S5L8720 Timers (Hardware)

From The iPhone Wiki
Jump to: navigation, search

S5L8720 Timer Hardware

Base Address: 0x3C700000

Common Registers

Register Function
0x118 Timer 4-7 IRQ Status, write to clear interrupt request


IRQ Status Register (0x118)

Bit Access Function
2-0 R Timer 7 Flags (execute handler 1 to 3)
7-3 x No Function / Unknown
10-8 R Timer 6 Flags (execute handler 1 to 3)
15-11 x No Function / Unknown
18-16 R Timer 5 Flags (execute handler 1 to 3)
23-19 x No Function / Unknown
26-24 R Timer 4 Flags (execute handler 1 to 3)
31-27 x No Function / Unknown

RW: Read/Write Access, x: Don't know

RTC Registers

Register Function
0x80 RTC Ticks High
0x84 RTC Ticks Low
0x88 On init: 0xA, then after the others: 0x18010
0x8C On init: 0xFFFFFFFF
0x90 On init: 0xFFFFFFFF
0x94 On init: 0xFFFFFFFF
0x98 On init: 0xFFFFFFFF


Timers

Timer Bases

TimerNumber 0 1 2 3 4 5 6 7
Base 0x0 0x20 0x40 0x60 0xA0 0xC0 0xE0 0x100
Width 16Bit 16Bit 16Bit 16Bit 32Bit 32Bit 32Bit 32Bit


Timer Registers

Register Name
0x00 Config Register
0x04 Control Register
0x08 Compare Buffer Register (TCMPB)
0x0C Counter Buffer register (TCNTB)
0x10 10-Bit Prescaler
0x14 Observation Register (TCNTO)


Register Description

Config Register

Bit Access Function
2-0 x No Function / Unknown
3 RW Switches Bit 23 (TOUT) randomly if set...
4 RW Compare Mode: Counter runs up to TCMPB (Modebit 0)
5 RW Auto-Reload: (Modebit 1)
1 = One-Shoot
0 = Interval Mode
Counter runs up to TCMPB
6 RW Clock Select
0 => 133MHz Timer Clock
1 and Divider = 1 and Prescaler = 0 => 133MHz Timer Clock
1 and (Divider > 1 or Prescaler > 0) => 24MHz Timer Clock
7 RW Unknown
10-8 RW Divider
11 RW Invert TOUT
14-12 RW Unknown
15 x No Function / Unknown
22-16 x Unknown
23 RW Timer Out (TOUT)
In mode 0x00: Bit 23 = Toggle when TCNT = 0
In mode 0x01: Bit 23 = (TCNT >= TCMP)
In mode 0x10: Bit 23 = (TCNT >= TCMP)
In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
24 RW Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
27-25 x No Function / Unknown
28 RW When counting down, count down starting at TCMPB (Only on Timer 4-7)
31-29 x No Function / Unknown

RW: Read/Write Access, x: Don't know

Control Register

Bit Access Function
0 RW Start / Stop
1 RW Manual Update
3-2 x No Function/ Unknown
4 RW Resets all counter registers to 0
31-5 x No Function/ Unknown

RW: Read/Write Access, x: Don't know


References

Information gathered from:

  • Reversing iBoot
  • openiBoot
  • Playing with the registers when iBoot is running