The iPhone Wiki - User contributions [en]

Talk:Bootrom Dumper Utility

2010-12-26T01:02:41Z

Kleemajo:

If anyone gets it working for iPod touch 2G let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current iPod touch 2G openiBoot [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)

IBSS commands

2010-11-09T07:18:51Z

Kleemajo: I'm pretty sure that iBoot does not run bash...

{{DISPLAYTITLE:iBSS commands}}
You can access this command list by typing "help" after [[iBSS]] is uploaded.

bootx boot a kernel cache at specified address
tsys boot into tsys (if present)
diags boot into diagnostics (if present)
setpicture set the image on the display
bgcolor set the display background color
poweroff power off the device
halt halt the system (good for JTAG)
reboot reboot the device
run use contents of enironment var as script
script run script at specific address
go jump directly to address
mws memory write - string
mwb memory write - 8bit
mwh memory write - 16bit
mw memory write - 32bit
mdb memory display - 8bit
mdh memory display - 16bit
md memory display - 32bit
ramdisk create a radisk from the specified address
powernvram Access Power NVRAM.
charge Manage the charger chip.
devicetree create a device tree from the specified address
saveenv save current environment to flash
syscfg flash SysCfg inspection
chunk chunk a file
arm7_stop stop the arm7
arm7_go start the arm7 with a downloaded image
iic iic read/write
usb run a USB command
sha1 SHA-1 hash of memory
crc POSIX 1003.2 checksum of memory
clearenv clear all environment variables
setenv set an environment variable
printenv print one or all environment variables
image flash image inspection
pki PKI
bdev block device commands

== command descriptions ==

(Recovery) iPhone$ usb
Usage:
usb get <filename> [address] [amount]
usb get tftp://servername.com/file.bin [address] [amount]
usb put <filename> <amount> [address]
(Recovery) iPhone$ pki
not enough arguments.
pki verify <cert-chain-as-concatenated-der-blobs-data> <length> <signature-blob-data> <length> <hash-blob-data> <length>
verify-image <8900-1.0-image-data> <length>
(Recovery) iPhone$ bdev
not enough arguments
usage:
bdev list
bdev read <dev> <offset> <len> [<address>]
bdev write <dev> <offset> [<len>] [<address>]
bdev memcmp <dev> <offset> [<len>] [<address>]
bdev erase <dev> <offset> <len>
(Recovery) iPhone$ image
not enough arguments.
image list [<detailed>]
image load [<type>|memory] [<address>]
(Recovery) iPhone$ printenv
config_board = 'n72ap'
loadaddr = '0x9000000'
boot-command = 'fsboot'
idle-off = 'true'
boot-device = 'nand0'
boot-partition = '0'
boot-path = '/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8720x'
display-color-space = 'RGB888'
display-timing = 'n72'
P bootdelay = '0'
P platform-uuid = <DATA>
P backlight-level = '56'
P debug-uarts = '4'
P auto-boot = 'false'
image-version = '0x3'
framebuffer = '0xfb04000'
secure-boot = '0x1'
? = '0xfffffff'
(Recovery) iPhone$ crc
not enough arguments.
crc <address> <len>
(Recovery) iPhone$ sha1
not enough arguments.
sha1 <address> <len>
(Recovery) iPhone$ iic
not enough arguments.
iic read <bus> <iicaddr> <len>
iic readreg <bus> <iicaddr> <reg> <len>
iic write <bus> <iicaddr> <data0> <data1> ...
(Recovery) iPhone$ chunk
Enter a sub-command

Commands:
put_test
get_test
(Recovery) iPhone$ syscfg
0x53724e6d 'SrNm' 0x30304539 0x48453134 0x00333032 0x00000000
0x46774964 'FwId' 0x01000000 0x00000000 0x000a2700 0x00000000
0x48775672 'HwVr' 0x00000000 0x00000000 0x00000000 0x00000000
0x48774964 'HwId' 0x00000000 0x00000000 0x00000000 0x00000000
0x53775672 'SwVr' 0x00000000 0x00000000 0x00000000 0x00000000
(Recovery) iPhone$ saveenv
0x4d4c424e 'MLBN' 0x00000000 0x00000000 0x00000000 0x00000000
0x4d6f6423 'Mod#' 0x3335424d 0x00000031 0x00000000 0x00000000
0x5265676e 'Regn' 0x412f4446 0x00000000 0x00000000 0x00000000
0x4d4c4223 'MLB#' 0x30394339 0x50393237 0x5a323437 0x00000041
(Recovery) iPhone$ devicetree
0x42617474 'Batt' 0x42617474 0x00000012 0x00001fd8 0xffffffff
0x53425672 'SBVr' 0x00000031 0x00000000 0x00000000 0x00000000
0x4d74436c 'MtCl' 0x4d74436c 0x00000100 0x00001ed8 0xffffffff
(Recovery) iPhone$ powernvram
usage:
powernvram <command>
list List NVRAM Properties.
set <prop#> <value> Set NVRAM Property.
(Recovery) iPhone$ powernvram list
0: [iBootState] 0x00
1: [iBootDebug] 0x00
2: [iBootStage] 0x00
3: [iBootErrorCount] 0x05
4: [iBootErrorStage] 0x30
(Recovery) iPhone$ md
0x09000000: e59f3014 e3a02a02 e1c320b0 e3e02000
0x09000010: e2833c9d e58326c0 eafffffe 2200f300
0x09000020: 00000000 00000000 00000000 00000000
0x09000030: 00000000 00000000 00000000 00000000
0x09000040: 00000000 00000000 00000000 00000000
0x09000050: 00000000 00000000 00000000 00000000
0x09000060: 00000000 00000000 00000000 00000000
0x09000070: 00000000 00000000 00000000 00000000
0x09000090: 00000000 00000000 00000000 00000000
0x090000a0: 00000000 00000000 00000000 00000000
0x090000b0: 00000000 00000000 00000000 00000000
0x090000c0: 00000000 00000000 00000000 00000000
0x090000d0: 00000000 00000000 00000000 00000000
0x090000e0: 00000000 00000000 00000000 00000000
0x090000f0: 00000000 00000000 00000000 00000000
(Recovery) iPhone$ mdh
0x09000100: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000110: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000120: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000130: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000140: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000150: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000160: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000170: 0000 0000 0000 0000 0000 0000 0000 000
0x09000180: 0000 0000 0000 0000 0000 0000 0000 0000
0x09000190: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001a0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001b0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001c0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001d0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001e0: 0000 0000 0000 0000 0000 0000 0000 0000
0x090001f0: 0000 0000 0000 0000 0000 0000 0000 0000
59f3014 (Recovery) iPhone$ mdd
(Recovery) iPhone$ mdb
0x09000200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000260: 00 00 00 0 00 00 00 00 00 00 00 00 00 00 00 00
0x09000270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x09000290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002c0: 00 00 00 00 00 00 00 00 00 0000 00 00 00 00 00
0x090002d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090002f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(Recovery) iPhone$ mw
mw [<address>] <data>
(Recovery) iPhone$ mwh
mwh [<address>] <data>
(Recovery) iPhone$ mwb
mwb [<address>] <data>
(Recovery) iPhone$ mws
mws [<address>] <data>
(Recovery) iPhone$ bgcolor
wrong number of args.
bgcolor <red> <green> <blue>
(Recovery) iPhone$ setpicture
wrong number of args.
setpicture update? [<addr> [<size>]]
(Recovery) iPhone$ tsys
boot_flash: could not find image
(Recovery) iPhone$ diags
boot_flash: could not find image
(Recovery) iPhone$ run
run <variable>
(Recovery) iPhone$ script
running script at 0x9000000
finished running script (EOF at 0x900000c)
0??*?? ??

?SYNTAX ERROR
] POSIX 1003.2 cpresent)
(Recovery) iPhone$ bootx
Attempting to validate kernelcache @ 0x09000000
(Recovery) iPhone$ usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000)
Kernelcache image not valid
error loading kernelcache

==[[IBEC]] commands==

A lot of the commands have been removed because [[IBEC]] is used to boot a [[ramdisk]] or [[kernelcache]].

ramdisk create a radisk from the specified address
go jump directly to address
bootx boot a kernel cache at specified address
devicetree create a device tree from the specified address

S5L8720 (Hardware)

2010-04-20T07:49:16Z

Kleemajo: /* VIC (PL192) */ Fixed a tag that I accidentally copy pasted over in the previous edit.

This should help people reversing iBoot and friends. It is a work in progress.

==SHA1==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38000000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x00</center></td>
<td width=50%><center>Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x04</center></td>
<td width=50%><center>Setup</center></td>
</tr>
<tr>
<td width=50%><center>0x20 through 0x30</center></td>
<td width=50%><center>Output SHA1 hash</center></td>
</tr>
<tr>
<td width=50%><center>0x40 through 0x7C</center></td>
<td width=50%><center>Data Input (64 Bytes)</center></td>
</tr>
</table>
See [[S5L8720 (Hardware) SHA1|S5L8720 SHA1]] for a more detailed description

==DMA (PL080)==
This appears to use an ARM PrimeCell PL080. You can read the technical reference manual [http://www.mediafire.com/download.php?mjy2m1do0jg here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base (dmac0): 0x38200000 Base (dmac1): 0x39900000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>TC Status (If HIGH, transaction complete)</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>TC Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Error Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Error Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>TC Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Error Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>DMA Channels Enabled</center></td>
</tr>
<tr>
<td width=50%><center>0x30</center></td>
<td width=50%><center>Controller Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x34</center></td>
<td width=50%><center>Enable / Disable Synchronization</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Channel 0 Source Address</center></td>
</tr>
<tr>
<td width=50%><center>0x104</center></td>
<td width=50%><center>Channel 0 Destination Address</center></td>
</tr>
<tr>
<td width=50%><center>0x108</center></td>
<td width=50%><center>Channel 0 Linked List Address</center></td>
</tr>
<tr>
<td width=50%><center>0x10C</center></td>
<td width=50%><center>Channel 0 Control 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Channel 0 Control 2</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>Channel 0 Configuration</center></td>
</tr>
</table>

==VIC (PL192)==
This appears to use an ARM PrimeCell PL192. You can read the technical reference manual [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0273a/DDI0273.pdf here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (vic0): 0x38E00000 
Base (vic1): 0x38E01000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>IRQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>FIQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Raw Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Select (0=IRQ, 1=FIQ)</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Interrupt Enable (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Software Interrupt (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x20</center></td>
<td width=50%><center>Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.</center></td>
</tr>
<tr>
<td width=50%><center>0x24</center></td>
<td width=50%><center>Software Interrupt Priority Mask (0=Masked, 1=Not Masked)</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Vector Addresses</center></td>
</tr>
<tr>
<td width=50%><center>0x200</center></td>
<td width=50%><center>Vector Priority Levels</center></td>
</tr>
<tr>
<td width=50%><center>0xFE0 through 0xFEC</center></td>
<td width=50%><center>Peripheral Identification Registers 
Part Number 
Bits 7 through 0 of register 0xFE0 is one portion of the part number (0x92), then bits 3 through 0 of register 0xFE4 is the other portion of it (0x1). If you do some annoying shifting, to put it together, you get 0x192 (0x92|0x11<<8&0xFFF==0x192). 0x192 indicates that it is an ARM PrimeCell PL192. 
Designer 
Bits 7 through 4 of register 0xFE4 is one portion of the designer tag (0x1), then bits 3 through 0 of register 0xFE8 is the other portion of it (0x4). Like above, we can do (0x11 | 0x4<<4) and we get 0x41, which is "A" in ASCII, meaning it was designed by ARM Limited. 
Revision Number 
Unlike the above two, this one is pretty easy. Bits 7 through 4 of register 0xFE8 is the revision number, which is "0" at least for the iPod touch 2G. 
Configuration 
The reference manual simply states that bits 7 through 2 should read back as 0, and nothing more about them. It also states that bits 1 through 0 indicate the number of interrupts supported, which appear to be 32 for the iPod touch 2G ('''0b00=32 Supported''', 0b01=64 Supported, 0b10=128 Supported, 0b11=256 Supported). 
</center></td>
</tr>
<tr>
<td width=50%><center>0xFF0 through 0xFFC</center></td>
<td width=50%><center>PrimeCell Identification Registers 
Register 0xFF0: Should read as 0x0D 
Register 0xFF4: Should read as 0xF0 
Register 0xFF8: Should read as 0x05 
Register 0xFFC: Should read as 0xB1</center></td>
</tr>
</table>

==CHIPID==
All information here was gathered by reversing iBoot and friends.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3D100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Unused & Unreferenced Register</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Not yet documented</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Chip Info 
Chip ID: Bits 31 through 16 (0x8720, meaning it is an [[S5L8720]]) 
Security Epoch: Bits 15 through 1 (0x01) 
</center></td>
</tr>
</table>

==WDT (Watchdog Timer)==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3C800000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Control Register 
NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Watchdog Timeout Duration</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Clear</center></td>
</tr>
</table>

==Timers==
See separate article [[S5L8720 Timers (Hardware)]]

==ARM7 (Second CPU)==
All information here was gathered by looking at the code for the [[ARM7 Go]] command, as well as noting that although 2.1.1 iBoots reference this as 0xB8600000, 0x80000000 through 0xFFFFFFFF is mapped to 0x0 through 0x7FFFFFFF when the MMU does it's stuff.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38600000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Running Status 
To halt the ARM7: Clear all bits then set bit t 2 
To make it resume: Set bit 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Code Address 
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>"Code Waiting" 
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110</center></td>
</tr>
</table>

==UART==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (uart0 - Serial): 0x3CC00000 
Base (uart1 - Bluetooth): 0x3DB00000 
Base (uart2): 0x3DC00000 
Base (uart3): 0x3DD00000 </center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==SPI==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (spi0 - NOR Flash): 0x3C300000 
Base (spi1 - NOR Flash): 0x3CE00000 
Base (spi2): 0x3D200000 
Base (spi3): 0x3DA00000 
Base (spi4 - Multi Touch): 0x3E100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==Links==
* [http://github.com/planetbeing/iphonelinux/tree/27b57ac836053d59421a02755920b5be6b1e7805/openiboot OpeniBoot]
* [http://code.google.com/p/chronicdev/wiki/N72APDevTree Decoded iPod touch 2G DevTree]

S5L8720 (Hardware)

2010-04-20T07:48:23Z

Kleemajo: /* VIC (PL192) */ Updated technical reference manual link to one on the ARM doc site since the old link was broken.

This should help people reversing iBoot and friends. It is a work in progress.

==SHA1==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38000000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x00</center></td>
<td width=50%><center>Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x04</center></td>
<td width=50%><center>Setup</center></td>
</tr>
<tr>
<td width=50%><center>0x20 through 0x30</center></td>
<td width=50%><center>Output SHA1 hash</center></td>
</tr>
<tr>
<td width=50%><center>0x40 through 0x7C</center></td>
<td width=50%><center>Data Input (64 Bytes)</center></td>
</tr>
</table>
See [[S5L8720 (Hardware) SHA1|S5L8720 SHA1]] for a more detailed description

==DMA (PL080)==
This appears to use an ARM PrimeCell PL080. You can read the technical reference manual [http://www.mediafire.com/download.php?mjy2m1do0jg here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base (dmac0): 0x38200000 Base (dmac1): 0x39900000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>TC Status (If HIGH, transaction complete)</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>TC Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Error Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Error Interrupt Clear</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>TC Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Error Interrupt Status Before Masking (Raw)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>DMA Channels Enabled</center></td>
</tr>
<tr>
<td width=50%><center>0x30</center></td>
<td width=50%><center>Controller Configuration</center></td>
</tr>
<tr>
<td width=50%><center>0x34</center></td>
<td width=50%><center>Enable / Disable Synchronization</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Channel 0 Source Address</center></td>
</tr>
<tr>
<td width=50%><center>0x104</center></td>
<td width=50%><center>Channel 0 Destination Address</center></td>
</tr>
<tr>
<td width=50%><center>0x108</center></td>
<td width=50%><center>Channel 0 Linked List Address</center></td>
</tr>
<tr>
<td width=50%><center>0x10C</center></td>
<td width=50%><center>Channel 0 Control 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Channel 0 Control 2</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>Channel 0 Configuration</center></td>
</tr>
</table>

==VIC (PL192)==
This appears to use an ARM PrimeCell PL192. You can read the technical reference manual http://infocenter.arm.com/help/topic/com.arm.doc.ddi0273a/DDI0273.pdf here].

<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (vic0): 0x38E00000 
Base (vic1): 0x38E01000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>IRQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>FIQ Status</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Raw Interrupt Status</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Select (0=IRQ, 1=FIQ)</center></td>
</tr>
<tr>
<td width=50%><center>0x10</center></td>
<td width=50%><center>Interrupt Enable (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x14</center></td>
<td width=50%><center>Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x18</center></td>
<td width=50%><center>Software Interrupt (0=Disabled, 1=Enabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x1C</center></td>
<td width=50%><center>Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)</center></td>
</tr>
<tr>
<td width=50%><center>0x20</center></td>
<td width=50%><center>Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.</center></td>
</tr>
<tr>
<td width=50%><center>0x24</center></td>
<td width=50%><center>Software Interrupt Priority Mask (0=Masked, 1=Not Masked)</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Vector Addresses</center></td>
</tr>
<tr>
<td width=50%><center>0x200</center></td>
<td width=50%><center>Vector Priority Levels</center></td>
</tr>
<tr>
<td width=50%><center>0xFE0 through 0xFEC</center></td>
<td width=50%><center>Peripheral Identification Registers 
Part Number 
Bits 7 through 0 of register 0xFE0 is one portion of the part number (0x92), then bits 3 through 0 of register 0xFE4 is the other portion of it (0x1). If you do some annoying shifting, to put it together, you get 0x192 (0x92|0x11<<8&0xFFF==0x192). 0x192 indicates that it is an ARM PrimeCell PL192. 
Designer 
Bits 7 through 4 of register 0xFE4 is one portion of the designer tag (0x1), then bits 3 through 0 of register 0xFE8 is the other portion of it (0x4). Like above, we can do (0x11 | 0x4<<4) and we get 0x41, which is "A" in ASCII, meaning it was designed by ARM Limited. 
Revision Number 
Unlike the above two, this one is pretty easy. Bits 7 through 4 of register 0xFE8 is the revision number, which is "0" at least for the iPod touch 2G. 
Configuration 
The reference manual simply states that bits 7 through 2 should read back as 0, and nothing more about them. It also states that bits 1 through 0 indicate the number of interrupts supported, which appear to be 32 for the iPod touch 2G ('''0b00=32 Supported''', 0b01=64 Supported, 0b10=128 Supported, 0b11=256 Supported). 
</center></td>
</tr>
<tr>
<td width=50%><center>0xFF0 through 0xFFC</center></td>
<td width=50%><center>PrimeCell Identification Registers 
Register 0xFF0: Should read as 0x0D 
Register 0xFF4: Should read as 0xF0 
Register 0xFF8: Should read as 0x05 
Register 0xFFC: Should read as 0xB1</center></td>
</tr>
</table>

==CHIPID==
All information here was gathered by reversing iBoot and friends.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3D100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Unused & Unreferenced Register</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Not yet documented</center></td>
</tr>
<tr>
<td width=50%><center>0x8</center></td>
<td width=50%><center>Chip Info 
Chip ID: Bits 31 through 16 (0x8720, meaning it is an [[S5L8720]]) 
Security Epoch: Bits 15 through 1 (0x01) 
</center></td>
</tr>
</table>

==WDT (Watchdog Timer)==
<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x3C800000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Control Register 
NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000</center></td>
</tr>
<tr>
<td width=50%><center>0x4</center></td>
<td width=50%><center>Watchdog Timeout Duration</center></td>
</tr>
<tr>
<td width=50%><center>0xC</center></td>
<td width=50%><center>Interrupt Clear</center></td>
</tr>
</table>

==Timers==
See separate article [[S5L8720 Timers (Hardware)]]

==ARM7 (Second CPU)==
All information here was gathered by looking at the code for the [[ARM7 Go]] command, as well as noting that although 2.1.1 iBoots reference this as 0xB8600000, 0x80000000 through 0xFFFFFFFF is mapped to 0x0 through 0x7FFFFFFF when the MMU does it's stuff.

<table border=1 width=100%>
<tr>
<td colspan=2><center>Base: 0x38600000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x100</center></td>
<td width=50%><center>Running Status 
To halt the ARM7: Clear all bits then set bit t 2 
To make it resume: Set bit 1</center></td>
</tr>
<tr>
<td width=50%><center>0x110</center></td>
<td width=50%><center>Code Address 
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7</center></td>
</tr>
<tr>
<td width=50%><center>0x114</center></td>
<td width=50%><center>"Code Waiting" 
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110</center></td>
</tr>
</table>

==UART==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (uart0 - Serial): 0x3CC00000 
Base (uart1 - Bluetooth): 0x3DB00000 
Base (uart2): 0x3DC00000 
Base (uart3): 0x3DD00000 </center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==SPI==
<table border=1 width=100%>
<tr>
<td colspan=2><center>
Base (spi0 - NOR Flash): 0x3C300000 
Base (spi1 - NOR Flash): 0x3CE00000 
Base (spi2): 0x3D200000 
Base (spi3): 0x3DA00000 
Base (spi4 - Multi Touch): 0x3E100000</center></td>
</tr>
<tr>
<td width=50%><center>Register</center></td>
<td width=50%><center>Description</center></td>
</tr>
</table>

==Links==
* [http://github.com/planetbeing/iphonelinux/tree/27b57ac836053d59421a02755920b5be6b1e7805/openiboot OpeniBoot]
* [http://code.google.com/p/chronicdev/wiki/N72APDevTree Decoded iPod touch 2G DevTree]