diff --git a/src/freedreno/registers/a6xx.xml b/src/freedreno/registers/a6xx.xml
index 044e6da65b1..8dd86993747 100644
--- a/src/freedreno/registers/a6xx.xml
+++ b/src/freedreno/registers/a6xx.xml
@@ -2417,7 +2417,19 @@ to upconvert to 32b float internally?
 
 	<reg32 offset="0x8e04" name="RB_UNKNOWN_8E04"/>
 
-	<reg32 offset="0x8e07" name="RB_CCU_CNTL"/>  <!-- always 7c400004 or 10000000 -->
+	<reg32 offset="0x8e07" name="RB_CCU_CNTL">
+		<!-- offset into GMEM for something.
+			important for sysmem path
+			BLIT_OP_SCALE also writes to GMEM at this offset for GMEM store
+			blob values for GMEM path (note: close to GMEM size):
+			a618: 0x7c000 a630/a640: 0xf8000 a650: 0x114000
+			SYSMEM path values:
+			a618: 0x10000 a630/a640: 0x20000 a650: 0x30000
+		-->
+		<bitfield name="OFFSET" low="23" high="31" shr="12" type="uint"/>
+		<bitfield name="GMEM" pos="22" type="boolean"/> <!-- set for GMEM path -->
+		<bitfield name="UNK2" pos="2" type="boolean"/> <!-- sometimes set with GMEM? -->
+	</reg32>
 
 	<reg32 offset="0x9100" name="VPC_UNKNOWN_9100"/>
 
diff --git a/src/freedreno/vulkan/tu_cmd_buffer.c b/src/freedreno/vulkan/tu_cmd_buffer.c
index 1a01e67267b..f61f5b89f94 100644
--- a/src/freedreno/vulkan/tu_cmd_buffer.c
+++ b/src/freedreno/vulkan/tu_cmd_buffer.c
@@ -1051,7 +1051,7 @@ tu6_init_hw(struct tu_cmd_buffer *cmd, struct tu_cs *cs)
 
    tu_cs_emit_write_reg(cs, REG_A6XX_HLSQ_UPDATE_CNTL, 0xfffff);
 
-   tu_cs_emit_write_reg(cs, REG_A6XX_RB_CCU_CNTL, 0x10000000);
+   tu_cs_emit_write_reg(cs, REG_A6XX_RB_CCU_CNTL, A6XX_RB_CCU_CNTL_OFFSET(0x20000));
    tu_cs_emit_write_reg(cs, REG_A6XX_RB_UNKNOWN_8E04, 0x00100000);
    tu_cs_emit_write_reg(cs, REG_A6XX_SP_UNKNOWN_AE04, 0x8);
    tu_cs_emit_write_reg(cs, REG_A6XX_SP_UNKNOWN_AE00, 0);
@@ -1394,7 +1394,7 @@ tu6_emit_binning_pass(struct tu_cmd_buffer *cmd, struct tu_cs *cs)
    tu_cs_emit_wfi(cs);
 
    tu_cs_emit_regs(cs,
-                   A6XX_RB_CCU_CNTL(.unknown = phys_dev->magic.RB_CCU_CNTL_gmem));
+                   A6XX_RB_CCU_CNTL(.dword = phys_dev->magic.RB_CCU_CNTL_gmem));
 
    cmd->wait_for_idle = false;
 }
@@ -1498,7 +1498,7 @@ tu6_sysmem_render_begin(struct tu_cmd_buffer *cmd, struct tu_cs *cs,
 
    tu6_emit_wfi(cmd, cs);
    tu_cs_emit_regs(cs,
-                   A6XX_RB_CCU_CNTL(0x10000000));
+                   A6XX_RB_CCU_CNTL(.offset = 0x20000));
 
    /* enable stream-out, with sysmem there is only one pass: */
    tu_cs_emit_regs(cs,
@@ -1561,7 +1561,7 @@ tu6_tile_render_begin(struct tu_cmd_buffer *cmd, struct tu_cs *cs)
    /* 0x10000000 for BYPASS.. 0x7c13c080 for GMEM: */
    tu6_emit_wfi(cmd, cs);
    tu_cs_emit_regs(cs,
-                   A6XX_RB_CCU_CNTL(phys_dev->magic.RB_CCU_CNTL_gmem));
+                   A6XX_RB_CCU_CNTL(.dword = phys_dev->magic.RB_CCU_CNTL_gmem));
 
    const struct tu_tiling_config *tiling = &cmd->state.tiling_config;
    if (use_hw_binning(cmd)) {
diff --git a/src/freedreno/vulkan/tu_device.c b/src/freedreno/vulkan/tu_device.c
index 6412fcaaf42..a784f026b00 100644
--- a/src/freedreno/vulkan/tu_device.c
+++ b/src/freedreno/vulkan/tu_device.c
@@ -268,7 +268,9 @@ tu_physical_device_init(struct tu_physical_device *device,
       device->tile_align_w = 64;
       device->tile_align_h = 16;
       device->magic.RB_UNKNOWN_8E04_blit = 0x00100000;
-      device->magic.RB_CCU_CNTL_gmem     = 0x3e400004;
+      device->magic.RB_CCU_CNTL_gmem = A6XX_RB_CCU_CNTL_OFFSET(0x7c000) |
+                                       A6XX_RB_CCU_CNTL_GMEM |
+                                       A6XX_RB_CCU_CNTL_UNK2;
       device->magic.PC_UNKNOWN_9805 = 0x0;
       device->magic.SP_UNKNOWN_A0F8 = 0x0;
       break;
@@ -277,7 +279,9 @@ tu_physical_device_init(struct tu_physical_device *device,
       device->tile_align_w = 64;
       device->tile_align_h = 16;
       device->magic.RB_UNKNOWN_8E04_blit = 0x01000000;
-      device->magic.RB_CCU_CNTL_gmem     = 0x7c400004;
+      device->magic.RB_CCU_CNTL_gmem = A6XX_RB_CCU_CNTL_OFFSET(0xf8000) |
+                                       A6XX_RB_CCU_CNTL_GMEM |
+                                       A6XX_RB_CCU_CNTL_UNK2;
       device->magic.PC_UNKNOWN_9805 = 0x1;
       device->magic.SP_UNKNOWN_A0F8 = 0x1;
       break;
diff --git a/src/gallium/drivers/freedreno/a6xx/fd6_context.c b/src/gallium/drivers/freedreno/a6xx/fd6_context.c
index 6eb8e1f979d..a06ce92314c 100644
--- a/src/gallium/drivers/freedreno/a6xx/fd6_context.c
+++ b/src/gallium/drivers/freedreno/a6xx/fd6_context.c
@@ -111,23 +111,27 @@ PC_UNKNOWN_9805:
   - 0x1 -> 0
  */
 		fd6_ctx->magic.RB_UNKNOWN_8E04_blit = 0x00100000;
-		fd6_ctx->magic.RB_CCU_CNTL_gmem     = 0x3e400004;
-		fd6_ctx->magic.RB_CCU_CNTL_bypass   = 0x08000000;
+		fd6_ctx->magic.RB_CCU_CNTL_gmem = A6XX_RB_CCU_CNTL_OFFSET(0x7c000) |
+										  A6XX_RB_CCU_CNTL_GMEM |
+										  A6XX_RB_CCU_CNTL_UNK2;
+		fd6_ctx->magic.RB_CCU_CNTL_bypass = A6XX_RB_CCU_CNTL_OFFSET(0x10000);
 		fd6_ctx->magic.PC_UNKNOWN_9805 = 0x0;
 		fd6_ctx->magic.SP_UNKNOWN_A0F8 = 0x0;
 		break;
 	case 630:
 		fd6_ctx->magic.RB_UNKNOWN_8E04_blit = 0x01000000;
-		// NOTE: newer blob using 0x3c400004, need to revisit:
-		fd6_ctx->magic.RB_CCU_CNTL_gmem     = 0x7c400004;
-		fd6_ctx->magic.RB_CCU_CNTL_bypass   = 0x10000000;
+		fd6_ctx->magic.RB_CCU_CNTL_gmem = A6XX_RB_CCU_CNTL_OFFSET(0xf8000) |
+										  A6XX_RB_CCU_CNTL_GMEM |
+										  A6XX_RB_CCU_CNTL_UNK2;
+		fd6_ctx->magic.RB_CCU_CNTL_bypass = A6XX_RB_CCU_CNTL_OFFSET(0x20000);
 		fd6_ctx->magic.PC_UNKNOWN_9805 = 0x1;
 		fd6_ctx->magic.SP_UNKNOWN_A0F8 = 0x1;
 		break;
 	case 640:
 		fd6_ctx->magic.RB_UNKNOWN_8E04_blit = 0x00100000;
-		fd6_ctx->magic.RB_CCU_CNTL_gmem     = 0x7c400000;
-		fd6_ctx->magic.RB_CCU_CNTL_bypass   = 0x10000000;
+		fd6_ctx->magic.RB_CCU_CNTL_gmem = A6XX_RB_CCU_CNTL_OFFSET(0xf8000) |
+										  A6XX_RB_CCU_CNTL_GMEM;
+		fd6_ctx->magic.RB_CCU_CNTL_bypass = A6XX_RB_CCU_CNTL_OFFSET(0x20000);
 		fd6_ctx->magic.PC_UNKNOWN_9805 = 0x1;
 		fd6_ctx->magic.SP_UNKNOWN_A0F8 = 0x1;
 		break;