The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "S5L8720 Timers (Hardware)"

From The iPhone Wiki
Jump to: navigation, search
 
Line 1: Line 1:
  +
==S5L8720 Timer Hardware==
  +
Base Address: 0x3C700000
   
  +
==Common Registers==
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Register
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Function
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|align="left" width="100px" |0x118
  +
|align="left" |Timer 4-7 IRQ Status, write to clear interrupt request
  +
|}
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
  +
====IRQ Status Register (0x118)====
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Bit
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="60px" |Access
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Function
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
  +
|2-0||R||Timer 7 Flags (execute handler 1 to 3)
  +
|-
  +
|7-3||x||No Function / Unknown
  +
|-
  +
|10-8||R||Timer 6 Flags (execute handler 1 to 3)
  +
|-
  +
|15-11||x||No Function / Unknown
  +
|-
  +
|18-16||R||Timer 5 Flags (execute handler 1 to 3)
  +
|-
  +
|23-19||x||No Function / Unknown
  +
|-
  +
|26-24||R||Timer 4 Flags (execute handler 1 to 3)
  +
|-
  +
|31-27||x||No Function / Unknown
  +
|}
  +
RW: Read/Write Access, x: Don't know
   
  +
==RTC Registers==
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Register
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Function
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|0x80
  +
|RTC Ticks High
  +
|-
  +
|0x84
  +
|RTC Ticks Low
  +
|-
  +
|0x88
  +
|On init: 0xA, then after the others: 0x18010
  +
|-
  +
|0x8C
  +
|On init: 0xFFFFFFFF
  +
|-
  +
|0x90
  +
|On init: 0xFFFFFFFF
  +
|-
  +
|0x94
  +
|On init: 0xFFFFFFFF
  +
|-
  +
|0x98
  +
|On init: 0xFFFFFFFF
  +
|}
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
  +
==Timers==
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
===Timer Bases===
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |TimerNumber
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
! 0 !! 1 !! 2 !! 3 !! 4 !! 5 !! 6 !! 7
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
  +
|Base ||align="center"| 0x0 ||align="center"| 0x20 ||align="center"| 0x40 ||align="center"| 0x60
  +
|align="center"| 0xA0 ||align="center"| 0xC0 ||align="center"| 0xE0 ||align="center"| 0x100
  +
|-
  +
|Width ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit ||align="center"| 16Bit
  +
|align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit ||align="center"| 32Bit
  +
|}
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
  +
===Timer Registers===
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Register
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Name
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|0x00
  +
|Config Register
  +
|-
  +
|0x04
  +
|Control Register
  +
|-
  +
|0x08
  +
|Compare Buffer Register (TCMPB)
  +
|-
  +
|0x0C
  +
|Counter Buffer register (TCNTB)
  +
|-
  +
|0x10
  +
|10-Bit Prescaler
  +
|-
  +
|0x14
  +
|Observation Register (TCNTO)
  +
|}
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
  +
===Register Description===
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
====Config Register====
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Bit
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="60px" |Access
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Function
  +
|-
  +
|2-0||x||No Function / Unknown
  +
|-
  +
|3||RW||Switches Bit 23 (TOUT) randomly if set...
  +
|-
  +
|4||RW||Compare Mode: Counter runs up to TCMPB (Modebit 0)
  +
|-
  +
|5||RW||Auto-Reload: (Modebit 1)
  +
{|
  +
|1 = One-Shoot
  +
|-
  +
|0 = Interval Mode
  +
|-
  +
|Counter runs up to TCMPB
  +
|}
  +
|-
  +
|6||RW||Clock Select
  +
{|
  +
|0 ||=>||align="right"|133MHz Timer Clock
  +
|-
  +
|1 and Divider = 1 and Prescaler = 0 ||=>||align="right"|133MHz Timer Clock
  +
|-
  +
|1 and (Divider > 1 or Prescaler > 0) ||=>||align="right"|24MHz Timer Clock
  +
|}
  +
|-
  +
|7||RW||Unknown
  +
|-
  +
|10-8||RW||Divider
  +
|-
  +
|11||RW||Invert TOUT
  +
|-
  +
|14-12||RW||Unknown
  +
|-
  +
|15||x||No Function / Unknown
  +
|-
  +
|22-16||x||Unknown
  +
|-
  +
|23||RW
  +
|Timer Out (TOUT)
  +
{|
  +
|In mode 0x00: Bit 23 = Toggle when TCNT = 0
  +
|-
  +
|In mode 0x01: Bit 23 = (TCNT >= TCMP)
  +
|-
  +
|In mode 0x10: Bit 23 = (TCNT >= TCMP)
  +
|-
  +
|In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
  +
|}
  +
|-
  +
|24||RW||Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
  +
|-
  +
|27-25||x||No Function / Unknown
  +
|-
  +
|28||RW||When counting down, count down starting at TCMPB (Only on Timer 4-7)
  +
|-
  +
|31-29||x||No Function / Unknown
  +
|}
  +
RW: Read/Write Access, x: Don't know
   
  +
====Control Register====
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
{| style="width:100%" border="1"
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="100px" |Bit
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" width="60px" |Access
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
!align="left" |Function
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
|-
  +
|0||RW||Start / Stop
  +
|-
  +
|1||RW||Manual Update
  +
|-
  +
|3-2||x||No Function/ Unknown
  +
|-
  +
|4||RW||Resets all counter registers to 0
  +
|-
  +
|31-5||x||No Function/ Unknown
  +
|}
  +
RW: Read/Write Access, x: Don't know
   
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
   
  +
==References==
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
Information gathered from:
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
*Reversing iBoot
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
*openiBoot
−
Haxed by 1337Urmom at The Pois0nhack team
  
  +
*Playing with the registers when iBoot is running
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  
−
Haxed by 1337Urmom at The Pois0nhack team
  

Latest revision as of 07:24, 7 November 2009

S5L8720 Timer Hardware

Base Address: 0x3C700000

Common Registers

Register Function
0x118 Timer 4-7 IRQ Status, write to clear interrupt request


IRQ Status Register (0x118)

Bit Access Function
2-0 R Timer 7 Flags (execute handler 1 to 3)
7-3 x No Function / Unknown
10-8 R Timer 6 Flags (execute handler 1 to 3)
15-11 x No Function / Unknown
18-16 R Timer 5 Flags (execute handler 1 to 3)
23-19 x No Function / Unknown
26-24 R Timer 4 Flags (execute handler 1 to 3)
31-27 x No Function / Unknown

RW: Read/Write Access, x: Don't know

RTC Registers

Register Function
0x80 RTC Ticks High
0x84 RTC Ticks Low
0x88 On init: 0xA, then after the others: 0x18010
0x8C On init: 0xFFFFFFFF
0x90 On init: 0xFFFFFFFF
0x94 On init: 0xFFFFFFFF
0x98 On init: 0xFFFFFFFF


Timers

Timer Bases

TimerNumber 0 1 2 3 4 5 6 7
Base 0x0 0x20 0x40 0x60 0xA0 0xC0 0xE0 0x100
Width 16Bit 16Bit 16Bit 16Bit 32Bit 32Bit 32Bit 32Bit


Timer Registers

Register Name
0x00 Config Register
0x04 Control Register
0x08 Compare Buffer Register (TCMPB)
0x0C Counter Buffer register (TCNTB)
0x10 10-Bit Prescaler
0x14 Observation Register (TCNTO)


Register Description

Config Register

Bit Access Function
2-0 x No Function / Unknown
3 RW Switches Bit 23 (TOUT) randomly if set...
4 RW Compare Mode: Counter runs up to TCMPB (Modebit 0)
5 RW Auto-Reload: (Modebit 1)
1 = One-Shoot
0 = Interval Mode
Counter runs up to TCMPB
6 RW Clock Select
0 => 133MHz Timer Clock
1 and Divider = 1 and Prescaler = 0 => 133MHz Timer Clock
1 and (Divider > 1 or Prescaler > 0) => 24MHz Timer Clock
7 RW Unknown
10-8 RW Divider
11 RW Invert TOUT
14-12 RW Unknown
15 x No Function / Unknown
22-16 x Unknown
23 RW Timer Out (TOUT)
In mode 0x00: Bit 23 = Toggle when TCNT = 0
In mode 0x01: Bit 23 = (TCNT >= TCMP)
In mode 0x10: Bit 23 = (TCNT >= TCMP)
In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
24 RW Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
27-25 x No Function / Unknown
28 RW When counting down, count down starting at TCMPB (Only on Timer 4-7)
31-29 x No Function / Unknown

RW: Read/Write Access, x: Don't know

Control Register

Bit Access Function
0 RW Start / Stop
1 RW Manual Update
3-2 x No Function/ Unknown
4 RW Resets all counter registers to 0
31-5 x No Function/ Unknown

RW: Read/Write Access, x: Don't know


References

Information gathered from:

  • Reversing iBoot
  • openiBoot
  • Playing with the registers when iBoot is running
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=S5L8720_Timers_(Hardware)&oldid=5539"