consider that SRAM is addressed in row, column, bank format. Getting to the bottom of this is complicated as there are no public specifications for the existing PSC SDRAM.

Update 31/10/06 According to an archived forum the memory A2V56S40BTP-G75 is SDRAM 16MX16 3.3V 7.5ns TSOP54 LT/LF PSC. The G75 would be representative of using PC133 speed (similar to Micron numbering).

Can we use the empty sockets?
In principle we should be able to - a lot depends upon how the designers connected things.

A further investigation showed that there are some unconnected capacitors associated with the empty SDRAM sockets; these are listed below. Assuming that all SDRAM with the TSOP54 footprint have the same pinouts then using information for the Micron MT48 series should enable the functionality to be deduced. Values are unknown as they are not readable on the SMD components; but they seem to be stabilisation (debounce) capacitors connected between the power supply and isolated DQ power supply. Please fill out the table if further information is found.

Memory Upgrade - Perhaps Not?
It seems that the memory has to be manufacturer matched; in order to make sure the addressing routines are identical. Currently using alternative products (e.g. Micron) do not appear to work; this could be due to the way row, column values are mapped. The U-Boot code indicates that the maximum memory available is 0x10000000 (= 256MByte) using two chips in bank 0. All other banks are disabled. To add extra memory would therefore require recompiling the U-boot firmware. Alternatively it might be possible to remove the existing PSC chips (2x32MB) and replace them with others (e.g. Micron) upto a maximum of 2x128MB.

Can we replace the existing chips?
Based on the fact that the capacitors are purely acting for stability it would seem logical that the existing chips can be extracted and replaced with new ones. Once again getting better specifications on the PSC chips would enable an easy answer. Most of the Micron memory chips are 4 bank devices; and go upto 256MB; thus allowing a theoretical potential of 512MB ram. Practically though it is not clear whether the CPU is running in 32 bit or 64 bit access; or has the full PCB connected capacity for the higher memory options. Unfortunately the CPU is a Ball Grid Array device; and getting access to check all the pins is not easy.

Which chips might work
Any SDRAM TSOP 54 (54 pins) chips which are x16 format could work. To get the 32Mbyte you would need 256MBit; 64Mbyte would then by 512MBit.

Micron
 * 2x MT48LC16M16A2P-75, PC133 SDRAM (256MBit, 32 MByte)
 * 2x MT48LC32M16A2P-75, PC133 SDRAM (512MBit, 64 MByte)

Samsung
 * 2x K4S561632H or E, PC133 SDRAM (256MBit, 32 MByte)
 * 2x K4S511632D or B, PC133 SDRAM (512MBit, 64 MByte)

Qimonda It is also worth checking their website independantly in case they change the release numbers slightly.
 * 2x HYB39S256160FT-7, PC133 SDRAM (256MBit, 32 MByte)
 * 2x HYB39S512160AT-7, PC133 SDRAM (512MBit, 64 MByte)

Mini PCI Connector
Originally the Turbostation TS101 was announced with a optional wireless card; however this option never materialised. Some of the PCB's released had space and layout for the SMD connection of the connector; but this was left blank. Other boards (>August 2006) seem to have the connectors added. There is currently no known information about which mini-pci (type III) boards may be suitable.

An interesting observation: there is a sealed hole at the end of one of the cases which might be for an ariel for a wifi connector. This may be needed because the casing could cause interference problems.

Update: 11/10/06 QNAP have claimed at the Mini PCI feature is not yet enabled in the firmware. If the board has a Mini PCI slot then it is a new board version and more announcements will follow in the future. Whether old boards can be retrofitted with the correct slot is still unknown.

If you want to put on a mini-PCI connector the following types can be used. NOTE the lower versions are probably not useful due to height clearance. The ideal height should be around 6.2mm!

Molex 67315-0011 (4mm high) or 67391-0011 (5.2mm high); Tyco Electronics 1734835-1 (6.7mm), 1734835-2 (6.7mm), 1734069-3 (6.7mm), 1734661-1 (5.6mm) and 1734027-3 (6.00mm)

Mini PCI Boards
There are lots to choose from - but the NSLU site provides some useful ideas. E.g. Wifi; More SATA / Hardware Raid / VGA / Firewire / Audio...

Other USB?
The USB chip is the same as those used on the kurobox devices; and checking the circuit appears to show that USB ports 1 and 5 are not used. Certainly DM1 appears to be N/C; and RSDM1 held to low. It may be possible to enable them using something like the kurobox usb upgrade.

Technical documents from NEC (pdf) show the proposed circuit layout for driving USB devices. Checking through the physical circuit, it is clear that QNAP followed very similar layouts. To power additional USB ports small 36 Ohm resistors (e.g. SMT 0406) would be needed to connect RSDPx to DPx and RSDMx to DMx. Additionally the DPx and DMx lines would need to be brought out to a USB connector. Power could be drawn from the existing USB ports. This soldering is not for the faint hearted!

USB Swap File
Based on comments from the [forums.slimdevices.com Slimdevices forums] there could be opportunities to add a cheap USB stick to one of the ports; and use this for a swap file. This could help enable hard disks to spin down when not needed.

Firmware
The firmware is a PC1 encrypted compressed tarball. Firmware 1.2.1 contains the following files:


 * initrd.boot (2.5M)


 * initrd.boot.cksum


 * rootfs_ext.tgz (7.8M)


 * rootfs_ext.tgz.cksum


 * uImage (1.8M)


 * uImage.cksum

The firmware source code and configuration is currently available under GPL from the QNAP website. First head to the Specifications page; select Download and then the 'Technical Docu' link. For convienence the link is here but this could break in the future.

Flash Memory
There is 16MB of flash memory from which the system boots, organised as follows:

The QNAP firmware update process updates only the Kernel (uImage), RootFS1 (initrd.boot) and RootFS2 (rootfs_ext).

mtdblock0
The boot loader - Das U-Boot (1.1.2).

mtdblock1
Compressed kernel image (2.6.12.3 for the 1.2.1 firmware) with a U-Boot header.

mtdblock2
The root filesystem, gzip'ed ext2 image with a U-Boot header. This filesystem is loaded into a ramdisk /dev/ram0 during booting.

mtdblock3
This is a tar'ed and gzip'ed ext2 filesystem. It is copied to /dev/sda4 during boot and mounted as /mnt/ext.

mtdblock4
An ext2 filesystem image containing an empty autorun.sh file which is run during system startup. This part of the flash may be used to startup any software not supplied with the firmware by writing a customised autorun.sh file.

mtdblock5
Configuration for the boot loader:

mtdblock6
This partition has a small ext2 filesystem image with two files. One file ETH0.MAC_ADDR defines the unit's MAC address.

The other file seems to have the results output from a hardware test.

Boot Loader
The boot loader is accessible from the serial port connection as there is a 1 second timeout in which to interrupt the normal boot process.

U-Boot reports the following as the system starts:

Looking in their GPL source code, it appears that QNAP have based their version on the Sandpoint 8245 configuration with a few minor tweaks for a bigger sized flash chip.

Although the network boot commands are configured, QNAP didn't configure in either either the Intel 82540EM or Realtek RTL8169SC Gigabit ethernet controllers. There are no hard disk or USB commands either.

Kermit file copy is available but is untested. If it works it would provide a way to experiment with customised firmware whilst retaining the ability to restore the original firmware if things break.

Some interesting information about Das U-Boot running on the Linkstation/Kurobox can be found here or here, especially the part about being able to test U-Boot modifications without having to flash it first. Some experimentation is called for - although having a working JTAG interface would provide a better safety net!

Shell Access
As shipped, the TS-101 does not have any shell access enabled - neither telnet or a login via the serial port. However this can be enabled (and disabled again) on-the-fly using a hidden function in the admin GUI. The following is known to work for a standard TS-101 using the 1.2.1 firmware. It does not appear to work for versions 1.0 and 1.2.0 (it may also work for the TS201).

Two bits of information are required:


 * the Server Name
 * the MAC address

Both are available from the admin web interface (System Settings and Network Settings).

A special string is then constructed; e.g using MyTS101 as the host and 00:08:9B:8A:64:1A as the MAC address:


 * QNAP_NAS_MyTS101_00:08:9B:8A:64:1A_1.2.1

Next compute an MD5 hex digest. There are various resources on the web that can do this using Javascript. For the above string the digest would be:


 * 9fd8c9e0f3cdaf2327ed367fff6a3c5b

Then, having already been authenticated to the TS-101 administration screens enter the following URL:


 * http://MyTS101:6000/console.cgi?login=yes&pwd=9fd8c9e0f3cdaf2327ed367fff6a3c5b

And you should receive a message saying that console access is enabled (or disabled if you use login=no). Telnet is then available on port 13131. Log in using the same credentials as for the web administration GUI to get 'root' access. It's only telnet, so you probably don't want to open up port 13131 to the outside world!

A getty process is also started allowing login to the serial port.

The process needs to be repeated if the TS-101 is power-cycled.

Installing new packages
The TS-101 firmware is based on uClibc and BusyBox. There is a pre-built PowerPC rootfs available for download from the uClibc site that contains a number of ready-to-run utilities not included in the TS-101 firmware; including gcc and dropbear ssh.

Information on setting up cross compilers, and new user developed software packages for the Turbostation family can be found on the software page.

Mailing List
An OpenTurbostation mailing list has been created at Yahoo!. Please use this to ask specific questions rather than adding lines to the Wiki. We suggest subscribing on a daily digest basis in order to minimise traffic to your mail boxes.