XMM6180

This is the baseband platform used in the iPhone 4 and iPad 2 and is build by Infineon. It uses the X-Gold 618.

The firmware is based on ThreadX, a realtime OS.

Firmware files are signed for a specific device by Apple during the restore process. As a result, the baseband will allow downgrades provided that Apple is still signing the firmware.

Main Features (according to Datasheet)

Modem

• HSDPA/HSUPA 7.2Mbps/2.9Mbps (Apple confirmed upload was 5.8Mbps)
• WCDMA: 384kbps DL/UL
• EDGE up to MSC33 with SAIC
• Speech: NB-AMR, WB-AMR

CPU

• ARM1176 @ 416MHz

Memory

• LPDDR1-SDRAM
• NOR & NAND Flash
• eSD/eMMC

Connectivity and Interfaces

• Digital RF interface V3.09
• High speed SIM card interface
• USB 2.0 HS
• 3 x USIF; 2xI2S; 2xI2C
• 3 x SD/MMC card interface

Memory Map

• 0x40FE0000-0x41000000 -- Bootloader(0x2)
• 0x40040000-0x40800000 -- Main Code(0x4)
• 0x40800000-0x41000000 -- AENEAS(0x5)
• 0x60000000-0x60200000 -- EBL(0x3)
• 0x00080000-0x00A00000 -- PSI_RAM(0x1)
• 0x40800000-0x40A00000 -- CDS(0x4)

Although the crash dump would seem to contradict this, code running from 0x60xxxxxx

Flash Files in 01.59.00

• psi_ram.fls
  • RAM bootloader?
  • 0x80000 size 0xFF00
• psi_flash.fls
  • Flash bootloader
  • 0x40FE0000 size 0x8000
• stack.fls(ICE3.fls)
  • Main baseband code
  • 0x40040000 size 0x6F7E5C
  • start vector @ 0x40040408
• ebl.fls
  • Flashing loader??
  • 0x60000000 size 0xDFB0

Known Firmware Versions

1.59.00 4.0 (Build 8A293), 4.0.1 (Build 8A306) and 4.0.2 (Build 8A400)
2.07.01 4.1 beta 1 (Build 8B5080c)
2.10.04 4.1 (Build 8B117)
3.08.00 4.2 beta 1 (Build 8C5091e)
3.09.00 4.2 beta 2 (Build 8C5101c)
3.10.01 4.2.1 (Build 8C148)
4.08.00 4.3 beta 1 (Build 8F5148b)
4.09.00 4.3 beta 2 (Build 8F5153d)
4.10.01 4.3 beta 3 (Build 8F5166b), 4.3 (Builds 8F190 and 8F191), 4.3.1 (Build 8G4), 4.3.2 (Build 8H7), 4.3.3 (Build 8J2)
4.11.04 5.0 beta 1 (Build 9A5220p)