It seems to not want to parse Quadro K3000M, K4000M, and K5000M BIOSes. Am I doing something wrong, or are Kepler cards not supported by nvbios?

Source code is

fread(buffer, 1, sizeof(buffer), file);
return strstr(buffer, "nvidia") == NULL;

OpenCL kernels intercepted from GK110 (GTX 780) running blob 367.27 do not get disassembled by demmt. Quickly grepping through the demmt log reveals opcodes that I expect in the program, but not their human-readable counterpart. In other words, it appears the data is there but demmt doesn't quite know what to do with it.

Trace from a GK106 or GK107 (not sure) using the same set-up is decoded and disassembled fine. If you need a trace file for tests, please ping me on IRC.

When compiling envytools in Slackware it fails to find the python3 module since the pkg-config file is called python-3.5 not python3.

-- Checking for module 'python3'
--   No package 'python3' found
-- Looking for pthread.h
-- Looking for pthread.h - found
-- Looking for pthread_create
-- Looking for pthread_create - not found
-- Looking for pthread_create in pthreads
-- Looking for pthread_create in pthreads - not found
-- Looking for pthread_create in pthread
-- Looking for pthread_create in pthread - found
-- Found Threads: TRUE  
Warning: nvapy won't be built because of un-met dependencies (python and cython)

So I traced the issue to nva/CMakeLists.txt where there is this line, pkg_check_modules(PC_PYTHON python3) and found that I could work around it with sed -i 's/python3/python-3.5/' nva/CMakeLists.txt.

I would appreciate if a sed was not necessary though.

I'm using the python variant of the lookup tool:

[fox@x230 rnn]$ ./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1000 0x3F800000 2>/dev/null
LIGHT_FRONT_AMBIENT[0x0].R => 1.0
[fox@x230 rnn]$ ./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1080 0x3F800000 2>/dev/null
0x1080

as result for the second command (0x1080) I'd have expected LIGHT_FRONT_AMBIENT[0x1].R => 1.0 because (rnndb/graph/nv20_3d.xml):

<doc> Lights. </doc>

<stripe length="8" stride="128">
	<stripe offset="0x1000" name="LIGHT_FRONT_AMBIENT">
		<use-group name="rgb-float"/>
	</stripe>
	<stripe offset="0x100c" name="LIGHT_FRONT_DIFFUSE">
		<use-group name="rgb-float"/>
	</stripe>
	<stripe offset="0x1018" name="LIGHT_FRONT_SPECULAR">
		<use-group name="rgb-float"/>
	</stripe>
</stripe>

The array lookup works fine for length in reg32:

[fox@x230 rnn]$ ./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1040 0x3F800000 2>/dev/null
LIGHT_SPOT_CUTOFF[0x0][0x0] => 1.0
[fox@x230 rnn]$ ./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1044 0x3F800000 2>/dev/null
LIGHT_SPOT_CUTOFF[0x0][0x1] => 1.0

Which is:

<reg32 offset="0x1040" name="LIGHT_SPOT_CUTOFF" length="7" type="float"/>

I'd expect stripes to be tricky in case of ambiguity (which shouldn't exist for regs?), but in these cases I don't understand why stripe length does not work.

Is this a design decision, user-error or a bug?

Hello! I am currently trying to research and edit shaders for the nintendo switch, which uses shader gm107, and the one thing I cannot seem to find any documentation for, is the scheduling instructions. I know that they occur every 32 bytes, or every 3 instructions, and the output contains something for each of the 3 instructions, but that's about all I can gather.

Clearer documentation would be appreciated.

Thanks!

rnn allows a forward lookup of the name from registers:

./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1D94 0x000000F0 2>/dev/null
CLEAR_BUFFERS => { COLOR_A | COLOR_B | COLOR_G | COLOR_R }

However, I'd like to do a lookup in the other direction like this:

./reverse_lookup.py -d SUBCHAN -v obj-class NV20_3D "CLEAR_BUFFERS" 2>/dev/null
0x1D94

Or possibly even:

./reverse_lookup.py -d SUBCHAN -v obj-class NV20_3D "CLEAR_BUFFERS <= { COLOR_A | COLOR_B | COLOR_G | COLOR_R }" 2>/dev/null
0x1D94 0x000000F0

I was wondering if there are tools to do this already (anywhere, possibly not in envytools itself), or if it would be accepted if such tools were made.

See #148 for my motivation.

I am sorry to write here my question, but I don't know where to go. Recently I made a global upgrade for my laptop, I changed geforce gt635m to geforce gtx 950m. I figured out almost everything, video card work properly. Now I bought a new motherboard, which native graphics card-760m. I changed the memory and video chip to 1050 ti (GP107M + K4G8 samsung memory). Naturally, with multiple jumpers, i changed 3.3v to 1.8 and so on. The video card is displayed in the device Manager, reads the video BIOS from the flash memory, controlls my fan. But it refuses to work :))) I cannot flash BIOS, tried to hack nvflash, also it is not possible. It seems that the 2.0 certificate is now verified by the PMU and it cannot be deceived. It is necessary to load BIOS through OPROM because i cant use the programmer to flash each time - it is very difficult. I do not understand, can the error occur due to a certificate mismatch? Nvidia mods throws error - the hardware was not initialized. With 950M this error never occurred. In BIOS there is a line-NVIDIA Certificate Check Skipped. Therefore, it is possible to disable the check. But how? Also on the NVIDIA website says that falcon security mode can be switched to NS - non-secure. But no word on how to do it. I want to disable it too. Help please, I cant figure it out)))) Cant do anything with that. P.S. Why are there no voltage map table and voltage table on new video cards? In BIT Table " P " there are just zeros. I tried to search manually-nothing. How is the voltage regulated now? PWM controllers are all the same now? Or only Video Driver can manage it now?

I was wondering if rnn / rnndb should be distributed using PyPI or at least contain a setup.py for setuptools (so it could be installed via pip install git+https://github.com/envytools/envytools.git#egg=rnn&subdirectory=rnn).

Motivation

I'm working on XQEMU (original Xbox emulator based on QEMU) and XboxDev tools. The original Xbox included the NV2A GPU.

We have envy-tools like tools such as https://github.com/XboxDev/nv2a-trace which allows us to trace FIFO and re-inject the FIFO later (which run via network almost on bare-metal).

[
  {
    "comment": "Set the clear color to pink",
    "method": "0x1D90",
    "subchannel": "0x0",
    "non_increasing": false,
    "data": [
      "0x00FF00FF"
    ]
  },
  {
    "comment": "Clears the image",
    "method": "0x1D94",
    "subchannel": "0x0",
    "non_increasing": false,
    "data": [
      "0x000000F0"
    ]
  },
  {
    "comment": "This one is meant as a no-op. It's only used for dumping the image",
    "method": "0x1D94",
    "subchannel": "0x0",
    "non_increasing": false,
    "data": [
      "0x00000000"
    ]
  }
]

If we had (an enhanced) rnn this could possibly look like this (mockup only):

[
  {
    "comment": "Set the clear color to pink", 
    "method": "CLEAR_VALUE",
    "data": ["0x00FF00FF"]
  },
  {
    "comment": "Clears the image",
    "method": "CLEAR_BUFFERS", 
    "data": [{
      "COLOR_A": true,
      "COLOR_R": true,
      "COLOR_G": true,
      "COLOR_B": true
    }]
  },
  {
    "comment": "This one is meant as a no-op. It's only used for dumping the image",
    "method": "CLEAR_BUFFERS", 
    "data": [0]
  }
]

However, rnn / rnndb is currently not easy to install so we could only submodule it, which makes it harder to update. I'd rather avoid duplicating work already done in rnn / rnndb too.

Other tools in rnn like lookup.py are also useful for our workflow:

[fox@x230 rnn]$ RNN_PATH=`pwd`/../rnndb:`pwd`/../rnndb-generated/ ./lookup.py -d SUBCHAN -v obj-class NV20_3D 0x1D94 0x000000F0 2>/dev/null
CLEAR_BUFFERS => { COLOR_A | COLOR_B | COLOR_G | COLOR_R }

So having an easy option to install them would be beneficial.

There's also a GTX 750 with GM206 chip - https://www.techpowerup.com/gpudb/2778/geforce-gtx-750-v2

Hello!

I am trying to read VRAM size from the hardware (like from the configuration in BAR0), but I found nothing about this in the online envytools documentation. Is there a way to read VRAM size from the GPU ?

Thank you
Timothy Madden

WIP bash version: https://github.com/karolherbst/nouveau_tools/blob/master/dbg_falcon.sh

vbios.zip
I have a GM204 (nvidia 970M on a MSI laptop).
Attached the original vbios and the one extracted with ./nvagetbios -s PROM
And a question:
do these tools allow to modify vbios in memory without flashing?
I wish to fiddle with some internal parameters but not in a permanent way.

I've managed to get the nvbios target to compile with cmake extension in visual studio 2017 15.7.1.
But I started getting missing definitions for envy_bios_parse_D_unk2 envy_bios_print_bit_D envy_bios_parse_bit_D ... And then I realized that there is both a d.c and a D.c which conflicts since windows isn't case sensitive..

I know this is probably not designed to run on windows but it mostly works for these offline utilities and is helpful. Perhaps these files could be named less ambiguously for the future? (I think I can just rename them myself but would have to find all instances)
right now i renamed d.c to dp.c and left D.c as D.c thus changing the line in nvbios\cmakelists.txt to D.c L.c T.c dp.c p.c from D.c L.c T.c d.c p.c

also the line in p.c where &p->unk0.offset is commented out, the compiler complains that the initializer is empty, and it looks like it's being used based on the version it detects so i just made it the same as if it's == 2

	struct p_known_tables p1_tbls[] = {
		{ 0x00, &p->falcon_ucode.offset, "UNKNWN UCODE" },
		 /* { 0x00, &p->unk0.offset, "UNKNOWN" }, */
	};
	struct p_known_tables p2_tbls[] = {
		{ 0x00, &p->falcon_ucode.offset, "FALCON UCODE" },
	};

It could successfully compile after manually downloading windows versions of

win_flex_bison
pkg-config-lite-0.28-1
libxml2-2.9.5.win64
libiconv
unistd.h getopt.c getopt.h windows ports

https://github.com/lexxmark/winflexbison/releases
https://sourceforge.net/projects/pkgconfiglite/files/0.28-1/
https://github.com/mhils/libxml2-win-binaries/releases
https://github.com/pffang/libiconv-for-Windows
https://gist.github.com/ashelly/7776712
https://gist.github.com/mbikovitsky/39224cf521bfea7eabe9

put the getopt.c alongside nvbios.c similarly unistd.h and getopt.h in envytool includes
modified to VS generated cmakesettings.json to tell cmake to look for dependencies in a project subdirectory called CMAKEModuleDependencies

{
  // See https://go.microsoft.com//fwlink//?linkid=834763 for more information about this file.
  "configurations": [
    {
      "name": "x86-Debug",
      "generator": "Ninja",
      "configurationType": "Debug",
      "inheritEnvironments": [ "msvc_x86" ],
      "buildRoot": "${projectDir}\\CMakeBuilds\\build\\${name}",
      "installRoot": "${projectDir}\\CMakeBuilds\\install\\${name}",
      "cmakeCommandArgs": "-DCMAKE_PROGRAM_PATH=${projectDir}\\CMAKEModuleDependencies\\win_flex_bison-latest;${projectDir}\\CMAKEModuleDependencies\\pkg-config-lite-0.28-1\\bin; -DCMAKE_LIBRARY_PATH=${projectDir}\\CMAKEModuleDependencies\\libxml2-2.9.5.win64\\lib\\ -DLIBXML2_INCLUDE_DIR=${projectDir}\\CMAKEModuleDependencies\\libxml2-2.9.5.win64\\include; -DLIBICONV_INCLUDE_DIR=${projectDir}\\CMAKEModuleDependencies\\libiconv-for-Windows-master\\include",
      "buildCommandArgs": "-v",
      "ctestCommandArgs": ""
    }
]
}

as of visual studio 2017 15.7.1 there's a bug that causes cmake to spew out this error stack trace when VS tries to process the cmakelists
work around is to add

#workaround for VS 2017 15.7.1 cmake bug
add_definitions(-DFOO)

microsoft/VSLinux#288

1> Object reference not set to an instance of an object.
   at libcmake.CMakeTargetBase`1.SetTargetInfoAndSources[BacktraceProtocol](CMakeTargetJsonProtocol`1 info, CMakeProjectJsonProtocol`1 project, DebugTargetType DebugTargetType, IDictionary`2 traceDictionary)
   at libcmake.CMakeProject.GenerateTarget[BacktraceProtocol](CMakeTargetJsonProtocol`1 tgt, CMakeProjectJsonProtocol`1 curProject, DebugTargetType targetType, IDictionary`2 traceMap)
   at libcmake.CMakeProjectBase`3.UpdateListOfTargets[BacktraceProtocol](CMakeProjectJsonProtocol`1 curProject, Dictionary`2 pathToTargetMap, IDictionary`2 traceMap)
   at libcmake.CMakeProjectBase`3.<ExtractInfoGeneric>d__94`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at libcmake.CMakeLists.<ExtractInfo>d__114.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at libcmake.CMakeLists.<ParseWithoutCacheAsync>d__113.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.CMake.Project.CMakeListsUtils.<ParseAsync>d__20.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at Microsoft.VisualStudio.CMake.Project.CMakeListsCache.<ParseAsync>d__28.MoveNext()

Had to modify bios.h to use variadic macro syntax for visual studio compiler
from

#define ENVY_BIOS_ERR(fmt, arg...) fprintf(stderr, fmt, ##arg)
#define ENVY_BIOS_WARN(fmt, arg...) fprintf(stderr, fmt, ##arg)

to

#define ENVY_BIOS_ERR(fmt, ...) fprintf(stderr, fmt, __VA_ARGS__)
#define ENVY_BIOS_WARN(fmt, ...) fprintf(stderr, fmt, __VA_ARGS__)

some description and so

I can't read or change the assignments for GPIO pins. I need to switch the mode from PWM to VID0-VID5, but nvbios does not read them correctly. GTX 950 m n 16 p-gt-a2 chip. And will there be a program to edit these values? I don't know how, where and what to change) Wanted to insert table from another BIOS.
gx950m.zip
GPIO table at 0x5239 version 4.1 GPIO 9: line 9 tag 0x49 [THERM_ALERT_OUT] IN NEG DEF 0 gpio: normal SPEC_IN 0x15 [THERMAL_ALERT] GPIO 11: line 11 tag 0x81 [VID_PWM0] OUT DEF 0 param 1 gpio: normal SPEC_OUT 0x5d [PWM_1] GPIO 12: line 12 tag 0x6f [HW_PWR_SLOWDOWN] IN NEG DEF 0 gpio: normal GPIO 13: line 13 tag 0x7a [ATX_FORCE_LOW_PWR] OUT NEG DEF 0 gpio: normal
Should be:
0 - GC6_FB_EN
5 3v3_MAIN_EN
6 FB_CLAMP_REQ#
8 VGA_THERM#_R
9 ALERT#
10 FBREF_SEL
11 PWM_VID
12 DGPU_PD#
13 NVDD_PSI
16 FRM_CLK
21 GPU_PEX_RST_HOLD#
parsed.zip
Parsed bios

Hello,

I wanted to ask if the MMIO map of GT 710 is the same with any of previous documented gpus. If not, is there any relevant work that you know about the specific topic and if so please can you provide any links. In worst case scenario, that i need to reverse engineer it can you please provide any advise or helpful links to make my job easier.

Thanks in advance

Having the content of the doc field can be informative when one is manually looking up a register.
It could be a --doc flag or a --no-doc flag.

Hello, I'm currently looking into using the nva tools, specifically nvatiming, nvafucstart and nvagetpmu. I have the proprietary NVIDIA driver running on my machine since the README states that it is a requirement for nvagetpmu. But for some reason, whatever tool I invoke, it opts out at PCI initialization with the following error message:

❯ sudo nvalist
WARN: Can't probe 0000:26:00.0
PCI init failure!

Given that warning, I tried to query the device with lspci and that indeed seems to be my GPU.

❯ lspci -vv -s 26:00
26:00.0 VGA compatible controller: NVIDIA Corporation GP104 [GeForce GTX 1070] (rev a1) (prog-if 00 [VGA controller])
	Subsystem: ASUSTeK Computer Inc. Device 8598
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 72
	IOMMU group: 15
	Region 0: Memory at f6000000 (32-bit, non-prefetchable) [size=16M]
	Region 1: Memory at e0000000 (64-bit, prefetchable) [size=256M]
	Region 3: Memory at f0000000 (64-bit, prefetchable) [size=32M]
	Region 5: I/O ports at e000 [size=128]
	Expansion ROM at 000c0000 [virtual] [disabled] [size=128K]
	Capabilities: <access denied>
	Kernel driver in use: nvidia
	Kernel modules: nouveau, nvidia_drm, nvidia

System and dependency versions that were used when building latest envytools master (9353a86):

• Arch Linux with Linux kernel 5.7.10
• libpciaccess 0.16
• libx11 1.6.9
• libxext 1.3.4
• Python 3.8.3
• Cython 0.29.20

I had several people reproducing the issue, any help with this would be greatly appreciated. Please let me know if I missed any important details.

this return will never be run.
I think you just forgot it.

I can't seem to use it. I tried to give it inputs in multiple ways.

First, I tried to specify an input file on the command line. Didn't work.

Then, I tried to give it assembly after passing the command, when it gives me a chance to input.

Still no.

Then, I tried to specify an input file after doing the command. That also didn't work.

So, how would I be able to use it?

It would be useful

When I tried to compile, I found that I encountered an error.

Then I moved the header files in the include folder under the project root directory to the nvbios directory,
another error occurred.

The following is my kernel information. I would be very grateful if you could help me

Thanks a lot!