Nano 5G

From freemyipod.org
Jump to: navigation, search

Nano 5g frt a.png Nano 5g bck a.png

Components

Label Component Part Markings Notes
2 CPU Samsung S5L8730 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931 Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data).
SDRAM Integrated into the processor, similar to the iPod Touch and iPhone lines.
8 NAND Flash Various 8/16 GB chips TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE One example is TH58NVG6D2ELA49 visible on the iFixit Teardown
1 Power manager Probably Dialog 338S0707, -AD, 09278HGZ Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.
3
4
5 Audio codec Cirrus Logic CLI1480A 338S0559, ATWV0926, SGP Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp
6 Accelerometer LIS331DLM 33DM, 2910 The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.
7 0630, CK9Y, 925

Code Execution

Code execution on the Nano 5G was achieved by blindly porting wInd3x.

CP15 Registers

Dump of CP15 registers from bootrom context:

cX cY opc2 Description Value Interpretation
0 0 0 Main ID 410fb764 ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176
0 0 1 Cache Type 1d152152 Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word)
0 0 2 TCM Status 00000000 No tightly coupled memory.
0 0 3 TLB Type 00000800
0 1 0 Processor Feature 0 00000111 Jazelle, Thumb1, ARM (no Thumb2)
0 1 1 Processor Feature 1 00000011 Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model.
0 1 2 Debug Feature 0 00000033 v6.1 Secure Debug, v6.1 Debug.
0 1 3 Auxiliary Feature 0 00000000
0 1 4 Memory Model Feature 0 01130003 Standard ARM1176JZF-S.
0 1 5 Memory Model Feature 1 10030302 Standard ARM1176JZF-S.
0 1 6 Memory Model Feature 2 01222100 Standard ARM1176JZF-S.
0 1 7 Memory Model Feature 3 00000000 Standard ARM1176JZF-S.
0 2 0 Instruction Set Feature Attribute 0 00140011 Standard ARM1176JZF-S.
0 2 1 Instruction Set Feature Attribute 1 12002111 Standard ARM1176JZF-S.
0 2 2 Instruction Set Feature Attribute 2 11231121 Standard ARM1176JZF-S.
0 2 3 Instruction Set Feature Attribute 3 01102131 Standard ARM1176JZF-S.
0 2 4 Instruction Set Feature Attribute 4 00001141 Standard ARM1176JZF-S.
0 2 5 Instruction Set Feature Attribute 5 00000000 Standard ARM1176JZF-S.
1 0 0 Control 00450078 No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU.
1 0 1 Auxiliary Control 00000007 ...
1 0 2 Coprocessor Access Control 00000000 ...
1 1 0 Secure Configuration 00000000 ...
1 1 1 Secure Debug Enable 00000000 ...
1 1 2 Non-Secure Access Control 00000000 ...
2 0 0 Translation Table Base 0 00000000 ...
2 0 1 Translation Table Base 1 00000000 ...
2 0 2 Translation Table Base Control 00000000 ...
3 0 0 Domain Access Control 00000000 ...
7 4 0 PCA 00000000 ...
7 10 6 Cache Dirty Status 00000000 ...
9 0 0 Data Cache Lockdown fffffff0 ...
9 0 1 Instruction Cache Lockdown fffffff0 ...
9 1 0 Data TCM Region 00000000 ...
9 1 1 Instruction TCM Region 00000000 ...
9 1 2 Data TCM Non-secure Control Access 00000000 ...
9 1 3 Instruction TCM Non-secure Control Access 00000000 ...
9 2 0 TCM Selection 00000000 ...
9 8 0 Cache Behavior Override 00000000 ...

Clock Gates

The clock gate registers are:

Address Name
0x3C500048 GATES[0]
0x3C50004C GATES[1]
0x3C500058 GATES[4]
0x3C500068 GATES[8]
0x3C50006C GATES[9]

GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits.

Function Register(s)/Bit(s) Number in BootROM
AES GATE[0][7] 7
AMC GATE[0][3] 3
AMC-core GATE[0][4] 4
AMCSS GATE[1][17] 38
ARM-core GATE[0][15] 15
ARM-icu GATE[0][16] 16
ARM-sleep GATE[0][20] 20
AXI-bus GATE[1][18] 39
AXI-spine GATE[8][13] 63
AXI-video GATE[8][14] 64
CAMIF GATE[0][17], GATE[8][15] 17, 65
CEATA GATE[0][6] 6
CLCD GATE[8][9] 59
CLCD-OTF GATE[8][10] 60
CSIS GATE[0][18] 18
DDR-MIU GATE[9][17] 89
DMAC0 GATE[0][11] 11
DMAC1 GATE[0][12] 12
DMAX GATE[8][8] 58
ECC GATE[0][9] 9
ECID GATE[1][14] 35
FMC GATE[0][5] 5
GPIO GATE[1][12] 33
H264 GATE[8][2], GATE[9][18] 52, 90
H264ENC GATE[4][7], GATE[8][16], GATE[8][17] 60, 66, 67
IIC0 GATE[1][4], GATE[9][11] 25, 83
IIC1 GATE[1][6], GATE[9][12] 27, 84
IIS0 GATE[1][7] 28
IIS1 GATE[1][10] 31
IIS2 GATE[1][16] 37
JPEG GATE[0][19] 19
LCD GATE[0][1], GATE[9][16] 1, 88
MBX-3D GATE[8][6] 56
MBX-bus GATE[8][7] 57
MBX-core GATE[8][5] 55
MIPI-link GATE[1][19] 40
MIXER GATE[8][1] 51
MPVD GATE[8][3] 53
PKE GATE[1][13] 34
PL301MPVD GATE[1][21] 42
PRNG GATE[1][0] 21
RINGOSC GATE[4][0] 53
SCALER GATE[8][4], GATE[9][25] 54, 97
SDIO GATE[0][8] 8
SHA1 GATE[0][0] 0
SPD GATE[1][8] 29
SPI0 GATE[1][2], GATE[9][13] 23, 85
SPI1 GATE[1][11], GATE[9][14] 32, 86
SPI2 GATE[1][15], GATE[9][15] 36, 87
SPI3 GATE[4][1], GATE[9][19] 54, 91
SPI4 GATE[4][4], GATE[9][20] 57, 92
SWI GATE[4][2], GATE[9][21] 55, 93
TIMER0 GATE[1][5], GATE[9][0] 26, 72
TIMER1 GATE[1][23], GATE[9][1] 44, 73
TIMER2 GATE[1][24], GATE[9][2] 45, 74
TIMER3 GATE[1][25], GATE[9][3] 46, 75
TIMER4 GATE[1][26], GATE[9][4] 47, 76
TIMER5 GATE[1][27], GATE[9][5] 48, 77
TIMER6 GATE[1][28], GATE[9][6] 49, 78
TIMER7 GATE[4][5], GATE[9][22] 58, 94
TIMER8 GATE[4][6], GATE[9][23] 59, 95
TVOUT GATE[0][10] 10
TW GATE[1][1] 22
UART0 GATE[1][9], GATE[9][7] 30, 79
UART1 GATE[1][29], GATE[9][8] 50, 80
UART2 GATE[1][30], GATE[9][9] 51, 81
UART3 GATE[1][31], GATE[9][10] 52, 82
UART4 GATE[4][8], GATE[9][26] 61, 98
USB-OTG GATE[0][2] 2
USB2-PHY GATE[1][3] 24
VP GATE[8][0] 50
VROM GATE[0][13] 13
XMC GATE[8][12] 62

Helpful pages

Teardowns:

Other: