- Joined
- Nov 10, 2003
- Location
- the steppes
2500+ unlocking effort, post results and possible solutions
please keep this thread clear for unlocking ideas, results, and progress. the "last week 2500+ unlocked" thread is up to 15+ pages, and is getting unwieldy. hats off to all who've gotten their hands dirty so far.
chip=die=silicon square in center of processor
package=printed circuit board with pins the chip is mounted upon
bridges (L1,L2,...L12)=conductors which by their presence or absense (blown) determine a finished processors speed, cache, working voltage, etc.
so.... regarding multi select and cache select blown bridges:
its far more likely that the package was changed, since a change to the chip means new mask sets, different metalization steps, etc, in short, huge process changes.
changing the packaging (essentially a very fine pitch multi layer printed circuit board) is much easier to do.
the chips are tested before packaging for known good die, and perhaps for performance. a fixed multi on die would mean different mask sets for each clock speed, which is just not done.
there is a very remote possibility that the bridges to be blown are on the die, but that would mean they've been there unused since moving to .13um process or the last die circuit update in the .13um process. if this is the case, it would be on one of the die interconnet layers, of which there are 7 or 8 (memory fails me) for this chip.
the reason it is very unlikely that the blow bridges are on the die is that the interconnect layers use copper wiring with an isolation layer to prevent the copper from migrating (dual damascene process). copper will migrate into silicon and pollute it, causing the chip to fail. if the bridges were in this copper layer, blowing them would allow uncontrolled migration of copper. so it really can't be done this way.
the most likely scenario IMHO was suggested earlier, which is using formerly NC pins to blow an internal PCB (package, not die) bridge electrically. this is done with many chips and packages, such as (for chips) programmable read only memory (PROM), asics (application specific ic's), etc.
x-ray might work, but you're resolving feature as small as .2mm (200um) on that pcb, and with all the layers, it will look like a plate of spagetti.
i think hoot made what is probably the only workable suggestion earlier. would need 2 pcb modules with cores removed. each pcb would need to be sanded layer by layer. as each layer is uncovered, take a high resolution close up picture. compare each layer from each pcb by doing a photoedit boolean subtract. the difference will pop right out if the layers being compared are registered very well.
the folks looking at pin electrical characteristics have a problem with numbers of possible combinations. if there are 10 NC pins, they may have to be checked against Vss, Vdd and perhaps active pins. unless i'm wrong, this could be hundreds of resistance checks. not my cup of tea.
but, if and when differences are found on layers, that's the time to follow up with the DMM.
edit:
this circuit describes the concept well, if only in one possible implementation.
The original idea for this comes from darkman101010; this link is to the original picture. Thanks darkman.
http://www.overclockers.at/attachment.php?attachmentid=40885
Link to the original thread of darkman101010's post, in german:
http://www.overclockers.at/showthread.php?s=&threadid=97670&perpage=15&pagenumber=5
UnLoadeD has provided the hosting below, which seems to be faster.
cheers,
phaed
please keep this thread clear for unlocking ideas, results, and progress. the "last week 2500+ unlocked" thread is up to 15+ pages, and is getting unwieldy. hats off to all who've gotten their hands dirty so far.
chip=die=silicon square in center of processor
package=printed circuit board with pins the chip is mounted upon
bridges (L1,L2,...L12)=conductors which by their presence or absense (blown) determine a finished processors speed, cache, working voltage, etc.
so.... regarding multi select and cache select blown bridges:
its far more likely that the package was changed, since a change to the chip means new mask sets, different metalization steps, etc, in short, huge process changes.
changing the packaging (essentially a very fine pitch multi layer printed circuit board) is much easier to do.
the chips are tested before packaging for known good die, and perhaps for performance. a fixed multi on die would mean different mask sets for each clock speed, which is just not done.
there is a very remote possibility that the bridges to be blown are on the die, but that would mean they've been there unused since moving to .13um process or the last die circuit update in the .13um process. if this is the case, it would be on one of the die interconnet layers, of which there are 7 or 8 (memory fails me) for this chip.
the reason it is very unlikely that the blow bridges are on the die is that the interconnect layers use copper wiring with an isolation layer to prevent the copper from migrating (dual damascene process). copper will migrate into silicon and pollute it, causing the chip to fail. if the bridges were in this copper layer, blowing them would allow uncontrolled migration of copper. so it really can't be done this way.
the most likely scenario IMHO was suggested earlier, which is using formerly NC pins to blow an internal PCB (package, not die) bridge electrically. this is done with many chips and packages, such as (for chips) programmable read only memory (PROM), asics (application specific ic's), etc.
x-ray might work, but you're resolving feature as small as .2mm (200um) on that pcb, and with all the layers, it will look like a plate of spagetti.
i think hoot made what is probably the only workable suggestion earlier. would need 2 pcb modules with cores removed. each pcb would need to be sanded layer by layer. as each layer is uncovered, take a high resolution close up picture. compare each layer from each pcb by doing a photoedit boolean subtract. the difference will pop right out if the layers being compared are registered very well.
the folks looking at pin electrical characteristics have a problem with numbers of possible combinations. if there are 10 NC pins, they may have to be checked against Vss, Vdd and perhaps active pins. unless i'm wrong, this could be hundreds of resistance checks. not my cup of tea.
but, if and when differences are found on layers, that's the time to follow up with the DMM.
edit:
this circuit describes the concept well, if only in one possible implementation.
The original idea for this comes from darkman101010; this link is to the original picture. Thanks darkman.
http://www.overclockers.at/attachment.php?attachmentid=40885
Link to the original thread of darkman101010's post, in german:
http://www.overclockers.at/showthread.php?s=&threadid=97670&perpage=15&pagenumber=5
UnLoadeD has provided the hosting below, which seems to be faster.
cheers,
phaed
Last edited:
