S5L8720/Hardware - Timers

From The Apple Wiki

S5L8720 Timer Hardware[edit]

Base Address: 0x3C700000

Common Registers[edit]

Register Function
0x118 Timer 4-7 IRQ Status, write to clear interrupt request


IRQ Status Register (0x118)[edit]

Bit Access Function
2-0 R Timer 7 Flags (execute handler 1 to 3)
7-3 x No Function / Unknown
10-8 R Timer 6 Flags (execute handler 1 to 3)
15-11 x No Function / Unknown
18-16 R Timer 5 Flags (execute handler 1 to 3)
23-19 x No Function / Unknown
26-24 R Timer 4 Flags (execute handler 1 to 3)
31-27 x No Function / Unknown

RW: Read/Write Access, x: Don't know

RTC Registers[edit]

Register Function
0x80 RTC Ticks High
0x84 RTC Ticks Low
0x88 On init: 0xA, then after the others: 0x18010
0x8C On init: 0xFFFFFFFF
0x90 On init: 0xFFFFFFFF
0x94 On init: 0xFFFFFFFF
0x98 On init: 0xFFFFFFFF


Timers[edit]

Timer Bases[edit]

TimerNumber 0 1 2 3 4 5 6 7
Base 0x0 0x20 0x40 0x60 0xA0 0xC0 0xE0 0x100
Width 16Bit 16Bit 16Bit 16Bit 32Bit 32Bit 32Bit 32Bit


Timer Registers[edit]

Register Name
0x00 Config Register
0x04 Control Register
0x08 Compare Buffer Register (TCMPB)
0x0C Counter Buffer register (TCNTB)
0x10 10-Bit Prescaler
0x14 Observation Register (TCNTO)


Register Description[edit]

Config Register[edit]

Bit Access Function
2-0 x No Function / Unknown
3 RW Switches Bit 23 (TOUT) randomly if set...
4 RW Compare Mode: Counter runs up to TCMPB (Modebit 0)
5 RW Auto-Reload: (Modebit 1)
1 = One-Shoot
0 = Interval Mode
Counter runs up to TCMPB
6 RW Clock Select
0 => 133MHz Timer Clock
1 and Divider = 1 and Prescaler = 0 => 133MHz Timer Clock
1 and (Divider > 1 or Prescaler > 0) => 24MHz Timer Clock
7 RW Unknown
10-8 RW Divider
11 RW Invert TOUT
14-12 RW Unknown
15 x No Function / Unknown
22-16 x Unknown
23 RW Timer Out (TOUT)
In mode 0x00: Bit 23 = Toggle when TCNT = 0
In mode 0x01: Bit 23 = (TCNT >= TCMP)
In mode 0x10: Bit 23 = (TCNT >= TCMP)
In mode 0x11: Bit 23 = Toggle when TCNT = TCMP
24 RW Counting Direction: 0 = Up, 1 = Down (Only on Timer 4-7)
27-25 x No Function / Unknown
28 RW When counting down, count down starting at TCMPB (Only on Timer 4-7)
31-29 x No Function / Unknown

RW: Read/Write Access, x: Don't know

Control Register[edit]

Bit Access Function
0 RW Start / Stop
1 RW Manual Update
3-2 x No Function/ Unknown
4 RW Resets all counter registers to 0
31-5 x No Function/ Unknown

RW: Read/Write Access, x: Don't know


References[edit]

Information gathered from:

  • Reversing iBoot
  • openiBoot
  • Playing with the registers when iBoot is running