The Open Turbostation:TS101 is a member of the Turbostation Family of Network Access Storage Device from QNAP (Taiwan). The device has gigabit LAN and contains space for a single 3.5" SATA drive; as well as connectivity to external USB and e-Sata drives. Full product details and updated firmware are available from Qnap TS101.

Progessive Audio provides a firmware update (and support) for enabling Slimserver in order to stream data to the Squeezebox / Transporter Audio sytems. It is recommended! Alternatively the latest firmware from QNAP allows UPnP streaming using TwonkyMedia.


Circuit Boards

There appear to be at least two types of PCB boards for the TS101. V1.02 uses an Intel Gigabit ethernet controller, may have the Type III Mini-PCI connector, and a JTAG interface. A later variation? (version unknown) is shown on smallnetbuilder where holes are provided for heatsink mounting on the CPU. The most recent board V200 (decimal point missing?) is identical to the board used in the TS-201 but with some different sata connectors and no heatsink. Compared with the earlier TS-101 boards the JTAG interface has been removed and the Intel Gigabit ethernet replaced by a Realtek version.

Rear of the TS101 Circuit Board - Click for higher resolution

Rear of TS101 (alternate version) - Click for higher resolution

Front of the TS101 Circuit Board - Click for higher resolution

Parts List

2x PSC A2V56S40BTP; 518ALA00 Taiwan -7 64MB SDRAM - TSOP54 Package Specifications unknown
1x Freescale MPC8241LVR266D; 4K78P; QQKU0528 266MHz PowerPC CPU Specifications
1x Microchip PIC16F627A; 0430360 8 bit Microcontroller Specifications
1x Spansion S29GL128N11TF101; 0508ABA H 128Mbit (16MB) Flash Specifications
1x Silicon Image SiI 3512 ECTU128; QB2170.1-4; 0523 AD03AX2 2x SATA 150 Controller Specifications
1x NEC D720101GJ; 0529PPA72 USB 2.0 Controller Specifications
1x Intel RC82540EM; 0503; FG31301.1 GB Ethernet Controller Specifications
or 1x Realtek RTL8110SCL GB Ethernet Controller


Serial Port

The 2x3 Pin connector (labelled JP2) is located on the HDD side of the PCB behind the LED1 / USB light (below the QNAP label). This is a serial port running at TTL 3.3V. It is similar to the Synology DS101 and can be connected to at 115200 baud; 8n1 software handshakes.

3.3V GND

At boot time you can press space to interrupt the boot loader - see below for more details. Under normal operation there is no login prompt available on the serial port.

Update: With firmware 2.5.0 Build 0505T there is a login prompt at any time, initialised by the init-process (respawn::getty). To avoid the system to offer this login prompt (while you wish to use the serial port for any other data transfer), comment-out this line in the /etc/inittab, restart the init process with init -q and kill the current getty-process. Don't forget that the kernel will send error-messages to this port anyway.

Further information on connecting the serial port is available on the Serial Communications page.

JTAG Access

There is an unpopulated connector (JP1) on the V1.02 board (absent on the V200 boards) that may provide JTAG access to the CPU. This would allow re-flashing of a 'bricked' TS-101, but needs further investigation to see what can be done economically (if at all).

If the connector follows the recommended layout (Pg 50), the pin assignments should be:

Function Pin Pin Function
TDO 1 2 NC
TMS 9 10 NC
SRST_N 11 12 NC
HRST_N 13 14 NC
NC 15 16 GND

The actual pin outs measured on the board are as follows...

Connection Pin Pin Connection
To uP (BGA) 1 2 N/C?
To uP (BGA) 3 4 D8 & R155 (N/C) -->VDD
RN5/4 (N/C?) 5 6 R163 (N/C?) -->VDD
To uP (BGA) 7 8 R162 (N/C?) -->VDD
To uP (BGA) 9 10 N/C?
RN5/3 (N/C?) 11 12 N/C?
RN5/2 (N/C?) 13 14 N/C?
RN5/1 (N/C?) 15 16 GND

Since most JTAG references would indicate that the important signals are TDI, TDO, TMS, TCK, possibly TRST_N and SRST_N, then it is likely the outputs match. Note if RN5, R155, R162 and R163 were populated they would connect to VDD (e.g. of SDRAM). JTAG specifications would indicate that there should be a 100 Ohm resistor between VDD and VREF as a current limiter.


A simple parallel port based circuit can be found here.

And a USB schematic based on the FTDI2232 can be found here

Unfortunately there isn't a great selection of free/cheap software compatible with the MPC8241. However the Kurobox community (similar hardware) seem to have come up with a reasonably affordable although not very performant solution based on the parallel port cable and Openwince JTAG tools. USB Openwince tools are in development... e.g. with FX02 or Byteblaster.

This information will move to the JTAG Programming Page.

PIC Serial Programming

The PIC controller can be programmed using the 'In Circuit Serial Programming TM' (ICSP) mode (see page 112 of PIC manual for more info). There are 5 through pins located close to the main SATA connector; Pin 1 is closest to connector. If looking from component side (and LED's are to your right), Pin 1 is closest to the BZ1 label; and CN2 is written on right hand side. The following layout is used

Connector CN2 PIC Function
Pin 1 #12 RB6 / PGC / CKI
Pin 2 #13 RB7 / PGD
Pin 3 #05 VSS (0V)
Pin 4 #14 VDD (+5V)
Pin 5 #04 RA5 / VPP

Further info on the 'in circuit serial programming guide'


There are clearly two empty SDRAM slots on the original PCB board. According to QNAP, the memory cannot be upgraded and is fixed at 64MB. The details of the MPC controller shows that it can support a maximum of 2 Gigabytes of RAM; attached in 1-8 banks of 16,64, 128 156, 512 MB. Quick calculations show that things dont add up; unless you consider that SRAM is addressed in row, column, bank format. Getting to the bottom of this is complicated as there are no public specifications for the existing PSC SDRAM.

Update 31/10/06 According to an archived forum the memory A2V56S40BTP-G75 is SDRAM 16MX16 3.3V 7.5ns TSOP54 LT/LF PSC. The G75 would be representative of using PC133 speed (similar to Micron numbering).

Can we use the empty sockets?

In principle we should be able to - a lot depends upon how the designers connected things.

A further investigation showed that there are some unconnected capacitors associated with the empty SDRAM sockets; these are listed below. Assuming that all SDRAM with the TSOP54 footprint have the same pinouts then using information for the Micron MT48 series should enable the functionality to be deduced. Values are unknown as they are not readable on the SMD components; but they seem to be stabilisation (debounce) capacitors connected between the power supply and isolated DQ power supply. Please fill out the table if further information is found.

Capacitor Pin Function Value
C90 3 VDDQ ??
6 VSSQ ??
C91 9 VDDQ ??
12 VSSQ ??
C92 14 VDD ??
C93 27 VDD ??
C72 52 VSSQ ??
49 VDDQ ??
C73 46 VSSQ ??
43 VDDQ ??
  1. Application examples for VDDQ power supplies indicate a capacitor of approx 10uF between VDDQ and VSSQ.
  2. With great thanks to Flipflip and the NSLU2 website, it is possible to view high resolution images of the Synology DS106x - a memory upgraded model of the DS106. Two sets of chips have coupling capacitors; and two do not. The memory is however all matched.

Memory Upgrade - Perhaps Not?

It seems that the memory has to be manufacturer matched; in order to make sure the addressing routines are identical. Currently using alternative products (e.g. Micron) do not appear to work; this could be due to the way row, column values are mapped. The U-Boot code indicates that the maximum memory available is 0x10000000 (= 256MByte) using two chips in bank 0. All other banks are disabled. To add extra memory would therefore require recompiling the U-boot firmware. Alternatively it might be possible to remove the existing PSC chips (2x32MB) and replace them with others (e.g. Micron) upto a maximum of 2x128MB.

Can we replace the existing chips?

Based on the fact that the capacitors are purely acting for stability it would seem logical that the existing chips can be extracted and replaced with new ones. Once again getting better specifications on the PSC chips would enable an easy answer. Most of the Micron memory chips are 4 bank devices; and go upto 256MB; thus allowing a theoretical potential of 512MB ram. Practically though it is not clear whether the CPU is running in 32 bit or 64 bit access; or has the full PCB connected capacity for the higher memory options. Unfortunately the CPU is a Ball Grid Array device; and getting access to check all the pins is not easy.

Which chips might work

Any SDRAM TSOP 54 (54 pins) chips which are x16 format could work. To get the 32Mbyte you would need 256MBit; 64Mbyte would then by 512MBit.


  • 2x MT48LC16M16A2P-75, PC133 SDRAM (256MBit, 32 MByte)
  • 2x MT48LC32M16A2P-75, PC133 SDRAM (512MBit, 64 MByte)


  • 2x K4S561632H or E, PC133 SDRAM (256MBit, 32 MByte)
  • 2x K4S511632D or B, PC133 SDRAM (512MBit, 64 MByte)


  • 2x HYB39S256160FT-7, PC133 SDRAM (256MBit, 32 MByte)
  • 2x HYB39S512160AT-7, PC133 SDRAM (512MBit, 64 MByte)

It is also worth checking their website independantly in case they change the release numbers slightly.

Mini PCI Connector

Originally the Turbostation TS101 was announced with a optional wireless card; however this option never materialised. Some of the PCB's released had space and layout for the SMD connection of the connector; but this was left blank. Other boards (>August 2006) seem to have the connectors added. There is currently no known information about which mini-pci (type III) boards may be suitable.

An interesting observation: there is a sealed hole at the end of one of the cases which might be for an ariel for a wifi connector. This may be needed because the casing could cause interference problems.

Update: 11/10/06 QNAP have claimed at the Mini PCI feature is not yet enabled in the firmware. If the board has a Mini PCI slot then it is a new board version and more announcements will follow in the future. Whether old boards can be retrofitted with the correct slot is still unknown.

If you want to put on a mini-PCI connector the following types can be used. NOTE the lower versions are probably not useful due to height clearance. The ideal height should be around 6.2mm!

Molex 67315-0011 (4mm high) or 67391-0011 (5.2mm high); Tyco Electronics 1734835-1 (6.7mm), 1734835-2 (6.7mm), 1734069-3 (6.7mm), 1734661-1 (5.6mm) and 1734027-3 (6.00mm)

Mini PCI Boards

There are lots to choose from - but the NSLU site provides some useful ideas. E.g. Wifi; More SATA / Hardware Raid / VGA / Firewire / Audio...

Other USB?

The USB chip is the same as those used on the kurobox devices; and checking the circuit appears to show that USB ports 1 and 5 are not used. Certainly DM1 appears to be N/C; and RSDM1 held to low. It may be possible to enable them using something like the kurobox usb upgrade.

Technical documents from NEC (pdf) show the proposed circuit layout for driving USB devices. Checking through the physical circuit, it is clear that QNAP followed very similar layouts.

Pin Fcn Comment
142 RSDP5 N/C or floating
141 DP5 15k (R33) pull down to ground
139 DM5 15k (R35) pull down to ground
138 RSDM5 N/C or floating
115 RSDP1 N/C or floating
114 DP1 15k (R16) pull down to ground
112 DM1 15k (R3) pull down to ground
111 RSDM1 N/C or floating

To power additional USB ports small 36 Ohm resistors (e.g. SMT 0406) would be needed to connect RSDPx to DPx and RSDMx to DMx. Additionally the DPx and DMx lines would need to be brought out to a USB connector. Power could be drawn from the existing USB ports. This soldering is not for the faint hearted!

USB Swap File

Based on comments from the [ Slimdevices forums] there could be opportunities to add a cheap USB stick to one of the ports; and use this for a swap file. This could help enable hard disks to spin down when not needed.



The firmware is a PC1 encrypted compressed tarball. En/Decryption binaries for Linux x86 is available here. The encryption key used is QNAPNASVERSION4 for TS101. Firmware 2.0.1 contains the following files:

  • initrd.boot (2.5M)
  • initrd.boot.cksum
  • rootfs_ext.tgz (7.8M)
  • rootfs_ext.tgz.cksum
  • uImage (1.8M)
  • uImage.cksum

The firmware source code and configuration is currently available under GPL from the QNAP website. First head to the Specifications page; select Download and then the 'Technical Docu' link. For convienence the link is here but this could break in the future.

Flash Memory

There is 16MB of flash memory from which the system boots, organised as follows:

Device Length Location Contents
mtdblock0 256K 0xFFF00000 U-Boot
mtdblock1 2M 0xFF000000 Kernel
mtdblock2 3M 0xFF200000 RootFS1
mtdblock3 9M 0xFF500000 RootFS2
mtdblock4 1M 0xFFE00000 Vendor
mtdblock5 128K 0xFFF40000 U-Boot Config
mtdblock6 640K 0xFFF60000 NAS Config

The QNAP firmware update process updates only the Kernel (uImage), RootFS1 (initrd.boot) and RootFS2 (rootfs_ext).


The boot loader - Das U-Boot (1.1.2).


Compressed kernel image ( for the 1.2.1 firmware) with a U-Boot header.


The root filesystem, gzip'ed ext2 image with a U-Boot header. This filesystem is loaded into a ramdisk /dev/ram0 during booting.


This is a tar'ed and gzip'ed ext2 filesystem (not sure why they used tar?). It is copied to /dev/sda4 during boot and mounted as /mnt/ext.


An ext2 filesystem image containing an empty file which is run during system startup. This part of the flash may be used to startup any software not supplied with the firmware by writing a customised file.


The boot loader environment.


This partition has a small ext2 filesystem image with two files. One file ETH0.MAC_ADDR defines the unit's MAC address.

The other file seems to have the results output from a hardware test.

Boot Loader

QNAP have used U-Boot for the Linux boot loader, with some minor modifications for the Turbostation.

As supplied there are no options for booting from the network or other devices. However it is possible to install a new boot loader to provide more functionality.

More details can be found on the Boot Loader page.

TT===Shell Access as root=== As shipped, the TS-101 may not have any shell access enabled - neither telnet or a login via the serial port. However firmware release 1.2.1 allows you to 'enable' this on the fly using a hidden function in the admin GUI.

Beta firmware releases for 1.3.0, 2.0.0 and 2.1.0 are known to have telnet enabled as default; and users should skip this section.

Enabling the Telnet Port - Firmware 1.2.1

The following is known to work for a standard TS-101 updated to the official 1.2.1 firmware.

Two bits of information are required:

  • the Server Name
  • the MAC address

Both are available from the admin web interface (System Settings and Network Settings).

A special string is then constructed; first converting all letters to upper case. Lets assume the server name is 'MyTs101' with the MAC address '00:08:9B:8A:64:1A'.


Next compute an MD5 hex digest. There are various resources on the web that can do this using Javascript (e.g.). For the above string the digest would be:


Then, having already been authenticated to the TS-101 administration screens enter the following URL, taking care to use lowercase hex digits:


And you should receive a message saying that console access is enabled (or disabled if you use login=no). Telnet is then available on port 13131. Unfortunately this enabling process needs to be repeated if the TS-101 is power-cycled.

NOTE: For firmware version 2.0.0-Build 0105, Telnet is not enabled by default. It can be enabled using the method described here. Just update the appended firmware version number to 2.0.0. So the special string to encrypt, from the example above, would become:


and the corresponding digest:


leading to this URL:


hint: create a bookmark for the URL to easily re-enable Telnet after a power-cycle.

Accessing the Telnet port

Once enabled (or as default) telnet is running on port 13131. You can log in using the same credentials as for the web administration GUI to get 'root' access. It's only telnet, so you probably don't want to open up port 13131 to the outside world!

Under windows you can use telnet under the command prompt (cmd). Type 'telnet MyTS101 -l administrator 13131 where MyTS101 can also be replaced with the ip address. Or do yourself a favour and get hold of PuTTY instead.

A getty process is also started allowing root login via the serial port.

Installing new packages

The TS-101 firmware is based on uClibc and BusyBox. There is a pre-built PowerPC rootfs available for download from the uClibc site that contains a number of ready-to-run utilities not included in the TS-101 firmware; including gcc and dropbear ssh. These are linked to uclibc0.9.27 which appears to be standard in the 1.3.1 and 2.0.0 firmware.

Information on setting up cross compilers, and new user developed software packages for the Turbostation family can be found on the software page.

Mailing List

An OpenTurbostation mailing list has been created at Yahoo!. Please use this to ask specific questions rather than adding lines to the Wiki. We suggest subscribing on a daily digest basis in order to minimise traffic to your mail boxes.

Community content is available under CC-BY-SA unless otherwise noted.