The Undocumented Pi

Revision as of 15:18, 4 March 2020 by Elijah (talk | contribs) (Clocks: Use monospace for register names)
Jump to: navigation, search

Back to the Hub.


Hardware & Peripherals:

Hardware and Hardware History.

Low-level Peripherals and Expansion Boards.

Screens, Cases and Other Peripherals.

Software & OS Distributions:

Software and Distributions


Documentation Page

The Undocumented Pi



There is a nicely ordered table with all BCM2835_registers as found in the GPU code published by Broadcom. Unfortunately, the table does not quite match the SoC in the Raspberry Pi, but it's a good start. The sections below should serve as a companion to that table.


All SoC clocks are derived from a crystal oscillator (54.0 MHz for RPi4, 19.2 MHz for all other models). RPi4 has one more oscillator (25.0 MHz), which is used by the VIA VL805 USB 3.0 host controller. A diagram of the clock hierarchy:

Clock diagram

Each PLL is a fractional N frequency synthesizer that can generate N/M times the crystal oscillator frequency (XOSC). The integer part of N is controlled by the NDIV field of the A2W_PLLx_CTRL register; the fractional part is stored in A2W_PLLx_FRAC. The M refers to the PDIV field of A2W_PLLx_CTRL. There is also a prescaler in the feedback path, which is controlled by a bit in the A2W_PLLx_ANA1 register:

  • bit 11 for PLLH
  • bit 14 for all other PLLs

PLL block diagram

The loop filter is controlled by three parameters: KA, KI and KP (cf. A2W_PLLx_ANA_KAIP). It is most likely some sort of a PID controller, but it is not clear why the first coefficient is called KA and not KD. It may have some significance, though.


There is a VCE block to accelerate video encoding/decoding. No documentation AFAIK.


The BCM2711 does not have PLLH. It also lacks the following clock muxes:

  • CCP2
  • HSM (controlled through other registers?)
  • SLIM
  • SDC (secondary SDRAM clock)
  • ARM (controlled through other registers?)
  • AVEO

It has the following extra clock mux registers (their names are just made up, because there is no official documentation):

name address type width mask reset description
CM_HEVCCTL 0x7e1011c8 RW 20 ??? 0000000000
CM_HEVCDIV 0x7e1011cc RW 24 0x00ffffff 0000000000
CM_EMMC2CTL 0x7e1011d0 RW 20 ??? 0000000000
CM_EMMC2DIV 0x7e1011d4 RW 24 0x00ffffff 0000000000
CM_GENET250CTL 0x7e1011e8 RW 20 ??? 0000000000
CM_GENET250DIV 0x7e1011ec RW 24 0x00ffffff 0000000000
CM_STB27CTL 0x7e1011f0 RW 20 ??? 0000000000
CM_STB27DIV 0x7e1011f4 RW 24 0x00ffffff 0000000000
CM_STB108CTL 0x7e101200 RW 20 ??? 0000000000
CM_STB108DIV 0x7e101204 RW 24 0x00ffffff 0000000000
CM_PIXBVBCTL 0x7e101208 RW 20 ??? 0000000000
CM_PIXBVBDIV 0x7e10120c RW 24 0x00ffffff 0000000000
CM_GENET125CTL 0x7e101210 RW 20 ??? 0000000000
CM_GENET125DIV 0x7e101214 RW 24 0x00ffffff 0000000000
CM_M2MCCTL 0x7e10122c RW 20 ??? 0000000000
CM_M2MCDIV 0x7e101230 RW 24 0x00ffffff 0000000000
CM_USBXHCICTL 0x7e10123c RW 20 ??? 0000000000
CM_USBXHCIDIV 0x7e101240 RW 24 0x00ffffff 0000000000

There is a hardware register which contains the chip version and revision (name made up again):

name address type width mask reset description
ID_CHIPREV 0x7c404000 RW 24 0xffffffff 2711xxxxxx

Bits 16..31 always contain the value 0x2711. Bits 0..7 contain the stepping, apparently encoded as two nibbles: ((letter - 'A') << 4) | digit, for example B0 gets encoded as 0x10.

The VCE block was apparently removed, but there is now a HEVC block.


The BCM2835 chip has an on-chip SMPS and an LDO for the LPDDR2 memory chip. RPi2 and RPi3 B use custom circuitry made of discrete components to do the power-up sequencing, including an NCP6343 chip (datasheet) at I²C address 0x1c. The RPi 3B+ and RPi 4B boards contain a MaxLinear MxL7704 (datasheet) at address 0x1d.

The PMIC is always on the system I²C bus (I2C8 on RPi4, I2C0 on all other devices).

See also this very informative blog post by James Adams.

Boot ROM



Clock Manager
HDMI State Machine
One-Time Programmable (memory)