Imac G3 DV CPU SWAP (just a few steps away)

indibil

6502
Good evening everyone!

I've been working on this for the past week. I know it's nothing groundbreaking, it's not the first time it's been done, but I'm going to document everything I've done and discovered, and in the end, I need your help to finish it.

I have an iMac G3 DV 400MHz, and I had a spare motherboard. Although they're hard to find, I was able to locate a G4 DA 533MHz processor.The original G3 processor is running at 2.05V, and the new processor, an XPC7410RX533PD, has a nominal Vcore of 2.0V, although it can run up to 2.1V.

It wouldn't have been necessary to reduce the voltage, but I decided to see how it could be done. I was discussing it with @herd; the integrated circuit responsible for managing the Vcore was the CS5158.

The voltage should be managed by Vid0-4, but it wasn't. I have a faulty 350 motherboard, and I've desoldered CS5158. None of the pads for Vid0-Vid3 are connected to anything, and Vid4 is connected directly to ground.

1774801877857.jpg

Vid0-3 were not connected to anything (logic 1 according to the datasheet) but Vid4 was connected to GND (logic 0), so the voltage should be 1.3V. So something must have been forcing the Vcore to rise to 2.05V, when @herd suggested to me that there might be a voltage divider in VFB.

On the 400MHz motherboard, R225 is in parallel with R89 connected to Vcore, and R88 to GND, creating a voltage divider on VFB. But if you look at the first picture of the 350MHz motherboard, R225 isn't there. So perhaps the 350MHz motherboard has a different voltage, but I can't measure it; it's faulty.

R225.png
R88_R89.png

I kept R225 (660 ohm) and changed R89 from 4.9kΩ to 2.2kΩ, and the Vcore dropped to 1.95V. Although I finally opted for 2.7kΩ and got 2V.

IMG_20260330_105123.jpg

I forgot to take a picture with the new CPU, but after adjusting the voltage, I swapped the G3 processor for the XPC7410 and also changed the two cache chips from the iMac (2x 256kB) for those from the G4 533 (2x 512kB).

And I adjusted the speed to 600MHz. I couldn't get it past the "chime" at 650MHz, maybe with more Vcore, but for now it's fine as is. If you look at the photo, on the left in C115, I'm keeping the original R89.

1774956454011.jpg

1774956453987.jpg

At this point, as you'll see in the photos, there are two setbacks. The first is that it only recognizes 512kB of L2 cache, due to the firmware configuration, and the second is that the ratio is also fixed at 2.5:1 (5:2), meaning we're not using the maximum speed of the cache chips (275MHz chips capable of running at 300MHz).

First, I needed to verify that the 1MB of cache was available and also that the speed was capable of running at 300MHz. For the speed, in CPU Director, under OS9, I was able to configure the ratio to 2:1, and it works perfectly.

1775031952050.jpg

1774956453958.jpg


1774956453929.jpg

To verify that the 1MB was available (there was a possibility that Apple had not routed the necessary tracks to be recognized) I had to use some temporary "tricks" that a colleague told me about, under OS X Tiger.

1775062896096.jpg

Everything seems to be working correctly. Here comes the difficult part, and where I'm stuck. I admit my limitations; I can manage by swapping chips, but working with and manipulating OpenFirmware isn't my strong suit. I've always used third-party patchers, but there isn't one for this iMac that can set a 2:1 ratio in the firmware and also change the cache size from 512kB to 1MB.

Following @joevt 's instructions (from this), I was able to download the complete iMac firmware, which I've attached along with the PDF that explains how to configure the CPU parameters, which I also find difficult to decipher. I had done this with the small EEPROMs that accompany the PM G4 processors; there I was able to locate the ratio and size configuration, but this file is very large and I don't even know where to start.

Perhaps this point is the ratio? Would the red circle represent the ratio? But if it were, I can't locate which parameter is the cache size.

iMacConfig.png

I've been told that I could modify the iMac's Firmware Updater to make these changes, but I need help. First, I need to locate the values I need to change, then correct the checksum (I've only done this with Sega Megadrive ROMs using a specific tool; I don't even know how to calculate it), and finally, modify the Firmware Updater to run it.

I know it could go wrong, but as a last resort, I have a TL866 and this adapter.

1775036363199.jpg
1775036363162.jpg

Before I finish, I want to give a HUGE thank you to @herd and @joevt for their help and patience in guiding this project, which I hope can help many people make this modification.
 

Attachments

Perhaps this point is the ratio? Would the red circle represent the ratio? But if it were, I can't locate which parameter is the cache size.
Yes, that's the ratio. The document you posted makes this pretty clear. My suggestion would be to convert that document into a utility (a bash or perl script or Hex Fiend.app template) that parses the config block in order to understand your config block.

The config block starts at 0x3F00, as you've hilited, in the ROM dump.
"Table 1. Sys-Config (Boot ROM System Configuration )" in the "Boot Flash System Configuration Block Version 2.5.15" document says "Processor Info (Table 5)" begins at offset 0x24.
"Table 5. Processor Info" says "Level 2 Cache Section" starts at offset 0x1C.
0x3F00 + 0x24 + 0x1C = 0x3F40

The bytes you have at that location say the following:
0x3F40: # of L2s : 0x01 ; (what would two L2 caches mean?)
0x3F41: Size of L2 : 0x13 ; 19 decimal; 2^19 = 512K
0x3F42: L2 Bus Width : 0x06: 2^6 = 64 bit.
0x3F43: L2/Processor Ratio : 0x52 = 5:2 according to Table 5.2.
0x3F44: L2 Mode : 0x01 = no parity, not write thru, 0.5 ns L2 Output Hold, Pipelined Burst
0x3F45..0x3F47 : Reserved : 0xFF 0xFF 0xFF

I've attached dumps from your iMac ROM dump.

The first 0x80 bytes (0x3F00..0x3F7F) of the Config Block in your ROM matches another iMac (PowerMac2,1) with the same firmware version. All such iMacs should have the same first 0x80 bytes. The second 0x80 bytes (0x3F80..0x3FFF) contains info specific to your iMac. Other differences exist in NVRAM. Everything else is the same.

Your iMac has firmware 4.1.9f1. You posted info extracted from the 4.1.9f1 firmware updater. A firmware updater includes Config Blocks for many Macs. The Config Block for your model is dumped in the "configblock 0x0081.00 Kihei.txt" file. Therefore, we just need to change the bytes in the config block in the firmware updater. What bytes do you want to change? The size and ratio? I've attach a firmware updater with the changes. Put the firmware updater on a disk and load the firmware updater in Open Firmware (after booting the Mac into programmer mode).

It may help to boot into Open Firmware and do setenv auto-boot? false so that it automatically boots into Open Firmware. Then you can boot the Mac into programmer mode and get into Open Firmware more easily. While you're there, connect using telnet from another Mac or PC and capture the output of dump-device-tree before applying the firmware update.

Download the 4.1.9 firmware updater and follow the instructions to get into Programmer mode (but don't run that installer).
https://forums.macrumors.com/threads/powerpc-mac-firmware-boot-rom-updates.2285855/

After the firmware is applied and you restart, capture dump-device-tree again so we can compare.

Use the dir command in Open Firmware to find the patched firmware updater file (it may be easier to remove spaces from the firmware updater file name). You should know the partition number (in decimal). Use diskutil in Mac OS X to find that.
 

Attachments

Okay, that's very helpful. Thank you.

You're able to understand all this with great ease; I can barely grasp it. I'm rereading it; I admire you.

Just a quick note: this part: 0x3F40: # of L2s : 0x01 ; (what would two L2 caches mean?) -> could it indicate that there are two L2 cache chips? I can't think of anything else.

I understand that the file "ROM 4.1.9f1 iMac G3 (Slot loading) Firmware Update patched.zip" includes the modified update you performed, is that correct? Thank you for changing the ratio to 2:1 and enabling 1MB.

I've only run patchers the "normal" way: run the patcher in OS9 or OSX, restart by pressing the "program" button, and once you hear the beeps, release the button and wait for it to complete. :)

In this case, I understand that I need to run commands in Open Firmware. Is that correct?

Regarding connecting with Telnet, I tried it once but couldn't get it to work. Is there a thread that explains it simply?

Imagen 1.png

Imagen 2.png


Imagen 3.png
 
Back
Top