PIF-NUS

The Peripheral Interface, or PIF manages many of the critical functions of the N64 console.

• Console startup and piracy protections
  • Stores the first 2 stages of the Initial Program Load (IPL) that is executed by the VR4300 CPU
• Manages the console reset button to avoid corrupting save game data
• Handles all JoyBus communication with the controllers and EEPROM inside the cartridges

Console startup

1. PIF holds all of the console components in reset mode, listening for cartridge CIC
2. Cartridge sends 4 bits (nibble) including region encoding
3. Cartridge sends 4 bit encrypted seed value
4. Cartridge sends 4 bit checksum
5. PIF checks that these are the expected values
   1. If the values don't match (same scenario if no cartridge is inserted)
      1. The user would generally reset using the button or power off
      2. Remove/Re-insert cartridge (or change games)
      3. Power on (go to step #1)
6. PIF writes the encrypted seed value to memory address 0xBFC0'07E4
7. PIF releases the reset pin for the whole console
8. VR4300 requests RAM address 0xBFC0'0000 from the Memory Management Unit inside the RCP
9. IPL1: The MMU then loads the MIPS code from a storage area of the PIF chip
   1. These instructions are executed directly in this very slow manner.
   2. Thankfully IPL1 is only 52 instructions + some looping
   3. Some really basic hardware initialization
   4. Copy IPL2 to the RSP IMEM address range
10. IPL 2 is executed by the VR4300 but reading the instructions from the RSP's IMEM
    1. More general hardware initialization
    2. If it's determined to be a 64DD disk it will jump to 0xA600'0000
    3. Load IPL3 from the cartridge into the RSP's DMEM
    4. The IPL3 code is CRC checked
    5. Set 0xBFC0'0000 range to "invisible"
    6. Jump to RSP DMEM to execute IPL3
11. IPL3 is executed by the VR4300 but reading the instructions from the RSP's DMEM
    1. Initialize RDRAM
    2. Depending on reset type
       1. Power On: Invalidate VR4300 ICache & DCache
       2. Reset : Writeback VR4300 ICache & DCache
    3. Move IPL3 execution from DMEM to RDRAM
    4. DMA 1 MB of Game code to RDRAM
    5. Authenticate 1 MB of Game Program
    6. Reset RSP
    7. Clear Interrupts
    8. Clear IPL3 from DMEM
    9. Clear IPL2 from IMEM
    10. Jump to Game code in RDRAM

Both the PIF and CIC (inside the cartridge) are custom versions of Sharp branded SM5 4-bit microcontrollers. These microcontrollers were also used in the Game & Watch handheld games, so Nintendo already had developers that were familiar with them.

is a Sharp SM5 microcontroller on the main board that does many functions for the Nintendo 64. In addition to managing the Joybus Protocol for connected hardware like controllers and connected accessory PAKs, it also continuously communicates with the CIC copy protection chip in the game cartridge, handles console startup, and manages the Reset button.

References

https://sites.google.com/site/consoleprotocols/home/techinfo/lowlevel/pif12

https://code.google.com/archive/p/mupen64plus/wikis/SoftResetNotes.wiki

https://github.com/jago85/UltraCIC_C/blob/master/cic_c.c