[HN Gopher] Pi Pico 2 Extreme Teardown
___________________________________________________________________
Pi Pico 2 Extreme Teardown
Author : coder543
Score : 159 points
Date : 2024-08-25 21:01 UTC (1 days ago)
(HTM) web link (electronupdate.blogspot.com)
(TXT) w3m dump (electronupdate.blogspot.com)
| coder543 wrote:
| electronupdate also published a more detailed video for the
| teardown: https://www.youtube.com/watch?v=vb8AB8bsQSk
| 70rd wrote:
| That channel is great, would be great to find repositories of
| similar hacker/electronics channels, if anyone has some.
| jsheard wrote:
| The Pi5 southbridge was codenamed RP1, the RP2040 was RP2, and
| the RP2350 is apparently RP4. What might RP3 be I wonder? The
| boring prediction is that it's just a new southbridge for the
| Pi6, but one can hope they eventually split with Broadcom and
| do their own in-house Linux SoC which they would be able to
| document properly.
| my123 wrote:
| RP3 is the Pi Zero 2 W SiP
| jsheard wrote:
| Oh, that's even more boring. Fingers crossed for RP5
| then...
| amelius wrote:
| Are there any methods to automatically reverse-engineer
| transistors and their connections from these kinds of
| photographs?
| mschuster91 wrote:
| Ken Shirriff regularly pops up on here with _a ton_ of
| microcontroller reverse engineering [1], and IIRC he does
| everything by hand.
|
| [1]
| https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
| nothercastle wrote:
| Any idea if there is a way to take pcb pictures and
| automatically convert them into a schematic? Obviously you
| would have to fill in the equipment in.
| Palomides wrote:
| there are services that sand down PCBs layer by layer to
| allow electrically exact copies
|
| not viable for ICs, though
| monocasa wrote:
| There's some automated tooling, but at least the publicly
| available tooling isn't great.
| jstrieb wrote:
| This is not exactly what you're looking for, but is also pretty
| interesting: it's a tool for reverse engineering the bits from
| mask ROM photographs.
|
| https://github.com/travisgoodspeed/maskromtool
| choilive wrote:
| Not from these types of photos, but there are computed
| tomography techniques that are being used to help reverse
| engineer chips.. not to point fingers but its somewhat of known
| secret that the Chinese are using CT to reverse engineer
| American made semiconductor designs where the IP has not been
| successfully exfiltrated.
| IshKebab wrote:
| Sea of gates for all cores so unfortunately we can't tell the
| area used for RISC-V vs ARM. Anyone from Raspberry want to
| enlighten us?
| NopeJason wrote:
| A question was asked at this year's DEF CON during the "Making
| The DEF CON 32 Badge" talk. Luke Wren responded by saying he
| couldn't compare size of the ARM and RISC-V cores, but said
| that taking them out wouldn't make the chip die smaller. He
| added that he knew exactly what shape hole the core was going
| to fit into, and designed it to fit.
| edm0nd wrote:
| I didnt attend this year but was super impressed at how DEF
| CON and Raspberry Pi worked together on this years badge +
| announced the release of RP2350 on the same day DC32 started!
|
| I immediately put an order in for one and should get it
| pretty soon.
| dmitrygr wrote:
| > how DEF CON and Raspberry Pi worked together on this
| years badge
|
| rPi donated the chips, Entropic Engineering designed the
| boards, I wrote the firmware. DEFCON made the gameboy game
| the badge runs and designed the plastics.
| IshKebab wrote:
| I wonder if ARM told them not to say. Seems like an obvious
| question to ask and it wouldn't take that much work to get a
| ballpark answer.
| Neywiny wrote:
| ARM puts the number on their website. For a 40nm node, it's
| 0.028mm^2. That is configuration dependent, but it's a
| starting point.
| Kirby64 wrote:
| It's 40nm, so the die area from the cores themselves is quite
| small. Most of the area is dedicated to RAM/ROM and IO. I'd
| guess the area for all the cores is less than 10% of total die.
| IshKebab wrote:
| You could take a look at the photos in the article and then
| make a less wildly inaccurate guess...
| Kirby64 wrote:
| Did you read the article and watch the video? He states
| (rightly) that the cores are somewhere in the "sea of gates
| mush". You can't tell visually where the cores are. And
| there's so much more than just the cores in that blob of
| gates.
| RantyDave wrote:
| So the "power distribution network" bit is a big pile of standard
| components? Is this what you get if you show up with a big pile
| of verilog and say "print this"? Why do the other bits looks
| different?
| dragontamer wrote:
| PDN includes the PCB itself.
|
| You need to think about the return currents closely matching.
| In many cases on 4 layer boards, you are required to have two
| Vias per... Via. (One for the forward current and a second for
| the reverse current).
|
| The PCB also serves as the fastest capacitor. The PCB layers
| itself form a capacitor measured in hundreds of Picofarads in
| most cases but more importantly, almost no parasitic inductance
| or resistance.
|
| In many cases, boards are simulated at the Maxwell equation
| level to understand crosstalk issues. It seems like RP2350 is
| just fast enough where these effects could be noticed (at the
| highest clock rate)
| lambda wrote:
| Because that portion is digital. Digital is fairly immune to
| noise, but it can produce a lot of noise. The power
| distribution network can carry that noise to other components
| that it passes over, but because that section is all digital,
| it's ok, it's reasonably tolerant if it.
|
| The other portions that are uncovered have more sensitive
| analog circuits. You need to be more careful of how you route
| power, to avoid noise, so you don't cover it all in a big
| network on the top metal layer, but instead it's routed more
| selectively.
| metadat wrote:
| How did they remove _" the package"_ for this one? The usual
| sodium hydroxide or?
| gradschoolfail wrote:
| My guess its laser and/or micromachining
| revax wrote:
| Usually you use fuming nitric acid with or without sulfuric
| acid depending if you have copper bondings.
|
| https://www.semitracks.com/reference-material/failure-and-yi...
| axoltl wrote:
| In my experience just hot sulfuric acid works fairly well if
| you're looking to just get the die out. Just don't leave it
| too long or you won't have any bond pads left...
| yellowapple wrote:
| > interesting: the power supply on a USB interface is fixed at
| 5V... why not just a 'buck' supply?
|
| > [...]
|
| > The power supply is a buck-boost from Richtek. Interesting
| choice as it allows the assembly to be powered from a voltage as
| low as 1.8V (battery use, perhaps??)
|
| That'd be consistent with how I've used the original Pi Pico in
| projects, yep. The Pico (and Pico 2) has VBUS and VSYS pins -
| VBUS being the USB port's 5V, and VSYS being intended for non-USB
| power sources, including batteries. The Pico 2 datasheet
| (https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf)
| has some sample schematics for three use cases:
|
| 1. A simple case where you connect the external power source to
| VSYS through a Shottky diode - in which case the Pico will pull
| from whichever of USB or VSYS has the higher voltage
|
| 2. Based on #1, except with a MOSFET instead of a Shottky diode,
| and with the gate connected to VBUS - in which case the Pico will
| not pull from VSYS when receiving USB power
|
| 3. Based on #2, except there's a battery charger between the
| external power source and the MOSFET, and VBUS is also connected
| to the charger's input - in which case the Pico will charge the
| battery when receiving USB power, in addition to the behavior of
| #2
|
| (The datasheet also mentions an additional use case: if you're
| using the Pico as a USB host, you'd want to supply 5V _to_ VBUS
| in order to power both the Pico and the attached device)
___________________________________________________________________
(page generated 2024-08-26 23:01 UTC)