2500+ unlocking effort, strictly directions

[v8vega350]

just had a thought what if all the pins that controled the multiplier slection were gone and you wired the multiplier you self on the socket anybody tried this yet

going to go try this on a old pali core unless someone tells me not to

 

[hitechjb1]

emboss,

I suppose you have a locked 2500+ and a digital multimeter. Have you looked at my post about possibility of locating a hidden control pin(s) within the NC, VSS and VCC pin group. What do you think? I'd like to close that end either positively or negatively.

Even if the multiplier bit information is stored somewhere statically within CPU or package, and such alternation is blocked from the top level L1/L3 and BP_FID into the internal multiplier circuit, if the backdoor hidden pin(s) exist, it may regain access to multiplier change. But firstly and remotely, we have to see whether there are some STRANGE pins that fall into the resistance characteristic that I suggested in an earlier post.

 

[PDL]

I'd have to agree that the answer is most likely some other pins with NC markings. With the difficulty and expense involved in retooling the PCB, I really doubt AMD would have went that way. But that's just a SWAG.

Anyway, I was looking over the pin layout and there are a number of places, many in fact, that could hold the possible elusive pins. There are a lot of NC pins on that processor. Makes me wonder why they use so many.
But, because there are so many unused it reinforces the idea of there being different pins being used.
Question: Has anyone looked at the old FID[0-3] pins that were used on the old Durons and TBirds? There is a NC pin there that could complete the set. Just a thought. Seems a company strapped for money and market share may try to use whatever is available rather than rework the whole thing!

 

[emboss]

When I've got some time (and some light ) I'll have a bit of a poke around at the NC (then GND, then VCC) pins to se if anything unexpected shows up.

Because of the "fade-in" of the locking of the CPUs, I suspect the capability to lock was always built into the CPUs with the laminated layer (be it brown or green). If it's a die-lock, then I suspect that it's been around since the initial release of the Barton.

 

[hitechjb1]

There are less than 500 pins. If one has a locked CPU and a DMM, then ...

1. Print out the AMD tech doc Page 55, the bottom pin layout. Linkk is posted in the earlier post.

2. Just hook up a probe of the DMM to the VSS pin.

3. Measure the resistance of each pin of the CPU with respect to VSS. Have to measure ALL THE PINS carefully, jumping around would not work, may miss some.

4. Best way to do it is having a helper (a little brother or sister) to write down the resistance number on that pin layout, while the other person measure the resistance, GOING FROM ONE PIN TO THE NEXT ONE.

4. I estimate if each pin can be measured in 4 sec, it would only take about half an hour to measure all the pins.

5. After that, we can discuss whether there are some potential hidden pins in the NC group, VCC group, VSS group.

The hidden pin is a necessary condition and chance to reactivate the multiplier. It is a remote chance and not a sufficient condition, but necessary.

Whether agreeing about the existence of the hidden pin(s) or not is not the issue. It just HAS TO BE DONE to close this "hidden" pin case, either positive or negative. I don't have such CPU, otherwise I would have done it.

The details about this procedure is described in an earlier post.

 

[PDL]

It just seems strange that they would pick now to lock them. I remember when there were a lot of the TBirds being repackaged but I was not aware of such a serious problem with these Bartons. Maybe I missed that. It also doesn't wash that they would spend much time=money on the problem because the ROI of such a change would not be good.

Also, wouldn't it be best to check the L1 dot(either side if they show to be electricaly connected) against the NC pins to look for a near 0 ohm connection. I know it would not be the easiest to do but wouldn't it give a better indication?

 

[hitechjb1]

It just seems strange that they would pick now to lock them. I remember when there were a lot of the TBirds being repackaged but I was not aware of such a serious problem with these Bartons. Maybe I missed that. It also doesn't wash that they would spend much time=money on the problem because the ROI of such a change would not be good.

Also, wouldn't it be best to check the L1 dot(either side if they show to be electricaly connected) against the NC pins to look for a near 0 ohm connection. I know it would not be the easiest to do but wouldn't it give a better indication?

Tests have been done by deathstar13 and Hoot on locked CPU to show that the five BP_FID pins (CPU pins) are still directly connecting to the corresponding five L1 pins, which in turn also is connected to one end of the corresponding L3 pins.

The BP_FID pins are for wire trick, bios multiplier setting by motherboard. Tests shown by Hoot in earlier posts and discussion also showed that bios multiplier setting change did indeed induce L3 pin voltage change. But such had no effect on actual internal multiplier change.

Conclusion is that the L1/L3/BP_FID are still intact, but changing voltage on them has no effect to real, actual multiplier change. These have been discussed extensively in various post of the thread. Please review them and see whether there are something missing or wrong thoughts.

 

[v8vega350]

dumb question but

what does vcc,vss,and nc stand for

 

[emboss]

I know I'm going to get it back to front, but this is my stab at it:
vcc = vcore
vss = ground, 0V
nc = not connected (as marked on the AMD pin diagram)

 

[v8vega350]

thanks

 

[hitechjb1]

dumb question but

what does vcc,vss,and nc stand for

Go to this link, the AMD tech doc for Barton (model 10)
http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/26237.PDF

Chapeter 11 is about the CPU pins, page 53-78.

Page 55 is the pin layout view from bottom.

There will describe all the signal pins, VCC, VSS, NC pins and where they are, ..., plus much more.

 

[hitechjb1]

NC pin should be an open pin, i.e. not conencting to anything. So resistance to VSS should be very large, larger than DMM max resistance reading. If a NC pin has a small resitance < 10 M ohm to VSS, it may indicate something.

VCC and VSS are power supply pins. VCC for Vcore, VSS for ground (0V).

Resistance between VCC to VSS is nonlinear, i.e. resistance varies with voltage across it.

Resitance between VCC to VSS is biased at around 10 ohm based on DMM setting.

Side track: when CPU is running, the resistance between VCC and VSS is less than 1 ohm !!!

There is a possibility that some VCC and VSS pins are not true power pins. If some pins among VCC and VSS indeed are not true VSS or VCC pin, it would read much higher than 10 ohms. If there is a control pin(s) among the VCC or VSS pins, connecting it to VCC or VSS would disable the function of that control pin.

 

[Hoot]

Okay, here's the scoop on the possible existence of a second set of pins. I have spent the past three evenings ohming the 5 known BP_FID pins on my unlocked Barton to all the other pins on the bottom and sadly, though not unexpectedly, I must report that none of the other pins, regardless of claimed function, be that Vss, Vcc, N/C, etc, are connected to them.

Now, here's where it gets "creepy". I eventually snapped and did something I never dreamed I would do. On the Locked Barton, I heated the core with a micro hydrogen flame torch, to keep the heat locallized to the core until the sealant around the edge softened, as well as all the solder dots, be they bismuth, indium, or whatever low temperature metal AMD uses, melted. I then lifted the core off the carrier.

Yes, we're talking CPUicide here. Following the traces from the L3 bridges to their destination solder dots in the array on top of the carrier, beneath where the core sits and the dots leading inside it touch, I discovered they were actually connected to the core's corresponding dots just like all the other traces.

That shoots down my theory about the paths leading to the multiplier control circuitry having been etched back, cut, or whatever, before the core was mounted onto the carrier.

So where does that lead us, other than recommending me for committment to an appropriate institution? Either, as some of you have proposed, they gave those circuit inputs a lethal shot of current or there may be some microcode embedded inside the core which can be programmed to ignore the input logic levels to the multiplier control circuitry. I seriously doubt the cores themselves are different, though I'm certainly not going to trash my remaining unlocked Barton to compare them. I'm already having enough difficulty dealing with my self-loathing, not to mention the $90 price tag to satisfy my curiousity.

Score: AMD 1, OC'ers 0

I'm bushed after three nights of late hours and am off to the refuge from my deed, known as sleep.

Just in case anyone who both appreciates the sacrifice and has a real job want to help out, I'm not too proud to accept contributions.

Hoot the Horrible

 

[hitechjb1]

Okay, here's the scoop on the possible existence of a second set of pins. I have spent the past three evenings ohming the 5 known BP_FID pins on my unlocked Barton to all the other pins on the bottom and sadly, though not unexpectedly, I must report that none of the other pins, regardless of claimed function, be that Vss, Vcc, N/C, etc, are connected to them.

...

So you have ohmed the five BP_FID pins to all other pins. But have you ohmed each pins to a VSS pin to confirm that

- All NC pins are indeed isolated, i.e. > 40 M ohm to VSS or DMM infinity
- Each VCC pin to VSS has small resistance in the order of 10 ohm
- Each VSS pin to VSS has 0 ohm

 

[c627627]

OMG!:

I have no $ but I'll repost in the other thread's post 1, maybe somebody else can help you out.

Um... first of all thank you.
Second, I'm sorry.

...and if I may ask, this then means that the game is over since it's either a permanent electronic fuse or "there may be some microcode embedded inside the core which can be programmed to ignore the input logic levels to the multiplier control circuitry."

The second part means it can't be "reprogrammed" and a hidden control pin does not exist, right?

 

[hitechjb1]

OMG!:

I have no $ but I'll repost in the other thread's post 1, maybe somebody else can help you out.

Um... first of all thank you.
Second, I'm sorry.

...and if I may ask, this then means that the game is over since it's either a permanent electronic fuse or "there may be some microcode embedded inside the core which can be programmed to ignore the input logic levels to the multiplier control circuitry."

The second part means it can't be "reprogrammed" and a hidden control pin does not exist, right?

"No hidden pin" is not yet conclusive, I think, unless proving these:

- All NC pins are indeed isolated, i.e. > 40 M ohm to VSS or DMM infinity
- Each VCC pin to VSS has small resistance in the order of 10 ohm
- Each VSS pin to VSS has 0 ohm

 

[c627627]

I hope when Hoot wakes up, he'll confirm it once and for all, if he's feeling better. You know that commercial for Australian Foster's beer?

Dedicaetion...

That's what Hoot did.

Anyway, the conclusion of an irreversible lock now rests upon the three things you asked. Hopefully we'll know what's up for sure tomorrow.

 

[hitechjb1]

Regardless of the "hidden pin" being yes or no, I think we should not come to a strong conclusion like "games over", "irreversible", ...., unless it is proven positively and exhaustively that nothing can be done, or find out what has been changed to the die and/or package.

There are still some possibilities not yet identified.

 

[emboss]

Hoot, I have to say I'm very impressed. I don't think I could bring myself to do something like that. My locked 2500 is currently at auction (finishes in 4 days), and any proceeds from that you can have. Or, if it fails to get any bids at all (starting at 60% of retail), I can send you the chip (retail box).

Anyhow, on a slightly lighter note, one thing that would really be appreciated by me would be for you to take a photo or scan the carnage

 

[leviathon]

Does anyone know or has anyone found out how intel locks their processors? 'Cos AMD may have done the same thing as intel in which case there is basically no hope considering no-one has ever unlocked an intel have they?