PLL Pinmod Overclocking Methods and Examples

WARNING: The information on this thread is for educational purposes and following any instructions may void your warranty and also cause major damage to your notebook.
If you don't know how to monitor system temperature and what the tjmax of your CPU is then please skip this.

How overclock a notebook with a TME-locked PLL or some other blockade

Successful PLL pinmods using ideas from this post is summarized below

OC details linkPLLPinmod type^1Normal SpeedOC SpeedCalpellaMSI GX740ICS9LPRS113AKLFFSLxi5-430M-2.26@1333.40@200MontevinaGateway p7805uICS9LPRS365BGLFTME-unlockP8400-2.4@2663.61@400Quanta TW8 SLG8SP513VFSLxT4500-2.3@2003.06@266HP 6730PICS9LPRS397DKLFTME-unlockP8600-2.4@2663.06@333HP 8530W^3SLG8SP533VTME-unlockP8600-2.4@2663.06@333HP CQ45 & SLG8SP553VFSLxP8400-2.26@2662.82@333Acer 1810TSLG8SP513VFSLx+BSEL & TME-unlockSU4100-1.3@2001.73@266Acer 1810T & & &ICS9LPRS365FSLx+BSEL & TME-unlockSU3500-1.4@2001.70@242Santa RosaClevo M570RU^5 &ICS9LPR365DGLFFSLxX9000-2.8@2003.74@266Dell XPS M1330 &SLG8LP550VFSLxT9300-2.5@2003.59@266HP 8710/6910/6710/6510^3ICS9LPRS355BGLFFSLx & TME-unlock200Mhz PLL266Mhz PLLDell XPS M1730^3CY28547 FSLx200Mhz PLL266Mhz PLLHP Pavilion dv9700t RTM875T-606TME-unlockT9300-2.5@2003.13@250Quanta TW7 ICS9LPRS365BGLFFSLxT8100-2.1@2002.80@266Fujitsu U9200 ICS9LPRS365BGLFFSLxT8100-2.1@2002.80@266Toshiba Tecra A9ICS9LPR501SGLTME-unlockT7300-2.0@2002.72@272Dell XPS M1330SLG8LP550VFSLxT7300-2.0@2002.66@266Acer Aspire 8920g RTM875T-606TME-unlockT8300-2.4@2002.60@217Dell Inspiron 1525 &ICS9LPRS365BKLTME-unlockT7250-2.0@2002.50@250Dell D630 SLG8LP550FSLxT7100-1.8@2002.40@266HP Pavilion DV6871us &RTM875T-606TME-unlockT5600-1.83@1662.20@200HP Pavilion DV2000^3ICS954305EKLFFSLxT2050-1.6@1332.00@166Acer Aspire 5920g ICS9LPRS365BGLFTME-unlockT5250-1.5@1661.61@179HP 2510P &^2^4ICS9LPRS355BGLFFSLxU7600-1.33@1331.60@160HP 2710P^3 ICS9LPRS355BKLFSLx & TME-unlockU7600-1.2@1331.50@166
^1 FSLx or FSLx+BSEL mod means a large overclocking jump eg: 166/200/266/333/400 FSB.
TME-unlocked PLLs means can use 0.3Mhz increments up to the point of instability via setfsb software overclocking.
^2 not necessary other than for convenience.
Could have just used setfsb overclocking.

^3 theory requires implementation.
^4 running DualIDA capable bios and cpu gaining an extra half or full multiplier.
Appears all recent Dell systems can do dualIDA.
^5 Throttlestop can unlock multipliers in the Core 2 Extreme CPUs making PLL overclock unnecessary.

This thread will help people extract peak performance from their notebook by showing:

- how to check if your PLL is TME-locked, indicating setfsb OC won't work
- method 1: TME-unlock a PLL via a pinmod so setfsb/grub2-setfsb can program the PLL
- method 2 and 3: FSLx or FSLx+BSEL overclocking via PLL pinmod for a faster FSB.Before attempting any of these PLL overclock methods it might be worthwhile seeing if you can BSEL pinmod the CPU.
Naton explains [click pic on right for visual understanding] The 200 -> 266 consists on connecting the two holes A23 and B23 on the CPU socket with a copper wire, or B23 and B24 with a copper wire.
I haven't tried this myself.
If it works likely to lock your multiplier at lowest setting for all CPUs on Intel chipsets, except ULV and Celerons.
AMD/NVidia chipsets allowing overclocking without multiplier lockout.
1.
Where can I get a schematic of my systemboard to identify my PLL and help if I need to pinmod? Try laptopdesktopschematic, lqv77, GSM-extreme, notebookschematic and a general google search.

2.
How do I check TME_READBACK to see if I can overclock my PLL with software? using setfsb (Windows)
Spoiler :



Right: the status of TME_READBACK tells us if TME is enabled.
Screenshot shows it's status on register 9 bit 6, shown as 65h=1100101(binary) bit 6=1, meaning no overclocking.
In the next screenshot it is shown how to write a 0 to the PCI2 Output Enable register.
If your system freezes after doing this then it uses the PCI2 signal for it's operation and it's not possible to pinmod the TME/PCI2 pin to remove the hardwired TME_Enabled mode, so continue to method 2.
If the system works after the write, then refer to method 1 below.


Both the ICS9LPRS355 and ICS9LPR501SGLF PLLs read TME_READBACK in this way, so it's highly likely other ICS PLLs do too.



using R-W Everything (Windows)
Spoiler :



1.
Run r-w everything
2.
Select Access-Clock Generator
3.
Change byte 0C from 0D(13) to 16(22), click write close Clock Generator window
4.
Select Access->Clock Geneator.
It will open same window as before but present 22bytes of data rather than 13.


using lmsensors (Linux)
Spoiler :



Setfsb's Diagnosis window requires a PLL to use for it's operation.
Since newer PLLs aren't being added, we need an alternative way of checking the TME_READBACK flag using Linux.

1.
Install lmsensors package.
Available for various Linux flavors on the repositories.

2.
Some distributions blacklist the i2c-dev or i2c-i801 module.
Check your /etc/modules and uncomment if blacklisted

3.
Check that your bios has enabled the SMBUS device:

Code:
$ lspci | grep -i smbus
00:1f.3 SMBus: Intel Corporation 82801H (ICH8 Family) SMBus Controller (rev 03)
If not, need to switch on the bits to enable it as explained here.

4.
Load i2c modules

Code:
$ modprobe i2c-dev
$ modprobe i2c-i801
$ ls /dev/i2c*
/dev/i2c-0
5.
Scan to identify devices on i2c bus.
ICS PLL appears as device 0x69


Code:
$ i2cdetect -y 0
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- 08 -- -- -- 0c -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- 1d -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: 30 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- 44 -- -- -- -- -- -- -- 4c -- -- --
50: 50 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- 61 -- -- 64 -- -- -- -- 69 -- -- -- -- -- --
70: -- -- -- -- -- -- -- --
6.
Dump the PLL data


Code:
$ i2cdump -y 0 0x69 s 0
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: 31 85 fc 33 ff f0 90 11 d0 65 7d 00 0d 1??3.????e}.?

$ i2cdump -y 0 0x69 s 0xd
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: cf 44 ef 2f a0 8f f2 23 00 ce 61 53 d8 ?D?/???#.?aS?
7.
Check the TME_Readback flag to see if TME is enabled (no software overclocking)

For ICS PLLs:
- look at first dump, register 9, bit 6
- if bit6=1 then it's TME-locked (no overclocking)

For CYxxx PLLS
- look at first dump, register 15, bit 7
- If bit7=1 then it's TME-locked (no overclocking)


3.
Is there any software method to bypass TME mode without using a pinmod?
Spoiler :



setfsb's author Abo has successfully overcome the 2510P's ics9LPRS355 PLL TME mode via software configuration only.
As far as I know this is the only PLL he has done this for.
I was able to visually compare PLL registers before and after the overclock, referring to the ics9lprs355 datasheet to see what was done.


We see that he swaps the main clock from PLL1 to PLL3, and the sata clock to PLL2 below.
Can perform these steps or some variation of them to see if can overcome TME mode on the other PLLs are well.

Right: 2510P PLL registers before/after setfsb applies TME workaround (OD, OE sets FSB)
Step 1: set TME workaround0h(0): 31->37
Sets source for SRC Main from PLL1 -> PLL3
Sets sata clock from SRC_Main to PLL211h(17): A0->A4
VCO Frequency Control Register PLL3.
M Div (5:0)12h(18): 8F->F6
VCO Frequency Control Register PLL3 N Div (9:0)15h(21): 00->01
M/N EnableStep 2: Set byte 0D and OE manually for your desired FSB
Spoiler :



{ FSB, Byte 0D, Byte OE}
{ 112, 0x88, 0x71},
{ 117, 0x88, 0x87}
{ 125, 0x88, 0xA3}
{ 133, 0x88, 0xBF}
{ 142, 0x88, 0xDB}
{ 150, 0x88, 0xF7}
{ 158, 0x48, 0x13}
{ 167, 0x48, 0x2F}
{ 175, 0x48, 0x4B}
{ 183, 0x48, 0x67}
{ 190, 0x48, 0x7D}
{ 195, 0x48, 0x8E}
{ 200, 0x48, 0x9E}


NOTE: one undersirable behaviour that the ics9lprs355 PLL shows is that when the system is put into standby/hibernate, it resumes in a state where the PLL won't respond to setfsb requests.
It requires another quick standby to unfreeze it upon which it can respond to software overclocking requests.


4.
What methods can I use to overclock my PLL?Intro
Spoiler :



The PLL's FSLx and the CPU's BSELx pins are tied.
Method 2 is in effect a BSEL mod via the PLL's FSLx pins.
Method 3 separates the PLL's FSLx signals and the CPU's BSEL signals to provide faster operation, a necessary workaround to prevent the CPU going into lowest multipler lockout when it's in an invalid (faster) BSEL setting.

Software used for overclocking a PLL: setfsb for Windows.
grub2 bootloader overclocking for OS-independent overclocking.
Only provision is would need Linux, prefereably Ubuntu 9.10 or newer, installed to be able to compile and use it.

PLL pins of interest: blue: method 1 | red: method 2/3.
From ICS9LPR501SGLF PLL datasheet


RAM timing: how it affects overclocking potential
Spoiler :



Overclocking methods 1 and 3 below boot your system and set your northbridge, chipset and CPU internally to *believe* they will be receiving 200Mhz timings.
They just are being sent faster signals from the PLL instead (266Mhz in method 3's case!!).
This could present a problem with your RAM.
DDR2-667 RAM will now be receiving timing signals for 266Mhz/887Mhz operation, yet still be using the SPD table for 667Mhz operation.
In which case, I hope you've got good ram to test, or can use Thaiphoon Burner or SPDTool to slow down *at least* the CAS timing in your RAM's eeprom SPD table by increasing it's value.
I believe it's CA