Register reads made with fc-tmsh against original fw:

MEMIF block:

FFFF:FB00 = 0x00A4	(nCS0)
FFFF:FB02 = 0x00A5	(nCS1)
FFFF:FB04 = 0x00A4	(nCS2)
FFFF:FB06 = 0x00A5	(nCS3)
FFFF:FB08 = 0x0040	(nCS7)
FFFF:FB0A = 0x0285	(nCS4)
FFFF:FB0C = 0x00C0	(nCS6)
FFFF:FB0E = 0x002A	(API-RHEA ctrl)
FFFF:FB10 = 0x0300	(Extra ctrl, boot mapping)

Config regs:

FFFE:F004 = 0x0000	(DSP_CONF_REG)
FFFE:F006 = 0x0008	(ARM_CONF_REG: ADD22 set)
FFFE:F008 = 0x3050	(ASIC_CONF_REG)
FFFE:F00A = 0x03FD	(IO_CONF_REG: all GPIO except SIM_PWCTRL)

DPLL & clock ctrl:

FFFF:9800 = 0x2413	(DPLL multiplies by 8)
FFFF:FD00 = 0xF0A1	(ARM clock is /2)
FFFF:FD02 = 0xFF85	(VTCXO_DIV2 set)
FFFF:FD04 = 0xFFFD	(DSP out of reset)

ARMIO block:

FFFE:4802 = 0x1F87	(ARMIO_LATCH_OUT)
FFFE:4804 = 0xC060	(IO_CNTL_REG)

Iota registers:

APCOFF = 0x07F