Duo 2300c/180 MHz 603e QFP Graft/Hack . . .

And then clock circuit modifications?

As far as removing the CPU, use a pankcake griddle, some screws as standoffs, preheat the board at 300F and let it go for about 10 mins.

Heatgun on low, pull the chip right off ;-)

I just did a full reflow on a POS Acer aspire 5534 today using a similar technique.

And then clock circuit modifications?

Click to expand...

Dunno about the clock, I'm just planning to go for a CPU Bus Multiplier change to access more cycles per tick on the fast side bus.

IIRC, if I leave those legs floating in the air and patch the proper resistance values to them it's a done deal. :?:

If that works, I can look at tweaking the system clock and Bus Multiplier to find optimal performance & reliability, but that'll have to take certain peripherals running on the bridged '030 bus into consideration.

For example: I'm still aiming at a hack that'll route the proper 16 bits of the Duo's bridged '030 bus to a 1400's "T-Rex-on-Board" PCMCIA Card Cage mounted in place of the HDD. I've even got a cute lil PCMCIA wireless card for the top slot that has a whip antenna nubbin that'll slightly protrude from the Duo's side! Underneath will be one of my adapter cards and flash memory, an actual PCMCIA HDD . . .

. . . or anything else that rolls along! }

If I can get the card cage hack online w/WiFi and the Proc to match the 166MHz of the 1400, I'll be a very happy hacker! [] ]'>

Hey Trash,

so are we to assume you will be determining CPU multipliers for the 2300c, or clock crystal replacement? I'd love to see the 2300c with just a little more boost - 117Mhz, 133 even

JB

Where did you find the 180MHz 603e? Is it on a 1400 CPU card?

UMax SuperMac C500 CPU 603e 180 MHz

Part#910252-11 SSCPU



The seller has several BGA versions, but I snagged the only QFP INSIDE UMax CPU Card he had. [] ]'>

IIRC, all the 1400 cards, with the exception of the slowest, used a BGA package 603e.

The reason the mysterious DuoHacker never attempted this graft was that he couldn't locate the four resistors normally used to determine the clock speed. I never tried . . . hence . . .

. . . the neolithic, brute force approach I plan on using for testing! }

edit: now that I think of it, I should try to find the PowerDuo parallels for the resistors TomLee posted for the 5300!

I'd love to see the 2300c with just a little more boost - 117Mhz, 133 even

Click to expand...

AFAIK, the 1400's 117MHz CPU Card's QFP 603e should work for this hack too! [] ]'>

is the dock port on the back of the unit PDS? if so, couldn't we override the internal CPU with a newer CPU like the other PDS accelerators did?

Yep! It's the same PBX Bridged '030 PDS/slow side I/O bus, common to the Duos, 1400s and 5300s. So the Docking Connector only has access to the slow side of the I/O bus, whereas the Cache and unbridged PDS Slots were on the fast side along with the Memory Controller, RAM, CACHE, etc.

You really have to move the CPU lines to the Modem Compartment and adapt them to the 1400 Mobo Connectors to stick a CrescendoPB in there . . .

. . . to which DR. Bob over on 'fritter replied was no mean feat, as the fast side is running at 100MHz . . . :-/

However he'd scoffed at the entire notion until I posted the DevNote Block Diagrams, side by side and color coded, to show the few differences between the 1400 and the 2300c. The gang over there shouted him down, so he gave me a crash course on why fooling around with the 100MHz section wasn't child's play.

At which point I decided to cheat . . . by moving PBX to the mountain and . . . whatever . . . )

< edited . . . murk reduction attempt >

Installing the T-Rex/PCMCIA Card Cage from a 1400 is likely to be a much more simple hack. I'm Certain the UltraDock's cavernous sub-basement was designed to enclose this assembly, running off the Duo's Docking Connector.

Pardon my ignorance, whats a Trex/Card cage?

Sorry, my bad. It's not ignorance! It's my visual thinker's verbal/.TXT communications skill deficit.

The PowerBook 1400 has a DIP header mounted PCMCIA Slot Mechanism DaughterCard.

T-Rex is the PCMCIA Controller ASIC on the bottom of the assembly.

< I'll post a pic of my 1400's Book Cover showing the 1400/2300 block diagrams side by side here after I find the file [] ]'> >

Found a couple of 1400 goodies just now!

X11 for 1400

http://hintsforums.macworld.com/archive/index.php/t-9732.html

Debian on a Powerbook 1400

http://forums.debian.net/viewtopic.php?t=19915

ooooOOOOH!

http://mess.redump.net/mess:driver_info:mac_technical_notes

Hmm... I got a parts PB1400. it actually works, but someone busted the hell out of it removing the HDD. so its useless for any practical usage. Plugging in an external SCSI HDD with a universal OS, yielded to a bootable system.

If you've got one, pull it apart and take a look at the card cage:





Here's the graphic I'd posted over on 'fritter something like 8 years ago!



I'm still spelunking in the drives in the 466 DA for the Illustrator files I did of the traces on the surfaces of a depopulated Card Cage (bake & shake) and then within the Card Cage's PCB back when I decided to start scanning the it periodically . . .

. . . after taking a grinder to the freakin' thing . . . repetitively! }

It was paper thin when I'd finished, I'm hoping to find it in one of the boxen along with this Duo case I modded for a test fitting! :approve:

your block diagram is wayy too small, i cant see it.

Well if we can get protocol and logic analyzers on that Trex chip, which is equipment that i DONT own or ever operated.

We could technically emulate it and program a new CPLD or FPGA to mimic the trex. then build new cages

OHHHH I SEE. lol.

I am looking at the datasheets side-by-side, the 2300 and the 1400 use the same whitney archetecture. so i see what your saying, map the pins of the card cage to the whitney IC in the PB1400, mark em down.

then mark the same on the whitney IC to the PDS slot of the duo 2300, so then this way, we can get pins-to-functions chart, such as Pin1 = A0, Pin2 = D3, etc etc. Pin16 = /IRQ, i see what your saying now.

weee. it wont be TOO incredibly bad, if I can figure out which IC is the whitney.

Which brings me to the master question: has the connectors been mapped yet?

WAAAYYYY too complicated! I snagged several cages and have the circuit board almost deciphered.

I've also got a deal pending for a dead 1400 MoBo from one of the comrades. That's intended to be depopulated in a FAR more civilized manner. Then I can just buz the connections from the interboard header connection back to the PBX Bridge chip pads and compare those results to the 2300c's connections from the docking connector back to PBX's pads and then noodle out how to connect the T-Rex Cage to the Docking Connector for testing.

Once that's up and running, the Duo 2300c gets a new Copper Clad FRP floorpan that'll help to replace some of the stiffness lost in hacking a chunk out of the magnesium frame for slot access.

And all the IRtalk hardware comes right along for the ride! }

Anybody got a dead 2300c mobo available for a lobotomy? :?:

isnt the docking connector documented? what the address/data/control lines are?

because then if you can map out what they are on the card cage, you could just wire it up and be done

AHA! Typing at the same time I see!

Yeah, it's a little more complicated than I thought if we need to figure out the interconnections with Whitney, but we may not have to, dunno.

I was thinking it was all in the PBX 030 Bridge/Memory Controller ASIC, but you may be right.

I am looking at the signal pathing of the block diagram.

it appears to "me" ( i use that term loosley). That the card cage is on the slow side 030 buss, from the PBX/Whitney, etc. its a bus, its all interconnected. A0 is A0, D0 is D0, etc, at least i think.

Now, if we can trace out which pins are what between the PBX/Whitney/Cage, you can make a Cage To Chip chart.

Then you can make a Chip to Dock connector chart on the duo.

Take the two charts, join them, then you get a Cage to Dock chart and if the Dock pins are known, then you get a Cage To Signals chart, then you can adapt the cage to ANY 030 PDS buss.

Yup! the Docking Connector isn't the problem, it's well documented, it's the connections between the ASICs on the 1400 and the PARTIAL docking connnector (16 bit?) that the T-Rex card cage interconnect represents.

Well, if so, then what I said still stands as a viable attack method.

Time consuming and difficult, YES. but is it feasable, YES.

Any better ideas?

of course we are gonna obviously need the PCMCIA system enabler and drivers. If ROM doesnt support PCMCIA, we cant boot from, unlike the 520/540.

Well, if so, then what I said still stands as a viable attack method.

Click to expand...

I've been working on it along those lines on and off for a VERY long time!

. . . then you can adapt the cage to ANY 030 PDS buss.

Click to expand...

SHHHHHHH!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! That part was supposed to be a surprise! :lol:

Oh well, cats outta the bag now. lol.

BTW we skewed this thread, WAYYYYY out of topic, but hey its fun.

I guess easiest thing is to get VCCs and GNDs out of the way. lol. And work with whats left.

But this means that any machine with an 030 PDS bus, we can have orinocco wireless

But unless we emulate the t-rex with a new CPLD, we eventually are gonna run out of cages.

Oh well. :-x

BTW, I've got one BiG@$$ spreadsheet somewhere called the RosettaStoneProject that lists the pin/signals of every flavor of 030 PDS slot, bridged or unbridged, that Apple ever managed to torque outta' shape.

Well before i get too carried away, i have to finish the AVR SCSI project, but i think the cardcage thing would actually work out better. MAYBE.

Well, for machines that we cant directly access the PDS, we can "force" a PDS, such as the PB1XX series. find and tap into all the address/Data lines and run wires.

BTW we skewed this thread, WAYYYYY out of topic, but hey its fun.

Click to expand...

: Whatever gave you the idea that any of my threads EVER stayed on topic? :lol:

Tangential spinoff is the way some of the best interactions happen around here! :approve:

yup. all it takes is an "ooohhh.. oohhhh, what iff....." thought.

Well, i got my gears spinning now. Going to have to sleep on this food for thought and see what i come up with. I have to get up early for work in the AM. In the meantime, i just sent in a small donation because i love this site. lol.

Me too, ciao! )

. . . of course we are gonna obviously need the PCMCIA system enabler and drivers. If ROM doesnt support PCMCIA, we cant boot from, unlike the 520/540.

Click to expand...

The Duo has it all in ROM, remember Apple announced a PCMCIA Dock and then didn't deliver, even after Newer had done the Design and had the Tooling done for the PCMCIA UltraDock. They wound up just using it for everything BUT housing the T-Rex/Card Cage.

I wouldn't be at all surprised if the 1400, 5300 and 2300 all use what is basically the same ROM, because they're very close being different packaging of the the same machine, IIRC. The Duo 2300c was released with the PB 1400, if memory serves.

We'll probably have to cook up a Dock DeclROM to do it though, but that's fairly well documented . . .

. . . for an Apple product/spec. :

Dock DeclROM? only if the dock PDS is on a different interrupt vector level or something than the original TREX driver requires it to be.

But if its in ROM, then it should already be there. just load the PCMCIA driver and go.

You might be right, however, while I'm at it, it sure would be nice to lie to the friggin' thing, so I can uncouple the ^&%$^#%$# left and right speaker channels . . .

. . . among other juicy little tidbits I'v been working on/whittling away at . . . lo, these many years! }

Muahahahahahhahahahaaaaaaaaa!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! :lol:

i know how these "many years" things goes. there are soo many projects I need to complete myself and never have.

I had an RC lawnmower that was all electric, i made from scratch. control circuitry, remote, all of it. took me 2 years until i got it done. finally got it done, had some bugs and other similar issues, but overall it worked ok. it cut the lawn. and i didnt have to physically ride or push it. LOL.

But it burned up in a fire. since the cutting deck was home made out of wood, the drunks decided to burn it in a fire. NICE. :disapprove: (i live in a boarding house environment)

couple of other unfinished projects is a set-top audio spectrum analyzer which i still need to finish, using soviet VFD display tubes.

I also need to finish the MP3 player that uses SD storage, and uses another VFD as its display tube. has a VU meter, and 14 segment alphanumeric. VS1001 decoders are hard to come by, which is why it never got finished.

I made an encrypted cordless phone that worked for awhile and eventually something went screwy in the modem and i never got around to fix it. I used a standard cordless phone with a 24kbit AAC (i think) codec IC, and scrambled the 512-byte stream buffer with a 512bit RSA key in an ATmega128. it worked great. ;-) only major pitfall is the phone ONLY worked if the other person had the same phone, and the audio quality was TERRIBLE, but that was the fastest i could go, as the phone line bandwidth is obviously limited so the modulator couldnt go any faster. it was running fast enough support the 24kbit AAC, I also had to use a 5 block size buffer, not only becuase the encryption took a little while, the audio was choppy. the buffer fixed the choppy audio, but increased the lag time. i didnt care as long as audio wasnt choppy.

the modulator/demodulator consisted of XR2204 AFSK decode/Encode ICs, if memory serves. it was AFSK hot all the time. The "magic" (modulator/scrambler/encoder) sat in between the microphone and the MIC amplifier on the handset. I had to remove the low pass filters to get the entire bandwidth of the handset. Same thing with the earpiece. the demodulator sat in between the earpiece and the amplifier on the handset.

This also meant i couldnt hear plaintext or analog sounds. ONLY the modulated sounds. so i coudlnt hear DTMF tones, or dialtones. just hope like hell it worked. hehe. and it always did. If someone picked up the phone, it would sound like the old time fax machines on the line. lol. I never added a mixer circuit so I could hear the analog as well as digital, and once the Exar IC locked, it would "disable" the analog mix path. it would have been simple to do, just didnt bother. Another cumbersome setback was I had to turn off the MIC modulator while i was dialing, or the "AFSK noise" would interfere and cause issues dialing. But no big deal, after i dialed the phone i would switch the modulator on.

me and a buddy of mine would call each other and use them all the time, and not have to worry about eavesdroppers. Then he passed away, and the project died, never did fix the issue. as he had the other handset.

Before he passed away, the future plans were to fix those issues, and add new ones, such as modulating ASCII text transmissions, so i would know "who" was calling besides what the caller ID said. But i dunno if the PSTN would transmit anything unless the other end "picked up" so it probably wouldnt work until i picked up the phone anyway. I would have also added the ability to change keys on the fly, as I would set my phone up as a master phone, transmit the key to the secondary phone and "rotate keys" for each call or something. Bad thing about that would be, unless i could encrypt the key that i transmit, the encryption could be broken.

:O About 90% of the technical end of that phone phreakin' $#!+ went . . .

< Peanut Mode >

eeeerrrrwwwwwtttttttt!!!!!!!!!!!!!!!!!!!!

< /Peanut Mode >

. . . right over my head! :I

Sounds way cool though! :approve:

Cripes! You sound nuttier than me . . . and that's goin' a fer piece! The only thing I ever wanted to do that'd p1$$ off the NSA was to write a one time pad encryption routine that'd use specific AOL installation CD releases as generally available, non transmitted, Digital One Time Pad Keys . . .

. . . and you're doing that kind of crap over the phone lines!!!!!!!!!!!!!!!!!!!!!! 8-o

Yeah, I know, waaayyyyyy too much Clancy in my noggin's bibliography, but not enough Programming Texts ( I have a love/hate relationship with coding . . . with a major league side order of procrastination and laziness as garnish [] ]'> ) to do anything really useful. So I mull things over and think up outlandish hardware hacks and try to pull 'em off without resorting to programming!

Necessity may be the "mother of invention," but creative laziness and tomfoolery are the "whacked out uncles" of invention . . .

. . . that none of the respectable members of the family ever talk about! } :beige: )

Chip's here, pics are up!

Spent a bit of time with the digital camera yesterday after picking the CPU Card from the Complex Rental Office the evening before.



I've got some more things and materials to order/scrounge up, along with some other victims coming in for practice runs before I start doing SMT rework on this lil' puppy. So don't expect results to be posted very soon, I'll be taking my time.

As a side note: thee has been some real progress on the SuperDuo front!

I finally had a chance to test something I've wanted to check out ever since the inception of the 2300cG3 project . . .



. . . and it fits!

Next experiment: Check to see if Sonnet's NuBus Accelerator will run reliably on the end of its matching PDS extension cable. }

oh jeebus. NOW we are in trouble......... hahaha.

that 603 is pretty. wish i had one, that CPU pitch is the same pitch of the SCSI transceivers from TI that i just soldered down on the AVR SCSI board.

ive got 2 duo 2300s. one of them is a real 2300 missin some parts (side rubbers) and torn trackpad cable.

and the other one is a duo 280c upgraded 2300 (complete minus SCSI HDD)

I got a 7100 from a friend of a friend who used it in college and wanted to find it a good home! }

I haven't done anything drastic yet, but I set up the Upgrade on a Stick (PDS extension cable above) test in it, (didn't wanna risk either my Radius 81/110 or the extra board for it) mounted a fan to blow air in for cooling where I had it flopped over the carrier card and . . .



. . . no joy at all. :'(

Works fine in the slot, but not hangin' out onna' limb.

I'll give Sonnet a call, it might just be be an addressing/slot assignment issue, but somehow I don't think two adapter boards and this Flex Circuit are going to be the simplified solution I was looking for.

SuperDuo is gonna take a bit more thinkin' n researchin', BLEH! :disapprove:

IIRC, that PDS extender only works on the downstream side of the G3 upgrade, ie between the G3 and a PDS video card - and only a video card. I don't think anything but a video card even works plugged straight into the PDS passthru on the G3, so it's likely the ribbon only has enough lines for that and nothing else.

But wait ... you're hoping to run a desktop G3 upgrade card in a Duo?

Nope, still looking at ways to adapt a CrescendoPB to the Modem Cubic, this was just a down and dirty test of the cable.

BTW, if a CrescendoPB works, ANY 1400 ProcCard ought to work! :b&w:

this was just a down and dirty test of the cable.

Click to expand...

...why? Surely you're going to need a completely different cable for the actual hack?

BTW, if a CrescendoPB works, ANY 1400 ProcCard ought to work! :b&w:

Click to expand...

Which gives you the option of using vanilla 1400 CPU cards as disposable testbeds

Which gives you the option of using vanilla 1400 CPU cards as disposable testbeds . . .

Click to expand...

. . . and allows other DuoHackers to find far less expensive/READILY AVAILABLE, cache-on-board 603ev ProcCards from the 1400 series to speedbump their 2300s . . .

. . . instead of the CrescendoPB! }

I'm not yet convinced that Sonnet's cable won't work, it looks like a straight passthru cable to me (that fits!) with some intervening circuitry that likely allows 2 PDS cards to be addressed in one PDS Slot.

It's probably very similar to that super-expensive SE/30 multicard adapter with the mysterious PAL on board. Disable that kinda nonsense and I'll bet the Sonnet Card will run just fine on the end of its matching cable!

If this doesn't work out, I'll just have to do ONE adapter card that's a lot more complex a task than doing two simpler cards for the ends of the existing/available Sonnet cable . . .

BTW, if a CrescendoPB works, ANY 1400 ProcCard ought to work! :b&w:

Click to expand...

Did I mention that at least some (if not all) of the Apple 166MHz 1400 cards are actually 180MHz 603s downclocked? At least according to the HHHH.

every 166 MHz CPU module I have examined actually uses a 180 MHz 603ev part!

Click to expand...

I'll bet the Sonnet Card will run just fine on the end of its matching cable!

Click to expand...

Ahhhh now I understand - you want to go socket->cable->G3->HPV, instead of socket->G3->cable->HPV, so you can move the G3->HPV elsewhere in the case. Well, seeing as both the HPV and the G3 can sit in the 601 PDS socket, sure, why not?

it looks like a straight passthru cable to me with some intervening circuitry that likely allows 2 PDS cards to be addressed / Disable that kinda nonsense

Click to expand...

You may not have to. If I remember my PDS lore, the cards themselves (at least 030 PDS ones) carry pseudo-slot IDs - the relative position on a multi-card chain matters not.

Did I mention that at least some (if not all) of the Apple 166MHz 1400 cards are actually 180MHz 603s downclocked?

Click to expand...

Only one fly in that ointment, they're all BGA CPUs on those cards. However, if I can get 1400 cards and T-Rex to work within the Duo's case, I might be tempted to try overclocking it!

I think my precious QFP 603e is going to go into my best (read: Beater Quality Plastics) 5300ce. There's already some overclocking info from TomLee available and that beautiful 800x600x16bit Spanned Display tips the scales in that direction . . .

. . . not to mention the T-Rex/Card Cage already on board! }

EDIT: forgot to mention the 5300ce 64MB (artificial) RAM limit > the 2300c 48MB (waaaayyyyyyyy artificial) RAM ceiling.