S5L8720 (Hardware)

This should help people reversing iBoot and friends. It is a work in progress.

VIC (Vectored Interrupt Controller)

Base (vic0): 0x38E00000 Base (vic1): 0x38E01000
Register	Description
0x0	IRQ Status
0x4	FIQ Status
0x8	Raw Interrupt Status
0xC	Interrupt Select (0=IRQ, 1=FIQ)
0x10	Interrupt Enable (0=Disabled, 1=Enabled)
0x14	Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)
0x18	Software Interrupt (0=Disabled, 1=Enabled)
0x1C	Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)
0x20	Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.
0x24	Software Interrupt Priority Mask (0=Masked, 1=Not Masked)
0x100	Vector Addresses
0x200	Vector Priority Levels
0xFE0 through 0xFEC	Not sure what these four registers are, because I can confirm that at least SecureROM, probably iBoot and such too, will simply read them when initializing the vectored interrupt controller. It does nothing about the contents...I'll post a snippet from IDA in the discussion page, but if anyone knows what these do, put it here.

WDT (Watchdog Timer)

Base: 0x3C800000
Register	Description
0x0	Control Register NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000
0x4	Watchdog Timeout Duration
0xC	Interrupt Clear

USB

OTG-PHYCTRL

Base: 0x3C400000
Register	Description
0x0	Power Control
0x4	Clock Control
0x8	Reset Control
0x10	Clock Control

OTG

Base: 0x38400000
Register	Description
0x0	Control
0x4	Interrupt
0x8	AHB Config
0xC	Core Config
0x10	Core Reset
0x14	Core Interrupt
0x18	Core Interrupt Mask
0x1C and 0x20	Rx Status Debug
0x24	Rx FIFO Size
0x28	Non-Periodic Transmit FIFO Size
TBC...	TBC...

ARM7

Base: 0x38600000
Register	Description
0x100	Running Status To halt the ARM7: Write 0x0 then 0x10 to this register To make it resume: Write 0x1 to this register
0x110	Code Address To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7
0x114	"Code Waiting" I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110

UART

Base (uart0): 0x3CC00000 Base (uart1): 0x3DB00000 Base (uart2): 0x3DC00000 Base (uart3): 0x3DD00000
Register	Description
0x0	Line Control
0x4	Control
0x8	FIFO Control
0xC	Modem Control (uart0 and uart1 only)
0x10	Tx / Rx Status Bit 0: If 1, Rx buffer has data, if 0, Rx buffer is empty Bit 1: If 1, Rx buffer is empty, if 0, it is not empty
0x14	Rx Error Bit 0: If 1, overrun error Bit 1: If 1, parity error Bit 2: If 1, frame error Bit 3: If 1, break signal
0x18	FIFO Status
0x1C	Modem Status (uart0 and uart1 only)
0x20	Tx Buffer (write-only)
0x24	Rx Buffer (read-only)
0x28	Baud Rate Divisor
0x2C	???
0x30	Interrupt Pending
0x34	Interrupt Source Pending
0x38	Interrupt Mask