#687 – The RP2350 with the Raspberry Pi Team

Welcome James Adams, Chris Boross, Liam Fraser, and Luke Wren!

• The last time the RPi team was on the show was about the RP1 (#648)


• The order of parts being released was RP2040->RP1->RP2350


• Check out the datasheet for the RP2350


• Learning from silicon


• Security and power states


• The part is a “Dual dual core”


• The Arm side is a Dual M33


• The RISC V side is a Hazard 3 processor, designed by Luke based on a previous processor called the Hazard 5


• HB5


• There is a mux on the core and you select which side you’re going to use at boot


• There are 48 GPIO (but users always want more)


• Chris Boross (first time on the show) is on the commercial team. He’s seing interesting applications for the RP2350 including devices that are using it for motor control.


• They also have seen the part used in satellites because mRAM or masked ROM is less susceptible to radiation errors


• The PIOs have changed, but are more evolutionary from the RP2040


• The PIO allows you to create state machines that process inputs without processor interventions, basically like tiny cores


• 2 cores – 8 total


• Interesting PIO applications
  
  
  
  • Luke still likes that DVI on 2040 that was discussed on the first episode they were on (#529)
  
  
  • CAN is possible
  
  
  • USB host / device
  
  
  • MII / RMII
  
  
  • ULPI – USB 2.0 Phy
  
  
  
  


• The core frequency only increased 133 MHz -> 150 MHz. There is tougher timing with the M33


• LVT – lower voltage threshhold


• 30 -> 40 pins


• There are now variants listed on the RP2350 product page (but not in mass production) that include flash in the SOM package


• RP2040 was one power domain


• “Powerman” (and of course AVR Man)


• Switched core


• AON – always on


• 32 kHz


• There is a C/C++ SDK that is the basis for other ports


• Security is a focus for the RP2350


• Bootrom in every chip


• Secure boot


• M33 features – secure / non-secure


• RISC V PMP


• RCP – Redundancy Coprocessor


• Raspberry Pi had a challenge / bounty for getting the secret out of the RP2350 OTP with secure boot


• One of the few silicon companies doing this sort of thing in public


• Past guest Aedan Cullen  was one of the hacks called “Hazardous threes”. He gave a talk about it at 38C3


• Past guest Colin O’Flynn was also mentioned because collaboration around side channel attacks with the Chip Whisperer


• IOActive used a FIB – Fine Ion Beam – and passive voltage contrast to capture an impressive image of a decapped chip (see the RPi post)


• “Never want to see ‘novel technique’ in an email”


• Improving the RP2350 silicon


• How do you decide what to fix/leave?


• Can it be changed in metal/vias?


• SIO spinlock not being fixed


• Chicken Bit


• Filler cells are reprogrammable and help with fixes


• It costs approximately $50K per layer to change (ostensibly because of the high costs of masks)


• ULA – uncommitted logic array


• Die shrink doesn’t seem to make sense


• Will keep making each chip as long as 40 nm fabs are around


• Thinking about the RP2040


• The easiest way to get started is to use a Pico (RP2040) or a Pico 2 (RP2350). Both have connectivity options as well.


• Raspberry Pi is now a public company! Doesn’t change much other than the business scrutiny.