Reality Display Processor/Interface

The RDP interface is the set of registers that allow to control the RDP and make it perform the required rasterization jobs.

RDP executes a stream of commands that are sent to it via DMA. The RDP interface allows to initiate and monitor the DMA transfers to RDP, and to query the current status of RDP.

DMA transfers

DMA transfers allow to send a sequence of commands from RDRAM or DMEM to the RDP. When a DMA is triggered the RDP will start fetching commands in small batches into an internal FIFO queue, from which they will get run; the DMA will then wait for space to become available in this internal command FIFO before more data can be transferred.

Commands can be stored in either RDRAM or DMEM. Bit 0 of DPC_STATUS is used to select whether RDRAM or DMEM is used. When reading data from DMEM, the RDP uses an internal bus in the RCP called XBUS, so normally "using XBUS" is a shorthand expression for "programming the RDP to fetch commands from DMEM". Notice that both VR4300 and RSP can program the RDP to either use XBUS or not; there is no correlation between the CPU programming the RDP and the data source being used.

The RDP is a deeply pipelined unit. There is thus no correlation between a DMA being finished and the respective commands being finished (e.g. pixels drawn into the framebuffer). Instead, the end of DMA can just be used as a signal that the RDRAM/DMEM buffer that stores the commands can be recycled, but no further information can be deduced regarding the actual execution of the commands. A few synchronization commands can be used to guarantee that work will have been completed by the RDP before the next command begins execution; see the page on RDP commands for more details.

RDP commands are composed of one or more 64-bit (8 byte) words. For this reason, RDP DMA must fetch data from an address that is 64-bit aligned: in fact, the lowest 3 bits of the DMA address register are ignored. There is no destination register: the destination is the RDP itself and its internal command FIFO is not addressable in any way.

Incremental transfers

To allow the RDP to begin processing commands as soon as they are available (that is, while the VR4300 and RSP are generating them), the RDP DMA allows for incremental transfers; the DPC_END register can be updated while a DMA is in progress (or after it has finished) and the effect is that the DMA will continue running until the new end pointer is reached. This operation is totally safe and free of race conditions. The intended purpose is that the VR4300 or the RSP can continue updating the DPC_END register while they add more data to the command buffer in RDRAM/DMEM until it is full, at which point they can start another transfer to switch to another buffer.

Double buffering

DMA registers are double-buffered: this means that it is possible to program a new DMA transfer while another one is in progress. A new DMA transfer in this context means starting again from another buffer: we do not consider incremental transfers described above as "new transfers".

To program a pending DMA transfer, just write to DPC_START/DPC_END a new buffer start/end address. The START_PENDING / END_PENDING bits in DPC_STATUS will be set to 1, signaling that a transfer is indeed pending. New writes to DPC_END will now update the pending transfer; in other words, after a new DMA transfer is pending, it is not possible to incrementally add more commands to the currently-running transfer.

Programming considerations

The choice between using XBUS or not is an open debate. There is no clear cut answer and it should be carefully considered depending on the expected performance implications:

• If commands are already in RDRAM (eg: a static display list of RDP commands, read from ROM), then it is obviously more efficient to send them directly from there, without copying them first to DMEM. Libultra does not support this (in libultra, all RDP commands are always passed through RSP as they were RSP commands first, causing a double memory bandwidth impact if they are then sent back to RDRAM for RDP DMA); in libdragon, this is supported via rdpq_exec.
• Symmetrically, short display lists of RDP commands can be already available in RSP DMEM (as part of the data segment of a RSP microcode). In this case, pushing them directly to RDP via XBUS is surely the fastest option.
• If commands are generated by the RSP (eg: triangles at the end of a T&L pipeline), consider the following aspects:
  • sending back all the commands to RDRAM will have an impact on memory bandwidth (first, to transfer them from DMEM to RDRAM, and later from RDRAM to RDP). Memory bandwidth is often a bottleneck on N64.
  • on the other hand, RDRAM allows for much larger buffers. When the buffers are small (like they typically are in DMEM), it means that the RSP could be forced to wait for the RDP to process the commands before producing new ones (basically this is back-pressure from RDP to RSP), and in turns it could cause a back-pressure on the VR4300. Often, RDP is the slowest among the three, so a larger buffer allows for better pacing.

While preparing buffers on RDP commands, it is useful to take advantage of incremental transfers. This is a possible algorithm:

1. Prepare two buffers (in either DMEM or RDRAM).
2. Get ready to send the first buffer by setting DPC_START = DPC_END = pointer to the start of the first buffer. This will not actually transfer any byte (remember DPC_END is an exclusive bound, so if you set DPC_START = DPC_END, this means "0 byte buffer"), but will setup the DMA engine as such.
3. Generate RDP commands into the first buffer (assuming this is RSP, depending whether you are using XBUS or not, either just write them to DMEM, or also DMA them to RDRAM into the first buffer). Any time a new command is added to the buffer, write DPC_END to point past it. This basically tells the RDP that there are more commands to run, as soon as it is ready.
4. When the buffer is full, go back to point 2, switching to the next buffer. Notice that the RDP DMA on the first buffer will continue running until all commands have been fetched, so the new buffer will be effectively pending at this point. Anyway, you can continue working on the new buffer and keep writing DPC_END: this is totally race-free, whether the new transfer is still pending, is ongoing, or even if it is finished.
5. Consider that the RDP can only have one transfer pending. So anytime you write DPC_START to switch to a new buffer, first check if another transfer is already pending (by checking if the START_PENDING bit is set in DPC_STATUS). If it is pending, then you will need to wait for it. This also makes sure you don't start pushing new commands into the first buffer again, before the previous contents have been fully consumed.

Another possible approach to push commands into the RDP is using a single buffer, and checking DPC_CURRENT to race against the DMA. The idea is using the buffer as a circular one, and have the DMA constantly trailing behind our write pointer.

1. Prepare a single buffer (in either DMEM or RDRAM). Write DPC_START = DPC_END = pointer to the start of the buffer. Notice that, as soon as the RDP accepts these register writes, DPC_CURRENT will also point there when read.
2. Generate RDP commands and write them into the buffer. Any time a new command is written, update DPC_END. At this point, there are no pending DMAs (START_PENDING = 0), and in general we will have that DPC_START <= DPC_CURRENT <= DPC_END. To visualize this, remember that DPC_CURRENT is basically the "read pointer", while DPC_END is our "write pointer", within the same circular buffer.
3. When we reach the end of the buffer, schedule a new DMA transfer on the same buffer from the beginning (so again DPC_START = DPC_END = pointer to the start of the buffer). At this point, this second transfer will be pending (START_PENDING = 1), but the RDP DMA will probably be still going through the buffer on the first time. So at this point we have DPC_START <= DPC_END < DPC_CURRENT. Notice in fact that reading DPC_START and DPC_END will return the pending values (the new run on the buffer), while DPC_CURRENT will still report the currently running transfer, and will keep going until the end of the buffer.
4. Keep writing commands from the start of the buffer. This time, though, make sure that you never write past the current value of DPC_CURRENT. If you need to write a command but you have reached the current value of DPC_CURRENT, it means that you risk overwriting commands that have not been sent to RDP yet. So in this case, you will need to throttle (wait) for a bit.
5. As soon as the RDP has finished going through the buffer, it will run the pending transfer and thus start from the beginning of the buffer again. After this happens (you can check it with START_PENDING becoming 0), you can freely go through the buffer writing commands, without checking DPC_CURRENT anymore. In fact, at this point we are back to the initial situation in which DPC_START <= DPC_CURRENT <= DPC_END so it is possible to keep writing until the end of the buffer.

In general, the second algorithm is more complex and requires a bit more code to be implemented, but it allows for less throttling and more efficient use of the memory. In fact, in the first scenario, whenever we have filled the available memory (two buffers) and we throttle, we will need to wait until the RDP finishes processing the whole first buffer. In the second scenario, instead, throttling is much reduced because as soon as the RDP processes one command, we get room for one more command to write.

RDP Interface Registers

The RDP interface registers are memory mapped into the VR4300 physical address space starting from 0x0410 0000. Normally, accesses are performed through the virtual uncached segment, so at 0xA410 0000.

The exact same physical registers are also exposed as COP0 registers to RSP itself, and can thus be accessed using the MTC0 / MFC0 opcodes. Since access to all registers is shared by VR4300 and RSP, special care must be taken while writing software to decide who is in charge of each different resource / feature. For instance, normally DMA operations are performed by either the CPU or the RSP only; if the software architecture requires both to issue DMA transfers, some kind of mutex protocol must be established (for instance, using either the SIG bits in the SP_STATUS register, or the SP_SEMAPHORE register).

VR4300 address	RSP COP0 register	Name	Description
0x0410 0000	c8	DPC_START	Start address in RDRAM / DMEM for a DMA transfer of RDP commands
0x0410 0004	c9	DPC_END	End address in RDRAM / DMEM for a DMA transfer of RDP commands (exclusive bound)
0x0410 0008	c10	DPC_CURRENT	Current address in RDRAM / DMEM being transferred by the DMA engine
0x0410 000C	c11	DPC_STATUS	Status register
0x0410 0010	c12	DPC_CLOCK
0x0410 0014	c13	DPC_BUF_BUSY
0x0410 0018	c14	DPC_PIPE_BUSY
0x0410 001C	c15	DPC_TMEM_BUSY

The registers mirror every 0x20 bytes across the whole range 0x0410'0000 - 0x041F'FFFF.

0x0410 0000 (c8) - DPC_START

---

DPC_START 0x0410 0000 (c8)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	START[23:16]
15:8	RW-?	RW-?	RW-?	RW-?	RW-?	RW-	RW-?	RW-?
	START[15:0]
7:0	RW-?	RW-?	RW-?	RW-?	RW-?	U-0	U-0	U-0
	START[7:0]

bit 23-0

START[23:0]: Physical address of the start of the command list in RDRAM or DMEM. When reading, it always returns the last written value.

Extra Details:

START This address points to the beginning of the command list from which RDP commands will be fetched by the DMA. After writing this register, the address is latched into the RDP interface, and the START_PENDING bit in DPC_STATUS becomes 1, but no transfer is started. Writing DPC_END will actually initiate the transfer. Selection of the data source (RDRAM or DMEM) is controller by bit 0 of DPC_STATUS. Writing DPC_START while another value is pending (START_PENDING is 1) will update the pending value. Notice though that this is a risky operation because of races: the pending transfer could in fact start at any point, and if you write a new pending value just before or just after the transfer starts, the behavior will be totally different; in general, it is better to avoid writing DPC_START if START_PENDING is 1.

0x0410 0004 (c9) - DPC_END

---

DPC_END 0x0410 0004 (c9)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	END[23:16]
15:8	RW-?	RW-?	RW-?	RW-?	RW-?	RW-	RW-?	RW-?
	END[15:0]
7:0	RW-?	RW-?	RW-?	RW-?	RW-?	U-0	U-0	U-0
	END[7:0]

bit 23-0

END[23:0]: Physical address of the end of the command list (in RDRAM or DMEM). When reading, it always returns the last written value.

Extra Details:

END This address points to the end of the command list. The address is interpreted as an exclusive bound, so it must point after the last command to transfer. Notice that writing DPC_START=DPC_END is well formed, and will run a perfectly valid zero byte transfer (which can later extended via an incremental transfer).

When DPC_END is written, the RDP does the following:

• If START_PENDING (in DPC_STATUS) is 0, the write is considered an "incremental transfer", so the RDP DMA is programmed to continue the last transfer up to the new value of DPC_END. This works whether the previous transfer is still running or was already finished; in both cases, the transfer is continued/restored until the new DPC_END is reached;
• If START_PENDING (in DPC_STATUS) is 1, the behavior depends on whether a transfer is running or not:
  • if no transfer is running, the new transfer is started (from DPC_START to DPC_END), and START_PENDING goes back to 0.
  • if a transfer is in progress, END_PENDING is set to 1 and the new transfer remains pending and will start as soon as the current transfer is finished. Further writes to DPC_END in this state will simply update the pending transfer's end address.

WARNING: Do not start a DMA transfer or even process any command if you have previously enqueued a SYNC_FULL command. There is a RDP hardware bug that makes RDP sometimes crash if any other command is processed while SYNC_FULL is run. Thus, when you schedule a SYNC_FULL (usually at the end of the frame), it must be the last scheduled command (DPC_END must point immediately after it), and you must wait until the RDP has processed it and got back to fully idle status (BUSY bit goes to 0 in DPC_STATUS), before starting a new DMA transfer, even just an incremental one. It is fine to just write DPC_START though, as that doesn't start a transfer.

0x0410 0008 (c10) - DPC_CURRENT

---

DPC_CURRENT 0x0410 0008 (c10)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CURRENT[23:16]
15:8	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CURRENT[15:0]
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CURRENT[7:0]

bit 23-0

CURRENT[23:0]: Read the current address being transferred by DMA.

Extra Details:

CURRENT This address points after the last command that was transferred by DMA. It is possible to monitor this register to know how far the transfer has gone. In general, it is expected that DPC_START <= DPC_CURRENT <= DPC_END, and thus the portion of the buffer between DPC_START and DPC_CURRENT is free to be recycled for other uses. When a transfer is finished, DPC_CURRENT will always be equal to DPC_END. Notice that when START_PENDING or END_PENDING are 1, reading DPC_START and DPC_END will return the pending values, while reading DPC_CURRENT will always refer to the currently running (or last finished) transfer.

0x0410 000C (c11) - DPC_STATUS

---

DPC_STATUS 0x0410 000C (c11) - Read access
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
15:8	U-?	U-?	U-?	U-?	U-?	R-?	R-?	R-?
	—	—	—	—	—	START_PENDING	END_PENDING	DMA_BUSY
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CBUF_READY	CMD_BUSY	PIPE_BUSY	TMEM_BUSY	GCLK	FLUSH	FREEZE	XBUS

bit 10	START_PENDING: Set if DPC_START was written and the value is still pending because DPC_END was not written yet, or another transfer is in progress (see DPC_START and DPC_END).
bit 9	END_PENDING: Set if DPC_END was written and the value is still pending because another transfer is in progress (see DPC_END)
bit 8	DMA_BUSY: ?
bit 7	CBUF_READY: ?
bit 6	CMD_BUSY: 1 while the RDP is processing a command, 0 when it is idle. See the DPC_CMD_BUSY register for more information.
bit 5	PIPE_BUSY: Becomes 1 as soon as a DMA transfer starts, and stays to 1 until a SYNC_FULL command is run. See the DPC_PIPE_BUSY register for more information.
bit 4	TMEM_BUSY: 1 while the RDP is loading bytes to TMEM, 0 when it is idle (or stalled for RDRAM). See DPC_TMEM_BUSY for more information.
bit 3	GCLK: This bit is the main gated clock for the whole RDP pipeline; when it is 0, the pipeline is paused. The RDP stops this clock any time it is stalled for RDRAM. In other words, it behaves similar to PIPE_BUSY, but it also goes to zero any time the RDP is stalled for RDRAM.
bit 2	FLUSH: While set, all RDP transfers in progress or started are immediately terminated
bit 1	FREEZE: While set, RDP will stop processing commands
bit 0	XBUS: 0: DMA transfer source is XBUS; 1: DMA transfer source is DMEM

DPC_STATUS 0x0410 000C (c11) - Write access
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
15:8	U-?	U-?	U-?	U-?	U-?	U-?	W-?	W-?
	—	—	—	—	—	—	CLR_CLOCK	CLR_BUFFER_BUSY
7:0	W-?	W-?	W-?	W-?	W-?	W-?	W-?	W-?
	CLR_PIPE_BUSY	CLR_TMEM_BUSY	SET_FLUSH	CLR_FLUSH	SET_FREEZE	CLR_FREEZE	SET_XBUS	CLR_XBUS

bit 9	CLR_CLOCK: Reset DPC_CLOCK to zero.
bit 8	CLR_BUFFER_BUSY: Reset DPC_BUSY to zero.
bit 7	CLR_PIPE_BUSY: Reset DPC_PIPE_BUSY to zero.
bit 6	CLR_TMEM_BUSY: Reset DPC_TMEM_BUSY to zero.
bit 5	SET_FLUSH: Set the FLUSH bit to 1
bit 4	CLR_FLUSH: Clear the FLUSH bit to 0
bit 3	SET_FREEZE: Set the FREEZE bit to 1
bit 2	CLR_FREEZE: Clear the FREEZE bit to 0
bit 1	SET_XBUS: Set the XBUS bit to 1
bit 0	CLR_XBUS: Clear the XBUS bit to 0

Extra Details:

FREEZE During freeze, the RDP DMA engine is suspended (paused). If a transfer was ongoing, it is paused and will resume as soon as the freeze bit is reset to 0. During the freeze, it is still possible to write DPC_START or DPC_END, and the writes will still affect the START_PENDING / END_PENDING bits, but no transfer will be initiated.

FLUSH While FLUSH is set, all DMA transfers are instantly terminated (flushed). Pulsing the FLUSH bit is a good way to force-reset the RDP DMA engine and make sure the RDP is ready to initiate a new transfer.

BUSY This bit seems to refer to a more general state of RDP, which is not related to actually performing any task. When the bit is 0, the RDP is like "turned off". As long as a single command is sent to RDP, this bit goes to 1 and will stay there even if after that single command, you wait for seconds, far beyond the actual execution time of that command. It looks like the RDP is now "turned on". To turn it off again, the only known way is sending a SYNC_FULL. After processing a SYNC_FULL, the BUSY bit goes back to 0 again.

0x0410 0010 (c12) - DPC_CLOCK

---

DPC_CLOCK 0x0410 0010 (c12)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CLOCK[23:16]
15:8	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CLOCK[15:0]
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CLOCK[7:0]

bit 23-0

CLOCK[23:0]: 24-bit counter running at RCP frequency

Extra Details:

CLOCK This register accesses a read-only 24-bit clock that runs at the RCP frequency (which is 62.5 Mhz on standard N64, and 96 Mhz on iQue). The counter starts ticking from boot and does not stop (not even if you freeze the RDP via the `FREEZE` bit in `DPC_STATUS`). The only possible interaction from the CPU/RSP is to reset it to 0 by writing the `CLR_CLOCK` bit in `DPC_STATUS`. Being the only counter available directly from RSP, it can be useful to perform benchmarks on it.

0x0410 0014 (c13) - DPC_CMD_BUSY

---

DPC_CMD_BUSY 0x0410 0014 (c13)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CMD_BUSY[23:16]
15:8	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CMD_BUSY[15:8]
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	CMD_BUSY[7:0]

bit 23-0

CMD_BUSY[23:0]: 24-bit counter of actual RDP command activity at RCP frequency

Extra Details:

CMD_BUSY This register accesses a read-only 24-bit clock that counts up any RCP cycle in which the internal RDP command FIFO is not empty. The FIFO is filled via RDP DMA with new commands, and is flushed as commands get executed, so this counter is the closest thing to a "RDP activity counter". This counter is connected to the CMD_BUSY bit in DPC_STATUS, so it basically counts how many cycle that bit is set to 1.

0x0410 0018 (c14) - DPC_PIPE_BUSY

---

DPC_PIPE_BUSY 0x0410 0018 (c14)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	PIPE_BUSY[23:16]
15:8	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	PIPE_BUSY[15:0]
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	PIPE_BUSY[7:0]

bit 23-0

PIPE_BUSY[23:0]: 24-bit counter of RDP pipeline activation time at RCP frequency

Extra Details:

PIPE_BUSY This register accesses a read-only 24-bit clock that counts up only in the intervals of time between the first command being received via RDP DMA, and the subsequent SYNC_FULL command. Basically, this counter shows the RDP activity "gross time", because it keeps counting even if the RDP has nothing to do, until SYNC_FULL is received. This counter is connected to the PIPE_BUSY bit in DPC_STATUS, so it basically counts how many cycle that bit is set to 1.

0x0410 001C (c15) - DPC_TMEM_BUSY

---

DPC_TMEM_BUSY 0x0410 001C (c15)
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	TMEM_BUSY[23:16]
15:8	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	TMEM_BUSY[15:0]
7:0	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	TMEM_BUSY[7:0]

bit 23-0

TMEM_BUSY[23:0]: 24-bit counter of RDP TMEM activity time

Extra Details:

TMEM_BUSY This register accesses a read-only 24-bit clock that counts up any RCP cycle in which the RDP is loading the TMEM. Notice that the counter is stopped during cycles in which the RDP is stalled for RDRAM, so it is basically a "net" texture loading time. This counter is connected to the TMEM_BUSY bit in DPC_STATUS, so it basically counts how many cycle that bit is set to 1.

0x0420 0000 - DPS_TBIST

---

DPS_TBIST 0x0420 0000
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
15:8	U-?	U-?	U-?	U-?	U-?	R-?	R-?	R-?
	—	—	—	—	—	FAIL[7:5]
7:0	R-?	R-?	R-?	R-?	R-?	RW-?	RW-?	RW-?
	FAIL[4:0]					DONE	GO	CHECK

bit 10-3	FAIL[7:0]: ?
bit 2	DONE: ?
bit 1	GO: ?
bit 0	CHECK: ?

0x0420 0004 - DPS_TEST_MODE

---

When Reading:

DPS_TEST_MODE 0x0420 0004
31:24	U-0	U-0	U-0	U-0	R-?	R-?	R-?	R-?
	0				cspan0[3:0]
23:16	R-?	R-?	R-?	R-?	R-?	R-?	R-?	R-?
	cspan1[3:0]				zspan0[3:0]
15:8	R-?	R-?	R-?	R-?	U-?	U-?	U-?	U-?
	zspan1[3:0]				?	?	?	?
7:0	U-1	U-?	U-?	U-?	U-?	U-1	U-?	R-1
	1	?	?	?	?	1	?	TEST_ENABLE

bit 31-28	0: Always 0?
bit 27-24	cspan0[3:0]: Color span counter? Increments (and potentially overflows) based on how many 16-byte segments a drawn primitive covers.
bit 23-20	cspan1[3:0]: Color span counter? Synced with the other counter; if the other counter has the msbit unset this one has it set and vice-versa.
bit 19-16	zspan0[3:0]: Depth span counter? Increments (and potentially overflows) based on how many 16-byte segments a drawn primitive covers, only when depth read or write is enabled.
bit 15-12	zspan1[3:0]: Depth span counter? Synced with the other counter; if the other counter has the msbit unset this one has it set and vice-versa.
bit 7	1: Always 1?
bit 2	1: Always 1?
bit 0	TEST_ENABLE: Whether span buffer testing is enabled.

When Writing:

DPS_TEST_MODE 0x0420 0004
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
23:16	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
15:8	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—	—	—	—	—	—	—	—
7:0	U-?	U-?	U-?	U-?	U-?	U-?	U-?	W-1
	—	—	—	—	—	—	—	TEST_ENABLE

bit 0

TEST_ENABLE: Enables span buffer test access via DPS_BUFTEST_ADDR and DPS_BUFTEST_DATA. Warning: If the span test mode is used the RDP should be idle, else the RDP may hang.

0x0420 0008 - DPS_BUFTEST_ADDR

---

DPS_BUFTEST_ADDR 0x0420 0008
31:24	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—
23:16	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—
15:8	U-?	U-?	U-?	U-?	U-?	U-?	U-?	U-?
	—
7:0	U-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	—	ADDRESS[6:0]

bit 6-0

ADDRESS[6:0]: Sets the span buffer word address that DPS_BUFTEST_DATA will read from or write to.

Span buffers are 288 bytes of memory while a 7-bit word index can address up to 512 bytes; when some addresses are read/written with DPS_BUFTEST_DATA some bits are fixed to 0. The span buffer data is arrayed such that 72 bits are accessed over 4 word addresses. The data layout is shown below. The first two columns can contain color/depth/texture data while the third column can contain coverage. The first half of the rows up to 0x40 only hold color data while the second half of the rows from 0x40 onwards hold depth and texture data. Texture data is held in spans as it is loaded from RDRAM before being shuffled into TMEM.

    |        0        1        2        3
----+------------------------------------
  0 | XXXXXXXX XXXXXXXX 000000XX 00000000
  4 | XXXXXXXX XXXXXXXX 000000XX 00000000
  8 | XXXXXXXX XXXXXXXX 000000XX 00000000
  C | XXXXXXXX XXXXXXXX 000000XX 00000000
 10 | XXXXXXXX XXXXXXXX 000000XX 00000000
 14 | XXXXXXXX XXXXXXXX 000000XX 00000000
 18 | XXXXXXXX XXXXXXXX 000000XX 00000000
 1C | XXXXXXXX XXXXXXXX 000000XX 00000000
 20 | XXXXXXXX XXXXXXXX 000000XX 00000000
 24 | XXXXXXXX XXXXXXXX 000000XX 00000000
 28 | XXXXXXXX XXXXXXXX 000000XX 00000000
 2C | XXXXXXXX XXXXXXXX 000000XX 00000000
 30 | XXXXXXXX XXXXXXXX 000000XX 00000000
 34 | XXXXXXXX XXXXXXXX 000000XX 00000000
 38 | XXXXXXXX XXXXXXXX 000000XX 00000000
 3C | XXXXXXXX XXXXXXXX 000000XX 00000000
 40 | XXXXXXXX XXXXXXXX 000000XX 00000000
 44 | XXXXXXXX XXXXXXXX 000000XX 00000000
 48 | XXXXXXXX XXXXXXXX 000000XX 00000000
 4C | XXXXXXXX XXXXXXXX 000000XX 00000000
 50 | XXXXXXXX XXXXXXXX 000000XX 00000000
 54 | XXXXXXXX XXXXXXXX 000000XX 00000000
 58 | XXXXXXXX XXXXXXXX 000000XX 00000000
 5C | XXXXXXXX XXXXXXXX 000000XX 00000000
 60 | XXXXXXXX XXXXXXXX 000000XX 00000000
 64 | XXXXXXXX XXXXXXXX 000000XX 00000000
 68 | XXXXXXXX XXXXXXXX 000000XX 00000000
 6C | XXXXXXXX XXXXXXXX 000000XX 00000000
 70 | XXXXXXXX XXXXXXXX 000000XX 00000000
 74 | XXXXXXXX XXXXXXXX 000000XX 00000000
 78 | XXXXXXXX XXXXXXXX 000000XX 00000000
 7C | XXXXXXXX XXXXXXXX 000000XX 00000000

0x0420 000C - DPS_BUFTEST_DATA

---

DPS_BUFTEST_DATA 0x0420 000C
31:24	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	DATA[31:24]
23:16	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	DATA[23:16]
15:8	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	DATA[15:0]
7:0	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?	RW-?
	DATA[7:0]

bit 31-0

DATA: Reading from this register reads the span buffer data at the current DPS_BUFTEST_ADDR. Writing to this register sets the span buffer data at the current DPS_BUFTEST_ADDR to the write value.

This register requires span buffer test access to be enabled in DPS_TEST_MODE_REG to be functional.