Hardware Hacks for the LS Pro
All input is welcome. Please do not edit this page directly as I do not want any information to get past me without my knowledge as it could be detrimental to the LS Pro on which I'm experimenting. Please post any comments to the forum thread or the talk page.
This is an account of the attempts of Tampakuro (aka Kuroguy) to open the LS Pro hardware to more development. I'll be concentrating mainly on the flash memory as well as adding an eSATA port.
There are two obvious routes to reprogramming the flash memory:
The JTAG Access Method
As we have no manufacturer's literatire for the hardware, installation of a JTAG port is not currently an option. That leaves the dual flash method described below.
The Dual flash Method
I will be using a modified dual flash method to gain the ability to safely modify the flash contents. As the flash contains the bootloader, flashing a non working bootloader would permanently brick the LS Pro. The dual flash hack used on the LS1 involved piggybaking a second identical flash chip onto the original flash chip and then alternately enabling and disabling the two chips to gain access to a backup copy of the bootloader stored in the piggybacked flash chip. recovery was as simple as booting from the backup copy of the bootloader and then switching to the original flash chip via a switch or set of jumpers and reflashing the original bootloader.
The modified method I will be using requires completely removing the flash memory chip and replacing it with a new chip with twice the memory. Prior to installing the new memory chip I will program the contents of the original flash chip into the bottom 256 KB of memory and then again into the top 256 KB of memory. Since the 512 KB chip is pin compatible with the 256 KB flash all that is necessary to switch from the lower bank of 256 KB (the original bootloader) to the upper 256 KB (the backup copy) is to toggle the most significant address line (A18) from low to high. This will be accomplished via a jumper that I will install.
I have copied the flash contents to a file named flash.contents using the following command
cat /dev/mtd0 ./flash.contents
I programed the data from the flash.contents file into a new 512 KB flash chip at both address 0x00000 and 0x40000. The way it works is that toggling the A18 pin on the flash chips makes the LS Pro think that everything above 0x40000 is at 0x00000. When it does, we are using the backup flash contents.
I had brief dreams of saving the original flash chip just incase something went wrong. As a result of trying, I managed to lift 2 pads off of the motherboard. I then used a razor knife to cut all the pins from the flash chip as close to the chip as possible. once the body of the chip was removed, it was a simple matter to remove all the separate pins from the board.
Reinstalling the new flash chip was very easy. I filed a knife edge onto my soldering iron and tinned it and then made sure there was no extra solder on the tip. Line up the flash chip with the pads and then tack two opposite corners in place. Once the chip is held in place press down firmly on the chip and run the clean knife edge down the two rows of pins. There is enough solder on the pads and pins to do the trick. Next I soldered a piece of 26 gage wire to pin 9 (Address 18). This pin is how we will select our backup copy from flash. Pull it low to use the copy at 0x00000. Pull it high to select the copy at 0x40000. Here is a photo of the new chip installed.
Adding an second SATA portAdding a second SATA drive to your Linkstation Pro is as simple as installing a 0.01 uF surface mount capacitor at C279, C280, C281, and C282 and then installing the proper Molex connector at CN8.
To test this I plugged the hard disk into the new sata port (I didn't have a spare SATA drive). The bootloader would not boot directly to the SATA drive plugged into CN8 so I bbooted the device using TFTP to retrieve the kernel and initrd. Once the device had the kernel and initrd loaded it pivoted to the root filesystem on the SATA drive even though it was attached to the secondary SATA port. I have attached a portion of the DMESG showing the device was recognized:
...o Checksum offload enabled o Loading network interface ** egiga_init_module (0) 'eth0' Intergrated Sata device found scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter Vendor: WDC Model: WD2500JS-00NCB1 Rev: 10.0 Type: Direct-Access ANSI SCSI revision: 03 SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) SCSI device sda: drive cache: write back SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) SCSI device sda: drive cache: write back sda: sda1 sda2 sda3 sda4 Attached scsi disk sda at scsi0, channel 0, id 0, lun 0 Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0, type 0 physmap flash device: 400000 at ff800000 CFI: Found no phys_mapped_flash device at location zero....
The next step after installing the SATA connector is to place the board back into the metal chassis and mark the location of the new opening that must be cut to allow access to the connector from the outside of the case. A dremel tool works well for cutting the chassis. After cutting the hole into the chassis, place the chassis into the plastic case and use a hot pin to mark the corners of the opening in the plastic case. Heat the pin sufficiently to poke completely through the case and then use a hot blade to connect the dots you just made in the case. I've found that a razor knife's blade heated with a torch will cleanly cut through the plastic case.