Hardware Hacks for the LS2

From NAS-Central Buffalo - The Linkstation Wiki
Revision as of 15:21, 3 November 2006 by Kuroguy (Talk | contribs)

Jump to: navigation, search

All input is welcome. Please do not edit this page directly as I do not want any information to get past me without my knowledge as it could be detrimental to the LS2 on which I'm experimenting. Please post any comments to the forum thread or the talk page.



This is an account of the attempts of Tampakuro (aka Kuroguy) to open the LS2 hardware to more development. As the goals in this article are met we will be adding notes to alert other users that a particular goal/set of instructions is safe to attempt.

There is a forum thread at http://forum.linkstationwiki.net/index.php?action=vthread&forum=3&topic=1530 with a discussion relating to this project. Please feel free to add relevant content to that thread.

The LS2 that the community purchased arrived from Dusseldorf today (Oct 6, 2006). I will be installing a JTAG port on it. Once that is done I'll be installing a serial console. I plan to document all of the steps here. As described it came without a hard disk and (possibly) with a bad power supply.


Additional Info about the history of this particular LS2

Mindbender asked Adrian (the former owner of this box) again what happened and what he did to repair the LS2 and he told me that he caused the problem by shortening the board somehow while replacing the hdd.

As a result of the short, two capacitors were destroyed and he replaced them....but it did not work. Here is a picture which shows which Capacitors were replaced...maybe they are faulty or not correctly soldered to the board?

LS2 Damaged parts

Lets see what we can see

I first disassembled the LS2 and took a few photos of the board. Noteworthy on the back of the board labeled CN8 is a mini PCI header. It looks like the addition of 4 SMT resistors and 6 SMT capacitors is all that is necessary to get this port working.

From the manufacturer's literature given to me by Mindbender I know that CN9 is the JTAG port. The spec says that the target voltage can be picked up on pin 14. As in teh case of the LS1 and LS-HG, the series resistor is missing. Rather than mess with it, I'll likely get power for the JTAG cable from elsewhere on the board.

Next I unplugged the power supply from the board and powered it up. My voltmeter told me that the power supply is working. That means I need to look for a bad fuse or switch on the main board. This might be over before it gets started.

LS2 Front side of main board

J1 looks just like the standard serial header found on all of the PPC based boxes. It even has pads for a decoupling capacitor (C34) across pins 3 and 4 (on the PPC boxes pin 3 is 3.3V and pin 4 is ground). I'll check for 3.3 volts across these pins when I power up the board. Pin 2, like the PPC versions, has a pullup resistor, R256 (not installed) and series resistor, R186 (not installed) If this does turn out to be a serial port it will make life really easy on us.

CN5 appears to be a header for programming the AVR. We shouldn't need to mess with this one and unless someone would like me to solder a header in place, I'll leave it alone.

I've included a couple of high resolution photos of the main circuit board.

LS2 Back side of main board

Getting it to power up

The buttons wouldn't do anything and I think that the microcontroller (does the same functions as the AVR in the PPC based models) is damaged. The microcontroller is responsible for powering up and down the Linkstation. It also controls the cooling fan. Good news, After a bit of fiddling i Have been able to make the LS2 power up the fan by shorting pins 24 and 25 of the AVR. I can also make the fan and drive spin up by shorting pins 23 and 24 and then shorting and holding pins 24 and 25. I believe the LS is powering up too. I can hear the heads stroking back and forth.

As I will be somewhat bypassing the microprocessor I'll try to trace the pins and document their functions too.

I've gotten some conflicting results when injecting data onto the pins of the microprocessor. I suspect it is due to the circuitry of the microprocessor transferring data onto other pins at the same time. In any event, there is no way for me to know the normal state of the inputs and outputs of the microprocessor with it still in circuit. I'm seriously considering removing the microprocessor from the board to get some certain answers as to what pin does what without interference by the microprocessor. This will allow me to properly document which pin does what.

I assume there are at least the following DI (digital input)and DO (digital output) pins:

DI - fan status 
DI - front button status 
DI - Rear button status 
DI - HDD read/write status 
DI - Serial in
DO - Serial out
DO - Fan Start 
DO - HDD start 
DO - HDD light on 
DO - DIAG. light on 
DO - Power light on 
DO - Reset CPU  

Other pins that have to be present would be Vcc and Ground

If I can determine which pin does what it will be very possible to write our own application for the microprocessor and get rid of the proprietary stuff Buffalo is using. This would allow things like additional flash patterns for the LED.

Planned modifications

1. Install and test the JTAG header.

2. Test/Install serial level converter.

3. Optionally try to install a mini PCI slot.

4. Install additional USB ports

The Microcontroller

Homebrew microcontroller socket

The microcontroller work wasn't planned. It was necessitated by the fact that the LS2 I have was someone else's damaged discard. This work came from an attempt to get the LS2 to power up.

The microcontroller was interfering with diagnosing the cause of the LS2 not powering up so I decided to remove it. It took the better part of an hour to remove the microcontroller and solder it in its new home - a piece of perf board with 2 sets of 2x7 pin headers. I had to bend the pins into a single row making two rows of 14 each on .05" centers to match up with the pin spacing on the microcontroller. Check out this photo of the microcontroller sitting atop its new socket. The plan was to attach a 28 strand ribbon cable to the circuit board where the microcontroller was located and terminate the other end of the cable with two 2x7 IDE headers. The microcontroller could then be snapped back in the LS2 at will. With the microcontroller removed from the circuit I could trace those pins and their functions without the microcontroller causing problems.

A bit of serendipity here. Printed on the circuit board under the microcontroller was the part number MC68HC908JL8CDW. This is a Motorola Freescale microprocessor. Motorola has a complete data sheet posted on the Freescale site. This is new and very useful information.

With the microcontroller removed from the circuit, I easily found the cause of the LS2 not powering up; a missing resistor on the main board, R265. This is a series resistor for the power button. I installed a 4.7K resistor and reinstalled the microcontroller and it booted without incident. All that work removing the microcontroller and setting it in a homebrew socket was not necessary. Of course, we did gain some very useful information, such as the true part number for the microcontroller and the pin functions of the microcontroller, so it wasn't a total waste of time. In fact, I couldn't have diagnosed and repaired the problem without removing the microcontroller unless I had a schematic drawing of the LS2 and those aren't available. It is possible to write a completely open source application for this microcontroller now that we know what it is and the specific pin functions.

I have also determined that the Link light is not controlled by the microcontroller.

The following table lists confirmed pin functions of the microcontroller:

Pin Signal Type Function
1 - Pin 3, CN5
2 DO Pull to ground to turn Diagnostic light on
3 - Ground and Pin 9, CN5
4 - Pin 1, CN5
5 - -
6 DO Pull to ground to turn HDD full light on
7 - Vcc (3.3V)
8 DO Pull to ground to turn power light on green
9 DO Pull to ground to turn power light on amber
10 - Ground
11 - -
12 - -
13 DI Serial in from CPU
14 DI Serial out to CPU
15 - -
16 - -
17 - Pin 8, CN5
18 - Pin 7, CN5
19 - -
20 - Pin 10, CN5
21 - Pin 5, CN5
22 - -
23 DI Rear button pressed pulls low
24 DO Pull High to turn on fan and spin up HDD
25 - -
26 DI Fan Status, High means fan running
27 DI Power button pressed pulls low
28 - Vcc, Through filter FIL18 to Pin 4, CN5


CN5 is a 2x5 header that appears to be used to program the microcontroller. Pin 2 of this connector is tied to Vcc (3.3V). Pin 6 of this connector is tied to ground.

Items in bold have been confirmed with the microcontroller removed from the circuit.

JTAG Installation (Hardware modification is tested and safe to install)

Hardware modifications

The literature lists the following pins and descriptions:

Signal Pin Noted
nTRST 1 must be pulled high if not controlled by the JTAG cable
TDI 3 -
TDO 5 Series Resistor R64 not installed - Installed 330 ohm resistor
TCK 9 -
TMS 7 -
Ground 2 -
Power 14 Series resistor R181 and decoupling capacitor C35 not installed. - Bridged R181, didn't install C35.

The instruction manual at http://www.idt.com/products/files/1868542/32434manual.pdf details the required values of the TDO series resistor on page 494. It states that a typical value of R64 is 1Kohm. It says a smaller value reduces crosstalk and values of 33 ohm are sufficient. It also states that a value of 47Kohm is sufficient for hot plugging applications. Since we will not be hot plugging the JTAG cable we can use a value closer to the recommended value of 1Kohm. As it turned out I could not find a 1K SMT resistor in my computer graveyard. Instead I installed a 330 ohm resistor (has 331 on it).

Bridging R181 and installing a capacitor in the range of .1uF at C35 should be sufficient to power the cable. In fact, The DLC5 cables I made already have a decoupling capacitor across the power and ground lines so C35 may be omitted in our case. If you are in doubt as to whether your cable has a capacitor installed you should install a capacitor at C35. It won't cause problems if both are installed.

Also, according to the manufacturer's data, pin 12 on the main board should be left unpopulated to prevent connecting the JTAG cable to the main board backwards.

The following photo shows the JTAG connector and R64 just above the jtag header. I have installed the JTAG header on the back of the board to make it easy to plug and unplug the JTAG Cable. If I had not done this I would have needed to remove and replace the main board every time I wanted to connect or disconnect the JTAG cable. As a result of the header being on the back side of the board, the rows of pins are reversed. It will mean wiring our JTAG cable connector backwards. This is not a problem until you try to use your JTAG cable on other hardware as it will be wired backwards. Connecting the cable backwards could damage the JTAG port on your board, so make sure you get it right.

LS2 Installed JTAG header and R64 just to the left of the header. Note that the header is installed on the back of the board so it can be accessed without removing the main board from the chassis. This means the rows are reversed from the standard MIPS JTAG header. Also visible in this photo is the homemade serial level converter and red jumper to enable the serial console. Electrical tape on the back of the level converter prevents short circuiting the main board

The JTAG cable I designed for the PPC boxes along with some very minor modifications was able to detect the chain.

I terminated the cable with the 14 pin IDE connector instead of the 16 pin connector used for the PPC boxes (I built an adapter), it was necessary to pull pin 1 (nTRST) high. I just tied pin 14 (3.3v) to pin 1 through a 1K resistor and Openwince's JTAG Tools detected the chain.

Software to actually use the JTAG port

About the only JTAG software that is free and works with the DLC5 flash is Openwince's JTAG tools. This is the software that I use to unbrick Kuros and PPC linkstations (Also works with the Terastation Pro). I need to build the IDT include files for Openwince's JTAG tools before going any further. As those files are not part of the source package I will need to create them myself. This could take some time as I'm not a software person.

I found in IDT's website a BSDL file that describes how to talk to the SOC via JTAG. I have also found a script for converting Xilinx BSDL files for use with JTAG Tools. Hopefully this will work and we'll have the ability to read and write flash contents. There are a number of files that need to be edited so the software will recognize the LS2 properly, but I think I can get that done properly.

I'm still not sure if the DLC5 cable will work, but if it doesn't, I'll build a wiggler cable and continue working. At the very least we know the header is installed correctly.

Configuring JTAG Tools to recognize the LS2's components is simple. The Device has a uniqui identification string. It is a 32 bit number and JTAG Tools displays this ID when the command detect is executed. The ID is 00000000001000010111000001100111. There are 3 parts to this iID. According to the standard, the least significant bit is required to be 1. Bits 13 through 2 (100000110011) are a unique number that identifies the manufacturer. If you add this ID to /usr/local/share/jtag/MANUFACTURERS along with the the manufacturer name and directory name where the target manufacturer's data files are located JTAG Tools will automatically recognize the device manufacturer when detect is run.

The line I added looks like this :

00000110011     idt             IDT

The "idt" is the name of the data directory for this manufacturer loacted at /usr/local/share/jtag/data/ and the "IDT" is the text that detect will return as the manufacturer.

In the idt directory there are several files we need to create. Create a file named PARTS. This file uses bits 27 through 12 if the device identification string. It defines specific part's name and the subdirectory where the converted BSDL file is located. This file contains the following line:

0000001000010111 idt 79RC32434

We create a file named /usr/local/share/jtag/data/idt/79RC32434/STEPPINGS which contains bits 31 through 27 (0000) and the name of the file that contains the converted BSDL file (mips) along with the version number of the target (0000):

0000 mips 0000

We also need to create a file named mips which contains the converted BSDL file. we execute:

bsd2jtag < (bdsl file name) > mips

If you do this correctly when you detect the target, JTAG Tools will return the following when detect is executed:

jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000000001000010111000001100111
  Manufacturer: IDT
  Part:         79RC32434
  Stepping:     0000
  Filename:     /usr/local/share/jtag/idt/79RC32434/mips

Next we need to get JTAG Tools to initialize the JTAG bus.

Serial console installation (Completed - Safe to install)

I ordered a max3232 chip and 5 capacitors from Mouser electronics (along with some other parts for the hacks I'm doing here) and have built a serial level converter on perf board (I don't have time to etch a board) This box will have a permanently installed serial level converter. We'll need to install a series resistor (R186). Had we installed a temporary level converter we would have had to install both a pullup and series resistor. This is because the level converter holds the pin high unless pulled down by serial data to the LS2, and without it the LS2's serial input pin will float causing bad data to show up on the serail port. For the Kuro we used the 10K resistor that was installed as a pullup resistor as a series resistor with success, although I suspect anything between 1K and 10K would work.

I have read that in order to toggle the UART from the AVR to the serial console, since the LS2 only has one serial port, a jumper must be installed at J2. One side of J2 is tied to pin H4 of the IDT 79RC32H434 SOC. This pin is defined in one of the manuals on page 6 as U0SINP: Alternate function: UART channel 0 serial input, so that pretty much confirms that J2 is directly related to the serial port. We'll give this a shot once I have confirmed that the JTAG modification works. I don't want to make more than one change at a time for ttroubleshooting purposes.

A photo of the serial port connector as it is installed on the back of the LS2. It is a male D9 connector and is wired as a host. It requires a null modem cable (pins 2 and 3 swapped) for connection to a the serial port on the rear of your computer.

Of course with the AVR not able to communicate with the processor (on boxes with a working AVR), it will be necessary to disable the watchdog before starting the LS2 or it will shutdown when the watchdog runs down. No problems there for me. This is where the red button on the rear of the LS2 will finally come in handy. Just hold it down while powering up the LS2 to disable the watchdog (AKA Christmas tree mode).

As it turns out, simply jumpering J2, bridging R186, and disabling the watchdog (or not) will allow two way communiction via the serial console. Of course, you do need to install a serial level converter at J1. I installed the J2 header on the back of the board so it can be accessed without removing the board from the chassis. Simply remove the side of the case and it can be accessed. Photos will be posted shortly.

Mini PCI Slot

It appears that all of the capacitors are decoupling capacitors. Based on the pin descriptions at http://www.interfacebus.com/MiniPCI_Pinout_124Pin.html they all bridge 3.3v to ground. I suspect anything in the .1uF range will work for these.

Also according to the standard, R238 and R239 enable and disable the 66Mhz PCI bus.

Install additional USB ports

The USB controller used is the same as the Kurobox and LS1. Additional ports can be added by following the instructions at http://www.kurobox.com/mwiki/index.php/Add_USB_Port#Additional_USB_Port_in_the_Rear. The USB controller is labeled IC7 and is installed on the back of the main board adjacent to the front USB plug. R86 thru R93 are pulldown resistors that have already been installed to keep those USB ports from floating. All that is necessary is the installation of two 36 ohm resistors and a USB plug for each additional port. Six resistors and 3 plugs would max out the USB controller with five working USB ports.

Other stuff I know

Install an LED at LED8 and a 330 ohm resistor at R268 (Both near the IDE connector pin 40) and It will turn on when a HDD read or write occurs.