To use these, write the address and number of dwords, then read the result from $addr. Instruction to jump to when the CP is preempted to perform a context switch, initialized to entry 15 of the jump table at bootup. Writing to this triggers a register write and auto-increments REG_WRITE_ADDR. Note that there seems to be some upper bits that are possilby flags, ie: l284: 0d12: 8a8c0003 mov $0c, 0x0003 << 20 GPR: $0c: 00300000 0d13: 318c9e0b or $0c, $0c, 0x9e0b GPR: $0c: 00309e0b 0d14: a80c0024 cwrite $0c, [$00 + @REG_WRITE_ADDR], 0x0 CTRL: @REG_WRITE_ADDR: 00309e0b After setting these, read result from $addr2 Write to increase WFI_PEND_CTR, decremented by WFI_PEND_DECR pipe register. SQE writes DRAW_STATE_SEL to select the SDS state group, and then reads out the SDS header (DRAW_STATE_HDR), ie. the first dword in the state group entry (see CP_SET_DRAW_STATE), and base address of the state group cmdstream (DRAW_STATE_BASE) base address for executing draw state group when IB_LEVEL is set to 3 (ie. it's a bit like IB3 equiv of IBn_BASE) Note that SDS_BASE/SDS_DWORDS seem to be per-state-group, the values reflected switch when DRAW_STATE_SEL is written. state group equiv of IBn_DWORDS Contains information from the first dword of the state group entry in CP_SET_DRAW_STATE, but format isn't exactly the same. The # of dwords is in low 16b, and mode mask is in high 16 bits Controls whether RB, IB1, or IB2 is executed Controls high 32 bits used by load and store afuc instructions Used to initialize the jump table for handling packets at bootup These are addresses of various preemption records for the current context. When context switching, the CP will save the current state into these buffers, restore the state of the next context from the buffers in the corresponding CP_CONTEXT_SWITCH_PRIV_* registers written by the kernel, then set these internal registers to the contents of those registers. The kernel sets the initial values via CP_SET_PSEUDO_REG on startup, and from then on the firmware keeps track of them. Used only during preemption, saved and restored from the "info" field of a6xx_preemption_record. From the downstream kernel: "Type of record. Written non-zero (usually) by CP. we must set to zero for all ringbuffers." Seems to be a shadow for PC_MARKER Set by SET_MARKER, used to conditionally execute CP_COND_REG_EXEC and draw states.