this is an interesting thread to read. i want two of those 3.5GHz ones in my quad (quad core 3.5ghz)
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Overclocking the G5 CPU
- Thread starter simie
- Start date
- Sort by reaction score
Did Apple do this as well ?
PowerPC 970MP running in single-core?
It may sound strange but the IntelliStation POWER 185 is in fact running the PowerPC 970MP "dual core" chip in single core mode. This is undocumented on the PPC 970MP datasheet and not implemented on anything else as far as I can tell. I'm not exactly sure how this was achieved but it's either a hidden switch on the PPC970MP or a special switch done through firmware. The reason why this was done was to reduce the thermal requirements for a smaller system and smaller heatsink; as a work-around IBM then offered adding a second PowerPC 970MP in the IntelliStation 185 (also running in single-core mode) to simulate a "dual-core" PowerPC 970MP setup through two discreet chips instead of one.
PowerPC 970MP running in single-core?
It may sound strange but the IntelliStation POWER 185 is in fact running the PowerPC 970MP "dual core" chip in single core mode. This is undocumented on the PPC 970MP datasheet and not implemented on anything else as far as I can tell. I'm not exactly sure how this was achieved but it's either a hidden switch on the PPC970MP or a special switch done through firmware. The reason why this was done was to reduce the thermal requirements for a smaller system and smaller heatsink; as a work-around IBM then offered adding a second PowerPC 970MP in the IntelliStation 185 (also running in single-core mode) to simulate a "dual-core" PowerPC 970MP setup through two discreet chips instead of one.
Digging deeper into IBM processors, I now know that the Power 5+ cpu's required an activation code.
- The 4-core 1.65 GHz processor (#8285) requires that four processor activation codes be ordered. A maximum of four processor activation code features (4 x #8285, or 2 x #7285 and 2 x #8485) are allowed per processor card.
Yes (and, for RAM too at least on the Power7 770-790 which use proprietary Power7 DDR3 slots) but as Power 5-7 are EOL/EOS in theory there should be no reason why IBM wouldn't give simply those away at this point
I have a Power8 machine running Ubuntu (in ppc64le mode), on which I will install ppc64 ubuntu (16.04, the last big-endian version) with yaboot and try to boot osx or Darwin on another partition from there (which works on G5s, and only using yaboot; grub cannot boot the ppc version of osx afaik and as far as I have tried), e.g. with a mac-flashed Radeon 9200 PCI, let's see how far it goes before KPing due to the lack of a supported platform kext
Lets see how far you can get with the support everyone who reads this thread. This would be a major step forward for PPC OSX users.
Will let you know, I definitely expect it to fail (I would assume this has been tried before notably on the PS3 or 360 if not on Power) the question is how far down the boot process, yaboot should work on it (perhaps with some fiddling again as under 16.04 ppc on G5s), I would like to see if the kernel even loads which would already be something.
Another option would be qemu, but I am not sure that the ppc64 or ppc64le ports support GPU passthrough, though there has been some success with the x86_64 version of qemu-system-ppc and a mac-flashed graphics card:
Two different boards with the same holes but in different places
The far right , these may be our JTAG connection points as the board has other test points that are labeled to 12volts and GND.
If we could also work out the rear of the socket surely this would mean that we can over or underclock this way.
Some boards have a socket on the end and space for two other but these are not plugged in. These are actually labelled and one of them is labelled IBM.
The following image is not an Apple Power Mac but look at the JTAG connections. According to the interweb there is no set standard for JTAG connections.
https://1bitsquared.de/products/black-magic-probe Here is a probe that may be able to assist this project.
Looking at the above board for the PPC2.7GHZ cpu, we can see on the top far right our holes and below this we can see a space which we assume would have a connector labeled (looks like) IBM then there is an actual connector labelled SAT or SAF and then the space may have had a connector and it is labelled FMAX.
Attachments
Last edited:
Reading further suggests that JTAG could have a password protecting access to the debugging. This would be a bugger if Apple had done this .View attachment 2162260
Two different boards with the same holes but in different places
View attachment 2162263
The far right , these may be our JTAG connection points as the board has other test points that are labeled to 12volts and GND.
If we could also work out the rear of the socket surely this would mean that we can over or underclock this way.
Some boards have a socket on the end and space for two other but these are not plugged in. These are actually labelled and one of them is labelled IBM.
The following image is not an Apple Power Mac but look at the JTAG connections. According to the interweb there is no set standard for JTAG connections.
https://1bitsquared.de/products/black-magic-probe Here is a probe that may be able to assist this project.
View attachment 2162527
Looking at the above board for the PPC2.7GHZ cpu, we can see on the top far right our holes and below this we can see a space which we assume would have a connector labeled (looks like) IBM then there is an actual connector labelled SAT or SAF and then the space may have had a connector and it is labelled FMAX.
Here is a guide and possible JTAG tools that may work on the PPC
"Finding the JTAG interface signals and their pinout can be quite laborious! That’s because the device manufacturer can hide, obfuscate or disable the JTAG interface."
The Newbie’s Guide To JTAG
Do you even snarf? If not, it might be because you haven’t mastered the basics of JTAG and learned how to dump, or snarf, the firmware of an embedded device. This JTAG primer will get you up …
This might be the software that will do the job
Downloads - sigrok
Other software
OpenOCD (Open On-Chip Debugger) is an open source tool for communicating with JTAG interfaces. The project has been around for many years, connects easily to GDB and has a very comprehensive support of JTAG adapters and hardware devices.
UrJTAG is a newer tool, simpler but with a more friendly interface.
According to various sources, some manufacturers hide the JTAG connections under other components like batteries etc. While some other manufacturers disable the JTAG connections in some way.
Reading further the JTAG and Apple may not have invented their own but stuck to designs used by IBM.
JTAG 101 - Part 1: Overview and On-Chip Debug Methods - EDN
Introduction JTAG (jay-tag) is one of the engineering acronyms that has been transformed into a noun, although arguably it is not so popular as RAM, or
Here is a JTAG interface that works with PowerPC cpu's
There is some available on EBAY
Last edited:
Reading the service manual again for the G5 Quad, Apple state that there are two versions of the processors
This is version 2
This is version 1
What are the benefits of having the version 2 over the version one, I wonder which is the most reliable?
This is version 2
This is version 1
What are the benefits of having the version 2 over the version one, I wonder which is the most reliable?
So far yaboot doesn't show the option to boot macosx on Power8, even with macosx=/dev/sdb4 in yaboot.conf in my case and then entering sudo ybin -v -C /etc/yaboot.conf and sudo ybin -v -C /etc/mkofboot.conf
I installed Ubuntu 16.04 ppc on an external HD which boots into it fine, then I resized the ext4 partition, created an hfsplus partition and cloned a working Tiger partition onto it then run the above, to no avail. I tried reinstalling Ubuntu 16.04 ppc onto the external HD keeping the osx partition (the yaboot installation part has a "detecting other OSes" part) but no luck, neither by then doing the above.
However there is a difference from Apple hardware, in that petitboot seems to scan whatever is in the PReP boot partition and offer it in the startup menu, and thus there seems to be no staged yaboot as under Apple machines (whereby the first stage would offer l: Linux, x: OSX and c: cd options then proceed to stage 2 if l was pressed, where you would still have a choice to boot osx along with ubuntu if listed in etc/yaboot.conf).
Note that there is no ofboot option in the yaboot.conf generated by Ubuntu 16.04 ppc on my Power8 machine. This might be the key, but for this I need to determine the OpenFirmware path to the PreP partition (the version of ofpath provided by Ubuntu 16.04 ppc doesn't seem to function on the Tyan Power8; I will try from 20.04 if it works at all, as it seems that this the Tyan Power8 servers seem to have an incomplete Open Firmware implementation). I will examine the PreP boot partition to see if it's anything like on Apple machines when running Linux (notably the presence of ofboot.b). Another option might be to make a very large boot partition and stick an Xpostfacto helper partition installation on it - the fixed Debian ppc version seems to use a fake System folder in it to boot Debian). Or to try with Darwin only at first (yaboot does have support for booting Darwin too via the darwin=/dev/sdXY option)
Last edited:
I think the main issue is the lack of OpenFirmware on OpenPower systems.
Petitboot reads configuration files from grub or yaboot and does a soft reboot to load the kernel and initrd but I am unclear as to whether it actually loads those bootloaders upon soft reboot. If it does So from what I read from the boot process of IBM Power systems (and OpenPower), if it does then I think the idea is to get BootX to load from petitboot after a soft reboot. Chainload might be an option there as the platform might be EFI/UEFI, however this has been reported not to work on PowerPC:
Let's see if this works on Power8 or by using chainload +1, Or using kexec, but the issue there is that the system will need device drivers to access the boot drive even if it does boot the kernel.
multiboot might also be an option via grub or petitboot however I am not sure one can multiboot BootX (or boot.efi for that matter)
If not, the configuration provided in yaboot seems the best option (eg macosx=/dev/sdb2) but I would really like to know how to load osx from eg the yaboot command prompt or to determine exactly how it loads the Apple bootloader.
Alternatively, another option would be to get the Apple bootloader to load from skiboot instead of petitboot in the boot process
wiki.raptorcs.com
wiki.raptorcs.com
Petitboot reads configuration files from grub or yaboot and does a soft reboot to load the kernel and initrd but I am unclear as to whether it actually loads those bootloaders upon soft reboot. If it does So from what I read from the boot process of IBM Power systems (and OpenPower), if it does then I think the idea is to get BootX to load from petitboot after a soft reboot. Chainload might be an option there as the platform might be EFI/UEFI, however this has been reported not to work on PowerPC:
Let's see if this works on Power8 or by using chainload +1, Or using kexec, but the issue there is that the system will need device drivers to access the boot drive even if it does boot the kernel.
multiboot might also be an option via grub or petitboot however I am not sure one can multiboot BootX (or boot.efi for that matter)
If not, the configuration provided in yaboot seems the best option (eg macosx=/dev/sdb2) but I would really like to know how to load osx from eg the yaboot command prompt or to determine exactly how it loads the Apple bootloader.
Alternatively, another option would be to get the Apple bootloader to load from skiboot instead of petitboot in the boot process
OpenPOWER Firmware - RCS Wiki
Skiboot - RCS Wiki
Last edited:
Further on this, it seems that petitboot is able to kexec FreeBSD on the PS3. So it might be doable on Power8, the issue is that a bootloader and initial ramdisk has to be written as it was for the PS3. In theory initrd for OSX would be the entire partition or at least an image with the kexts - as this is fundamentally different between FreeBSD/OSX on the one hand and Linux on the other hand
news.ycombinator.com
FreeBSD now supports the Playstation 3 | Hacker News
news.ycombinator.com
Great work, it would be amazing if you can pull this off, all the effort will pay off.Further on this, it seems that petitboot is able to kexec FreeBSD on the PS3. So it might be doable on Power8, the issue is that a bootloader and initial ramdisk has to be written as it was for the PS3. In theory initrd for OSX would be the entire partition or at least an image with the kexts - as this is fundamentally different between FreeBSD/OSX on the one hand and Linux on the other hand
FreeBSD now supports the Playstation 3 | Hacker News
OpenPOWER Foundation
openpowerfoundation.org
Power Progress Community - promotion and dissemination of Open Source Hardware and Software
promotion and dissemination of Open Source Hardware and Software
repo.powerprogress.org
Last edited:
Here is the link to the PowerPc version on OpenOCD for JTAG
Here is some information about the JTAG standard and reverse engineering
wrongbaud.github.io
Here is some information about the JTAG standard and reverse engineering
Hardware Debugging for Reverse Engineers Part 2: JTAG, SSDs and Firmware Extraction
A blog focusing on hardware and software reverse engineering
Here is the link to some older Powerpc devices and you can see the displayed JTAG Connections
JTAG Pinouts and Connectors for PowerPC - Etoolsmiths
This page contains details on PowerPC JTAG Connector Pinouts. These Pinouts can be used to interface a JTAG ICE or Boundary Scan test Device to your PowerPC board PowerPC 52XX, 74XX, 7XX, 82XX, 83XX, 85XX JTAG Pin Signal Name 1 1 TDO JTAG Test Data Out 2 2 Not Used (QACK -7XX only) 3 3 …
www.etoolsmiths.com
I have just come across a document that is specific to the IBM 970MP cpu
Here is the document for the IBM 970Fx CPU
extract confirms JTAG
3.10 I2C and JTAG The single external I2C interface connects to two I2C controllers, one for each processing unit. The controllers are distinguished by the low order address bit, which is 0 for Processing Unit 0 and 1 for Processing Unit 1. Similarly, the single external JTAG interface connects to two daisy chained JTAG controllers, one for each processing unit
This next paragraph explains how the CPU frequency is set
.2.1 Determining PLLMULT and BUS_CFG settings The first step is to determine the bus frequency. This parameter is a critical component of overall system performance. The bus should run as fast as your memory controller/bridge chip can support. Once you have determined your maximum bus frequency, you should select a bus multiplier ratio that will deliver the optimal processor core frequency. Note: The PLL_MULT and PLL_RANGE bits may be overwritten by JTAG commands and the BUS_CFG bits may be changed by SCOM commands during the POR (power on reset) sequence. These overrides disappear after every HRESET. Refer to the PowerPC 970MP Power On Reset Application Note for more details. The available bus ratios are shown in Table 5-1. In most applications this would be the highest frequency possible for a given PowerPC 970MP part number, but other considerations (i.e., available power) may take precedence
Here is the document for the IBM 970Fx CPU
extract confirms JTAG
3.10 I2C and JTAG The single external I2C interface connects to two I2C controllers, one for each processing unit. The controllers are distinguished by the low order address bit, which is 0 for Processing Unit 0 and 1 for Processing Unit 1. Similarly, the single external JTAG interface connects to two daisy chained JTAG controllers, one for each processing unit
This next paragraph explains how the CPU frequency is set
.2.1 Determining PLLMULT and BUS_CFG settings The first step is to determine the bus frequency. This parameter is a critical component of overall system performance. The bus should run as fast as your memory controller/bridge chip can support. Once you have determined your maximum bus frequency, you should select a bus multiplier ratio that will deliver the optimal processor core frequency. Note: The PLL_MULT and PLL_RANGE bits may be overwritten by JTAG commands and the BUS_CFG bits may be changed by SCOM commands during the POR (power on reset) sequence. These overrides disappear after every HRESET. Refer to the PowerPC 970MP Power On Reset Application Note for more details. The available bus ratios are shown in Table 5-1. In most applications this would be the highest frequency possible for a given PowerPC 970MP part number, but other considerations (i.e., available power) may take precedence
Last edited:
If we locate the memory controller and research its specifications, then we know what we are dealing with regarding how fast we can push the bus speed.
I read somewhere that Apple disabled the SCOM COMMANDS but can change this so that it becomes available. Is it disabled within the CPU itself or can we simply mod the circuit board to bypass the restriction.
Can SCOM be enabled through either serial communication or direct through JTAG?
I read somewhere that Apple disabled the SCOM COMMANDS but can change this so that it becomes available. Is it disabled within the CPU itself or can we simply mod the circuit board to bypass the restriction.
Can SCOM be enabled through either serial communication or direct through JTAG?
Last edited:
It is interesting that there are all these revisions of this datasheet. The ones that I came across, especially the version 1.0 is the same as your one.
I will sit an read through them and look for clues towards our cause.
7.2.5.1 Attention (ATTENTION)–Output ATTENTION is an output signal from the 970MP microprocessor to the JTAG debugger, used in debug mode. I2C SCOM commands are sent directly to PSCOM and do not go through the JTAG TAP engine. Therefore, when Attention is active, a SCOM read/write command will not be acknowledged with the standard I 2C acknowledgment (ACK) pulse because it is not a primitive test access port (TAP) command.1
Last edited:
7.2.1.3 Clock In (CLKIN/CLKIN)–Input The CLKIN signal originates in the companion chip and is sent synchronously with the data (ADIN and SRIN) for use in data capture at the receivers in the 970MP microprocessor. This clock is transmitted as a differential pair. Timing: The clock in signal is derived from the on-chip PLL on the companion chip and synchronized to the psync signal, which provides a periodic global reference event. During the initial alignment procedure (IAP) for the processor interface, a rising edge of the clock in signal is identified as corresponding to time zero. Every other rising edge thereafter is a time zero, delimiting the basic unit of time on the bus, in which four beats of data can be transferred
