Difference between revisions of "Nano 5G"
(→Components) |
|||
(13 intermediate revisions by 5 users not shown) | |||
Line 2: | Line 2: | ||
[[Image:nano_5g_bck_a.png|500px]] | [[Image:nano_5g_bck_a.png|500px]] | ||
==Components== | ==Components== | ||
− | {| | + | {| class="wikitable" |
! Label !! Component !! Part !! Markings !! Notes | ! Label !! Component !! Part !! Markings !! Notes | ||
|- | |- | ||
Line 8: | Line 8: | ||
| CPU | | CPU | ||
| Samsung S5L8730 | | Samsung S5L8730 | ||
− | | | + | | 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931 |
− | | Printed backwards on the chip - how sneaky. | + | | Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data). |
|- | |- | ||
| | | | ||
Line 20: | Line 20: | ||
| NAND Flash | | NAND Flash | ||
| Various 8/16 GB chips | | Various 8/16 GB chips | ||
+ | | TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE | ||
+ | | One example is TH58NVG6D2ELA49 visible on the iFixit Teardown | ||
+ | |- | ||
+ | | 1 | ||
+ | | Power manager | ||
+ | | Probably Dialog | ||
+ | | 338S0707, -AD, 09278HGZ | ||
+ | | Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device. | ||
+ | |- | ||
+ | | 3 | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | |- | ||
+ | | 4 | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | | | ||
+ | |- | ||
+ | | 5 | ||
+ | | Audio codec | ||
+ | | Cirrus Logic CLI1480A | ||
+ | | 338S0559, ATWV0926, SGP | ||
+ | | Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp | ||
+ | |- | ||
+ | | 6 | ||
+ | | Accelerometer | ||
+ | | [http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00213611.pdf LIS331DLM] | ||
+ | | 33DM, 2910 | ||
+ | | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names. | ||
+ | |- | ||
+ | | 7 | ||
| | | | ||
− | | | + | | |
+ | | 0630, CK9Y, 925 | ||
+ | | | ||
+ | |} | ||
+ | |||
+ | == Code Execution == | ||
+ | |||
+ | Code execution on the Nano 5G was achieved by blindly porting [[WInd3x|wInd3x]]. | ||
+ | |||
+ | == CP15 Registers == | ||
+ | |||
+ | Dump of CP15 registers from bootrom context: | ||
+ | |||
+ | {| class="wikitable" | ||
+ | ! cX !! cY !! opc2 !! Description !! Value !! Interpretation | ||
+ | |- | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | Main ID | ||
+ | | 410fb764 | ||
+ | | ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176 | ||
+ | |- | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | Cache Type | ||
+ | | 1d152152 | ||
+ | | Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word) | ||
+ | |- | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | TCM Status | ||
+ | | 00000000 | ||
+ | | No tightly coupled memory. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | 3 | ||
+ | | TLB Type | ||
+ | | 00000800 | ||
+ | | | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | Processor Feature 0 | ||
+ | | 00000111 | ||
+ | | Jazelle, Thumb1, ARM (no Thumb2) | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | Processor Feature 1 | ||
+ | | 00000011 | ||
+ | | Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 2 | ||
+ | | Debug Feature 0 | ||
+ | | 00000033 | ||
+ | | v6.1 Secure Debug, v6.1 Debug. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 3 | ||
+ | | Auxiliary Feature 0 | ||
+ | | 00000000 | ||
+ | | | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 4 | ||
+ | | Memory Model Feature 0 | ||
+ | | 01130003 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 5 | ||
+ | | Memory Model Feature 1 | ||
+ | | 10030302 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 6 | ||
+ | | Memory Model Feature 2 | ||
+ | | 01222100 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | 7 | ||
+ | | Memory Model Feature 3 | ||
+ | | 00000000 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 0 | ||
+ | | Instruction Set Feature Attribute 0 | ||
+ | | 00140011 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 1 | ||
+ | | Instruction Set Feature Attribute 1 | ||
+ | | 12002111 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 2 | ||
+ | | Instruction Set Feature Attribute 2 | ||
+ | | 11231121 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 3 | ||
+ | | Instruction Set Feature Attribute 3 | ||
+ | | 01102131 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 4 | ||
+ | | Instruction Set Feature Attribute 4 | ||
+ | | 00001141 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | 5 | ||
+ | | Instruction Set Feature Attribute 5 | ||
+ | | 00000000 | ||
+ | | Standard ARM1176JZF-S. | ||
+ | |- | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | Control | ||
+ | | 00450078 | ||
+ | | No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU. | ||
+ | |- | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | Auxiliary Control | ||
+ | | 00000007 | ||
+ | | ... | ||
+ | |- | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | Coprocessor Access Control | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | Secure Configuration | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | Secure Debug Enable | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | 2 | ||
+ | | Non-Secure Access Control | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 2 | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | Translation Table Base 0 | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 2 | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | Translation Table Base 1 | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 2 | ||
+ | | 0 | ||
+ | | 2 | ||
+ | | Translation Table Base Control | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 3 | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | Domain Access Control | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 7 | ||
+ | | 4 | ||
+ | | 0 | ||
+ | | PCA | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 7 | ||
+ | | 10 | ||
+ | | 6 | ||
+ | | Cache Dirty Status | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 0 | ||
+ | | 0 | ||
+ | | Data Cache Lockdown | ||
+ | | fffffff0 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 0 | ||
+ | | 1 | ||
+ | | Instruction Cache Lockdown | ||
+ | | fffffff0 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 1 | ||
+ | | 0 | ||
+ | | Data TCM Region | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 1 | ||
+ | | 1 | ||
+ | | Instruction TCM Region | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 1 | ||
+ | | 2 | ||
+ | | Data TCM Non-secure Control Access | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 1 | ||
+ | | 3 | ||
+ | | Instruction TCM Non-secure Control Access | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 2 | ||
+ | | 0 | ||
+ | | TCM Selection | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |- | ||
+ | | 9 | ||
+ | | 8 | ||
+ | | 0 | ||
+ | | Cache Behavior Override | ||
+ | | 00000000 | ||
+ | | ... | ||
+ | |} | ||
+ | |||
+ | == Clock Gates == | ||
+ | |||
+ | The clock gate registers are: | ||
+ | |||
+ | {| class="wikitable" | ||
+ | ! Address !! Name | ||
+ | |- | ||
+ | | 0x3C500048 | ||
+ | | GATES[0] | ||
+ | |- | ||
+ | | 0x3C50004C | ||
+ | | GATES[1] | ||
+ | |- | ||
+ | | 0x3C500058 | ||
+ | | GATES[4] | ||
+ | |- | ||
+ | | 0x3C500068 | ||
+ | | GATES[8] | ||
+ | |- | ||
+ | | 0x3C50006C | ||
+ | | GATES[9] | ||
+ | |} | ||
+ | |||
+ | GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits. | ||
+ | |||
+ | {| class="wikitable" | ||
+ | ! Function !! Register(s)/Bit(s) !! Number in BootROM | ||
+ | |- | ||
+ | | AES | ||
+ | | GATE[0][7] | ||
+ | | 7 | ||
+ | |- | ||
+ | | AMC | ||
+ | | GATE[0][3] | ||
+ | | 3 | ||
+ | |- | ||
+ | | AMC-core | ||
+ | | GATE[0][4] | ||
+ | | 4 | ||
+ | |- | ||
+ | | AMCSS | ||
+ | | GATE[1][17] | ||
+ | | 38 | ||
+ | |- | ||
+ | | ARM-core | ||
+ | | GATE[0][15] | ||
+ | | 15 | ||
+ | |- | ||
+ | | ARM-icu | ||
+ | | GATE[0][16] | ||
+ | | 16 | ||
+ | |- | ||
+ | | ARM-sleep | ||
+ | | GATE[0][20] | ||
+ | | 20 | ||
+ | |- | ||
+ | | AXI-bus | ||
+ | | GATE[1][18] | ||
+ | | 39 | ||
+ | |- | ||
+ | | AXI-spine | ||
+ | | GATE[8][13] | ||
+ | | 63 | ||
+ | |- | ||
+ | | AXI-video | ||
+ | | GATE[8][14] | ||
+ | | 64 | ||
+ | |- | ||
+ | | CAMIF | ||
+ | | GATE[0][17], GATE[8][15] | ||
+ | | 17, 65 | ||
+ | |- | ||
+ | | CEATA | ||
+ | | GATE[0][6] | ||
+ | | 6 | ||
+ | |- | ||
+ | | CLCD | ||
+ | | GATE[8][9] | ||
+ | | 59 | ||
+ | |- | ||
+ | | CLCD-OTF | ||
+ | | GATE[8][10] | ||
+ | | 60 | ||
+ | |- | ||
+ | | CSIS | ||
+ | | GATE[0][18] | ||
+ | | 18 | ||
+ | |- | ||
+ | | DDR-MIU | ||
+ | | GATE[9][17] | ||
+ | | 89 | ||
+ | |- | ||
+ | | DMAC0 | ||
+ | | GATE[0][11] | ||
+ | | 11 | ||
+ | |- | ||
+ | | DMAC1 | ||
+ | | GATE[0][12] | ||
+ | | 12 | ||
+ | |- | ||
+ | | DMAX | ||
+ | | GATE[8][8] | ||
+ | | 58 | ||
+ | |- | ||
+ | | ECC | ||
+ | | GATE[0][9] | ||
+ | | 9 | ||
+ | |- | ||
+ | | ECID | ||
+ | | GATE[1][14] | ||
+ | | 35 | ||
+ | |- | ||
+ | | FMC | ||
+ | | GATE[0][5] | ||
+ | | 5 | ||
+ | |- | ||
+ | | GPIO | ||
+ | | GATE[1][12] | ||
+ | | 33 | ||
+ | |- | ||
+ | | H264 | ||
+ | | GATE[8][2], GATE[9][18] | ||
+ | | 52, 90 | ||
+ | |- | ||
+ | | H264ENC | ||
+ | | GATE[4][7], GATE[8][16], GATE[8][17] | ||
+ | | 60, 66, 67 | ||
+ | |- | ||
+ | | IIC0 | ||
+ | | GATE[1][4], GATE[9][11] | ||
+ | | 25, 83 | ||
+ | |- | ||
+ | | IIC1 | ||
+ | | GATE[1][6], GATE[9][12] | ||
+ | | 27, 84 | ||
+ | |- | ||
+ | | IIS0 | ||
+ | | GATE[1][7] | ||
+ | | 28 | ||
+ | |- | ||
+ | | IIS1 | ||
+ | | GATE[1][10] | ||
+ | | 31 | ||
+ | |- | ||
+ | | IIS2 | ||
+ | | GATE[1][16] | ||
+ | | 37 | ||
+ | |- | ||
+ | | JPEG | ||
+ | | GATE[0][19] | ||
+ | | 19 | ||
+ | |- | ||
+ | | LCD | ||
+ | | GATE[0][1], GATE[9][16] | ||
+ | | 1, 88 | ||
+ | |- | ||
+ | | MBX-3D | ||
+ | | GATE[8][6] | ||
+ | | 56 | ||
+ | |- | ||
+ | | MBX-bus | ||
+ | | GATE[8][7] | ||
+ | | 57 | ||
+ | |- | ||
+ | | MBX-core | ||
+ | | GATE[8][5] | ||
+ | | 55 | ||
+ | |- | ||
+ | | MIPI-link | ||
+ | | GATE[1][19] | ||
+ | | 40 | ||
+ | |- | ||
+ | | MIXER | ||
+ | | GATE[8][1] | ||
+ | | 51 | ||
+ | |- | ||
+ | | MPVD | ||
+ | | GATE[8][3] | ||
+ | | 53 | ||
+ | |- | ||
+ | | PKE | ||
+ | | GATE[1][13] | ||
+ | | 34 | ||
+ | |- | ||
+ | | PL301MPVD | ||
+ | | GATE[1][21] | ||
+ | | 42 | ||
+ | |- | ||
+ | | PRNG | ||
+ | | GATE[1][0] | ||
+ | | 21 | ||
+ | |- | ||
+ | | RINGOSC | ||
+ | | GATE[4][0] | ||
+ | | 53 | ||
+ | |- | ||
+ | | SCALER | ||
+ | | GATE[8][4], GATE[9][25] | ||
+ | | 54, 97 | ||
+ | |- | ||
+ | | SDIO | ||
+ | | GATE[0][8] | ||
+ | | 8 | ||
+ | |- | ||
+ | | SHA1 | ||
+ | | GATE[0][0] | ||
+ | | 0 | ||
+ | |- | ||
+ | | SPD | ||
+ | | GATE[1][8] | ||
+ | | 29 | ||
+ | |- | ||
+ | | SPI0 | ||
+ | | GATE[1][2], GATE[9][13] | ||
+ | | 23, 85 | ||
+ | |- | ||
+ | | SPI1 | ||
+ | | GATE[1][11], GATE[9][14] | ||
+ | | 32, 86 | ||
+ | |- | ||
+ | | SPI2 | ||
+ | | GATE[1][15], GATE[9][15] | ||
+ | | 36, 87 | ||
+ | |- | ||
+ | | SPI3 | ||
+ | | GATE[4][1], GATE[9][19] | ||
+ | | 54, 91 | ||
+ | |- | ||
+ | | SPI4 | ||
+ | | GATE[4][4], GATE[9][20] | ||
+ | | 57, 92 | ||
+ | |- | ||
+ | | SWI | ||
+ | | GATE[4][2], GATE[9][21] | ||
+ | | 55, 93 | ||
+ | |- | ||
+ | | TIMER0 | ||
+ | | GATE[1][5], GATE[9][0] | ||
+ | | 26, 72 | ||
+ | |- | ||
+ | | TIMER1 | ||
+ | | GATE[1][23], GATE[9][1] | ||
+ | | 44, 73 | ||
+ | |- | ||
+ | | TIMER2 | ||
+ | | GATE[1][24], GATE[9][2] | ||
+ | | 45, 74 | ||
+ | |- | ||
+ | | TIMER3 | ||
+ | | GATE[1][25], GATE[9][3] | ||
+ | | 46, 75 | ||
+ | |- | ||
+ | | TIMER4 | ||
+ | | GATE[1][26], GATE[9][4] | ||
+ | | 47, 76 | ||
+ | |- | ||
+ | | TIMER5 | ||
+ | | GATE[1][27], GATE[9][5] | ||
+ | | 48, 77 | ||
+ | |- | ||
+ | | TIMER6 | ||
+ | | GATE[1][28], GATE[9][6] | ||
+ | | 49, 78 | ||
+ | |- | ||
+ | | TIMER7 | ||
+ | | GATE[4][5], GATE[9][22] | ||
+ | | 58, 94 | ||
+ | |- | ||
+ | | TIMER8 | ||
+ | | GATE[4][6], GATE[9][23] | ||
+ | | 59, 95 | ||
+ | |- | ||
+ | | TVOUT | ||
+ | | GATE[0][10] | ||
+ | | 10 | ||
+ | |- | ||
+ | | TW | ||
+ | | GATE[1][1] | ||
+ | | 22 | ||
+ | |- | ||
+ | | UART0 | ||
+ | | GATE[1][9], GATE[9][7] | ||
+ | | 30, 79 | ||
+ | |- | ||
+ | | UART1 | ||
+ | | GATE[1][29], GATE[9][8] | ||
+ | | 50, 80 | ||
+ | |- | ||
+ | | UART2 | ||
+ | | GATE[1][30], GATE[9][9] | ||
+ | | 51, 81 | ||
+ | |- | ||
+ | | UART3 | ||
+ | | GATE[1][31], GATE[9][10] | ||
+ | | 52, 82 | ||
+ | |- | ||
+ | | UART4 | ||
+ | | GATE[4][8], GATE[9][26] | ||
+ | | 61, 98 | ||
+ | |- | ||
+ | | USB-OTG | ||
+ | | GATE[0][2] | ||
+ | | 2 | ||
+ | |- | ||
+ | | USB2-PHY | ||
+ | | GATE[1][3] | ||
+ | | 24 | ||
+ | |- | ||
+ | | VP | ||
+ | | GATE[8][0] | ||
+ | | 50 | ||
+ | |- | ||
+ | | VROM | ||
+ | | GATE[0][13] | ||
+ | | 13 | ||
+ | |- | ||
+ | | XMC | ||
+ | | GATE[8][12] | ||
+ | | 62 | ||
|} | |} | ||
Line 29: | Line 664: | ||
Other: | Other: | ||
*http://purpleskank.wikidot.com/ipod-nano-5g | *http://purpleskank.wikidot.com/ipod-nano-5g | ||
+ | *http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271 |
Latest revision as of 18:31, 9 January 2023
Components
Label | Component | Part | Markings | Notes |
---|---|---|---|---|
2 | CPU | Samsung S5L8730 | 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931 | Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data). |
SDRAM | Integrated into the processor, similar to the iPod Touch and iPhone lines. | |||
8 | NAND Flash | Various 8/16 GB chips | TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE | One example is TH58NVG6D2ELA49 visible on the iFixit Teardown |
1 | Power manager | Probably Dialog | 338S0707, -AD, 09278HGZ | Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device. |
3 | ||||
4 | ||||
5 | Audio codec | Cirrus Logic CLI1480A | 338S0559, ATWV0926, SGP | Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp |
6 | Accelerometer | LIS331DLM | 33DM, 2910 | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names. |
7 | 0630, CK9Y, 925 |
Code Execution
Code execution on the Nano 5G was achieved by blindly porting wInd3x.
CP15 Registers
Dump of CP15 registers from bootrom context:
cX | cY | opc2 | Description | Value | Interpretation |
---|---|---|---|---|---|
0 | 0 | 0 | Main ID | 410fb764 | ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176 |
0 | 0 | 1 | Cache Type | 1d152152 | Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word) |
0 | 0 | 2 | TCM Status | 00000000 | No tightly coupled memory. |
0 | 0 | 3 | TLB Type | 00000800 | |
0 | 1 | 0 | Processor Feature 0 | 00000111 | Jazelle, Thumb1, ARM (no Thumb2) |
0 | 1 | 1 | Processor Feature 1 | 00000011 | Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model. |
0 | 1 | 2 | Debug Feature 0 | 00000033 | v6.1 Secure Debug, v6.1 Debug. |
0 | 1 | 3 | Auxiliary Feature 0 | 00000000 | |
0 | 1 | 4 | Memory Model Feature 0 | 01130003 | Standard ARM1176JZF-S. |
0 | 1 | 5 | Memory Model Feature 1 | 10030302 | Standard ARM1176JZF-S. |
0 | 1 | 6 | Memory Model Feature 2 | 01222100 | Standard ARM1176JZF-S. |
0 | 1 | 7 | Memory Model Feature 3 | 00000000 | Standard ARM1176JZF-S. |
0 | 2 | 0 | Instruction Set Feature Attribute 0 | 00140011 | Standard ARM1176JZF-S. |
0 | 2 | 1 | Instruction Set Feature Attribute 1 | 12002111 | Standard ARM1176JZF-S. |
0 | 2 | 2 | Instruction Set Feature Attribute 2 | 11231121 | Standard ARM1176JZF-S. |
0 | 2 | 3 | Instruction Set Feature Attribute 3 | 01102131 | Standard ARM1176JZF-S. |
0 | 2 | 4 | Instruction Set Feature Attribute 4 | 00001141 | Standard ARM1176JZF-S. |
0 | 2 | 5 | Instruction Set Feature Attribute 5 | 00000000 | Standard ARM1176JZF-S. |
1 | 0 | 0 | Control | 00450078 | No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU. |
1 | 0 | 1 | Auxiliary Control | 00000007 | ... |
1 | 0 | 2 | Coprocessor Access Control | 00000000 | ... |
1 | 1 | 0 | Secure Configuration | 00000000 | ... |
1 | 1 | 1 | Secure Debug Enable | 00000000 | ... |
1 | 1 | 2 | Non-Secure Access Control | 00000000 | ... |
2 | 0 | 0 | Translation Table Base 0 | 00000000 | ... |
2 | 0 | 1 | Translation Table Base 1 | 00000000 | ... |
2 | 0 | 2 | Translation Table Base Control | 00000000 | ... |
3 | 0 | 0 | Domain Access Control | 00000000 | ... |
7 | 4 | 0 | PCA | 00000000 | ... |
7 | 10 | 6 | Cache Dirty Status | 00000000 | ... |
9 | 0 | 0 | Data Cache Lockdown | fffffff0 | ... |
9 | 0 | 1 | Instruction Cache Lockdown | fffffff0 | ... |
9 | 1 | 0 | Data TCM Region | 00000000 | ... |
9 | 1 | 1 | Instruction TCM Region | 00000000 | ... |
9 | 1 | 2 | Data TCM Non-secure Control Access | 00000000 | ... |
9 | 1 | 3 | Instruction TCM Non-secure Control Access | 00000000 | ... |
9 | 2 | 0 | TCM Selection | 00000000 | ... |
9 | 8 | 0 | Cache Behavior Override | 00000000 | ... |
Clock Gates
The clock gate registers are:
Address | Name |
---|---|
0x3C500048 | GATES[0] |
0x3C50004C | GATES[1] |
0x3C500058 | GATES[4] |
0x3C500068 | GATES[8] |
0x3C50006C | GATES[9] |
GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits.
Function | Register(s)/Bit(s) | Number in BootROM |
---|---|---|
AES | GATE[0][7] | 7 |
AMC | GATE[0][3] | 3 |
AMC-core | GATE[0][4] | 4 |
AMCSS | GATE[1][17] | 38 |
ARM-core | GATE[0][15] | 15 |
ARM-icu | GATE[0][16] | 16 |
ARM-sleep | GATE[0][20] | 20 |
AXI-bus | GATE[1][18] | 39 |
AXI-spine | GATE[8][13] | 63 |
AXI-video | GATE[8][14] | 64 |
CAMIF | GATE[0][17], GATE[8][15] | 17, 65 |
CEATA | GATE[0][6] | 6 |
CLCD | GATE[8][9] | 59 |
CLCD-OTF | GATE[8][10] | 60 |
CSIS | GATE[0][18] | 18 |
DDR-MIU | GATE[9][17] | 89 |
DMAC0 | GATE[0][11] | 11 |
DMAC1 | GATE[0][12] | 12 |
DMAX | GATE[8][8] | 58 |
ECC | GATE[0][9] | 9 |
ECID | GATE[1][14] | 35 |
FMC | GATE[0][5] | 5 |
GPIO | GATE[1][12] | 33 |
H264 | GATE[8][2], GATE[9][18] | 52, 90 |
H264ENC | GATE[4][7], GATE[8][16], GATE[8][17] | 60, 66, 67 |
IIC0 | GATE[1][4], GATE[9][11] | 25, 83 |
IIC1 | GATE[1][6], GATE[9][12] | 27, 84 |
IIS0 | GATE[1][7] | 28 |
IIS1 | GATE[1][10] | 31 |
IIS2 | GATE[1][16] | 37 |
JPEG | GATE[0][19] | 19 |
LCD | GATE[0][1], GATE[9][16] | 1, 88 |
MBX-3D | GATE[8][6] | 56 |
MBX-bus | GATE[8][7] | 57 |
MBX-core | GATE[8][5] | 55 |
MIPI-link | GATE[1][19] | 40 |
MIXER | GATE[8][1] | 51 |
MPVD | GATE[8][3] | 53 |
PKE | GATE[1][13] | 34 |
PL301MPVD | GATE[1][21] | 42 |
PRNG | GATE[1][0] | 21 |
RINGOSC | GATE[4][0] | 53 |
SCALER | GATE[8][4], GATE[9][25] | 54, 97 |
SDIO | GATE[0][8] | 8 |
SHA1 | GATE[0][0] | 0 |
SPD | GATE[1][8] | 29 |
SPI0 | GATE[1][2], GATE[9][13] | 23, 85 |
SPI1 | GATE[1][11], GATE[9][14] | 32, 86 |
SPI2 | GATE[1][15], GATE[9][15] | 36, 87 |
SPI3 | GATE[4][1], GATE[9][19] | 54, 91 |
SPI4 | GATE[4][4], GATE[9][20] | 57, 92 |
SWI | GATE[4][2], GATE[9][21] | 55, 93 |
TIMER0 | GATE[1][5], GATE[9][0] | 26, 72 |
TIMER1 | GATE[1][23], GATE[9][1] | 44, 73 |
TIMER2 | GATE[1][24], GATE[9][2] | 45, 74 |
TIMER3 | GATE[1][25], GATE[9][3] | 46, 75 |
TIMER4 | GATE[1][26], GATE[9][4] | 47, 76 |
TIMER5 | GATE[1][27], GATE[9][5] | 48, 77 |
TIMER6 | GATE[1][28], GATE[9][6] | 49, 78 |
TIMER7 | GATE[4][5], GATE[9][22] | 58, 94 |
TIMER8 | GATE[4][6], GATE[9][23] | 59, 95 |
TVOUT | GATE[0][10] | 10 |
TW | GATE[1][1] | 22 |
UART0 | GATE[1][9], GATE[9][7] | 30, 79 |
UART1 | GATE[1][29], GATE[9][8] | 50, 80 |
UART2 | GATE[1][30], GATE[9][9] | 51, 81 |
UART3 | GATE[1][31], GATE[9][10] | 52, 82 |
UART4 | GATE[4][8], GATE[9][26] | 61, 98 |
USB-OTG | GATE[0][2] | 2 |
USB2-PHY | GATE[1][3] | 24 |
VP | GATE[8][0] | 50 |
VROM | GATE[0][13] | 13 |
XMC | GATE[8][12] | 62 |
Helpful pages
Teardowns:
Other: