The iPhone Wiki - User contributions [en]

IOS

2010-07-08T20:16:13Z

WillStrafach:

{{DISPLAYTITLE:iOS}}
iOS, formerly known as iPhone OS, is the operating system for the [[iPhone]], [[iPod Touch]] and [[iPad]]. iOS has four abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The OS takes less than half a gigabyte (GB) of the device's total memory storage, this means that users will not get their full storage space.

In iOS 4, it takes up ~1GB of space, probably due to the 2x graphics that have been added for the [[iPhone 4]]'s Retina display.

/System/Library/CoreServices/SystemVersion.plist

2010-07-08T20:14:49Z

WillStrafach:

This file is where [[iOS]] gets the firmware version, build number, and build type. Editing this file is often done to fake the firmware version (to trick anything that has a hardcoded check on it), changing the build type from "Beta" to something else on beta builds (to prevent expiration), and more.

/System/Library/CoreServices/SystemVersion.plist

2010-07-08T20:14:37Z

WillStrafach:

This file is where iOS gets the firmware version, build number, and build type. Editing this file is often done to fake the firmware version (to trick anything that has a hardcoded check on it), changing the build type from "Beta" to something else on beta builds (to prevent expiration), and more.

Greenpois0n (jailbreak)

2010-06-28T17:55:33Z

WillStrafach: removed "chronic" part because some may think that means me, versus meaning ChronicDev

Greenpois0n is a cross-platform hacker toolkit that helps users to find their own exploits for jailbreaks, write custom ramdisks, and create custom firmwares.

== Current Toolset ==

*[http://github.com/chronicdev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.

*[http://github.com/chronicdev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.

*[http://github.com/chronicdev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.

*[http://github.com/chronicdev/arsenic GreenPois0n Arsenic]: custom firmware toolkit to help developers design jailbreaks to help preserve [[Baseband Firmware|baseband]] and keep unlocks, much in the same way [[PwnageTool]]/[[sn0wbreeze]] works.

SwitchBoard.app

2010-06-26T02:02:16Z

WillStrafach:

[[Image:SwitchBoard.jpg|frame|right|SwitchBoard on M68AP.]]

SwitchBoard.app is one of Apple's internal utilities. It's a simple launcher of other developer utilities. It's usually located in /AppleInternal/Applications folder along the other internal applications. Currently, there is no SwitchBoard binary available for public.

== Origin ==
SwitchBoard and diagnostic utilities are copied onto device during restore with special IPSW file which is seeded only to Apple official service centers.

== Other ==
Note that this is not "Switchboard", note the lowercase "b", which is basically an internal "App Store" for Apple employees only.

S5L8930

2010-06-20T14:44:23Z

WillStrafach: /* Exploits */

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]] and [[N90ap|iPhone 4]]. Publicly, Apple refers to this chip as the '''A4'''.

== Exploits ==
=== Bootrom ===

=== iBoot / Kernel ===

=== Userland ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD

== See also ==
* [[S5L8930 (Bootrom)]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

S5L8930

2010-04-07T01:36:23Z

WillStrafach:

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]]. Publicly, Apple refers to this hip as the '''A4'''.

== Exploits ==
=== Bootrom ===

=== iBoot / Kernel ===

=== Userland ===

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

K48AP

2010-03-29T23:20:40Z

WillStrafach:

[[Image:ipad_hero_20100127.jpg|thumb|right|250px|iPad]]This is the iPad. Announced on January 27, 2010. $499 for WiFi-only variant. Features 1 GHz Apple [[S5L8930]] CPU and 9.7" display. Runs iPhone OS 3.2.

== Application processor ==
It uses Apple-designed 1 GHz [[A4|A4]] CPU.

== Specifications ==
'''Screen:''' 1024x768px

'''Size:''' 9.56 inches (242.8 mm) (height) x 7.47 inches (189.7 mm) (width) x 0.5 inch (13.4 mm) (depth)

'''Weight:''' 1.5 pounds (0.68 kg) Wi-Fi model; 1.6 pounds (0.73 kg) Wi-Fi + 3G model

'''Battery:''' Up to 10 hours of Internet use, one month of standby

'''3G:''' UMTS/HSDPA (850, 1900, 2100 MHz), GSM/EDGE (850, 900, 1800, 1900 MHz), data only

S5L8930

2010-03-29T23:17:48Z

WillStrafach: New page: An SoC developed by Apple in-house chip design department. It is currently used in iPad. == Exploits == === Bootrom === === iBoot / Kernel === === Userland === == Specificati...

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]].

== Exploits ==
=== Bootrom ===

=== iBoot / Kernel ===

=== Userland ===

== Specifications ==
* '''CPU''': ARM Cortex-A9 MPCore
* '''GPU''': PowerVR SGX 545
* '''A/V Playback''': PowerVR VXD

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx
* http://infocenter.arm.com/help/topic/com.arm.doc.ddi0407e/DDI0407E_cortex_a9_mpcore_r2p0_trm.pdf

Main Page

2010-03-29T23:16:25Z

WillStrafach:

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%" style="background-color:orange;"><tr>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td>
</tr>
</table><br />

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]
{{col-2}}
{{HeadingB|Hardware}}
====iPhone====
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]

====iPod Touch====
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

====iPad====
* [[K48ap|iPad (k48ap)]]

====Processors====
* [[S5L8900]] ([[iPhone]], [[iPod Touch]], [[iPhone 3G]])
* [[S5L8720]] ([[iPod touch 2G]])
* [[S5L8920]] ([[N88AP|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod Touch 3G]])
* [[S5L8930]] ([[k48ap|iPad]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}
====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}
====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Glossary]]
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]
{{col-end}}

<table border="1" width="100%" style="background-color:orange;">
<tr>
<td colspan="4" style="background-color:orange; text-align:center;">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table>

__NOTOC____NOEDITSECTION__

IBoot-817.28

2010-03-29T23:15:43Z

WillStrafach: New page: iBoot revision that the iPad WiFi-only model (iPad1,1) ships with.

[[iBoot]] revision that the iPad WiFi-only model (iPad1,1) ships with.

Talk:CmdArg

2010-03-11T12:34:57Z

WillStrafach: unk0

== unk0 ==

pretty sure it's the name of the command issued, as in, the equivalent of argv[0]. can anyone confirm?

Talk:Ramdisk (iBoot command)

2010-03-10T15:39:08Z

WillStrafach: /* n88ap__iBoot__blockdev */ new section

ok, now this is just silly. --[[User:Posixninja|posixninja]] 18:34, 9 March 2010 (UTC)

== n88ap__iBoot__blockdev ==

no idea what that is supposed to mean. it should be do_image_load, as image_load is jsut a wrapper function.

Bootx (iBoot command)

2010-02-26T22:27:52Z

WillStrafach: /* iPhone 3GS 8920x from iBoot-636.66 */

== iPhone 3GS 8920x from iBoot-636.66 ==

<pre>
N88AP_iBoot:4FF007E8 n88ap__iBoot__bootx_function ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o
N88AP_iBoot:4FF007E8
N88AP_iBoot:4FF007E8 kernelcache_prepped_memory_pos= -0x10
N88AP_iBoot:4FF007E8 oldR4 = -0xC
N88AP_iBoot:4FF007E8 oldR7 = -8
N88AP_iBoot:4FF007E8 oldLR = -4
N88AP_iBoot:4FF007E8
N88AP_iBoot:4FF007E8 000 PUSH {R4,R7,LR} ; Push registers
N88AP_iBoot:4FF007EA 00C ADD R7, SP, #4 ; Rd = Op1 + Op2
N88AP_iBoot:4FF007EC 00C SUB SP, SP, #4 ; Rd = Op1 - Op2
N88AP_iBoot:4FF007EE 010 CMP R0, #1 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF007F0 010 MOV R4, R1 ; Rd = Op2
N88AP_iBoot:4FF007F2 010 BLE loc_4FF00808 ; Branch
N88AP_iBoot:4FF007F4 010 LDR R1, [R1,#0x24] ; argv[1]
N88AP_iBoot:4FF007F6 010 LDR R0, =aHelp ; "help"
N88AP_iBoot:4FF007F8 010 BL strcmp ; Branch with Link
N88AP_iBoot:4FF007FC 010 CBNZ R0, loc_4FF00808 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF007FE 010 LDR R1, [R4,#0x10] ; param_R1
N88AP_iBoot:4FF00800 010 LDR R0, =aUsageSAddress ; "usage:\n\t%s [<address>]\n"
N88AP_iBoot:4FF00802 010 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00806 010 B loc_4FF0081C ; Branch
N88AP_iBoot:4FF00808 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00808
N88AP_iBoot:4FF00808 loc_4FF00808 ; CODE XREF: n88ap__iBoot__bootx_function+A�j
N88AP_iBoot:4FF00808 ; n88ap__iBoot__bootx_function+14�j
N88AP_iBoot:4FF00808 010 MOV.W R0, #n88ap_ramdisk ; addr
N88AP_iBoot:4FF0080C 010 MOV.W R1, #0xF00000 ; size
N88AP_iBoot:4FF00810 010 BL check_range ; Branch with Link
N88AP_iBoot:4FF00814 010 CBNZ R0, loc_4FF00822 ; Compare and Branch on Non-Zero
N88AP_iBoot:4FF00816 010 LDR R0, =aPermissionDenied ; "Permission Denied\n"
N88AP_iBoot:4FF00818 010 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF0081C
N88AP_iBoot:4FF0081C loc_4FF0081C ; CODE XREF: n88ap__iBoot__bootx_function+1E�j
N88AP_iBoot:4FF0081C 010 MOV.W R4, #0xFFFFFFFF ; fail
N88AP_iBoot:4FF00820 010 B loc_4FF0085C ; Branch
N88AP_iBoot:4FF00822 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00822
N88AP_iBoot:4FF00822 loc_4FF00822 ; CODE XREF: n88ap__iBoot__bootx_function+2C�j
N88AP_iBoot:4FF00822 010 MOV.W R1, #n88ap_ramdisk ; param_R1
N88AP_iBoot:4FF00826 010 LDR R0, =aAttemptingToValidateKernelcache0x08x ; "Attempting to validate kernelcache @ 0x"...
N88AP_iBoot:4FF00828 010 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF0082C 010 MOV.W R0, #n88ap_ramdisk ; memoery_pos
N88AP_iBoot:4FF00830 010 MOV.W R1, #0xF00000 ; memory_size
N88AP_iBoot:4FF00834 010 MOV R2, SP ; Rd = Op2
N88AP_iBoot:4FF00836 010 BL LoadImage_kernelcache_img3 ; Branch with Link
N88AP_iBoot:4FF0083A 010 CMP R0, #0 ; Set cond. codes on Op1 - Op2
N88AP_iBoot:4FF0083C 010 MOV R4, R0 ; Rd = Op2
N88AP_iBoot:4FF0083E 010 BGE loc_4FF00848 ; Branch
N88AP_iBoot:4FF00840 010 LDR R0, =aErrorLoadingKernelcache ; "error loading kernelcache\n"
N88AP_iBoot:4FF00842 010 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00846 010 B loc_4FF0085C ; Branch
N88AP_iBoot:4FF00848 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00848
N88AP_iBoot:4FF00848 loc_4FF00848 ; CODE XREF: n88ap__iBoot__bootx_function+56�j
N88AP_iBoot:4FF00848 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; param_R1
N88AP_iBoot:4FF0084A 010 LDR R0, =aKernelcachePreppedAtAddress0x08x ; "kernelcache prepped at address 0x%08x\n"
N88AP_iBoot:4FF0084C 010 BL N88AP__iBOOT__console_printf ; Branch with Link
N88AP_iBoot:4FF00850 010 LDR R2, =dword_4FF2DC40 ; Load from Memory
N88AP_iBoot:4FF00852 010 MOVS R0, #3 ; Rd = Op2
N88AP_iBoot:4FF00854 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; Load from Memory
N88AP_iBoot:4FF00856 010 LDR R2, [R2] ; Load from Memory
N88AP_iBoot:4FF00858 010 BL jump_to_addr ; Branch with Link
N88AP_iBoot:4FF0085C
N88AP_iBoot:4FF0085C loc_4FF0085C ; CODE XREF: n88ap__iBoot__bootx_function+38�j
N88AP_iBoot:4FF0085C ; n88ap__iBoot__bootx_function+5E�j
N88AP_iBoot:4FF0085C 010 MOV R0, R4 ; Rd = Op2
N88AP_iBoot:4FF0085E 010 SUB.W SP, R7, #4 ; Rd = Op1 - Op2
N88AP_iBoot:4FF00862 010 POP {R4,R7,PC} ; Pop registers
N88AP_iBoot:4FF00862 ; End of function n88ap__iBoot__bootx_function
N88AP_iBoot:4FF00862
N88AP_iBoot:4FF00862 ; ---------------------------------------------------------------------------
N88AP_iBoot:4FF00864 off_4FF00864 DCD aHelp ; DATA XREF: n88ap__iBoot__bootx_function+E�r
N88AP_iBoot:4FF00864 ; "help"
N88AP_iBoot:4FF00868 ; int off_4FF00868
N88AP_iBoot:4FF00868 off_4FF00868 DCD aUsageSAddress ; DATA XREF: n88ap__iBoot__bootx_function+18�r
N88AP_iBoot:4FF00868 ; "usage:\n\t%s [<address>]\n"
N88AP_iBoot:4FF0086C ; int off_4FF0086C
N88AP_iBoot:4FF0086C off_4FF0086C DCD aPermissionDenied ; DATA XREF: n88ap__iBoot__bootx_function+2E�r
N88AP_iBoot:4FF0086C ; "Permission Denied\n"
N88AP_iBoot:4FF00870 ; int off_4FF00870
N88AP_iBoot:4FF00870 off_4FF00870 DCD aAttemptingToValidateKernelcache0x08x
N88AP_iBoot:4FF00870 ; DATA XREF: n88ap__iBoot__bootx_function+3E�r
N88AP_iBoot:4FF00870 ; "Attempting to validate kernelcache @ 0x"...
N88AP_iBoot:4FF00874 ; int off_4FF00874
N88AP_iBoot:4FF00874 off_4FF00874 DCD aErrorLoadingKernelcache
N88AP_iBoot:4FF00874 ; DATA XREF: n88ap__iBoot__bootx_function+58�r
N88AP_iBoot:4FF00874 ; "error loading kernelcache\n"
N88AP_iBoot:4FF00878 ; int off_4FF00878
N88AP_iBoot:4FF00878 off_4FF00878 DCD aKernelcachePreppedAtAddress0x08x
N88AP_iBoot:4FF00878 ; DATA XREF: n88ap__iBoot__bootx_function+62�r
N88AP_iBoot:4FF00878 ; "kernelcache prepped at address 0x%08x\n"
N88AP_iBoot:4FF0087C off_4FF0087C DCD dword_4FF2DC40 ; DATA XREF: n88ap__iBoot__bootx_function+68�r
</pre>

N88AP/Device Tree

2010-02-21T17:36:19Z

WillStrafach: /* Interrupts */

== Address Spaces ==
<pre>
/arm-io: base = 80000000
/arm-io/vic: BF200000:00030000
/arm-io/gpio: 83000000:00001000
/arm-io/pmgr: BF100000:00002000
/arm-io/pmgr: BFC00000:00001000
/arm-io/pmgr: C0000000:00004000
/arm-io/pmgr: CFFFC000:00004000
/arm-io/cdma: 87000000:0001C000
/arm-io/cdma: 87800000:00009000
/arm-io/dart0: BFE00000:00001000
/arm-io/dart1: BFF00000:00001000
/arm-io/sdio: 80000000:00001000
/arm-io/sha1: 80100000:00001000
/arm-io/ceata: 81000000:00001000
/arm-io/flash-controller0: 81200000:00001000
/arm-io/flash-controller0: 81300000:00001000
/arm-io/sgx: 85300000:00001000
/arm-io/scaler: 85500000:00001000
/arm-io/tv-out: 85600000:00001000
/arm-io/tv-out: 85200000:00001000
/arm-io/tv-out: 85100000:00001000
/arm-io/isp: 88300000:000D4000
/arm-io/isp: 88100000:00001000
/arm-io/venc: 88000000:00001000
/arm-io/vxd: 85000000:00100000
/arm-io/spi0: 82000000:00001000
/arm-io/spi0/nor-flash: base = 00000000
/arm-io/spi0/nor-flash/diagnostic-data: 00006000:00002000
/arm-io/spi0/nor-flash/diagnostic-data: 00004000:00002000
/arm-io/spi0/nor-flash/nvram: 000FC000:00002000
/arm-io/spi0/nor-flash/nvram: 000FE000:00002000
/arm-io/spi0/nor-flash/raw-device: 00008000:000F4000
/arm-io/spi0/nor-flash/raw-device: 00000000:00001000
/arm-io/spi1: 82100000:00001000
/arm-io/spi2: 82200000:00001000
/arm-io/uart0: 82500000:00001000
/arm-io/uart1: 82600000:00001000
/arm-io/uart2: 82700000:00001000
/arm-io/uart3: 82800000:00001000
/arm-io/uart4: 82900000:00001000
/arm-io/pke: 83100000:00001000
/arm-io/i2c0: 83200000:00001000
/arm-io/i2c2: 83400000:00001000
/arm-io/pwm: 83500000:00001000
/arm-io/otgphyctrl: 86000000:00001000
/arm-io/usb-otg: 86100000:00010000
/arm-io/iop: 86300000:00001000
/arm-io/iop: BF300000:00001000
/arm-io/clcd: 85400000:00003000
/arm-io/mipi-dsim: 89000000:00001000
/arm-io/swi: 89100000:00001000
/arm-io/audio-complex: 84300000:00005000
/arm-io/audio-complex: 84400000:00001000
/arm-io/i2s0: 84500000:00001000
/arm-io/i2s1: 84501000:00001000
/arm-io/i2s2: 84502000:00001000
/arm-io/amc: 84100000:00003000
/arm-io/amc: 84000000:00038000
/arm-io/jpeg: 88200000:00001000
009016B0: / [bootrom]
00901FF0: /chosen
00902740: /cpus
00902780: /chosen/memory-map
009028C0: /options
009028E0: /chosen/iBoot
00903010: /aliases
00903050: /cpus/cpu0 [cpu]
ipi_dispatch = /arm-io/vic['IPID'](0x00000000)
cpu_idle = /arm-io/pmgr['cpuI']()
interrupt-parent = /arm-io/vic
00903CE0: /memory [memory]
00903F20: /pram [pram]
009041E0: /vram [vram]
00904460: /arm-io [s5l8920x-io]
clock_gate = /arm-io/pmgr['clkG']()
00904BE0: /buttons [buttons]
button_voldown = /arm-io/gpio['GPIO'](0x00001601, 0x00000000)
button_volup = /arm-io/gpio['GPIO'](0x00001600, 0x00000000)
wake_button_menu = /arm-io/i2c0/pmu['STAT'](0x00000180)
wake_button_hold = /arm-io/i2c0/pmu['STAT'](0x00000181)
button_hold = /arm-io/gpio['GPIO'](0x00001607, 0x00000100)
button_menu = /arm-io/gpio['GPIO'](0x00001606, 0x00000100)
button_ringerab = /arm-io/gpio['GPIO'](0x00001403, 0x00000000)
interrupt-parent = /arm-io/gpio
00904C20: /arm-io/vic [interrupt-controller]
00905260: /arm-io/pmgr [timer]
core_voltage_1 = /arm-io/swi['corV'](0x003C0002)
core_voltage_0 = /arm-io/swi['corV'](0x003C0001)
core_voltage_2 = /arm-io/swi['corV'](0x003C0003)
00905280: /arm-io/gpio [interrupt-controller]
interrupt-parent = /arm-io/vic
009070B0: /arm-io/cdma [cdma]
interrupt-parent = /arm-io/vic
00907710: /arm-io/dart0 [dart]
interrupt-parent = /arm-io/vic
00907BE0: /arm-io/dart1 [dart]
interrupt-parent = /arm-io/vic
009080F0: /arm-io/sdio [sdio]
device_reset = /arm-io/gpio['GPIO'](0x00001605, 0x00010101)
device_wake = /arm-io/gpio['GPIO'](0x00001404, 0x00000101)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
00908B70: /arm-io/sha1 [sha1]
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
009090C0: /arm-io/ceata [ceata]
interrupt-parent = /arm-io/vic
009095E0: /arm-io/flash-controller0 [fmi]
device1_reset = /arm-io/pmgr['ARST'](0x00000027)
device0_reset = /arm-io/pmgr['ARST'](0x00000026)
interrupt-parent = /arm-io/vic
00909D50: /arm-io/sgx [sgx]
perf_advise = /arm-io/pmgr['PRFA']()
interrupt-parent = /arm-io/vic
00909D90: /arm-io/flash-controller0/disk [nand]
0090A990: /arm-io/scaler [scaler]
interrupt-parent = /arm-io/vic
0090AF50: /arm-io/tv-out [tv-out]
video_ldo = /arm-io/i2c0/pmu['pmuL'](0x0BB80002)
amp_enable = /arm-io/gpio['GPIO'](0x00000A03, 0x00000101)
interrupt-parent = /arm-io/vic
0090B9E0: /arm-io/isp [isp]
sensor_shutdown = /arm-io/gpio['GPIO'](0x00000306, 0x02000101)
device_reset = /arm-io/pmgr['ARST'](0x00000012)
sensor_extclk = /arm-io/gpio['GPIO'](0x00000307, 0x02000101)
interrupt-parent = /arm-io/vic
0090C4E0: /arm-io/venc [venc]
interrupt-parent = /arm-io/vic
0090C990: /arm-io/vxd [vxd]
interrupt-parent = /arm-io/vic
0090CE80: /arm-io/spi0 [spi]
spi_cs0 = /arm-io/gpio['GPIO'](0x00001204, 0x00000001)
interrupt-parent = /arm-io/vic
0090D5F0: /arm-io/spi1 [spi]
spi_cs0 = /arm-io/gpio['GPIO'](0x00001300, 0x00010001)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
0090D630: /arm-io/spi0/nor-flash [nor-flash]
0090DAE0: /arm-io/spi0/nor-flash/diagnostic-data [diagnostic-data]
0090DE30: /arm-io/spi0/nor-flash/raw-device [raw-device]
0090DE50: /arm-io/spi0/nor-flash/nvram [nvram]
0090EFA0: /arm-io/spi2 [spi]
sclk = /arm-io/gpio['GPIO'](0x00001300, 0x00000101)
srdy = /arm-io/gpio['GPIO'](0x00001304, 0x00000100)
fail_gpio = /arm-io/gpio['GPIO'](0x00000804, 0x00000102)
mosi = /arm-io/gpio['GPIO'](0x00001302, 0x03000102)
mrdy = /arm-io/gpio['GPIO'](0x00001802, 0x00000101)
interrupt-parent = /arm-io/gpio
dma-parent = /arm-io/cdma
0090EFE0: /arm-io/spi1/multi-touch [multi-touch]
reset = /arm-io/gpio['GPIO'](0x00001401, 0x00010001)
clock_enable = /arm-io/i2c0/pmu['GPIO'](0x00000000, 0x02000101)
enable_cs = /arm-io/gpio['GPIO'](0x00001300, 0x00000101)
power_ldo = /arm-io/i2c0/pmu['pmuL'](0x0708020B)
interrupt-parent = /arm-io/gpio
00910B00: /arm-io/uart0 [uart]
tx = /arm-io/gpio['GPIO'](0x00000906, 0x00000102)
interrupt-parent = /arm-io/vic
009111C0: /arm-io/uart0/iap
009112D0: /arm-io/uart1 [uart]
tx = /arm-io/gpio['GPIO'](0x00000802, 0x00000102)
rts = /arm-io/gpio['GPIO'](0x00000804, 0x00000101)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
00911E40: /arm-io/uart2 [uart]
tx = /arm-io/gpio['GPIO'](0x00000706, 0x00000102)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
00911E80: /arm-io/uart1/debug
009129A0: /arm-io/uart3 [uart]
tx = /arm-io/gpio['GPIO'](0x00000806, 0x00000102)
rts = /arm-io/gpio['GPIO'](0x00000900, 0x00000002)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/cdma
009129E0: /arm-io/uart2/umts [umts]
00913680: /arm-io/uart4 [uart]
tx = /arm-io/gpio['GPIO'](0x00000902, 0x00000102)
interrupt-parent = /arm-io/vic
009136C0: /arm-io/uart3/bluetooth [bluetooth]
bt_wake = /arm-io/gpio['GPIO'](0x00001602, 0x00000101)
bt_reset = /arm-io/gpio['GPIO'](0x00001506, 0x00000001)
00914460: /arm-io/uart4/gas-gauge [gas-gauge]
battery_swi = /arm-io/i2c0/pmu['GPIO'](0x00000005, 0x00000100)
00914570: /arm-io/pke [pke]
interrupt-parent = /arm-io/vic
00914EB0: /arm-io/i2c0 [i2c]
iic_sda = /arm-io/gpio['GPIO'](0x00000401, 0x00010101)
iic_scl = /arm-io/gpio['GPIO'](0x00000400, 0x00010101)
interrupt-parent = /arm-io/vic
009156D0: /arm-io/i2c2 [i2c]
iic_sda = /arm-io/gpio['GPIO'](0x00000405, 0x00010101)
iic_scl = /arm-io/gpio['GPIO'](0x00000404, 0x00010101)
interrupt-parent = /arm-io/vic
00915710: /arm-io/i2c0/accelerometer [accelerometer]
interrupt-parent = /arm-io/gpio
00915C20: /arm-io/i2c0/compass1 [compass1]
00915C40: /arm-io/i2c0/compass [compass]
interrupt-parent = /arm-io/gpio
009163F0: /arm-io/i2c0/audio0 [audio-control]
reset = /arm-io/gpio['GPIO'](0x00001406, 0x00010001)
mclk_control = /arm-io/pwm/codec-mclk['pwmC']()
hp_detect = /arm-io/i2c0/pmu['GPIO'](0x00000004, 0x00000100)
interrupt-parent = /arm-io/i2c0/pmu
00916F40: /arm-io/i2c0/pmu [interrupt-controller]
keepact = /arm-io/gpio['GPIO'](0x00000501, 0x00000101)
suspend_helper = /arm-io/pmgr['Sush']()
swi_write = /arm-io/swi['swiB']()
interrupt-parent = /arm-io/gpio
00917F70: /arm-io/i2c0/mikey [mikey]
interrupt-parent = /arm-io/i2c0/pmu
00918520: /arm-io/i2c0/tethered [tethered]
00919030: /arm-io/pwm [pwm]
interrupt-parent = /arm-io/vic
00919070: /arm-io/i2c2/als [als]
interrupt-parent = /arm-io/gpio
00919C20: /arm-io/otgphyctrl [otgphyctrl]
00919C60: /arm-io/pwm/vibrator [pwm]
00919EC0: /arm-io/pwm/codec-mclk [pwm]
0091A610: /arm-io/usb-otg [usb-otg]
accessory_detect = /dock['accD']()
usb_500_100 = /charger['CHRG'](0x00000000)
usb_swap_config = /dock['accA'](0x0000000A)
usb_suspend = /charger['CHRG'](0x00000001)
usb_brick_detect = /charger['CHRG'](0x00000002)
interrupt-parent = /arm-io/vic
0091B210: /arm-io/iop [iop]
device_reset = /arm-io/pmgr['ARST'](0x0000002E)
jtag_enable = /arm-io/gpio['GPIO'](0x00001503, 0x00000101)
interrupt-parent = /arm-io/vic
0091B250: /arm-io/usb-otg/usb-device [usb-device]
interrupt-parent = /arm-io/vic
0091B660: /arm-io/usb-otg/usb-host [usb-host]
interrupt-parent = /arm-io/vic
0091C310: /arm-io/clcd [clcd]
lcd_enable = /arm-io/mipi-dsim/lcd['lcdE']()
interrupt-parent = /arm-io/vic
0091C9F0: /arm-io/mipi-dsim [mipi-dsim]
interrupt-parent = /arm-io/vic
0091D0A0: /arm-io/swi [swi]
interrupt-parent = /arm-io/vic
0091D0E0: /arm-io/mipi-dsim/lcd [lcd]
reset = /arm-io/gpio['GPIO'](0x00000500, 0x00000001)
lcd_ldo = /arm-io/i2c0/pmu['pmuL'](0x0BB80100)
interrupt-parent = /arm-io/gpio
0091DDE0: /arm-io/audio-complex [audio-complex]
dma-parent = /arm-io/cdma
0091E490: /arm-io/i2s0 [i2s]
mclk_frequency = /arm-io/audio-complex['MCLK']()
dout = /arm-io/gpio['GPIO'](0x00001703, 0x02000000)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/audio-complex
0091E5B0: /arm-io/i2s1 [i2s]
mclk_frequency = /arm-io/audio-complex['MCLK']()
dout = /arm-io/gpio['GPIO'](0x00001800, 0x02000000)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/audio-complex
0091EE30: /arm-io/i2s0/audio0 [audio-data]
0091F230: /arm-io/i2s2 [i2s]
dout = /arm-io/gpio['GPIO'](0x00001805, 0x02000000)
interrupt-parent = /arm-io/vic
dma-parent = /arm-io/audio-complex
0091FA80: /arm-io/i2s1/audio1 [audio-data]
00920790: /arm-io/amc [amc]
device_reset = /arm-io/pmgr['ARST'](0x00000018)
interrupt-parent = /arm-io/vic
009207D0: /arm-io/i2s2/audio2 [audio-data]
00921260: /arm-io/jpeg [jpeg]
interrupt-parent = /arm-io/vic
009225C0: /dock [dock]
read_acc = /arm-io/i2c0/pmu['pmuA'](0x00000003)
acc_sw_en = /arm-io/i2c0/pmu['pmuL'](0x80000005)
acc_detect = /arm-io/i2c0/pmu['STAT'](0x00000005)
acc_pwr = /arm-io/i2c0/pmu['pmuL'](0x0CE40005)
interrupt-parent = /arm-io/i2c0/pmu
00922D60: /charger [charger]
battery_pack = /dock['accA'](0x0000000B)
set_dmonitor = /arm-io/otgphyctrl['DMON'](0x00000000)
00923410: /baseband [baseband]
bb_rst = /arm-io/gpio['GPIO'](0x00001407, 0x00000101)
bt_reset = /arm-io/gpio['GPIO'](0x00001506, 0x00000001)
radio_on = /arm-io/gpio['GPIO'](0x00001405, 0x00000101)
bb_on = /arm-io/i2c0/pmu['GPIO'](0x00000002, 0x00010001)
bb_usart0_rxd_ctrl = /arm-io/gpio['GPIO'](0x00000F02, 0x00010101)
wlan_reset = /arm-io/gpio['GPIO'](0x00001605, 0x00000001)
dock_uart_ctrl = /arm-io/i2c0/pmu['GPIO'](0x00000003, 0x00010101)
reset_det = /arm-io/gpio['GPIO'](0x00001500, 0x00010000)
umts_rxd_ctrl = /arm-io/gpio['GPIO'](0x00000F03, 0x00010101)
sdio0_clk = /arm-io/gpio['GPIO'](0x00001102, 0x00010102)
uart3_tx = /arm-io/gpio['GPIO'](0x00000806, 0x00000102)
interrupt-parent = /arm-io/gpio
</pre>
== GPIO ==
<pre>
<gpio>
0x0 = gpio_multi-touch_clock_enable
0x2 = gpio_baseband_bb_on
0x3 = gpio_baseband_dock_uart_ctrl
0x4 = gpio_audio0_hp_detect
0x5 = gpio_gas-gauge_battery_swi
0x306 = gpio_isp_sensor_shutdown
0x307 = gpio_isp_sensor_extclk
0x400 = gpio_i2c0_iic_scl
0x401 = gpio_i2c0_iic_sda
0x404 = gpio_i2c2_iic_scl
0x405 = gpio_i2c2_iic_sda
0x500 = gpio_lcd_reset
0x501 = gpio_pmu_keepact
0x706 = gpio_uart2_tx
0x802 = gpio_uart1_tx
0x804 = gpio_uart1_rts
0x806 = gpio_baseband_uart3_tx
0x900 = gpio_uart3_rts
0x902 = gpio_uart4_tx
0x906 = gpio_uart0_tx
0xA03 = gpio_tv-out_amp_enable
0xF02 = gpio_baseband_bb_usart0_rxd_ctrl
0xF03 = gpio_baseband_umts_rxd_ctrl
0x1102 = gpio_baseband_sdio0_clk
0x1204 = gpio_spi0_spi_cs0
0x1300 = gpio_multi-touch_enable_cs
0x1302 = gpio_spi2_mosi
0x1304 = gpio_spi2_srdy
0x1401 = gpio_multi-touch_reset
0x1403 = gpio_buttons_button_ringerab
0x1404 = gpio_sdio_device_wake
0x1405 = gpio_baseband_radio_on
0x1406 = gpio_audio0_reset
0x1407 = gpio_baseband_bb_rst
0x1500 = gpio_baseband_reset_det
0x1502 = gpio_usb_plugged_in // not in devtree for some reason
0x1503 = gpio_iop_jtag_enable
0x1506 = gpio_baseband_bt_reset
0x1600 = gpio_buttons_button_volup
0x1601 = gpio_buttons_button_voldown
0x1602 = gpio_bluetooth_bt_wake
0x1605 = gpio_baseband_wlan_reset
0x1606 = gpio_buttons_button_menu
0x1607 = gpio_buttons_button_hold
0x1703 = gpio_i2s0_dout
0x1800 = gpio_i2s1_dout
0x1802 = gpio_spi2_mrdy
0x1805 = gpio_i2s2_dout
</pre>

== Interrupts ==
<pre>
<interrupts for /arm-io/gpio>
int 00000000 = /arm-io/spi1/multi-touch
int 00000001 = /arm-io/i2c2/als
int 00000002 = /arm-io/mipi-dsim/lcd
int 00000003 = /arm-io/i2c0/compass
int 00000004 = /baseband
int 00000005 = /buttons
int 00000007 = /buttons
int 00000090 = /arm-io/i2c0/compass
int 0000009C = /arm-io/spi2
int 0000009D = /arm-io/i2c0/pmu
int 0000009E = /arm-io/i2c2/als
int 000000A2 = /arm-io/i2c0/accelerometer
int 000000A3 = /buttons
int 000000A8 = /baseband
int 000000AF = /arm-io/mipi-dsim/lcd
int 000000B0 = /buttons
int 000000B1 = /buttons
int 000000B4 = /arm-io/spi1/multi-touch
int 000000B6 = /buttons
int 000000B7 = /buttons
<interrupts for /arm-io/i2c0/pmu>
int 00000000 = /arm-io/i2c0/mikey
int 00000005 = /dock
int 00000014 = /arm-io/i2c0/audio0
int 00000017 = /arm-io/i2c0/mikey
int 00000054 = /arm-io/i2c0/mikey
<interrupts for /arm-io/vic>
int 00000000 = /cpus/cpu0
int 00000002 = /arm-io/nmi // not in devicetree, nand management interface
int 00000003 = /arm-io/iop(dma)
int 00000005 = /arm-io/pmu // also not in devicetree
int 00000007 = /arm-io/swi
int 00000009 = /arm-io/isp
int 0000000A = /arm-io/isp
int 0000000C = /arm-io/scaler
int 0000000E = /arm-io/usb-otg/usb-host
int 0000000F = /arm-io/pwm
int 00000010 = /arm-io/pke
int 00000011 = /arm-io/i2c2
int 00000013 = /arm-io/i2c0
int 00000014 = /arm-io/uart4
int 00000015 = /arm-io/uart3
int 00000016 = /arm-io/uart2
int 00000017 = /arm-io/uart1
int 00000018 = /arm-io/uart0
int 0000001C = /arm-io/spi1
int 0000001D = /arm-io/spi0
int 0000001E = /arm-io/flash-controller0
int 0000001F = /arm-io/flash-controller0
int 00000020 = /arm-io/ceata
int 00000021 = /arm-io/sha1
int 00000022 = /arm-io/sdio
int 00000023 = /arm-io/tv-out
int 00000024 = /arm-io/mipi-dsim
int 00000025 = /arm-io/clcd
int 00000026 = /arm-io/venc
int 00000027 = /arm-io/tv-out
int 00000029 = /arm-io/sgx
int 0000002A = /arm-io/vxd
int 0000002B = /arm-io/cdma
int 0000002C = /arm-io/cdma
int 0000002D = /arm-io/cdma
int 0000002E = /arm-io/cdma
int 0000002F = /arm-io/cdma
int 00000030 = /arm-io/cdma
int 00000031 = /arm-io/cdma
int 00000032 = /arm-io/cdma
int 00000033 = /arm-io/cdma
int 00000034 = /arm-io/cdma
int 00000035 = /arm-io/cdma
int 00000036 = /arm-io/cdma
int 00000037 = /arm-io/cdma
int 00000038 = /arm-io/cdma
int 00000039 = /arm-io/cdma
int 0000003A = /arm-io/cdma
int 0000003B = /arm-io/cdma
int 0000003C = /arm-io/cdma
int 0000003D = /arm-io/cdma
int 0000003E = /arm-io/cdma
int 0000003F = /arm-io/cdma
int 00000040 = /arm-io/cdma
int 00000041 = /arm-io/cdma
int 00000042 = /arm-io/cdma
int 00000043 = /arm-io/cdma
int 00000044 = /arm-io/cdma
int 00000045 = /arm-io/cdma
int 00000046 = /arm-io/amc
int 00000047 = /arm-io/amc
int 00000048 = /arm-io/amc
int 00000049 = /arm-io/amc
int 0000004A = /arm-io/amc
int 0000004B = /arm-io/amc
int 0000004C = /arm-io/amc
int 0000004D = /arm-io/amc
int 0000004E = /arm-io/amc
int 0000004F = /arm-io/amc
int 00000050 = /arm-io/amc
int 00000051 = /arm-io/amc
int 00000052 = /arm-io/amc
int 00000053 = /arm-io/amc
int 00000054 = /arm-io/amc
int 00000055 = /arm-io/amc
int 00000056 = /arm-io/amc
int 00000057 = /arm-io/amc
int 00000058 = /arm-io/amc
int 00000059 = /arm-io/dart1
int 0000005A = /arm-io/dart0
int 0000005D = /arm-io/jpeg
int 0000005E = /arm-io/gpio
int 0000005F = /cpus/cpu0
</pre>

== DMA Channels ==
<pre>
<dma channels for /arm-io/audio-complex>
dma 00000000 = /arm-io/i2s0
dma 00000001 = /arm-io/i2s0
dma 00000002 = /arm-io/i2s1
dma 00000003 = /arm-io/i2s1
dma 00000004 = /arm-io/i2s2
dma 00000005 = /arm-io/i2s2
<dma channels for /arm-io/cdma>
dma 00000000 = /arm-io/audio-complex
dma 00000003 = /arm-io/sdio
dma 00000004 = /arm-io/sha1
dma 0000000A = /arm-io/uart1
dma 0000000B = /arm-io/uart2
dma 0000000C = /arm-io/uart3
dma 0000000D = /arm-io/uart3
dma 00000010 = /arm-io/spi2
dma 00000011 = /arm-io/spi2
dma 00000012 = /arm-io/spi1
dma 00000013 = /arm-io/spi1
dma 00000015 = /arm-io/audio-complex
dma 00000016 = /arm-io/audio-complex
dma 00000017 = /arm-io/audio-complex
dma 00000018 = /arm-io/audio-complex
dma 00010001 = /arm-io/uart3
dma 00010004 = /arm-io/spi2
dma 00040002 = /arm-io/audio-complex
dma 00100004 = /arm-io/sha1
dma 80000020 = /arm-io/sdio
dma 801000A0 = /arm-io/sha1
dma 82100010 = /arm-io/spi1
dma 82100020 = /arm-io/spi1
dma 82200010 = /arm-io/spi2
dma 82200020 = /arm-io/spi2
dma 82600024 = /arm-io/uart1
dma 82700024 = /arm-io/uart2
dma 82800020 = /arm-io/uart3
dma 82800024 = /arm-io/uart3
dma 84000000 = /arm-io/audio-complex
dma 84000004 = /arm-io/audio-complex
dma 84000008 = /arm-io/audio-complex
dma 8400000C = /arm-io/audio-complex
</pre>

== Clock Gates ==
<pre>
<clock gates for clock id 16>
gate 00000010 = /arm-io/sdio
<clock gates for clock id 17>
gate 00000011 = /arm-io/sha1
<clock gates for clock id 18>
gate 00000012 = /arm-io/ceata
<clock gates for clock id 19>
gate 00000013 = /arm-io/flash-controller0
gate 00000014 = /arm-io/flash-controller0
<clock gates for clock id 21>
gate 00000015 = /arm-io/spi0
<clock gates for clock id 22>
gate 00000016 = /arm-io/spi1
<clock gates for clock id 23>
gate 00000017 = /arm-io/spi2
<clock gates for clock id 26>
gate 0000001A = /arm-io/uart0
<clock gates for clock id 27>
gate 0000001B = /arm-io/uart1
<clock gates for clock id 28>
gate 0000001C = /arm-io/uart2
<clock gates for clock id 29>
gate 0000001D = /arm-io/uart3
<clock gates for clock id 30>
gate 0000001E = /arm-io/uart4
<clock gates for clock id 31>
gate 0000001F = /arm-io/pke
<clock gates for clock id 32>
gate 00000020 = /arm-io/i2c0
<clock gates for clock id 34>
gate 00000022 = /arm-io/i2c2
<clock gates for clock id 35>
gate 00000023 = /arm-io/pwm
<clock gates for clock id 36>
gate 00000024 = /arm-io/otgphyctrl
<clock gates for clock id 37>
gate 00000025 = /arm-io/usb-otg
<clock gates for clock id 39>
gate 00000027 = /arm-io/iop
<clock gates for clock id 40>
gate 00000028 = /arm-io/vxd
<clock gates for clock id 41>
gate 00000029 = /arm-io/sgx
<clock gates for clock id 42>
gate 0000002A = /arm-io/clcd
<clock gates for clock id 43>
gate 0000002B = /arm-io/scaler
<clock gates for clock id 44>
gate 0000002C = /arm-io/tv-out
<clock gates for clock id 45>
gate 0000002D = /arm-io/dart0
<clock gates for clock id 46>
gate 0000002E = /arm-io/venc
<clock gates for clock id 47>
gate 0000002F = /arm-io/jpeg
<clock gates for clock id 48>
gate 00000030 = /arm-io/isp
gate 00000031 = /arm-io/isp
gate 00000032 = /arm-io/isp
<clock gates for clock id 51>
gate 00000033 = /arm-io/dart1
<clock gates for clock id 52>
gate 00000034 = /arm-io/mipi-dsim
<clock gates for clock id 53>
gate 00000035 = /arm-io/swi
gate 00000036 = /arm-io/swi
<clock gates for clock id 55>
gate 00000037 = /arm-io/audio-complex
<clock gates for clock id 56>
gate 00000038 = /arm-io/amc
<clock gates for clock id 57>
gate 00000039 = /arm-io/i2s0
<clock gates for clock id 58>
gate 0000003A = /arm-io/i2s1
<clock gates for clock id 59>
gate 0000003B = /arm-io/i2s2
</pre>

A4

2010-02-14T09:56:01Z

WillStrafach:

A4 is a SoC designed by Apple in-house chip design department. It is used in [[k48ap|iPad]].

== Specifications ==
* '''CPU''': ARM Cortex-A9 MPCore
* '''GPU''': PowerVR SGX 545
* '''A/V Playback''': PowerVR VXD

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx
* http://infocenter.arm.com/help/topic/com.arm.doc.ddi0407e/DDI0407E_cortex_a9_mpcore_r2p0_trm.pdf

IBoot (Bootloader)

2010-02-14T09:54:20Z

WillStrafach: /* Commands used as an exploit vector */

{{DISPLAYTITLE:iBoot}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Revisions ==
* [[iBoot-99]] (1A420 a.k.a. Prototype)
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 3A109a)
* [[iBoot-204.0.2]] (1.1.1 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1 and 3.1.1)
* [[iBoot-636.66]] (3.1.1 7C146 and 3.1.2)
* [[iBoot-636.66.33]] (3.1.3)

==Commands used as an exploit vector==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
<pre>
// n88
0x4FF00000 => 0x0
0x40000000 => 0xC0000000
</pre>

== See also ==
* [[iBoot (Enums)]]

IBoot (Bootloader)

2010-02-14T09:53:57Z

WillStrafach: /* Commands used as an exploit vector */

{{DISPLAYTITLE:iBoot}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Revisions ==
* [[iBoot-99]] (1A420 a.k.a. Prototype)
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 3A109a)
* [[iBoot-204.0.2]] (1.1.1 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1 and 3.1.1)
* [[iBoot-636.66]] (3.1.1 7C146 and 3.1.2)
* [[iBoot-636.66.33]] (3.1.3)

==Commands used as an exploit vector==
* ''diags'': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* ''arm7_go'': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
<pre>
// n88
0x4FF00000 => 0x0
0x40000000 => 0xC0000000
</pre>

== See also ==
* [[iBoot (Enums)]]

IBoot (Bootloader)

2010-02-14T09:53:38Z

WillStrafach: /* Commands used as an exploit vector */

{{DISPLAYTITLE:iBoot}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Revisions ==
* [[iBoot-99]] (1A420 a.k.a. Prototype)
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 3A109a)
* [[iBoot-204.0.2]] (1.1.1 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1 and 3.1.1)
* [[iBoot-636.66]] (3.1.1 7C146 and 3.1.2)
* [[iBoot-636.66.33]] (3.1.3)

==Commands used as an exploit vector==
* **diags**: Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at written to 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* **arm7_go**: For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
<pre>
// n88
0x4FF00000 => 0x0
0x40000000 => 0xC0000000
</pre>

== See also ==
* [[iBoot (Enums)]]

Kernelcache

2010-02-03T21:39:23Z

WillStrafach:

The kernelcache is basically the kernel itself as well as all of its extensions (AppleImage3NORAccess, IOAESAccelerator, IOPKEAccelerator, etc.) into one file, then packed / encrypted in an [[IMG3 File Format|IMG3]] (Firmware 2.0 and above) or [[8900 File Format|8900]] (Firmwares 1.0 [production] through 1.1.4) container.

IBoot-636.66.33

2010-02-03T19:46:45Z

WillStrafach:

== Changes ==
* [[usb_control_msg(0x21, 2) Exploit]] fixed
* There are no longer assert()'s for the usb otg hardware handler functions, normally checked for in usb_core_init();
* Two new tasks: usb-high-current and usb-no-current

== Allowed ==
=== Commands ===
* [[bootx (iBoot command)|bootx]]
* [[reboot (iBoot command)|reboot]]
* [[reboot (iBoot command)|reset]]
* [[bgcolor (iBoot command)|bgcolor]]
* [[setpicture (iBoot command)|setpicture]]
* [[go (iBoot command)|go]]
* [[ramdisk (iBoot command)|ramdisk]]
* [[devicetree (iBoot command)|devicetree]]
* [[getenv (iBoot command)|getenv]]
* [[setenv (iBoot command)|setenv]]
* [[saveenv (iBoot command)|saveenv]]

=== Environmental Vars ===
* [[auto-boot (iBoot variable)|auto-boot]]
* [[boot-args (iBoot variable)|boot-args]]
* [[debug-uarts (iBoot variable)|debug-uarts]]
* [[filesize (iBoot variable)|filesize]]

Recovery Mode

2010-02-03T17:41:12Z

WillStrafach:

Recovery Mode is a failsafe in [[iBoot]] that is used to reflash the device with a new OS, whether the currently installed one is somehow damaged or the device is undergoing an upgrade via [[iTunes]].

== Entering Recovery Mode ==
# Turn the device completely off and disconnect it from cable/dock.
# Hold down the home button.
# While holding down the home button connect to a computer with a cable (easiest) or dock.
# Keep holding down the home button until you see a connect-to-[[iTunes]] screen (on a QuickPwn'ed phone a drawing of Steve might be shown). You are now in recovery mode.

To escape Recovery Mode and power the phone off simply hold down power and home buttons for ten seconds.

==Protocols==
*[[Recovery Mode 0x1280]] in pre-2.0
*[[Recovery Mode 0x1281]] in 2.0 and above

Debug-uarts (iBoot variable)

2010-02-03T17:39:28Z

WillStrafach: New page: If set to 1, LLB and iBoot will give debug output over serial while booting or while in Recovery Mode]. This allows you to see things like the list of firmware images in flash ...

If set to 1, [[LLB]] and [[iBoot]] will give debug output over serial while booting or while in [[Recovery Mode]]]. This allows you to see things like the list of firmware images in flash and the information that it output whilst the LCD is initialized (ie. pre-"[[Recovery Mode]]" output).

Note that as a consequence, when set to 1, output over USB may be very choppy for reasons that have not yet been investigated.

Auto-boot (iBoot variable)

2010-02-03T17:35:46Z

WillStrafach: New page: If set to false or 0, the device will boot straight into recovery mode when powered on. iBoot is what checks for this variable while booting. If set to true or 1, the device will boot ...

If set to false or 0, the device will boot straight into recovery mode when powered on. [[iBoot]] is what checks for this variable while booting. If set to true or 1, the device will boot normally.

IBoot-636.66.33

2010-02-03T17:33:59Z

WillStrafach: New page: == Allowed == === Commands === * bootx * reboot * reset * bgcolor * [[setpicture...