You don't need a $20B fab to get your hands dirty.
- Magic / OpenLane: Open-source EDA flow that takes Verilog to GDS using the SkyWater 130 nm PDK. Synthesize, place-and-route, and view the layout, all on a laptop. Submit to Tiny Tapeout for actual silicon for ~$100.
- iCE40 + yosys + nextpnr: An iCE40 board (TinyFPGA, iCEBreaker, Upduino) costs under $50 and runs the open-source toolchain. Build a UART, a VGA generator, or fit a small RISC-V (PicoRV32) into iCE40-HX8K.
- Read a real chip: TechInsights publishes die photos of every flagship CPU, GPU, and SoC. Compare M3 vs M4 floorplans to see how Apple uses extra area.
- ChipWhisperer power-analysis attack: a $250 board for hands-on DPA against AES on a small target. End-to-end you see CMOS leakage exposing a key. Do not skip this exercise; it is the most direct "VLSI to security" experience available.
- Read TSMC, Samsung, Intel public process briefs: VLSI Symposium, IEDM, ISSCC papers are free and surprisingly readable.