Martin Peres edited this page Aug 16, 2014 · 53 revisions

Testing Memory Timings

We are currently reverse engineering the memory timings vbios table, but, as you can see, we are a bit fuzzy on how it actually works.

We have managed to make it to work on some selected hardware, but we now want to know if it would work across all of the boards out there.

Not needed anymore! Thanks a lot to everyone who helped!


Here is the requirement list:

  • Have a non-IGP NVC0 -> NVE4 (included) nvidia card, GeForce 4xx or newer. See Nvidia Codenames if you don't know what your card is. The rest of the manual also applies for earlier cards, but for these we have sufficient samples.
  • nvapeek, nvagetbios, nvbios(optional): See the dedicated Tools for the Reverser page.
  • Run the blob, nouveau or nothing, it really shouldn't matter. But if you can, read them from the blob.

Please update nvbios before using it, it is improved on a daily basis.


I will now assume that you have both nvapeek and vbtracetool compiled. If you can't compile either of them, please show up on freenode, #pathscale (if it is a problem with nvapeek, ask mwk) or #nouveau (if it is a vbtracetool problem).

Determine your card type

Just run nvalist to see installed GPUs:

# sudo ./nvalist > card_list && cat card_list
0: 0000:03:00.0 NVA5 0a5000a2
1: 0000:04:00.0 NVC1 0c1080a1
2: 0000:08:07.0 NV03 00030110

In case of a multi-gpu system, you should add "-c " parameter to all following nvapeek commands, to select the card it should operate on.

If your card is NV4C, NV4E, NV67, NV68, NVAA, NVAC, or NVAF, it's an IGP and hence doesn't have memory controller nor memory timings. Otherwise, it has timings and you can make a useful dump.

Dump the VBIOS

Just run:

# ./nvagetbios > nvXX_vbios.rom

If it doesn't work, you may want to try:

# ./nvagetbios -s prom > nvXX_vbios.rom

If the vbios is still empty, please follow the steps of the DumpingVideoBios wiki page.

Get your card's strap

Getting the card's strap is done by peeking at 0x00101000. The strap is an hardwired register that gives some knowledge upon the specific card. It is set by the gpu manufacturer and cannot be extracted from the vbios.

# ./nvapeek 0x00101000 > nvXX_strap_peek

Get the currently selected timings

NV40 to NVC0 (not included)

Getting the current timing is simply done by peeking 32 bytes beginning at the 0x100220:

# ./nvapeek 0x100220 0x30 > nvXX_timing_peek
# ./nvapeek 0x1002c0 0x30 > nvXX_mr_peek

>=NVC0 (AKA Fermi)

Getting the current timing is simply done by peeking 32 bytes beginning at the 0x10f290:

# ./nvapeek 0x10f290 0x30 > nvXX_timing_peek

Wanna help a bit more? (Optional, requires nvbios)

Was it too simple? Well, you can save us some time by looking at the output of nvbios on your bios.

To do so, just execute nvbios this way:

$ ./nvbios nvXX_vbios.rom > nvXX_vbios_parsed

It may issue a warning about a missing strap value. This warning can be safely ignored.

You'll get a really long output and, around the end, you'll find the timing table parsed. Try to find an entry that would correspond to the one you have in nvXX_timing_peek.

Two cases:

  • If you find an exact match, great news, our code works for you. Please notify us on IRC.
  • If you find no correspondence, please send us an email (see below).

Wanna help a LOT more?

Hey, you've already done a great job, but there is one last thing we need to know about your card ... it's how the proprietary driver(blob) uses it!

You can track everything the blob does by following the steps here: Make an mmiotrace

We thank you by advance

Send us a mail

Please send an email to martin.peres at ensi-bourges dot fr with all the generated file you've created. Please also enclose the output of "lspci -vnn".

It will then be forwarded to other developers.

WARNING: Triple check you enclosed all the files before pressing the send button!


Thanks a lot for caring of reverse engineering nvidia's hardware. Both pscnv and nouveau devs thank you.