Project Etnaviv is an open source user-space driver for the Vivante GCxxx series of embedded GPUs.



Project Etnaviv is an open source user-space driver for the Vivante GCxxx series of embedded GPUs.

This repository contains reverse-engineering and debugging tools, and rnndb register documentation. It is not necessary to use this repository when building the driver.

Instead, use:

SoCs with Vivante GPU


  • Marvell 88SV331x has a GC530
  • Marvell Armada 510 has a GC600: CuBox
  • Marvell Armada 610 has a GC860: OLPC XO-1.75
  • Marvell Armada 1500 has a GC1000: Google TV
  • Marvell PXA2128 has a GC2000 (OLPC XO-4)
  • Rockchip 2918 has a GC800: some Arnova tablets
  • Freescale i.MX6 Quad and Dual have a GC2000 + GC320 + GC355
  • Freescale i.MX6 QuadPlus and DualPlus have a GC3000 + GC320 + GC355
  • Freescale i.MX6 DualLite and Solo have a GC880 + GC320
  • Freescale i.MX6 SoloLite has GC320 + GC355 (no 3D)
  • Actions Semiconductor ATM7029 has a GC1000


  • Ingenic JZ4760 has a GC200 (2D only)
  • Ingenic JZ4770 has a GC860: GCW Zero

See also wikipedia.

For the Vivante GPUs on many platforms feature bits have been determined, these can be found in doc/gpus_comparison.html.


The repository contains various tools and documentation related to figuring out how to program Vivante GCxxx GPU cores.

Debugging support

Etnaviv comes with a GDB plugin for etna driver debugging. GDB 7.5+ with Python support (usually enabled by default in distributions) is needed for it to work. This plugin adds a few custom commands.

Usage (from gdb):

source /path/to/


  • gpu-state [ ] gpu-state uniforms

    Show full GPU state by default or a subset of the registers with a certain prefix. The special prefix 'uniforms' shows the shader uniforms.

  • gpu-dis

    Disassemble the currently bound fragment and vertex shaders.

  • gpu-trace

    Trace and dump all submitted command buffers. This is similar to dumping to FDR (using one of the hook mechanisms) and then running dump_cmdstream, however this works on the fly.

    Along with each command the physical address is printed, this should come in handy for searching back the physical address that the GPU is stuck on according to the kernel.

    Usage: gpu-trace Enable/disable cmdbuffer trace gpu-trace stop Enable/disable stopping on every commit gpu-trace output stdout Set tracing output to stdout (default) gpu-trace output file Set tracing output to file

These commands automatically find the gallium pipe and screen from the current Mesa context.

State map

Map of documentation for known render state and registers. Mapped in rules-ng-ng (envytools) format:

rnndb/state.xml     Top-level database, global state
rnndb/state_hi.xml  Host interface registers
rnndb/state_2d.xml  2D engine state
rnndb/state_3d.xml  3D engine state
rnndb/state_vg.xml  VG engine state (stub)
rnndb/state_common.xml  Common, shared state defines

Other scattered bits of documentation about the hardware and ISA can be found in doc/

ISA documentation

Vivante has a unified, fixed-size, predictable instruction format with explicit inputs and outputs. This does simplify code generation, compared to a weird flow pipe system like the Mali 200/400. Shader (both vertex and fragment) instruction set description in rules-ng-ng format can be found here:


Some written down notes, and examples of disassembled shaders can be found here:


Assembler and disassembler

A basic disassembler for the shader instructions (to a custom format) can be found in the tools directory:



This can be used to disassemble shaders extracted using --dump-shaders.

There is also an assembler, which accepts the same syntax that is produced by the disassembler:



Command stream format

Like other modern GPUs, the primary means of programming the chip is through a command stream interpreted by a DMA engine. This "Front End" takes care of distributing state changes through the individual modules of the GPU, kicking off primitive rendering, synchronization, and also supports basic flow control (branch, call, return).

Most of the relevant bits of this command stream have been deciphered.

The command stream format represented in rules-ng-ng XML format can be found here:


Command stream interception

A significant part of reverse engineering was done by intercepting command streams while running GL demos and examples.

Command stream interception functionality (libvivhook and moved to the libvivhook repository. The tools to parse and dump intercepted command streams will remain in this repository.

Command stream dumper

Other tools live in:


The most useful ones, aside from the assembler and disassembler mentioned before are:

  • Decodes and dumps the intercepted command stream in human readable format, making use of rnndb state maps.

  • Extract areas of video memory, images, and command buffers at certain points of execution.

Vivante GPL kernel drivers

These have been moved to

Envytools fork

Envytools is a set of tools aimed at developers of the open source NVIDIA driver Nouveau, however some parts such as rnndb can be applied more generally. The repository contains a slightly modified subset of envytools for header generation from the state / command stream / ISA rnndb files, so they can be used from the C code (etna), build with

cd envytools
mkdir build
cd build
cmake ..
cd ../..

Then generate the headers with



There is a mailing list for the project.

There is also a Google group for development discussion for this project at etnaviv-devel, but we are in process of switching to the above freedesktop mailing list.

We usually hang out in #etnaviv on


  • Wladimir J. van der Laan
  • Steven J. Hill (kernel driver help)
  • Christian Gmeiner (beginnings of GC2000 support)
  • Michał Ściubidło (GC880 support)
  • Maarten ter Huurne (GCW kernel driver, v4_uapi interface)


  • Luc Verhaegen (libv) of Lima project (basic framework, general idea)
  • Nouveau developers (rnndb, envytools)
  • point links from README to upstream

    point links from README to upstream

    Since etnaviv is already merged for some time into official [1] mesa library, maybe would be good idea to point directly there?

    Thank you


    opened by okias 7
  • -pthread is missing

    -pthread is missing

    Hello, fought my way though building etna_viv which is hopefully successful. Yet if you want to build the samples it fails because of an unresolved reference.

    I added -lpthread in the to the LDFLAGS line and it does the trick. Building at least.

    regards, kneo

    edit: yes you should obviously add -lpthread

    opened by kneo 4
  • Gc880


    BSP 4.0.0 kernel drivers by lplachno Small egl example that was usefull while starting gc880. Move ioctl go one place. Tested PE_PIPE_DEPTH_ADDR[0]/PE_PIPE_COLOR_ADDR[0] by setting then to random and everything works. Don't know why original driver does that.

    opened by mike-sc 3
  • rnndb: document MMU exception interrupt bit

    rnndb: document MMU exception interrupt bit

    Document the MMU exception interrupt bit as found in galcore kernel sources 5.0.11.p8.4. This is needed to support mmuv2 in the etnaviv kernel driver.

    Signed-off-by: Christian Gmeiner [email protected]

    opened by austriancoder 1
  • rnndb: add copyright and licence information

    rnndb: add copyright and licence information

    I decided to get a review even on something simple as copyright and licence information. Also I am not quite sure what we should do with the generated copyright.xml.h file.

    opened by austriancoder 1
  • Add SoC to description

    Add SoC to description

    NXP has further SocS with Vivante core: MAC57D5xx:

    opened by jesko42 0
  • Opengl ES 3.0 for gc vivante 1000

    Opengl ES 3.0 for gc vivante 1000

    Hello and good morning. I have galaxy tab 3 T211 and GPU is GC vivante 1000. When my device receive update for 4.4.2 I think "now I will have engine ES 3.0" but my principal engine is ES 2.0. I check on libs GPU and see ligles 3.0 (opengl es 3.0). When I test some benchmarks to use opengl es 3.0 I got some black screen or errors :(. Why the principal engine is not opengl es 3.0 ? Thanks for your great work.

    opened by hehk1234 0
  • Drawing lines with GL_LINE_LOOP freezes rendering at eglSwapBuffers()

    Drawing lines with GL_LINE_LOOP freezes rendering at eglSwapBuffers()

    I have only tested this under GLES 1.1, as I am not yet familiar enough with GLES 2.0.

    When drawing, let's say, a simple square using GL_LINE_LOOP, eglSwapBuffers() never returns and nothing is drawn to the screen. However, drawing this same square to the screen, using one additional vertex to complete the square, with GL_LINE_STRIP, works just fine.

    Here is a test-case program to use it: I've included instructions to repeat the problem at the top of lineloop.c

    Thanks for all the work so far on etnaviv!

    opened by senquack 0
  • etna_bo_from_fbdev needs page alignment

    etna_bo_from_fbdev needs page alignment

    As reported on IRC by @atomic007:

    The function fb_open() from fbdemos.c does not account for pages when doing a mmap on more than one frame buffer. For instance a display size of 800x480 produces a buffer stride that does not match page size. The second buffer's mmap would fail. But if you were to mmap both buffers in one call it will succeed. I think the bufferstride calculation needs to account for page size alignment.

    Accounting for page alignment would be difficult though, at least with the fbdev panning mechanism - which can only work by line - so etna_bo_from_fbdev should do some trick in which it maps the pages around the buffer address and uses an offset.

    (or not mmap at all? I don't think we CPU access the frame buffer anywhere, it's there just in case...)

    opened by laanwj 0
  • Fix fbdemos segmentation fault when using single-buffered fbdev devices

    Fix fbdemos segmentation fault when using single-buffered fbdev devices

    This patch prevents etna_bo_gpu_address() from being called with a null argument when there is only one buffer, causing a segfault. The demos work properly after applying the patch, but I'm not sure if there are any side-effects of not calling etna_compile_rs_state() the additional times.

    opened by tchebb 0
An open-source C and C++ project series where beginners can contribute and practice coding.

C C++ mini project A collection of easy C and C++ small projects to help you improve your programming skills. Steps To Follow for contribute Star this

Alexander Monterrosa 2 Jan 1, 2022
Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

CosMapper Loads a signed kernel driver (signed with leaked cert) which allows you to map any driver to kernel mode without any traces of the signed /

null 157 Jan 2, 2023
A framework for implementing block device drivers in user space

BDUS is a Linux 4.0+ framework for developing block devices in user space. More specifically, it enables you to implement block device drivers as regu

Alberto Faria 26 Dec 13, 2022
our supper awesome kernel and user space system

osakauss our super awesome kernel and user space system memory layout The kernel is loaded at 0x00100000. kmalloc initially uses 'placement' allocatio

Eduard 8 Aug 26, 2021
A collection of user-space Linux kernel specific guided fuzzers based on LKL

kBdysch kBdysch is a collection of fast Linux kernel specific fuzzing harnesses supposed to be run in userspace in a guided fuzzing manner. It was des

Anatoly Trosinenko 63 Nov 25, 2022
Cloud Native Data Plane (CNDP) is a collection of user space libraries to accelerate packet processing for cloud applications.

CNDP - Cloud Native Data Plane Overview Cloud Native Data Plane (CNDP) is a collection of userspace libraries for accelerating packet processing for c

Cloud Native Data Plane 35 Dec 28, 2022
Selective user space swap (kubernetes swap / kubeswap)

BigMaac ?? ?? ( Big Malloc Access And Calloc ) because sometimes a happy meal is not big enough BigMaac can be used in userspace (e.g. inside Kubernet

Misko 12 Dec 9, 2022
Linux USB driver for the MOTU AVB series interfaces

motu-avb Linux USB driver for the MOTU AVB series interfaces Kernel parameters: samplerate: set the samplerate (its currently fixed at module load) de

null 47 Dec 23, 2022
A WMI driver for Lenovo Legion series of laptops

Problem The Legion line of laptops from Lenovo come with the ability to switch power modes between "quiet", "balanced" and "performance." On Windows t

null 11 Aug 20, 2022
A place to collaborate on code for the book club. Currently reading "STM32 ARM Programming for Embedded Systems".

Welcome to the Book Club Code site! This is a place for the book club to collaborate and learn together. Repo Structure Guide Top-level fo

Peter Griffin 11 Jul 21, 2022
Embedded Flutter runtime targeting Embedded Linux with Wayland

ivi-homescreen IVI Homescreen for Wayland Strongly Typed (C++) Lightweight Clang 11 Release Stripped = 151k GCC 9.3 Release Stripped = 168k Source run

null 170 Dec 13, 2022
3D GPUs Strange Attractors and Hypercomplex Fractals explorer - up to 256 Million particles in RealTime

glChAoS.P ⋅ wglChAoS.P - Ver 1.5.3 glChAoS.P / wglChAoS.P ⋅ opengl / webgl ⋅ Chaotic Attractors of Slight (dot) Particles RealTime 3D Strange Attracto

Michele Morrone 704 Dec 29, 2022
OffensivePH - use old Process Hacker driver to bypass several user-mode access controls

offensiveph OffensivePH is a post-exploitation tool that utilizes an old Process Hacker driver to bypass several user-mode access controls. Usage Comp

Red Section 291 Dec 29, 2022
A user-mode emulator for the mhyprot2.sys driver

mhynot2 Cheating is bad, but I think requiring a kernel driver to play a (mostly) single-player game is worse. mhynot2 is a hook DLL which hooks into

Khangaroo 92 Dec 28, 2022
Linux HWMON sensors driver for ASUS motherboards to get sensor readings from the embedded controller

asus-wmi-ec-sensors Linux HWMON sensors driver for ASUS motherboards to read sensors from the embedded controller Many ASUS motherboards do not publis

Eugene Shalygin 6 Aug 30, 2022
Generic embedded C driver to work with Sensirion's SEN5x environmental sensor modules via I2C

Sensirion Embedded I2C SEN5x Driver This is a generic embedded driver for the Sensirion SEN5x sensor modules. It enables developers to communicate wit

Sensirion AG 6 Nov 30, 2022
Single source file ASTC texture decompression in C++ (derived from Google's open source Android project)

astc_dec astc_dec is a single source file ASTC texture decompressor with the Apache 2.0 license, derived from Google's open source Android sources. Th

Rich Geldreich 29 Dec 5, 2022
This repository contains the source-code for the Robothon 24h series of workshops and competition within ENSTA Borj Cedria.

Robothon: The 24h long zero to hero robotics bootcamp What is Robothon? Robothon by Electronix ENSTABC is a 24h long event held within the walls of EN

Radhi SGHAIER 5 Mar 23, 2022
x64 Windows kernel driver mapper, inject unsigned driver using anycall

anymapper x64 Windows kernel driver mapper, inject unsigned driver using anycall This project is WIP. Todo Fix: Can't make API calls from IAT nor func

Kento Oki 72 Dec 26, 2022