From wikiPodLinux

The PortalPlayer PP5020 (http://www.iriverchina.com/review/h10/76/H10(5)/source/PP5020.pdf) is used in the 4th and 5th generation iPods as well as the iPod minis and iPod Photo.

location description
0x10000000 SDRAM (32MB; exceptions are 60GB and 80GB 5G model: 64MB)
0x40000000 Fast RAM, also called IRAM (96KB)
0xf0000000 Cache Control

location description
0x60000000 Processor ID
0x55 CPU
0xaa COP

location description
0x60001000 CPU mailbox (cpu writes/cop reads)
0x60001004 COP mailbox (cop writes/cpu reads)
0x60001008 CPU mailbox (cpu writes/cop reads)
0x6000100c COP mailbox (cop writes/cpu reads)

Interrupt Controller
location description
0x60004000 CPU interrupt status (interrupts 0-29)
0x1 timer1
0x2 timer2
0x10 mailboxes?
0x800000 ide
0x1000000 usb
0x2000000 firewire
0x40000000 0x60004100 set
0x60004100 CPU interrupt status (hi interrupts 30-61)
0x1 GPIO
0x10 ser0
0x20 ser1
0x100 i2c (serial opto?)
0x800000 ?
0x20000000 ?? (in retailos)
0x60004104 COP interrupt status
0x60004108 CPU FIQ status
0x6000410c COP FIQ status
0x60004110 interrupt status
0x60004114 forced status
0x60004118 forced interrupt set
0x6000411c forced interrupt clear
0x60004120 CPU interrupt enable mask status
0x60004124 CPU interrupt enable mask set
0x60004128 CPU interrupt enable mask clear
0x6000412c CPU interrupt priority IRQ=0 FIQ=1
0x60004130 COP interrupt enable mask status
0x60004134 COP interrupt enable mask set
0x60004138 COP interrupt enable mask clear
0x6000413c COP interrupt priority IRQ=0 FIQ=1

Timer Controller
location description
0x60005000 timer1 config
0x60005004 timer1 present value (read to clear interrupt)
0x60005008 timer2 config
0x1fffffff counter
0x20000000 unknown config bit
0x40000000 repeat
0x80000000 enable
0x6000500c timer2 present value (read to clear interrupt)
0x60005010 microsecond timer
0x60005014 RTC

Device Controller
location description
0x60006004 device reset
0x4 system
0x60006010  ??
0x2000 or'ed in for photo LCD init
0x6000600c device enable
0x2 enabled for i2s
0x40 ser0
0x80 ser1
0x800 I2S
0x1000 I2C (?)
0x10000 serial opto
0x20000 piezo (ipod photo lcd?)
0x400000 usb
0x800000 firewire
0x2000000 ide0
0x8000000 LCD? (seen in 4g diag startup)
0x600060A0 set to 0xC0000000 in photo LCD init

CPU Controller
location bits description
0x60007000 31-0 CPU control
0x60007004 31-0 COP control
31-29 flow

000 - no control (run)
001 - generate interrupt on event condition (or when resumed)
010 - stop until event condition (EC)
100 - stop until interrupt condition
bits may be ORed together for combinations

27 sysclock EC
25 usec EC
24 msec EC
23 sec EC
7-0 counter (EC on N+1th event)
/* resume COP on the Xth usec tick: */
outl(0x42000000 | (X - 1), 0x60007004); /* where X < 256 */

Cache Controller
location bits description
0x6000c000 31-0 cache control
4 local exception vector table enable
1 cache control enable
/* enable local exception vector table */
outl(inl(0x6000c000) | 0x10, 0x6000c000);

/* remap exception vector entries to -addr- */
for (i = 0; i <= 0x1c; i += 4)
    outl((unsigned int)addr + i, 0x6000f000 + i);

GPIO Controller
location description
0x6000d000 GPIO port A enable
0x6000d004 GPIO port B enable
0x6000d008 GPIO port C enable
0x6000d00c GPIO port D enable
0x6000d010 GPIO port A output enable
0x6000d020 GPIO port A output value
0x6000d030 GPIO port A input value

all models: dock (power?) probe, hold switch
Mini 1st gen only: wheel and keypad buttons

0x6000d040 GPIO port A interrupt status
0x6000d050 GPIO port A interrupt enable
0x6000d060 GPIO port A interrupt level
0x6000d070 GPIO port A interrupt clear
0x6000d100 GPIO port E ???

??? Controller
location description
0x70000000 "PP50"
0x70000004 "20D "
0x70000010 used during piezo enable, or in 0xc00 during fw init
0x70000020 used during I2S init
0x300 bic'ed in during I2S recording init
0x1000 bic'ed in for firewire init
0x2000 bic'ed in for IDE init
0x4000 bic'ed in for scroll wheel init
0x80000000 or'ed in for USB init

I2S Controller
location description
0x1 (bit 0) set or cleared along with bit 28
0x2 (bit 1) set or cleared along with bit 29
0x70 (bits 4, 5, 6) enabled for input & output
0x300 (bits 8, 9)
0xC00 (bits 10, 11 = 01, 10, 11)
0x2000000 (bit 25)
0x10000000 (bit 28) enable I2S input
0x20000000 (bit 29) enable I2S output
0x80000000 (bit 31) soft reset (clear to finish)
0x40000000 I2S busy?
0x7000280c I2S fifo
0x1 (bit 0) set for output
0x2 (bit 1) cleared for output
0x10 (bit 4) set for input
0x20 (bit 5) cleared for input
0x100 (bit 8) set for output
0x1000 (bit 12) set for input
0x3F0000 fifo out empty count
0x3F000000 fifo in empty count
0x70002840 I2S fifo out
0x70002880 I2S fifo in

LCD Controller
location description
0x70003000 lcd_status
0x8000 - write done bit
0x70003008 lcd_command
0x70003010 lcd_data

Serial Controller
location description
0x70006000 ser0
0x70006040 ser1

Photo LCD Controller
location description
0x80000000 controller busy (set to 1 to write command, wait to be cleared, write 1 to write data)

Piezo Controller
location description
0x7000A000 config
0x1fff pitch
0x00ffe000 or 0x00ff0000 wave form modifier
0x80000000 enable

I2C Controller
location description
0x7000C00C I2C Data0
0x80000000 reset (clear to finish reset)
0x60000000 (or'ed in after the reset)
0xC000000 (or'ed in before and after reset)
0x4000000 (or'ed in during operation (perhaps after an error)
0x80000000 busy (non zero during reset, should be cleared in <1500 usecs)
0x8001052A (set before reset)
0x8000023A (set after reset during operation)
0x7000C140 scroll wheel value and keypad buttons (on all but Mini 1st gen.)
bit 31: always set unless Hold switch is engaged
bit 30: set when scroll wheel is being touched
bits 16-22: last touch position (ranges from 0 to 0x5f)
bits 8: Center button
bits 9: Fwd button
bits 10: Rew button
bits 11: Play button
bits 12: Menu button
bits 0-7: 0x1a in normal operation, 0x00 when Hold is engaged

EIDE Controller
location description
0xC3000000 IDE0 primary timing 0
0xC3000004 IDE0 primary timing 1
0xC3000008 IDE0 secondary timing0
0xC300000C IDE0 secondary timing1
0xC3000010 IDE1 primary timing0
0xC3000014 IDE1 primary timing1
0xC3000018 IDE1 secondary timing0
0xC300001C IDE1 secondary timing1
0xC3000028 IDE0 config
0xC300002c IDE1 config
0x8 - set after controller reset
0x10 - ide0 interrupt status (write 1 to clear)
0x20 - ide1 interrupt status (write 1 to clear)
0x10000000 - cpu > 65MHz
0x20000000 - cpu > 50MHz
0x80000000 reset device
0xC30001E0 IDE0 controller status

USB Controller
location description

Firewire Controller
location description
0x010000 reset device
0x4A0000 configure device

Memory Controller
location description
0xf0000000 cache base (8KB for PP5020)
0xf0004000 cache init base (8KB for PP5020)
0xf0008000 cache flush base
0xf000c000 cache invalidate base
0xf000f000 mmap0
0xf000f004 mmap0
0xf000f008 mmap1
0xf000f00c mmap1
0xf000f010 mmap2
0xf000f014 mmap2
0xf000f018 mmap3
0xf000f01c mmap3
0xf000f020 cache control
0xf000f024 cache control
0xf000f044 cache options
/* flush cache ( for the writing core ) */
outl(inl(0xf000f044) | 0x2, 0xf000f044);

/* flush & invalidate cache ( for the reading core ) */
outl(inl(0xf000f044) | 0x6, 0xf000f044);
Retrieved from "http://ipodlinux.org/PP5020"