Difference between revisions of "IO"

From iQueBrew
Jump to navigation Jump to search
m (fix typo)
 
(25 intermediate revisions by 6 users not shown)
Line 1: Line 1:
−
Custom registers.
+
Memory mapped registers available on the iQue Player.
  
 +
= MI =
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
Line 8: Line 9:
 
! Note
 
! Note
 
|-
 
|-
−
| 0xA4300010 || 4 || ||
+
| 0xA4300000 || 4 || MI_INIT_MODE_REG/MI_MODE_REG ||
 
|-
 
|-
−
| 0xA4300014 || 4? || || Reading from this address within game code causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = ?, bit 2 = SKC, the other bits seem unused
+
| 0xA4300004 || 4 || MI_VERSION_REG/MI_NOOP_REG ||
 
|-
 
|-
−
| 0xA4300030 || 4? || ||
+
| 0xA4300008 || 4 || MI_INTR_REG ||
 
|-
 
|-
−
| 0xA4300038 || 4? || ||  
+
| 0xA430000C || 4 || MI_INTR_MASK_REG ||
 
|-
 
|-
−
| 0xA430003C || 4? || ||  
+
| 0xA4300010 || 4 || ||
 
|-
 
|-
−
| 0xA4400000 || 4? || ||
+
| 0xA4300014 || 4 || MI_SK_EXCEPTION_REG || Reading from this address within non-secure mode causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = Watchdog Timer timeout, bit 2 = SKC.
 
|-
 
|-
−
| 0xA4500008 || 4? || ||
+
| 0xA4300018 || 4 || MI_SK_WATCHDOG_TIMER || Set to 0x7530c800 by SK to start or reset the timer. The bottom 16 bits appear to be the number of timer ticks to wait before an interrupt is fired, and bit 3 of MI_SK_EXCEPTION_REG is set. When reading from this register while the timer is ticking, the top 16 bits appear to be the remaining number of ticks until the interrupt fires. This is mainly used by SK to deal with trial/demo games. The timer is reset by SK when skKeepAlive is called. Depending on the trial type (timed vs number of launches), this timer is either used to detect a game crash or other event which would cause skKeepAlive calls to stop being made, or for timed trials, to keep track of the remaining time on the trial. One tick appears to happen every 1.220703 milliseconds with the configuration SK sets. Other tick rates and behaviors maybe be configurable, but it is unknown at this time if that is the case.
 
|-
 
|-
−
| 0xA4600010 || 4? || ||  
+
| 0xA4300028 || 4 || ||
 
|-
 
|-
−
| 0xA4600014 || 4? || ||  
+
| 0xA430002C || 1 || MI_RANDOM_BIT || Hardware RNG? Seems to return 1 bit of randomness, SK function at <tt>0x9FC03410</tt> gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
 
|-
 
|-
−
| 0xA4600018 || 4? || ||  
+
| 0xA4300030 || 4 || ||
 
|-
 
|-
−
| 0xA460001C || 4? || ||  
+
| 0xA4300038 || 4 || MI_HW_INTR_REG || Hardware interrupts (0x40 = NAND DMA, 0x80 = AES, 0x100 = RDB, 0x200 = PI_ERR, 0x400 = USB0, 0x800 = USB1, 0x1000 = ??, 0x2000 = MD). Bottom bits appear to mirror MI_INTR_REG.
 
|-
 
|-
−
| 0xA4600020 || 4? || ||  
+
| 0xA430003C || 4 || MI_HW_INTR_MASK_REG || Hardware interrupt mask.
 +
|}
 +
 
 +
= VI =
 +
{| class="wikitable"
 
|-
 
|-
−
| 0xA4600024 || 4? || ||
+
! Address
 +
! Size
 +
! Description
 +
! Note
 
|-
 
|-
−
| 0xA4600028 || 4? || ||
+
| 0xA4400000 || 4 || VI_STATUS_REG/VI_CONTROL_REG || If bit 13 is set (normally documented as unused/reserved), the console will display corrupted graphics. N64 games usually (always?) have this bit set, which is the cause of corrupted graphics seen when vanilla N64 games are played on an iQue Player.
 
|-
 
|-
−
| 0xA460002C || 4? || ||
+
| 0xA4400004 || 4 || VI_ORIGIN_REG/VI_DRAM_ADDR_REG ||  
 
|-
 
|-
−
| 0xA4600030 || 4? || ||
+
| 0xA4400008 || 4 || VI_WIDTH_REG/VI_H_WIDTH_REG ||  
 
|-
 
|-
−
| 0xA4600040 || 4? || ||
+
| 0xA440000C || 4 || VI_INTR_REG/VI_V_INTR_REG ||  
 
|-
 
|-
−
| 0xA4600044 || 4? || ||
+
| 0xA4400010 || 4 || VI_CURRENT_REG/VI_V_CURRENT_LINE_REG ||  
 
|-
 
|-
−
| 0xA4600048 || 4? || || Many times used for read/write actions. (card data access register???)
+
| 0xA4400014 || 4 || VI_BURST_REG/VI_TIMING_REG ||  
 
|-
 
|-
−
| 0xA4600050 || 4? || ||
+
| 0xA4400018 || 4 || VI_V_SYNC_REG ||  
 
|-
 
|-
−
| 0xA4600054 || 4? || ||
+
| 0xA440001C || 4 || VI_V_SYNC_REG ||  
 
|-
 
|-
−
| 0xA4600060 || 4 || [[#StatusField| StatusField]] || This register is used for RTC, error led and other things... (probably status register?, made-up name)
+
| 0xA4400020 || 4 || VI_LEAP_REG/VI_H_SYNC_LEAP_REG ||  
 
|-
 
|-
−
| 0xA4600070 || 4? || ||  
+
| 0xA4400024 || 4 || VI_H_START_REG/VI_H_VIDEO_REG ||
 
|-
 
|-
−
| 0xA4610000 || 4? || ||  
+
| 0xA4400028 || 4 || VI_V_START_REG/VI_V_VIDEO_REG ||
 
|-
 
|-
−
| 0xA4610200 || 4? || ||  
+
| 0xA440002C || 4 || VI_V_BURST_REG ||
 
|-
 
|-
−
| 0xA4610420 || 176 || PI_AES_EXPANDED_KEY || AES-128 expanded key for hardware AES engine
+
| 0xA4400030 || 4 || VI_X_SCALE_REG ||
 
|-
 
|-
−
| 0xA46104D0 || 16 || PI_AES_IV || AES-128-CBC initialisation vector for hardware AES engine
+
| 0xA4400034 || 4 || VI_Y_SCALE_REG ||
 +
|}
 +
 
 +
= AI =
 +
{| class="wikitable"
 
|-
 
|-
−
| 0xA4610500 || 4 || ||
+
! Address
 +
! Size
 +
! Description
 +
! Note
 +
|-
 +
| 0xA4500000 || 4 || AI_DRAM_ADDR_REG ||
 +
|-
 +
| 0xA4500004 || 4 || AI_LEN_REG ||  
 
|-
 
|-
−
| 0xA4610504 || 4? || || atb? (virtual address?)
+
| 0xA4500008 || 4 || AI_CONTROL_REG ||  
 
|-
 
|-
−
| 0xA46E0400 || 4? or 2? || || rdb?
+
| 0xA450000C || 4 || AI_STATUS_REG ||  
 
|-
 
|-
−
| 0xA4940010 || 4? || ||
+
| 0xA4500010 || 4 || AI_DACRATE_REG ||  
 
|-
 
|-
−
| 0xA4A40010 || 4? || ||
+
| 0xA4500014 || 4 || AI_BITRATE_REG ||
 
|}
 
|}
  
−
= StatusField =  
+
= PI =
 +
{| class="wikitable"
 +
|-
 +
! Address
 +
! Size
 +
! Description
 +
! Note
 +
|-
 +
| 0xA4600000 || 4 || PI_DRAM_ADDR_REG || bit 31: NAND (maybe other sources?) DMA busy.
 +
|-
 +
| 0xA4600004 || 4 || PI_CART_ADDR_REG ||
 +
|-
 +
| 0xA4600008 || 4 || PI_RD_LEN_REG ||
 +
|-
 +
| 0xA460000C || 4 || PI_WR_LEN_REG ||
 +
|-
 +
| 0xA4600010 || 4 || PI_STATUS_REG ||
 +
|-
 +
| 0xA4600014 || 4 || PI_BSD_DOM1_LAT_REG ||
 +
|-
 +
| 0xA4600018 || 4 || PI_BSD_DOM1_PWD_REG ||
 +
|-
 +
| 0xA460001C || 4 || PI_BSD_DOM1_PGS_REG ||
 +
|-
 +
| 0xA4600020 || 4 || PI_BSD_DOM1_RLS_REG ||
 +
|-
 +
| 0xA4600024 || 4 || PI_BSD_DOM2_LAT_REG ||
 +
|-
 +
| 0xA4600028 || 4 || PI_BSD_DOM2_PWD_REG ||
 +
|-
 +
| 0xA460002C || 4 || PI_BSD_DOM2_PGS_REG ||
 +
|-
 +
| 0xA4600030 || 4 || PI_BSD_DOM2_RLS_REG ||
 +
|-
 +
| 0xA4600038 || 4 || PI_CARD_STATUS_REG || Tells if the NAND card is present or not
 +
|-
 +
| 0xA4600040 || 4 || PI_ATB_NEXT_CONFIG || takes in configuration info about the next ATB entry
 +
|-
 +
| 0xA4600044 || 4 || ||
 +
|-
 +
| 0xA4600048 || 4 || PI_CARD_CNT_REG || Control register for the NAND controller
 +
{| class="wikitable"
 +
|-
 +
!Bit
 +
!Write
 +
!Read
 +
|-
 +
| 31 || Start || Busy
 +
|-
 +
| 30-24 || ? || ?
 +
|-
 +
| 23-16 || NAND command || ?
 +
|-
 +
| 15 || ? || ?
 +
|-
 +
| 14 || Buffer select. Controls where in PI_EX_DMA_BUF the result is read to.<br />0: PI_EX_DMA_BUF + 0<br />1: PI_EX_DMA_BUF + 0x200 || ?
 +
|-
 +
| 13-11 || ? || ?
 +
|-
 +
| 10 || ? || some kind of error status? After a transfer, bootrom checks this bit and returns an error if it was set
 +
|-
 +
| 9-0 || Size to receive to PI_EX_DMA_BUF from NAND, in bytes. || Size to send from PI_EX_DMA_BUF to NAND, in bytes.
 +
|-
 +
|}
 +
|-
 +
| 0xA460004C || 4 || PI_CARD_CONFIG_REG || Takes configuration parameters for the NAND card
 +
|-
 +
| 0xA4600050 || 4 || PI_AES_CNT(?) || Seems to be used for controlling the AES hardware. Bit31: start/busy
 +
|-
 +
| 0xA4600054 || 4 || PI_ALLOWED_IO || Allows/disallows access to new PI features. This register is set by SK using the hwAccessRights field of the [[CMD]]. Only the bottom 8 bits of this field are used for this register
 +
|-
 +
| 0xA4600058 || 4 || PI_EX_RD_LEN_REG || Enhanced PI read length register
 +
|-
 +
| 0xA460005C || 4 || PI_EX_WR_LEN_REG || Enhanced PI write length register
 +
|-
 +
| 0xA4600060 || 4 || [[#PI_MISC_REG|PI_MISC_REG]] || This register is used for RTC, error led, power and more
 +
|-
 +
| 0xA4600070 || 4 || PI_CARD_BLK_OFFSET_REG || Takes the NAND card block offset for reading/writing
 +
|-
 +
| 0xA4610000 || 0x400 || PI_EX_DMA_BUF || output of current PI DMA operation; used for NAND, AES and the PI_EX_READ\WRITE operations
 +
|-
 +
| 0xA4610420 || 0xB0 || PI_AES_EXPANDED_KEY || AES-128 expanded key for hardware AES engine
 +
|-
 +
| 0xA46104D0 || 0x10 || PI_AES_IV || AES-128-CBC initialisation vector for hardware AES engine
 +
|-
 +
| 0xA4610500 || 4 * 0xC0 || PI_ATB_ENTRY || Associates a particular page (or pages) in cartridge space with a particular NAND block (or blocks)
 +
|-
 +
| 0xA4620000 || 4 || ||
 +
|-
 +
| 0xA46E0000 || 2 || PI_RDB_REQ_HI_REG ||
 +
|-
 +
| 0xA46E0002 || 2 || PI_RDB_REQ_LO_REG ||
 +
|-
 +
| 0xA46E0004 || 2 || ||
 +
|-
 +
| 0xA46E0400 || 2 || || RDB related
 +
|-
 +
| 0xA46E0402 || 2 || || RDB related
 +
|-
 +
| 0xA46E8000 || 2 || PI_RDB_STATUS_REG ||
 +
|}
  
 +
== PI_MISC_REG ==
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
Line 80: Line 200:
 
! Description
 
! Description
 
|-
 
|-
−
| ?-15 || Box Id
+
| 31-15 || Box Id
 
|-
 
|-
−
| 27 || Power (on and off)
+
| 6-7 || RTC mask
 
|-
 
|-
−
| 28 || RTC related?
+
| 5 || Error led mask (always 0x01)
 
|-
 
|-
−
| 29 || Unknown bit
+
| 4 || Power mask (always 0x01)
 
|-
 
|-
−
| 30 || Error led
+
| 2-3 || RTC status
 
|-
 
|-
−
| 31 || Power (only on)
+
| 1 || Error led
 +
|-
 +
| 0 || Power control
 
|}
 
|}
  
−
== RTC ==
+
= USB =
 +
The iQue Player has support for two USB controllers, one mapped at 0xA4900000 and another at 0xA4A00000.
  
−
The iQue Player has a custom RTC functionality. The Nintendo 64 doesn't have a RTC, except the Nintendo 64 version of Animal Crossing which uses a special custom RTC chip instead of a built-in RTC. The RTC functionality is heavly used in the game [[Animal_Crossing| Animal Crossing]]. The RTC can be accessed through 0xA4600060. (unknown how)
+
{| class="wikitable"
 +
|-
 +
! Address
 +
! Size
 +
! Description
 +
! Note
 +
|-
 +
| 0xA4900000 || 4 || ||
 +
|-
 +
| 0xA4940010 || 4 || USB0_STATUS_REG ||
 +
|-
 +
| 0xA4A00000 || 4 || ||
 +
|-
 +
| 0xA4A40010 || 4 || USB1_STATUS_REG ||
 +
|}

Latest revision as of 00:07, 21 March 2024

Memory mapped registers available on the iQue Player.

MI

Address Size Description Note
0xA4300000 4 MI_INIT_MODE_REG/MI_MODE_REG
0xA4300004 4 MI_VERSION_REG/MI_NOOP_REG
0xA4300008 4 MI_INTR_REG
0xA430000C 4 MI_INTR_MASK_REG
0xA4300010 4
0xA4300014 4 MI_SK_EXCEPTION_REG Reading from this address within non-secure mode causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = Watchdog Timer timeout, bit 2 = SKC.
0xA4300018 4 MI_SK_WATCHDOG_TIMER Set to 0x7530c800 by SK to start or reset the timer. The bottom 16 bits appear to be the number of timer ticks to wait before an interrupt is fired, and bit 3 of MI_SK_EXCEPTION_REG is set. When reading from this register while the timer is ticking, the top 16 bits appear to be the remaining number of ticks until the interrupt fires. This is mainly used by SK to deal with trial/demo games. The timer is reset by SK when skKeepAlive is called. Depending on the trial type (timed vs number of launches), this timer is either used to detect a game crash or other event which would cause skKeepAlive calls to stop being made, or for timed trials, to keep track of the remaining time on the trial. One tick appears to happen every 1.220703 milliseconds with the configuration SK sets. Other tick rates and behaviors maybe be configurable, but it is unknown at this time if that is the case.
0xA4300028 4
0xA430002C 1 MI_RANDOM_BIT Hardware RNG? Seems to return 1 bit of randomness, SK function at 0x9FC03410 gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
0xA4300030 4
0xA4300038 4 MI_HW_INTR_REG Hardware interrupts (0x40 = NAND DMA, 0x80 = AES, 0x100 = RDB, 0x200 = PI_ERR, 0x400 = USB0, 0x800 = USB1, 0x1000 = ??, 0x2000 = MD). Bottom bits appear to mirror MI_INTR_REG.
0xA430003C 4 MI_HW_INTR_MASK_REG Hardware interrupt mask.

VI

Address Size Description Note
0xA4400000 4 VI_STATUS_REG/VI_CONTROL_REG If bit 13 is set (normally documented as unused/reserved), the console will display corrupted graphics. N64 games usually (always?) have this bit set, which is the cause of corrupted graphics seen when vanilla N64 games are played on an iQue Player.
0xA4400004 4 VI_ORIGIN_REG/VI_DRAM_ADDR_REG
0xA4400008 4 VI_WIDTH_REG/VI_H_WIDTH_REG
0xA440000C 4 VI_INTR_REG/VI_V_INTR_REG
0xA4400010 4 VI_CURRENT_REG/VI_V_CURRENT_LINE_REG
0xA4400014 4 VI_BURST_REG/VI_TIMING_REG
0xA4400018 4 VI_V_SYNC_REG
0xA440001C 4 VI_V_SYNC_REG
0xA4400020 4 VI_LEAP_REG/VI_H_SYNC_LEAP_REG
0xA4400024 4 VI_H_START_REG/VI_H_VIDEO_REG
0xA4400028 4 VI_V_START_REG/VI_V_VIDEO_REG
0xA440002C 4 VI_V_BURST_REG
0xA4400030 4 VI_X_SCALE_REG
0xA4400034 4 VI_Y_SCALE_REG

AI

Address Size Description Note
0xA4500000 4 AI_DRAM_ADDR_REG
0xA4500004 4 AI_LEN_REG
0xA4500008 4 AI_CONTROL_REG
0xA450000C 4 AI_STATUS_REG
0xA4500010 4 AI_DACRATE_REG
0xA4500014 4 AI_BITRATE_REG

PI

Address Size Description Note
0xA4600000 4 PI_DRAM_ADDR_REG bit 31: NAND (maybe other sources?) DMA busy.
0xA4600004 4 PI_CART_ADDR_REG
0xA4600008 4 PI_RD_LEN_REG
0xA460000C 4 PI_WR_LEN_REG
0xA4600010 4 PI_STATUS_REG
0xA4600014 4 PI_BSD_DOM1_LAT_REG
0xA4600018 4 PI_BSD_DOM1_PWD_REG
0xA460001C 4 PI_BSD_DOM1_PGS_REG
0xA4600020 4 PI_BSD_DOM1_RLS_REG
0xA4600024 4 PI_BSD_DOM2_LAT_REG
0xA4600028 4 PI_BSD_DOM2_PWD_REG
0xA460002C 4 PI_BSD_DOM2_PGS_REG
0xA4600030 4 PI_BSD_DOM2_RLS_REG
0xA4600038 4 PI_CARD_STATUS_REG Tells if the NAND card is present or not
0xA4600040 4 PI_ATB_NEXT_CONFIG takes in configuration info about the next ATB entry
0xA4600044 4
0xA4600048 4 PI_CARD_CNT_REG Control register for the NAND controller
Bit Write Read
31 Start Busy
30-24 ? ?
23-16 NAND command ?
15 ? ?
14 Buffer select. Controls where in PI_EX_DMA_BUF the result is read to.
0: PI_EX_DMA_BUF + 0
1: PI_EX_DMA_BUF + 0x200		 ?
13-11 ? ?
10 ? some kind of error status? After a transfer, bootrom checks this bit and returns an error if it was set
9-0 Size to receive to PI_EX_DMA_BUF from NAND, in bytes. Size to send from PI_EX_DMA_BUF to NAND, in bytes.
0xA460004C 4 PI_CARD_CONFIG_REG Takes configuration parameters for the NAND card
0xA4600050 4 PI_AES_CNT(?) Seems to be used for controlling the AES hardware. Bit31: start/busy
0xA4600054 4 PI_ALLOWED_IO Allows/disallows access to new PI features. This register is set by SK using the hwAccessRights field of the CMD. Only the bottom 8 bits of this field are used for this register
0xA4600058 4 PI_EX_RD_LEN_REG Enhanced PI read length register
0xA460005C 4 PI_EX_WR_LEN_REG Enhanced PI write length register
0xA4600060 4 PI_MISC_REG This register is used for RTC, error led, power and more
0xA4600070 4 PI_CARD_BLK_OFFSET_REG Takes the NAND card block offset for reading/writing
0xA4610000 0x400 PI_EX_DMA_BUF output of current PI DMA operation; used for NAND, AES and the PI_EX_READ\WRITE operations
0xA4610420 0xB0 PI_AES_EXPANDED_KEY AES-128 expanded key for hardware AES engine
0xA46104D0 0x10 PI_AES_IV AES-128-CBC initialisation vector for hardware AES engine
0xA4610500 4 * 0xC0 PI_ATB_ENTRY Associates a particular page (or pages) in cartridge space with a particular NAND block (or blocks)
0xA4620000 4
0xA46E0000 2 PI_RDB_REQ_HI_REG
0xA46E0002 2 PI_RDB_REQ_LO_REG
0xA46E0004 2
0xA46E0400 2 RDB related
0xA46E0402 2 RDB related
0xA46E8000 2 PI_RDB_STATUS_REG

PI_MISC_REG

Bit(s) Description
31-15 Box Id
6-7 RTC mask
5 Error led mask (always 0x01)
4 Power mask (always 0x01)
2-3 RTC status
1 Error led
0 Power control

USB

The iQue Player has support for two USB controllers, one mapped at 0xA4900000 and another at 0xA4A00000.

Address Size Description Note
0xA4900000 4
0xA4940010 4 USB0_STATUS_REG
0xA4A00000 4
0xA4A40010 4 USB1_STATUS_REG
Retrieved from "http://www.iquebrew.org/index.php?title=IO&oldid=1421"