The ‘Unlocking the Multiplier – Part I’ article caused quite some controversy, because we discussed the location of the actual multiplier lock circuit–i.e., whether it is on the PCB or in the CPU-core. We concluded that the multiplier lock is in the CPU-core, because there are so many advantages to having it there. Let me explain why this is the case and give the arguments for this conclusion:
Having the multiplier on the PCB has the following drawbacks:
– If the multiplier lock were on the PCB it could be circumvented by using some logic circuitry to bypass any input values before they were entering the actual CPU-core, thus setting a different multiplier. This would mean cutting the traces that derive the multiplier leading to the CPU’s core, and applying the desired input values to get the desired multiplier.
– Having the multiplier lock on the PCB requires active logic circuitry, so there is no trace routing or via selection which could set this multiplier value without actively responding to input values. So we can’t just use a different via layout, or trace pattern.
– Having the multiplier lock on the PCB needs different PCBs for each type of processor, so each CPU model would have a dedicated PCB; this drives up the cost pretty quickly.
Having the multiplier on the CPU-core has the following advantages:
– Changing the multiplier from the inside is impossible, because we can’t get into the CPU-core.
– Changing the multiplier from the factory can be as simple as writing the value into an on-die PROM (Programmable Read Only Memory), either using a similar setup to that described above (setting input values during the active phase of another signal) or using inputs listed as ‘reserved’ as the input values.
– Any CPU coming off of the production line can be ‘programmed’ to any desired value, permitting a great deal of flexibility; further, if the ROM is re-programmable (EEPROM, Electric Erasable Programmable Read Only Memory), already manufactured and programmed CPU’s can be re-programmed to adapt to market demand.
– The interface used to program the on-die multiplier lock does not have to adhere to any particular protocol used by the chipset or CPU; it can use a totally different and independent protocol.
– The implementation of a multiplier lock on the CPU-core only uses a few thousand transistors, and as we have millions available, this is easily accomodated.
– There are no added costs or components needed to implement the multiplier lock, as it is independent of the PCB and is part of the CPU-die. It is manufactured with the CPU-core and will thus not drive up costs.
– Interface with and configuration of the multiplier lock can be easily protected using a code or a bit value at the inputs, or can be a one-time operation (write once, read many times)–thus ruling out 99.9% of all attempts to change it from the outside.
– The multiplier factor is independent of the PCB used or of the CPU-core soldered onto the PCB; it is solely dependent on the programming of the multiplier lock.
Remarked Pentium II’s
Still, there are lots of ‘remarked’ Pentium II’s, either with a Klamath (.35micron) or ‘Deschutes’ (.25micron) core which have been ‘modified’ on a PCB level. Some of this ‘modifying’ is clearly visible to the naked eye, as a little circuit board is added that seemingly alters the CPU’s multiplier.
Many of you have asked yourselves if this isn’t in contradiction with our previous claim that the multiplier lock is in the CPU-core. Well, it isn’t. Simply because the circuit board is there and is connected to the Pentium II PCB does not mean that it can’t interface with some of the multiplier lock circuit’s inputs/outputs. What it does mean, however, is that the ‘remarkers’ have found a way to interface with the CPU’s multiplier lock and change its value from the outside.
Before we get into the different ‘remarked’ Pentium IIs that are out there, let us first get a clear perspective of all that these ‘modifications’ must accomplish:
– Change the multiplier of the CPU from value A to value B.
– Change the multiplier of the CPU without altering the CPU’s desired behavior.
– Change the multiplier of the CPU so that the motherboard accepts the new multiplier.
Changing the value of the multiplier from A to B is probably more complex than we realize, as it might well be possible that the ‘modification’ can only up- or down-grade a multiplier by a certain amount, for example: ?0.5x or ?1.0x. Thus, the original multiplier value, in combination with this amount, could be the limit.
Furthermore, changing the multiplier must not influence the CPU’s desired behavior. If your CPU locks up your system or is very unstable it can be easily picked out by a purchaser as a ‘remark’. It needs to function just like the ‘original’.
Also the motherboard needs to be fooled, to be able to readout the CPU’s frequency; this means that the ‘modifications’ need to interface with the CPU in such a way that the new CPU frequency will be read out to the motherboard correctly.
This might all seem very obvious, but keep in mind that herein is the major challenge for the ‘modification’, because if it were to cause erroneous CPU behavior it could be picked out doing a pre-sales check, and all of the remarker’s efforts would have been fruitless. Actually, without opening the cartridge most ‘remarked’ CPU’s cannot be distinguished from the original, and opening the cartridge will in most cases void the warranty.
That’s also why we haven’t seen any remarked Celeron’s, Slot1 or PPGA, or Pentium III’s. A visual check would be sufficient to determine whether they are ‘remarks’ or not.
Pentium II Modifications
Most modifications use a small printed circuitboard that attaches directly to some of the CPU pins, without interfacing directly with the Slot1 connector. Obviously the circuitry needs two pins for power, and as you can see two pins are used for interfacing with the CPU.
If we were to ‘guesstimate’ what the ‘modification’ does, we feel the following is a very possible scenario:
– Unlike the old BF0…BF3 jumpers used to set the multiplier permanently, the multiplier is set when the #RESET input is activated. As soon as the #RESET input is complete, the other inputs used are given another function and the multiplier value is set. As the motherboard requires the multiplier value in place before the #RESET signal is deactivated, all actions need to be taken within this timeframe.
– Given the fact that we have only two wires for signal transport, we are most likely looking at a serial input/output, so all signal bits are supplied in ‘sequence’ rather than in ‘parallel’.
– If a certain multiplier value is generated by the CPU, as a serial bitstream, it can be interfaced to the ‘modification’, which adds or subtracts a bit, or a couple of bits, and outputs this value to the CPU. The CPU will then accept this value as its multiplier factor.
– Or the ‘modification’ just disregards or blocks the serial bitstream from the CPU and outputs the desired multiplier value to the CPU. The CPU will the accept this value as its multiplier factor
– This action will take place within the ‘#RESET active’ timeframe.
Hacking up the Pentium II
As we were determined to prove our claim that the multiplier lock is indeed located in the CPU-core, we took it upon ourselves to completely take apart a Pentium II / 300 and a Pentium II / 333 and make a list of all their component values and parts. We then compared these lists and came to the conclusion that all parts were identical. The part that was different was the CPU-core, so we decided to also take the CPU-core off, swap the CPU-cores and see if we could get the Pentium IIs working again.
After some experimenting we were able to re-build a Pentium II / 333 PCB equipped with a Pentium II / 300 CPU-core, and we were able to successfully run this ‘homebuilt’ CPU in our system. We were not surprised to find out that the Pentium II / 300 on a Pentium II / 333 PCB acted like a Pentium II / 300. Thus we can only conclude that the multiplier lock is indeed in the CPU core.
Care to donate a couple of remarked CPUs to us, or do you work at an Intel FAB?