FMSS
FMSS is seemingly the name of the flash memory controller on the S5L8702, S5L8710, S5L8720 and S5L8730.
There is no publicly available information about it, and the following has been gathered from reverse engineering RetailOS and iOS builds for the S5L8720 (iPod touch). A very similar controller is present in the S5L8700X datasheet.
Contents
Subsystems
FMC (Flash Memory Controller)
This is the component responsible for the actual bus transfers on the NAND bus.
| Offset | Register Name | Description |
|---|---|---|
| 0x000 | FMCTRL0 | General control register.
|
| 0x004 | FMCTRL1 | Transfer control register.
|
| 0x008 | FMCMD | NAND command number. Eg. 0x90: read NAND ID. Documented in JEDEC docs and NAND chip datasheets. |
| 0x00C | FMADDR0 | Lower bits of address to be written in NAND address transfer. See JEDEC docs and NAND chip datasheets. |
| 0x010 | FMADDR1 | Higher bits of address to be written in NAND address transfer. See JEDEC docs and NAND chip datasheets. |
| 0x02C | FMANUM | Number of bytes to transfer during address transfer minus one (ie. countdown counter). |
| 0x030 | FMDNUM | Number of bytes to transfer during data transfer minus one (ie. countdown counter). |
To be documented fully.
ECC (Error Correction Code)
To be documented.
CS (Code Sequencer)
A little custom core that executes a custom bytecode. 9 32-bit general purpose registers. Controlled by the host CPU. It has access to the host memory and the rest of the FMSS peripherals, and operates by performing accesses to the FMC and ECC subsystems.
The bytecode is documented at lemonjesus/S5L8702-FMISS-Tools.
Other devices / SoCs
S5L8700X (non-Apple) and S5L8900
A similar controller is present, called simply the FMC. It has no code sequencing functionality.
On the S5L8900 the built-in CalmRISC16e core that's part of the ADM (Audio DSP Module) is used as a code sequencer in iOS.
S5L8950 / A6
The controller is called 'PPNFMSS' and seems to use the same CS bytecode, and a generally similar register layout.
