PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

[_XBrD4shDOE_808_]

I was looking through ebay for components and other things and an ad for Mod Orbis for sale appeared:
https://www.ebay.com/itm/353933803747?hash=item52681940e3:g:h4sAAOSwh-5iGZJd

I didn't know that the person responsible for the Mod sold on Ebay

 

[RIP-Felix]

The easiest test on a COK-001 or COK-002 with 40nm would be to run these commands and see if it'll boot:

w 3242 03 61 82 80 01 91
w 3254 21 EC

or

w 3242 03 61 82 80 01 91
w 3254 21 EB

If that doesn't work I'll need another testbed.

Ok, not mandatory, the people using the orbis chip was not doing it anyway, but i would say is recommended, just as a small recap from the samples collected here
For a 65nm RSX we need to write the value 0x88
For a 40nm RSX we need to write the value 0x8B
For a 28nm RSX we need to write the value 0x89





There is some way to identify that 2 versions of the 40nm RSX visually ?, im wondering if it matches with the presence of the IHS this way:
CXD2982xx = 65nm RSX with IHS so we need to write E8 ?
CXD2991xx = 65nm RSX with IHS so we need to write E8 ?
CXD5300xx = 40nm RSX with IHS so we need to write EB ?
CXD5301xx = 40nm RSX with IHS so we need to write EC ?
CXD5302xx = 40nm RSX without IHS so we need to write EC ?
D5305x = 28nm RSX without IHS so we need to write EE ?

Im assigning EC to CXD5301xx because in the way you explained the results of your tests it seems you achieved it when using EC and i guess it was a RSX with IHS (older than CXD5302xx anyway)
Dunno, in wiki we dont have enought info from that last RSX models


Btw, if someone finds the way to bring life into this frankenstein remember to share some photos of the monster. The pad layout is different, this differences doesnt means that is imposible, in theory if all the signals are present it could be posible but is a big challengue

I I have personally installed, sucessfully, a CXD5301 in both a COK-001 and COK-002 Using the EC bit. @Computer Booter just installed, sucessfully, a CXD5302 (NO IHS version that came off an MPX-001 SS). We thought it was going to require the EB command, but it didn't work. EC did!

So CXD5301 & 2 both need EC.

I don't remember if anyone has done a CXD5300. Can anyone confirm which command worked?

I need to revise my tutorial, cuz it assumed EB was needed for 5302.

 

[Computer Booter]

I was looking through ebay for components and other things and an ad for Mod Orbis for sale appeared:
https://www.ebay.com/itm/353933803747?hash=item52681940e3:g:h4sAAOSwh-5iGZJd

I didn't know that the person responsible for the Mod sold on Ebay

I don't *think* that the seller is Botakompong there on eBay is it?! I have a listing up as well ;-). (I've sold 3, not sure why anyone would want one anymore, but I spent a decent chunk on them, so maybe someone still wants some haha!)


https://www.ebay.com/itm/255421556647

I I have personally installed, sucessfully, a CXD5301 in both a COK-001 and COK-002 Using the EC bit. @Computer Booter just installed, sucessfully, a CXD5302 (NO IHS version that came off an MPX-001 SS). We thought it was going to require the EB command, but it didn't work. EC did!

So CXD5301 & 2 both need EC.

I don't remember if anyone has done a CXD5300. Can anyone confirm which command worked?

I need to revise my tutorial, cuz it assumed EB was needed for 5302.

I've installed a 5300 and used the commands that were on the tutorial. Hope that helps

 

[RIP-Felix]

I've installed a 5300 and used the commands that were on the tutorial. Hope that helps

It does, thanks.

So 5300-5302 all use the EC bit, not EB. What is it for then?

 

[sandungas]

AV6 -> 10K -> GND
AW5 -> pin 65

I posted this on my last post in faulty thread, I'll say again @sandungas AV6 is tied on gnd on 40nm slim boards.

Thx, added to wiki https://www.psdevwiki.com/ps3/Template:Syscon_pinout_LQFP_100_pins

This is what i meant when i said we are not completly sure if sony did some change in the last PS3 models when we compare it with the info from the service manuals of the first PS3 fat models
The first PS3 motherboards seems to have 9 RSX control lines, but in slim motherboards there are only 8 because it seems sony "nerfed" the RSX_CGRST line
Ok, it makes sense but this opens a new mistery, im wondering when is the first time they did this... right now im not sure if depends of the RSX manufacturing process (maybe they was doing it too with the 65nm RSX models) or depends of the syscon models (starting with the first sherwood syscon in VER-001 motherboard)
Never minds, is just an small detail and i guess eventually i will find the answer, no hurry, overal im happy with the run, this was a nice research, thx again sqeept, this pinout mapping has been very clarifying for me

So is this resistor ?... from RSX pad AV6 there is a track to outside, then simply a 10k resisotr to GND to "nerf" it

clock generator reset is what I assume.

I was thinkinig in something like that too... when doing some random google searches i saw the term "CG = chronograph" mentioned in some documenttion for risc architecture and microcontrollers
The concept of a "clock generator" and a "chronograph" is a bit the same

 

[sandungas]

I I have personally installed, sucessfully, a CXD5301 in both a COK-001 and COK-002 Using the EC bit. @Computer Booter just installed, sucessfully, a CXD5302 (NO IHS version that came off an MPX-001 SS). We thought it was going to require the EB command, but it didn't work. EC did!

So CXD5301 & 2 both need EC.

I don't remember if anyone has done a CXD5300. Can anyone confirm which command worked?

I need to revise my tutorial, cuz it assumed EB was needed for 5302.

The last time i was trying to make sense of that is in this post
https://www.psx-place.com/threads/f...cecha-with-40nm-rsx.28069/page-82#post-324924
But there was only 2 confirmed reports of CXD5301xxx = 21EC by david and you
The PS3 from m4j0r/vyktor cant be considered a confirmation because the RSX was replaced and the RSX IHS used in it was taken from a box where vyktor stores the IHS's all together... so it was imposible to identify that RSX model visually

I have not seen any more reports after that, so i dont know (and as a consequence i cant wikify it)... at this point probably some of you knows a lot better than me how that identifyers works

 

[squeept]

Mine was 5301 and I used whatever Felix had in his signature at the time.

 

[sandungas]

@Computer Booter just installed, sucessfully, a CXD5302 (NO IHS version that came off an MPX-001 SS)

Btw, i asked vyktor about that before, but he said the RSX IHS of the slims doesnt fits well in the 40nm RSX models without IHS... i guessed is a problem of heights but im not sure what was the real problem

Can you comment on that ?, what you did with the IHS ?
I was guessing if the problem was the height it would be easy to reduce his height, in my oppinion the better way to do it would be like doing a lapping but starting with very rought sandpaper

 

[vyktormvmpay25]

He added copper foil on middle of rsx ic to fill gap. He tested that gap in video and he seen won't work simple.

04:03:00., is a part of copper foil used in Nintendo.

 

[Workz_777]

this is not new to me, I've seen ads selling the PS4 APU this way LOL. But the ps3 GPU is the first time I see '-'

Yeah. worst part is the eBay listing had a photo of a "new old stock" RSX, and the in the description was written "New", and the price was also high. I'm trying to get a refund from this seller now.

 

[nCadeRegal]

Just when you think this thread was climaxing it's peak you guys blow my mind again with your continued research into this endeavor. Just thinking way back when icferrum first posted about getting a Sony refurbished Console with a 40 NM rsx and the slew of finding you guys have unearthed since is astounding. I continue to be amazed at the stuff you guys are doing for my favorite all time console. Thank you again. This is one of the most important threads of all time when it comes to the ps3 in my opinion.

 

[mekmitasdigoat]

Hey friends, so i had ordered a "nos" 40nm RSX (CXD5300) about 1 month ago from a Chinese eBay seller, after 1 week they told me they had no "new" ones left in stock and only used / refurbished ones. So i said send it anyway, well it arrived today and check this out...

View attachment 36714

They cut it out of the board!! I've never seen this before, like whaaaaa?? On the bright side, at least it hasn't endured another thermal stress by being desoldered, i guess lol ...and hey i got a few extra MLCCs for free!

As Vic suggested, i'm now looking to buy KTE-001 and harvest the RSX from them instead.

EDIT: strangely enough, everytime i just look at this cut-out RSX i keep hearing "George Takei" saying "Oh My!" in my head lol.

Haha I got the same thing from a random seller. However my bad delidding skill killed it

Also I heard that those salvage yards never cut the healthy PS3 board, so those cutting board "NOS" are likely came from the broken batch. However I personally think it might not be that bad given the relatively better stability for those chips. I mean once the machine does not turn on then it will most likely be counted as fault however in fact any component in that machine could cause the problem so there must be a change that the RSX is still in a good shape.


Btw is there any good way to delid this 53XX series RSX? I have seen some video that they dip this chip in some liquid overnight and can use a blade to cut open it easily.

 

[Workz_777]

Haha I got the same thing from a random seller. However my bad delidding skill killed it

Also I heard that those salvage yards never cut the healthy PS3 board, so those cutting board "NOS" are likely came from the broken batch. However I personally think it might not be that bad given the relatively better stability for those chips. I mean once the machine does not turn on then it will most likely be counted as fault however in fact any component in that machine could cause the problem so there must be a change that the RSX is still in a good shape.


Btw is there any good way to delid this 53XX series RSX? I have seen some video that they dip this chip in some liquid overnight and can use a blade to cut open it easily.

View attachment 36734

LOL ...looks like we got it from the same sellers. This is new to me, i've never seen them sell cut-out RSX with some of the board still attached. Is that you photo? If so seems you did a good job of de-lidding, i can't see why you killed it, seems fine to me.

I saw a guy recommend taping up a butter knife with electrical tape so that the knife doesn't scratch the substrate, i did this once and it worked well. Sticking the knife flat in the air gap of the RSX / IHS.

I wonder what overnight liquid that might be, maybe acetone?

 

[mekmitasdigoat]

LOL ...looks like we got it from the same sellers. This is new to me, i've never seen them sell cut-out RSX with some of the board still attached. Is that you photo? If so seems you did a good job of de-lidding, i can't see why you killed it, seems fine to me.

I saw a guy recommend taping up a butter knife with electrical tape so that the knife doesn't scratch the substrate, i did this once and it worked well. Sticking the knife flat in the air gap of the RSX / IHS.

I wonder what overnight liquid that might be, maybe acetone?

If you zoom in the photo you can see I cracked one corner. To open this thing, I heated it up and pushed my blade so hard to cut and separate the lid (that's why it cracked lol). It's not the same level as the 90nm ones the glue they used on those 40nms are like a rock.

For the liquid I think they used it to soften the adhesive so if the acetone does the job then it could be.

 

[RIP-Felix]

I was thinkinig in something like that too... when doing some random google searches i saw the term "CG = chronograph" mentioned in some documentation for risc architecture and microcontrollers
The concept of a "clock generator" and a "chronograph" is a bit the same

I didn't mean to make it sound like I was guessing. SONY is pretty consistent with abbreviations in the service manual. For example, AVCG stands for Audio Video Clock Generator. CG when used in most combinations means Clock generator. the abbreviation CLK is used instead, when referring to a clock signal instead of the generator.

So CG_Reset is a signal that resets the clock generator which produces clocks for...something? The way I read it is this...

• RSX reset signal is sent to coordinate the startup of some process. Eg, RSX is held in reset at during the power on sequence until clock generator power stabilizes and they are producing stable clocks. Then reset is released so the chipset can all initialize in a known state.
• Tying R2054 to GND with a 10k resistor (pull down resistor) prevents the RSX reset signal from triggering a CG reset on BGA pad AV6, without affecting reset on pad AW5. It looks like the arrow in the scematic is an incoming signal from the SYSCON. So this prevents the SYSCON from triggering CG_Reset. Why? IDK
  
• Evidently, the 65nm and 40nm RSX do not ever need CG reset. You can see SONY has it tied to GND with that 10k in the KTE-001 image. So the Frankenstein mod is simply copying that. I have no idea what function CG_Reset is supposed to serve in BC 90nm models. I wish I knew.

 

[RIP-Felix]

Btw is there any good way to delid this 53XX series RSX? I have seen some video that they dip this chip in some liquid overnight and can use a blade to cut open it easily.

When it's off the board you can use a razor blade to cut into the adhesive between the IHS and VRAM. You have to shimmy it back and forth inching it deeper, trying not to cut into the VRAM resin. Once you get far enought it'll pop. Then you can start on the another corner.

IMO the best solution is just to leave the IHS in place. No delid necessary. My lidded E01 has the same temps as my 2 delided A01's.

 

[RIP-Felix]

For the liquid I think they used it to soften the adhesive so if the acetone does the job then it could be.

Goof off slowly cuts it on 90nm. But I'd worry about soaking overnight. I just use it in combination with scraping to get the last bit off.

 

[squeept]

Could also have something to do with "clock gate reset" used to reduce power consumption, and they felt it was unnecessary to utilize / went a different design route on smaller processes.

See section 4 here: https://www.ijser.org/researchpaper/Effects-of-Different-Clock-Gating-Techinques-on-Design.pdf

 

[sandungas]

I didn't mean to make it sound like I was guessing. SONY is pretty consistent with abbreviations in the service manual. For example, AVCG stands for Audio Video Clock Generator. CG when used in most combinations means Clock generator. the abbreviation CLK is used instead, when referring to a clock signal instead of the generator.

So CG_Reset is a signal that resets the clock generator which produces clocks for...something? The way I read it is this...

• RSX reset signal is sent to coordinate the startup of some process. Eg, RSX is held in reset at during the power on sequence until clock generator power stabilizes and they are producing stable clocks. Then reset is released so the chipset can all initialize in a known state.
• Tying R2054 to GND with a 10k resistor (pull down resistor) prevents the RSX reset signal from triggering a CG reset on BGA pad AV6, without affecting reset on pad AW5. It looks like the arrow in the scematic is an incoming signal from the SYSCON. So this prevents the SYSCON from triggering CG_Reset. Why? IDK
  
• Evidently, the 65nm and 40nm RSX do not ever need CG reset. You can see SONY has it tied to GND with that 10k in the KTE-001 image. So the Frankenstein mod is simply copying that. I have no idea what function CG_Reset is supposed to serve in BC 90nm models. I wish I knew.

Ok, good to know sony already used the CG codenames in other lines of the service manuals with the meaning of clock generator, then im in the same boat, is our best guess
The fact is the names of the signals i was talking about belongs to syscon (not to RSX), as example there is another syscon line named SB_CGRST, in theory is should do exactly the same than RSX_CGRST but with the southbridge

And yeah, maybe this signals are used to initialize and sync them... im guessing the bittraining could start by using this reset signals, this way you are sure the syscon is "catching" them at the exact time interval to start the bittraining

The resistor to ground should be mostly to dont keep the line "floating" in an unestable state that could generate random resets caused by interferences, noises, etc...

I have not tryed to follow the line in the different motherboard models, but in the service manual of the SEM-001 it can be seen it have a resistor in between syscon and RSX named R2079... search for that in the .pdf is easy to find, it have some more resistors and capacitors related to it
There is also a resistor named R2054 located in between RSX_RESET and RSX_CGRST marked as xx (unpopulated, not present in retail units) that seems to indicate at some point they was joining together both signals... also, the circuit board allows to do that if we add that resistor, take a look at it because maybe the existence of that solder pads comes in handy for the frankies either to connect both together or to do the 10k resistor to GND to nerf the RSX_CGRST

As i said before, im not sure if this trick with the RSX_CGRST signal depends of the syscon model or the RSX model, but let me make a list of the motherboars that needs to be checked to find this:

DIA-002 (PS3 models CECHJxx or CECHKxx) <--- first PS3 model with a 65nm RSX (and a RSX RAM VDDR of 1.0v)
VER-001 (PS3 models CECHLxx, CECHMxx, CECHPxx, or CECHQxx) <--- first PS3 models with a sherwood syscon
SUR-001 (PS3 model CECH-21xx) <--- first PS3 model with a 40nm RSX

The change happened in one of them, my guess is it happened in VER-001 because they had to rewrite the syscon firmware for sherwoods, it looks like the perfect timing to modify the bittraining in between CELL, RSX and SB

 

[squeept]

Just did another COK-001 with a 65nm that I had sitting here. 3 second YLOD, A0403034, really low ohms, fixed and running fine after swap.

Also, I grabbed the uptime for the donor chip. What's the current record? This little guy had about 650 days, and was still over 4 ohms.