Hacker News new | past | comments | ask | show | jobs | submit login

How do eFuses work to ensure it's physically irrevocable?



On older AMD hardware it's controlled by lockdown registers which are written to by the SMU (Lattice Mico32 CPU) just after reset is deasserted.

The SMU reads the eFuses to determine what to lock down. So you can interrupt this process via JTAG and re-enable all the locked down cores. There is a window of a couple of milliseconds after de-asserting reset to halt the SMU.

I have no idea if this still works on newer chips with the AMD Secure Processor. There was some mention of a JTAG password in the leaked AMD documentation on the Web.

I'm not into that stuff anymore, I'm playing around with FPGAs now. No more locked down security processors to get in your way.


A paper: https://bunniestudios.com/blog/images/efuse.pdf

Most chip fuses are "antifuses": you pass high current through them, and instead of evaporating a fusewire like in normal fuses, it causes physical changes that reduce resistance.


eg if the fuse blows the line that powers up that part of the chip, then it simply can't power up after the fuse has been blown and thus is unusable.

Going in and fixing that blown trace inside of an IC is beyond the capabilities of almost everyone because decapping a chip renders it inoperable.


I think decapping doesn't necessarily render the chip inoperable, there's some research around attacking tamper resistant hardware and probing the decapped chips while powered on. But you have to be more careful about it of course. Also do all techniques require decapping? Seems in principle you could navigate by x-ray and fix traces disconnected by electromigration efuses using ion beam/implantation, possibly through the packaging.

edit: here's someone talking about running decapped chips. https://electronics.stackexchange.com/a/400899


I love when chip people pipe up on HN, because it reminds me that we absolutely do magic with silicon and most of us don't think twice about it.


never let Cunningham's law get n your own way ;)


If you have a ion beam you can probably afford to just buy working and supported cores.


> possibly through the packaging.

Not if somebody's put a metal layer on top of it. You can only meaningfully fiddle with the top surface of a decapped chip.


> You could try throwing a bundle of chips in boiling acid and see what comes out. But my guess is the bond pads will not be usable anymore.

Decapping with extreme prejudice.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: