Raspberry Pi unveils RP2350 with 5V support

Raspberry Pi has introduced a new version of its multicore RP2350 microcontroller, the RP2350 A4, to address performance and security issues while adding 5V support for industrial applications. This latest version, featuring both ARM and RISC-V cores, was unveiled by CEO Eben Upton during the eeNews Europe Elektor live round table discussion on supply chain challenges.

The initial RP2350 version, the A2, encountered problems with the GPIO pad design, preventing proper high-impedance state functioning and exposing security vulnerabilities identified during the RP2350 Hacking Challenge. The RP2350 A4 has undergone modifications to the metal layer to rectify these issues.

One significant improvement in the A4 version is the elimination of undesirable leakage in the high side of the pad, which previously required external resistors to pull inputs low. Eben Upton explained, “External resistors are no longer required to pull inputs low, though they may safely be retained in existing designs.”

Security vulnerabilities discovered during the RP2350 Hacking Challenge have been addressed in the A4 boot ROM, which now incorporates new defensive strategies to enhance security measures. Upton mentioned, “We have fixed a number of minor functional errata in the boot ROM, including a security vulnerability related to the OTP behavior during power removal.”

Looking ahead, a new hacking challenge will focus on identifying potential side-channel attacks on the AES cipher implementation used for decrypting firmware images into internal SRAM during boot time.

RP2350 5V Support

The RP2350 A4 now supports 5V supplies for industrial applications, with a caution to keep VDDIO powered when applying 5V to any GPIO pad to prevent damage. Upton emphasized the importance of referring to the updated datasheet for relevant information.

Despite the improvements in the A4 version, certain vulnerabilities remain unresolved. A winner of the Hacking Challenge exposed a vulnerability in the OTP bit array itself, demonstrating the potential for complete readback of OTP contents using Passive Voltage Contrast.

Upton acknowledged this vulnerability, stating, “An upcoming application note will provide guidance on storing secrets in OTP to mitigate current and potential future attacks.” As of now, there are no plans for an A5 version of the RP2350 microcontroller.

Raspberry Pi is also introducing pin-compatible variants of the RP2350A and RP2350B parts, named RP2354, which include 2MB of flash memory in-package. These new parts are priced just 20 cents higher than their RP2350 counterparts, offering enhanced features for users.