diff --git a/zdocs/heathrow.md b/zdocs/heathrow.md
index 453a171..3a79581 100644
--- a/zdocs/heathrow.md
+++ b/zdocs/heathrow.md
@@ -175,3 +175,101 @@ of those bits based on publicly available Apple and Linux sources.
 | 29    | high   | enet_ctrl_en  | enable Ethernet controller cell (?)     |
 | 30    | high   | enet_xcvr_en  | enable Ethernet Transceiver (?)         |
 | 31    | high   | enet_reset    | reset Ethernet cell                     |
+
+
+### Cell-specific registers
+
+#### ATA cell registers
+
+##### Internal ATA (IDE0)
+
+| Offset from I/O base | Width in bits |  Function on read | Function on write |
+|:--------------------:|:-------------:|:-----------------:|:-----------------:|
+| 0x20000              | 16            | Data              | Data              |
+| 0x20010              | 8             | Error             | Features          |
+| 0x20020              | 8             | Sector Count      | Sector Count      |
+| 0x20030              | 8             | Sector Number     | Sector Number     |
+| 0x20040              | 8             | Cylinder Low      | Cylinder Low      |
+| 0x20050              | 8             | Cylinder High     | Cylinder High     |
+| 0x20060              | 8             | Drive/Head        | Drive/Head        |
+| 0x20070              | 8             | Status            | Command           |
+| 0x20160              | 8             | Alternate Status  | Device Control    |
+| 0x20200              | 32            | Timing Config     | Timing Config     |
+
+##### Media Bay ATA (IDE1)
+
+| Offset from I/O base | Width in bits |  Function on read | Function on write |
+|:--------------------:|:-------------:|:-----------------:|:-----------------:|
+| 0x21000              | 16            | Data              | Data              |
+| 0x21010              | 8             | Error             | Features          |
+| 0x21020              | 8             | Sector Count      | Sector Count      |
+| 0x21030              | 8             | Sector Number     | Sector Number     |
+| 0x21040              | 8             | Cylinder Low      | Cylinder Low      |
+| 0x21050              | 8             | Cylinder High     | Cylinder High     |
+| 0x21060              | 8             | Drive/Head        | Drive/Head        |
+| 0x21070              | 8             | Status            | Command           |
+| 0x21160              | 8             | Alternate Status  | Device Control    |
+| 0x21200              | 32            | Timing Config     | Timing Config     |
+
+##### Timing Config Register
+
+The timing config register is specific to Apple's ATA implementation. According
+with
+[this source](https://android.googlesource.com/kernel/msm/+/android-wear-5.0.2_r0.1/drivers/ata/pata_macio.c),
+this register is used to control timings for Multiword DMA (MDMA) and Programmed I/O (PIO) modes.
+
+This register has the following format:
+
+| 31 ... 22  | 21 | 20 ... 16     | 15 ... 11   | 10 | 9 ... 5      | 4 ... 0    |
+|------------|----|---------------|-------------|----|--------------|------------|
+| Unused (?) | HT | MDMA Recovery | MDMA Access | E  | PIO Recovery | PIO Access |
+
+I don't know what Recovery and Access values mean. It seems that all values are
+in 30 ns units. It corresponds to one PCI cycle when running at a 33 MHz clock speed.
+
+Both PIO and MDMA recovery values are specified in `x / 30` units after subtracting
+a constant offset. This offset is 120 ns for PIO transfers and 30 ns for MDMA transfers.
+
+- The "HT" stands for _HalfTick_. When set, 15 ns will be added to both MDMA access
+and recovery times. Otherwise, 30 ns are added to the MDMA recovery time.
+- The "E" bit, when set, adds 30 ns to the final PIO timing.
+
+The [official Apple source](https://opensource.apple.com/source/HeathrowATA/HeathrowATA-108.3.1/HeathrowATA.cpp.auto.html)
+specifies the following default values for each PIO mode:
+
+| Mode # | Cycle time | Transfer rate | Recovery | Access |
+|:------:|:----------:|:-------------:|:--------:|:------:|
+| 0      | 600 ns     | 3,33 MB/s     | 420 ns   | 180 ns |
+| 1      | 390 ns     | 5,13 MB/s     | 240 ns   | 150 ns |
+| 2      | 360 ns     | 5,56 MB/s     | 180 ns   | 180 ns |
+| 3      | 330 ns     | 6,1  MB/s     | 180 ns   | 150 ns |
+| 4      | 300 ns     | 6,67 MB/s     | 150 ns   | 150 ns |
+
+Timing values for the PIO modes 2...4 deviate from the corresponding values given
+in the ATA-3 specification.
+
+PIO cycle time can be calculated using the following equation:
+```
+PIO_Cycle_ns = PIO_Recovery * 30 + 120 + PIO_Access * 30 + E * 30
+```
+
+Multiword DMA modes are specified as follows:
+
+| Mode # | Cycle time | Transfer rate | Recovery | Access |
+|:------:|:----------:|:-------------:|:--------:|:------:|
+| 0      | 480 ns     | 4,17 MB/s     | 240 ns   | 240 ns |
+| 1      | 360 ns     | 5,56 MB/s     | 180 ns   | 180 ns |
+| 2      | 270 ns     | 7,4  MB/s     | 135 ns   | 135 ns |
+| 3      | 240 ns     | 8,33 MB/s     | 120 ns   | 120 ns |
+| 4      | 210 ns     | 9,52 MB/s     | 105 ns   | 105 ns |
+| 5      | 180 ns     | 11,11 MB/s    | 90 ns    | 90 ns  |
+| 6      | 150 ns     | 13,33 MB/s    | 75 ns    | 75 ns  |
+| 7      | 120 ns     | 16,67 MB/s    | 45 ns    | 75 ns  |
+
+Modes 0, 6 and 7 from the table above correspond to the MDMA modes 0...2 specified
+in the ATA-2 standard.
+
+MDMA cycle time can be calculated using the following equation:
+```
+MDMA_Cycle_ns = MDMA_Recovery * 30 + MDMA_Access * 30 + 30
+```