PS3 [PoC] PS3 CELL/XDR Overclocking Research and Reversing, potential OC discovery on retail PS3.

If any of you want updates, the firmware to patch the timebase in lv0 has been published. This approach patches lv0 to dynamically calculate the timebase frequency at runtime. The only limitation is the does not have the required space to add two extra PPC instructions in lv0 to calculate the RefDiv variable, so four separate firmware files had to be created. The file names are self explanatory; PS3UPDAT32-38.PUP are for consoles that are either set to the stock 3.2 GHz or overclocked up to 3.8 GHz. If you wish to go further, you'll need to install the firmware for that respective overclock target.

This firmware is still experimental. Backup your EID root key and flash before attempting and proceed with caution. Although, multiple users have had success in Linux and in stock GameOS. There is also a dedicated Discord server for this topic so if you need help, feel free to join.
 
If any of you want updates, the firmware to patch the timebase in lv0 has been published. This approach patches lv0 to dynamically calculate the timebase frequency at runtime. The only limitation is the does not have the required space to add two extra PPC instructions in lv0 to calculate the RefDiv variable, so four separate firmware files had to be created. The file names are self explanatory; PS3UPDAT32-38.PUP are for consoles that are either set to the stock 3.2 GHz or overclocked up to 3.8 GHz. If you wish to go further, you'll need to install the firmware for that respective overclock target.

This firmware is still experimental. Backup your EID root key and flash before attempting and proceed with caution. Although, multiple users have had success in Linux and in stock GameOS. There is also a dedicated Discord server for this topic so if you need help, feel free to join.

Excellent news! I will quickly proceed with some tests and will be sure to provide feedback through the same channel. Thank you again for your outstanding work!

Just to clear up a doubt I have: is there a specific command to adjust the XDR RAM frequency?
 
Last edited:
XDR utilise la même table de fréquences que CELL, mais avec un décalage NVS différent (0x312C et 0x312D). Par exemple, un overclocking XDR à 3,8 GHz serait :w 312c 02 11
Ok, dont see this on the repo. My bad I guess... w 312 XX X is a mullion command? What the sherwood entry (I test essentially on sherwood)? Thank you very much. If I follow the github I see w 63 but this is the command for the cell or w 61 but that is for the XDR timing. Last question, you dont have the corrected firmware on 4.93? All my PS3 are on 4.93.

EDIT1: finding how activate QA flag but 4.93 version will be fine!

EDIT2: Currently, the best I can achieve is 4 GHz (test on 20XX) with the patched CFW (seem be perfectly OK). Starting at 4.1 GHz, the console no longer boots, even when I increase the CELL voltage. If I understand correctly, this is probably because the frequency gap between the CELL and its XDR memory becomes too large. In that case, I would really need access to the Sherwood command to address this issue.

EDIT3: Indeed, after testing (and search on the discord), the command for the XDR frequency on Sherwood is w 61 XX XX (I have trying 3.9GHZ). I was therefore able to boot at 4.2 GHz (by increasing the CELL voltage). At this point, I'm a bit lost: what is the Sherwood command used to optimize the memory timings (tRC)?

I was convinced it was also w 61 XX...

For reference, the following command is provided for Mullion:

tRC = 21: w 3160 51 70 (byte0: 010100|01) - STABLE (best confirmed)

EDIT4: First test on Skyrim @4.256GHZ, it's incredible! No more FPS drop when I'm runing in city.

EDIT5: First stabilised setup on SLIM 20XX with the modified CFW: CELL @ 4.256GHZ @ 1.15V & XDR @ 4GHZ (used new game start on skyrim for test stability, crashed under this value). I confirm thaht Skyrim is really a CELL limited game. Intro sequence have 30 FPS stable.

EDIT6: CELL @ 4.4GHZ and XDR @ 4.2GHZ need 1.2V. Starting to need delid CELL at this point, need 54% fan for stay under 60° (with direct fan case mod).

EDIT7: 4.5 GHZ demand 1.3V and 4.7GHZ (max reached) demand 1.35V, after this limit I cant reach more. 4.4GHZ seem to be the sweet spot.

Just a quick note to let you know that, in the end, there is no command on Sherwood to adjust XDR timings.

If you happen to come across this thread, you'll be glad to know it if, like me, you've been searching for it for quite a while.

According to Nascar, it wouldn't provide any benefit anyway when running overclocked CELL values, and would only make a difference at stock CELL clocks. It's easy to understand why: if I significantly increase the XDR memory frequency, that's likely to have a much greater impact than tweaking a few memory timings.

Nascar has offered to compile a 4.93 CFW with the corrected clock values when he has some free time. So if you're waiting for that, a little patience - I imagine he'll post it here when it's ready.

Once again, thanks to the whole team. It's genuinely fascinating to follow all of this.
 
Last edited:
Nope its actually because of no one has any actual concern towards superslims in reality pretty much everyone I have come across to engage in contribution of stock design data has simply showed either no interest or just moved on saying I don't have time or spare board so who even cares if obsolence is de facto trash
there is a lot of interest in every console, the only reason we have the A, B, C, E, and G is because they got leaked from Sony's servers, if we have the service manual a lot more could be done to super slims and even slims

Ok, dont see this on the repo. My bad I guess... w 312 XX X is a mullion command? What the sherwood entry (I test essentially on sherwood)? Thank you very much. If I follow the github I see w 63 but this is the command for the cell or w 61 but that is for the XDR timing. Last question, you dont have the corrected firmware on 4.93? All my PS3 are on 4.93.

EDIT1: finding how activate QA flag but 4.93 version will be fine!

EDIT2: Currently, the best I can achieve is 4 GHz (test on 20XX) with the patched CFW (seem be perfectly OK). Starting at 4.1 GHz, the console no longer boots, even when I increase the CELL voltage. If I understand correctly, this is probably because the frequency gap between the CELL and its XDR memory becomes too large. In that case, I would really need access to the Sherwood command to address this issue.

EDIT3: Indeed, after testing (and search on the discord), the command for the XDR frequency on Sherwood is w 61 XX XX (I have trying 3.9GHZ). I was therefore able to boot at 4.2 GHz (by increasing the CELL voltage). At this point, I'm a bit lost: what is the Sherwood command used to optimize the memory timings (tRC)?

I was convinced it was also w 61 XX...

For reference, the following command is provided for Mullion:

tRC = 21: w 3160 51 70 (byte0: 010100|01) - STABLE (best confirmed)

EDIT4: First test on Skyrim @4.256GHZ, it's incredible! No more FPS drop when I'm runing in city.

EDIT5: First stabilised setup on SLIM 20XX with the modified CFW: CELL @ 4.256GHZ @ 1.15V & XDR @ 4GHZ (used new game start on skyrim for test stability, crashed under this value). I confirm thaht Skyrim is really a CELL limited game. Intro sequence have 30 FPS stable.

EDIT6: CELL @ 4.4GHZ and XDR @ 4.2GHZ need 1.2V. Starting to need delid CELL at this point, need 54% fan for stay under 60° (with direct fan case mod).

EDIT7: 4.5 GHZ demand 1.3V and 4.7GHZ (max reached) demand 1.35V, after this limit I cant reach more. 4.4GHZ seem to be the sweet spot.

Just a quick note to let you know that, in the end, there is no command on Sherwood to adjust XDR timings.

If you happen to come across this thread, you'll be glad to know it if, like me, you've been searching for it for quite a while.

According to Nascar, it wouldn't provide any benefit anyway when running overclocked CELL values, and would only make a difference at stock CELL clocks. It's easy to understand why: if I significantly increase the XDR memory frequency, that's likely to have a much greater impact than tweaking a few memory timings.

Nascar has offered to compile a 4.93 CFW with the corrected clock values when he has some free time. So if you're waiting for that, a little patience - I imagine he'll post it here when it's ready.

Once again, thanks to the whole team. It's genuinely fascinating to follow all of this.
Now I have the 4.93 Firmware available so I will try to make that public on a github repo or something
 
there is a lot of interest in every console, the only reason we have the A, B, C, E, and G is because they got leaked from Sony's servers, if we have the service manual a lot more could be done to super slims and even slims
well thats something i have found not to be true theres absolutely no even moving an inch to contribute any data towards superslims anymore theres absolutely no images of cxd2999AAG or even d5305 bga pattern from an actual motherboard like fat and slims and i requested that over 3 years ago i specifically made a thread for developing schematics given that people contribute scans and probed data 6 months ago that's even abandoned now
 
well thats something i have found not to be true theres absolutely no even moving an inch to contribute any data towards superslims anymore theres absolutely no images of cxd2999AAG or even d5305 bga pattern from an actual motherboard like fat and slims and i requested that over 3 years ago i specifically made a thread for developing schematics given that people contribute scans and probed data 6 months ago that's even abandoned now
There are bga patterns and someone has reverse engineered the 28nm RSX. We just haven't really needed schematics for it since most of them aren't that in depth to fix. It would be good to have all of them but in reality what we have is really all we will ever get
 
There are bga patterns and someone has reverse engineered the 28nm RSX. We just haven't really needed schematics for it since most of them aren't that in depth to fix. It would be good to have all of them but in reality what we have is really all we will ever get
yeah therese no images of cxd299aag or even d5305 anywhere on internet I had to prowl no less than a 100 reels just to get these blurry photos
 

Attachments

  • FB_IMG_1779063320255.jpg
    FB_IMG_1779063320255.jpg
    92.7 KB · Views: 0
  • FB_IMG_1764287344865.jpg
    FB_IMG_1764287344865.jpg
    74.8 KB · Views: 0

Similar threads

Back
Top