First of all, I did one minor error in the previous episode: I reset the VP1 unit on every test, causing the $c registers to be cleared every time (rememeber we have no means of setting it arbitrarily). Allowing them to keep the old value between tests reveals that all 0x60-0x7f operands that we though to be NOPs in fact clear the destination $c register (if any) scalar flags to 0.
Given that we now have a simple and reliable way of executing a single instruction, it's time to start using automated testing to verify we got the semantics right.
Back in the beginning, we did a register scan and noticed two sets of registers that, by default, have values strangely similiar to the NOP encodings for the 4 execution units:
In the last episode we had a brief look at the nv44 mthd microcode - the only thing it did was handling the DMA object setting methods. The nv50 version of this microcode is even simpler - only method 0 is handled.
Time to think about the data store a bit. The d0/d2/d4/d6 opcodes are very likely just ld/st instructions targetting it. However, the channel switch sequence is supposed to read/write the context DMA object, and the VP architecture diagram shows a line connecting the data store to the memory interface. This means we should likely be looking for a way to launch a bulk transfer between the data store and the VM. Obviously, this should be done by the unknown instructions at the start and end of the channel switch sequences.