The Undocumented Pi

Revision as of 13:59, 4 March 2020 by Elijah (talk | contribs) (Clocks: PLL diagram)
Jump to: navigation, search

Back to the Hub.


Hardware & Peripherals:

Hardware and Hardware History.

Low-level Peripherals and Expansion Boards.

Screens, Cases and Other Peripherals.

Software & OS Distributions:

Software and Distributions


Documentation Page

The Undocumented Pi



There is a nicely ordered table with all BCM2835_registers as found in the GPU code published by Broadcom. Unfortunately, the table does not quite match the SoC in the Raspberry Pi, but it's a good start. The sections below should serve as a companion to that table.


Clock diagram

All SoC clocks are derived from a crystal oscillator (54.0 MHz for RPi4, 19.2 MHz for all other models). RPi4 has one more oscillator (25.0 MHz), which is used by the VIA VL805 USB 3.0 host controller.

PLL block diagram

Each PLL is a fractional N frequency synthesizer that can generate N/M times the crystal oscillator frequency (XOSC). The integer part of N is controlled by the NDIV field of the A2W_PLLx_CTRL register; the fractional part is stored in A2W_PLLx_FRAC. The M refers to the PDIV field of A2W_PLLx_CTRL. There is also a pre-scaler in the feedback path, which is controlled by a bit in A2W_PLLx_ANA1 register:

  • bit 11 for PLLH
  • bit 14 for all other PLLs


There is a VCE block to accelerate video encoding/decoding. No documentation AFAIK.


The BCM2711 does not have PLLH. It also lacks the following clock muxes:

  • CCP2
  • HSM (controlled through other registers?)
  • SLIM
  • SDC (secondary SDRAM clock)
  • ARM (controlled through other registers?)
  • AVEO

It has the following extra clock mux registers (their names are just made up, because there is no official documentation):

name address type width mask reset description
CM_HEVCCTL 0x7e1011c8 RW 20 ??? 0000000000
CM_HEVCDIV 0x7e1011cc RW 24 0x00ffffff 0000000000
CM_EMMC2CTL 0x7e1011d0 RW 20 ??? 0000000000
CM_EMMC2DIV 0x7e1011d4 RW 24 0x00ffffff 0000000000
CM_GENET250CTL 0x7e1011e8 RW 20 ??? 0000000000
CM_GENET250DIV 0x7e1011ec RW 24 0x00ffffff 0000000000
CM_STB27CTL 0x7e1011f0 RW 20 ??? 0000000000
CM_STB27DIV 0x7e1011f4 RW 24 0x00ffffff 0000000000
CM_STB108CTL 0x7e101200 RW 20 ??? 0000000000
CM_STB108DIV 0x7e101204 RW 24 0x00ffffff 0000000000
CM_PIXBVBCTL 0x7e101208 RW 20 ??? 0000000000
CM_PIXBVBDIV 0x7e10120c RW 24 0x00ffffff 0000000000
CM_GENET125CTL 0x7e101210 RW 20 ??? 0000000000
CM_GENET125DIV 0x7e101214 RW 24 0x00ffffff 0000000000
CM_M2MCCTL 0x7e10122c RW 20 ??? 0000000000
CM_M2MCDIV 0x7e101230 RW 24 0x00ffffff 0000000000
CM_USBXHCICTL 0x7e10123c RW 20 ??? 0000000000
CM_USBXHCIDIV 0x7e101240 RW 24 0x00ffffff 0000000000

There is a hardware register which contains the chip version and revision (name made up again):

name address type width mask reset description
ID_CHIPREV 0x7c404000 RW 24 0xffffffff 2711xxxxxx

Bits 16..31 always contain the value 0x2711. Bits 0..7 contain the stepping, apparently encoded as two nibbles: ((letter - 'A') << 4) | digit, for example B0 gets encoded as 0x10.

The VCE block was apparently removed, but there is now a HEVC block.


The BCM2835 chip has an on-chip SMPS and an LDO for the LPDDR2 memory chip. RPi2 and RPi3 B use custom circuitry made of discrete components to do the power-up sequencing, including an NCP6343 chip (datasheet) at I²C address 0x1c. The RPi 3B+ and RPi 4B boards contain a MaxLinear MxL7704 (datasheet) at address 0x1d.

The PMIC is always on the system I²C bus (I2C8 on RPi4, I2C0 on all other devices).

See also this very informative blog post by James Adams.

Boot ROM



Clock Manager
HDMI State Machine
One-Time Programmable (memory)