Hardware Hacks for the LS Pro
All input is welcome. Please do not edit this page directly as I do not want any information to get past me without my knowledge as it could be detrimental to the LS Pro on which I'm experimenting. Please post any comments to the forum thread or the talk page.
This is an account of the attempts of Tampakuro (aka Kuroguy) to open the LS Pro hardware to more development. I'll be concentrating mainly on the flash memory as well as adding an eSATA port.
Adding an eSATA port (tested and safe to install)Adding a second SATA drive to your Linkstation Pro is as simple as installing a 0.01 uF surface mount capacitor at C279, C280, C281, and C282 and then installing the proper Molex connector at CN8.
It is very important that you tin (and leave a bit of extra solder connected to) the capacitors as you cannot place a small enough amount of solder with just the solder. It would also require 3 hands to do so. You need the smallest bent nose jeweler's tweezers you can find ($1.30 at the local flea market). The width of one of the tips must be smaller that the spacing between adjacent capacitors. You will be heating both ends of the capacitor at one time. File a knife edge onto the iron tip and press the edge down the length of the capacitor while you hold it in place with the tweezers. be gentle as those capacitors like to fly across the room. Hold with moderate pressure until the solder is hot. You might even hear/feel a creaking sound when the solder goes to liquid. Hold the iron in place for about 2 more seconds after the sound. When the cap sets into place remove the iron and let it cool for a second. Once cool, remove the tweezers. The hard part is getting the adjacent capacitor in place without heating the first one. You also must hold the capacitor in place or it will simply stick to the soldering iron when you remove the iron. That's why you need the smallest tweezers you can get. After the capacitors are installed, install the eSATA connector. Use 0603 SMD capacitors.
The correct part to use is Molex part number 47082-1000 eSATA connector. This connector is designed to withstand 5000 plug/unplug cycles while the standard SATA connector is designed to only withstand 50 cycles.
You will need to bend the seven contacts down slightly before installing the connector. This will preload the pins when you solder the shield in place and then all that is necessary os to heat the seven pads oat CN8. The solder will melt towards the pins of the Molex connector and you will wind up with a nice solder joint. You will need to cut off one of the black alignment pins prior to installing the connector and a dry fitting will let you determine which pin is the correct one to remove.
To test this I plugged the hard disk into the new sata port (I didn't have a spare SATA drive). The bootloader would not boot directly to the SATA drive plugged into CN8 so I bbooted the device using TFTP to retrieve the kernel and initrd. Once the device had the kernel and initrd loaded it pivoted to the root filesystem on the SATA drive even though it was attached to the secondary SATA port. I have attached a portion of the DMESG showing the device was recognized:
...o Checksum offload enabled o Loading network interface ** egiga_init_module (0) 'eth0' Intergrated Sata device found scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter Vendor: WDC Model: WD2500JS-00NCB1 Rev: 10.0 Type: Direct-Access ANSI SCSI revision: 03 SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) SCSI device sda: drive cache: write back SCSI device sda: 488397168 512-byte hdwr sectors (250059 MB) SCSI device sda: drive cache: write back sda: sda1 sda2 sda3 sda4 Attached scsi disk sda at scsi0, channel 0, id 0, lun 0 Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0, type 0 physmap flash device: 400000 at ff800000 CFI: Found no phys_mapped_flash device at location zero....The next step after installing the SATA connector is to place the board back into the metal chassis and mark
There are two obvious routes to reprogramming the flash memory:
The JTAG Access Method
I took a torch to a kuro pro and a ls pro. Once the SOC was removed tracing the pins was a piece of cake. CN3 is the JTAG connector. pins are as follows:
The Dual flash Method (DO NOT ATTEMPT AT THIS TIME)
I will be using a modified dual flash method to gain the ability to safely modify the flash contents. As the flash contains the bootloader, flashing a non working bootloader would permanently brick the LS Pro. The dual flash hack used on the LS1 involved piggybaking a second identical flash chip onto the original flash chip and then alternately enabling and disabling the two chips to gain access to a backup copy of the bootloader stored in the piggybacked flash chip. recovery was as simple as booting from the backup copy of the bootloader and then switching to the original flash chip via a switch or set of jumpers and reflashing the original bootloader.
The modified method I will be using requires completely removing the flash memory chip and replacing it with a new chip with twice the memory. Prior to installing the new memory chip I will program the contents of the original flash chip into the bottom 256 KB of memory and then again into the top 256 KB of memory. Since the 512 KB chip is pin compatible with the 256 KB flash all that is necessary to switch from the lower bank of 256 KB (the original bootloader) to the upper 256 KB (the backup copy) is to toggle the most significant address line (A18) from low to high. This will be accomplished via a jumper that I will install.
I have copied the flash contents to a file named flash.contents using the following command
cat /dev/mtd0 ./flash.contentsI programmed the data from the flash.contents file into a new 512 KB flash chip at both address 0x00000 and 0x40000. The way it works is that toggling the A18 pin on the flash chip makes the LS Pro think that everything above 0x40000 is at 0x00000.
I had brief dreams of saving the original flash chip just in case something went wrong. As a result of trying, I managed to lift 2 pads off of the motherboard. I then used a razor knife to cut all the pins from the flash chip as close to the chip as possible. once the body of the chip was removed, it was a simple matter to remove all the separate pins from the board.
Reinstalling the new flash chip was very easy. I filed a knife edge onto my soldering iron tip and tinned it. I then made sure there was no extra solder on the tip. I Lined up the flash chip with the pads and then tacked two opposite corners in place. Once the chip was held in place, I pressed down firmly on the chip and ran the clean knife edge down the two rows of pins. There was enough solder on the pads and pins to do the trick. Next I made the necessary repairs to the board due to the to missing pads and soldered a piece of 26 gage wire to pin 9 (Address 18). This pin is how we will select our backup copy from flash. Pull it low to use the copy at 0x00000. Pull it high to select the copy at 0x40000. The photo shows the new chip installed on the LS Pro board.
ZIF socket installation (AKA Medusa)
Well, as a last resort I've decided to solder 32 wires to the circuit board and tie them into a ZIF socket that I can use to insert a preprogrammed flash chip. installing these wires has been a real pain as the pads tend to pull off the board. To alleviate that I decided to use hot glue to hold the wires in place after soldering them to the board. All that is left to do is repair 2 board traces and attach the ZIF socket. when complete the ZIF socket will be mounted on the outside of the LS Pro so I can remove/reprogram/replace the flash chip without opening Frankenstein's LS Pro's case. Here are some photos of the hack: