Deprecated: Function get_magic_quotes_gpc() is deprecated in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 99

Deprecated: The each() function is deprecated. This message will be suppressed on further calls in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 619

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1169

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 1176
8000 GitHub - schlae/cm5-reveng: Reverse engineered Raspberry Pi Compute Module 5
Nothing Special   »   [go: up one dir, main page]

Skip to content

schlae/cm5-reveng

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Reverse Engineered Raspberry Pi Compute Module 5

Board layout with all the layers turned on

This is the reverse engineered schematic and layout for a Raspberry Pi Compute Module 5. It's not meant to be fabricated--critical signal integrity parameters aren't correct, it's not 100% faithful to the original, the footprints aren't a perfect match, and the bill of materials is not reverse engineered. You also won't be able to obtain most of the chips since they are custom for this design or only available to large customers, not through a distributor.

I'm sure folks will want the schematic of the regular Pi 5, but I don't have plans to reverse engineer that.

Schematic PDF

Bonus schematic of the RM0 WiFi/Bluetooth module

Why?

I needed to solve some design issues with a project that uses one of these modules, but the schematic was not available. Fortunately, with a little reverse engineering work, I was able to back out the schematic and solve my design issues.

It's useful mainly for educational purposes or advanced hacking. For example, now that the PMIC pinout is known, the I2C register map could be explored. It's a great little part--if you accidentally blow up a CM5, you might be able to remove everything except for the PMIC, program it over I2C, and use it to power another project.

How?

I removed all the parts from the board, measured them with an LCR meter (and VNA, in the case of the ferrite beads), and then sanded down the board one layer at a time, imaging each with a flatbed scanner at 9600 DPI. KiCad layout lets you embed images which is great for tracing.

Fun Trivia

The resistors in the upper right corner that select the memory and eMMC configuration are not zero-ohm devices. Each possible position has a specific resistor value, forming a resistor divider with a 10K resistor, so that the RP1 can measure the voltage with two ADC inputs and determine the configuration.

The board has 10 layers. It is what's known as a 2+6+2 configuration since it has four layers of microvias: layer 1-2, 2-3, 8-9, and 9-10. There are buried mechanical vias from layers 2-9, and standard through-board vias from layers 1-10.

The PMIC has a hot-swap function to limit the inrush current to the >350uF of capacitance on the 5V rail. External capacitance on the carrier board is probably unnecessary.

The WiFi and Bluetooth functions can be disabled (through GPIO) from the BCM2712 as well as the connector pins. You can detect this externally by monitoring the voltages on the BT_nDISABLE and WL_nDISABLE pins.

The CM5 with onboard eMMC will not conflict with an external SD card (wired to the pins on the connector). This is because the SD pins are unconnected on this version of the module.

The original board has no designators, so the ones in this design are made up, with the exception of the test points, which are documented in the official RPi datasheet.

The 5V input goes through a hot-swap circuit with a series pass MOSFET. Since there is a test point on either side of the MOSFET and the part number is known (DMG7430LFG), you could monitor the voltage across and compute the supply current based on the MOSFET RDSON.

Board Stackup

By very carefully sanding through the board one layer at a time, I figured out the approximate stackup using digital calipers.

Layer Approximate Thickness (mm) Function
1 Cu 0.0522 Top layer
PP 0.0450
2 Cu 0.0522 Ground, PMIC LX, some signals. Reference layer for 1 and 3.
PP 0.0600
3 Cu 0.0348 Signal and power.
PP 0.1400
4 Cu 0.0348 Ground.
Core 0.0600
5 Cu 0.0522 Power, limited signal.
PP 0.1176
6 Cu 0.0522 Power.
Core 0.0600
7 Cu 0.0348 Ground.
PP 0.1400
8 Cu 0.0348 Signal and power.
PP 0.0348
9 Cu 0.0522 Ground. Reference layer for 8 and 10.
PP 0.0450
10 Cu 0.0522 Bottom layer

Updated Test Point List

The Raspberry Pi Compute Module 5 datasheet has a table of test points, but most of them are listed as "reserved." Here's a complete table. The coordinates are relative to the lower left corner of the board (if the board had a rectangular corner instead of being rounded off), increasing to the right and upwards. Note that, in the KiCad layout, the lower left corner is at 100mm x 100mm, and the Y axis is flipped, decreasing as you move up. To change a coordinate from this table to KiCad, add 100 to the X coordinate, and subtract the Y coordinate from 100.

Reference X Y NAME DESCRIPTION
MH4 51.5 36.5 Mounting Hole
MH3 3.5 36.5 Mounting Hole
MH2 51.5 3.5 Mounting Hole
MH1 3.5 3.5 Mounting Hole
TP1 14.34 17.54 +5V Raw 5V power to board.
TP2 8.8 1.3 RUN Unknown PMIC status output, possibly power good.
TP3 51.2 32.6 GND
TP4 4.8 13 PMIC INT PMIC interrupt output (likely).
TP7 24.2 7.5 GND
TP8 1.65 15.05 GND
TP9 1.5 10.05 VREF_3V3 Analog 3.3V to RP1 for ADCs.
TP10 48.4 15.1 VREG Unknown regulated voltage to RP1.
TP13 42.6 7.3 GND
TP15 14.7 6.6 VDD_0V8_LDO 0.8V LDO regulator to BCM2712.
TP16 9.3 34.9 nRPIBOOT Hold low for boot mode.
TP17 37.4 8.1 VDD_3V3_2 Secondary 3.3V rail for NOR flash and eMMC.
TP21 24.5125 14.025 nRESET_OUT BCM2712 reset output (status).
TP22 13.0875 11.225 PMIC_SIG Unknown PMIC signal. Could be for PMIC OTP programming.
TP26 17.7 20.2 GND
TP27 43.6 22.3 VDD_1V1_RP1 RP1 1.1V core voltage supply.
TP28 15.4 16 VDD_BCM_CORE BCM2712 core voltage rail. Nominally 0.8V.
TP29 23.65 21.55 VDD_0V8_BCM BCM2712 auxiliary 0.8V rail.
TP30 37.2 34.9 VDD_0V6 LPDDR4 VDDQ supply.
TP31 9.1 3.2 VDD_1V1 LPDDR4 VDD2 supply.
TP32 1.5 13 VDD_3V7_WIFI 3.7V rail for WiFi radio.
TP33 47 36 CM5_3V3 Main 3.3V supply rail.
TP34 50.5 15.5 CM5_1V8 Main 1.8V supply rail.
TP35 11 37.8 DEBUG_UART_TX Debugging UART transmit output.
TP36 8.5 37.1 DEBUG_UART_RX Debugging UART receive input.
TP39 22.1 6.1 EN_LOAD_SWITCH Enables VDD_3V3_2 and VDD_1V8_2 when asserted.
TP40 6.7 15.2 PMIC_SCL PMIC I2C bus clock.
TP41 8.7 15.3 PMIC_SDA PMIC I2C bus data.
TP42 11.4 34.9 PWR_BUT Power button signal to PMIC.
TP44 51.7 30.2 VDD_2V5_RP1 RP1 internal voltage regulator: 2.5V supply.
TP45 53.1 28.7 VDD_1V1_RP1 RP1 internal voltage regulator: 1.1V supply.
TP46 7 34.7 GND
TP48 21.6 15.4 SOC_TRST_N BCM2712 JTAG test reset input.
TP49 21.6 13.3 SOC_TDI BCM2712 JTAG test data input.
TP50 20.4 17.2 SOC_TDO BCM2712 JTAG test data output.
TP51 20.3 8.8 SOC_TMS BCM2712 JTAG test mode select.
TP52 19.9 11.9 SOC_TCK BCM2712 JTAG test clock.
TP57 53.2 32 RP1_TP Unknown RP1 signal.
TP60 48 38.7 GND
TP61 6.575 1.225 GND
TP62 22.2 31.6 GND
TP63 8.7 18.2 5V_SENSE Main board 5V rail, after hot-swap/inrush limiting MOSFET.
TP64 47.3 5.4 VDD_1V0_PHY BCM54210 internal voltage regulator: 1.0V supply.
TP65 28.2 7.5 USBC_D_N BCM2712 USB 2.0.
TP66 26.1 7.5 USBC_D_P BCM2712 USB 2.0.
TP67 7 38.6 LED_nPWR Power LED, driven by RP1.
TP68 13 37.5 LED_nACT Activity LED, driven by BCM2712.
TP69 38.8 25.9 ETH0_P
TP70 39.6 24.2 ETH0_N
TP71 43.8 14.1 ETH1_N
TP72 45.6 13.1 ETH1_P
TP73 42.4 31.7 ETH2_P
TP74 42.6 33.7 ETH2_N
TP75 41.6 37.8 ETH3_P
TP76 42.9 36.1 ETH3_N
TP77 14.37 19.52 +5V Raw 5V power to board.

RP1 Pinout Mysteries

There are some pins that have not been identified because they're not connected on the CM5:

Pin Guess
A2
B3
C2
C3
C4
D1
E3
E10
E15
F1
F2
F3
F7
G1
G2
H1
H3
H7
H17 USB 2.0?
H18 USB 2.0?
J15
J17
L13
L15
M17 USB 2.0?
M18 USB 2.0?
R4
T3
T4
T13
T14
V2
V3

Future Work

  • PCIe (BCM2712 to RP1) net identification
  • RP1 to BCM2712 net identification
  • PMIC I2C register map

License

CC BY-SA 4.0

About

Reverse engineered Raspberry Pi Compute Module 5

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published
0