PortalPlayer 502x series SoCs

NOTE: The information on this page is based on a copy of the 17 August 2007 version of http://www.ipodlinux.org/PP5020 taken from http://web.archive.org The contents of the IPL wiki and hence the contents of this page are licensed under the GNU Free Documentation Licence 1.2

Overview

location	description
0x10000000	SDRAM (32MB; exception is 60GB 5G model: 64MB)
0x40000000	Fast RAM, also called IRAM (96KB)
0xf0000000	Cache Control

CPU ID

location	description
0x60000000	Processor ID
	0x55 CPU
	0xaa COP

Mailboxes?

location	description
0x60001000	CPU mailbox (cpu writes/cop reads)
0x60001004	COP mailbox (cop writes/cpu reads)
0x60001008	CPU mailbox (cpu writes/cop reads)
0x6000100c	COP mailbox (cop writes/cpu reads)

Interrupt Controller

location	description
0x60004000	CPU interrupt status (interrupts 0-29)
	0x1 timer1
	0x2 timer2
	0x10 mailboxes?
	0x800000 ide
	0x1000000 usb
	0x2000000 firewire
	0x40000000 0x60004100 set
0x60004100	CPU interrupt status (hi interrupts 30-61)
	0x1 GPIO
	0x10 ser0
	0x20 ser1
	0x100 i2c (serial opto?)
	0x800000 ?
	0x20000000 ?? (in retailos)
0x60004104	COP interrupt status
0x60004108	CPU FIQ status
0x6000410c	COP FIQ status
0x60004110	interrupt status
0x60004114	forced status
0x60004118	forced interrupt set
0x6000411c	forced interrupt clear
0x60004120	CPU interrupt enable mask status
0x60004124	CPU interrupt enable mask set
0x60004128	CPU interrupt enable mask clear
0x6000412c	CPU interrupt priority IRQ=0 FIQ=1
0x60004130	COP interrupt enable mask status
0x60004134	COP interrupt enable mask set
0x60004138	COP interrupt enable mask clear
0x6000413c	COP interrupt priority IRQ=0 FIQ=1

Timer Controller

location	description
0x60005000	timer1 config
0x60005004	timer1 present value (read to clear interrupt)
0x60005008	timer2 config
	0x1fffffff counter
	0x20000000 unknown config bit
	0x40000000 repeat
	0x80000000 enable
0x6000500c	timer2 present value (read to clear interrupt)
0x60005010	microsecond timer
0x60005014	RTC

Device Controller

location	description
0x60006004	device reset
	0x4 system
0x60006010	??
	0x2000 or'ed in for photo LCD init
0x6000600c	device enable
	0x2 enabled for i2s
	0x40 ser0
	0x80 ser1
	0x800 I2S?
	0x1000 I2C? (?)
	0x10000 serial opto
	0x20000 piezo (ipod photo lcd?)
	0x400000 usb
	0x800000 firewire
	0x2000000 ide0
	0x8000000 LCD? (seen in 4g diag startup)
0x600060A0	set to 0xC0000000 in photo LCD init

CPU Controller

location	description
0x60007000	sleep CPU (int cleared by writing 0x800000 to 0x60006028?)
	0x0 to wake up CPU
	0x80000000 to sleep CPU
0x60007004	sleep COP
	0x0 to wake up COP
	0x80000000 to sleep COP (read to see if COP is sleeping)

?? Controller

location	description
0x6000c000	cache control

GPIO Controller

location	description
0x6000d000	GPIO port A enable
0x6000d004	GPIO port B enable
0x6000d008	GPIO port C enable
0x6000d00c	GPIO port D enable
0x6000d010	GPIO port A output enable
0x6000d020	GPIO port A output value
0x6000d030	GPIO port A input value
	all models: dock (power?) probe, hold switch Mini 1st gen only: wheel and keypad buttons
0x6000d040	GPIO port A interrupt status
0x6000d050	GPIO port A interrupt enable
0x6000d060	GPIO port A interrupt level
0x6000d070	GPIO port A interrupt clear
0x6000d100	GPIO port E ???

??? Controller

location	description
0x70000000	"PP50"
0x70000004	"20D "
0x70000010	used during piezo enable, or in 0xc00 during fw init
0x70000020	used during I2S? init
	0x300 bic'ed in during I2S? recording init
	0x1000 bic'ed in for firewire init
	0x2000 bic'ed in for IDE init
	0x4000 bic'ed in for scroll wheel init
	0x80000000 or'ed in for USB init

I2S? Controller

LCD Controller

location	description
0x70003000	lcd_status
	0x8000 - write done bit
0x70003008	lcd_command
0x70003010	lcd_data

Serial Controller

location	description
0x70006000	ser0
0x70006040	ser1

Photo LCD Controller

location	description
0x70008a0c
	0x80000000 controller busy (set to 1 to write command, wait to be cleared, write 1 to write data)

Piezo Controller

location	description
0x7000A000	config
	0x1fff pitch
	0x00ffe000 or 0x00ff0000 wave form modifier
	0x80000000 enable

I2C? Controller

location	description
0x7000C00C	I2C? Data0
0x7000C100
	0x80000000 reset (clear to finish reset)
	0x60000000 (or'ed in after the reset)
0x7000C104
	0xC000000 (or'ed in before and after reset)
	0x4000000 (or'ed in during operation (perhaps after an error)
	0x80000000 busy (non zero during reset, should be cleared in <1500 usecs)
0x7000C120
	0x8001052A (set before reset)
	0x8000023A (set after reset during operation)
0x7000C140	scroll wheel value and keypad buttons (on all but Mini 1st gen.)
	bit 31: always set unless Hold switch is engaged
	bit 30: set when scroll wheel is being touched
	bits 16-22: last touch position (ranges from 0 to 0x5f)
	bits 8: Center button
	bits 9: Fwd button
	bits 10: Rew button
	bits 11: Play button
	bits 12: Menu button
	bits 0-7: 0x1a in normal operation, 0x00 when Hold is engaged

EIDE Controller

location	description
0xC3000000	IDE0 primary timing 0
0xC3000004	IDE0 primary timing 1
0xC3000008	IDE0 secondary timing0
0xC300000C	IDE0 secondary timing1
0xC3000010	IDE1 primary timing0
0xC3000014	IDE1 primary timing1
0xC3000018	IDE1 secondary timing0
0xC300001C	IDE1 secondary timing1
0xC3000028	IDE0 config
0xC300002c	IDE1 config
	0x8 - set after controller reset
	0x10 - ide0 interrupt status (write 1 to clear)
	0x20 - ide1 interrupt status (write 1 to clear)
	0x10000000 - cpu > 65MHz
	0x20000000 - cpu > 50MHz
	0x80000000 reset device
0xC30001E0	IDE0 controller status

USB Controller

location	description
0xC5000000

Firewire Controller

location	description
0xC6000000
0xC6000050
	0x010000 reset device
	0x4A0000 configure device

Memory Controller

location	description
0xf0000000	cache base (8KB for PP5020)
0xf0004000	cache init base (8KB for PP5020)
0xf0008000	cache flush base
0xf000c000	cache invalidate base
0xf000f000	mmap0
0xf000f004	mmap0
0xf000f008	mmap1
0xf000f00c	mmap1
0xf000f010	mmap2
0xf000f014	mmap2
0xf000f018	mmap3
0xf000f01c	mmap3
0xf000f020	cache control
0xf000f024	cache control