Subchannels:

Id Subchannel (nvn) Name
0xB197 0 3D
0xB1C0 1 Compute
0xA140 2 Inline-to-Memory
0x902D 3 2D
0xB0B5 4 DMA

3D

Register Name Type Notes
0xC9 Tesselation_OuterLevel0
0xCA Tesselation_OuterLevel1
0xCB Tesselation_OuterLevel2
0xCC Tesselation_OuterLevel3
0xCD Tesselation_InnerLevel0
0xCE Tesselation_InnerLevel1
0xDF RasterizerDiscard_Enable bool
0x1D1 TransformFeedback_Pause
0x1FA-0x1FB ZCullCtx_Addr0 iova_t
0x1FC-0x1FD ZCullCtx_Addr1 iova_t
0x285+8*N DepthRange_Unk0_N
0x302+4*N DepthRange_Unk1_N
0x303+4*N DepthRange_Unk2_N
0x373 PatchSize Small value, always fits in 12 bits.
0x374 0 written here for "simple" BlendState.
0x381+4*N Scissor0_N
0x382+4*N Scissor1_N
0x3D5 StencilMask1_Ref bool
0x3D6 StencilMask1_Enable bool
0x3D7 StencilMask1_ValueMask bool
0x3E7 DepthBounds_Bound0 float
0x3E8 DepthBounds_Bound1 float
0x3ED Multisample_Related0
0x3EE Multisample_Related1
0x3EF SampleMask0
0x3F0 SampleMask1
0x3F1 SampleMask2
0x3F2 SampleMask3
0x3F5 Multisample_Related2
0x3F6 CoverageModulation_Enable bool
0x40C CoverageModulation_Table0 float
0x40D CoverageModulation_Table1 float
0x40E CoverageModulation_Table2 float
0x40F CoverageModulation_Table3 float
0x452 Raster_Enable bool
0x478 Multisample_Config3
0x479 Multisample_Config4
0x47A Multisample_Config5
0x47B Multisample_Config6
0x47E Multisample_Related3
0x4B3 DepthStencil_Config0 bool If set to 1, it enables DepthStencil_Config1 and DepthStencil_Config2.
0x4B8 Multisample_Config2 bool
0x4BA DepthStencil_Config1
0x4C3 DepthStencil_Config2 0-15 is written here.
0x4B9 1 written here for "simple" BlendState.
0x4BB BindColorState writes 0 or 1 here.
0x4C5 BindColorState sometimes writes here a value between 0-15.
0x4E0 0 is sometimes written here during BindDepthStencil.
0x4E5 StencilMask0_Ref bool
0x4E6 StencilMask0_ValueMask bool
0x4E7 StencilMask0_Enable bool
0x4EC LineWidth0
0x4ED LineWidth1
0x4C4 AlphaRef float
0x4C7 BlendColor0
0x4C8 BlendColor1
0x4C9 BlendColor2
0x4CA BlendColor3
0x47F DepthBuffer_Resolve 1 is written here to trigger.
0x519 ZCullCtx_Save 0 is written here to trigger ctx-save, uses both ZCullCtx_Addr0/1.
0x51F PolygonOffsetClamp0 float
0x540 ZCullCtx_Restore 0 is written here to trigger ctx-restore, uses both ZCullCtx_Addr0/1.
0x546 PointSize float
0x554-0x555 RendererEnableConditionAddr iova_t
0x556 RendererEnable 0=disabled unconditional, 1=enabled unconditional, 3=unknown conditional, 4=unknown conditional,
0x54C Counter_Reset Value written decides which counter to reset.
0x54D Multisample_Config1
0x54F Multisample_Config0 bool
0x55B PolygonOffsetClamp1 float
0x56F PolygonOffsetClamp2 float Float multiplied by 2 is written here.
0x591 PrimitiveRestart_Enable bool
0x592 PrimitiveRestart_Value
0x64F DepthClamp 0x101A is written when enabled, 0x181D when disabled.
0x66F DepthBounds_Enable bool
0x671 Sometimes used by BindColorState.
0x68B Barrier? Always 0 is written here. During zcull ctx-save, spammed when enabling raster, ...
0x6C0-0x6C1 Poke_Addr iova_t
0x6C2 Poke_WriteVal 0 is written here during most queries.
0x6C3 Poke_Control Big bitfield. After write, the result of query is written to 4 bytes at Poke_Addr.
0x781+8*N BlendState_N TODO, N = {0, ..., 7}
0x782+8*N BlendState_N TODO
0x783+8*N BlendState_N TODO
0x784+8*N BlendState_N TODO
0x785+8*N BlendState_N TODO
0x786+8*N BlendState_N TODO
0x8E3 BindImage_Config BindImage writes "8*i + 0x120" here.
0x8E4 BindImage_ValueLo This might be an addr but it's swapped opposite to other addrs.
0x8E5 BindImage_ValueHi
0x8E4-0x8EB Multisample_ConfigX What? Overlap.
0xD34 Used by SetConservativeRasterDilate.
0xD35 BlendState TODO: Bitfield
0xE00-0xE01 TransformFeedback_Addr iova_t
0xE0A Used by SetConservativeRasterDilate.
0xE0B Used by SetConservativeRasterDilate.
0xE0E BindImage writes 0-4 here.
0xE10 Sometimes used by BindColorState.
0xE12 BindChannelMaskState_Unk0
0xE13 BindChannelMaskState_Unk1
0xE1A DepthStencil_Config3
0xE1E Multisample_Config7
0xE20 Another barrier? Used by SetConservativeRasterDilate.
0xE2A DebugGroupPush_DynamicControl
0xE2B DebugGroupPush_DynamicValue This one can be written a variable number of times.
0xE2C DebugGroupPush_StaticControl
0xE2D DebugGroupPush_StaticValue This is written 3 times after DebugGroupPush_StaticControl.
0xE2E DebugGroupPop_Control
0xE2F DebugGroupPop_GroupId This is written once after DebugGroupPop_Control.

TODO: SetRenderTargets, SetSubpixelPrecisionBias, SetTiledCacheAction, SetTiledCacheTileSize, SetViewports, UpdateUniformBuffer, TiledDownSample

DMA

Register Name Notes
0x0C0 Dma_Control With 0x186 Src/DstStride is not used.
0x100 Dma_SrcAddrHi
0x101 Dma_SrcAddrLo
0x102 Dma_DstAddrHi
0x103 Dma_DstAddrLo
0x104 Dma_SrcStride?
0x105 Dma_DstStride?
0x106 Dma_Count At most 0x3FFFFF.