I finally cracked how the PSP-1000 controls its voltage rails — it goes through
the **Pommel*\*, a DC-DC converter chip sitting behind the syscon. This is the
mechanism behind the overvoltage control in PSPFatSave v981.

**⚠️ This is a hardware-damage warning, not a joke.*\* You can permanently damage
your PSP with this. Only try it on a unit you can afford to lose, back up the
Memory Stick first, and if anything seems wrong hit the Rail Defaults restore.

## How the voltage actually works

The PSP's core (Allegrex), DDR, and several other supply rails aren't set by the
main CPU directly — they're programmed through the **syscon*\, a small serial
microcontroller, which drives the ***Pommel**** DC-DC controller. So the chain is:

```
CPU -> syscon (serial) -> Pommel (DC-DC) -> actual rail voltage
```

There's no datasheet for the Pommel (MB44C001), so this was all worked out from
the firmware and measured on hardware.

## What I found

- **Rail selectors.*\* `sceSysconCtrlVoltage(selector, code)` addresses one rail at
  a time. On a TA-081 Phat: selector 1 = Tachyon core, selector 3 = DDR, and
  selectors 2/4/5/7 are **unidentified*\* rails. Each maps to a Pommel register as
  `reg = 0x0F + selector`.
- **The codes.*\* Voltage codes are `level << 8` (step 0x100; the hardware ignores
  the low byte). For the core rail, **smaller code = more volts*\.
- ***Factory binning.**** Stock voltage isn't fixed — it's read from a fuse register
  (`0xBC100098`), and Sony bins each chip. Some units have zero headroom above
  stock; the stock code is already 0x000.
- **The Pommel never forgets.*\* This is the sneaky part: the Pommel **keeps its
  register values across a warm reboot AND a syscon hard reset**. Only pulling the
  battery and AC clears it. The core rail hides this because the IPL reprograms it
  from the fuse every boot — but DDR and the unknown rails don't get reprogrammed,
  so whatever you last wrote is still live on the next boot. That's why an
  overvolt that "should" be gone can silently come back.

## The actual overvolt

`sceSysconCtrlVoltage(1, code)` on the Tachyon core, stepping the code below stock,
raises core voltage. Combined with the existing raw-PLL overclock this is what lets
a Phat push past 333 MHz more stably than stock voltage alone.

## Where it lives

This is all built into **PSPFatSave v981*\* — the Overclock page now has Tachyon /
DDR / unknown-rail voltage control, plus a **Rail Defaults*\* one-press restore that
puts every rail back to safe values (core to fuse stock, the rest to the console's
measured power-on reference).

GitHub Source
Release

*Everything rail-specific here is measured on a single unit (TA-081v5). Re-verify on
your board before trusting any mapping. Voltage control is NOT recommended for normal
use — it exists for tinkering, and it can damage hardware.*

Code generated 100% with AI. If you can't stand AI, please try to ignore it and don't use my work.

I checked AliExpress and didn’t found anything with good amount of reviews, and on Amazon there’s only ones with bad reviews. Maybe some of you have links? (I live in Germany)

Ps. If you recently ordered shells in other colors and they turn out to be good, leave a comment too pls

I'm looking for a reputable & reliable guide so that I can install CFW on my PSP 3000.

Does anyone have a link to one? Not sure what everyone is using.