MMIO register ranges¶
Contents
Introduction¶
Todo
write me
NV1 MMIO map¶
-
8-bit space
nv1-mmio
[0x2000000]
¶ Address Name Description 0x0 PMC card master control 0x1000 PBUS bus control 0x2000 PFIFO MMIO-mapped FIFO submission to PGRAPH 0x100000 PDMA system memory DMA engine 0x101000 PTIMER time measurement and time-based alarms 0x300000 PAUDIO audio capture and playback device 0x400000 PGRAPH accelerated drawing engine 0x410000 UBETA BETA object 0x420000 UROP ROP object 0x430000 UCHROMA CHROMA object 0x440000 UPLANE PLANE object 0x450000 UCLIP CLIP object 0x460000 UPATTERN PATTERN object 0x480000 UPOINT POINT object 0x490000 ULINE LINE object 0x4a0000 ULIN LIN object 0x4b0000 UTRI TRI object 0x4c0000 URECT RECT object 0x4d0000 UTEXLIN TEXLIN object 0x4e0000 UTEXQUAD TEXQUAD object 0x500000 UBLIT BLIT object 0x510000 UIFC IFC object 0x520000 UBITMAP BITMAP object 0x530000 UIFM IFM object 0x540000 UITM ITM object 0x5d0000 UTEXLINBETA TEXLINBETA object 0x5e0000 UTEXQUADBETA TEXQUADBETA object 0x600000 PFB VRAM and video output control 0x602000 PRAM RAMIN layout control 0x604000 PRAMAU RAMAU access 0x605000 PCHIPID chip ID readout 0x606000 PRAMUNK2 UNK2 access 0x608000 PSTRAPS straps readout 0x609000 PDAC DAC control 0x60a000 PEEPROM configuration EEPROM access 0x610000 PROM ROM access window 0x618000 PALT external memory access window 0x640000 PRAMHT RAMHT access 0x648000 PRAMFC RAMFC access 0x650000 PRAMRO RAMRO access 0x6c0000 PRM VGA and ISA sound emulation 0x6d0000 PRMIO VGA and ISA sound compat IO port access 0x6e0000 PRMFB VGA memory window access 0x700000 PRAMIN RAMIN access 0x800000+chid*0x10000+subc*0x2000 (chid<128, subc<8) USER[chid][subc] PFIFO MMIO submission area 0x1000000 FB VRAM access area
NV3:G80 MMIO map¶
-
8-bit space
nv3-mmio
[0x1000000]
¶ Todo
check UNK005000 variants [sorta present on NV35, NV34, C51, MCP73; present on NV5, NV11, NV17, NV1A, NV20; not present on NV44]
Todo
check PCOUNTER variants
Todo
some IGP don’t have PVPE/PVP1 [C51: present, but without PME; MCP73: not present at all]
Todo
check PSTRAPS on IGPs
Todo
check PROM on IGPs
Todo
PMEDIA not on IGPs [MCP73 and C51: not present] and some other cards?
Todo
PFB not on IGPs
Todo
merge PCRTC+PRMCIO/PRAMDAC+PRMDIO?
Todo
UNK6E0000 variants
Todo
UNK006000 variants
Todo
UNK00E000 variants
Todo
102000 variants; present on MCP73, not C51
Note
fully verified on NV3, NV5, NV11, NV17, NV34, NV35, NV44, C51, MCP73
Note
NV1A and NV20 don’t have second PCRTC/PRAMDAC, but still have the decoding circuitry for them. This may cause the card to hang when accessing these ranges. The same applies for NV2x and PVPE.
Address Variants Name Description 0x0 all PMC card master control 0x1000 all PBUS bus control 0x2000 NV3:NV4 PFIFO MMIO-mapped FIFO submission to PGRAPH 0x2000 NV4:G80 PFIFO MMIO and DMA FIFO submission to PGRAPH and PVPE 0x4000 NV3:NV4 UNK004000 ??? 0x4000 NV34:NV40 UNK004000 ??? 0x4000 NV40:G80 PCLOCK PLL control 0x5000 NV4:NV40,IGP4X UNK005000 ??? 0x6000 NV20:NV34 UNK006000 ??? 0x7000 all PRMA real mode BAR access 0x8000 NV10:G80 PVIDEO video overlay 0x9000 all PTIMER time measurement and time-based alarms 0xa000 NV10:NV40 PCOUNTER performance monitoring counters 0xa000 NV40:G80 PCOUNTER performance monitoring counters 0xb000 NV17:NV20,NV30:G80 PVPE MPEG decoding/encoding engine 0xc000 NV40:G80 PCONTROL misc clock control 0xd000 NV17:NV20,NV30:G80 PTV TV encoder 0xe000 NV17:NV20 UNK00E000 ??? 0xf000 NV41:G80 PVP1 VP1 video vector processor engine 0x88000 NV40:G80 PPCI PCI configuration access window 0x90000 NV40:G80 PFIFO_CACHE PFIFO cache data 0xa0000 all PRMFB VGA memory window access 0xc0000 NV3:NV40 PRMVIO VGA sequencer & graph controller registers 0xc0000+i*0x2000 (i<2) NV40:G80 PRMVIO[i] VGA sequencer & graph controller registers 0x100000 NV3:NV10 PFB memory interface 0x100000 NV10:NV40&!IGP1X PFB memory interface 0x100000 NV40:G80&!TC PFB memory interface & PCIE GART 0x100000 NV44:G80&TC PFB memory interface & PCIE GART 0x101000 !NV1A PSTRAPS straps readout 0x102000 MCP73 UNK102000 ??? 0x110000 NV3:NV4 PROM ROM access window 0x120000 NV3:NV4 PALT external memory access window 0x200000 !IGP4X PMEDIA mediaport 0x300000 NV4:NV17,NV20:NV25 PROM ROM access window 0x300000 NV17:NV20,NV25:G80&!IGP4X PROM ROM access window 0x400000 NV3:NV4 PGRAPH 2d/3d graphics engine 0x400000 NV4:NV10 PGRAPH 2d/3d graphics engine 0x400000 NV10:NV20 PGRAPH 2d/3d graphics engine 0x400000 NV20:NV40 PGRAPH 2d/3d graphics engine 0x400000 NV40:G80 PGRAPH 2d/3d graphics engine 0x401000 NV3:NV4 PDMA system memory DMA engine 0x600000 NV4:NV11,NV20:NV25 PCRTC CRTC controls 0x600000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PCRTC[i] CRTC controls 0x601000 NV3:NV11,NV20:NV25 PRMCIO VGA CRTC & attribute controller registers 0x601000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRMCIO[i] VGA CRTC & attribute controller registers 0x680000 NV3:NV11,NV20:NV25 PRAMDAC RAMDAC, video overlay, cursor, and PLL control 0x680000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRAMDAC[i] RAMDAC, video overlay, cursor, and PLL control 0x681000 NV3:NV11,NV20:NV25 PRMDIO VGA DAC registers 0x681000+i*0x2000 (i<2) NV11:NV20,NV25:G80 PRMDIO[i] VGA DAC registers 0x6e0000 NV17:NV40 UNK6E0000 ??? 0x700000 NV4:G80 PRAMIN RAMIN access 0x800000+chid*0x10000+subc*0x2000 (chid<128, subc<8) NV3:NV4 USER[chid][subc] PFIFO MMIO submission area 0x800000+chid*0x10000+subc*0x2000 (chid<16, subc<8) NV4:NV10 USER[chid][subc] PFIFO MMIO/DMA submission area 0x800000+chid*0x10000+subc*0x2000 (chid<32, subc<8) NV10:G80 USER[chid][subc] PFIFO MMIO/DMA submission area 0xc00000+chid*0x1000 (chid<512) NV40:G80 DMA_USER[chid] PFIFO DMA submission area
G80:GF100 MMIO map¶
-
8-bit space
g80-mmio
[0x1000000]
¶ Todo
10f000:112000 range on GT215-
Address Variants Name Description 0x0 all PMC card master control 0x1000 all PBUS bus control 0x2000 all PFIFO DMA FIFO submission to engines 0x4000 G80:GT215 PCLOCK PLL control 0x4000 GT215:GF100 PCLOCK PLL control 0x7000 all PRMA real mode BAR access 0x9000 all PTIMER time measurement and time-based alarms 0xa000 all PCOUNTER performance monitoring counters 0xb000 VP1,VP2 PVPE MPEG decoding/encoding engine 0xc000 G80:GT215 PCONTROL misc clock control 0xc000 GT215:GF100 PCONTROL misc clock control 0xe000 all PNVIO GPIOs, I2C buses, PWM fan control, and other external devices 0xe800 G80:GT215 PIOCLOCK I/O PLL control 0xe800 GT215:GF100 PIOCLOCK I/O PLL control 0xf000 VP1 PVP1 VP1 video vector processor engine 0xf000 VP2 PVP2 VP2 xtensa video processing engine 0x10000 all UNK010000 ??? 0x20000 all PTHERM thermal sensor 0x21000 all PFUSE efuses storing GPU options 0x22000 G84: UNK022000 ??? 0x60000 G84: PEEPHOLE indirect VM access 0x70000 G84:GF100 PFLUSH used to flush BAR writes 0x80000 G92:GF100 PHWSQ extended HWSQ code space 0x84000 VP3,VP4 PVLD VP3 variable length decoding engine 0x85000 VP3,VP4 PPDEC VP3 picture decoding engine 0x86000 VP3,VP4 PPPP VP3 video postprocessing engine 0x87000 VP3,GM107: PSEC VP3 cryptographic engine 0x88000 all PPCI PCI configuration access window 0x89000 G84: UNK089000 ??? 0x8a000 GT215:GF100 PPCI_HDA HDA codec PCI configuration access window 0x90000 all PFIFO_CACHE PFIFO cache data 0xa0000 all PRMFB VGA memory window access 0x100000 all PFB memory interface & VM control 0x101000 all PSTRAPS straps readout 0x102000 VP2 PCIPHER VP2 cryptography engine 0x102000 IGP UNK102000 ??? 0x103000 VP2 PBSP VP2 xtensa bitstream processing engine 0x104000 GT215:GF100 PCOPY memory copy engine 0x108000 GT215: PCODEC HDA codec for HDMI audio 0x109000 GT215: PKFUSE efuses storing secret key stuff 0x10a000 GT215:GF100 PDAEMON card management engine 0x1c1000 MCP89:GF100 PVCOMP video compositor engine 0x200000 all PMEDIA mediaport 0x280000 MCP89 UNK280000 ??? 0x2ff000 IGP PBRIDGE_PCI access to PCI config registers of the GPU's upstream PCIE bridge 0x300000 G80:G200 PROM ROM access window 0x300000 G200: PROM ROM access window 0x400000 all PGRAPH 2d/3d graphics and compute engine 0x601000 all PRMIO VGA registers 0x610000 all PDISPLAY unified display engine 0x700000 all PMEM indirect VRAM/host memory access 0x800000 all PIO_USER[subc:8] PFIFO MMIO submission area 0xc00000 all DMA_USER[chid:0x80] PFIFO DMA submission area
GF100+ MMIO map¶
-
8-bit space
gf100-mmio
[0x1000000]
¶ Todo
verified accurate for GK104, check on earlier cards
Todo
did they finally kill off PMEDIA?
Address Variants Name Description 0x0 all PMC card master control 0x1000 all PBUS bus control 0x2000 all PFIFO DMA FIFO submission to engines 0x5000 all PFIFO_PIO PFIFO PIO submission 0x7000 all PRMA real mode BAR access 0x9000 all PTIMER time measurement and time-based alarms 0xc800 all UNK00C800 ??? 0xcc00 all UNK00CC00 ??? 0xd000 GF119: PGPIO GPIOs and I2C buses 0xe000 all PNVIO GPIOs, I2C buses, PWM fan control, and other external devices 0xe800 all PIOCLOCK I/O clock control 0x10000 all UNK010000 ??? 0x20000 all PTHERM thermal sensor 0x21000 all PFUSE efuses storing GPU options 0x22400 all PUNITS control over enabled card units 0x40000 all PSPOON[3] PFIFO's DMA submission engine 0x60000 all PEEPHOLE indirect VM access 0x70000 all PFLUSH used to flush BAR writes 0x82000 all UNK082000 ??? 0x82800 GF100:GK104 UNK082800 ??? 0x84000 GF100:GM107 PVLD VP3 variable length decoding engine 0x84000 GM107: PVDEC VP6 video decoding engine 0x85000 GF100:GM107 PPDEC VP3 picture decoding engine 0x86000 GF100:GM107 PPPP VP3 video postprocessing engine 0x88000 all PPCI PCI configuration access window 0x89000 GF100:GK104 UNK089000 ??? 0x8a000 all PPCI_HDA HDA codec PCI configuration access window 0x8b000 GK104: UNK08B000 ??? 0xa0000 all PRMFB VGA memory window access 0x100700 all PBFB_COMMON some regs shared between PBFBs??? 0x100800 all PFFB front memory interface and VM control 0x101000 all PSTRAPS straps readout 0x104000+i*0x1000 (i<2) GF100:GK104 PCOPY[i] memory copy engine 0x104000+i*0x1000 (i<3) GK104: PCOPY[i] memory copy engine 0x108000 all PCODEC HDA codec for HDMI audio 0x109000 all PKFUSE efuses storing secret key stuff 0x10a000 all PDAEMON card management engine 0x10c000 all UNK10C000 ??? 0x10f000 all PBFB memory controller backends 0x120000 all PRING card internal bus 0x130000 all PCLOCK clock control 0x138000 all UNK138000 ??? 0x139000 all PP2P peer to peer memory access 0x13b000 all PXBAR crossbar between memory controllers and GPCs 0x140000 all PMFB middle memory controllers: compression and L2 cache 0x180000 all PCOUNTER performance monitoring counters 0x1c0000 all PFIFO_UNK1C0000 PFIFO ??? 0x1c2000 GK104:GM107 PVENC H.264 video encoding engine 0x1c3000 GF119: PUNK1C3 ??? 0x1c8000 GM107: PVENC H.264 video encoding engine 0x200000 all PMEDIA mediaport 0x300000 all PROM ROM access window 0x400000 all PGRAPH 2d/3d graphics and compute engine 0x601000 all PRMIO VGA registers 0x610000 GF100:GF119 PDISPLAY unified display engine 0x610000 GF119: PDISPLAY unified display engine 0x700000 all PMEM indirect VRAM/host memory access 0x800000 GK104: PFIFO_CHAN PFIFO channel table
GF119 MMIO errors¶
ROOT errors:
- bad001XX: nonexistent register [gives PBUS intr 3]
- bad0acXX: VM fault when accessing memory
- bad0daXX: disabled in PMC.ENABLE or PMC.SUBFIFO_ENABLE [gives PBUS intr 1]
- bad0fbXX: problem accessing memory [gives PBUS intr 7 or maybe 5]
The low 8 bits appear to be some sort of request id.
PRING errors [all give PBUS intr 2 if accessed via ROOT]:
- badf1000: target refused transaction
- badf1100: no target for given address
- badf1200: target disabled in PMC.ENABLE
- badf1300: target disabled in PRING
badf3000: access to GPC/PART targets before initialising them?
badf5000: ??? seen on accesses to PRING own areas and some PCOUNTER regs
Unknown ranges¶
-
8-bit space
nv4-unk005000
[0x1000]
¶ -
nv3-mmio
0x5000: UNK005000
[NV4:NV40,IGP4X] rules.xml says HOST_DIAG
Todo
RE me
-
8-bit space
unk006000
[0x1000]
¶ -
nv3-mmio
0x6000: UNK006000
[NV20:NV34] Reads as all 0xdeadbeef
Todo
RE me
-
8-bit space
unk00e000
[0x1000]
¶ -
nv3-mmio
0xe000: UNK00E000
[NV17:NV20] Reads cause device hang
Todo
RE me
-
8-bit space
unk6e0000
[0x1000]
¶ -
nv3-mmio
0x6e0000: UNK6E0000
[NV17:NV40] rules.xml says PREMAP
Todo
RE me
-
8-bit space
unk010000
[0x10000]
¶ -
g80-mmio
0x10000: UNK010000
-
gf100-mmio
0x10000: UNK010000
Has something to do with PCI config spaces of other devices?
Todo
NV4x? NVCx?
-
8-bit space
unk089000
[0x1000]
¶ -
g80-mmio
0x89000: UNK089000
[G84:] -
gf100-mmio
0x89000: UNK089000
[GF100:GK104] Todo
RE me
-
8-bit space
unk08b000
[0x4000]
¶ -
gf100-mmio
0x8b000: UNK08B000
[GK104:] Seems to be a new version of former 89000 area
Todo
RE me
-
8-bit space
unk00c800
[0x400]
¶ -
gf100-mmio
0xc800: UNK00C800
Todo
RE me
-
8-bit space
unk00cc00
[0x400]
¶ -
gf100-mmio
0xcc00: UNK00CC00
Todo
RE me
-
8-bit space
unk082000
[0x400]
¶ -
gf100-mmio
0x82000: UNK082000
Todo
RE me
-
8-bit space
unk082800
[0x800]
¶ -
gf100-mmio
0x82800: UNK082800
[GF100:GK104] Todo
RE me
-
8-bit space
unk10c000
[0x3000]
¶ -
gf100-mmio
0x10c000: UNK10C000
Todo
RE me
-
8-bit space
unk138000
[0x1000]
¶ -
gf100-mmio
0x138000: UNK138000
Todo
RE me