This announcement from Raspberry Pi details significant updates for their second-generation microcontroller, the RP2350. Key highlights include the immediate availability of the new A4 stepping, which resolves critical errata such as a GPIO pad design flaw and several boot ROM security vulnerabilities, enhancing the device's stability and security. Additionally, Raspberry Pi introduces the RP2354, pin-compatible variants of the RP2350 that integrate 2MB of flash memory directly in-package, offering a space-saving solution for embedded applications at a minimal added cost. The company also announces a new RP2350 Hacking Challenge with a $20,000 prize, targeting side-channel attacks on its power-hardened AES library, and confirms the RP2350's official 5V tolerance.
Raspberry Pi RP2350 Updates: A4 Stepping, Integrated Flash, and New Hacking Challenge
RP2350 Overview: The RP2350 microcontroller is nearly a year old, with over half a million Pico 2 and Pico 2 W boards sold, and is widely used in third-party products.
A4 Stepping Release: Raspberry Pi has released the A4 stepping, which addresses the majority of issues found in the previous A2 stepping.
Key Fixes: Most notably, Erratum 9 (GPIO pad high-impedance state leakage) is fixed, removing the need for external pull-down resistors. Security vulnerabilities (Errata 20, 21, 24 in boot ROM, and Erratum 16 related to OTP behavior) are also patched with new defensive strategies.
Unfixed Vulnerability: An OTP bit array vulnerability (via Passive Voltage Contrast) is not fixed in A4, but an upcoming application note will describe mitigation strategies.
Software Compatibility: A4 is software-compatible with A2, requiring only minor updates to the Pico SDK (v2.2.0) and Picotool.
Production Transition: A2 production has ceased, and A4 is now the standard drop-in replacement. Some A3 units (an intermediate stepping) will be used in Pico 2/2 W products.
RP2354 Introduction: New pin-compatible RP2350 variants (RP2354A and RP2354B) are launched, featuring 2MB of Winbond flash memory stacked in-package.
Benefits: This integration simplifies design by reducing sourcing effort and PCB area, making it ideal for applications requiring modest storage.
Pricing: Each RP2354 part costs an incremental $0.20 more than its equivalent RP2350 part, with detailed pricing available for different reel sizes.
New Hacking Challenge: A second RP2350 Hacking Challenge is announced, offering a $20,000 prize for a practical side-channel attack on the power-hardened AES library used for firmware decryption during boot.
5V Tolerance: The RP2350 is now officially 5V tolerant, which is beneficial for interfacing with retro computer hardware. Users must ensure IOVDD remains powered when 5V is applied to any GPIO pad to prevent damage, and consult the updated datasheet.