40
CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS layout

CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

  • Upload
    others

  • View
    10

  • Download
    3

Embed Size (px)

Citation preview

Page 1: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

CSCI 4974 / 6974Hardware Reverse Engineering

Lecture 4: CMOS layout

Page 2: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Inkscape

● Vector graphics editor● Very useful for visualizing VLSI layout● Demo● Download today's examples

Page 3: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Materials

● Silicon– Undoped

– P-type

– N-type

– Polycrystalline

● Insulators

– Usually SiO2

– Sometimes low-k

● Metal– Multiple layers

– Numbered in order

Page 4: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Color-coding convention

● Based on scheme used in Mead & Conway● Extended for multilevel metallization

P-type doping

N-type doping

Poly

Via

M1

M2

M3

M4

Page 5: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Schematic cross section

ImplantPoly

Contact

M1

M2

M3

M4

Overglass, bond pads, etc

M3-M4 via

M2-M3 via

M1-M2 via

Page 6: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual cross section (XC2C32A)

Page 7: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Poly resistor

Page 8: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual poly resistor

Page 9: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Laser-trimmed film resistor

● Typically only seen in precision analog

Page 10: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

MIM capacitor

● Metal-Insulator-Metal

Page 11: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Poly (MOS) capacitor

Page 12: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual MOS cap (24C02): M1

Page 13: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual MOS cap: Poly

Page 14: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual MOS cap: Implant

Page 15: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Semiconductor doping

● Semiconductors have few free charge carriers● Add trace amounts of materials with

– Extra valence electrons (N-type): P, As

– Holes in the shell (P-type): B

● Greatly increases conductivity

Page 16: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

P-N junctions

● Forward bias (P-type higher voltage)– Charges pulled across junction

– Current flows freely

● Reverse bias (P-type lower)– Charges pulled away from junction

– No current flows

Page 17: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Small-signal diode

Current flow

Page 18: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

High-current diode

Current flow

Page 19: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual diode (SecurID 600): M2

Page 20: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual diode: M1

Page 21: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual diode: Implant

Not same diode as first two pics, that one was damaged during sample prep :(

Page 22: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

N-channel MOSFET

Page 23: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

P-channel MOSFET

Page 24: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Schematic symbols

Page 25: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual small-signal NMOS

Page 26: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Dopant stain of two PMOS

Page 27: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual pad-driver MOSFETs

Page 28: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

MOSFET cross section

Page 29: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Transistor sizing

● Lots of tricks needed to get good performance● Rds(on) of PMOS is ~2.5x NMOS● Channel width increased to compensate

Page 30: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Putting it all together: Inverter

Page 31: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Actual inverter: SID600

Page 32: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Varying drive strength

Page 33: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Standard cells

Page 34: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Standard cell routing

● Layers typically alternate X and Y axes

Page 35: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

● Demo of vectorization

Page 36: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

In-class exercise 1

Page 37: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

In-class exercise 2: Metal

Page 38: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

In class exercise 2: Poly

Page 39: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

In class exercise 2: Active

Page 40: CSCI 4974 / 6974 Hardware Reverse Engineeringsecurity.cs.rpi.edu/courses/hwre-spring2014/Lecture4... · 2014. 2. 17. · CSCI 4974 / 6974 Hardware Reverse Engineering Lecture 4: CMOS

Questions?

● TA: Andrew Zonenberg <[email protected]>

● Image credit: Some images CC-BY from:

– John McMaster <[email protected]>