Memory mapped registers available on the iQue Player.
MI
| Address
|
Size
|
Description
|
Note
|
| 0xA4300000 |
4 |
MI_INIT_MODE_REG/MI_MODE_REG |
|
| 0xA4300004 |
4 |
MI_VERSION_REG/MI_NOOP_REG |
|
| 0xA4300008 |
4 |
MI_INTR_REG |
|
| 0xA430000C |
4 |
MI_INTR_MASK_REG |
|
| 0xA4300010 |
4 |
|
|
| 0xA4300014 |
4 |
MI_SK_EXCEPTION_REG |
Reading from this address within non-secure mode causes an exception; SK exception handler checks this address as well, and makes some decisions based on the value: bits 7-4 = ?, bit 3 = Watchdog Timer timeout, bit 2 = SKC.
|
| 0xA4300018 |
4 |
MI_SK_WATCHDOG_TIMER |
Set to 0x7530c800 by SK to start or reset the timer. The bottom 16 bits appear to be the number of timer ticks to wait before an interrupt is fired, and bit 3 of MI_SK_EXCEPTION_REG is set. When reading from this register while the timer is ticking, the top 16 bits appear to be the remaining number of ticks until the interrupt fires. This is mainly used by SK to deal with trial/demo games. The timer is reset by SK when skKeepAlive is called. Depending on the trial type (timed vs number of launches), this timer is either used to detect a game crash or other event which would cause skKeepAlive calls to stop being made, or for timed trials, to keep track of the remaining time on the trial. One tick appears to happen every 1.220703 milliseconds with the configuration SK sets. Other tick rates and behaviors maybe be configurable, but it is unknown at this time if that is the case.
|
| 0xA4300028 |
4 |
|
|
| 0xA430002C |
1 |
MI_RANDOM_BIT |
Hardware RNG? Seems to return 1 bit of randomness, SK function at 0x9FC03410 gets lots of entropy from this then hashes it with SHA1 (several times?), this function is used to get randomness used when ECC signing, and when creating key material for recrypt.sys.
|
| 0xA4300030 |
4 |
|
|
| 0xA4300038 |
4 |
MI_HW_INTR_REG |
Hardware interrupts (0x40 = NAND DMA, 0x80 = AES, 0x100 = RDB, 0x200 = PI_ERR, 0x400 = USB0, 0x800 = USB1, 0x1000 = ??, 0x2000 = MD). Bottom bits appear to mirror MI_INTR_REG.
|
| 0xA430003C |
4 |
MI_HW_INTR_MASK_REG |
Hardware interrupt mask.
|
VI
| Address
|
Size
|
Description
|
Note
|
| 0xA4400000 |
4 |
VI_STATUS_REG/VI_CONTROL_REG |
If bit 13 is set (normally documented as unused/reserved), the console will display corrupted graphics. N64 games usually (always?) have this bit set, which is the cause of corrupted graphics seen when vanilla N64 games are played on an iQue Player.
|
| 0xA4400004 |
4 |
VI_ORIGIN_REG/VI_DRAM_ADDR_REG |
|
| 0xA4400008 |
4 |
VI_WIDTH_REG/VI_H_WIDTH_REG |
|
| 0xA440000C |
4 |
VI_INTR_REG/VI_V_INTR_REG |
|
| 0xA4400010 |
4 |
VI_CURRENT_REG/VI_V_CURRENT_LINE_REG |
|
| 0xA4400014 |
4 |
VI_BURST_REG/VI_TIMING_REG |
|
| 0xA4400018 |
4 |
VI_V_SYNC_REG |
|
| 0xA440001C |
4 |
VI_V_SYNC_REG |
|
| 0xA4400020 |
4 |
VI_LEAP_REG/VI_H_SYNC_LEAP_REG |
|
| 0xA4400024 |
4 |
VI_H_START_REG/VI_H_VIDEO_REG |
|
| 0xA4400028 |
4 |
VI_V_START_REG/VI_V_VIDEO_REG |
|
| 0xA440002C |
4 |
VI_V_BURST_REG |
|
| 0xA4400030 |
4 |
VI_X_SCALE_REG |
|
| 0xA4400034 |
4 |
VI_Y_SCALE_REG |
|
AI
| Address
|
Size
|
Description
|
Note
|
| 0xA4500000 |
4 |
AI_DRAM_ADDR_REG |
|
| 0xA4500004 |
4 |
AI_LEN_REG |
|
| 0xA4500008 |
4 |
AI_CONTROL_REG |
|
| 0xA450000C |
4 |
AI_STATUS_REG |
|
| 0xA4500010 |
4 |
AI_DACRATE_REG |
|
| 0xA4500014 |
4 |
AI_BITRATE_REG |
|
PI
| Address
|
Size
|
Description
|
Note
|
| 0xA4600000 |
4 |
PI_DRAM_ADDR_REG |
bit 31: NAND (maybe other sources?) DMA busy.
|
| 0xA4600004 |
4 |
PI_CART_ADDR_REG |
|
| 0xA4600008 |
4 |
PI_RD_LEN_REG |
|
| 0xA460000C |
4 |
PI_WR_LEN_REG |
|
| 0xA4600010 |
4 |
PI_STATUS_REG |
|
| 0xA4600014 |
4 |
PI_BSD_DOM1_LAT_REG |
|
| 0xA4600018 |
4 |
PI_BSD_DOM1_PWD_REG |
|
| 0xA460001C |
4 |
PI_BSD_DOM1_PGS_REG |
|
| 0xA4600020 |
4 |
PI_BSD_DOM1_RLS_REG |
|
| 0xA4600024 |
4 |
PI_BSD_DOM2_LAT_REG |
|
| 0xA4600028 |
4 |
PI_BSD_DOM2_PWD_REG |
|
| 0xA460002C |
4 |
PI_BSD_DOM2_PGS_REG |
|
| 0xA4600030 |
4 |
PI_BSD_DOM2_RLS_REG |
|
| 0xA4600038 |
4 |
PI_CARD_STATUS_REG |
Tells if the NAND card is present or not
|
| 0xA4600040 |
4 |
PI_ATB_NEXT_CONFIG |
takes in configuration info about the next ATB entry
|
| 0xA4600044 |
4 |
|
|
| 0xA4600048 |
4 |
PI_CARD_CNT_REG |
Control register for the NAND controller
| Bit
|
Write
|
Read
|
| 31 |
Start |
Busy
|
| 30-24 |
? |
?
|
| 23-16 |
NAND command |
?
|
| 15 |
? |
?
|
| 14 |
Buffer select. Controls where in PI_EX_DMA_BUF the result is read to.
0: PI_EX_DMA_BUF + 0
1: PI_EX_DMA_BUF + 0x200 |
?
|
| 13-11 |
? |
?
|
| 10 |
? |
some kind of error status? After a transfer, bootrom checks this bit and returns an error if it was set
|
| 9-0 |
Size to receive to PI_EX_DMA_BUF from NAND, in bytes. |
Size to send from PI_EX_DMA_BUF to NAND, in bytes.
|
|
| 0xA460004C |
4 |
PI_CARD_CONFIG_REG |
Takes configuration parameters for the NAND card
|
| 0xA4600050 |
4 |
PI_AES_CNT(?) |
Seems to be used for controlling the AES hardware. Bit31: start/busy
|
| 0xA4600054 |
4 |
PI_ALLOWED_IO |
Allows/disallows access to new PI features. This register is set by SK using the hwAccessRights field of the CMD. Only the bottom 8 bits of this field are used for this register
|
| 0xA4600058 |
4 |
PI_EX_RD_LEN_REG |
Enhanced PI read length register
|
| 0xA460005C |
4 |
PI_EX_WR_LEN_REG |
Enhanced PI write length register
|
| 0xA4600060 |
4 |
PI_MISC_REG |
This register is used for RTC, error led, power and more
|
| 0xA4600070 |
4 |
PI_CARD_BLK_OFFSET_REG |
Takes the NAND card block offset for reading/writing
|
| 0xA4610000 |
0x400 |
PI_EX_DMA_BUF |
output of current PI DMA operation; used for NAND, AES and the PI_EX_READ\WRITE operations
|
| 0xA4610420 |
0xB0 |
PI_AES_EXPANDED_KEY |
AES-128 expanded key for hardware AES engine
|
| 0xA46104D0 |
0x10 |
PI_AES_IV |
AES-128-CBC initialisation vector for hardware AES engine
|
| 0xA4610500 |
4 * 0xC0 |
PI_ATB_ENTRY |
Associates a particular page (or pages) in cartridge space with a particular NAND block (or blocks)
|
| 0xA4620000 |
4 |
|
|
| 0xA46E0000 |
2 |
PI_RDB_REQ_HI_REG |
|
| 0xA46E0002 |
2 |
PI_RDB_REQ_LO_REG |
|
| 0xA46E0004 |
2 |
|
|
| 0xA46E0400 |
2 |
|
RDB related
|
| 0xA46E0402 |
2 |
|
RDB related
|
| 0xA46E8000 |
2 |
PI_RDB_STATUS_REG |
|
PI_MISC_REG
| Bit(s)
|
Description
|
| 31-15 |
Box Id
|
| 6-7 |
RTC mask
|
| 5 |
Error led mask (always 0x01)
|
| 4 |
Power mask (always 0x01)
|
| 2-3 |
RTC status
|
| 1 |
Error led
|
| 0 |
Power control
|
USB
The iQue Player has support for two USB controllers, one mapped at 0xA4900000 and another at 0xA4A00000.
| Address
|
Size
|
Description
|
Note
|
| 0xA4900000 |
4 |
|
|
| 0xA4940010 |
4 |
USB0_STATUS_REG |
|
| 0xA4A00000 |
4 |
|
|
| 0xA4A40010 |
4 |
USB1_STATUS_REG |
|