From iPodLinux
The PortalPlayer PP5020 is used in the 4th and 5th generation iPods as well as the iPod minis and iPod Photo.
Overview
| location | description
|
| 0x10000000 | SDRAM (32MB; exceptions are 60GB and 80GB 5G model: 64MB)
|
| 0x40000000 | Fast RAM, also called IRAM (96KB)
|
| 0xf0000000 | Cache Control
|
CPU ID
| location | description
|
| 0x60000000 | Processor ID
|
| | 0x55 CPU
|
| | 0xaa COP
|
Mailboxes?
| location | description
|
| 0x60001000 | CPU mailbox (cpu writes/cop reads)
|
| 0x60001004 | COP mailbox (cop writes/cpu reads)
|
| 0x60001008 | CPU mailbox (cpu writes/cop reads)
|
| 0x6000100c | COP mailbox (cop writes/cpu reads)
|
Interrupt Controller
| location | description
|
| 0x60004000 | CPU interrupt status (interrupts 0-29)
|
| | 0x1 timer1
|
| | 0x2 timer2
|
| | 0x10 mailboxes?
|
| | 0x800000 ide
|
| | 0x1000000 usb
|
| | 0x2000000 firewire
|
| | 0x40000000 0x60004100 set
|
| 0x60004100 | CPU interrupt status (hi interrupts 30-61)
|
| | 0x1 GPIO
|
| | 0x10 ser0
|
| | 0x20 ser1
|
| | 0x100 i2c (serial opto?)
|
| | 0x800000 ?
|
| | 0x20000000 ?? (in retailos)
|
| 0x60004104 | COP interrupt status
|
| 0x60004108 | CPU FIQ status
|
| 0x6000410c | COP FIQ status
|
| 0x60004110 | interrupt status
|
| 0x60004114 | forced status
|
| 0x60004118 | forced interrupt set
|
| 0x6000411c | forced interrupt clear
|
| 0x60004120 | CPU interrupt enable mask status
|
| 0x60004124 | CPU interrupt enable mask set
|
| 0x60004128 | CPU interrupt enable mask clear
|
| 0x6000412c | CPU interrupt priority IRQ=0 FIQ=1
|
| 0x60004130 | COP interrupt enable mask status
|
| 0x60004134 | COP interrupt enable mask set
|
| 0x60004138 | COP interrupt enable mask clear
|
| 0x6000413c | COP interrupt priority IRQ=0 FIQ=1
|
Timer Controller
| location | description
|
| 0x60005000 | timer1 config
|
| 0x60005004 | timer1 present value (read to clear interrupt)
|
| 0x60005008 | timer2 config
|
| | 0x1fffffff counter
|
| | 0x20000000 unknown config bit
|
| | 0x40000000 repeat
|
| | 0x80000000 enable
|
| 0x6000500c | timer2 present value (read to clear interrupt)
|
| 0x60005010 | microsecond timer
|
| 0x60005014 | RTC
|
Device Controller
| location | description
|
| 0x60006004 | device reset
|
| | 0x4 system
|
| 0x60006010 | ??
|
| | 0x2000 or'ed in for photo LCD init
|
| 0x6000600c | device enable
|
| | 0x2 enabled for i2s
|
| | 0x40 ser0
|
| | 0x80 ser1
|
| | 0x800 I2S
|
| | 0x1000 I2C (?)
|
| | 0x10000 serial opto
|
| | 0x20000 piezo (ipod photo lcd?)
|
| | 0x400000 usb
|
| | 0x800000 firewire
|
| | 0x2000000 ide0
|
| | 0x8000000 LCD? (seen in 4g diag startup)
|
| 0x600060A0 | set to 0xC0000000 in photo LCD init
|
CPU Controller
| location | bits | description
|
| 0x60007000 | 31-0 | CPU control
|
| 0x60007004 | 31-0 | COP control
|
| | 31-29 | flow
000 - no control (run)
001 - generate interrupt on event condition (or when resumed)
010 - stop until event condition (EC)
100 - stop until interrupt condition
bits may be ORed together for combinations
|
| | 27 | sysclock EC
|
| | 25 | usec EC
|
| | 24 | msec EC
|
| | 23 | sec EC
|
| | 7-0 | counter (EC on N+1th event)
|
/* resume COP on the Xth usec tick: */
outl(0x42000000 | (X - 1), 0x60007004); /* where X < 256 */
Cache Controller
| location | bits | description
|
| 0x6000c000 | 31-0 | cache control
|
| | 4 | local exception vector table enable
|
| | 1 | cache control enable
|
/* enable local exception vector table */
outl(inl(0x6000c000) | 0x10, 0x6000c000);
/* remap exception vector entries to -addr- */
for (i = 0; i <= 0x1c; i += 4)
outl((unsigned int)addr + i, 0x6000f000 + i);
GPIO Controller
| location | description
|
| 0x6000d000 | GPIO port A enable
|
| 0x6000d004 | GPIO port B enable
|
| 0x6000d008 | GPIO port C enable
|
| 0x6000d00c | GPIO port D enable
|
| 0x6000d010 | GPIO port A output enable
|
| 0x6000d020 | GPIO port A output value
|
| 0x6000d030 | GPIO port A input value
all models: dock (power?) probe, hold switch
Mini 1st gen only: wheel and keypad buttons
|
| 0x6000d040 | GPIO port A interrupt status
|
| 0x6000d050 | GPIO port A interrupt enable
|
| 0x6000d060 | GPIO port A interrupt level
|
| 0x6000d070 | GPIO port A interrupt clear
|
| 0x6000d100 | GPIO port E ???
|
??? Controller
| location | description
|
| 0x70000000 | "PP50"
|
| 0x70000004 | "20D "
|
| 0x70000010 | used during piezo enable, or in 0xc00 during fw init
|
| 0x70000020 | used during I2S init
|
| | 0x300 bic'ed in during I2S recording init
|
| | 0x1000 bic'ed in for firewire init
|
| | 0x2000 bic'ed in for IDE init
|
| | 0x4000 bic'ed in for scroll wheel init
|
| | 0x80000000 or'ed in for USB init
|
I2S Controller
| location | description
|
| 0x70002800 |
|
| | 0x1 (bit 0) set or cleared along with bit 28
|
| | 0x2 (bit 1) set or cleared along with bit 29
|
| | 0x70 (bits 4, 5, 6) enabled for input & output
|
| | 0x300 (bits 8, 9)
|
| | 0xC00 (bits 10, 11 = 01, 10, 11)
|
| | 0x2000000 (bit 25)
|
| | 0x10000000 (bit 28) enable I2S input
|
| | 0x20000000 (bit 29) enable I2S output
|
| | 0x80000000 (bit 31) soft reset (clear to finish)
|
| 0x70002804 |
|
| | 0x40000000 I2S busy?
|
| 0x7000280c | I2S fifo
|
| | 0x1 (bit 0) set for output
|
| | 0x2 (bit 1) cleared for output
|
| | 0x10 (bit 4) set for input
|
| | 0x20 (bit 5) cleared for input
|
| | 0x100 (bit 8) set for output
|
| | 0x1000 (bit 12) set for input
|
| | 0x3F0000 fifo out empty count
|
| | 0x3F000000 fifo in empty count
|
| 0x70002840 | I2S fifo out
|
| 0x70002880 | I2S fifo in
|
GPIO Controller
| location | description
|
| 0x6000d000 | GPIO port A enable
|
LCD Controller
| location | description
|
| 0x70003000 | lcd_status
|
| | 0x8000 - write done bit
|
| 0x70003008 | lcd_command
|
| 0x70003010 | lcd_data
|
Serial Controller
| location | description
|
| 0x70006000 | ser0
|
| 0x70006040 | ser1
|
Photo LCD Controller
| location | description
|
| 0x70008a0c |
|
| | 0x80000000 controller busy (set to 1 to write command, wait to be cleared, write 1 to write data)
|
Piezo Controller
| location | description
|
| 0x7000A000 | config
|
| | 0x1fff pitch
|
| | 0x00ffe000 or 0x00ff0000 wave form modifier
|
| | 0x80000000 enable
|
I2C Controller
| location | description
|
| 0x7000C00C | I2C Data0
|
| 0x7000C100 |
|
| | 0x80000000 reset (clear to finish reset)
|
| | 0x60000000 (or'ed in after the reset)
|
| 0x7000C104 |
|
| | 0xC000000 (or'ed in before and after reset)
|
| | 0x4000000 (or'ed in during operation (perhaps after an error)
|
| | 0x80000000 busy (non zero during reset, should be cleared in <1500 usecs)
|
| 0x7000C120 |
|
| | 0x8001052A (set before reset)
|
| | 0x8000023A (set after reset during operation)
|
| 0x7000C140 | scroll wheel value and keypad buttons (on all but Mini 1st gen.)
|
| | bit 31: always set unless Hold switch is engaged
|
| | bit 30: set when scroll wheel is being touched
|
| | bits 16-22: last touch position (ranges from 0 to 0x5f)
|
| | bits 8: Center button
|
| | bits 9: Fwd button
|
| | bits 10: Rew button
|
| | bits 11: Play button
|
| | bits 12: Menu button
|
| | bits 0-7: 0x1a in normal operation, 0x00 when Hold is engaged
|
EIDE Controller
| location | description
|
| 0xC3000000 | IDE0 primary timing 0
|
| 0xC3000004 | IDE0 primary timing 1
|
| 0xC3000008 | IDE0 secondary timing0
|
| 0xC300000C | IDE0 secondary timing1
|
| 0xC3000010 | IDE1 primary timing0
|
| 0xC3000014 | IDE1 primary timing1
|
| 0xC3000018 | IDE1 secondary timing0
|
| 0xC300001C | IDE1 secondary timing1
|
| 0xC3000028 | IDE0 config
|
| 0xC300002c | IDE1 config
|
| | 0x8 - set after controller reset
|
| | 0x10 - ide0 interrupt status (write 1 to clear)
|
| | 0x20 - ide1 interrupt status (write 1 to clear)
|
| | 0x10000000 - cpu > 65MHz
|
| | 0x20000000 - cpu > 50MHz
|
| | 0x80000000 reset device
|
| 0xC30001E0 | IDE0 controller status
|
USB Controller
| location | description
|
| 0xC5000000 |
|
Firewire Controller
| location | description
|
| 0xC6000000 |
|
| 0xC6000050 |
|
| | 0x010000 reset device
|
| | 0x4A0000 configure device
|
Memory Controller
| location | description
|
| 0xf0000000 | cache base (8KB for PP5020)
|
| 0xf0004000 | cache init base (8KB for PP5020)
|
| 0xf0008000 | cache flush base
|
| 0xf000c000 | cache invalidate base
|
| 0xf000f000 | mmap0
|
| 0xf000f004 | mmap0
|
| 0xf000f008 | mmap1
|
| 0xf000f00c | mmap1
|
| 0xf000f010 | mmap2
|
| 0xf000f014 | mmap2
|
| 0xf000f018 | mmap3
|
| 0xf000f01c | mmap3
|
| 0xf000f020 | cache control
|
| 0xf000f024 | cache control
|
| 0xf000f044 | cache options
|
/* flush cache ( for the writing core ) */
outl(inl(0xf000f044) | 0x2, 0xf000f044);
/* flush & invalidate cache ( for the reading core ) */
outl(inl(0xf000f044) | 0x6, 0xf000f044);
