View source for Nano 5G

[[Image:nano_5g_frt_a.png|500px]]
[[Image:nano_5g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 2
| CPU
| Samsung S5L8730
| 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931
| Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data).
|-
| 
| SDRAM
| 
|
| Integrated into the processor, similar to the iPod Touch and iPhone lines.
|-
| 8
| NAND Flash
| Various 8/16 GB chips
| TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE
| One example is TH58NVG6D2ELA49 visible on the iFixit Teardown
|-
| 1
| Power manager
| Probably Dialog
| 338S0707, -AD, 09278HGZ
| Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.
|-
| 3
| 
| 
| 
| 
|-
| 4
| 
| 
| 
| 
|-
| 5
| Audio codec
| Cirrus Logic CLI1480A
| 338S0559, ATWV0926, SGP
| Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp
|-
| 6
| Accelerometer
| [http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00213611.pdf LIS331DLM]
| 33DM, 2910
| The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.
|-
| 7
| 
| 
| 0630, CK9Y, 925
| 
|}

== Code Execution ==

Code execution on the Nano 5G was achieved by blindly porting [[WInd3x|wInd3x]].

== CP15 Registers ==

Dump of CP15 registers from bootrom context:

{| class="wikitable"
! cX !! cY !! opc2 !! Description !! Value !! Interpretation
|-
| 0
| 0
| 0
| Main ID
| 410fb764
| ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176
|-
| 0
| 0
| 1
| Cache Type
| 1d152152
| Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word)
|-
| 0
| 0
| 2
| TCM Status
| 00000000
| No tightly coupled memory.
|-
| 0
| 0
| 3
| TLB Type
| 00000800
|
|-
| 0
| 1
| 0
| Processor Feature 0
| 00000111
| Jazelle, Thumb1, ARM (no Thumb2)
|-
| 0
| 1
| 1
| Processor Feature 1
| 00000011
| Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model.
|-
| 0
| 1
| 2
| Debug Feature 0
| 00000033
| v6.1 Secure Debug, v6.1 Debug.
|-
| 0
| 1
| 3
| Auxiliary Feature 0
| 00000000
| 
|-
| 0
| 1
| 4
| Memory Model Feature 0
| 01130003
| Standard ARM1176JZF-S.
|-
| 0
| 1
| 5
| Memory Model Feature 1
| 10030302
| Standard ARM1176JZF-S.
|-
| 0
| 1
| 6
| Memory Model Feature 2
| 01222100
| Standard ARM1176JZF-S.
|-
| 0
| 1
| 7
| Memory Model Feature 3
| 00000000
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 0
| Instruction Set Feature Attribute 0
| 00140011
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 1
| Instruction Set Feature Attribute 1
| 12002111
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 2
| Instruction Set Feature Attribute 2
| 11231121
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 3
| Instruction Set Feature Attribute 3
| 01102131
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 4
| Instruction Set Feature Attribute 4
| 00001141
| Standard ARM1176JZF-S.
|-
| 0
| 2
| 5
| Instruction Set Feature Attribute 5
| 00000000
| Standard ARM1176JZF-S.
|-
| 1
| 0
| 0
| Control
| 00450078
| No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU.
|-
| 1
| 0
| 1
| Auxiliary Control
| 00000007
| ...
|-
| 1
| 0
| 2
| Coprocessor Access Control
| 00000000
| ...
|-
| 1
| 1
| 0
| Secure Configuration
| 00000000
| ...
|-
| 1
| 1
| 1
| Secure Debug Enable
| 00000000
| ...
|-
| 1
| 1
| 2
| Non-Secure Access Control
| 00000000
| ...
|-
| 2
| 0
| 0
| Translation Table Base 0
| 00000000
| ...
|-
| 2
| 0
| 1
| Translation Table Base 1
| 00000000
| ...
|-
| 2
| 0
| 2
| Translation Table Base Control
| 00000000
| ...
|-
| 3
| 0
| 0
| Domain Access Control
| 00000000
| ...
|-
| 7
| 4
| 0
| PCA
| 00000000
| ...
|-
| 7
| 10
| 6
| Cache Dirty Status
| 00000000
| ...
|-
| 9
| 0
| 0
| Data Cache Lockdown
| fffffff0
| ...
|-
| 9
| 0
| 1
| Instruction Cache Lockdown
| fffffff0
| ...
|-
| 9
| 1
| 0
| Data TCM Region
| 00000000
| ...
|-
| 9
| 1
| 1
| Instruction TCM Region
| 00000000
| ...
|-
| 9
| 1
| 2
| Data TCM Non-secure Control Access
| 00000000
| ...
|-
| 9
| 1
| 3
| Instruction TCM Non-secure Control Access
| 00000000
| ...
|-
| 9
| 2
| 0
| TCM Selection
| 00000000
| ...
|-
| 9
| 8
| 0
| Cache Behavior Override
| 00000000
| ...
|}

== Clock Gates ==

The clock gate registers are:

{| class="wikitable"
! Address !! Name
|-
| 0x3C500048
| GATES[0]
|-
| 0x3C50004C
| GATES[1]
|-
| 0x3C500058
| GATES[4]
|-
| 0x3C500068
| GATES[8]
|-
| 0x3C50006C
| GATES[9]
|}

GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits.

{| class="wikitable"
! Function !! Register(s)/Bit(s) !! Number in BootROM
|-
| AES
| GATE[0][7]
| 7
|-
| AMC
| GATE[0][3]
| 3
|-
| AMC-core
| GATE[0][4]
| 4
|-
| AMCSS
| GATE[1][17]
| 38
|-
| ARM-core
| GATE[0][15]
| 15
|-
| ARM-icu
| GATE[0][16]
| 16
|-
| ARM-sleep
| GATE[0][20]
| 20
|-
| AXI-bus
| GATE[1][18]
| 39
|-
| AXI-spine
| GATE[8][13]
| 63
|-
| AXI-video
| GATE[8][14]
| 64
|-
| CAMIF
| GATE[0][17], GATE[8][15]
| 17, 65
|-
| CEATA
| GATE[0][6]
| 6
|-
| CLCD
| GATE[8][9]
| 59
|-
| CLCD-OTF
| GATE[8][10]
| 60
|-
| CSIS
| GATE[0][18]
| 18
|-
| DDR-MIU
| GATE[9][17]
| 89
|-
| DMAC0
| GATE[0][11]
| 11
|-
| DMAC1
| GATE[0][12]
| 12
|-
| DMAX
| GATE[8][8]
| 58
|-
| ECC
| GATE[0][9]
| 9
|-
| ECID
| GATE[1][14]
| 35
|-
| FMC
| GATE[0][5]
| 5
|-
| GPIO
| GATE[1][12]
| 33
|-
| H264
| GATE[8][2], GATE[9][18]
| 52, 90
|-
| H264ENC
| GATE[4][7], GATE[8][16], GATE[8][17]
| 60, 66, 67
|-
| IIC0
| GATE[1][4], GATE[9][11]
| 25, 83
|-
| IIC1
| GATE[1][6], GATE[9][12]
| 27, 84
|-
| IIS0
| GATE[1][7]
| 28
|-
| IIS1
| GATE[1][10]
| 31
|-
| IIS2
| GATE[1][16]
| 37
|-
| JPEG
| GATE[0][19]
| 19
|-
| LCD
| GATE[0][1], GATE[9][16]
| 1, 88
|-
| MBX-3D
| GATE[8][6]
| 56
|-
| MBX-bus
| GATE[8][7]
| 57
|-
| MBX-core
| GATE[8][5]
| 55
|-
| MIPI-link
| GATE[1][19]
| 40
|-
| MIXER
| GATE[8][1]
| 51
|-
| MPVD
| GATE[8][3]
| 53
|-
| PKE
| GATE[1][13]
| 34
|-
| PL301MPVD
| GATE[1][21]
| 42
|-
| PRNG
| GATE[1][0]
| 21
|-
| RINGOSC
| GATE[4][0]
| 53
|-
| SCALER
| GATE[8][4], GATE[9][25]
| 54, 97
|-
| SDIO
| GATE[0][8]
| 8
|-
| SHA1
| GATE[0][0]
| 0
|-
| SPD
| GATE[1][8]
| 29
|-
| SPI0
| GATE[1][2], GATE[9][13]
| 23, 85
|-
| SPI1
| GATE[1][11], GATE[9][14]
| 32, 86
|-
| SPI2
| GATE[1][15], GATE[9][15]
| 36, 87
|-
| SPI3
| GATE[4][1], GATE[9][19]
| 54, 91
|-
| SPI4
| GATE[4][4], GATE[9][20]
| 57, 92
|-
| SWI
| GATE[4][2], GATE[9][21]
| 55, 93
|-
| TIMER0
| GATE[1][5], GATE[9][0]
| 26, 72
|-
| TIMER1
| GATE[1][23], GATE[9][1]
| 44, 73
|-
| TIMER2
| GATE[1][24], GATE[9][2]
| 45, 74
|-
| TIMER3
| GATE[1][25], GATE[9][3]
| 46, 75
|-
| TIMER4
| GATE[1][26], GATE[9][4]
| 47, 76
|-
| TIMER5
| GATE[1][27], GATE[9][5]
| 48, 77
|-
| TIMER6
| GATE[1][28], GATE[9][6]
| 49, 78
|-
| TIMER7
| GATE[4][5], GATE[9][22]
| 58, 94
|-
| TIMER8
| GATE[4][6], GATE[9][23]
| 59, 95
|-
| TVOUT
| GATE[0][10]
| 10
|-
| TW
| GATE[1][1]
| 22
|-
| UART0
| GATE[1][9], GATE[9][7]
| 30, 79
|-
| UART1
| GATE[1][29], GATE[9][8]
| 50, 80
|-
| UART2
| GATE[1][30], GATE[9][9]
| 51, 81
|-
| UART3
| GATE[1][31], GATE[9][10]
| 52, 82
|-
| UART4
| GATE[4][8], GATE[9][26]
| 61, 98
|-
| USB-OTG
| GATE[0][2]
| 2
|-
| USB2-PHY
| GATE[1][3]
| 24
|-
| VP
| GATE[8][0]
| 50
|-
| VROM
| GATE[0][13]
| 13
|-
| XMC
| GATE[8][12]
| 62
|}

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-nano-5th-Generation-Teardown/1157
Other:
*http://purpleskank.wikidot.com/ipod-nano-5g
*http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271