Reverse engineering an ASIC

The puzzle revolves around a chip design, which is described in a GDS file. This file contains a layout of polygons representing different layers of the chip. The example inputs provided serve as a simple test case, with one input and the expected output from the chip.

Opening the GDS file reveals the structure of the layout, which consists of various types of polygons grouped into cells. These cells can be defined once and placed multiple times, representing logic gates, registers, computational units, and other components. By examining the cell boundaries, we gain a structured overview of the chip's layout, even without the original Verilog description.

However, the GDS file alone doesn't provide enough information about the chip's functionality. To understand the meaning of the layout, we need to know the manufacturing process used to design the chip. This process has its own conventions for interpreting layer numbers, which are documented in a process design kit (PDK) along with rules for using different materials.

By examining the logic cell names, we can identify the chip's process as SkyWater 130 nm, a standard-cell library. Standard-cell libraries contain pre-made components like logic gates and flip-flops, which designers can use without having to draw them from individual transistors. Publicly available documentation for this process and library allows us to interpret the layers and understand the cells' intended functions.

With this knowledge, we can begin to identify the layers and their purposes. For instance, nwell, diff, and poly represent parts of transistors, while li1, short for local interconnect, connects transistors within a cell. Metal layers (met1 through met5) are used for wiring cells together and carrying signals across the chip. Connection points for wires, called vias, are specified using cut layers ending in /44.

Labels on the file's layers provide additional context, indicating the chip's inputs (clk, rst_n, enable, I), outputs (O, success), and power (VPWR, VGND) connections. By zooming into a logic cell, we discover that it is an XOR gate with two inputs (A and B) and one output (X). The XOR gate operates based on the principle that if the inputs differ, the output is one; if they are the same, the output is zero.

In summary, reverse engineering an ASIC involves analyzing the GDS file, understanding the manufacturing process via the PDK, and interpreting the logic cells' functions to deduce the chip's behavior and inputs.