PBUS area


PBUS is present on all nvidia cards. In theory, it deals with “bus control”. In practice, it accumulates all sort of junk nobody bothered to create a special area for. It is unaffected by any PMC.ENABLE bits.

MMIO registers

The main PBUS MMIO range is 0x1000:0x2000. It’s present on all cards. In addition to this range, PBUS also owns PEEPHOLE and PHWSQ ranges.

The registers in the PBUS area are:

8-bit space pbus [0x1000]
nv1-mmio 0x1000: PBUS
nv3-mmio 0x1000: PBUS
g80-mmio 0x1000: PBUS
gf100-mmio 0x1000: PBUS



Range Variants Description
0010f0:0010f4 NV11:G80 PWM - PWM generators
001300:001380 NV17:NV20 NV25:GF100 HWSQ - hardware sequencer
001380:001400 NV41:G80 VGA_STACK
001500:001540 ??? DEBUG registers
001540:001550 NV40:GF100 HWUNITS - enabling/disabling optional hardware subunits [see below]
00155c:001578 NV30:G84 PEEPHOLE - indirect memory access
001578:001580 NV41:GF100 HWSQ - hardware sequencer
001580:0015a0 NV17:NV20 NV25:GF100 CLOCK_GATE - clock gating registers [see below]
0015b0:0015c0 NV43:G80 THERM - thermal sensor
0015f4:001604 NV41:G80 PWM - PWM generators
001700:001800 TC HOST_MEM - host memory access setup
001700:001800 G80:GF100 HOST_MEM - host memory access setup
001700:001800 GF100- HOST_MEM - host memory access setup
001800:001a00 NV1:G80 PCI - PCI configuration space
001900:001980 G80:GF100 REMAP - BAR1 remapping circuitry
001980:001a00 G80:GF100 P2P - G80 P2P slave


loads and loads of unknown registers not shown

Address Variants Name Description
0x84 NV4: DEBUG_1 misc stuff
0x98 NV17:NV20,NV25: DEBUG_6 misc stuff
0x100 NV3: INTR interrupt status/acknowledge
0x104 NV31:G80 INTR_GPIO GPIO interrupt status/acknowledge
0x140 NV3: INTR_ENABLE interrupt enable
0x144 NV31:G80 INTR_GPIO_ENABLE GPIO interrupt enable
0x144 GF100: INTR_ENABLE_NRHOST NRHOST interrupt enable
0x150 G80: INTR_USER0_TRIGGER user interrupt generation
0x154+i*0x4 (i<4) G80: INTR_USER0_SCRATCH[i] user interrupt scratch register
0x170 GF100: INTR_USER1_TRIGGER user interrupt generation
0x174+i*0x4 (i<4) GF100: INTR_USER1_SCRATCH[i] user interrupt scratch register
0x200 NV4:NV10 ROM_TIMINGS ROM timing configuration
0x200 NV10:G80 ROM_TIMINGS ROM timing configuration
0x204 NV17:NV20,NV25:G80 ROM_SPI_CTRL SPI ROM direct access
0x400+i*0x4 (i<16) NV17:NV20,NV25:NV41 HWSQ_CODE[i] HWSQ code RAM access
0x400+i*0x4 (i<32) NV41:G80 HWSQ_CODE[i] HWSQ code RAM access
0x400+i*0x4 (i<64) G80:GF100 HWSQ_CODE[i] HWSQ code RAM access
0xa14 GT215:GF100 IBUS_TIMEOUT IBUS timeout length

DEBUG registers

DEBUG registers store misc hardware control bits. They’re mostly unknown, and usually group together unrelated bits. The known bits include:

reg32 pbus-debug-1
pbus 0x84: DEBUG_1 [NV4:]
  • bit 11: FUSE_READOUT_ENABLE - enables reads from fuses in PFUSE [G80:GF100]
  • bit 28: HEADS_TIED - mirrors writes to CRTC/RAMDAC registers on any head to the other head too [NV11:NV20, NV25:G80]
reg32 pbus-debug-6
pbus 0x98: DEBUG_6 [NV17:NV20,NV25:]


document other known stuff




On NV3+, PMC interrupt line 28 is connected to PBUS. On GF100+, there are actually two lines: the normal line and the NRHOST line [see Interrupts for a description of them]. PBUS has many subinterrupts. The PBUS->PMC interrupt line is active when any PBUS interrupt is both active [the bit in INTR or INTR_GPIO is 1] and enabled [the bit in INTR_EN or INTR_GPIO_EN is 1]. The NRHOST PBUS->PMC interrupt line is active when any PBUS interrupt is both active and enabled for NRHOST [the bit in INTR_EN_NRHOST is 1].

Most PBUS interrupts are reported via INTR register and enabled via INTR_EN and INTR_EN_NRHOST registers:

reg32 pbus-intr
pbus 0x100: INTR [NV3:]

Writing the INTR register clears interrupts that correspond to bits that are set in the written value.

reg32 pbus-intr-enable
pbus 0x140: INTR_ENABLE [NV3:]

Same bitfields as in INTR.

reg32 pbus-intr-enable-nrhost
pbus 0x144: INTR_ENABLE_NRHOST [GF100:]

Same bitfields as in INTR, except USER1 is not present.

On NV40:G80 GPUs, the PBUS additionally deals with GPIO change interrupts, which are reported via INTR_GPIO register and enabled via INTR_GPIO_EN register. These registers effectively function as extra bits to INTR and INTR_EN. For description of these registrers and GPIO interupts, see Interrupts.

User interrupts

G80+ PBUS has one [G80:GF100] or two [GF100-] user-triggerable interupts. These interrupts are triggered by writing any value to a trigger register:

reg32 pbus-intr-user-trigger
pbus 0x150: INTR_USER0_TRIGGER [G80:]
pbus 0x170: INTR_USER1_TRIGGER [GF100:]

Writing any value triggers the USERx interrupt. This register is write-only.

There are also 4 scratch registers per interrupt provided for software use. The hardware doesn’t use their contents for anything:

reg32 pbus-intr-user-scratch
pbus 0x154+i*0x4: INTR_USER0_SCRATCH[i] (i<4) [G80:]
pbus 0x174+i*0x4: INTR_USER1_SCRATCH[i] (i<4) [GF100:]

32-bit scratch registers for USERx interrupt.

GT215 IBUS timeout


description, maybe move somewhere else

On GT215:GF100, the IBUS timeout is controlled by:

reg32 pbus-ibus-timeout
pbus 0xa14: IBUS_TIMEOUT [GT215:GF100]

Specifies how many host cycles to wait for response on MMIO accesses forwarded to the IBUS.


verify that it’s host cycles

Reads that time out return a value of 0. Note that using too long timeout value will result in PCIE master timeouts instead, with possibly quite bad consequences. An IBUS timeout will cause the MMIO_FAULT interrupt to be lit.