.Z64 File Format – Memory map and registers

The addresses a Nintendo 64 program uses

Introduction

The disassembly of a ROM is full of constants such as lui $t0, 0xA404 followed by a load or store; they are addresses of hardware. This page gives the map they refer to and the register names the explorer puts in the notes. The names and addresses are those of the N64brew wiki; the one-line roles are written for this page from the names.

Segments

The VR4300 sees 32-bit virtual addresses. Two segments are mapped directly, without the TLB, to the lowest 512 MiB of physical addresses:

SegmentVirtual addressesPhysical addressCache
KSEG0$80000000–$9FFFFFFFvirtual − $80000000cached
KSEG1$A0000000–$BFFFFFFFvirtual − $A0000000uncached

Hardware registers are used through KSEG1 (a cached access to most of them freezes the processor, per N64brew), so the addresses on this page are written $A4040010 and so on; the explorer names the same register through KSEG0 too.

Physical memory map

Physical addressesNameWhat is there
$00000000–$03EFFFFFRDRAMMain memory (4 MiB, or 8 MiB with the Expansion Pak, of the 63 MiB the map reserves).
$03F00000–$03F7FFFFRDRAM registersPer-chip RDRAM registers.
$03F80000–$03FFFFFFRDRAM broadcastWrite-only: every RDRAM chip answers.
$04000000–$04000FFFSP DMEMRSP data memory (4 KiB).
$04001000–$04001FFFSP IMEMRSP instruction memory (4 KiB).
$04040000–$040BFFFFSP registersRSP DMA, status, semaphore and program counter.
$04100000–$041FFFFFDP commandRDP command DMA and counters.
$04200000–$042FFFFFDP spanRDP span and texture memory test registers.
$04300000–$043FFFFFMIMIPS interface: mode, version, interrupts and masks.
$04400000–$044FFFFFVIVideo interface.
$04500000–$045FFFFFAIAudio interface.
$04600000–$046FFFFFPIPeripheral interface: cartridge DMA and bus timing.
$04700000–$047FFFFFRIRDRAM interface.
$04800000–$048FFFFFSISerial interface: DMA to the PIF.
$08000000–$0FFFFFFFCartridge domain 2Save memory (SRAM, FlashRAM), slower bus timing.
$10000000–$1FBFFFFFCartridge domain 1Cartridge ROM, read through the PI.
$1FC00000–$1FC007BFPIF ROMBoot code of the PIF (IPL1 and IPL2).
$1FC007C0–$1FC007FFPIF RAMController and EEPROM communication and boot data (64 bytes).

The 64DD’s registers ($05000000 range) and IPL ROM ($06000000 range) are also reached through the PI; the rest of the space is unmapped or unused.

Registers the viewer names

Addresses are given in KSEG1. “Meaning” is a short role from the register’s name; the bit fields are not described here.

RSP (SP)

AddressNameMeaning
$A4040000SP_MEM_ADDRRSP DMA: address in DMEM or IMEM
$A4040004SP_DRAM_ADDRRSP DMA: address in RDRAM
$A4040008SP_RD_LENRSP DMA: length, RDRAM to RSP, starts the copy
$A404000CSP_WR_LENRSP DMA: length, RSP to RDRAM, starts the copy
$A4040010SP_STATUSRSP status and control (halt, break, signals)
$A4040014SP_DMA_FULLRSP DMA queue full
$A4040018SP_DMA_BUSYRSP DMA busy
$A404001CSP_SEMAPHORERSP semaphore
$A4080000SP_PCRSP program counter

RDP (DP command and span)

AddressNameMeaning
$A4100000DPC_STARTRDP command list start
$A4100004DPC_ENDRDP command list end
$A4100008DPC_CURRENTRDP command pointer
$A410000CDPC_STATUSRDP status and control
$A4100010DPC_CLOCKRDP clock counter
$A4100014DPC_CMD_BUSYRDP command busy counter (the wiki’s summary table calls it DPC_BUF_BUSY)
$A4100018DPC_PIPE_BUSYRDP pipe busy counter
$A410001CDPC_TMEM_BUSYRDP texture memory busy counter
$A4200000DPS_TBISTRDP texture memory built-in self test
$A4200004DPS_TEST_MODERDP span test mode
$A4200008DPS_BUFTEST_ADDRRDP span buffer test address
$A420000CDPS_BUFTEST_DATARDP span buffer test data

MIPS interface (MI)

AddressNameMeaning
$A4300000MI_MODEMI mode (init, repeat, ebus test)
$A4300004MI_VERSIONMI version
$A4300008MI_INTERRUPTPending RCP interrupts (SP, SI, AI, VI, PI, DP)
$A430000CMI_MASKRCP interrupt mask

Video interface (VI)

AddressNameMeaning
$A4400000VI_CTRLVideo control: pixel size, anti-aliasing, filters
$A4400004VI_ORIGINFramebuffer address in RDRAM
$A4400008VI_WIDTHFramebuffer width in pixels
$A440000CVI_V_INTRHalf-line that raises the video interrupt
$A4400010VI_V_CURRENTCurrent half-line
$A4400014VI_BURSTColour burst timing
$A4400018VI_V_TOTALTotal half-lines per field
$A440001CVI_H_TOTALTotal video clocks per line
$A4400020VI_H_TOTAL_LEAPLine length leap pattern
$A4400024VI_H_VIDEOActive horizontal range
$A4400028VI_V_VIDEOActive vertical range
$A440002CVI_V_BURSTColour burst vertical range
$A4400030VI_X_SCALEHorizontal scale
$A4400034VI_Y_SCALEVertical scale
$A4400038VI_TEST_ADDRTest address
$A440003CVI_STAGED_DATAStaged test data

Audio interface (AI)

AddressNameMeaning
$A4500000AI_DRAM_ADDRAudio DMA: address in RDRAM
$A4500004AI_LENGTHAudio DMA: length in bytes, starts or queues the transfer
$A4500008AI_CONTROLAudio DMA enable
$A450000CAI_STATUSAudio status
$A4500010AI_DACRATEDAC sample period
$A4500014AI_BITRATEAudio bit clock rate

Peripheral interface (PI)

AddressNameMeaning
$A4600000PI_DRAM_ADDRCartridge DMA: address in RDRAM
$A4600004PI_CART_ADDRCartridge DMA: address on the cartridge bus
$A4600008PI_RD_LENCartridge DMA: length, RDRAM to cartridge
$A460000CPI_WR_LENCartridge DMA: length, cartridge to RDRAM
$A4600010PI_STATUSPI status and control
$A4600014PI_BSD_DOM1_LATDomain 1 latency
$A4600018PI_BSD_DOM1_PWDDomain 1 pulse width
$A460001CPI_BSD_DOM1_PGSDomain 1 page size
$A4600020PI_BSD_DOM1_RLSDomain 1 release
$A4600024PI_BSD_DOM2_LATDomain 2 latency
$A4600028PI_BSD_DOM2_PWDDomain 2 pulse width
$A460002CPI_BSD_DOM2_PGSDomain 2 page size
$A4600030PI_BSD_DOM2_RLSDomain 2 release

RDRAM interface (RI)

AddressNameMeaning
$A4700000RI_MODERDRAM interface mode
$A4700004RI_CONFIGRDRAM interface configuration
$A4700008RI_CURRENT_LOADCurrent control load
$A470000CRI_SELECTSelect
$A4700010RI_REFRESHRefresh
$A4700014RI_LATENCYLatency
$A4700018RI_ERRORError
$A470001CRI_BANK_STATUSBank status

Serial interface (SI)

AddressNameMeaning
$A4800000SI_DRAM_ADDRPIF DMA: address in RDRAM
$A4800004SI_PIF_AD_RD64BPIF DMA: read 64 bytes from PIF RAM
$A4800008SI_PIF_AD_WR4BWrite 4 bytes to PIF RAM
$A4800010SI_PIF_AD_WR64BPIF DMA: write 64 bytes to PIF RAM
$A4800014SI_PIF_AD_RD4BRead 4 bytes from PIF RAM
$A4800018SI_STATUSSI status

The disassembly also names RSP memory (SP_DMEM+n, SP_IMEM+n) and PIF RAM (PIF_RAM+n) offsets. The RSP’s SP_IBIST register and the iQue Player’s extra registers (MI_BB_*, PI_BB_*) are not named: the wiki gives no address for the first, and the second are specific to another console.

How the viewer finds a register

A disassembler sees lui $t0, 0xA404 and, a few instructions later, lw $t1, 0x10($t0); it cannot know the register held the constant. The explorer looks back up to 16 instructions for the lui that set the base register, adds the offsets it can see (ori, addiu, the load or store offset) and names the address when it is on the list above. It stops at a jump and does not follow branches, so the note is a guess about the run time value, marked “from the LUI above”; it never changes the instruction text.

Not described

Known, not yet covered

  • Reference: the bit fields of every register, the RDRAM chip registers, the 64DD registers, the iQue Player registers, the PIF’s command protocol and the TLB mappings games set up.

Links

Reference