FMSS

FMSS is seemingly the name of the flash memory controller on the S5L8702, S5L8710, S5L8720 and S5L8730.

There is no publicly available information about it, and the following has been gathered from reverse engineering RetailOS and iOS builds for the S5L8720 (iPod touch). A very similar controller is present in the S5L8700X datasheet.

Subsystems

FMC (Flash Memory Controller)

This is the component responsible for the actual bus transfers on the NAND bus.

Offset	Register Name	Description
0x000	FMCTRL0	General control register. Bit 10: MASTER_EN, bit 24: DMA_EN.
0x004	FMCTRL1	Control register used to start transfers. Bit 0: DOADDR, Bit 1: DORXDAT, Bit2: DOTXDAT.
0x008	FMCMD	NAND command number. Eg. 0x90: read NAND ID. Documented in JEDEC docs and NAND chip datasheets.
0x00C	FMADDR0	Lower bits of address to be written in NAND address transfer. See JEDEC docs and NAND chip datasheets.
0x010	FMADDR1	Higher bits of address to be written in NAND address transfer. See JEDEC docs and NAND chip datasheets.
0x02C	FMANUM	Number of bytes to transfer during address transfer minus one (ie. countdown counter).
0x030	FMDNUM	Number of bytes to transfer during data transfer minus one (ie. countdown counter).

To be documented fully.

ECC (Error Correction Code)

To be documented.

CS (Code Sequencer)

A little custom core that executes a custom bytecode. 9 32-bit general purpose registers. Controlled by the host CPU. It has access to the host memory and the rest of the FMSS peripherals, and operates by performing accesses to the FMC and ECC subsystems.

The bytecode is documented at lemonjesus/S5L8702-FMISS-Tools.

Other devices / SoCs

S5L8700X (non-Apple) and S5L8900

A similar controller is present, called simply the FMC. It has no code sequencing functionality.

On the S5L8900 the built-in CalmRISC16e core that's part of the ADM (Audio DSP Module) is used as a code sequencer in iOS.

S5L8950 / A6

The controller is called 'PPNFMSS' and seems to use the same CS bytecode, and a generally similar register layout.