PS3 [PoC] PS3 CELL/XDR Overclocking Research and Reversing, potential OC discovery on retail PS3.

STLcardsWS

Administrator
Project Overview
This document details the reverse engineering of the PlayStation 3 syscon clock generation subsystem, specifically focusing on CELL and XDR clock configuration. The research resulted in the discovery of software based overclocking capabilities on retail PS3 consoles through NVS modification.

Target System
  • Console Model: CECHA00

Achievements
  • Decoded the complete clock frequency lookup table (25 entries)
  • Mapped NVS offsets controlling clock generators
  • Identified lv0 firmware whitelist restrictions (this can potentially be solved on winning the silicon lottery and chips with a differnet revision, 90/65/40/28nm)
  • Achieved semi stable 4.0 GHz CELL overclock (25% over stock 3.2 GHz)
  • Documented XDR clock limitations and CELL/XDR ratio requirements


.CONTINUE READING THE FULL WRITE-UP @
codeberg.org/derg/cell-xdr-overclocking/src/branch/main/README.md


Update: Project moved over to Github:
https://github.com/sagemono/cell-xdr-overclocking


Info and Write-up via
https://x.com/AbkarinoMHM/status/2014808811983241259
 
Last edited:
Slim and Super Slims will be supported?
Initially we thought that the 2500 for example can clock to 5.3GHz

... but its actually doing nothing

Basically for 2500 and SS, webmanMOD recognizes the OC and the Wattage increases but when comparing the timing between stock and OC, there is little to no difference

Think of it as a triangle, if one of the 3 indications are not true then its not a proper OC

Afaik, they are currently testing the 2000 slims as they use the same old clock gen. 2100 is yet to be determined and 2500/SS doesnt work properly like mentioned as of now

Probably they use a different type of clock gen or some additional stuff that needs to be RE.

Check the "Actual" in the table, it compares the 2500 and the P model (both Sherwood). Youll see that on the P the value changes but on the 2500 its the same
5175abff2ba569730eb0206038293c26.jpg
 
What is Actual value? Why it decreases on P model along with rise in GHZ?

So as of now it works only on FAT. That's better than nothing.
Imagine Super Slim with CFW and overclock both chips.
 
Seems like 2000 slims work with the OC. Probably due to using same old clock gen of the FATs.

Timebase correction needs to be figured out.
I hope that 2500 gets figured out [emoji120][emoji120]
a5d30e385ee1602a7a4e9792e016166c.jpg
 
Can someone explain timebase conversion?
Timebase correction just keeps game timing normal after a CELL overclock.
Games assume the CPU is always 3.2 GHz, so if you overclock without fixing the timebase, physics, animations, audio, and FPS can break or run too fast (analogy like old games running at way too high FPS)
The fix tells the system to keep time behaving like stock while still getting the performance boost.
 
Just a quick note to thank everyone working on this fascinating subject. I'm following the progress of this work with great interest. Going as far as tuning the RAM timings is truly exceptional. I'm very eager to see what this will bring to the 25XX series, and I hope there will be a small tutorial on how to synchronize the clock. That said, since 3.85 is already almost synchronized, we can already appreciate this significant advancement.
 
Does this mod need some changes or modifications in CFW or syscon changes are enoguh?
For now, only Syscon. But I guess that if we want an overclock value other than 3.9 GHz, a CFW modification might be necessary — though I'm not sure. At around 3.9 GHz, the internal timebase drift is only about +0.7% to +0.8%.

I also came across a recent short from Nascar, about a month old, mentioning that overclocking models newer than the 20XX series could become extremely difficult because some hardware components are missing from the motherboard revisions.

From my recent research, the best model to fully take advantage of these advances seems to be the PlayStation 3 CECHL. It's essentially a Fat model with a Slim-era motherboard design. These systems can handle RSX overclocks around 700/850 while also supporting CELL overclocking, making them an excellent overall combination.
 
Last edited:
Hi is there anyone in this world with a pqx motherboard and a reball station send me bga layout for cell and rsx on motherboard
 
I also came across a recent short from Nascar, about a month old, mentioning that overclocking models newer than the 20XX series could become extremely difficult because some hardware components are missing from the motherboard revisions.

How this hw components affect OC?
 
As far as I understand it, it's a hardware component of the 'clock' type that isn't present on revisions later than 20XX.

For what it's worth, after testing several consoles (mainly CECH L / Sherwood models, which I'm focusing on), it appears that not all of them necessarily support the same XDR timings, and some even refuse to go beyond stock settings (24). The results therefore seem to vary depending on the individual units.

After working on several modded CECHL units, I eventually came across one whose RSX was able to run stably at 750 MHz / 1000 MHz.

For reference, I stabilized it at 1.25V. This unit came with its original Fujitsu HDD (2009-09) and had the particularity of refusing any XDR timing modifications (unfortunately). I also encountered another case where a machine only accepted an improvement of the tRC from 24 to 23.

Additionally, as is often the case with these models, any attempt to raise the voltage beyond this limit results in an immediate hard shutdown as soon as the RSX comes under load.

Another CECHL was stabilized at 700 MHz (with 1.225V). This one, however, accepted the XDR RAM timing modification down to 21 without any issue (the maximum stable limit mentioned on GitHub). Its particularity was that it did not hard shutdown beyond 1.25V, but its RSX simply could not stabilize beyond the previously mentioned frequency limit.

At this stage, I can reasonably suggest that there are probably two types of CECHL boards — even though the motherboards are technically the same model: those that enforce a voltage limit, and those that allow it.

I was unable to find the Sherwood command to disable Spread Spectrum (if I understood correctly, w 3122 00 for Mullion). I would have been curious to see whether disabling it could have provided some additional headroom regarding these abrupt shutdowns.

By the way, on all the machines tested (roughly ten units), overclocking the CELL to 3.9 GHz only required 1V. Interestingly, going below this value prevents the machine from booting at all, whether overclocked or not.

I also carried out an overclocking test at 4.5 GHz (the only other clock value aligned with the PLL settings) using a voltage value of FF. It worked surprisingly well, but as already mentioned, the limitation of a certain memory bus causes audio desynchronization — and likely many other issues I did not take the time to investigate further.

From what I have been able to understand so far, the practical upper limit for PS3 CELL overclocking would be around 4.2 GHz.

I will probably continue experimenting on the Slim 20XX models next.

I am sharing these modest observations in the hope that they may be useful to the community. Once again, I would like to express my thanks and congratulations to everyone who made it possible for us to explore this playground.

Interesting PS3 CELL OC finding on a CECH-20XX.

I initially overclocked the CELL using:

  • 04 1B (~3.9 GHz)
The goal was to avoid clock desynchronization issues by keeping proper clock relationships instead of using some of the more aggressive presets.

System appeared stable:

  • games stable
  • no freezes
  • no obvious crashes
However, both Crysis 3 and Final Fantasy XIII showed severe audio desync/stuttering during video cutscenes while gameplay itself remained perfectly fine.

After testing, lowering the CELL one step down to:

  • 02 11 (~3.8 GHz)
completely fixed the issue.

Interesting part:
this suggests some PS3s can appear stable at 3.9 GHz while still exhibiting subtle SPU/audio/video decoding instability before hard crashes occur.

It also suggests that the stable CELL OC rules documented in the GitHub repo — largely based on CECHA behavior — may not universally apply to all later models.

At least on this CECH-20XX, 02 11 seems to be the actual stable point while 04 1B was only "gameplay stable".

Additional note regarding the same CECH-20XX from my previous post.

Out of curiosity, I tested an extreme CELL configuration using:

  • FF voltage
  • ~5.3 GHz effective CELL clock
Surprisingly, the console actually booted without immediate crashes or shutdowns, and I was even able to launch a Crysis 3 game session.

However, as expected, clock synchronization was completely broken.

Still interesting to see how far the hardware can be pushed before completely refusing to boot.
 
Sony has them locked down tight

Any news about project?
Ps2 timebase is still a work in progress, we have a modified lv0 which will fix ps3, ps1, psp, and OtherOS, but ps2 is its own thing and is very complex

For now, only Syscon. But I guess that if we want an overclock value other than 3.9 GHz, a CFW modification might be necessary — though I'm not sure. At around 3.9 GHz, the internal timebase drift is only about +0.7% to +0.8%.

I also came across a recent short from Nascar, about a month old, mentioning that overclocking models newer than the 20XX series could become extremely difficult because some hardware components are missing from the motherboard revisions.

From my recent research, the best model to fully take advantage of these advances seems to be the PlayStation 3 CECHL. It's essentially a Fat model with a Slim-era motherboard design. These systems can handle RSX overclocks around 700/850 while also supporting CELL overclocking, making them an excellent overall combination.
It won't be possible through cfw and is not recommended since to do it we have to do syscon modifications, if this was done through cfw there wouldn't be a safeguard unless you access the syscon anyways so it's going to be only syscon, it being done through cfw will not happen

As far as I understand it, it's a hardware component of the 'clock' type that isn't present on revisions later than 20XX.

For what it's worth, after testing several consoles (mainly CECH L / Sherwood models, which I'm focusing on), it appears that not all of them necessarily support the same XDR timings, and some even refuse to go beyond stock settings (24). The results therefore seem to vary depending on the individual units.

After working on several modded CECHL units, I eventually came across one whose RSX was able to run stably at 750 MHz / 1000 MHz.

For reference, I stabilized it at 1.25V. This unit came with its original Fujitsu HDD (2009-09) and had the particularity of refusing any XDR timing modifications (unfortunately). I also encountered another case where a machine only accepted an improvement of the tRC from 24 to 23.

Additionally, as is often the case with these models, any attempt to raise the voltage beyond this limit results in an immediate hard shutdown as soon as the RSX comes under load.

Another CECHL was stabilized at 700 MHz (with 1.225V). This one, however, accepted the XDR RAM timing modification down to 21 without any issue (the maximum stable limit mentioned on GitHub). Its particularity was that it did not hard shutdown beyond 1.25V, but its RSX simply could not stabilize beyond the previously mentioned frequency limit.

At this stage, I can reasonably suggest that there are probably two types of CECHL boards — even though the motherboards are technically the same model: those that enforce a voltage limit, and those that allow it.

I was unable to find the Sherwood command to disable Spread Spectrum (if I understood correctly, w 3122 00 for Mullion). I would have been curious to see whether disabling it could have provided some additional headroom regarding these abrupt shutdowns.

By the way, on all the machines tested (roughly ten units), overclocking the CELL to 3.9 GHz only required 1V. Interestingly, going below this value prevents the machine from booting at all, whether overclocked or not.

I also carried out an overclocking test at 4.5 GHz (the only other clock value aligned with the PLL settings) using a voltage value of FF. It worked surprisingly well, but as already mentioned, the limitation of a certain memory bus causes audio desynchronization — and likely many other issues I did not take the time to investigate further.

From what I have been able to understand so far, the practical upper limit for PS3 CELL overclocking would be around 4.2 GHz.

I will probably continue experimenting on the Slim 20XX models next.

I am sharing these modest observations in the hope that they may be useful to the community. Once again, I would like to express my thanks and congratulations to everyone who made it possible for us to explore this playground.

Interesting PS3 CELL OC finding on a CECH-20XX.

I initially overclocked the CELL using:

  • 04 1B (~3.9 GHz)
The goal was to avoid clock desynchronization issues by keeping proper clock relationships instead of using some of the more aggressive presets.

System appeared stable:

  • games stable
  • no freezes
  • no obvious crashes
However, both Crysis 3 and Final Fantasy XIII showed severe audio desync/stuttering during video cutscenes while gameplay itself remained perfectly fine.

After testing, lowering the CELL one step down to:

  • 02 11 (~3.8 GHz)
completely fixed the issue.

Interesting part:
this suggests some PS3s can appear stable at 3.9 GHz while still exhibiting subtle SPU/audio/video decoding instability before hard crashes occur.

It also suggests that the stable CELL OC rules documented in the GitHub repo — largely based on CECHA behavior — may not universally apply to all later models.

At least on this CECH-20XX, 02 11 seems to be the actual stable point while 04 1B was only "gameplay stable".

Additional note regarding the same CECH-20XX from my previous post.

Out of curiosity, I tested an extreme CELL configuration using:

  • FF voltage
  • ~5.3 GHz effective CELL clock
Surprisingly, the console actually booted without immediate crashes or shutdowns, and I was even able to launch a Crysis 3 game session.

However, as expected, clock synchronization was completely broken.

Still interesting to see how far the hardware can be pushed before completely refusing to boot.
So what we figured out is that Samsung XDR is usually max 3.8-4GHz, Elpida XDR is able to do 4.6-5.2ghz which I did achieve on XDR. Since cell has to be within at most 800mhz of XDR that is where the limitation is. There is also an issue with the clock gen, TI clock gen is not capable of overclocking, ICS chips are. Unfortunately on the 21xx and newer the syscon doesn't send the codes to those chips and thus we run into the overclock not applying. The fix would be to make a custom clock gen which is still very complex and is unlikely to happen for a while.

As for the 5.3ghz console you have, I am curious if you had a good clock gen or not as I couldn't get 5.2 to stay stable, you can verify this with your fps counter, if it is staying above 60fps in xmb then the overclock isn't applying, if it does go below 60fps in xmb then it is applying
 
Sony les tient fermement sous contrôle.


La base de temps PS2 est encore en développement. Nous avons une version modifiée de niveau 0 qui corrigera les problèmes sur PS3, PS1, PSP et autres systèmes d'exploitation, mais la PS2 est un cas à part et très complexe.


Ce ne sera pas possible via un firmware personnalisé (CFW) et c'est déconseillé car cela nécessiterait des modifications du syscon. Si cela était fait via un CFW, il n'y aurait aucune protection à moins d'accéder au syscon. Par conséquent, cela se limitera au syscon et ne sera pas possible via un CFW.


Nous avons donc constaté que les puces Samsung XDR sont généralement limitées à 3,8-4 GHz, tandis que les Elpida XDR peuvent atteindre 4,6-5,2 GHz, ce que j'ai pu faire avec une XDR. La limitation réside dans le fait que la fréquence de la Cell doit être inférieure ou égale à 800 MHz de celle de la XDR. Il y a également un problème avec le générateur d'horloge : celui de TI ne permet pas l'overclocking, contrairement aux puces ICS. Malheureusement, sur les modèles 21xx et plus récents, le syscon n'envoie pas les commandes à ces puces, ce qui explique pourquoi l'overclocking ne s'applique pas. La solution consisterait à développer un générateur d'horloge personnalisé, ce qui reste très complexe et peu probable dans un avenir proche.

Concernant votre console à 5,3 GHz, je me demandais si vous aviez un bon générateur d'horloge, car je n'ai pas réussi à stabiliser la fréquence de 5,2 GHz. Vous pouvez le vérifier avec votre compteur de FPS : s'il reste au-dessus de 60 FPS dans le XMB, l'overclocking n'est pas appliqué ; s'il descend en dessous de 60 FPS, il est appliqué.


Yes, I have observed that in these cases the FPS can run away in the XMB. That would explain it, especially since I did not need to apply particularly high voltages.

It is worth noting that some consoles are stable at 3.8 GHz (02 11), while others—generally older units— are stable at 3.9 GHz (04 1B).

Thank you very much for your clarifications. If I understood your message correctly, the base clock correction will eventually be handled directly through the Syscon. I assume this means you are carrying out a challenging reverse-engineering effort to identify the required commands and values.

Regarding Samsung and Elpida XDR RAM, I assume that either type should be sufficient to reach 4.2 GHz (with a maximum difference of around 800 MHz, if I understood correctly the rule between the CELL). However, I have not been able to find a clear testing procedure that confirms whether the XDR timing tightening has actually been applied. I tried using CellMark, but I do not get the impression that it allows me to verify this.

I have also noticed that some consoles (rares exeption) refuse any modification of these timings (CECHL). In addition, I have one FAT model (a CECHG series, if I remember correctly) that refused any modification of the CELL settings. Just to note that some motherboards sometimes do not behave the same way as others, for reasons that I do not understand.

To conclude, I can make a few sacrificial consoles available if it becomes necessary to test new, potentially risky Syscon values. If so, feel free to provide me with a list of tests to perform; I would be happy to carry them out if it can help.

Finally, after several hours of in-game testing, I did not observe any anomalies as long as the CELL setting was properly aligned with the internal clock frequency.

Once again, congratulations on your efforts, this is an incredibly fascinating subject.
 
Last edited:

Similar threads

Back
Top