2500+ unlocking effort, strictly directions

[hitechjb1]

Thanks for pointing out the high risk involved doing these kind of tests and experiments, even though I don't agree with some details about the various scenarios and possibilities in your descriptions when doing the tests.

I already pointed out in various posts that in order to carry out these experiments, one needs to understand the assumptions and skill in the field, and know what to look for, .... I also listed some precautions as much as possible.

The steps are listed out for suggestions and potential ideas, ....

Further the risk is high in damaging a functional CPU.

It is not for someone who just follows the steps and hopes for discover somethings without understanding the hypothetical assumptions behind, and changing some details if needed when performing the experiments, ...

Let me says again, if one is not trained in the electrical/electronic field, please don't do the tests. Just use them for ideas (right or wrong) or discussion.

Even if one is experienced, the risk is high in damaging a good CPU.

 

[Hoot]

In case anyone wanted to see what's left of the carcass, here's what is left of the AQYFA 0342, after removing the core and subsequently lapping/digging/cursing my way into the L3 bridge paths to make sure they only went to the L1 bridges, Pull-up SMD, BP_FID pins and pin grid array in the center. Sorry for the quality of the picture, but it was the best I could do with my "low-end" camera. Even though the new process carriers are either translucent green or yellow-brown on the surface, they're still brownies underneath.

It's not a pretty sight...

Hoot

 

[KnownKiller]

Oh my god is that sick lookin!

I'd keep that for a reminder for all that you've done for this locking prob.

you should email that pic to AMD thanking them for locking their new CPU's!

 

[johnoh]

cool pic

 

[stamasd]

May I suggest that if someone else is thinking of doing something similar, they do it to a cheaper locked CPU, such as a Duron or something...

 

[emboss]

I don't suppose there's enough of the board left to verify whether there are any additional traces cut by the lasers?

 

[Hoot]

That's a joke, right?

After chasing each L3 bridge path here and there, making sure they weren't intentionally interrupted, nor connected to any mysterious other inputs to the core, I updated my resume to include the fact that I qualified to get a job at McCormick/Schilling, picking fly sh*t out of pepper!

The laser cuts on the top traces were consistent with the unlocked Barton I had alongside the cut one with the exception that my unlocked Barton, being a 2600, had the one L3 trace cut consistent with 11.5x versus 11x.

Hoot

 

[phaedrus]

lol, perhaps emboss would like to have that carcass to get his "picker of fly sh*t from pepper" certification!

 

[hitechjb1]

Someone's gonna fry a chip and they're going to blame the person who gave them the directions on how to do it.

The resistance of a semiconductor gate changes as a function of the forward bias. The forward bias in FETs and MOSFETs is governed by the amount of voltage you place on it. Ohm meters place different amounts of voltage on the probes dependent upon the resistance range. Analog ohmeters typically place greater voltage on their probes than digital multimeters, again depending upon the resistance range. Measuring semiconductor gate resistance in a passive mode yields different values depending upon the resistance range. Using an ohmeter to read a gates resistance is useful for telling whether a gate is open, shorted, or for comparing identical gates to see if they are all in the same ball park. My Fluke 189 DMM puts 5.14 volts on its probes in the 500 ohm and 5k ohm ranges, 4.71 volts in the 50k ohm range, 4.02 volts in the 500k ohm, 1.12 volts in the 5m ohm range and .979 volts in the 50 and 500m ohm ranges. If it was my CPU, I would be very hesitant to put 5.14 volts on any of the indeterminate pins. That's a lot higher voltage compared to the intended Vcc for the CPU.

I gotta wade in and say, with all due respect to the hard work that's going into this angle of approach, I'm afraid someone is going to get burned.

Has anyone pondered what might happen to the CPU if you find an inderterminate pin who's real function is to erase the CPUs internal microcode or otherwise render it useless? Running into tamper or snoop guards in highly proprietary chips is not unheard of.

Taking live chip pin voltage checks should not cause a problem and in that vein, I'd say look at these indeterminate pins for a voltage around .45V. That was what constituted a logic high on the BP_Fid pins I measured when I was trying to force a multiplier. Also, in my 2600, where on of the L3 trace to the pull-down resistor was cut (11.5x), that voltage floated up to something like .35V and registered as a logic high on its respective BP_FID pin.

All that testing will reveal that there is some, function undefined, gate input who's manufacturers intended logic level was high.

Move cautiously tampering with undefined functions...

Hoot

I did some investigation into how “safe” is using DMM to measure motherboard and chips in terms of its internal open circuit voltage and current.

I have a DMM and an analog multimeter. I did some measurements.

The analog multimeter operates with 3V for ohmmeter, 20 K ohm/V DC. For DC and AC measurement, it is passive.

The DMM operates with a 9V battery, 0.3% accuracy (DC), 10 M ohm input impedance (AC/DC), open circuit voltage < 2.8 V (for discrete diode and transistor), open circuit current < 2 mA.

For the analog multimeter, when measuring ohms, the open circuit voltage is < 3V and is in series w/ a resistor (50, 500, 5K, 50K ohm for Rx1, Rx10, Rx100, Rx1000). That is the max voltage applied to the component being measured is 3V. So components that can stand 3V would be OK (see later for FET’s).

For the DMM, when used as an ohmmeter, I checked the “open” circuit voltage by the analog meter. Actually NOT exactly open circuit, since the analog DC meter has an impedance of 100 Kohm in the 5V range, and 10 Kohm in the 0.5V range, and it can load the DMM. This is what I found

DMM set to ohmmeter connected to analog multimeter (probes to probes)
- 0.21 V (0.5V range)
- 0.20 V (5 V range)
- 0.18 mA (0.5 mA range)

I then used the DMM to measure resistance and used the analog multimeter to roughly measure the voltage across the resistance (since the impedance of the multimeter would change the measurement)
- 10 ohm, << 10 mV
- 100 ohm, 0.02 V
- 1 K ohm, 0.15 V
- 10 K ohm, 0.2 V
- 100 K ohm, 0.2 V
- 1 M ohm, 0.2 V

So from this measurement, it seems to me that it is “safe” to use a DMM (similar to the one I have) to measure regular semiconductor devices.

So why a Fluke DMM put out such a high voltage, am I missing something, ...

 

[hitechjb1]

Regarding to use DMM to probe around CPU pins and motherboards:

First of all, I must say doing these kinds of things require some background and training in Electrical/Electronic field. Even experience, trained persons would sometime damage components due to unforeseen and human errors, ….

MOS FET’s which makes up most of the CPU and CMOS chips have very high gate impedance, since the gate is insulated from the underlying source drain channel of a FET, and the gate itself would NOT conduct current (except for the order of magnitude smaller tunneling current due to quantum effect) even when the gate voltage is above its threshold voltage (about 0.2 – 0.3 V for 0.18, 0.13 and even 0.09 micron regular FET’s). So applying 1-2 V to the gate per se (at least up to 0.13 micron chips) should not be a concern.

MOS FET’s have a so called gate break down voltage. The gate of a FET transistor is insulated from the underlying source drain channel by a thin layer of silicon dioxide (SiO2) forming a MOS capacitor. The thickness is very thin (of the order of 20-30 A, and is getting thinner for next generations, approaching 10 atoms or so thickness). So when a high enough voltage is applied to the FET gate, the intense electric field (electric_field = voltage/oxide_thickness) may damage the gate dielectric (dielectric breakdown). I estimated that voltage is somewhere between 2 and 3 V, depending on the oxide thickness. So if a DMM or analog multimeter has high open circuit voltage, they indeed can potentially damage FET.

So if a DMM or analog multimeter has an open circuit voltage of 3+ V, would almost certain damage these gates if connected directly to them.

For commercial chips, the internal FET’s are well insulated from the external pins from package. The package pin should not be directly connected to the internal, smaller transistors, without going through some stage of I/O buffers which also can stand a higher voltage (e.g. thicker oxide) than the internal small and fast transistors. There are also protective diode at each package pin to minimize damage due to electrostatic discharge, ….

Regarding to the specific about the 12 hidden NC pins of Barton, each of which has 40/50/80 ohms to VCC and VSS, I think these small resistance shows that they are not connected directly to internal FET’s, but rather some kind of pullup or pulldown paths or … (I don’t want to speculate here).


When I get chance, I may try to measure the voltage of these 12 NC pins, either using a Palomino or a Barton (if I can get one, either locked or unlocked) with an old socket A motherboard to see what may have happened.

Let me repeat again, don’t try to do these kind of measurement or test if you don’t fully understand the situation, and the risk is high for damaging the components and may be the entire motherboard and CPU, ….

The 12 hidden NC pins and potentially hiden VSS/VCC are still unsolved, AFAIK.

 

[wolverine I]

well in the automotive industry we're required by law to use a high impedance digital mm as they do not use enough voltage to damage computer components as the analog mm do.we must
use 10meg

 

[gt2i]

The L5 trick still works on locked Bartons right ?!

While closing the L5[2] you will transform your Barton into a Barton MOBILE ?!

I suppose this mod will enable PowerNow and some other internal circuitry like FID for Mobile (L6) and SOFT VID for Mobile (L8).

Thus it would be possible to unlock the barton by transforming it into a barton mobile !?

and I think that AMD mobile processors support on the fly multiplier adjustment through PowerNow !

Jeff, France

 

[Hoot]

Emboss covered that angle on about page 3 of this thread. It didn't work.

Hoot

 

[Hoot]

On this Thanksgiving day here in America, I took some time as I sat at work and thought of everything I have to be thankful for. I hope you all had the chance to do so also, hopefully, not at work.

Anyway, I wanted to express a special thanks to Emboss and Phaedrus for their thoughtful contributions that allowed me to recover the cost of the locked Barton I dissected. When I first mentioned being open to any contributions to help offset the self-loathing I was feeling, having intentionally harmed a working CPU, it was almost in jest. I made the decision to do what I did because I had the tools to make some qualitative observations and a subject to do them with. The warm feeling their generosity invoked would lead me to do the same thing again, not just to satisfy my own curiousity, but for the benefit of the entire OC community, even if I knew I wasn't going to get any help with the cost. You guys (and gals I think) are the best.

[/misty mode]

Back to business. As I was skimming through the entire thread again, it occurred to me that there may be the opportunity for still a little more enlightenment, though I confess, I don't know if it would yield any solution. Ponder this. We have looked at passive and active measurements of both an unlocked 2600 and a locked 2500. What we haven't examinened is a locked Barton that is greater than 2500. IE, has one or more L3 bridges cut to yield a multiplier other than 11, yet is locked at that speed. Are the FID lines for the necessary-to-unlock bridges disabled as well as the lines that are not needed for that multiplier? All we need is for someone with say, a locked 2600 to try forcing it to 11 instead of 11.5 using a motherboard capable of forcing mutlipliers. If it can't be forced to 11, then we know the chip is not responding to logic levels put on the BP_FID0 pin, even though that decoding line is needed to make it a 2600. If they can change the multiplier, then we know that something must have been done to the other 4 decoding lines to deactivate them. If, in doing the first task, the person with the 2600 could not get the multiplier to change to 11, then, if the person was agreeable, they could do a standard fill and reconnect on the L3 .5x bridge up top and see if the multiplier changed. That would be very interesting to know since the BP_FID pin had no effect. If that effort proved in vain, the person could take the chip out and do a comparative ohm test on the locked bridges 8x,4x,2x and 1x versus the unlocked .5x. That would yield some interesting results also.

Lastly, again, after skimming the thread I noticed something that we as a group overlooked. If you go back to the post where I took the active voltage measurements. Did anyone notice that the pulled high voltage, on the .5x multiplier (2600) line that was cut, occurred on a BP_FID pin that is different than the pin that got pulled high when I forced an 11.5 multiplier? Either the FAB51 documentation has something wrong, or I'm missing something there. It's almost like the BP_FID 0-5 lines are backwards or something. Someone else look at that and chime in.

Boy, I got to eat roast Turkey more often. Cold fusion is starting to look more do-able already!

Hoot

 

[hitechjb1]

This was my interpretation of the result right after the measurement posted:

- Each BP_FID[0:4] have direct connection to each of the L1-L3 connection points (using the Fab51 diagram, they are the mid (connection) points between between each L1-L3). It had also been confirmed by deathstar13 by direct resistance measurement between the 5 pins BP_FIP[0:4] to the 5 pins of L1-L3 connection points. They are directly connected with less than 1 ohm resistance measured.

- The 22 mV higher (384 mV vs 406 mV) on the BP_FID[0] for a forced logic 1 by the bios setting only further favors logic 1 trying to force the locked Barton 2500 from multiplier 11 to 11.5. But it was not able to change that for the locked Barton (from 11 to 11.5).

So I came to conclude that the BP_FIP[0:4] and the L1-L3 bridge network, pull-up and pull-down are still there (based on other measurements by the others, detailed in the thread). BUT such logic 0 or logic 1 signal/voltage were not able to alter the real, actual multiplier inside the chip (with "possible" explanations, see thread). This was my conclusion then, ..., of course, I might have overlooked or made wrong inferences, ...

...
Unlocked Barton 2600 L3 bridge 0 cut
Multiplier BP_FID0 BP_FID1 BP_FID2 BP_FID3 BP_FID4 Result Mult
Auto------0.005V---0.005V---0.005V---0.005V---0.337V 11.5
x11-------0.005V---0.005V---0.005V---0.005V---0.009V 11
x11.5-----0.384V---0.005V---0.005V---0.005V---0.009V 11.5

Locked Barton 2500 L3 bridge 0 cut
Multiplier BP_FID0 BP_FID1 BP_FID2 BP_FID3 BP_FID4 Result Mult
Auto------0.004V---0.004V---0.004V---0.004V---0.323V 11
x11-------0.004V---0.004V---0.004V---0.004V---0.007V 11
x11.5-----0.406V---0.004V---0.004V---0.004V---0.007V 11
...

Nice work.

Just want to confirm:

What it shows is that, for the locked Barton, the bios multiplier setting change is able to alter the BP_FID[0] = L3_FID[0] voltage. That voltage, if for the old unlocked CPU, would be able to program the multiplier as 11.5. But for this new locked CPU, it does not alter the actual CPU multiplier.

I think the measured voltage for the locked CPU, though read 22 mV higher (0.406 V vs 0.384 V) than the unlocked 2600+, should not be the culprit to the inabililty of multiplier changing.

So this further confirm what I have been suspecting that even the whole L1/L3, BP_FID, resistance network are intact and "working", the L3_FID signal/voltage is not passed into the internal circuit that decodes and changes the actual multiplier.

 

[Hoot]

Perhaps I didn't make myself clear.

When you set the bios for automatic sense of multiplier, the register on the motherboard that drives the BP_FID inputs on the CPU is tri-stated, allowing the bridges, whether cut or not, to set the logic levels of BP_FID0-4. That logic goes to the multiplier control circuitry and also shows up on the BP_FID pins.

If you look at the example below, the 2600 has the bridge associated with .5x cut to yield a multiplier of 11.5x. According to FAB51, the bridge for .5x is BP_FID0, which shows up on pin AN27. Again, referencing the example below, for the 2600, when the bios is set to force 11.5x, indeed the BP-FID0 pin goes up to .384V and the other pins with their respective bridges to the pull-down resistors remain zero. However, in the auto detect mode, where those pins float to whatever logic is hard-coded by cutting the L3 bridges, BP_FID0 was not the pin that registered the logic high. BP_FID4 floated up to .337V instead. In other words, the multiplier byte comprised of BP_FID0-4 flipped around. This occurred in both the locked and unlocked bartons which both had the bridge associated with BP_FID0 (per FAB51) cut.

Hoot

Unlocked Barton 2600 L3 bridge 0 cut
Multiplier BP_FID0 BP_FID1 BP_FID2 BP_FID3 BP_FID4 Result Mult
Auto------0.005V---0.005V---0.005V---0.005V---0.337V 11.5
x11-------0.005V---0.005V---0.005V---0.005V---0.009V 11
x11.5-----0.384V---0.005V---0.005V---0.005V---0.009V 11.5

Locked Barton 2500 L3 bridge 0 cut
Multiplier BP_FID0 BP_FID1 BP_FID2 BP_FID3 BP_FID4 Result Mult
Auto------0.004V---0.004V---0.004V---0.004V---0.323V 11
x11-------0.004V---0.004V---0.004V---0.004V---0.007V 11
x11.5-----0.406V---0.004V---0.004V---0.004V---0.007V 11

 

[hitechjb1]

I checked a while back, from my interpretation of your measurment results, they are conistent and explanable with the Fab51 circuit and description.

I think Fab51 does not have the bridge order messed up or backward.

FID[4] is for higher or lower multiplier. In your measurement in Auto mode, it showed up as higher voltage 0.3+ V from 0.0 V. I don't know what it actually does for Auto, but that is NOT for FID[0]. That may be a logic signal to tell the CPU to set the multiplier automatically (internally?). Since all the rest FID[0..3] are logic 0.

Side track: I don't know whether the FID[4] would play a role in multiplier unlocking ?? It might, ..., would be interesting, overlooked?

FID[0] is same as BP_FID[0] is the same as AN27.
This is the 1st L1/L3 bridge, responsible for 0.5x multiplier change. Your measurement showed that the motherboard multiplier setting was able to alter its voltage for both a unlocked 2600+ and an altered, locked 2500+.

As far as I can tell, if ignoring the measurement of the Auto mode, BOTH the unlocked 2600+ and the altered, locked 2500+ Barton with 1st L3 cut manually BEHAVE THE SAME under motherboard manual multiplier setting. The motherboard was able to alter the voltage/signal on the four L1/L3 pin and BP_FID[0..3] pins for BOTH the 2600+ and the altered 2500+, but the real, actual multiplier was not changed.

Reason why TBD but guessed as
- signal paths from L1/L3 being ignored/overwriten/bypassed somewhere to CPU internal or
- BP_FID/L1/L3 being used to program the multiplier during packaging and testing but then future change being disabled permanently by electronic fuse or hidden control pins.

 

[Fubar569]

are any and all of these bridges super locked? i read along the way somewhere the the mobile xp's use a different set of bridges to determine thier multiplier.......has anyone tried to CLOSE the 3rd L5 to enable mobile and go from there? this is just a thought i came up with since i'm gonna try to get the mobile cpus to hack it in a dual rig...

 

[Hoot]

It's been tried and also failed to unlock the multipliers.

Hoot

 

[emboss]

Slightly off-topic ... Anyhow, mobile chips won't work in SMP mode. If you get a real mobile chip, then you've got to break the "mobile" L5 bridge to get them to SMP.