Hardware Hacks for the LS Pro

From NAS-Central Buffalo - The Linkstation Wiki
Revision as of 05:09, 10 March 2007 by Kuroguy (Talk | contribs) (Adding a second SATA port (tested and safe to install))

Jump to: navigation, search

All input is welcome. Please do not edit this page directly as I do not want any information to get past me without my knowledge as it could be detrimental to the LS Pro on which I'm experimenting. Please post any comments to the forum thread or the talk page.



This is an account of the attempts of Tampakuro (aka Kuroguy) to open the LS Pro hardware to more development. I'll be concentrating mainly on the flash memory as well as adding an eSATA port.

Flash modifications

There are two obvious routes to reprogramming the flash memory:

The JTAG Access Method

As we have no manufacturer's literatire for the hardware, installation of a JTAG port is not currently an option. That leaves the dual flash method described below.

The Dual flash Method (DO NOT ATTEMPT AT THIS TIME)

I will be using a modified dual flash method to gain the ability to safely modify the flash contents. As the flash contains the bootloader, flashing a non working bootloader would permanently brick the LS Pro. The dual flash hack used on the LS1 involved piggybaking a second identical flash chip onto the original flash chip and then alternately enabling and disabling the two chips to gain access to a backup copy of the bootloader stored in the piggybacked flash chip. recovery was as simple as booting from the backup copy of the bootloader and then switching to the original flash chip via a switch or set of jumpers and reflashing the original bootloader.

The modified method I will be using requires completely removing the flash memory chip and replacing it with a new chip with twice the memory. Prior to installing the new memory chip I will program the contents of the original flash chip into the bottom 256 KB of memory and then again into the top 256 KB of memory. Since the 512 KB chip is pin compatible with the 256 KB flash all that is necessary to switch from the lower bank of 256 KB (the original bootloader) to the upper 256 KB (the backup copy) is to toggle the most significant address line (A18) from low to high. This will be accomplished via a jumper that I will install.

I have copied the flash contents to a file named flash.contents using the following command

cat /dev/mtd0 ./flash.contents
I programmed the data from the flash.contents file into a new 512 KB flash chip at both address 0x00000 and 0x40000. The way it works is that toggling the A18 pin on the flash chip makes the LS Pro think that everything above 0x40000 is at 0x00000.
Second 512 KB flash installed Note the repair for the broken trace at the upper right corner of the flash chip.
When it does, we are using the backup flash contents.

I had brief dreams of saving the original flash chip just in case something went wrong. As a result of trying, I managed to lift 2 pads off of the motherboard. I then used a razor knife to cut all the pins from the flash chip as close to the chip as possible. once the body of the chip was removed, it was a simple matter to remove all the separate pins from the board.

Reinstalling the new flash chip was very easy. I filed a knife edge onto my soldering iron tip and tinned it. I then made sure there was no extra solder on the tip. I Lined up the flash chip with the pads and then tacked two opposite corners in place. Once the chip was held in place, I pressed down firmly on the chip and ran the clean knife edge down the two rows of pins. There was enough solder on the pads and pins to do the trick. Next I made the necessary repairs to the board due to the to missing pads and soldered a piece of 26 gage wire to pin 9 (Address 18). This pin is how we will select our backup copy from flash. Pull it low to use the copy at 0x00000. Pull it high to select the copy at 0x40000. The photo shows the new chip installed on the LS Pro board.

Adding a second SATA port (tested and safe to install)

Adding a second SATA drive to your Linkstation Pro is as simple as installing a 0.01 uF surface mount capacitor at C279, C280, C281, and C282 and then installing the proper Molex connector at CN8.
Second SATA port installed dry fit prior to soldering. Notice that the rear of the shield needs to be bent up and out of the way prior to soldering.
I used a Molex part number 67490-1225 (you can get a few free samples from the molex web site) and held it down with a piece of 18 gage wire soldered over it like a strap. This is sufficient since the force applied to the connector after installation is in the direction of the plug and the connector has alignment pins to take the loads associated with plugging and unplugging the SATA cable for the external drive. Note that the connector is a SATA plug and not the typical eSATA connector that would normally be used to connect an external SATA drive. The correct part to use is Molex part number 0470821000 eSATA connector. This connector is recommended as the SATA connector is designed for 50 plug/unplug cycles while this connector is designed to withstand 5000 cycles. You will need to bend the contacts down slightly before installing it. That way, after you solder the 4 corners of the shield in place (you will need to cut off one of the black alignment pins)you can simply use your iron to heat the portion of the pads on the board that are not under the connector. the solder will heat up and flow to the pins and you will wind up with a good solder joint.

To test this I plugged the hard disk into the new sata port (I didn't have a spare SATA drive). The bootloader would not boot directly to the SATA drive plugged into CN8 so I bbooted the device using TFTP to retrieve the kernel and initrd. Once the device had the kernel and initrd loaded it pivoted to the root filesystem on the SATA drive even though it was attached to the secondary SATA port. I have attached a portion of the DMESG showing the device was recognized:

  ...o Checksum offload enabled
  o Loading network interface ** egiga_init_module (0)
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
  Vendor: WDC       Model: WD2500JS-00NCB1   Rev: 10.0
  Type:   Direct-Access                      ANSI SCSI revision: 03
SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB)
SCSI device sda: drive cache: write back
SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB)
SCSI device sda: drive cache: write back
 sda: sda1 sda2 sda3 sda4
Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0,  type 0
physmap flash device: 400000 at ff800000
CFI: Found no phys_mapped_flash device at location zero....
The next step after installing the SATA connector is to place the board back into the metal chassis and mark
Second SATA port installed as viewed from the back of the unit. This opening still needs some sanding and polishing.
the location of the new opening that must be cut to allow access to the connector from the outside of the case. A dremel tool works well for cutting the chassis. After cutting the hole into the chassis, place the chassis into the plastic case and use a hot pin to mark the corners of the opening in the plastic case. Heat the pin sufficiently to poke completely through the case and then use a hot blade to connect the dots you just made in the case. I've found that a razor knife's blade heated with a torch will cleanly cut through the plastic case.