The ware for August 2007 is shown below. Click on the photo for a much larger version (warning, about 2 MB in size).
It’s late in coming, as Chumby has kept me very busy lately, but better late than never. Yep, this is a portion of a silicon chip, imaged at just 20x magnification! The challenge for this…er last…month is to correctly name what type of functional block this is, and some basic properties about it. Thanks to Chris at Flylogic.net for the awesome chip shot! We’ll be teaching an introductory workshop on silicon reverse engineering at this years’ Toorcon in San Diego.
It looks like memory but other than that…
What kind of memory, and what size? :-)
I’m guessing that it’s a PLA structure, perhaps in NMOS (ala Mead/Conway), though it appears that it might be 2 level metal, rather than poly+metal for routing layers. I make that claim only because the layout often switches level based on routing direction, without trying to stay in metal except where necessary for crossing.
No probe marks on the pads. The standard cell routing at the bottom looks hand crafted in some respects, but probably is a very good automatic router. And signals are going off the “page” so this is part of a larger chip.
Actually, this resembles portions of an i386 poster I have, though I don’t see an exact match (didn’t look too hard), and Intel continued to use nmos into the 2 level metal days, so I’ll take a guess that it is an Intel chip.
I never did any PLA work (didn’t take a Mead/Conway class), so I’m not good at sizing it… but I think I see 64 rows, and 16 columns. But maybe it’s just 16 rows? Or am I completely off base, and it’s a CAM?
There also seem to be some interesting capacitor or resistor structures off to the right side, and one trace to that area just disappears as if it were a blown fusible link. Or am I now acting like I’m looking at a Rorsarch (sp?) pattern.
\chuck
Maybe it is an AVR processor?
Ok, so the memory itself should be the left, upper area. It’s 16 bits wide and 256 bits “high”. The vertical structure in the middle seems to be some kind of demultiplexer, it’s 16 almost identical blocks stacked above each other fed by a vertical bus. There are also busses on the left and on the top, with different permutations of taps on each line/column.
If the big green islands are capacitors (and I have no idea on what other things one would spend so much wafer-real-estate) and if the bigger looking devices around it are stronger transistors, that could be (and I’m wildly guessing here) some sort of charge pump to create elevated voltages.
As the number of bits are quite small, I’d therefore guess that it’s some kind of EEPROM memory with about 4kBit of storage.
Totally out of my area, but I think it’s 16x32x8 bit (1/2 K) DRAM from a 32 bit processor. Probably an ARM.
-Andy
Chuck: The “disappearing trace” might be a stitching error when putting together several die-shots to a bigger one. You can see “strange” traces on the same height in the picture right of it.
OK, I don’t think it’s a PLA, but rather a EEPLD. The dark left upper area looks like 16 identical sets of transistors, but I’m betting that it’s actually 8, each using two sections. The section at the bottom of this would be the programmable, electrically-erasable control logic, and the section just to the right would be the configurable output block. You can see 8 feedback runs vertically from the right side of this section, leading down to the control, where they could be routed to any of the PLD sections above. We don’t see to the edge of the die. I suspect that’s where the I/O pads are, because I don’t see enough of them to account for all the inputs and outputs, so the pads visible in the picture are probably testing points.
I can’t actually read gates, but this looks like a hardware
implementation of a cryptographic primitive. In addition to the
context of the Flylogic link and what we know about Bunnie’s
interests, here’s why
I am guessing that the big structure on the left is a a hardware
implementation of an S-Box. My reasoning is that the lines coming in
to the left of the rows are swizzled; I can see swizzling rows on a
RAM on a PCB where it just doesn’t matter and maybe you get some
better layout properties, but here the layout is nice and regular.
I was thinking “permutation” for the lower left chunk, and a picture
of one in “Design Principles for Tamper-Resistant Smartcard
Processors” by K”ommerling and Kuhn seems to confirm this.
If I knew how to read gates, I’d probably be able to say something
interesting about those vertically-symmetric structures on the right
just over the permutation block.
This is also not my area, but here is my guess…
It could be a 16550 RS232 UART.
The main grid “area” on the top left side seems to be memory (SRAM), with the bit decode below (it does look to be 16-bits) and the FIFO decode on the right. I chose the 16550 over the 16450 due to the size of the FIFO (16 elements deep).
The section on the bottom looks like traditional CPU microcode, but there is not much of it an the scale seems to fit the decode / operation for a 16×50 chip.
The cyan colored section is probably the most important feature to distinguish this chip. I agree with Christian — it does look like a charge pump (taking 3.3/5V to +/-12V for RS232 levels). I suppose it could also be some sort of on-chip oscillator or VCO. I know that a 16X50 chip has an external oscillator, and that is divided down by the high and low divisor latches.
It has been a while since I had “advanced baking” class at OSU — we made chips that contained a resistor, capacitor, and transistor (multiplied 12X) on a quarter wafer back in 1991…
I’m way outside of my scope here, but I’ll guess that it’s a 256 byte chunk of static RAM maybe on an RFID type of device?
About the seminar, is there any chance to get a hold of the slides after the event is done? I would love to assist, but it is a bit expensive and given the fact that I would have to cross the border in order to do it (which would add a lot to the cost), it is almost certain that I won’t be able to.
Looks like a 16X64 (SRAM?) Array on the left. I’m guessing the groups of 6 white blobs in the array are the 6 transistors forming a memory bit.
Memory is 8 bit output, two groups of 8 sense amplifiers forming the line of 16 under the array, which are then muxed together to the right forming the 8 bit output.
Middle bit is the address line decoding, but it looks like its taking an 8 bit input at the bottom which would imply 256 address lines?), so 256x8bit ram? (yeah i’m 2x out in size somewhere)
The area on the right with on chip capacitors, if it’s a charge pump as others have said, I’d guess it’s an EEPROM, or at least a RAM that can operate at dual voltage range.
I’d guess that the logic at the bottom is something like interface logic. maybe serial I2C or similar.
So I’m guessing serial EEPROM like a microchip 24LC02, but it might be one corner of something larger – either a larger memory in the same range, or perhaps a PIC, giving bunnies previous PIC hacking!
It’s a 512 * 8 EEPROM array :-). There is a glitch in the image stitch around the capacitor array on the upper right too.
Middle bit is the address line decoding, but it looks like its taking an 8 bit input at the bottom which would imply 256 address lines?), so 256×8bit ram? (yeah i’m 2x out in size somewhere)
The area on the right with on chip capacitors, if it’s a charge pump as others have said, I’d guess it’s an EEPROM, or at least a RAM that can operate at dual voltage range.
I entirely agree with your advice. :) There’s nothing more relaxing than relaxing and crafting with pals.