Subchannels:

Id Subchannel (nvn) Name
0xB197 0 3D
0xB1C0 1 Compute
0xA140 2 Inline-to-Memory
0x902D 3 2D
0xB0B5 4 DMA

3D

Register Name Type Notes
0xC9 Tesselation_OuterLevel0
0xCA Tesselation_OuterLevel1
0xCB Tesselation_OuterLevel2
0xCC Tesselation_OuterLevel3
0xCD Tesselation_InnerLevel0
0xCE Tesselation_InnerLevel1
0xDF RasterizerDiscard_Enable bool
0xE0+8*N TransformFeedbackBuffer_Enable bool
(0xE1,0xE2)+8*N TransformFeedbackBuffer_Addr iova_t
0xE3+8*N TransformFeedbackBuffer_Flags
0x1D1 TransformFeedback_Pause
0x1FA,0x1FB ZCullCtx_Addr0 iova_t
0x1FC,0x1FD ZCullCtx_Addr1 iova_t
0x285+8*N DepthRange_Unk0_N
0x302+4*N DepthRange_Unk1_N
0x303+4*N DepthRange_Unk2_N
0x36B BindPolygonState writes here.
0x36C BindPolygonState writes here.
0x370 bool BindPolygonState writes here.
0x371 bool BindPolygonState writes here.
0x372 bool BindPolygonState writes here.
0x373 PatchSize Small value, always fits in 12 bits.
0x374 0 written here for "simple" BlendState.
0x381+4*N Scissor0_N
0x382+4*N Scissor1_N
0x3D5 StencilMask1_Ref bool
0x3D6 StencilMask1_Enable bool
0x3D7 StencilMask1_ValueMask bool
0x3E7 DepthBounds_Bound0 float
0x3E8 DepthBounds_Bound1 float
0x3ED Multisample_Related0
0x3EE Multisample_Related1
0x3EF SampleMask0
0x3F0 SampleMask1
0x3F1 SampleMask2
0x3F2 SampleMask3
0x3F5 Multisample_Related2
0x3F6 CoverageModulation_Enable bool
0x40C CoverageModulation_Table0 float
0x40D CoverageModulation_Table1 float
0x40E CoverageModulation_Table2 float
0x40F CoverageModulation_Table3 float
0x452 Raster_Enable bool
0x478 Multisample_Config3
0x479 Multisample_Config4
0x47A Multisample_Config5
0x47B Multisample_Config6
0x47E Multisample_Related3
0x4B3 DepthStencil_Config0 bool If set to 1, it enables DepthStencil_Config1 and DepthStencil_Config2.
0x4B8 Multisample_Config2 bool
0x4BA DepthStencil_Config1
0x4C3 DepthStencil_Config2 0-15 is written here.
0x4B9 1 written here for "simple" BlendState.
0x4BB BindColorState writes 0 or 1 here.
0x4C5 BindColorState sometimes writes here a value between 0-15.
0x4E0 0 is sometimes written here during BindDepthStencil.
0x4E5 StencilMask0_Ref bool
0x4E6 StencilMask0_ValueMask bool
0x4E7 StencilMask0_Enable bool
0x4EC LineWidth0
0x4ED LineWidth1
0x4C4 AlphaRef float
0x4C7 BlendColor0
0x4C8 BlendColor1
0x4C9 BlendColor2
0x4CA BlendColor3
0x47C BindProgram writes 0 here sometimes.
0x47F DepthBuffer_Resolve 1 is written here to trigger.
0x519 ZCullCtx_Save 0 is written here to trigger ctx-save, uses both ZCullCtx_Addr0/1.
0x51F PolygonOffsetClamp0 float
0x540 ZCullCtx_Restore 0 is written here to trigger ctx-restore, uses both ZCullCtx_Addr0/1.
0x546 PointSize float
0x554,0x555 RendererEnableConditionAddr iova_t
0x556 RendererEnable 0=disabled unconditional, 1=enabled unconditional, 3=unknown conditional, 4=unknown conditional,
0x54C Counter_Reset Value written decides which counter to reset.
0x54D Multisample_Config1
0x54F Multisample_Config0 bool
0x55B PolygonOffsetClamp1 float
0x56F PolygonOffsetClamp2 float Float multiplied by 2 is written here.
0x591 PrimitiveRestart_Enable bool
0x592 PrimitiveRestart_Value
0x646 BindPolygonState writes here.
0x647 BindPolygonState writes here.
0x648 BindPolygonState writes here.
0x64F DepthClamp 0x101A is written when enabled, 0x181D when disabled.
0x66F DepthBounds_Enable bool
0x671 Sometimes used by BindColorState.
0x68B Barrier? Always 0 is written here. During zcull ctx-save, spammed when enabling raster, ...
0x6C0,0x6C1 Poke_Addr iova_t
0x6C2 Poke_WriteVal 0 is written here during most queries.
0x6C3 Poke_Control Big bitfield. After write, the result of query is written to 4 bytes at Poke_Addr.
(0x701,0x702)+2*N VertexBufferStartAddr iova_t
(0x7C0,0x7C1)+2*N VertexBufferEndAddr iova_t
0x781+8*N BlendState_N TODO, N = {0, ..., 7}
0x782+8*N BlendState_N TODO
0x783+8*N BlendState_N TODO
0x784+8*N BlendState_N TODO
0x785+8*N BlendState_N TODO
0x786+8*N BlendState_N TODO
0x820 BindProgram writes here.
0x821 BindProgram writes here.
0x830 BindProgram writes here.
0x840 BindProgram writes here.
0x850 BindProgram writes here.
0x8E0 BindUniformBuffer_Size? BindUniformBuffer writes here.
0x8E1,0x8E2 BindUniformBuffer_Addr iova_t
0x8E3 BindImage_Config BindImage writes "8*i + 0x120" here. BindSeparateSampler writes "8*i + 0x568" here. BindSeparateTexture uses "8*i + 0x168". BindTexture uses 8*i + 32.
0x8E4 BindImage_ValueLo This might be an addr but it's swapped opposite to other addrs. BindSeparateSampler/BindSeparateTexture writes something here. BindStorageBuffer writes something here.
0x8E5 BindImage_ValueHi BindStorageBuffer writes something here.
0x8E6 BindStorageBuffer writes something here.
0x8E4,0x8EB Multisample_ConfigX What? Overlap.
0x904 UniformBuffer0_Control
0x90C UniformBuffer3_Control
0x914 UniformBuffer4_Control
0x91C UniformBuffer2_Control
0x924 UniformBuffer1_Control
0xD1E BindProgram writes 0 here, trigger?
0xD34 Used by SetConservativeRasterDilate.
0xD35 BlendStateAdvanced bitfield Bit0: NormalizedDst, bit1: PremultipliedSrc, bit2-3: BlendTarget, Bit4-9: Mode
0xE00,0xE01 TransformFeedback_Addr iova_t
0xE0A Used by SetConservativeRasterDilate.
0xE0B Used by SetConservativeRasterDilate.
0xE0E BindImage/BindSeparateSampler/BindSeparateTexture writes 0-4 here.
0xE10 Sometimes used by BindColorState.
0xE12 BindChannelMaskState_Unk0
0xE13 BindChannelMaskState_Unk1
0xE1A DepthStencil_Config3
0xE1E Multisample_Config7 Also written to by BindStorageBuffer
0xE20 Another barrier? Used by SetConservativeRasterDilate.
0xE2A DebugGroupPush_DynamicControl
0xE2B DebugGroupPush_DynamicValue This one can be written a variable number of times.
0xE2C DebugGroupPush_StaticControl
0xE2D DebugGroupPush_StaticValue This is written 3 times after DebugGroupPush_StaticControl.
0xE2E DebugGroupPop_Control
0xE2F DebugGroupPop_GroupId This is written once after DebugGroupPop_Control.

TODO: SetRenderTargets, SetSubpixelPrecisionBias, SetTiledCacheAction, SetTiledCacheTileSize, SetViewports, UpdateUniformBuffer, TiledDownSample, BindVertexAttribState, BindVertexStreamState, Clear*, Copy*, Discard*, Dispatch*, Downsample, Draw*

DMA

Register Name Notes
0x0C0 Dma_Control With 0x186 Src/DstStride is not used.
0x100 Dma_SrcAddrHi
0x101 Dma_SrcAddrLo
0x102 Dma_DstAddrHi
0x103 Dma_DstAddrLo
0x104 Dma_SrcStride?
0x105 Dma_DstStride?
0x106 Dma_Count At most 0x3FFFFF.