NV3 memory mapping

Understanding the memory mapping of the NV3 is critical for understanding its overall operation.

The memory mapping architecture is implemented internally by the NV3 on-die memory controller and exposed to the user via the configuration register interface of the Peripheral Connect Interface (PCI) bus and its siblings and successors, such as AGP (or in later models, PCIe). Two of the maximum fsix base address registers are exposed using this mechanism, BAR0 and BAR1; BAR2 is claimed to exist by some sources, including envytools, but doesn't seem to actually exist. BAR0 contains a gigantic slab (16MB) of MMIO containing all registers, and BAR1, also 16MB, contains both a copy of the current framebuffer (or all of VRAM?) for dumb framebuffer use, and, at 0xC00000, instance memory mapped as it is intended to be addressed.

Memory mapping

BAR0 (MMIO)

NV3 BAR0 mapping

Start	End	Name	Purpose
0x0	0xFFF	PMC	Control GPU subsystems, some manufacture-time config info & global GPU interrupt status and control
0x1000	0x17FF	PBUS	PCI/AGP electrical configuration, memory controller, DMA controller
0x1800	0x18FF	PCI config space mirror	PCI configuration for exposing the GPU to the rest of the machine, including vendor and device IDs, BARs for MMIO and VRAM mapping by the OS and various other characteristics. Technically a part of PBUS [1]
0x2000	0x3FFF	PFIFO	FIFO buffer using Gray code indexing; allows objects to be submitted in one of two caches (the one-entry CACHE0 used for software method injection and the 32 or 64 (NV3T)-deep CACHE1), storing them in a queue their methods can be executed; supports up to 8 DMA channels for object submission with 8 subchannels each, "context switching" is needed (see RAMFC) to change which DMA channel is selected.
0x4000	0x5FFF	PRM	Legacy Sound Blaster/MPU-401 support on MS-DOS
0x6000	0x6FFF	PRAM	NV1 leftover that controlled the amount of RAM used for GPU control structures, unused.
0x7000	0x7FFF	PRMIO	Real Mode I/O. In practice only used for the Real Mode Access (RMA) feature (at MMIO 0x7100) that allows reading and writing, to the GPU's MMIO space from real-mode (by using the x86 in/out instructions on legacy SVGA ports) without mapping any of the BARs; this is used by the VBIOS to talk to the main part of the GPU.
0x9000	0x9FFF	PTIMER	56-bit programmable interval timer for measuring events that need to happen at a precise real-world time interval.
0xA0000	0xBFFFF	PRMVGA	Legacy VGA video memory
0xC0000	0xCFFFF	PRMVIO	Legacy VGA I/O, extended sequencer registers, unknown "GX" registers; mirrored as legacy I/O ports. Lines up with where the VBIOS is in the real mode memory map but is entirely different.
0x100000	0x100FFF	PFB	Framebuffer configuration and interface; power configuration; memory timings and configuration; some manufacture-time configuration information; debug facilities including tetris mode.
0x110000	0x11FFFF	PROM / VBIOS	Mirror of the Video BIOS (repeated for 64kb, even though the VBIOS is only 32kb)
0x120000	0x120FFF	PALT	Alternative(?) VBIOS
0x200000	0x200FFF	PME	Mediaport; allows plugging in of external MPEG decoder (in theory) - Warning: All known cases of reading these registers hard locks the entire system!
0x400000	0x401FFF	PGRAPH	2D & 3D graphics rendering engine. Allows up to 4 buffers to be used for rendering 2D and 3D graphics (mostly DirectX 5.0 and OpenGL 1.1 compliant); can render graphics at 8, 16 or 32bpp in 2D at up to theoretical maximum resolution (set by PFB) of 2048*1536 (but in practice 1920*1200, sometimes 1600*1200) and up to 960*720 (NV3) or 1600*1200 (?) (NV3T) at 16bpp for 3D.
0x400648 (index)	0x40064C (address/data)	DPRAM	Internal port (as part of PGRAPH) to access on-die texture and vertex cache (12 KB)
0x410000	0x411FFF	UBETA	Internal write-only registers used to execute methods for the beta factor object
0x420000	0x421FFF	UROP	Internal write-only registers used to execute methods for the GDI ternary ROP object
0x430000	0x431FFF	UCHROMA	Internal write-only registers used while executing methods for the beta factor object
0x440000	0x441FFF	UPLANE	Internal write-only registers used while executing methods for the beta factor object
0x450000	0x451FFF	UCLIP	Internal write-only registers used while executing methods for the beta factor object
0x460000	0x461FFF	UPATT	Internal write-only registers used while executing methods for the beta factor object
0x470000	0x471FFF	URECT	Internal write-only registers used while executing methods for the beta factor object
0x480000	0x481FFF	UPOINT	Internal write-only registers used while executing methods for the beta factor object
0x490000	0x491FFF	ULINE	Internal write-only registers used while executing methods for the beta factor object
0x4A0000	0x4A1FFF	ULIN	Internal write-only registers used while executing methods for the beta factor object
0x4B0000	0x4B1FFF	UTRI	Internal write-only registers used while executing methods for the beta factor object
0x4C0000	0x4C1FFF	UW95TXT	Internal write-only registers used while executing methods for the beta factor object
0x4D0000	0x4D1FFF	UMEMFMT	Internal write-only registers used while executing methods for the beta factor object
0x4E0000	0x4E1FFF	USCALED	Internal write-only registers used while executing methods for the beta factor object
0x500000	0x501FFF	UBLIT	Internal write-only registers used while executing methods for the beta factor object
0x510000	0x511FFF	UIMAGE	Internal write-only registers used while executing methods for the beta factor object
0x520000	0x521FFF	UBITMAP	Internal write-only registers used while executing methods for the beta factor object
0x540000	0x541FFF	UTOMEM	Internal write-only registers used while executing methods for the beta factor object
0x550000	0x551FFF	USTRTCH	Internal write-only registers used while executing methods for the beta factor object
0x570000	0x571FFF	UD3D0Z	Internal write-only registers used while executing methods for the beta factor object
0x580000	0x581FFF	UPOINTZ	Internal write-only registers used while executing methods for the beta factor object
0x5C0000	0x5C1FFF	UINMEM	Internal write-only registers used while executing methods for the beta factor object

Notes

^ Repeated from 0x1900-0x19FF due to incomplete address decoding