https://freemyipod.org/index.php?action=history&feed=atom&title=Boot_Process 2026-04-30T07:14:21Z Revision history for this page on the wiki MediaWiki 1.45.1 https://freemyipod.org/index.php?title=Boot_Process&diff=21987&oldid=prev 2023-01-09T16:47:59Z

<p>Created page with &quot;== S5L87xx iPod Boot Process == This summarizes the boot process of Samsung S5L87XX based iPods (Nano 3G+, Classic). === BootROM === The S5L87xx SoC starts executing the ...&quot;</p> <p><b>New page</b></p><div>== S5L87xx iPod Boot Process ==<br /> <br /> This summarizes the boot process of Samsung S5L87XX based iPods (Nano 3G+, Classic).<br /> <br /> === BootROM ===<br /> <br /> The S5L87xx SoC starts executing the [[Bootrom]] at power up. The BootROM mainly lives at 0x20000000, but is also mapped to 0x00000000 as that&#039;s where the ARM core expects interrupt vectors to be present.<br /> <br /> The BootROM does the bare minimum to load a second stage: set up stacks/modes, bring up PLLs, and opens clock gates for AES/NAND/NOR/USB as needed.<br /> <br /> The bootROM then checks a few conditions (like GPIO, probably set by the clickwheel controler) to decide what to do next:<br /> <br /> # Load a second stage bootloader from NOR<br /> # Load a second stage bootloader from NAND<br /> # Start DFU mode over USB<br /> <br /> Starting DFU mode is also the fail-safe mode that the BootROM will run if other boot methods fail.<br /> <br /> The second-stage bootloader (loaded as an [[IMG1]]) is signature checked, decrypted, and executed.<br /> <br /> === Second Stage Bootloader (bootloader / WTF) ===<br /> <br /> When loaded from NAND/NOR this bootloader is referred to as &#039;bootloader&#039;. When loaded over DFU during recovery more, it&#039;s called &#039;WTF&#039;. They are pretty much the same codebase, with slight differences in the &#039;main&#039; flow of booting the next stage.<br /> <br /> The bootloader/WTF images are based around EFI, and thus quite modular. When further booting another EFI-based payload, eg. Diags, the bootloader/WTF&#039;s EFI interfaces are also available to the latter stage.<br /> <br /> This stage initializes a bunch of peripherals/subsystems, like DRAM, the LCD, UART, the interrupt controller(s), [[FTL]], ...<br /> <br /> Depending on the implementation (WTF vs. bootloader), pressed keys and other unknown conditions it will either continue booting [[OSOS]] (or diagnostics/disk mode/aupd) from NAND or go into another USB DFU mode. The WTF by default goes into USB DFU. This permits another [[IMG1]] being loaded and executed.<br /> <br /> As with the BootROM, the bootloader/DFU perform IMG1 signature checking and decryption.</div>

Q3k