Imported from GitHub: schlae/cm5-reveng · commit 7fe61ca
Description
Reverse engineered Raspberry Pi Compute Module 5
README
Reverse Engineered Raspberry Pi Compute Module 5
This is the reverse engineered schematic and layout for a Raspberry Pi Compute Module 5. It's not meant to be fabricated--critical signal integrity parameters aren't correct, it's not 100% faithful to the original, the footprints aren't a perfect match, and the bill of materials is not reverse engineered. You also won't be able to obtain most of the chips since they are custom for this design or only available to large customers, not through a distributor.
I'm sure folks will want the schematic of the regular Pi 5, but I don't have plans to reverse engineer that.
Bonus schematic of the RM0 WiFi/Bluetooth module
Why?
I needed to solve some design issues with a project that uses one of these modules, but the schematic was not available. Fortunately, with a little reverse engineering work, I was able to back out the schematic and solve my design issues.
It's useful mainly for educational purposes or advanced hacking. For example, now that the PMIC pinout is known, the I2C register map could be explored. It's a great little part--if you accidentally blow up a CM5, you might be able to remove everything except for the PMIC, program it over I2C, and use it to power another project.
How?
I removed all the parts from the board, measured them with an LCR meter (and VNA, in the case of the ferrite beads), and then sanded down the board one layer at a time, imaging each with a flatbed scanner at 9600 DPI. KiCad layout lets you embed images which is great for tracing.
Fun Trivia
The resistors in the upper right corner that select the memory and eMMC configuration are not zero-ohm devices. Each possible position has a specific resistor value, forming a resistor divider with a 10K resistor, so that the RP1 can measure the voltage with two ADC inputs and determine the configuration.
The board has 10 layers. It is what's known as a 2+6+2 configuration since it has four layers of microvias: layer 1-2, 2-3, 8-9, and 9-10. There are buried mechanical vias from layers 2-9, and standard through-board vias from layers 1-10.
The PMIC has a hot-swap function to limit the inrush current to the >350uF of capacitance on the 5V rail. External capacitance on the carrier board is probably unnecessary.
The WiFi and Bluetooth functions can be disabled (through GPIO) from the BCM2712 as well as the connector pins. You can detect this externally by monitoring the voltages on the BT_nDISABLE and WL_nDISABLE pins.
The CM5 with onboard eMMC will not conflict with an external SD card (wired to the pins on the connector). This is because the SD pins are unconnected on this version of the module.
The original board has no designators, so the ones in this design are made up, with the exception of the test points, which are documented in the official RPi datasheet.
The 5V input goes through a hot-swap circuit with a series pass MOSFET. Since there is a test point on either side of the MOSFET and the part number is known (DMG7430LFG), you could monitor the voltage across and compute the supply current based on the MOSFET RDSON.
Board Stackup
By very carefully sanding through the board one layer at a time, I figured out the approximate stackup using digital calipers.
| Layer | Approximate Thickness (mm) | Function | |
|---|---|---|---|
| 1 | Cu | 0.0522 | Top layer |
| PP | 0.0450 | ||
| 2 | Cu | 0.0522 | Ground, PMIC LX, some signals. Reference layer for 1 and 3. |
| PP | 0.0600 | ||
| 3 | Cu | 0.0348 | Signal and power. |
| PP | 0.1400 | ||
| 4 | Cu | 0.0348 | Ground. |
| Core | 0.0600 | ||
| 5 | Cu | 0.0522 | Power, limited signal. |
| PP | 0.1176 | ||
| 6 | Cu | 0.0522 | Power. |
| Core | 0.0600 | ||
| 7 | Cu | 0.0348 | Ground. |
| PP | 0.1400 | ||
| 8 | Cu | 0.0348 | Signal and power. |
| PP | 0.0348 | ||
| 9 | Cu | 0.0522 | Ground. Reference layer for 8 and 10. |
| PP | 0.0450 | ||
| 10 | Cu | 0.0522 | Bottom layer |
Updated Test Point List
The Raspberry Pi Compute Module 5 datasheet has a table of test points, but most of them are listed as "reserved." Here's a complete table. The coordinates are relative to the lower left corner of the board (if the board had a rectangular corner instead of being rounded off), increasing to the right and upwards. Note that, in the KiCad layout, the lower left corner is at 100mm x 100mm, and the Y axis is flipped, decreasing as you move up. To change a coordinate from this table to KiCad, add 100 to the X coordinate, and subtract the Y coordinate from 100.
| Reference | X | Y | NAME | DESCRIPTION |
|---|---|---|---|---|
| MH4 | 51.5 | 36.5 | Mounting Hole | |
| MH3 | 3.5 | 36.5 | Mounting Hole | |
| MH2 | 51.5 | 3.5 | Mounting Hole | |
| MH1 | 3.5 | 3.5 | Mounting Hole | |
| TP1 | 14.34 | 17.54 | +5V | Raw 5V power to board. |
| TP2 | 8.8 | 1.3 | RUN | Unknown PMIC status output, possibly power good. |
| TP3 | 51.2 | 32.6 | GND | |
| TP4 | 4.8 | 13 | PMIC INT | PMIC interrupt output (likely). |
| TP7 | 24.2 | 7.5 | GND | |
| TP8 | 1.65 | 15.05 | GND | |
| TP9 | 1.5 | 10.05 | VREF_3V3 | Analog 3.3V to RP1 for ADCs. |
| TP10 | 48.4 | 15.1 | VREG | Unknown regulated voltage to RP1. |
| TP13 | 42.6 | 7.3 | GND | |
| TP15 | 14.7 | 6.6 | VDD_0V8_LDO | 0.8V LDO regulator to BCM2712. |
| TP16 | 9.3 | 34.9 | nRPIBOOT | Hold low for boot mode. |
| TP17 | 37.4 | 8.1 | VDD_3V3_2 | Secondary 3.3V rail for NOR flash and eMMC. |
| TP21 | 24.5125 | 14.025 | nRESET_OUT | BCM2712 reset output (status). |
| TP22 | 13.0875 | 11.225 | PMIC_SIG | Unknown PMIC signal. Could be for PMIC OTP programming. |
| TP26 | 17.7 | 20.2 | GND | |
| TP27 | 43.6 | 22.3 | VDD_1V1_RP1 | RP1 1.1V core voltage supply. |
| TP28 | 15.4 | 16 | VDD_BCM_CORE | BCM2712 core voltage rail. Nominally 0.8V. |
| TP29 | 23.65 | 21.55 | VDD_0V8_BCM | BCM2712 auxiliary 0.8V rail. |
| TP30 | 37.2 | 34.9 | VDD_0V6 | LPDDR4 VDDQ supply. |
| TP31 | 9.1 | 3.2 | VDD_1V1 | LPDDR4 VDD2 supply. |
| TP32 | 1.5 | 13 | VDD_3V7_WIFI | 3.7V rail for WiFi radio. |
| TP33 | 47 | 36 | CM5_3V3 | Main 3.3V supply rail. |
| TP34 | 50.5 | 15.5 | CM5_1V8 | Main 1.8V supply rail. |
| TP35 | 11 | 37.8 | DEBUG_UART_TX | Debugging UART transmit output. |
| TP36 | 8.5 | 37.1 | DEBUG_UART_RX | Debugging UART receive input. |
| TP39 | 22.1 | 6.1 | EN_LOAD_SWITCH | Enables VDD_3V3_2 and VDD_1V8_2 when asserted. |
| TP40 | 6.7 | 15.2 | PMIC_SCL | PMIC I2C bus clock. |
| TP41 | 8.7 | 15.3 | PMIC_SDA | PMIC I2C bus data. |
| TP42 | 11.4 | 34.9 | PWR_BUT | Power button signal to PMIC. |
| TP44 | 51.7 | 30.2 | VDD_2V5_RP1 | RP1 internal voltage regulator: 2.5V supply. |
| TP45 | 53.1 | 28.7 | VDD_1V1_RP1 | RP1 internal voltage regulator: 1.1V supply. |
| TP46 | 7 | 34.7 | GND | |
| TP48 | 21.6 | 15.4 | SOC_TRST_N | BCM2712 JTAG test reset input. |
| TP49 | 21.6 | 13.3 | SOC_TDI | BCM2712 JTAG test data input. |
| TP50 | 20.4 | 17.2 | SOC_TDO | BCM2712 JTAG test data output. |
| TP51 | 20.3 | 8.8 | SOC_TMS | BCM2712 JTAG test mode select. |
| TP52 | 19.9 | 11.9 | SOC_TCK | BCM2712 JTAG test clock. |
| TP57 | 53.2 | 32 | RP1_TP | Unknown RP1 signal. |
| TP60 | 48 | 38.7 | GND | |
| TP61 | 6.575 | 1.225 | GND | |
| TP62 | 22.2 | 31.6 | GND | |
| TP63 | 8.7 | 18.2 | 5V_SENSE | Main board 5V rail, after hot-swap/inrush limiting MOSFET. |
| TP64 | 47.3 | 5.4 | VDD_1V0_PHY | BCM54210 internal voltage regulator: 1.0V supply. |
| TP65 | 28.2 | 7.5 | USBC_D_N | BCM2712 USB 2.0. |
| TP66 | 26.1 | 7.5 | USBC_D_P | BCM2712 USB 2.0. |
| TP67 | 7 | 38.6 | LED_nPWR | Power LED, driven by RP1. |
| TP68 | 13 | 37.5 | LED_nACT | Activity LED, driven by BCM2712. |
| TP69 | 38.8 | 25.9 | ETH0_P | |
| TP70 | 39.6 | 24.2 | ETH0_N | |
| TP71 | 43.8 | 14.1 | ETH1_N | |
| TP72 | 45.6 | 13.1 | ETH1_P | |
| TP73 | 42.4 | 31.7 | ETH2_P | |
| TP74 | 42.6 | 33.7 | ETH2_N | |
| TP75 | 41.6 | 37.8 | ETH3_P | |
| TP76 | 42.9 | 36.1 | ETH3_N | |
| TP77 | 14.37 | 19.52 | +5V | Raw 5V power to board. |
RP1 Pinout Mysteries
There are some pins that have not been identified because they're not connected on the CM5:
| Pin | Guess |
|---|---|
| A2 | |
| B3 | |
| C2 | |
| C3 | |
| C4 | |
| D1 | |
| E3 | |
| E10 | |
| E15 | |
| F1 | |
| F2 | |
| F3 | |
| F7 | |
| G1 | |
| G2 | |
| H1 | |
| H3 | |
| H7 | |
| H17 | USB 2.0? |
| H18 | USB 2.0? |
| J15 | |
| J17 | |
| L13 | |
| L15 | |
| M17 | USB 2.0? |
| M18 | USB 2.0? |
| R4 | |
| T3 | |
| T4 | |
| T13 | |
| T14 | |
| V2 | |
| V3 |
Future Work
- PCIe (BCM2712 to RP1) net identification
- RP1 to BCM2712 net identification
- PMIC I2C register map