Instruction to jump to when the CP is preempted to perform a context switch, initialized to entry 15 of the jump table at bootup. Stack Pointer for call/ret return address stack Controls high 32 bits used by store afuc instruction To use these, write the address and number of dwords, then read the result from $addr. Writing to this triggers a register write and auto-increments REG_WRITE_ADDR. Note that there seems to be some upper bits that are possilby flags, ie: l284: 0d12: 8a8c0003 mov $0c, 0x0003 << 20 GPR: $0c: 00300000 0d13: 318c9e0b or $0c, $0c, 0x9e0b GPR: $0c: 00309e0b 0d14: a80c0024 cwrite $0c, [$00 + @REG_WRITE_ADDR], 0x0 CTRL: @REG_WRITE_ADDR: 00309e0b After setting these, read result from $regdata Write to increase WFI_PEND_CTR, decremented by WFI_PEND_DECR pipe register. SQE writes DRAW_STATE_SEL to select the SDS state group, and then reads out the SDS header (DRAW_STATE_HDR), ie. the first dword in the state group entry (see CP_SET_DRAW_STATE), and base address of the state group cmdstream (DRAW_STATE_BASE) base address for executing draw state group when IB_LEVEL is set to 3 (ie. it's a bit like IB3 equiv of IBn_BASE) Note that SDS_BASE/SDS_DWORDS seem to be per-state-group, the values reflected switch when DRAW_STATE_SEL is written. state group equiv of IBn_DWORDS Contains information from the first dword of the state group entry in CP_SET_DRAW_STATE, but format isn't exactly the same. The # of dwords is in low 16b, and mode mask is in high 16 bits This register is written for each state group entry in CP_SET_DRAW_STATE. The value is copied directly from the packet to these registers so the format is identical to the first word. The draw state base is set via the (sds2) modifier. Set to 1 before setting draw states, introduced in a660_sqe.fw Controls whether RB, IB1, or IB2 is executed Controls high 32 bits used by load and store afuc instructions An array of 2-bit fields each controlling a single countable. TODO: Test with modified firmware to confirm which countables each field controls Used to initialize the jump table for handling packets at bootup The zap shader uses the base address of itself, adding the offset of the embedded shader instructions, to program SP_CS_OBJ_START with the address of the shader part of the zap "shader" Resettable counter used to implement PERF_CP_LONG_PREEMPTIONS Seemingly used to start/stop PREEMPTION_TIMER Private mirror of CP_CONTEXT_SWITCH_CNTL Write 1 to trigger a preemption from SQE. Reads return 1 if SQE triggered preemption. Written by SQE throughout the preemption routine, with mostly monotonically increasing values, presumably used to determine where it is when it crashes. TODO: How do we read this? These are addresses of various preemption records for the current context. When context switching, the CP will save the current state into these buffers, restore the state of the next context from the buffers in the corresponding CP_CONTEXT_SWITCH_PRIV_* registers written by the kernel, then set these internal registers to the contents of those registers. The kernel sets the initial values via CP_SET_PSEUDO_REG on startup, and from then on the firmware keeps track of them. Used only during preemption, saved and restored from the "info" field of a6xx_preemption_record. From the downstream kernel: "Type of record. Written non-zero (usually) by CP. we must set to zero for all ringbuffers." Seems to be a shadow for PC_MARKER Set by SET_MARKER, used to conditionally execute CP_COND_REG_EXEC and draw states. After setting these, read result from $regdata Set to 1 before setting draw states This is used by LPAC instead of (sds2) to write the base Controls whether RB, IB1, IB2, IB3, or SDS is executed Controls high 32 bits used by load and store afuc instructions Used to initialize the jump table for handling packets at bootup These registers seem to define a range that load/store instructions can access Register used to create critical sections when reading/writing shared memory (0x200-0x2ff). Each bit contains a lock. Writing 1 to the bit initiates a lock, reads return 1 once the lock is taken. Writing 0 unlocks. The low 3 bits are used as a semaphore to let SQE wait for other coprocessors to start. SQE sets it to 0x7 before starting the coprocessors, then each coprocessor atomically clears a bit. Other bits are used for CP_THREAD_CONTROL::SYNC_THREADS and other internal syncing. After setting these, read result from $regdata