This article is relevant only to legacy hardware or software, and is retained for its historical significance.
Please ask at the community portal if you would like to update this article with current information.
This should help people reversing iBoot and friends. It is a work in progress.
|0x20 through 0x30||Output SHA1 hash|
|0x40 through 0x7C||Data Input (64 Bytes)|
See S5L8720 SHA1 for a more detailed description
Base (dmac0): 0x38200000
|0x4||TC Status (If HIGH, transaction complete)|
|0x8||TC Interrupt Clear|
|0xC||Error Interrupt Status|
|0x10||Error Interrupt Clear|
|0x14||TC Interrupt Status Before Masking (Raw)|
|0x18||Error Interrupt Status Before Masking (Raw)|
|0x1C||DMA Channels Enabled|
|0x34||Enable / Disable Synchronization|
|0x100||Channel 0 Source Address|
|0x104||Channel 0 Destination Address|
|0x108||Channel 0 Linked List Address|
|0x10C||Channel 0 Control 1|
|0x110||Channel 0 Control 2|
|0x114||Channel 0 Configuration|
This appears to use an ARM PrimeCell PL192. You can read the technical reference manual here.
Base (vic0): 0x38E00000
|0x8||Raw Interrupt Status|
|0xC||Interrupt Select (0=IRQ, 1=FIQ)|
|0x10||Interrupt Enable (0=Disabled, 1=Enabled)|
|0x14||Interrupt Enable Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)|
|0x18||Software Interrupt (0=Disabled, 1=Enabled)|
|0x1C||Software Interrupt Clear (Write-Only; 0=No Effect, 1=Interrupt enabled with previous reg disabled)|
|0x20||Register Protection Mode. If bit 0 is set to 1, then Protection Mode is on and only privileged mode writes will work.|
|0x24||Software Interrupt Priority Mask (0=Masked, 1=Not Masked)|
|0x200||Vector Priority Levels|
|0xFE0 through 0xFEC||Peripheral Identification Registers
|0xFF0 through 0xFFC||PrimeCell Identification Registers
All information here was gathered by reversing iBoot and friends.
|0x0||Unused & Unreferenced Register|
|0x4||Not yet documented|
WDT (Watchdog Timer)
NOTE: It seems that you can disable Watchdog Timer by rewriting this register to 0x00000000, and you can reboot the device by rewriting it to 0x100000
|0x4||Watchdog Timeout Duration|
See separate article S5L8720 Timers (Hardware)
ARM7 (Second CPU)
All information here was gathered by looking at the code for the ARM7 Go command, as well as noting that although 2.1.1 iBoots reference this as 0xB8600000, 0x80000000 through 0xFFFFFFFF is mapped to 0x0 through 0x7FFFFFFF when the MMU does it's stuff.
To halt the ARM7: Clear all bits then set bit to 2. To make it resume: Set bit 1
To run code, halt the ARM7, write the load address of the code to this register, write 0x3FF0000 to register 0x114, then resume the ARM7
I don't know exactly what this register does, but I named it like this because 0x3FF0000 is written to this register when there is a load address of code to be jumped to in register 0x110
Base (uart0 - Serial): 0x3CC00000
Base (spi0 - NOR Flash): 0x3C300000