5 ms·

Pi Pico 2 Extreme Teardown

178 points by coder543 2y ago

coder543 2y ago
electronupdate also published a more detailed video for the teardown: https://www.youtube.com/watch?v=vb8AB8bsQSk https://www.youtube.com/watch?v=vb8AB8bsQSk
- 70rd 2y ago
  That channel is great, would be great to find repositories of similar hacker/electronics channels, if anyone has some.
  - WatchDog 2y ago
    zeptobars for die shots https://x.com/zeptobars https://x.com/zeptobars der8auer is mostly pc hardware focused, but has some interesting videos looking at chips https://www.youtube.com/@der8auer-en https://www.youtube.com/@der8auer-en bigclivedotcom for teardowns of random electronics https://www.youtube.com/bigclivedotcom https://www.youtube.com/bigclivedotcom
  - anonymous_user9 2y ago
    https://youtube.com/@mikeselectricstuff/videos https://youtube.com/@mikeselectricstuff/videos Teardowns of biomedical/x-ray/optical machines, as well as deep dives into reverse engineering and clever electrical design.
- jsheard 2y ago
  The Pi5 southbridge was codenamed RP1, the RP2040 was RP2, and the RP2350 is apparently RP4. What might RP3 be I wonder? The boring prediction is that it's just a new southbridge for the Pi6, but one can hope they eventually split with Broadcom and do their own in-house Linux SoC which they would be able to document properly.
  - my123 2y ago
    RP3 is the Pi Zero 2 W SiP
    - jsheard 2y ago
      Oh, that's even more boring. Fingers crossed for RP5 then...
      - hhh 2y ago
        RP5 with CM5?
amelius 2y ago
Are there any methods to automatically reverse-engineer transistors and their connections from these kinds of photographs?
- mschuster91 2y ago
  Ken Shirriff regularly pops up on here with a ton of microcontroller reverse engineering [1], and IIRC he does everything by hand. [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=righto.com&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
  - nothercastle 2y ago
    Any idea if there is a way to take pcb pictures and automatically convert them into a schematic? Obviously you would have to fill in the equipment in.
    - Palomides 2y ago
      there are services that sand down PCBs layer by layer to allow electrically exact copies not viable for ICs, though
- monocasa 2y ago
  There's some automated tooling, but at least the publicly available tooling isn't great.
- jstrieb 2y ago
  This is not exactly what you're looking for, but is also pretty interesting: it's a tool for reverse engineering the bits from mask ROM photographs. https://github.com/travisgoodspeed/maskromtool https://github.com/travisgoodspeed/maskromtool
- choilive 2y ago
  Not from these types of photos, but there are computed tomography techniques that are being used to help reverse engineer chips.. not to point fingers but its somewhat of known secret that the Chinese are using CT to reverse engineer American made semiconductor designs where the IP has not been successfully exfiltrated.
IshKebab 2y ago
Sea of gates for all cores so unfortunately we can't tell the area used for RISC-V vs ARM. Anyone from Raspberry want to enlighten us?
- deleted 2y ago
  [deleted]
- NopeJason 2y ago
  A question was asked at this year's DEF CON during the "Making The DEF CON 32 Badge" talk. Luke Wren responded by saying he couldn't compare size of the ARM and RISC-V cores, but said that taking them out wouldn't make the chip die smaller. He added that he knew exactly what shape hole the core was going to fit into, and designed it to fit.
  - edm0nd 2y ago
    I didnt attend this year but was super impressed at how DEF CON and Raspberry Pi worked together on this years badge + announced the release of RP2350 on the same day DC32 started! I immediately put an order in for one and should get it pretty soon.
    - dmitrygr 2y ago
      > how DEF CON and Raspberry Pi worked together on this years badge rPi donated the chips, Entropic Engineering designed the boards, I wrote the firmware. DEFCON made the gameboy game the badge runs and designed the plastics.
  - IshKebab 2y ago
    I wonder if ARM told them not to say. Seems like an obvious question to ask and it wouldn't take that much work to get a ballpark answer.
    - Neywiny 2y ago
      ARM puts the number on their website. For a 40nm node, it's 0.028mm^2. That is configuration dependent, but it's a starting point.
RantyDave 2y ago
So the "power distribution network" bit is a big pile of standard components? Is this what you get if you show up with a big pile of verilog and say "print this"? Why do the other bits looks different?
- dragontamer 2y ago
  PDN includes the PCB itself. You need to think about the return currents closely matching. In many cases on 4 layer boards, you are required to have two Vias per... Via. (One for the forward current and a second for the reverse current). The PCB also serves as the fastest capacitor. The PCB layers itself form a capacitor measured in hundreds of Picofarads in most cases but more importantly, almost no parasitic inductance or resistance. In many cases, boards are simulated at the Maxwell equation level to understand crosstalk issues. It seems like RP2350 is just fast enough where these effects could be noticed (at the highest clock rate)
- lambda 2y ago
  Because that portion is digital. Digital is fairly immune to noise, but it can produce a lot of noise. The power distribution network can carry that noise to other components that it passes over, but because that section is all digital, it's ok, it's reasonably tolerant if it. The other portions that are uncovered have more sensitive analog circuits. You need to be more careful of how you route power, to avoid noise, so you don't cover it all in a big network on the top metal layer, but instead it's routed more selectively.
metadat 2y ago
How did they remove "the package" for this one? The usual sodium hydroxide or?
- gradschoolfail 2y ago
  My guess its laser and/or micromachining
- revax 2y ago
  Usually you use fuming nitric acid with or without sulfuric acid depending if you have copper bondings. https://www.semitracks.com/reference-material/failure-and-yield-analysis/failure-analysis-package-level/delid-and-decap.php https://www.semitracks.com/reference-material/failure-and-yi...
  - axoltl 2y ago
    In my experience just hot sulfuric acid works fairly well if you're looking to just get the die out. Just don't leave it too long or you won't have any bond pads left...
yellowapple 2y ago
> interesting: the power supply on a USB interface is fixed at 5V... why not just a 'buck' supply? > [...] > The power supply is a buck-boost from Richtek. Interesting choice as it allows the assembly to be powered from a voltage as low as 1.8V (battery use, perhaps??) That'd be consistent with how I've used the original Pi Pico in projects, yep. The Pico (and Pico 2) has VBUS and VSYS pins - VBUS being the USB port's 5V, and VSYS being intended for non-USB power sources, including batteries. The Pico 2 datasheet (https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf) has some sample schematics for three use cases: 1. A simple case where you connect the external power source to VSYS through a Shottky diode - in which case the Pico will pull from whichever of USB or VSYS has the higher voltage 2. Based on #1, except with a MOSFET instead of a Shottky diode, and with the gate connected to VBUS - in which case the Pico will not pull from VSYS when receiving USB power 3. Based on #2, except there's a battery charger between the external power source and the MOSFET, and VBUS is also connected to the charger's input - in which case the Pico will charge the battery when receiving USB power, in addition to the behavior of #2 (The datasheet also mentions an additional use case: if you're using the Pico as a USB host, you'd want to supply 5V to VBUS in order to power both the Pico and the attached device)
- ranger_danger 2y ago
  I'm not an EE, but how does #2 prevent power from traveling back into where VBUS originally came from (like a PC USB port for example)?
  - yellowapple 2y ago
    I ain't an EE, either, but I'm pretty sure the answer boils down to "that's just how transistors work". So you have: - Some external power source into the MOSFET's source pin - VBUS into the MOSFET's gate pin - The MOSFET's drain pin into VSYS And by some transistor magic that I as a lowly layman ain't privy to, the MOSFET only allows power to flow into the input/gate pins and out of the output pin, and prevents power from flowing back out of the input/gate pins. The datasheet does specify a P-channel MOSFET, so that might have something to do with it (the differences between P-channel and N-channel MOSFETs are a bit over my head). If you wanted extra assurance that power won't flow back into VBUS, you could probably stick a diode between VBUS and the MOSFET's gate pin.

178 points by coder543 2y ago

electronupdate also published a more detailed video for the teardown: https://www.youtube.com/watch?v=vb8AB8bsQSk https://www.youtube.com/watch?v=vb8AB8bsQSk

70rd 2y ago
That channel is great, would be great to find repositories of similar hacker/electronics channels, if anyone has some.
- WatchDog 2y ago
  zeptobars for die shots https://x.com/zeptobars https://x.com/zeptobars der8auer is mostly pc hardware focused, but has some interesting videos looking at chips https://www.youtube.com/@der8auer-en https://www.youtube.com/@der8auer-en bigclivedotcom for teardowns of random electronics https://www.youtube.com/bigclivedotcom https://www.youtube.com/bigclivedotcom
- anonymous_user9 2y ago
  https://youtube.com/@mikeselectricstuff/videos https://youtube.com/@mikeselectricstuff/videos Teardowns of biomedical/x-ray/optical machines, as well as deep dives into reverse engineering and clever electrical design.
jsheard 2y ago
The Pi5 southbridge was codenamed RP1, the RP2040 was RP2, and the RP2350 is apparently RP4. What might RP3 be I wonder? The boring prediction is that it's just a new southbridge for the Pi6, but one can hope they eventually split with Broadcom and do their own in-house Linux SoC which they would be able to document properly.
- my123 2y ago
  RP3 is the Pi Zero 2 W SiP
  - jsheard 2y ago
    Oh, that's even more boring. Fingers crossed for RP5 then...
    - hhh 2y ago
      RP5 with CM5?

amelius 2y ago

Are there any methods to automatically reverse-engineer transistors and their connections from these kinds of photographs?

mschuster91 2y ago
Ken Shirriff regularly pops up on here with a ton of microcontroller reverse engineering [1], and IIRC he does everything by hand. [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=righto.com&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
- nothercastle 2y ago
  Any idea if there is a way to take pcb pictures and automatically convert them into a schematic? Obviously you would have to fill in the equipment in.
  - Palomides 2y ago
    there are services that sand down PCBs layer by layer to allow electrically exact copies not viable for ICs, though
monocasa 2y ago
There's some automated tooling, but at least the publicly available tooling isn't great.
jstrieb 2y ago
This is not exactly what you're looking for, but is also pretty interesting: it's a tool for reverse engineering the bits from mask ROM photographs. https://github.com/travisgoodspeed/maskromtool https://github.com/travisgoodspeed/maskromtool
choilive 2y ago
Not from these types of photos, but there are computed tomography techniques that are being used to help reverse engineer chips.. not to point fingers but its somewhat of known secret that the Chinese are using CT to reverse engineer American made semiconductor designs where the IP has not been successfully exfiltrated.

IshKebab 2y ago

Sea of gates for all cores so unfortunately we can't tell the area used for RISC-V vs ARM. Anyone from Raspberry want to enlighten us?

deleted 2y ago
[deleted]
NopeJason 2y ago
A question was asked at this year's DEF CON during the "Making The DEF CON 32 Badge" talk. Luke Wren responded by saying he couldn't compare size of the ARM and RISC-V cores, but said that taking them out wouldn't make the chip die smaller. He added that he knew exactly what shape hole the core was going to fit into, and designed it to fit.
- edm0nd 2y ago
  I didnt attend this year but was super impressed at how DEF CON and Raspberry Pi worked together on this years badge + announced the release of RP2350 on the same day DC32 started! I immediately put an order in for one and should get it pretty soon.
  - dmitrygr 2y ago
    > how DEF CON and Raspberry Pi worked together on this years badge rPi donated the chips, Entropic Engineering designed the boards, I wrote the firmware. DEFCON made the gameboy game the badge runs and designed the plastics.
- IshKebab 2y ago
  I wonder if ARM told them not to say. Seems like an obvious question to ask and it wouldn't take that much work to get a ballpark answer.
  - Neywiny 2y ago
    ARM puts the number on their website. For a 40nm node, it's 0.028mm^2. That is configuration dependent, but it's a starting point.

RantyDave 2y ago

So the "power distribution network" bit is a big pile of standard components? Is this what you get if you show up with a big pile of verilog and say "print this"? Why do the other bits looks different?

dragontamer 2y ago
PDN includes the PCB itself. You need to think about the return currents closely matching. In many cases on 4 layer boards, you are required to have two Vias per... Via. (One for the forward current and a second for the reverse current). The PCB also serves as the fastest capacitor. The PCB layers itself form a capacitor measured in hundreds of Picofarads in most cases but more importantly, almost no parasitic inductance or resistance. In many cases, boards are simulated at the Maxwell equation level to understand crosstalk issues. It seems like RP2350 is just fast enough where these effects could be noticed (at the highest clock rate)
lambda 2y ago
Because that portion is digital. Digital is fairly immune to noise, but it can produce a lot of noise. The power distribution network can carry that noise to other components that it passes over, but because that section is all digital, it's ok, it's reasonably tolerant if it. The other portions that are uncovered have more sensitive analog circuits. You need to be more careful of how you route power, to avoid noise, so you don't cover it all in a big network on the top metal layer, but instead it's routed more selectively.

metadat 2y ago

How did they remove "the package" for this one? The usual sodium hydroxide or?

gradschoolfail 2y ago
My guess its laser and/or micromachining
revax 2y ago
Usually you use fuming nitric acid with or without sulfuric acid depending if you have copper bondings. https://www.semitracks.com/reference-material/failure-and-yield-analysis/failure-analysis-package-level/delid-and-decap.php https://www.semitracks.com/reference-material/failure-and-yi...
- axoltl 2y ago
  In my experience just hot sulfuric acid works fairly well if you're looking to just get the die out. Just don't leave it too long or you won't have any bond pads left...

yellowapple 2y ago

> interesting: the power supply on a USB interface is fixed at 5V... why not just a 'buck' supply? > [...] > The power supply is a buck-boost from Richtek. Interesting choice as it allows the assembly to be powered from a voltage as low as 1.8V (battery use, perhaps??) That'd be consistent with how I've used the original Pi Pico in projects, yep. The Pico (and Pico 2) has VBUS and VSYS pins - VBUS being the USB port's 5V, and VSYS being intended for non-USB power sources, including batteries. The Pico 2 datasheet (https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf https://datasheets.raspberrypi.com/pico/pico-2-datasheet.pdf) has some sample schematics for three use cases: 1. A simple case where you connect the external power source to VSYS through a Shottky diode - in which case the Pico will pull from whichever of USB or VSYS has the higher voltage 2. Based on #1, except with a MOSFET instead of a Shottky diode, and with the gate connected to VBUS - in which case the Pico will not pull from VSYS when receiving USB power 3. Based on #2, except there's a battery charger between the external power source and the MOSFET, and VBUS is also connected to the charger's input - in which case the Pico will charge the battery when receiving USB power, in addition to the behavior of #2 (The datasheet also mentions an additional use case: if you're using the Pico as a USB host, you'd want to supply 5V to VBUS in order to power both the Pico and the attached device)

ranger_danger 2y ago
I'm not an EE, but how does #2 prevent power from traveling back into where VBUS originally came from (like a PC USB port for example)?
- yellowapple 2y ago
  I ain't an EE, either, but I'm pretty sure the answer boils down to "that's just how transistors work". So you have: - Some external power source into the MOSFET's source pin - VBUS into the MOSFET's gate pin - The MOSFET's drain pin into VSYS And by some transistor magic that I as a lowly layman ain't privy to, the MOSFET only allows power to flow into the input/gate pins and out of the output pin, and prevents power from flowing back out of the input/gate pins. The datasheet does specify a P-channel MOSFET, so that might have something to do with it (the differences between P-channel and N-channel MOSFETs are a bit over my head). If you wanted extra assurance that power won't flow back into VBUS, you could probably stick a diode between VBUS and the MOSFET's gate pin.