The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "S5L8720 (Hardware)"

From The iPhone Wiki
Jump to: navigation, search
m
Line 61: Line 61:
 
<td width=50%><center>0xFE0 through 0xFEC</center></td>
  
<td width=50%><center>0xFE0 through 0xFEC</center></td>
 
<td width=50%><center>Not sure what these four registers are, because I can confirm that at least SecureROM, probably iBoot and such too, will simply read them when initializing the vectored interrupt controller. It does nothing about the contents...I'll post a snippet from IDA in the discussion page, but if anyone knows what these do, put it here.</center></td>
  
<td width=50%><center>Not sure what these four registers are, because I can confirm that at least SecureROM, probably iBoot and such too, will simply read them when initializing the vectored interrupt controller. It does nothing about the contents...I'll post a snippet from IDA in the discussion page, but if anyone knows what these do, put it here.</center></td>
  +
</tr>
  +
</table>
  +
  +
==WDT (Watchdog Timer)==
  +
<table border=1 width=100%>
  +
<tr>
  +
<td colspan=2><center><b>Base</b>: 0x3C800000</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center><b>Register</b></center></td>
  +
<td width=50%><center><b>Description</b></center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x0</center></td>
  +
<td width=50%><center>Control Register<br><br>
  +
<b>NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000</b></center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x4</center></td>
  +
<td width=50%><center>Watchdog Timeout Duration</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0xC</center></td>
  +
<td width=50%><center>Interrupt Clear</center></td>
  +
</tr>
  +
</table>
  +
  +
==USB==
  +
===OTG-PHYCTRL===
  +
<table border=1 width=100%>
  +
<tr>
  +
<td colspan=2><center><b>Base</b>: 0x3C400000</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center><b>Register</b></center></td>
  +
<td width=50%><center><b>Description</b></center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x0</center></td>
  +
<td width=50%><center>Power Control</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x4</center></td>
  +
<td width=50%><center>Clock Control</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x8</center></td>
  +
<td width=50%><center>Reset Control</center></td>
  +
</tr>
  +
</table>
  +
  +
===OTG===
  +
<table border=1 width=100%>
  +
<tr>
  +
<td colspan=2><center><b>Base</b>: 0x38400000</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center><b>Register</b></center></td>
  +
<td width=50%><center><b>Description</b></center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x0</center></td>
  +
<td width=50%><center>Control</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x4</center></td>
  +
<td width=50%><center>Interrupt</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x8</center></td>
  +
<td width=50%><center>AHB Config</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0xC</center></td>
  +
<td width=50%><center>Core Config</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x10</center></td>
  +
<td width=50%><center>Core Reset</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x14</center></td>
  +
<td width=50%><center>Core Interrupt</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x18</center></td>
  +
<td width=50%><center>Core Interrupt Mask</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x1C and 0x20</center></td>
  +
<td width=50%><center>Rx Status Debug</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x24</center></td>
  +
<td width=50%><center>Rx FIFO Size</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x28</center></td>
  +
<td width=50%><center>Non-Periodic Transmit FIFO Size</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>TBC...</center></td>
  +
<td width=50%><center>TBC...</center></td>
  +
</tr>
  +
</table>
  +
  +
==ARM7==
  +
<table border=1 width=100%>
  +
<tr>
  +
<td colspan=2><center><b>Base</b>: 0x38600000</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center><b>Register</b></center></td>
  +
<td width=50%><center><b>Description</b></center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x100</center></td>
  +
<td width=50%><center>Running Status<br><br>
  +
<b>To halt the ARM7</b>: Write 0x0 then 0x10 to this register<br>
  +
<b>To make it resume</b>: Write 0x1 to this register</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x110</center></td>
  +
<td width=50%><center>Code Address<br><br>
  +
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7</center></td>
  +
</tr>
  +
<tr>
  +
<td width=50%><center>0x114</center></td>
  +
<td width=50%><center>"Code Waiting"<br><br>
  +
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110</center></td>
 
</tr>
  
</tr>
 
</table>
  
</table>

Revision as of 20:14, 11 February 2009

This should help people reversing iBoot and friends. It is a work in progress.

VIC (Vectored Interrupt Controller)

Base (vic0): 0x38E00000
Base (vic1): 0x38E01000
Register
Description
0x0
IRQ Status
0x4
FIQ Status
0x8
Raw Interrupt Status
0xC
Interrupt Select (0=IRQ, 1=FIQ)
0x10
Interrupt Enable (0=Disabled, 1=Enabled)
0x14
Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)
0x18
Software Interrupt (0=Disabled, 1=Enabled)
0x1C
Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)
0x20
Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.
0x24
Software Interrupt Priority Mask (0=Masked, 1=Not Masked)
0x100
Vector Addresses
0x200
Vector Priority Levels
0xFE0 through 0xFEC
Not sure what these four registers are, because I can confirm that at least SecureROM, probably iBoot and such too, will simply read them when initializing the vectored interrupt controller. It does nothing about the contents...I'll post a snippet from IDA in the discussion page, but if anyone knows what these do, put it here.

WDT (Watchdog Timer)

Base: 0x3C800000
Register
Description
0x0
Control Register

NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000
0x4
Watchdog Timeout Duration
0xC
Interrupt Clear

USB

OTG-PHYCTRL

Base: 0x3C400000
Register
Description
0x0
Power Control
0x4
Clock Control
0x8
Reset Control

OTG

Base: 0x38400000
Register
Description
0x0
Control
0x4
Interrupt
0x8
AHB Config
0xC
Core Config
0x10
Core Reset
0x14
Core Interrupt
0x18
Core Interrupt Mask
0x1C and 0x20
Rx Status Debug
0x24
Rx FIFO Size
0x28
Non-Periodic Transmit FIFO Size
TBC...
TBC...

ARM7

Base: 0x38600000
Register
Description
0x100
Running Status

To halt the ARM7: Write 0x0 then 0x10 to this register

To make it resume: Write 0x1 to this register
0x110
Code Address

To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7
0x114
"Code Waiting"

I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=S5L8720_(Hardware)&oldid=3036"