This is how bare metal works. Writing the programs is the easy part, the information needed to write those programs is the hard(er) part. And there is no single answer, in this case a schematic would have been ideal, but they have been hit or miss with schematics after the first product. Sometimes you have to troll through linux sources, device tree as mentioned above, etc. Sometimes you just light up all the gpios one at a time and hope you dont smoke anything, sometimes disassemble some code that you are pretty sure talks to the thing. Or read through forums like this where someone has figured it out (or perhaps an employee or contractor with information has leaked it, not saying that happened here, but it is in the realm of possibilities, and does happen for products from time to time). You also have to assume that all documentation is wrong, not the whole document but just about every one of them for chips or peripherals has a t least one bug, if not great but so many of them do. Plus they are not all well done, or leave gaps, or make assumptions (like you work there and know something that the author knows that wasnt written down, or a document you dont have access to). Broadcom is the type of company that doesnt release anything without an NDA, and you could be a pretty big company and still not be big enough to be worthy of being a customer and thus no NDA because there is no way they will sell you parts. So what we were given was sadly not in the well done category of documentation (perhaps because they dont publish widely and thus dont know how?) or the version we got was banged out in a hurry or some other sort of haste makes waste. The community here has been awesome, on par with the avr freaks pre-arduino, there is a wiki page with errata to the documentation and this forum. You look at other similar vendors like Allwinner, whose customers tend to distribute the documentation (I would argue illegally, violating the NDA, look at the watermarks), or Nintendo (thinking GBA/NDS) where clearly someone either just gave out the docs and/or someone with the docs re-wrote them in a look what I figured out way. As with Broadcom and Allwinner chips like these that have open sourced linux drivers (or even broadcoms other product families) you can always fall back on that in combination with some hacking, if I set this bit like they do in the code does it do what the code implies it is doing or were there other things I had to do first that I have not found yet? There are some things that we never find, or in the case of 6502 things that were found decades later when they shaved the chip and took high resolution photos in order to be able to reverse engineer the chip at the transistor/metal layers, analyze and simulate it at the transistor/gate level.