The CSR Field-Table Index

This is the consolidated, grep-friendly CSR reference for the Cayman (NC-v3) GPSIMD / Vision-Q7 SoC — the lookup companion to the twenty narrative CSR pages under ../control/csr/. Where each narrative page reasons about one register block in depth (semantics, boot contract, cross-gen drift), this appendix is a flat per-register / per-bitfield table across every block: block → register/bundle → offset → field → bit-range → access-type → reset → one-line meaning. It is deliberately terse and one-bitfield-per-row where it matters, so a reimplementer can rg for a register name and land on its offset, width, and reset in one hop.

Everything here is byte-grounded in the shipped, RTL-generated cayman-arch-regs CSR JSON schemas (csrs/<sub>/<unit>.json) and their cross-gen arch-headers copies — binary-derived register descriptors, citeable as static-analysis artifacts. Every offset, width, and reset below was re-read from the JSON with jq by absolute path. No vendor source tree was consulted; the schemas are the binary. Confidence tags are HIGH/MED/LOW × OBSERVED/INFERRED/CARRIED; callouts are QUIRK / GOTCHA / NOTE / CORRECTION.

How to read this page. Each block section opens with a one-line identity (UnitName, SizeInBytes, InterfaceType, bundle/reg/field counts) and a link to its narrative page, then a row-per-bitfield index of its primary registers. Absolute register offset = bundle.AddressOffset + register.AddressOffset (+ the per-instance ArraySize stride for arrayed bundles — §1). The SoC-absolute address is that offset plus the block's leaf base from the block→schema xref and the unified SoC memory map. Literal | inside a cell is escaped \|.

Related (read these for the why): the 20 narrative CSR pages (§3 index), the block→schema join block-schema-xref.md, the unified region table unified-soc-memory-map.md, and the per-gen applicability matrix master-capability-matrix.md.

1. Schema conventions — the JSON shape and the join [HIGH · OBSERVED]

Every CSR schema is one RegFile object. The nesting and the keys a reimplementer parses are fixed across all 76 referenced schemas:

RegFile { UnitName, Type="REGFILE", RegfileFlavor, InterfaceType, AddrWidth,
          DataWidth, SizeInBytes, Parameters[], Memories[], RegistersBundleArrays[] }
  RegistersBundleArrays[] { Name, AddressOffset, ArraySize, BundleSizeInBytes, GenFlavor, Registers[] }
    Registers[] { Name, AddressOffset, AccessType, BitFields[] }
      BitFields[] { Name, Position("hi:lo" | "N"), AccessType, ResetValue, Description, SpecialAccess }

1a. AddressOffset is relative to the bundle base

A register's AddressOffset is relative to its bundle's AddressOffset. For an arrayed bundle (ArraySize > 1) the per-instance base advances by BundleSizeInBytes:

abs_off(reg, i) = bundle.AddressOffset + i*BundleSizeInBytes + reg.AddressOffset   // i in 0..ArraySize-1

BitFields[].Position is a single bit ("4") or an inclusive range ("31:0") — not BitOffset/BitWidth. The reset key is literally ResetValue (a hex string); a .Reset lookup returns null for every field. Field access lives on the BitField, not the register — the register-level AccessType is frequently RW while the bitfield is RO/WO (e.g. nsm.control.report, tpb_events_semaphores_axi op windows). Always read access from the bitfield.

1b. GOTCHA — the hex-vs-decimal BundleSizeInBytes (and SizeInBytes) radix trap

GOTCHA [HIGH · OBSERVED]. AddressOffset is always a hex string. But BundleSizeInBytes and SizeInBytes are per-file mixed radix — hex ("0x100") in most blocks, bare decimal ("256", "64") in several. Concrete failure mode: udma_m2s.AXI_M2S_MLA.BundleSizeInBytes = "256". Read as hex (strtol(...,16) → 0x256 = 598) the very next bundle (AXI_M2S @ 0x100) lands inside the first bundle's span and every queue past M2S_Q[0] is mislaid. The truth is decimal 256 = 0x100, which lands AXI_M2S exactly at the bundle boundary. The same trap closes the intc_4grp_msix aperture: MSIX_Vector_Table_Space.BundleSizeInBytes = "16" (decimal) gives 0x800 + 128×16 = 0x1000 == SizeInBytes; read as hex (0x16=22) it overflows to 0x1300. Radix census (re-derived):

Second-order trap — AddressOffset itself is decimal in two files. fis_control and rdm_model use decimal register AddressOffsets (fis_control bundle bases 0,24,40,48,76,120,140; rdm_model queue_size_0 @ "32" = 0x20). Parse AddressOffset per-file, not globally as hex. [HIGH · OBSERVED]

1c. ArraySize is a per-instance stride — and may be a symbolic parameter

ArraySize replicates a bundle's register set N times at BundleSizeInBytes stride. It is often a literal ("40", "16") but is sometimes a parameter name resolved from Parameters[]: notific_nq.ArraySize = "NUM_SW_Q" → Parameters[NUM_SW_Q].Value = "10"; intc_4grp.ctrl.ArraySize = "INTC_NUM_GROUPS" → 4; intc_msix.MSIX_Vector_Table_Space.ArraySize = "NUM_OF_TRIGS" → hardcoded 128. A parser that treats ArraySize as always-numeric crashes on the symbolic forms. The ap_intc wrappers go further — their SizeInBytes / AddrWidth are unevaluated expression strings ("0x40*INTC_NUM_GROUPS", "log2(0x40*INTC_NUM_GROUPS)") that a downstream generator resolves. [HIGH · OBSERVED]

1d. The block → schema → address join

A block name resolves to an absolute SoC address in three hops, joining the CSR lane (this appendix, "what the registers are") to the ADDR lane ("where they live"):

(1) block leaf name      e.g.  TPB_0_POOL_LOCAL_REG
        │  block-schema-xref.md  (json: key in the flat YAML, basename = join key)
        ▼
(2) schema basename      e.g.  tpb/tpb_xt_local_reg.json   →  the field tables on THIS page
        │  unified-soc-memory-map.md / soc-master-map.md (leaf base from the flat YAML)
        ▼
(3) SoC-absolute address e.g.  0x2803060000 + 0x3000 + 0x0  =  0x2803063000  (q7 run-stall doorbell)

The forward bind is the flat YAML's inline json: key (present on 19,012 of 34,858 nodes; absence = pure memory / reserved / container — not a missing-schema error). The same schema basename binds many leaves (tpb_xt_local_reg.json binds 84 across TPB/TOP_SP/PEB_SP/PREPROC), so one row here describes dozens of physical instances. SoC-absolute math, end to end, is worked in unified-soc-memory-map.md §2; the binding census and the reverse index are in block-schema-xref.md.

GOTCHA — PEB-plane bit-53. Privileged leaves live on the PEB_APB_IO* plane whose absolute bases carry bit 53 (0x20000000000000); the die-1 copy ORs bit 47 (0x800000000000). A block's schema offsets (this page) are identical on both planes — only the leaf base moves. [HIGH · OBSERVED]

2. The "20 CSR blocks" reconciliation [HIGH · OBSERVED]

CORRECTION / SCOPE — "20 CSR blocks" = the 20 narrative CSR pages, NOT 20 schemas. fd over ../control/csr/ returns exactly 20 .md pages (re-counted this session). They do not map 1:1 to 20 schema JSONs — they document the register surfaces grouped by subsystem, and several pages cover many schemas at once. The 20 pages collectively byte-document 65 of the 85 on-disk schemas (the other 20 are peripheral residual — clock/PLL, PVT, I2C/SPI/GPIO, OTP, DFT, ring, URB, APB bridge — see notific-sdma-residual.md §4). The "20 blocks" headline reproduces against the page count, not a schema count. Mapping each page to its schema(s):

All 20 link paths were confirmed to resolve on disk this session. The schema count is the 85/76/65 ledger of notific-sdma-residual.md §4; the page count is 20.

3. The consolidated field-table index

Grouped by block. Each block names its schema, window, interface, and (bundles/regs/fields), then indexes its primary registers. Offsets are absolute within the regfile window (bundle base + register offset) unless a row is inside an arrayed bundle, where the per-instance stride is noted.

3.1 tpb_xt_local_reg — per-engine NX + 8×Q7 control [HIGH · OBSERVED]

Schema tpb/tpb_xt_local_reg.json · 0x10000 (64 KiB) · APB · 7 bundles / 55 regs / 84 fields · every reg+field RW, every SpecialAccess=None. Bound 84× (TPB×40, TOP_SP×20, PEB_SP×20, PREPROC×4) — the canonical shared Q7/SP IP. Page: tpb-xt-local-reg.md.

Bundle map: nx@0x0000(arr 1), general@0x1000(arr 60, stride 0x20), window@0x2000(arr 40, stride 0x1C), q7@0x3000(arr 1), hw_decode@0x4000(arr 1), tensor_replace@0x5000(arr 32, stride 0x20), notific@0x6000(arr 1).

NOTE — per-gen. v4/v5 (mariana/mariana_plus/maverick) append 4 atomic-op bundles (atomic_rdwr/inc/dec/addiff0 @0x8000–0x8FFF, each arr 64) → 59 regs / 88 fields; all 7 Cayman bundles are byte-identical at the same offsets. Sunda/Tonga: schema not shipped (INFERRED present). [HIGH · OBSERVED v3/v4/v5]

3.2 tpb — top-level cluster datapath + event routing [HIGH · OBSERVED]

Schema tpb/tpb.json · 0x1000 (4 KiB) · APB · 9 bundles / 146 regs / 185 fields · bound 16×. Page: tpb.md. Bundles: pe_sequencer@0x000, pool_sequencer@0x100, act_sequencer@0x200, dve_sequencer@0x300, events_semaphores@0x800, notific@0xA00, misc@0xB00, performance_counter@0xC00, intc_bypass@0xE00 (all arr 1).

NOTE — gen-specific shape. tpb.json is re-spun per gen: sunda 8 bundles/136 regs, cayman 9/146/185, mariana 12/168. v5 (maverick) restructures to tpb_top.json (+tpb_dve). [HIGH · OBSERVED v2/v3/v4; v5 INFERRED]

3.3 PE-array sequencer (host-visible / cluster / protected) [HIGH · OBSERVED]

Schemas tpb/tpb_arr_seq_top_host_visible.json (7 bundles / 305 regs / 308 fields; 299 RO / 6 RW; 1 PulseOnW), tpb_arr_seq_cluster_host_visible.json (3/17), tpb_arr_seq_top_protected.json (1/1). All 0x1000 · APB · bound 16/16/8×. Page: pe-array-sequencer.md.

CORRECTION (carried from #pe-array-sequencer §4). Per-tile counters are 48-bit (lsb[31:0] + msb[15:0]), NOT 64-bit; reconstruct ((u64)(msb&0xFFFF)<<32)|lsb. The "go"/matmul launch is not a CSR — work enters via the micro-op IFIFO. [HIGH · OBSERVED]

3.4 TPB sub-blocks — SBUF / EVT_SEM / HAM [HIGH · OBSERVED]

Page: tpb-subblocks.md.

tpb/tpb_sbuf_cluster.json (0x1000, 5/10, bound 64×) — 2-stage SBUF port arbiter:

tpb/tpb_sbuf_pool_act.json (0x1000, 4/16, bound 16×) — POOL/ACT/DVE token-bucket throttlers (rd/wr_throttle_cfg0.disable_throttle[0] reset 0x1 = OFF; cfg1.window_len[7:0]/transfer_cnt[23:16]).

tpb/tpb_events_semaphores_axi.json (0x100000 = 1 MiB, 5 bundles arr 256 stride 0x4, IF=APB despite _axi name) — 256 events + 256 semaphores, op-aliased windows:

NOTE — EVT_SEM ResetValue is bare "0" (no 0x) for this file only; the threshold/notify control lives in tpb.json events_semaphores@0x800 (§3.2). The container is bound only via address arithmetic on Cayman (schema is an orphan — §2). [HIGH · OBSERVED]

tpb/tpb_ham.json (0x1000, 7/30, bound 8×) — PE-array power/di-dt governor:

QUIRK — tpb_ham_table.ctrl name↔description swap. Bit [28] named rd_en but described "Write enable"; bit [29] named wr_en but described "Read enable". Schema bug — pin by the description (which matches the entry_wr/entry_rd dataflow) and verify against silicon. [HIGH · OBSERVED]

3.5 udma_m2s — outbound descriptor engine [HIGH · OBSERVED]

Schema sdma/udma_m2s.json · 0x20000 (SizeInBytes="131072" DECIMAL) · APB · 11 bundles / 100 regs / 325 fields · M2S_Q arr 16 stride 0x1000 · bound 280×. Page: udma-m2s.md. GOTCHA: BundleSizeInBytes is decimal here.

NOTE — per-gen. Cayman == Mariana == Mariana+ (11/100/325). Sunda drops AXI_M2S_MLA, enhanced_ostand_cfg, TDRDTP_inc/TDRDTP → 10/94/316 (the 6-reg NC-v3 delta). v5 INFERRED (no schema). [HIGH · OBSERVED]

3.6 udma_s2m — inbound descriptor engine [HIGH · OBSERVED]

Schema sdma/udma_s2m.json · 0x18000 (SizeInBytes="98304" DECIMAL) · InterfaceType=NONE (M2S is APB) · 8 bundles / 73 regs / 264 fields · S2M_Q arr 16 stride 0x1000 · bound 280×. Page: udma-s2m.md. Mirror of M2S minus the 4 egress-shaping bundles, plus S2M_wr.

GOTCHA — S2M_Q.BundleSizeInBytes="4096" DECIMAL (= 0x1000). Hex-read (0x4096) puts Q[15]@0x3d8ca outside the 0x18000 window. [HIGH · OBSERVED]

3.7 udma_gen / udma_gen_ex / tdma_model — shared SDMA control [HIGH · OBSERVED]

Schemas sdma/udma_gen.json (0x4000, 22/69, BundleSizeInBytes DECIMAL, bound 280×), sdma/udma_gen_ex.json (0x4000, 5/29, decimal BSIB, bound 280×), sdma/tdma_model.json (0x1000, 8/44, hex BSIB, bound 264× — no broadcast mirror). Page: udma-gen-tdma.md.

3.8 notific_10_queue / notific_1_queue [HIGH · OBSERVED]

Schemas notific/notific_10_queue.json (0x1000, 2/41+6, bound 332×) and notific/notific_1_queue.json (byte-identical bundles, NUM_SW_Q=1, bound 962× — all ERRTRIG sinks). notific_nq arr NUM_SW_Q stride 0x28. Pages: notific-queue.md, notific-sdma-residual.md.

NOTE. Nine interrupts tpb_notific_intr_0..8; the 16-byte wire record + notific_type enum live on the narrative page. Variant diff = only NUM_SW_Q (1 vs 10) + SW_Q_RESET_TO_ALL_1 (1 vs 1023). [HIGH · OBSERVED]

3.9 intc_4grp / intc_1grp / ap_intc [HIGH · OBSERVED]

Schemas intc/intc_4grp_{no_msix,msix}_unit.json (0x1000, APB, bound 1070/858×), intc/intc_1grp_{no_msix,msix}_unit.json (= 4grp at INTC_NUM_GROUPS=1; only 1grp_msix placed, 4×), ap_intc/* (MEM IOFIC, all orphans). ctrl arr INTC_NUM_GROUPS stride 0x40. Pages: intc-4group.md, intc-1group-apintc.md. Per-group register bank (abs = g*0x40 + rel):

msix-only tail: Sunda.MSIX_TC@0x3E0[2:0]; PBA@0x3F0 (arr 4, BSIB 4 dec); VecTable@0x400 (arr 4, BSIB 0x100, nests Val arr 32 BSIB 8 dec); MSIX_Vector_Table_Space@0x800 (arr NUM_OF_TRIGS=128, BSIB 16 dec). ap_intc_grp_ctrl (9 regs, MEM/NONE) differs: drops int_cdc_bypass/int_error_msk/int_posedge, and int_mask_grp resets to 0 (UNMASKED) — the reverse of APB intc.

QUIRK — ap_intc boots UNMASKED (int_mask_grp reset 0 vs APB 0xffffffff). Firmware must mask before enabling sources. GOTCHA — 1grp_msix over-provisions the MSI-X table at 128 entries even though only 32 cause bits are live. [HIGH · OBSERVED]

3.10 fis_control / papb_bcast — FIS control + errtrig [HIGH · OBSERVED]

Schemas fis/fis_control.json (0x2000, decimal offsets, AMZN-only, bound 582×), fis/papb_bcast.json (0x800, USER, bound 464×). errtrig = intc_4grp PAIR + notific_1_queue. Page: fis-errtrig-spad.md.

GOTCHA — fis_control uses DECIMAL AddressOffsets (bundle bases 0,24,40,48,76,120,140), the lone exception being the hex SizeInBytes="0x2000". Read perf_snapshot_lo_0 @28 as decimal 28, not 0x28. [HIGH · OBSERVED]

3.11 nsm — AXI network-security monitor [HIGH · OBSERVED]

Schema sprot/nsm.json · 0x1000 · APB · 4 bundles / 50 regs / 74 fields · bound 220×. Page: nsm.md. Bundles control@0x000, wr@0x100, rd@0x200, spare@0x900. Register offsets are mixed-radix (decimal control.bypass@4, hex thereafter).

QUIRK — verbatim typo isolatio_sm_nsm_axi_timeout_detected (missing n) in the pcie trigger YAML, index [11]. A symbol-table-faithful rebuild reproduces it. [HIGH · OBSERVED]

3.12 qos_prot — FIS QoS shaper + NTS [HIGH · OBSERVED]

Schema sprot/qos_prot.json · 0x1000 · APB · 5 bundles / 74 regs / 192 fields · 15 PulseOnW · all-hex sizes · bound 1500× (secure-only). Page: qos-prot.md. Bundles csr@0x000, nts_amzn@0x400, wr_serializer@0x500, nts_isolation@0x600, spare_amzn@0x7F0.

3.13 qos_pmu / qos_host_visible — FIS QoS observe surfaces [HIGH · OBSERVED]

Schemas sprot/qos_pmu.json (0x800, 1 bundle csr, 146/154, RW-dominant profiler, bound 528×) and sprot/qos_host_visible.json (0x800, 3 bundles, 64/67, RO-dominant monitor, bound 1208×). All-hex sizes. Page: qos-pmu-hostvisible.md.

3.14 amzn_remapper / user_remapper — FIS address/ID firewall [HIGH · OBSERVED]

Schemas sprot/amzn_remapper.json (0x1000, 10/87/134, privileged, bound 712×) and sprot/user_remapper.json (0x800, 4/28/45, guest, bound 528×). Page: remapper.md. CAM = 6-word/192-bit indirect entry.

WALL — never invert pass_on_miss. amzn→fail-open removes the firmware whitelist; user→fail-closed deadlocks every un-provisioned guest. Frozen Sunda=Cayman=Mariana. The remapper DECIDES; qos_prot NTS RESPONDS (SLVERR + 0xDEADBEEF). [HIGH · OBSERVED]

3.15 rdm_model / top_sp_ram — RDM + TOP_SP config [HIGH · OBSERVED]

Schemas rdm/rdm_model.json (0x1000, 1 bundle, 236/242, decimal offsets, bound 4×) and top_sp/top_sp_ram.json (0x1000, 1 bundle, 8/11, hex offsets, bound 40×). Page: rdm-top-sp.md. Per-queue RDM block = 9 regs × 24 queues, 36-byte stride (decimal i*36).

3.16 HBM / D2D / PCIe blocks [HIGH · OBSERVED]

Page: hbm-d2d-pcie-blocks.md. GenFlavor=EXTERNAL_IP on bought vendor IP, null on Amazon glue/RAS. All-hex sizes (decimal SizeInBytes recurs only in Mariana's hbm_xbar_port_hbm). Representative control registers (full 41k-field PHY dumps are out of scope — these are the control/init/RAS/link-state anchors):

GENERATION WALL. This block is Cayman/NC-v3 (DWC-PCIe + Marvell-XSR D2D, 16-channel HBM via hbm_cfg.hbm_ctrl_debug arr 16). The Maverick siblings'32 HBM_CTRL_DP / 8×32 XBAR / 39 UCIE links / 128 GiB are v5 — do not read them as Cayman. [HIGH · OBSERVED]

3.17 xtensa_q7 / xtensa_nx — Cadence debug/trace/PMU/OCD [HIGH · OBSERVED]

Schemas xtensa_q7/xtensa_q7.json (0x4000, 5 bundles, 78/296, bound 80×) and xtensa_nx/xtensa_nx.json (0x4000, 5 bundles, 73/275, bound 60×). Both APB, AddrWidth 14. NX = Q7 minus 5 registers (DIR4..7, FAULTINFOHI) plus 1 reset delta (TRAXID.CFGID). Pages: xtensa-q7.md, xtensa-nx.md. Bundles Trax@0x0000, Performance_Monitor@0x1000, OCD@0x2000, Miscellaneous@0x3000, CoreSight@0x3F00.

NOTE — 8 placeholder 0xb1 resets on both cores (ITCTRL/CLAIMSET/…/DEVTYPE) reuse the Component_ID3=0xB1 byte = generator default, LOW confidence on those resets (offsets/names HIGH). The 9th 0xb1 is the legitimate Component_ID3. [HIGH offsets · LOW those resets]

4. Per-gen CSR applicability — which rows are Cayman-only [HIGH · OBSERVED / where flagged INFERRED]

The block→schema xref's three-way partition (44 SHARED basenames + 32 Cayman-only) plus the per-block cross-gen sections of the narrative pages give the applicability for every block above. Flag where the JSON is header-OBSERVED only (Maverick interior) vs byte-grounded.

NOTE — SUNDA-retired / v5-only rows, INFERRED where header-OBSERVED. SUNDA-retired: nts_isolation (qos_prot), txn_len_chk (amzn_remapper), dve_throttler (sbuf_pool_act), tpb_ham_notifi, the NC-v3 prefetch regs (AXI_M2S_MLA/TDRDTP). v5/Maverick-only (the JSON is header-OBSERVED, interior INFERRED): ap_intc_8grp_msix_unit, int_sec_grp/int_regs_sec_grp SWOM, SEMAPHORE_CNTR_INC EVT_SEM port, tpb_fab_remap*, the H-die hdie_spad. Every Maverick interior behavioral claim is [INFERRED]; the Cayman field tables are [HIGH · OBSERVED].

5. Verification ledger (this session)

The five strongest claims re-challenged directly against the JSON before authoring — all pass:

Supporting checks: udma_s2m SizeInBytes="98304" (= 0x18000) + IF=NONE; gpio/pvt SizeInBytes decimal "4096"/"65536"; rdm_model queue_size_0 AddressOffset="32" (= 0x20, decimal); xtensa_q7 AddrWidth=14 SizeInBytes=0x4000 IF=APB. All 20 ../control/csr/*.md cross-links and the ../control/address/{block-schema-xref,unified-soc-memory-map}.md links confirmed resolvable on disk.

[HIGH · OBSERVED] — every offset/width/reset/access row above (re-read from the schema JSON); the 20-page count and the page→schema map; the radix taxonomy; the symbolic-ArraySize resolution; the block→schema→address join math. [MED · INFERRED] — the SoC-absolute leaf bases (carried from the ADDR-lane pages, family-level not per-leaf-grepped here); the per-gen "additive vs restructured" readings. [INFERRED] — all Maverick / NC-v5 interior behavior (the JSON is header-OBSERVED only; no v5 register schema ships for most blocks; the byte-grounded behavioral reference is the Cayman schema).

NOTE. Nothing here is fabricated and no vendor source snapshot was consulted. Every offset, width, reset, and binding traces to the shipped cayman-arch-regs CSR JSON / arch-headers copies, parsed this session (lawful interoperability reverse engineering, DMCA 17 U.S.C. §1201(f)).

See also

• The 20 narrative CSR pages (§2 index) — the why behind every row here.
• block-schema-xref.md — the block→schema bind (the join's hop 1→2).
• unified-soc-memory-map.md — the SoC-absolute region table (hop 2→3).
• soc-master-map.md — the full 126-root / 34,858-node chip map.
• master-capability-matrix.md — the per-gen CSR applicability of every block.