5 ms·

And a follow on question… could they be turned on and used?

jsheard 3y ago
Probably not, these modular bits of silicon are usually tied to eFuses that are blown at the factory to irrevocably disable them in SKUs that aren't supposed to have them. Many years ago it was sometimes possible to re-enable disabled cores by poking the right registers, but manufacturers learned their lesson and now they make sure that silicon stays dead. Besides, even if you could enable these DSP cores you'd be hard pressed to do anything useful with them, I don't believe there's any public documentation or tooling whatsoever for Cadence DSPs.
- fulafel 3y ago
  How do eFuses work to ensure it's physically irrevocable?
  - fragmede 3y ago
    eg if the fuse blows the line that powers up that part of the chip, then it simply can't power up after the fuse has been blown and thus is unusable. Going in and fixing that blown trace inside of an IC is beyond the capabilities of almost everyone because decapping a chip renders it inoperable.
    - fulafel 3y ago
      I think decapping doesn't necessarily render the chip inoperable, there's some research around attacking tamper resistant hardware and probing the decapped chips while powered on. But you have to be more careful about it of course. Also do all techniques require decapping? Seems in principle you could navigate by x-ray and fix traces disconnected by electromigration efuses using ion beam/implantation, possibly through the packaging. edit: here's someone talking about running decapped chips. https://electronics.stackexchange.com/a/400899 https://electronics.stackexchange.com/a/400899
      - rpmisms 3y ago
        I love when chip people pipe up on HN, because it reminds me that we absolutely do magic with silicon and most of us don't think twice about it.
        fragmede 3y ago
        never let Cunningham's law get n your own way ;)
      - ZiiS 3y ago
        If you have a ion beam you can probably afford to just buy working and supported cores.
      - jorvi 3y ago
        > You could try throwing a bundle of chips in boiling acid and see what comes out. But my guess is the bond pads will not be usable anymore. Decapping with extreme prejudice.
      - pjc50 3y ago
        > possibly through the packaging. Not if somebody's put a metal layer on top of it. You can only meaningfully fiddle with the top surface of a decapped chip.
        deleted 3y ago
        [deleted]
  - 127361 3y ago
    On older AMD hardware it's controlled by lockdown registers which are written to by the SMU (Lattice Mico32 CPU) just after reset is deasserted. The SMU reads the eFuses to determine what to lock down. So you can interrupt this process via JTAG and re-enable all the locked down cores. There is a window of a couple of milliseconds after de-asserting reset to halt the SMU. I have no idea if this still works on newer chips with the AMD Secure Processor. There was some mention of a JTAG password in the leaked AMD documentation on the Web. I'm not into that stuff anymore, I'm playing around with FPGAs now. No more locked down security processors to get in your way.
    - deleted 3y ago
      [deleted]
  - pjc50 3y ago
    A paper: https://bunniestudios.com/blog/images/efuse.pdf https://bunniestudios.com/blog/images/efuse.pdf Most chip fuses are "antifuses": you pass high current through them, and instead of evaporating a fusewire like in normal fuses, it causes physical changes that reduce resistance.

Probably not, these modular bits of silicon are usually tied to eFuses that are blown at the factory to irrevocably disable them in SKUs that aren't supposed to have them. Many years ago it was sometimes possible to re-enable disabled cores by poking the right registers, but manufacturers learned their lesson and now they make sure that silicon stays dead. Besides, even if you could enable these DSP cores you'd be hard pressed to do anything useful with them, I don't believe there's any public documentation or tooling whatsoever for Cadence DSPs.

fulafel 3y ago
How do eFuses work to ensure it's physically irrevocable?
- fragmede 3y ago
  eg if the fuse blows the line that powers up that part of the chip, then it simply can't power up after the fuse has been blown and thus is unusable. Going in and fixing that blown trace inside of an IC is beyond the capabilities of almost everyone because decapping a chip renders it inoperable.
  - fulafel 3y ago
    I think decapping doesn't necessarily render the chip inoperable, there's some research around attacking tamper resistant hardware and probing the decapped chips while powered on. But you have to be more careful about it of course. Also do all techniques require decapping? Seems in principle you could navigate by x-ray and fix traces disconnected by electromigration efuses using ion beam/implantation, possibly through the packaging. edit: here's someone talking about running decapped chips. https://electronics.stackexchange.com/a/400899 https://electronics.stackexchange.com/a/400899
    - rpmisms 3y ago
      I love when chip people pipe up on HN, because it reminds me that we absolutely do magic with silicon and most of us don't think twice about it.
      - fragmede 3y ago
        never let Cunningham's law get n your own way ;)
    - ZiiS 3y ago
      If you have a ion beam you can probably afford to just buy working and supported cores.
    - jorvi 3y ago
      > You could try throwing a bundle of chips in boiling acid and see what comes out. But my guess is the bond pads will not be usable anymore. Decapping with extreme prejudice.
    - pjc50 3y ago
      > possibly through the packaging. Not if somebody's put a metal layer on top of it. You can only meaningfully fiddle with the top surface of a decapped chip.
      - deleted 3y ago
        [deleted]
- 127361 3y ago
  On older AMD hardware it's controlled by lockdown registers which are written to by the SMU (Lattice Mico32 CPU) just after reset is deasserted. The SMU reads the eFuses to determine what to lock down. So you can interrupt this process via JTAG and re-enable all the locked down cores. There is a window of a couple of milliseconds after de-asserting reset to halt the SMU. I have no idea if this still works on newer chips with the AMD Secure Processor. There was some mention of a JTAG password in the leaked AMD documentation on the Web. I'm not into that stuff anymore, I'm playing around with FPGAs now. No more locked down security processors to get in your way.
  - deleted 3y ago
    [deleted]
- pjc50 3y ago
  A paper: https://bunniestudios.com/blog/images/efuse.pdf https://bunniestudios.com/blog/images/efuse.pdf Most chip fuses are "antifuses": you pass high current through them, and instead of evaporating a fusewire like in normal fuses, it causes physical changes that reduce resistance.