IO

Memory mapped registers available on the iQue Player.

MI

Address	Size	Description	Note
0xA4300000	4	MI_INIT_MODE_REG/MI_MODE_REG
0xA4300004	4	MI_VERSION_REG/MI_NOOP_REG
0xA4300008	4	MI_INTR_REG
0xA430000C	4	MI_INTR_MASK_REG
0xA4300010	4
0xA4300014	4	MI_SK_EXCEPTION_REG	Reading from this address within non-secure mode causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = Watchdog Timer timeout, bit 2 = SKC.
0xA4300018	4	MI_SK_WATCHDOG_TIMER	Set to 0x7530c800 by SK to start or reset the timer. The bottom 16 bits appear to be the number of timer ticks to wait before an interrupt is fired, and bit 3 of MI_SK_EXCEPTION_REG is set. When reading from this register while the timer is ticking, the top 16 bits appear to be the remaining number of ticks until the interrupt fires. This is mainly used by SK to deal with trial/demo games. The timer is reset by SK when skKeepAlive is called. Depending on the trial type (timed vs number of launches), this timer is either used to detect a game crash or other event which would cause skKeepAlive calls to stop being made, or for timed trials, to keep track of the remaining time on the trial. One tick appears to happen every 1.220703 milliseconds with the configuration SK sets. Other tick rates and behaviors maybe be configurable, but it is unknown at this time if that is the case.
0xA4300028	4
0xA430002C	1	MI_RANDOM_BIT	Hardware RNG? Seems to return 1 bit of randomness, SK function at 0x9FC03410 gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
0xA4300030	4
0xA4300038	4	MI_HW_INTR_REG	Hardware interrupts (0x40 = NAND DMA, 0x80 = MD, 0x100 = RDB, 0x200 = AES, 0x400 = PI_ERR, 0x800 = USB0, 0x1000 = USB1, 0x2000 = NAND).
0xA430003C	4	MI_HW_INTR_MASK_REG	Hardware interrupt mask.

VI

Address	Size	Description	Note
0xA4400000	4	VI_STATUS_REG/VI_CONTROL_REG	If bit 13 is set (normally documented as unused/reserved), the console will display corrupted graphics. N64 games usually (always?) have this bit set, which is the cause of corrupted graphics seen when vanilla N64 games are played on an iQue Player.
0xA4400004	4	VI_ORIGIN_REG/VI_DRAM_ADDR_REG
0xA4400008	4	VI_WIDTH_REG/VI_H_WIDTH_REG
0xA440000C	4	VI_INTR_REG/VI_V_INTR_REG
0xA4400010	4	VI_CURRENT_REG/VI_V_CURRENT_LINE_REG
0xA4400014	4	VI_BURST_REG/VI_TIMING_REG
0xA4400018	4	VI_V_SYNC_REG
0xA440001C	4	VI_V_SYNC_REG
0xA4400020	4	VI_LEAP_REG/VI_H_SYNC_LEAP_REG
0xA4400024	4	VI_H_START_REG/VI_H_VIDEO_REG
0xA4400028	4	VI_V_START_REG/VI_V_VIDEO_REG
0xA440002C	4	VI_V_BURST_REG
0xA4400030	4	VI_X_SCALE_REG
0xA4400034	4	VI_Y_SCALE_REG

AI

Address	Size	Description	Note
0xA4500000	4	AI_DRAM_ADDR_REG
0xA4500004	4	AI_LEN_REG
0xA4500008	4	AI_CONTROL_REG
0xA450000C	4	AI_STATUS_REG
0xA4500010	4	AI_DACRATE_REG
0xA4500014	4	AI_BITRATE_REG

PI

Address	Size	Description	Note
0xA4600000	4	PI_DRAM_ADDR_REG	bit 31: NAND (maybe other sources?) DMA busy.
0xA4600004	4	PI_CART_ADDR_REG
0xA4600008	4	PI_RD_LEN_REG
0xA460000C	4	PI_WR_LEN_REG
0xA4600010	4	PI_STATUS_REG
0xA4600014	4	PI_BSD_DOM1_LAT_REG
0xA4600018	4	PI_BSD_DOM1_PWD_REG
0xA460001C	4	PI_BSD_DOM1_PGS_REG
0xA4600020	4	PI_BSD_DOM1_RLS_REG
0xA4600024	4	PI_BSD_DOM2_LAT_REG
0xA4600028	4	PI_BSD_DOM2_PWD_REG
0xA460002C	4	PI_BSD_DOM2_PGS_REG
0xA4600030	4	PI_BSD_DOM2_RLS_REG
0xA4600038	4	PI_CARD_STATUS_REG	Tells if the NAND card is present or not
0xA4600040	4
0xA4600044	4
0xA4600048	4	PI_CARD_ADDR_REG	Takes the device buffer address for RAM<->NAND DMA
0xA460004C	4	PI_CARD_CONFIG_REG	Takes configuration parameters for the NAND card
0xA4600050	4	PI_AES_CNT(?)	Seems to be used for controlling the AES hardware. Bit31: start/busy
0xA4600054	4	PI_ALLOWED_IO	Allows/disallows access to new PI features. This register is set by SK using the hwAccessRights field of the CMD
0xA4600058	4	PI_EX_RD_LEN_REG	Enhanced PI read length register
0xA460005C	4	PI_EX_WR_LEN_REG	Enhanced PI write length register
0xA4600060	4	PI_MISC_REG	This register is used for RTC, error led, power and more
0xA4600070	4	PI_CARD_BLK_OFFSET_REG	Takes the NAND card block offset for reading/writing
0xA4610000	0x200	PI_AES_DATA_OUT	output of current AES operation
0xA4610200	4
0xA4610420	0xB0	PI_AES_EXPANDED_KEY	AES-128 expanded key for hardware AES engine
0xA46104D0	0x10	PI_AES_IV	AES-128-CBC initialisation vector for hardware AES engine
0xA4610500	4		ATB?
0xA4610504	4		ATB?
0xA4620000	4
0xA46E0000	2	PI_RDB_REQ_HI_REG
0xA46E0002	2	PI_RDB_REQ_LO_REG
0xA46E0004	2
0xA46E0400	2		RDB related
0xA46E0402	2		RDB related
0xA46E8000	2	PI_RDB_STATUS_REG

PI_MISC_REG

Bit(s)	Description
31-15	Box Id
6-7	RTC mask
5	Error led mask (always 0x01)
4	Power mask (always 0x01)
2-3	RTC status
1	Error led
0	Power control

USB

The iQue Player has support for two USB controllers, one mapped at 0xA4900000 and another at 0xA4A00000.

Address	Size	Description	Note
0xA4900000	4
0xA4940010	4	USB0_STATUS_REG
0xA4A00000	4
0xA4A40010	4	USB1_STATUS_REG