The iPhone Wiki - User contributions [en]

S5L8720 (Hardware - SHA1)

2009-04-30T17:21:43Z

1am3r: /* Programming Guide */

==S5L8720 SHA-1 Hardware==
Base Address: 0x38000000

===Programming Guide===
As there is no real documentation of the hardware (The Samsung S3C6400X seams to use a very similar SHA-1 generator, but not the same), this is based on what [[iBoot]] does and on a lot of trial-and-error.
====How it works====
Basically it is like a hardware version of a SHA-1 algorithm. The hardware processes data in 512Bit (64 Bytes) chunks (Just like a software algorithm). 
It does NO pre-processing (appending a '1' Bit to the data, pad the data so that the length mod 512 is 448, and append the bit-length of the data as a 64-bit big-endian integer). 
This has to be done in software.

====Calculating the SHA-1 of a message====
# Prepare the message as usual. See [http://en.wikipedia.org/wiki/SHA_hash_functions Wikipedia on SHA]
# Switch on the clock for the SHA-1 generator
# Reset the generator. To do this set bit 0 of reset register and clear it afterwards (iBoot waits until the hash is ready before resetting it)
# Clear (Write 0) to the Configuration Register (Not sure if this is needed as it already reads 0 after resetting, but iBoot does it)
# Clear register 0x80 and 0x10 (Also not sure why, as they also read 0)
# Write 64 bytes of the message to the data input registers starting at the lowest
# If this were the the first 64 bytes clear bit 3 in the Configuration register, else set it
# Set bit 1 (Start Hash) of the Configuration register and wait until bit 0 (Hash Busy) is cleared
# If more data to hash go to point 6
# Read the calculated hash of the Output SHA-1 Hash registers
# Switch off the clock

==Registers==
===Register Summary===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Register</td>
<td>Description</td>
</tr>
<tr>
<td align=left width=100pix>0x00</td>
<td align=left>Configuration</td>
</tr>
<tr>
<td align=left width=100pix>0x04</td>
<td align=left>Reset</td>
</tr>
<tr>
<td align=left width=100pix>0x08</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x0C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x10</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x20 - 0x30</td>
<td align=left>Output SHA-1 hash / Input Initialization Vector</td>
</tr>
<tr>
<td align=left width=100pix>0x40 - 0x7C</td>
<td align=left>Data Input (64 Bytes)</td>
</tr>
<tr>
<td align=left width=100pix>0x80</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x84</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x8C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
</table>

===Configuration Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Hash Busy. Is set when the hash calculation is started and cleared when the generator is done.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 1</td>
<td align=left>Start Hash. Set to 1 to start hashing of the data in the Input Data registers.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 2</td>
<td align=left>Unknown</td>
</tr>
<tr>
<td align=left width=100pix>Bit 3</td>
<td align=left>Config IV. Use arbitary IV (=1), Use SHA-1 constants (=0) (Used for starting a new hash (=0), or continue a previous one (=1)).</td>
</tr>
</table>
All other bits are unknown or not used

===Reset Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Reset Hash. Resets the generator and all registers.</td>
</tr>
</table>
All other bits are unknown or not used

===Hash Out / IV In===
Read: Outputs the hash in little-endian 
Write: Set the initialization vectors

===Data Input===
Read: Read what was previously written there (like normal RAM) 
Write: The current 64 byte data chunk to calculate the hash of. (little-endian)

S5L8720 (Hardware - SHA1)

2009-04-09T09:44:48Z

1am3r:

==S5L8720 SHA-1 Hardware==
Base Address: 0x38000000

===Programming Guide===
As i have no real documentation of the hardware (The Samsung S3C6400X seams to use a very similar SHA-1 generator, but not the same), this is based on what [[iBoot]] does and what i found out by trying myself.
====How it works====
Basically it is like a hardware version of a SHA-1 algorithm. The hardware processes data in 512Bit (64 Bytes) chunks (Just like a software algorithm). 
It does NO pre-processing (appending a '1' Bit to the data, pad the data so that the length mod 512 is 448, and append the bit-length of the data as a 64-bit big-endian integer). 
This has to be done in software.

====Calculating the SHA-1 of a message====
# Prepare the message as usual. See [http://en.wikipedia.org/wiki/SHA_hash_functions Wikipedia on SHA]
# Switch on the clock for the SHA-1 generator
# Reset the generator. To do this set bit 0 of reset register and clear it afterwards (iBoot waits until the hash is ready before resetting it)
# Clear (Write 0) to the Configuration Register (Not sure if this is needed as it already reads 0 after resetting, but iBoot does it)
# Clear register 0x80 and 0x10 (Also not sure why, as they also read 0)
# Write 64 bytes of the message to the data input registers starting at the lowest
# If this were the the first 64 bytes clear bit 3 in the Configuration register, else set it
# Set bit 1 (Start Hash) of the Configuration register and wait until bit 0 (Hash Busy) is cleared
# If more data to hash go to point 6
# Read the calculated hash of the Output SHA-1 Hash registers
# Switch off the clock

==Registers==
===Register Summary===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Register</td>
<td>Description</td>
</tr>
<tr>
<td align=left width=100pix>0x00</td>
<td align=left>Configuration</td>
</tr>
<tr>
<td align=left width=100pix>0x04</td>
<td align=left>Reset</td>
</tr>
<tr>
<td align=left width=100pix>0x08</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x0C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x10</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x20 - 0x30</td>
<td align=left>Output SHA-1 hash / Input Initialization Vector</td>
</tr>
<tr>
<td align=left width=100pix>0x40 - 0x7C</td>
<td align=left>Data Input (64 Bytes)</td>
</tr>
<tr>
<td align=left width=100pix>0x80</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x84</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x8C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
</table>

===Configuration Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Hash Busy. Is set when the hash calculation is started and cleared when the generator is done.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 1</td>
<td align=left>Start Hash. Set to 1 to start hashing of the data in the Input Data registers.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 2</td>
<td align=left>Unknown</td>
</tr>
<tr>
<td align=left width=100pix>Bit 3</td>
<td align=left>Config IV. Use arbitary IV (=1), Use SHA-1 constants (=0) (Used for starting a new hash (=0), or continue a previous one (=1)).</td>
</tr>
</table>
All other bits are unknown or not used

===Reset Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Reset Hash. Resets the generator and all registers.</td>
</tr>
</table>
All other bits are unknown or not used

===Hash Out / IV In===
Read: Outputs the hash in little-endian 
Write: Set the initialization vectors

===Data Input===
Read: Read what was previously written there (like normal RAM) 
Write: The current 64 byte data chunk to calculate the hash of. (little-endian)

Talk:S5L8720 (Hardware - SHA1)

2009-04-08T18:15:36Z

1am3r: New page: ===iBoot functions=== Is it allowed to post reverse engineered functions of iBoot, and/or is it of some help? ~~~~

===iBoot functions===
Is it allowed to post reverse engineered functions of iBoot, and/or is it of some help? 
[[User:1am3r|1am3r]] 18:15, 8 April 2009 (UTC)

S5L8720 (Hardware - SHA1)

2009-04-08T18:10:49Z

1am3r: New page describing the sha-1 hardware in detail

==S5L8720 SHA-1 Hardware==
Base Address: 0x38000000

===Programming Guide===
As i have no real documentation of the hardware (The Samsung S3C6400X seams to use a very similar SHA-1 generator, but not the same), this is based on what iBoot does and what i found out by trying myself.
====How it works====
Basically it is like a hardware version of a SHA-1 algorithm. The hardware processes data in 512Bit (64 Bytes) chunks (Just like a software algorithm). 
It does NO pre-processing (appending a '1' Bit to the data, pad the data so that the length mod 512 is 448, and append the bit-length of the data as a 64-bit big-endian integer). 
This has to be done in software.

====Calculating the SHA-1 of a message====
# Prepare the message as usual. See [http://en.wikipedia.org/wiki/SHA_hash_functions Wikipedia on SHA]
# Switch on the clock for the SHA-1 generator
# Reset the generator. To do this set bit 0 of reset register and clear it afterwards (iBoot waits until the hash is ready before resetting it)
# Clear (Write 0) to the Configuration Register (Not sure if this is needed as it already reads 0 after resetting, but iBoot does it)
# Clear register 0x80 and 0x10 (Also not sure why, as they also read 0)
# Write 64 bytes of the message to the data input registers starting at the lowest
# If this were the the first 64 bytes clear bit 3 in the Configuration register, else set it
# Set bit 1 (Start Hash) of the Configuration register and wait until bit 0 (Hash Busy) is cleared
# If more data to hash go to point 6
# Read the calculated hash of the Output SHA-1 Hash registers
# Switch off the clock

==Registers==
===Register Summary===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Register</td>
<td>Description</td>
</tr>
<tr>
<td align=left width=100pix>0x00</td>
<td align=left>Configuration</td>
</tr>
<tr>
<td align=left width=100pix>0x04</td>
<td align=left>Reset</td>
</tr>
<tr>
<td align=left width=100pix>0x08</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x0C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x10</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x20 - 0x30</td>
<td align=left>Output SHA-1 hash / Input Initialization Vector</td>
</tr>
<tr>
<td align=left width=100pix>0x40 - 0x7C</td>
<td align=left>Data Input (64 Bytes)</td>
</tr>
<tr>
<td align=left width=100pix>0x80</td>
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td>
</tr>
<tr>
<td align=left width=100pix>0x84</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
<tr>
<td align=left width=100pix>0x8C</td>
<td align=left>Unknown, but referenced in iBoot</td>
</tr>
</table>

===Configuration Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Hash Busy. Is set when the hash calculation is started and cleared when the generator is done.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 1</td>
<td align=left>Start Hash. Set to 1 to start hashing of the data in the Input Data registers.</td>
</tr>
<tr>
<td align=left width=100pix>Bit 2</td>
<td align=left>Unknown</td>
</tr>
<tr>
<td align=left width=100pix>Bit 3</td>
<td align=left>Config IV. Use arbitary IV (=1), Use SHA-1 constants (=0) (Used for starting a new hash (=0), or continue a previous one (=1)).</td>
</tr>
</table>
All other bits are unknown or not used

===Reset Register===
<table border=1 width=100%>
<tr>
<td align=left width=100pix>Bit</td>
<td>Function</td>
</tr>
<tr>
<td align=left width=100pix>Bit 0</td>
<td align=left>Reset Hash. Resets the generator and all registers.</td>
</tr>
</table>
All other bits are unknown or not used

===Hash Out / IV In===
Read: Outputs the hash in little-endian 
Write: Set the initialization vectors

===Data Input===
Read: Read what was previously written there (like normal RAM) 
Write: The current 64 byte data chunk to calculate the hash of. (little-endian)

S5L8720 (Hardware)

2009-04-08T16:43:37Z

1am3r: /* SHA1 */ Added some registers and a link to the detailed description

This should help people reversing iBoot and friends. It is a work in progress.

==SHA1==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38000000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x00</center></td>
<td width=50%><center>Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x04</center></td>
<td width=50%><center>Setup</center></td>
</tr>
<tr>
<td width=50%><center>0x20 through 0x30</center></td>
<td width=50%><center>Output SHA1 hash</center></td>
</tr>
<tr>
<td width=50%><center>0x40 through 0x7C</center></td>
<td width=50%><center>Data Input (64 Bytes)</center></td>
</tr>
</table>
See [[S5L8720 (Hardware) SHA1|S5L8720 SHA1]] for a more detailed description

==DMA (PL080)==
This appears to use an ARM PrimeCell PL080. You can read the technical reference manual [http://www.mediafire.com/download.php?mjy2m1do0jg here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base (dmac0): 0x38200000 Base (dmac1): 0x39900000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>TC Status (If HIGH, transaction complete)</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>TC Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Error Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Error Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>TC Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Error Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>DMA Channels Enabled</center></td>
</tr>
<tr>
<td width=50%><center>0x30</center></td>
<td width=50%><center>Controller Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x34</center></td>
<td width=50%><center>Enable / Disable Synchronization</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Channel 0 Source Address</center></td>
</tr>
<tr>
<td width=50%><center>0x104</center></td>
<td width=50%><center>Channel 0 Destination Address</center></td>
</tr>
<tr>
<td width=50%><center>0x108</center></td>
<td width=50%><center>Channel 0 Linked List Address</center></td>
</tr>
<tr>
<td width=50%><center>0x10C</center></td>
<td width=50%><center>Channel 0 Control 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Channel 0 Control 2</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>Channel 0 Configuration</center></td>
</tr>
</table>

==VIC (PL192)==
This appears to use an ARM PrimeCell PL192. You can read the technical reference manual [http://www.mediafire.com/download.php?mmjdnud0iuz here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (vic0): 0x38E00000 
Base (vic1): 0x38E01000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>IRQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>FIQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Raw Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Select (0=IRQ, 1=FIQ)</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Interrupt Enable (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Software Interrupt (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x20</center></td>
<td width=50%><center>Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.</center></td>
</tr>
<tr>
<td width=50%><center>0x24</center></td>
<td width=50%><center>Software Interrupt Priority Mask (0=Masked, 1=Not Masked)</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Vector Addresses</center></td>
</tr>
<tr>
<td width=50%><center>0x200</center></td>
<td width=50%><center>Vector Priority Levels</center></td>
</tr>
<tr>
<td width=50%><center>0xFE0 through 0xFEC</center></td>
<td width=50%><center>Peripheral Identification Registers 
Part Number 
Bits 7 through 0 of register 0xFE0 is one portion of the part number (0x92), then bits 3 through 0 of register 0xFE4 is the other portion of it (0x1). If you do some annoying shifting, to put it together, you get 0x192 (0x92|0x11<<8&0xFFF==0x192). 0x192 indicates that it is an ARM PrimeCell PL192. 
Designer 
Bits 7 through 4 of register 0xFE4 is one portion of the designer tag (0x1), then bits 3 through 0 of register 0xFE8 is the other portion of it (0x4). Like above, we can do (0x11 | 0x4<<4) and we get 0x41, which is "A" in ASCII, meaning it was designed by ARM Limited. 
Revision Number 
Unlike the above two, this one is pretty easy. Bits 7 through 4 of register 0xFE8 is the revision number, which is "0" at least for the iPod touch 2G. 
Configuration 
The reference manual simply states that bits 7 through 2 should read back as 0, and nothing more about them. It also states that bits 1 through 0 indicate the number of interrupts supported, which appear to be 32 for the iPod touch 2G ('''0b00=32 Supported''', 0b01=64 Supported, 0b10=128 Supported, 0b11=256 Supported). 
</center></td>
</tr>
<tr>
<td width=50%><center>0xFF0 through 0xFFC</center></td>
<td width=50%><center>PrimeCell Identification Registers 
Register 0xFF0: Should read as 0x0D 
Register 0xFF4: Should read as 0xF0 
Register 0xFF8: Should read as 0x05 
Register 0xFFC: Should read as 0xB1</center></td>
</tr>
</table>

==CHIPID==
All information here was gathered by reversing iBoot and friends.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3D100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Unused & Unreferenced Register</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Not yet documented</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Chip Info 
Chip ID: Bits 31 through 16 (0x8720, meaning it is an [[S5L8720]]) 
SCEP: Bits 15 through 1 (0x01) 
</center></td>
</tr>
</table>

==WDT (Watchdog Timer)==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3C800000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Control Register 
NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Watchdog Timeout Duration</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Clear</center></td>
</tr>
</table>

==Timers==
See separate article [[S5L8720 Timers (Hardware)]]

==ARM7 (Second CPU)==
All information here was gathered by looking at the code for the [[ARM7 Go]] command, as well as noting that although 2.1.1 iBoots reference this as 0xB8600000, 0x80000000 through 0xFFFFFFFF is mapped to 0x0 through 0x7FFFFFFF when the MMU does it's stuff.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38600000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Running Status 
To halt the ARM7: Write 0x0 then 0x10 to this register 
To make it resume: Write 0x1 to this register</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Code Address 
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>"Code Waiting" 
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110</center></td>
</tr>
</table>

==UART==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (uart0 - Serial): 0x3CC00000 
Base (uart1 - Bluetooth): 0x3DB00000 
Base (uart2): 0x3DC00000 
Base (uart3): 0x3DD00000 </center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==SPI==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (spi0 - NOR Flash): 0x3C300000 
Base (spi1 - NOR Flash): 0x3CE00000 
Base (spi2): 0x3D200000 
Base (spi3): 0x3DA00000 
Base (spi4 - Multi Touch): 0x3E100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==Links==
* [http://github.com/planetbeing/iphonelinux/tree/27b57ac836053d59421a02755920b5be6b1e7805/openiboot OpeniBoot]
* [http://code.google.com/p/chronicdev/wiki/N72APDevTree Decoded iPod touch 2G DevTree]

S5L8720 Timers (Hardware)

2009-03-30T19:08:27Z

1am3r: /* IRQ Status Register */

==S5L8720 Timer Hardware==
Base Address: 0x3C700000

==Common Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|align="left" width="100px" |0x118
|align="left" |Timer 4-7 IRQ Status, write to clear interrupt request
|}

====IRQ Status Register (0x118)====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|2-0||R||Timer 7 Flags (execute handler 1 to 3)
|-
|7-3||x||No Function / Unknown
|-
|10-8||R||Timer 6 Flags (execute handler 1 to 3)
|-
|15-11||x||No Function / Unknown
|-
|18-16||R||Timer 5 Flags (execute handler 1 to 3)
|-
|23-19||x||No Function / Unknown
|-
|26-24||R||Timer 4 Flags (execute handler 1 to 3)
|-
|31-27||x||No Function / Unknown
|}
RW: Read/Write Access, x: Don't know

==RTC Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|0x80
|RTC Ticks High
|-
|0x84
|RTC Ticks Low
|-
|0x88
|On init: 0xA, then after the others: 0x18010
|-
|0x8C
|On init: 0xFFFFFFFF
|-
|0x90
|On init: 0xFFFFFFFF
|-
|0x94
|On init: 0xFFFFFFFF
|-
|0x98
|On init: 0xFFFFFFFF
|}

==Timers==
===Timer Bases===
{| style="width:100%" border="1"
!align="left" width="100px" |TimerNumber
! 0 !! 1 !! 2 !! 3 !! 4 !! 5 !! 6 !! 7
|-
|Base ||align="center"| 0x0 ||align="center"| 0x20 ||align="center"| 0x40 ||align="center"| 0x60
|align="center"| 0xA0 ||align="center"| 0xC0 ||align="center"| 0xE0 ||align="center"| 0x100
|-
|Width ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit
|align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit
|}

===Timer Registers===
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Name
|-
|0x00
|Config Register
|-
|0x04
|Control Register
|-
|0x08
|Compare Buffer Register (TCMPB)
|-
|0x0C
|Counter Buffer register (TCNTB)
|-
|0x10
|10-Bit Prescaler
|-
|0x14
|Observation Register (TCNTO)
|}

===Register Description===
====Config Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|2-0||x||No Function / Unknown
|-
|3||RW||Switches Bit 23 (TOUT) randomly if set...
|-
|4||RW||Compare Mode: Counter runs up to TCMPB (Modebit 0)
|-
|5||RW||Auto-Reload: (Modebit 1)
{|
|1 = One-Shoot
|-
|0 = Interval Mode
|-
|Counter runs up to TCMPB
|}
|-
|6||RW||Clock Select
{|
|0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and Divider = 1 and Prescaler = 0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and (Divider > 1 or Prescaler > 0) ||=>||align="right"|24MHz Timer Clock
|}
|-
|7||RW||Unknown
|-
|10-8||RW||Divider
|-
|11||RW||Invert TOUT
|-
|14-12||RW||Unknown
|-
|15||x||No Function / Unknown
|-
|22-16||x||Unknown
|-
|23||RW
|Timer Out (TOUT)
{|
|In mode 0x00: Bit 23 = Toggle when TCNT = 0
|-
|In mode 0x01: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x10: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
|}
|-
|24||RW||Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
|-
|27-25||x||No Function / Unknown
|-
|28||RW||When counting down, count down starting at TCMPB (Only on Timer 4-7)
|-
|31-29||x||No Function / Unknown
|}
RW: Read/Write Access, x: Don't know

====Control Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|0||RW||Start / Stop
|-
|1||RW||Manual Update
|-
|3-2||x||No Function/ Unknown
|-
|4||RW||Resets all counter registers to 0
|-
|31-5||x||No Function/ Unknown
|}
RW: Read/Write Access, x: Don't know

==References==
Information gathered from:
*Reversing iBoot
*openiBoot
*Playing with the registers when iBoot is running

S5L8720 Timers (Hardware)

2009-03-30T19:07:33Z

1am3r: Added simple description of IRQ Status Register

==S5L8720 Timer Hardware==
Base Address: 0x3C700000

==Common Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|align="left" width="100px" |0x118
|align="left" |Timer 4-7 IRQ Status, write to clear interrupt request
|}

====IRQ Status Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|2-0||R||Timer 7 Flags (execute handler 1 to 3)
|-
|7-3||x||No Function / Unknown
|-
|10-8||R||Timer 6 Flags (execute handler 1 to 3)
|-
|15-11||x||No Function / Unknown
|-
|18-16||R||Timer 5 Flags (execute handler 1 to 3)
|-
|23-19||x||No Function / Unknown
|-
|26-24||R||Timer 4 Flags (execute handler 1 to 3)
|-
|31-27||x||No Function / Unknown
|}
RW: Read/Write Access, x: Don't know

==RTC Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|0x80
|RTC Ticks High
|-
|0x84
|RTC Ticks Low
|-
|0x88
|On init: 0xA, then after the others: 0x18010
|-
|0x8C
|On init: 0xFFFFFFFF
|-
|0x90
|On init: 0xFFFFFFFF
|-
|0x94
|On init: 0xFFFFFFFF
|-
|0x98
|On init: 0xFFFFFFFF
|}

==Timers==
===Timer Bases===
{| style="width:100%" border="1"
!align="left" width="100px" |TimerNumber
! 0 !! 1 !! 2 !! 3 !! 4 !! 5 !! 6 !! 7
|-
|Base ||align="center"| 0x0 ||align="center"| 0x20 ||align="center"| 0x40 ||align="center"| 0x60
|align="center"| 0xA0 ||align="center"| 0xC0 ||align="center"| 0xE0 ||align="center"| 0x100
|-
|Width ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit
|align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit
|}

===Timer Registers===
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Name
|-
|0x00
|Config Register
|-
|0x04
|Control Register
|-
|0x08
|Compare Buffer Register (TCMPB)
|-
|0x0C
|Counter Buffer register (TCNTB)
|-
|0x10
|10-Bit Prescaler
|-
|0x14
|Observation Register (TCNTO)
|}

===Register Description===
====Config Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|2-0||x||No Function / Unknown
|-
|3||RW||Switches Bit 23 (TOUT) randomly if set...
|-
|4||RW||Compare Mode: Counter runs up to TCMPB (Modebit 0)
|-
|5||RW||Auto-Reload: (Modebit 1)
{|
|1 = One-Shoot
|-
|0 = Interval Mode
|-
|Counter runs up to TCMPB
|}
|-
|6||RW||Clock Select
{|
|0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and Divider = 1 and Prescaler = 0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and (Divider > 1 or Prescaler > 0) ||=>||align="right"|24MHz Timer Clock
|}
|-
|7||RW||Unknown
|-
|10-8||RW||Divider
|-
|11||RW||Invert TOUT
|-
|14-12||RW||Unknown
|-
|15||x||No Function / Unknown
|-
|22-16||x||Unknown
|-
|23||RW
|Timer Out (TOUT)
{|
|In mode 0x00: Bit 23 = Toggle when TCNT = 0
|-
|In mode 0x01: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x10: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
|}
|-
|24||RW||Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
|-
|27-25||x||No Function / Unknown
|-
|28||RW||When counting down, count down starting at TCMPB (Only on Timer 4-7)
|-
|31-29||x||No Function / Unknown
|}
RW: Read/Write Access, x: Don't know

====Control Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|0||RW||Start / Stop
|-
|1||RW||Manual Update
|-
|3-2||x||No Function/ Unknown
|-
|4||RW||Resets all counter registers to 0
|-
|31-5||x||No Function/ Unknown
|}
RW: Read/Write Access, x: Don't know

==References==
Information gathered from:
*Reversing iBoot
*openiBoot
*Playing with the registers when iBoot is running

N72AP

2009-03-20T09:59:19Z

1am3r: Added link to S5L8720_(Hardware)

This is the 2nd Generation [[iPod Touch]].

'''Model''': n72ap

'''Application Processor (OS Chip)''': s5l8720x

==Hardware==
See the [[S5L8720_(Hardware)]] for hardware details

==Device IDs==
'''0x1227''' = DFU Mode 2.0 (Basically WTF 2.0 burned into bootrom) 
'''0x1281''' = Recovery Mode 2.0 (iBEC / iBSS / iBoot) 
'''0x1293''' = Normal Mode (comm with iTunes / MobileDev framework)

==Exploits==
See the [[S5L8720]] page for all known exploits

S5L8720 (Hardware)

2009-03-19T23:08:59Z

1am3r:

This should help people reversing iBoot and friends. It is a work in progress.

==SHA1==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38000000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x20 through 0x30</center></td>
<td width=50%><center>Output SHA1 hash</center></td>
</tr>
</table>

==DMA (PL080)==
This appears to use an ARM PrimeCell PL080. You can read the technical reference manual [http://www.mediafire.com/download.php?mjy2m1do0jg here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base (dmac0): 0x38200000 Base (dmac1): 0x39900000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>TC Status (If HIGH, transaction complete)</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>TC Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Error Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Error Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>TC Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Error Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>DMA Channels Enabled</center></td>
</tr>
<tr>
<td width=50%><center>0x30</center></td>
<td width=50%><center>Controller Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x34</center></td>
<td width=50%><center>Enable / Disable Synchronization</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Channel 0 Source Address</center></td>
</tr>
<tr>
<td width=50%><center>0x104</center></td>
<td width=50%><center>Channel 0 Destination Address</center></td>
</tr>
<tr>
<td width=50%><center>0x108</center></td>
<td width=50%><center>Channel 0 Linked List Address</center></td>
</tr>
<tr>
<td width=50%><center>0x10C</center></td>
<td width=50%><center>Channel 0 Control 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Channel 0 Control 2</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>Channel 0 Configuration</center></td>
</tr>
</table>

==VIC (PL192)==
This appears to use an ARM PrimeCell PL192. You can read the technical reference manual [http://www.mediafire.com/download.php?mmjdnud0iuz here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (vic0): 0x38E00000 
Base (vic1): 0x38E01000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>IRQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>FIQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Raw Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Select (0=IRQ, 1=FIQ)</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Interrupt Enable (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Software Interrupt (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x20</center></td>
<td width=50%><center>Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.</center></td>
</tr>
<tr>
<td width=50%><center>0x24</center></td>
<td width=50%><center>Software Interrupt Priority Mask (0=Masked, 1=Not Masked)</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Vector Addresses</center></td>
</tr>
<tr>
<td width=50%><center>0x200</center></td>
<td width=50%><center>Vector Priority Levels</center></td>
</tr>
<tr>
<td width=50%><center>0xFE0 through 0xFEC</center></td>
<td width=50%><center>Peripheral Identification Registers 
Part Number 
Bits 7 through 0 of register 0xFE0 is one portion of the part number (0x92), then bits 3 through 0 of register 0xFE4 is the other portion of it (0x1). If you do some annoying shifting, to put it together, you get 0x192 (0x92|0x11<<8&0xFFF==0x192). 0x192 indicates that it is an ARM PrimeCell PL192. 
Designer 
Bits 7 through 4 of register 0xFE4 is one portion of the designer tag (0x1), then bits 3 through 0 of register 0xFE8 is the other portion of it (0x4). Like above, we can do (0x11 | 0x4<<4) and we get 0x41, which is "A" in ASCII, meaning it was designed by ARM Limited. 
Revision Number 
Unlike the above two, this one is pretty easy. Bits 7 through 4 of register 0xFE8 is the revision number, which is "0" at least for the iPod touch 2G. 
Configuration 
The reference manual simply states that bits 7 through 2 should read back as 0, and nothing more about them. It also states that bits 1 through 0 indicate the number of interrupts supported, which appear to be 32 for the iPod touch 2G ('''0b00=32 Supported''', 0b01=64 Supported, 0b10=128 Supported, 0b11=256 Supported). 
</center></td>
</tr>
<tr>
<td width=50%><center>0xFF0 through 0xFFC</center></td>
<td width=50%><center>PrimeCell Identification Registers 
Register 0xFF0: Should read as 0x0D 
Register 0xFF4: Should read as 0xF0 
Register 0xFF8: Should read as 0x05 
Register 0xFFC: Should read as 0xB1</center></td>
</tr>
</table>

==CHIPID==
All information here was gathered by reversing iBoot and friends.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3D100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Unused & Unreferenced Register</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Not yet documented</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Chip Info 
Chip ID: Bits 31 through 16 (0x8720, meaning it is an [[S5L8720]]) 
SCEP: Bits 15 through 1 (0x01) 
</center></td>
</tr>
</table>

==WDT (Watchdog Timer)==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3C800000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Control Register 
NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Watchdog Timeout Duration</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Clear</center></td>
</tr>
</table>

==Timers==
See separate article [[S5L8720 Timers (Hardware)]]

==ARM7 (Second CPU)==
All information here was gathered by looking at the code for the [[ARM7 Go]] command, as well as noting that although 2.1.1 iBoots reference this as 0xB8600000, 0x80000000 through 0xFFFFFFFF is mapped to 0x0 through 0x7FFFFFFF when the MMU does it's stuff.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38600000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Running Status 
To halt the ARM7: Write 0x0 then 0x10 to this register 
To make it resume: Write 0x1 to this register</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Code Address 
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>"Code Waiting" 
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110</center></td>
</tr>
</table>

==UART==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (uart0 - Serial): 0x3CC00000 
Base (uart1 - Bluetooth): 0x3DB00000 
Base (uart2): 0x3DC00000 
Base (uart3): 0x3DD00000 </center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==SPI==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (spi0 - NOR Flash): 0x3C300000 
Base (spi1 - NOR Flash): 0x3CE00000 
Base (spi2): 0x3D200000 
Base (spi3): 0x3DA00000 
Base (spi4 - Multi Touch): 0x3E100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==Links==
* [http://github.com/planetbeing/iphonelinux/tree/27b57ac836053d59421a02755920b5be6b1e7805/openiboot OpeniBoot]
* [http://code.google.com/p/chronicdev/wiki/N72APDevTree Decoded iPod touch 2G DevTree]

S5L8720 Timers (Hardware)

2009-03-19T23:07:03Z

1am3r: New page: ==S5L8720 Timer Hardware== Base Address: 0x3C700000 ==Common Registers== {| style="width:100%" border="1" !align="left" width="100px" |Register !align="left" |Function |- |align="left" w...

==S5L8720 Timer Hardware==
Base Address: 0x3C700000

==Common Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|align="left" width="100px" |0x118
|align="left" |Timer IRQ Status
|}

==RTC Registers==
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Function
|-
|0x80
|RTC Ticks High
|-
|0x84
|RTC Ticks Low
|-
|0x88
|On init: 0xA, then after the others: 0x18010
|-
|0x8C
|On init: 0xFFFFFFFF
|-
|0x90
|On init: 0xFFFFFFFF
|-
|0x94
|On init: 0xFFFFFFFF
|-
|0x98
|On init: 0xFFFFFFFF
|}

==Timers==
===Timer Bases===
{| style="width:100%" border="1"
!align="left" width="100px" |TimerNumber
! 0 !! 1 !! 2 !! 3 !! 4 !! 5 !! 6 !! 7
|-
|Base ||align="center"| 0x0 ||align="center"| 0x20 ||align="center"| 0x40 ||align="center"| 0x60
|align="center"| 0xA0 ||align="center"| 0xC0 ||align="center"| 0xE0 ||align="center"| 0x100
|-
|Width ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit
|align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit
|}

===Timer Registers===
{| style="width:100%" border="1"
!align="left" width="100px" |Register
!align="left" |Name
|-
|0x00
|Config Register
|-
|0x04
|Control Register
|-
|0x08
|Compare Buffer Register (TCMPB)
|-
|0x0C
|Counter Buffer register (TCNTB)
|-
|0x10
|10-Bit Prescaler
|-
|0x14
|Observation Register (TCNTO)
|}

===Register Description===
====Config Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|2-0||x||No Function / Unknown
|-
|3||RW||Switches Bit 23 (TOUT) randomly if set...
|-
|4||RW||Compare Mode: Counter runs up to TCMPB (Modebit 0)
|-
|5||RW||Auto-Reload: (Modebit 1)
{|
|1 = One-Shoot
|-
|0 = Interval Mode
|-
|Counter runs up to TCMPB
|}
|-
|6||RW||Clock Select
{|
|0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and Divider = 1 and Prescaler = 0 ||=>||align="right"|133MHz Timer Clock
|-
|1 and (Divider > 1 or Prescaler > 0) ||=>||align="right"|24MHz Timer Clock
|}
|-
|7||RW||Unknown
|-
|10-8||RW||Divider
|-
|11||RW||Invert TOUT
|-
|14-12||RW||Unknown
|-
|15||x||No Function / Unknown
|-
|22-16||x||Unknown
|-
|23||RW
|Timer Out (TOUT)
{|
|In mode 0x00: Bit 23 = Toggle when TCNT = 0
|-
|In mode 0x01: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x10: Bit 23 = (TCNT >= TCMP)
|-
|In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
|}
|-
|24||RW||Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
|-
|27-25||x||No Function / Unknown
|-
|28||RW||When counting down, count down starting at TCMPB (Only on Timer 4-7)
|-
|31-29||x||No Function / Unknown
|}
RW: Read/Write Access, x: Don't know

====Control Register====
{| style="width:100%" border="1"
!align="left" width="100px" |Bit
!align="left" width="60px" |Access
!align="left" |Function
|-
|0||RW||Start / Stop
|-
|1||RW||Manual Update
|-
|3-2||x||No Function/ Unknown
|-
|4||RW||Resets all counter registers to 0
|-
|31-5||x||No Function/ Unknown
|}
RW: Read/Write Access, x: Don't know

==References==
Information gathered from:
*Reversing iBoot
*openiBoot
*Playing with the registers when iBoot is running