MMIO register ranges

Introduction

Todo

write me

NV1 MMIO map

8-bit space nv1-mmio [0x2000000]
Address Name Description
0x0 PMC card master control
0x1000 PBUS bus control
0x2000 PFIFO MMIO-mapped FIFO submission to PGRAPH
0x100000 PDMA system memory DMA engine
0x101000 PTIMER time measurement and time-based alarms
0x300000 PAUDIO audio capture and playback device
0x400000 PGRAPH accelerated drawing engine
0x410000 UBETA BETA object
0x420000 UROP ROP object
0x430000 UCHROMA CHROMA object
0x440000 UPLANE PLANE object
0x450000 UCLIP CLIP object
0x460000 UPATTERN PATTERN object
0x480000 UPOINT POINT object
0x490000 ULINE LINE object
0x4a0000 ULIN LIN object
0x4b0000 UTRI TRI object
0x4c0000 URECT RECT object
0x4d0000 UTEXLIN TEXLIN object
0x4e0000 UTEXQUAD TEXQUAD object
0x500000 UBLIT BLIT object
0x510000 UIFC IFC object
0x520000 UBITMAP BITMAP object
0x530000 UIFM IFM object
0x540000 UITM ITM object
0x5d0000 UTEXLINBETA TEXLINBETA object
0x5e0000 UTEXQUADBETA TEXQUADBETA object
0x600000 PFB VRAM and video output control
0x602000 PRAM RAMIN layout control
0x604000 PRAMAU RAMAU access
0x605000 PCHIPID chip ID readout
0x606000 PRAMUNK2 UNK2 access
0x608000 PSTRAPS straps readout
0x609000 PDAC DAC control
0x60a000 PEEPROM configuration EEPROM access
0x610000 PROM ROM access window
0x618000 PALT external memory access window
0x640000 PRAMHT RAMHT access
0x648000 PRAMFC RAMFC access
0x650000 PRAMRO RAMRO access
0x6c0000 PRM VGA and ISA sound emulation
0x6d0000 PRMIO VGA and ISA sound compat IO port access
0x6e0000 PRMFB VGA memory window access
0x700000 PRAMIN RAMIN access
0x800000+chid*0x10000+subc*0x2000 (chid<128, subc<8) USER[chid][subc] PFIFO MMIO submission area
0x1000000 FB VRAM access area

NV3:G80 MMIO map

8-bit space nv3-mmio [0x1000000]

Todo

check UNK005000 variants [sorta present on NV35, NV34, C51, MCP73; present on NV5, NV11, NV17, NV1A, NV20; not present on NV44]

Todo

check PCOUNTER variants

Todo

some IGP don’t have PVPE/PVP1 [C51: present, but without PME; MCP73: not present at all]

Todo

check PSTRAPS on IGPs

Todo

check PROM on IGPs

Todo

PMEDIA not on IGPs [MCP73 and C51: not present] and some other cards?

Todo

PFB not on IGPs

Todo

merge PCRTC+PRMCIO/PRAMDAC+PRMDIO?

Todo

UNK6E0000 variants

Todo

UNK006000 variants

Todo

UNK00E000 variants

Todo

102000 variants; present on MCP73, not C51

Note

fully verified on NV3, NV5, NV11, NV17, NV34, NV35, NV44, C51, MCP73

Note

NV1A and NV20 don’t have second PCRTC/PRAMDAC, but still have the decoding circuitry for them. This may cause the card to hang when accessing these ranges. The same applies for NV2x and PVPE.

Address Variants Name Description
0x0 all PMC card master control
0x1000 all PBUS bus control
0x2000 NV3:NV4 PFIFO MMIO-mapped FIFO submission to PGRAPH
0x2000 NV4:G80 PFIFO MMIO and DMA FIFO submission to PGRAPH and PVPE
0x4000 NV3:NV4 UNK004000 ???
0x4000 NV34:NV40 UNK004000 ???
0x4000 NV40:G80 PCLOCK PLL control
0x5000 NV4:NV40,IGP4X UNK005000 ???
0x6000 NV20:NV34 UNK006000 ???
0x7000 all PRMA real mode BAR access
0x8000 NV10:G80 PVIDEO video overlay
0x9000 all PTIMER time measurement and time-based alarms
0xa000 NV10:NV40 PCOUNTER performance monitoring counters
0xa000 NV40:G80 PCOUNTER performance monitoring counters
0xb000 NV17:NV20,NV30:G80 PVPE MPEG decoding/encoding engine
0xc000 NV40:G80 PCONTROL misc clock control
0xd000 NV17:NV20,NV30:G80 PTV TV encoder
0xe000 NV17:NV20 UNK00E000 ???
0xf000 NV41:G80 PVP1 VP1 video vector processor engine
0x88000 NV40:G80 PPCI PCI configuration access window
0x90000 NV40:G80 PFIFO_CACHE PFIFO cache data
0xa0000 all PRMFB VGA memory window access
0xc0000 NV3:NV40 PRMVIO VGA sequencer & graph controller registers
0xc0000+i*0x2000 (i<2) NV40:G80 PRMVIO[i] VGA sequencer & graph controller registers
0x100000 NV3:NV10 PFB memory interface
0x100000 NV10:NV40&!IGP1X PFB memory interface
0x100000 NV40:G80&!TC PFB memory interface & PCIE GART
0x100000 NV44:G80&TC PFB memory interface & PCIE GART
0x101000 !NV1A PSTRAPS straps readout
0x102000 MCP73 UNK102000 ???
0x110000 NV3:NV4 PROM ROM access window
0x120000 NV3:NV4 PALT external memory access window
0x200000 !IGP4X PMEDIA mediaport
0x300000 NV4:NV17,NV20:NV25 PROM ROM access window
0x300000 NV17:NV20,NV25:G80&!IGP4X PROM ROM access window
0x400000 NV3:NV4 PGRAPH 2d/3d graphics engine
0x400000 NV4:NV10 PGRAPH 2d/3d graphics engine
0x400000 NV10:NV20 PGRAPH 2d/3d graphics engine
0x400000 NV20:NV40 PGRAPH 2d/3d graphics engine
0x400000 NV40:G80 PGRAPH 2d/3d graphics engine
0x401000 NV3:NV4 PDMA system memory DMA engine
0x600000 NV4:NV11,NV20:NV25 PCRTC CRTC controls
0x600000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PCRTC[i] CRTC controls
0x601000 NV3:NV11,NV20:NV25 PRMCIO VGA CRTC & attribute controller registers
0x601000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRMCIO[i] VGA CRTC & attribute controller registers
0x680000 NV3:NV11,NV20:NV25 PRAMDAC RAMDAC, video overlay, cursor, and PLL control
0x680000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRAMDAC[i] RAMDAC, video overlay, cursor, and PLL control
0x681000 NV3:NV11,NV20:NV25 PRMDIO VGA DAC registers
0x681000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRMDIO[i] VGA DAC registers
0x6e0000 NV17:NV40 UNK6E0000 ???
0x700000 NV4:G80 PRAMIN RAMIN access
0x800000+chid*0x10000+subc*0x2000 (chid<128, subc<8) NV3:NV4 USER[chid][subc] PFIFO MMIO submission area
0x800000+chid*0x10000+subc*0x2000 (chid<16, subc<8) NV4:NV10 USER[chid][subc] PFIFO MMIO/DMA submission area
0x800000+chid*0x10000+subc*0x2000 (chid<32, subc<8) NV10:G80 USER[chid][subc] PFIFO MMIO/DMA submission area
0xc00000+chid*0x1000 (chid<512) NV40:G80 DMA_USER[chid] PFIFO DMA submission area

G80:GF100 MMIO map

8-bit space g80-mmio [0x1000000]

Todo

10f000:112000 range on GT215-

Address Variants Name Description
0x0 all PMC card master control
0x1000 all PBUS bus control
0x2000 all PFIFO DMA FIFO submission to engines
0x4000 G80:GT215 PCLOCK PLL control
0x4000 GT215:GF100 PCLOCK PLL control
0x7000 all PRMA real mode BAR access
0x9000 all PTIMER time measurement and time-based alarms
0xa000 all PCOUNTER performance monitoring counters
0xb000 VP1,VP2 PVPE MPEG decoding/encoding engine
0xc000 G80:GT215 PCONTROL misc clock control
0xc000 GT215:GF100 PCONTROL misc clock control
0xe000 all PNVIO GPIOs, I2C buses, PWM fan control, and other external devices
0xe800 G80:GT215 PIOCLOCK I/O PLL control
0xe800 GT215:GF100 PIOCLOCK I/O PLL control
0xf000 VP1 PVP1 VP1 video vector processor engine
0xf000 VP2 PVP2 VP2 xtensa video processing engine
0x10000 all UNK010000 ???
0x20000 all PTHERM thermal sensor
0x21000 all PFUSE efuses storing GPU options
0x22000 G84: UNK022000 ???
0x60000 G84: PEEPHOLE indirect VM access
0x70000 G84:GF100 PFLUSH used to flush BAR writes
0x80000 G92:GF100 PHWSQ extended HWSQ code space
0x84000 VP3,VP4 PVLD VP3 variable length decoding engine
0x85000 VP3,VP4 PPDEC VP3 picture decoding engine
0x86000 VP3,VP4 PPPP VP3 video postprocessing engine
0x87000 VP3,GM107: PSEC VP3 cryptographic engine
0x88000 all PPCI PCI configuration access window
0x89000 G84: UNK089000 ???
0x8a000 GT215:GF100 PPCI_HDA HDA codec PCI configuration access window
0x90000 all PFIFO_CACHE PFIFO cache data
0xa0000 all PRMFB VGA memory window access
0x100000 all PFB memory interface & VM control
0x101000 all PSTRAPS straps readout
0x102000 VP2 PCIPHER VP2 cryptography engine
0x102000 IGP UNK102000 ???
0x103000 VP2 PBSP VP2 xtensa bitstream processing engine
0x104000 GT215:GF100 PCOPY memory copy engine
0x108000 GT215: PCODEC HDA codec for HDMI audio
0x109000 GT215: PKFUSE efuses storing secret key stuff
0x10a000 GT215:GF100 PDAEMON card management engine
0x1c1000 MCP89:GF100 PVCOMP video compositor engine
0x200000 all PMEDIA mediaport
0x280000 MCP89 UNK280000 ???
0x2ff000 IGP PBRIDGE_PCI access to PCI config registers of the GPU’s upstream PCIE bridge
0x300000 G80:G200 PROM ROM access window
0x300000 G200: PROM ROM access window
0x400000 all PGRAPH 2d/3d graphics and compute engine
0x601000 all PRMIO VGA registers
0x610000 all PDISPLAY unified display engine
0x700000 all PMEM indirect VRAM/host memory access
0x800000 all PIO_USER[subc:8] PFIFO MMIO submission area
0xc00000 all DMA_USER[chid:0x80] PFIFO DMA submission area

GF100+ MMIO map

8-bit space gf100-mmio [0x1000000]

Todo

verified accurate for GK104, check on earlier cards

Todo

did they finally kill off PMEDIA?

Address Variants Name Description
0x0 all PMC card master control
0x1000 all PBUS bus control
0x2000 all PFIFO DMA FIFO submission to engines
0x5000 all PFIFO_PIO PFIFO PIO submission
0x7000 all PRMA real mode BAR access
0x9000 all PTIMER time measurement and time-based alarms
0xc800 all UNK00C800 ???
0xcc00 all UNK00CC00 ???
0xd000 GF119: PGPIO GPIOs and I2C buses
0xe000 all PNVIO GPIOs, I2C buses, PWM fan control, and other external devices
0xe800 all PIOCLOCK I/O clock control
0x10000 all UNK010000 ???
0x20000 all PTHERM thermal sensor
0x21000 all PFUSE efuses storing GPU options
0x22400 all PUNITS control over enabled card units
0x40000 all PSPOON[3] PFIFO’s DMA submission engine
0x60000 all PEEPHOLE indirect VM access
0x70000 all PFLUSH used to flush BAR writes
0x82000 all UNK082000 ???
0x82800 GF100:GK104 UNK082800 ???
0x84000 GF100:GM107 PVLD VP3 variable length decoding engine
0x84000 GM107: PVDEC VP6 video decoding engine
0x85000 GF100:GM107 PPDEC VP3 picture decoding engine
0x86000 GF100:GM107 PPPP VP3 video postprocessing engine
0x88000 all PPCI PCI configuration access window
0x89000 GF100:GK104 UNK089000 ???
0x8a000 all PPCI_HDA HDA codec PCI configuration access window
0x8b000 GK104: UNK08B000 ???
0xa0000 all PRMFB VGA memory window access
0x100700 all PBFB_COMMON some regs shared between PBFBs???
0x100800 all PFFB front memory interface and VM control
0x101000 all PSTRAPS straps readout
0x104000+i*0x1000 (i<2) GF100:GK104 PCOPY[i] memory copy engine
0x104000+i*0x1000 (i<3) GK104: PCOPY[i] memory copy engine
0x108000 all PCODEC HDA codec for HDMI audio
0x109000 all PKFUSE efuses storing secret key stuff
0x10a000 all PDAEMON card management engine
0x10c000 all UNK10C000 ???
0x10f000 all PBFB memory controller backends
0x120000 all PRING card internal bus
0x130000 all PCLOCK clock control
0x138000 all UNK138000 ???
0x139000 all PP2P peer to peer memory access
0x13b000 all PXBAR crossbar between memory controllers and GPCs
0x140000 all PMFB middle memory controllers: compression and L2 cache
0x180000 all PCOUNTER performance monitoring counters
0x1c0000 all PFIFO_UNK1C0000 PFIFO ???
0x1c2000 GK104:GM107 PVENC H.264 video encoding engine
0x1c3000 GF119: PUNK1C3 ???
0x1c8000 GM107: PVENC H.264 video encoding engine
0x200000 all PMEDIA mediaport
0x300000 all PROM ROM access window
0x400000 all PGRAPH 2d/3d graphics and compute engine
0x601000 all PRMIO VGA registers
0x610000 GF100:GF119 PDISPLAY unified display engine
0x610000 GF119: PDISPLAY unified display engine
0x700000 all PMEM indirect VRAM/host memory access
0x800000 GK104: PFIFO_CHAN PFIFO channel table

GF119 MMIO errors

  • ROOT errors:

    • bad001XX: nonexistent register [gives PBUS intr 3]
    • bad0acXX: VM fault when accessing memory
    • bad0daXX: disabled in PMC.ENABLE or PMC.SUBFIFO_ENABLE [gives PBUS intr 1]
    • bad0fbXX: problem accessing memory [gives PBUS intr 7 or maybe 5]

    The low 8 bits appear to be some sort of request id.

  • PRING errors [all give PBUS intr 2 if accessed via ROOT]:

    • badf1000: target refused transaction
    • badf1100: no target for given address
    • badf1200: target disabled in PMC.ENABLE
    • badf1300: target disabled in PRING
  • badf3000: access to GPC/PART targets before initialising them?

  • badf5000: ??? seen on accesses to PRING own areas and some PCOUNTER regs

Unknown ranges

8-bit space nv3-unk004000 [0x1000]
nv3-mmio 0x4000: UNK004000 [NV3:NV4]

Todo

RE me

8-bit space nv4-unk005000 [0x1000]
nv3-mmio 0x5000: UNK005000 [NV4:NV40,IGP4X]

rules.xml says HOST_DIAG

Todo

RE me

8-bit space unk006000 [0x1000]
nv3-mmio 0x6000: UNK006000 [NV20:NV34]

Reads as all 0xdeadbeef

Todo

RE me

8-bit space unk00e000 [0x1000]
nv3-mmio 0xe000: UNK00E000 [NV17:NV20]

Reads cause device hang

Todo

RE me

8-bit space unk6e0000 [0x1000]
nv3-mmio 0x6e0000: UNK6E0000 [NV17:NV40]

rules.xml says PREMAP

Todo

RE me

8-bit space nv34-unk004000 [0x1000]
nv3-mmio 0x4000: UNK004000 [NV34:NV40]

Todo

RE me

8-bit space c51-unk102000 [0x1000]
nv3-mmio 0x102000: UNK102000 [MCP73]

Todo

RE me

8-bit space unk010000 [0x10000]
g80-mmio 0x10000: UNK010000
gf100-mmio 0x10000: UNK010000

Has something to do with PCI config spaces of other devices?

Todo

NV4x? NVCx?

8-bit space unk022000 [0x400]
g80-mmio 0x22000: UNK022000 [G84:]

Todo

RE me

8-bit space unk089000 [0x1000]
g80-mmio 0x89000: UNK089000 [G84:]
gf100-mmio 0x89000: UNK089000 [GF100:GK104]

Todo

RE me

8-bit space unk102000 [0x1000]
g80-mmio 0x102000: UNK102000 [IGP]

Todo

RE me

8-bit space unk280000 [0x20000]
g80-mmio 0x280000: UNK280000 [MCP89]

Todo

RE me

8-bit space unk08b000 [0x4000]
gf100-mmio 0x8b000: UNK08B000 [GK104:]

Seems to be a new version of former 89000 area

Todo

RE me

8-bit space unk00c800 [0x400]
gf100-mmio 0xc800: UNK00C800

Todo

RE me

8-bit space unk00cc00 [0x400]
gf100-mmio 0xcc00: UNK00CC00

Todo

RE me

8-bit space unk082000 [0x400]
gf100-mmio 0x82000: UNK082000

Todo

RE me

8-bit space unk082800 [0x800]
gf100-mmio 0x82800: UNK082800 [GF100:GK104]

Todo

RE me

8-bit space unk10c000 [0x3000]
gf100-mmio 0x10c000: UNK10C000

Todo

RE me

8-bit space unk138000 [0x1000]
gf100-mmio 0x138000: UNK138000

Todo

RE me