ME: Let kernel code on the main CPU reach RAM and VRAM through kseg1

Yabause-PSP's me.prx ORs 0xA0000000 onto its own addresses to share a
buffer with the ME uncached, which is 0xA8xxxxxx for a module in kernel
RAM. The main CPU's space has no views there, so it crashed.

All of kernel segment 1 (0xA0000000-0xBFFFFFFF) now counts as MMIO, and a
device below the hardware registers maps RAM and VRAM onto their uncached
mirrors at 0x40000000. The main CPU's native kernel loads and stores send
the whole segment to that path; the ME keeps 0xBC000000 as the boundary,
since its space maps the rest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Core/MIPS/x86/X64IRCompLoadStore.cpp

@@ -89,7 +89,8 @@ Gen::OpArg X64JitBackend::PrepareSrc1Address(IRInst inst) {
 
 #if PPSSPP_ARCH(AMD64)
 // Memory directly, or through the fixed code for a hardware register (0xBC000000-0xBFFFFFFF), where
-// the address may also be one the CPU has no memory at.
+// the address may also be one the CPU has no memory at. The main CPU has no views anywhere in kernel
+// segment 1 (0xA0000000-0xBFFFFFFF), so all of it goes there (see Memory::IsMMIOAccess).
 void X64JitBackend::CompIR_KernelLoadStore(IRInst inst) {
 	CONDITIONAL_DISABLE;
 
@@ -98,7 +99,7 @@ void X64JitBackend::CompIR_KernelLoadStore(IRInst inst) {
 	LEA(32, SCRATCH1, MDisp(regs_.RX(inst.src1), inst.constant));
 	const X64Reg reg = isStore ? regs_.RX(inst.src3) : regs_.RX(inst.dest);
 
-	CMP(32, R(SCRATCH1), Imm32(0xBC000000));
+	CMP(32, R(SCRATCH1), Imm32(mips_->IsMediaEngine() ? 0xBC000000 : 0xA0000000));
 	FixupBranch below = J_CC(CC_B);
 	CMP(32, R(SCRATCH1), Imm32(0xC0000000));
 	FixupBranch above = J_CC(CC_AE);