diff --git a/src/freedreno/.gitlab-ci/reference/afuc_test.asm b/src/freedreno/.gitlab-ci/reference/afuc_test.asm
index 141559df3d2..ad924e41d0f 100644
--- a/src/freedreno/.gitlab-ci/reference/afuc_test.asm
+++ b/src/freedreno/.gitlab-ci/reference/afuc_test.asm
@@ -124,7 +124,7 @@ CP_MEM_TO_MEM:
         waitin
         mov $01, $data
 
-UNKN15:
+IN_PREEMPT:
         cread $02, [$00 + 0x101], 0x0
         brne $02, 0x1, #l007
         nop
@@ -147,8 +147,8 @@ UNKN6:
 UNKN7:
 UNKN8:
 UNKN9:
-UNKN10:
-UNKN11:
+IN_IB_END:
+IN_GMU_INTERRUPT:
 UNKN12:
 UNKN13:
 UNKN14:
@@ -164,9 +164,9 @@ UNKN24:
 CP_DRAW_PRED_ENABLE_GLOBAL:
 CP_DRAW_PRED_ENABLE_LOCAL:
 UNKN27:
-CP_PREEMPT_ENABLE:
+UNKN28:
 CP_SKIP_IB2_ENABLE_GLOBAL:
-CP_PREEMPT_TOKEN:
+UNKN30:
 UNKN31:
 UNKN32:
 CP_DRAW_INDX:
@@ -216,7 +216,7 @@ CP_START_BIN:
 CP_END_BIN:
 CP_WAIT_REG_EQ:
 CP_SMMU_TABLE_UPDATE:
-UNKN84:
+CP_CONTEXT_SWITCH:
 CP_SET_CTXSWITCH_IB:
 CP_SET_PSEUDO_REG:
 CP_INDIRECT_BUFFER_CHAIN:
@@ -238,8 +238,8 @@ UNKN103:
 UNKN104:
 UNKN105:
 UNKN106:
-UNKN107:
-UNKN108:
+CP_CONTEXT_SWITCH_YIELD:
+CP_PREEMPT_DISABLE:
 CP_REG_WRITE:
 UNKN110:
 CP_BOOTSTRAP_UCODE:
diff --git a/src/freedreno/.gitlab-ci/reference/crash.log b/src/freedreno/.gitlab-ci/reference/crash.log
index cb971c416d9..01acc8702d5 100644
--- a/src/freedreno/.gitlab-ci/reference/crash.log
+++ b/src/freedreno/.gitlab-ci/reference/crash.log
@@ -698,7 +698,7 @@ registers:
 	00000000	0x8a9: 00000000
 	00000000	0x8aa: 00000000
 	00000000	0x8ab: 00000000
-	00000000	0x8c0: 00000000
+	00000000	CP_PREEMPT_THRESHOLD: 0
 	8040362c	CP_ROQ_THRESHOLDS_1: { RB_LO = 0xb0 | RB_HI = 0xd8 | IB1_START = 0x100 | IB2_START = 0x200 }
 	010000c0	CP_ROQ_THRESHOLDS_2: { SDS_START = 0x300 | ROQ_SIZE = 0x400 }
 	00000080	CP_MEM_POOL_SIZE: 0x80
diff --git a/src/freedreno/registers/adreno/a6xx.xml b/src/freedreno/registers/adreno/a6xx.xml
index 5c379d4f778..3658648c074 100644
--- a/src/freedreno/registers/adreno/a6xx.xml
+++ b/src/freedreno/registers/adreno/a6xx.xml
@@ -992,6 +992,8 @@ to upconvert to 32b float internally?
 	<reg64 offset="0x0830" name="CP_SQE_INSTR_BASE"/>
 	<reg32 offset="0x0840" name="CP_MISC_CNTL"/>
 	<reg32 offset="0x0844" name="CP_APRIV_CNTL"/>
+	<!-- Preemptions taking longer than this threshold increment PERF_CP_LONG_PREEMPTIONS: -->
+	<reg32 offset="0x08C0" name="CP_PREEMPT_THRESHOLD"/>
 	<!-- all the threshold values seem to be in units of quad-dwords: -->
 	<reg32 offset="0x08C1" name="CP_ROQ_THRESHOLDS_1">
 		<doc>
diff --git a/src/freedreno/registers/adreno/adreno_control_regs.xml b/src/freedreno/registers/adreno/adreno_control_regs.xml
index 24ce699c69f..3fdac2192f4 100644
--- a/src/freedreno/registers/adreno/adreno_control_regs.xml
+++ b/src/freedreno/registers/adreno/adreno_control_regs.xml
@@ -114,13 +114,63 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 	<doc> Controls high 32 bits used by load and store afuc instructions </doc>
 	<reg32 name="LOAD_STORE_HI" offset="0x058"/>
 
+	<enum name="sqe_perfcntr_cntl">
+		<!-- 0 doesn't do anything -->
+		<value value="1" name="INCR"/>
+		<value value="2" name="START"/>
+		<value value="3" name="STOP"/>
+	</enum>
+
+	<doc>
+		An array of 2-bit fields each controlling a single countable.
+		TODO: Test with modified firmware to confirm which countables each field controls
+	</doc>
+	<reg32 name="PERFCNTR_CNTL" offset="0x05d">
+		<bitfield name="NUM_PREEMPTIONS" low="0" high="1" type="sqe_perfcntr_cntl"/>
+		<bitfield name="PREEMPTION_REACTION_DELAY" low="2" high="3" type="sqe_perfcntr_cntl"/>
+		<bitfield name="PREEMPTION_SWITCH_OUT_TIME" low="4" high="5" type="sqe_perfcntr_cntl"/>
+		<bitfield name="PREEMPTION_SWITCH_IN_TIME" low="6" high="7" type="sqe_perfcntr_cntl"/>
+		<bitfield name="DEAD_DRAWS_IN_BIN_RENDER" low="8" high="9" type="sqe_perfcntr_cntl"/>
+		<bitfield name="PREDICATED_DRAWS_KILLED" low="10" high="11" type="sqe_perfcntr_cntl"/>
+		<!-- MODE_SWITCH? -->
+		<bitfield name="ZPASS_DONE" low="14" high="15" type="sqe_perfcntr_cntl"/>
+		<bitfield name="CONTEXT_DONE" low="16" high="17" type="sqe_perfcntr_cntl"/>
+		<bitfield name="CACHE_FLUSH" low="18" high="19" type="sqe_perfcntr_cntl"/>
+		<bitfield name="LONG_PREEMPTIONS" low="20" high="21" type="sqe_perfcntr_cntl"/>
+		<bitfield name="VSD_DECODE_STARVE" low="22" high="23" type="sqe_perfcntr_cntl"/>
+		<bitfield name="SYNC_STALL" low="24" high="25" type="sqe_perfcntr_cntl"/>
+		<bitfield name="PM4_WFI_STALL" low="26" high="27" type="sqe_perfcntr_cntl"/>
+		<bitfield name="SYS_WFI_STALL" low="28" high="29" type="sqe_perfcntr_cntl"/>
+	</reg32>
+
 	<doc> Used to initialize the jump table for handling packets at bootup </doc>
 	<reg32 name="PACKET_TABLE_WRITE_ADDR" offset="0x060"/>
 	<reg32 name="PACKET_TABLE_WRITE" offset="0x061"/>
 
+	<doc> Resettable counter used to implement PERF_CP_LONG_PREEMPTIONS </doc>
+	<reg32 name="PREEMPTION_TIMER" offset="0x06e"/>
+	<doc> Seemingly used to start/stop PREEMPTION_TIMER </doc>
+	<reg32 name="PREEMPTION_TIMER_CNTL" offset="0x06f">
+		<bitfield name="RUNNING" pos="0"/>
+	</reg32>
+
+	<doc> Private mirror of CP_CONTEXT_SWITCH_CNTL </doc>
+	<reg32 name="CONTEXT_SWITCH_CNTL" offset="0x70"/>
+
 	<reg32 name="PREEMPT_ENABLE" offset="0x071"/>
 	<reg32 name="SECURE_MODE" offset="0x075"/>
 
+	<doc> Write 1 to trigger a preemption from SQE. Reads return 1 if SQE triggered preemption. </doc>
+	<reg32 name="PREEMPT_TRIGGER" offset="0x072"/>
+
+	<doc>
+		Written by SQE throughout the preemption routine, with mostly
+		monotonically increasing values, presumably used to determine where
+		it is when it crashes.
+		TODO: How do we read this?
+	</doc>
+	<reg32 name="PREEMPT_COOKIE" offset="0x078"/>
+
 	<!--
 		Note: I think that registers above 0x100 are actually just a
 		scratch space which can be used by firmware however it wants,
diff --git a/src/freedreno/registers/adreno/adreno_pm4.xml b/src/freedreno/registers/adreno/adreno_pm4.xml
index 75571272ce4..d18b38be675 100644
--- a/src/freedreno/registers/adreno/adreno_pm4.xml
+++ b/src/freedreno/registers/adreno/adreno_pm4.xml
@@ -246,8 +246,8 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 		indirect buffer dispatch.  prefetch parser uses this packet
 		type to determine whether to pre-fetch the IB
 	</doc>
-	<value name="CP_PREEMPT_ENABLE" value="0x1c"/>
-	<value name="CP_PREEMPT_TOKEN" value="0x1e"/>
+	<value name="CP_PREEMPT_ENABLE" value="0x1c" variants="A5XX"/>
+	<value name="CP_PREEMPT_TOKEN" value="0x1e" variants="A5XX"/>
 	<value name="CP_INDIRECT_BUFFER" value="0x3f"/>
 	<doc>
 		Takes the same arguments as CP_INDIRECT_BUFFER, but jumps to
@@ -484,7 +484,7 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 	<!-- Enable/Disable A5x local preemption model -->
 	<value name="CP_PREEMPT_ENABLE_LOCAL" value="0x6a" variants="A5XX"/>
 	<!-- Yield token on a5xx similar to CP_PREEMPT on a4xx -->
-	<value name="CP_CONTEXT_SWITCH_YIELD" value="0x6b" variants="A5XX"/>
+	<value name="CP_CONTEXT_SWITCH_YIELD" value="0x6b" variants="A5XX-"/>
 	<!-- Inform CP about current render mode (needed for a5xx preemption) -->
 	<value name="CP_SET_RENDER_MODE" value="0x6c" variants="A5XX"/>
 	<value name="CP_COMPUTE_CHECKPOINT" value="0x6e" variants="A5XX"/>
@@ -544,8 +544,16 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 	<value name="IN_INCR_UPDT_CONST" value="0x56" variants="A2XX"/>
 	<value name="IN_INCR_UPDT_INSTR" value="0x57" variants="A2XX"/>
 
+	<!-- internal jumptable entries on a6xx+, possibly a5xx: -->
+
 	<!-- jmptable entry used to handle type4 packet on a5xx+: -->
 	<value name="PKT4" value="0x04" variants="A5XX-"/>
+	<!-- called when ROQ is empty, "returns" from an IB or merged sequence of IBs -->
+	<value name="IN_IB_END" value="0x0a" variants="A6XX-"/>
+	<!-- handles IFPC save/restore -->
+	<value name="IN_GMU_INTERRUPT" value="0x0b" variants="A6XX-"/>
+	<!-- preemption/context-swtich routine -->
+	<value name="IN_PREEMPT" value="0x0f" variants="A6XX-"/>
 
 	<!-- TODO do these exist on A5xx? -->
 	<value name="CP_SCRATCH_WRITE" value="0x4c" variants="A6XX"/>
@@ -555,6 +563,11 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 	<value name="CP_WAIT_TWO_REGS" value="0x70" variants="A6XX"/>
 	<value name="CP_MEMCPY" value="0x75" variants="A6XX"/>
 	<value name="CP_SET_BIN_DATA5_OFFSET" value="0x2e" variants="A6XX"/>
+	<doc>
+                Write CP_CONTEXT_SWITCH_*_INFO from CP to the following dwords,
+                and forcibly switch to the indicated context.
+	</doc>
+	<value name="CP_CONTEXT_SWITCH" value="0x54" variants="A6XX"/>
 	<!-- Note, kgsl calls this CP_SET_AMBLE: -->
 	<value name="CP_SET_CTXSWITCH_IB" value="0x55" variants="A6XX"/>
 
@@ -594,6 +607,9 @@ xsi:schemaLocation="http://nouveau.freedesktop.org/ rules-ng.xsd">
 	<value name="CP_START_BIN" value="0x50" variants="A6XX"/>
 	<value name="CP_END_BIN" value="0x51" variants="A6XX"/>
 
+	<doc> Make next dword 1 to disable preemption, 0 to re-enable it. </doc>
+	<value name="CP_PREEMPT_DISABLE" value="0x6c" variants="A6XX"/>
+
 	<value name="CP_WAIT_TIMESTAMP" value="0x14" variants="A7XX-"/>
 	<value name="CP_THREAD_CONTROL" value="0x17" variants="A7XX-"/>
 </enum>