Hacker News Reader

Comment by Red_Leaves_Flyy | Hacker News Reader

And a follow on question… could they be turned on and used?

Probably not, these modular bits of silicon are usually tied to eFuses that are blown at the factory to irrevocably disable them in SKUs that aren't supposed to have them. Many years ago it was sometimes possible to re-enable disabled cores by poking the right registers, but manufacturers learned their lesson and now they make sure that silicon stays dead.

Besides, even if you could enable these DSP cores you'd be hard pressed to do anything useful with them, I don't believe there's any public documentation or tooling whatsoever for Cadence DSPs.

How do eFuses work to ensure it's physically irrevocable?

eg if the fuse blows the line that powers up that part of the chip, then it simply can't power up after the fuse has been blown and thus is unusable.

Going in and fixing that blown trace inside of an IC is beyond the capabilities of almost everyone because decapping a chip renders it inoperable.

I think decapping doesn't necessarily render the chip inoperable, there's some research around attacking tamper resistant hardware and probing the decapped chips while powered on. But you have to be more careful about it of course. Also do all techniques require decapping? Seems in principle you could navigate by x-ray and fix traces disconnected by electromigration efuses using ion beam/implantation, possibly through the packaging.

edit: here's someone talking about running decapped chips. https://electronics.stackexchange.com/a/400899

I love when chip people pipe up on HN, because it reminds me that we absolutely do magic with silicon and most of us don't think twice about it.

never let Cunningham's law get n your own way ;)

If you have a ion beam you can probably afford to just buy working and supported cores.

> You could try throwing a bundle of chips in boiling acid and see what comes out. But my guess is the bond pads will not be usable anymore.

Decapping with extreme prejudice.

> possibly through the packaging.

Not if somebody's put a metal layer on top of it. You can only meaningfully fiddle with the top surface of a decapped chip.

On older AMD hardware it's controlled by lockdown registers which are written to by the SMU (Lattice Mico32 CPU) just after reset is deasserted.

The SMU reads the eFuses to determine what to lock down. So you can interrupt this process via JTAG and re-enable all the locked down cores. There is a window of a couple of milliseconds after de-asserting reset to halt the SMU.

I have no idea if this still works on newer chips with the AMD Secure Processor. There was some mention of a JTAG password in the leaked AMD documentation on the Web.

I'm not into that stuff anymore, I'm playing around with FPGAs now. No more locked down security processors to get in your way.

A paper: https://bunniestudios.com/blog/images/efuse.pdf

Most chip fuses are "antifuses": you pass high current through them, and instead of evaporating a fusewire like in normal fuses, it causes physical changes that reduce resistance.

Reply on news.ycombinator.com