Skip to content

DiskStation DS-106 Series Hardware

Detailed specifications and software hacks (bootloader, Linux).

Chips Identified on the PCB of a Revision 3.1 DS-106X

The DS-106(e) and the DS-101g+ most likely have the same hardware with a different configuration of RAM and RAM/flash, respectively. Pictures are available here.

Slot(s)Description
U15Freescale MPC8241LVR266D (4K78P; QQKU0628) Integrated Host Processor (CPU), PowerPC 603e based
U23-26Hynix Semiconductor HY57V561620CTP-H (620U; KOR N6CABM02Q1) 256 Mbit 133 MHz lead-free SDRAM. Configuration: 4 banks x 4 Mbit x 16
U33NEC Electronics D720101GJ (0622PPA36) USB 2.0 Host Controller
U34Silicon Image SataLink SiI 3512ECTU128 (QB9515.1; 0615; AD03Ax2) SATA Host Controller (PCI to 2-port SATA150)
U29Spansion S29AL016M (S29AL016M90TF102; 0627FRC) 16 Mbit flash memory
U21Microchip PIC16F627A (ZSO C?; 06312M8) 8bit microcontroller (programmable integrated circuit, PIC)
U31Catalyst Semiconductor CAT24WC08 (0628F; ?) 8K-Bit Serial (I2C) EEPROM
U19Marvell Yukon 88E8001-LKJ1 (AGR52A.1; 0535 A4E; TW) 32-bit Gigabit Ethernet Controller
U18LB 24HST1041A-2 (LF; 0630M) 1000 Base-T Magnetics Module (isolating transformer)
U6not identifiable, maybe Rico RS25C37A/B I2C bus serial interface real-time clock (RTC) IC
U13Cypress Semiconductor CY23S05 (SXC-1H; 6196802; ?) Low-cost Spread Aware Zero Delay Buffer
U14Cypress Semiconductor CY25100 (SXCF; C258528?) Field- and Factory-Programmable Spread Spectrum Clock Generator for EMI Reduction
Q18+20AnaChip AP1501-50 and AP1501-33 150 kHz 3 A PWM Buck DC/DC Converter (5.0 and 3.3 V)
Q8AnaChip AP1084 (0626BL) 5A Low Dropout Positive Adjustable or Fixed-Mode Regulator
U224435GM (616202) Unlcear, possibly a P-Channel Logic Level PowerTrenchMOSFET


See also

PCI Devices

0:13:0  (0:0d:0)
        PCI device 1095:3512.
        Silicon Image, Inc.
        SiI 3512 SATALink Controller
        IRQ 16.
        Master Capable.  Latency=128.
        I/O at 0xbffff8 [0xbfffff].
        I/O at 0xbffff4 [0xbffff7].
        I/O at 0xbfffe8 [0xbfffef].
        I/O at 0xbfffe4 [0xbfffe7].
        I/O at 0xbfffd0 [0xbfffdf].
        Non-prefetchable 32 bit memory at 0xbffffe00 [0xbfffffff].

0:14:0 (0:0e:0)
        NEC USB controller (no PCI devices in /proc/pci)
        IRQ 17.
        Master Capable.  Latency=128.  Min Gnt=1.Max Lat=42.
        Non-prefetchable 32 bit memory at 0xbfffe000 [0xbfffefff].
        -> Kernel: usb-ohci

0:14:1 (0:0e:1)
        NEC USB controller (no PCI devices in /proc/pci)
        IRQ 17.
        Master Capable.  Latency=128.  Min Gnt=1.Max Lat=42.
        Non-prefetchable 32 bit memory at 0xbfffd000 [0xbfffdfff].
        -> Kernel: usb-ohci

0:14:2 (0:0e:2)
        NEC USB controller (no PCI devices in /proc/pci)
        IRQ 17.
        Master Capable.  Latency=128.  Min Gnt=1.Max Lat=42.
        Non-prefetchable 32 bit memory at 0xbfffcf00 [0xbfffcfff].
        -> Kernel: ehci_hcd

0:15:0 (0:0f:0)
        PCI device 11ab:4320.
        Marvell Technology Group Ltd.
        IRQ 18.
        Master Capable.  Latency=128.  Min Gnt=23.Max Lat=31.
        Non-prefetchable 32 bit memory at 0xbfff8000 [0xbfffbfff].
        I/O at 0xbffe00 [0xbffeff].
        -> Kernel: sk98lin, Yukon Gigabit Ethernet 10/100/1000Base-T Adapter

Flash Layout

FFE00000 16k z  FFE04000  8k z  FFE06000  8k z  FFE08000 32k z  FFE10000 64k z
FFE20000 64k z  FFE30000 64k z  FFE40000 64k z  FFE50000 64k z  FFE60000 64k z
FFE70000 64k z  FFE80000 64k z  FFE90000 64k z  FFEA0000 64k z  FFEB0000 64k z
FFEC0000 64k z  FFED0000 64k v  FFEE0000 64k r  FFEF0000 64k    FFF00000 64k p
FFF10000 64k p  FFF20000 64k p  FFF30000 64k p  FFF40000 64k gu FFF50000 64k gu
FFF60000 64k gu FFF70000 64k gu FFF80000 64k gu FFF90000 64k ge FFFA0000 64k g
FFFB0000 64k g  FFFC0000 64k g  FFFD0000 64k g  FFFE0000 64k g  FFFF0000 64k f

absolute   relative   "mtd-partition"   size           sectors
----------------------------------------------------------------------------------------
0xffe00000 0x000000 : "zImage"           851968  832k   1*16k+2*8k+1*32k+11*64k    z
0xffed0000 0x0d0000 : "vendor"            65536   64k   1*64k                      v
0xffee0000 0x0e0000 : "RedBoot Config"   131072  128k   2*64k                      r
0xfff00000 0x100000 : "ppcboot"          262144  256k   4*64k                      p
0xfff40000 0x140000 : "rd.gz"            720896  704k  11*64k                      g
0xffff0000 0x1f0000 : "FIS directory"     65536   64k   1*64k                      f
0xffffffff 0x200000 : --end-of-flash--  2097152 2048k

U-Boot "daisy-chain", using:
0xfff40000 0x140000  320k 5*64k   u  --> TEXT_BASE = 0xfff40000, MONITOR_LEN = 0x50000
0xfff90000 0x190000   64k 1*64k   e  --> ENV_ADDR  = 0xff90000,  ENV_SIZE    = 0x10000

LEDs and Buttons

The PIC controls the LEDs and buttons. It is connected to ttyS1 (9600 8N1). It reacts on single bytes and emits single bytes on button events. The codes are as follows.

CharHexDescriptionCharHexDescriptionCharHexDescription
Power Management
10x31power offC0x43reset
Beeper
20x32short beep30x33long beep
Power LED
60x36off40x34on50x35blink
Status LED
70x37off80x38green on90x39green blink
:0x3aorange on;0x3borange blink
Copy LED
B0x42off@0x40onA0x41blink
Buttons
00x30power`0x60copy??reset

Das U-Boot and Linux 2.6.20

Introduction

First attempts at installing Das U-Boot (1.2.0) and Linux (2.6.20) on the DS have been made. While U-Boot works rather well, Linux seems to be a bit more tricky. Here the current snapshots of these attempts are provided as downloads.

No warranties, express or implied, that it works and that it does not harm you, your diskstation, your dog or anything or anyone else are made.

Please be aware that applying these instructions may void the warranty for the DS (or the device you install it onto) and it can make the DS unusable. It may even destroy or damage it. Even worse, it will most likely brick your Diskstation.

The author disclaims all liability for direct, indirect, incidental, or consequential damages that result from any use of this software or the information contained in it.

You have been warned and use this stuff at your own risk!

Any suggestions, improvements and patches are highly appreciated. Use the ds101-linux mailinglist to discuss these things.

Toolchain

A good (i.e. working, sane) toolchain is needed to compile Das U-Boot and the Kernel. The Embedded Linux Development Kit (ELDK) is recommended. See also toolchains.

export EDLKBASE=/path/to/the/eldk
export PATH=${EDLKBASE}/usr/bin:${EDLKBASE}/bin:$PATH
export CROSS_COMPILE=ppc_6xx-

Serial Console

A serial console to access ppcboot is madatory. See the section RS232 Serial Port for DS/CS on the hardware page.

Compiling das U-Boot

This patch against U-Boot 1.2.0 adds support for the DS-106X.

tar -xjvf u-boot-1.2.0.tar.bz2
cd u-boot-1.2.0
zcat ../u-boot-1.2.0-ds106x-YYYYMMDD.patch.gz  | patch -p1
mkdir ../u-boot-build
export BUILD_DIR=`realpath ../u-boot-build`
make distclean
make ds106x_config
make

Installing das U-Boot

You have to be able to load u-boot.bin into ppcboot. For me serial upload using Kermit did not work. I used rarp as described in the section Loading Stuff into Ppcboot over Network on the hacks page.

Only do this if you know what you are doing! Compare with Flash Layout above and in particular with YOUR flash layout and setup. Be sure to have a backup. 
rarp 3000000 u-boot.bin
protect off all
erase FFF40000 FFF8FFFF
erase FFF90000 FFF9FFFF
cp.b 3000000 fff40000 4ffff
protect on all
go fff40100

Test with hello_world.bin:

DS106X> rarp 40000 hello_world.bin
RARP broadcast 1
Using SK98#0 device
TFTP from server 192.168.1.13; our IP address is 192.168.1.101
Filename 'hello_world.bin'.
Load address: 0x40000
Loading: #############
done
Bytes transferred = 66360 (10338 hex)

DS106X> go 40004 hoi hoi :-)
## Starting application at 0x00040004 ...
Example expects ABI version 3
Actual U-Boot ABI version 3
Hello World
argc = 4
argv[0] = "40004"
argv[1] = "hoi"
argv[2] = "hoi"
argv[3] = ":-)"
argv[4] = "<NULL>"
Hit any key to exit ...

## Application terminated, rc = 0x0

Yay! :-)

N.B. After overwriting rd.gz the Diskstation will not auto boot anymore. The default (and unchangeable) bootcmd=bootm FFE00000 FFF40000 cannot load rd.gz anymore and will fail. You can still boot the standard kernel/system using bootm ffe00000. Of course, you can flash the original rd.gz provided that you have a backup. You have read the warning above, have you?

Compiling Linux

This patch against Linux 2.6.20 is the best I have so far. It includes a few ugly hacks found in Synology’s sources.

mkdir -p linux-build linux-install/boot
cp config-2.6.20 linux-build/.config
cd linux-2.6.20
make ARCH=ppc O=`realpath ../linux-build` oldconfig
make ARCH=ppc O=`realpath ../linux-build` menuconfig
make ARCH=ppc O=`realpath ../linux-build`
make ARCH=ppc O=`realpath ../linux-build` INSTALL_MOD_PATH=`realpath ../linux-install` modules_install
cp -v ../linux-build/arch/ppc/boot/images/{vmlinux.bin,uImage,vmlinux.gz,zImage.elf} ../linux-install/boot/

Booting Linux

In ppcboot or u-boot:

rarp 3000000 boot/uImage
setenv bootargs console=ttyS0,115200 root=/dev/hda1 init=/bin/sh
bootm 3000000

Later it should be possible to replace ppcboot with u-boot and boot the Kernel using diskboot or even ext2load.

Reverting the U-Boot installation

You would do this in ppcboot (i.e. not in u-boot). Hopefully you have a backup of mtd_rootfs.

rarp 3000000 mtd_rootfs
protect off all
erase FFF40000 FFFEFFFF
cp.b 3000000 fff40000 AFFFF
protect on all
reset

Issues, TODOs, Notes

  • Determine MAC address (ethaddr) in U-Boot.
  • Mem test in u-boot does not work (hangs).
  • Add LED/beeper/buttons support (see the Linkstation u-boot patch).
  • Kernel does not detect RTC (drivers/rtc/rtc-rs5c372.c, arch/ppc/syslib/todc_time.c, CONFIG_RTC_DRV_RS5C372).
  • sk98lin.c behaves strangely (ping works, telnet or scp does not work). Better use skge.c?
  • ttyS1 is not found (detected). Why?
  • Early boot messages in kernel do not appear on ttyS0 and/or the network console.
  • Probably lots of other stuff in the kernel.

Credits and References

In no particular order:

Potential OS

created: 2008-04-03, updated: 2015-09-16