Sonnet G4 1.2 GHz Upgrade overclocking: Trying to crack the CPLD

[EmilioCube]

I recently got my hands on a very cheap 1.2 GHz Sonnet upgrade and as the chip on it is a RX1250PF I guess I can easily overclock it to 1.4GHz.
Also laying around is a non-working 1 GHz upgrade also from Sonnet and so I used that to compare resistors.
This is what I found out, differences are as following:

R20 and R33, closed on 1.2GHz but open on 1GHz
R28, open on 1.2 and bridged with "5R1" on 1GHz

R11-R15 (99% sure these are the PLLs): 01000 on the 1 GHz board, 10101 on 1.2 one.
Both are 100mhz bus ones as they work in my Cube, but what makes me wonder is that the data sheet says something entirely different for the 10x and 12x configs: 10101 for 10x and 10111 for 12x.

So is there anyone knowing more about Sonnets PLL configs and how I need to resolder them to change the clock speed?
Thanks in advance!

 

[LightBulbFun]

So is there anyone knowing more about Sonnets PLL configs and how I need to resolder them to change the clock speed?
Thanks in advance!

Sonnet CPU's like that have their PLL multiplier controlled usually by some sort of CPLD or the such like,

there might well be separate resistor straps that tell the CPLD what speed the CPU is and thus what multipliers to set the CPU too, but there wont be direct PLL resistors on the board im afraid

this is because sonnet wanted their CPU's to be completely plug and play/"smart" and work in both 100Mhz and 133Mhz bus speed systems without the need to change any jumpers etc, so they use a CPLD or such to set the multipliers on the fly

in theory if you wanted to brute force it, you could de-solder the CPU and beep out where all 5 CPU PLL's (PLL0 PLL1 PLL2 PLL3 PLL4) go from their respective pads on the Ball grid array, onto the PCB and then remove resistors/cut the traces to isolate them and install your own PLL pull up/pull down resistors but this is fairly involved and again quite brute force

 

[Needleroozer]

I recently got my hands on a very cheap 1.2 GHz Sonnet upgrade and as the chip on it is a RX1250PF I guess I can easily overclock it to 1.4GHz.
Also laying around is a non-working 1 GHz upgrade also from Sonnet and so I used that to compare resistors.
This is what I found out, differences are as following:

R20 and R33, closed on 1.2GHz but open on 1GHz
R28, open on 1.2 and bridged with "5R1" on 1GHz

R11-R15 (99% sure these are the PLLs): 01000 on the 1 GHz board, 10101 on 1.2 one.
Both are 100mhz bus ones as they work in my Cube, but what makes me wonder is that the data sheet says something entirely different for the 10x and 12x configs: 10101 for 10x and 10111 for 12x.

So is there anyone knowing more about Sonnets PLL configs and how I need to resolder them to change the clock speed?
Thanks in advance!

View attachment 2405486



View attachment 2405487

If you look up the numbers on top of the chips, you’ll find that U3 is an SC1182B switching regulator and has five VID pins (upper right side, pins 18 to 22) to configure its output voltage, which is what I suspect R10-14 do. You can probe this out with a multimeter to confirm that, luckily without needing to desolder anything.
See page 6 of the datasheet for a table of output voltages.

https://static5.arrow.com/pdfs/quickdata/sem/sc1182b.pdf

The Xilinx IC, U5, is indeed a CPLD like @LightBulbFun hypothesized. I don’t see any PCB traces running from the R20,R21,R33,R34,R35,R40 complex to the CPLD, but it’s entirely possible they run on an inner layer. You could determine whether they connect to the CPLD or not using a multimeter as well.

 

[EmilioCube]

this is because sonnet wanted their CPU's to be completely plug and play/"smart" and work in both 100Mhz and 133Mhz bus speed systems without the need to change any jumpers etc

Aah, thats how they achieved that, thanks. I always wondered how Sonnet managed that and Apple modules always have to be modified.

de-solder the CPU and install your own PLL pull up/pull down resistors

ez


just kidding I guess I will never be skilled enough for that

You could determine whether they connect to the CPLD or not using a multimeter as well.

I knew "thanks in advance" was right. Ill give it a try.

 

[lolof]

I would say J3 is the jtag for the cpld.
Maybe it can be read and be modified.
I don’t know if this could help to adjust the frequency…. If I had a card not in a cube, I would give it a try to dump the Xilinx….
That’s easy to do if it’s not read protected.
Than it could be maybe possible to let think the sonnet card (with a modified code in the cold) that the bus is a 133mhz one and have the cpu running 33% faster ?
Though, no idea if the cpu would be stable at 1.6…..

 

[EmilioCube]

Definitely not. Not even the average 1.42GHz 7455 chip that was an Apple exclusive ran stable at more than 1.5GHz.
What I want to modify are

R11-R15 (99% sure these are the PLLs): 01000 on the 1 GHz board, 10101 on 1.2 one.

Its probably safe to say that if I set the resistors fom the 1.2GHz board to the 1GHz board setting it would also run at 1GHz. I am just too stupid to find a data sheet to determine which PLL config I need for 1.3 or 1.4GHz. Maybe someone else finds one.

 

[EmilioCube]

Thats all what I found but that Data sheet dies not say anything about frequencies... https://www.datasheetspdf.com/datasheet-pdf/1088460/XC9536XL.html
XILINX XC9536XV VQ44A is what Im looking for.

 

[EmilioCube]

Better idea... what about finding a hi-res picture of the 1.4GHz version of Sonnets upgrades and just use that to find out the resistor layout for 1.4GHz?
This is the best picture I could find (from Newegg):

The photo barely allowed me to find out that Sonnet used the same XILINX XC9536XV VQ44A.
There are no R11-R15 to find, but R15-R19 (at the same position where R11-R15 were on the two lower-end upgrades) which are 00101.


I just found another 1.4GHz upgrade with a different PCB layout: In a video of Daves Vintage Apple Tech I managed to shot this capture. As the board layout looks more similar to the one of the 1.2GHz upgrade so I think this resistor layout (also R11-R15, 10011 instead of 10101) is more trustworthy to try:

To sum that up, I believe it is possible to either
close R11 to go from 10101 to 00101 (Neweggs layout, not so trustworthy) or to
swap the 0 Ohm resistor from R14 to R13 to go from 10101 to 10011 (more trustworthy)
to overclock the card to 1.4GHz.

Am I talking nonsense here? I would love to try that out but dont want to do something very stupid by shredding this expensive upgrade.

 

[ervus]

I would give it a try to dump the Xilinx….
That’s easy to do if it’s not read protected.

If this is something you could do, it would definitely be useful. I doubt there are very many people with the skills and equipment to do it. Reading the program on that chip could tell us all the possible settings. My approach would be to remove that chip and throw it away, then control the settings myself...

 

[EmilioCube]

So I guess I wait for @lolof s results?

 

[lolof]

If it’s not protected, it’s just a matter of powering the cpu card somehow and connect the jtag correctly. The jtag pins order can be found with a multimeter and the Xilinx datasheet.
Read the chip with impact software using something like this device.

Waveshare XILINX JTAG Download Debugger Compatible XILINX Platform Cable USB FPGA CPLD in-Circuit Debugger Programmer

Waveshare XILINX JTAG Download Debugger Compatible XILINX Platform Cable USB FPGA CPLD in-Circuit Debugger Programmer

amzn.eu

I could have tried to do it but I just finished to put my cube all together…. The next time I will take it apart, I will if nobody did it.
But then, you have to find someone who can do something with that. It’s the hardest part….

 

[EmilioCube]

Or just try

swap the 0 Ohm resistor from R14 to R13 to go from 10101 to 10011 to overclock the card to 1.4GHz

? Or is the risk of damaging something too high?