regs + POLL_SITE_MAP: TRM §2.4.3 register names for low-offset polls

Sibling went back into the TRM and found §2.4.3 'Registers Summary
For DDRPHY' which I'd missed — it names almost every PHY PUB register
we'd been calling 'RE guess':

  +0x110 = DDRPHY_CAL_RD_VWML0     (Read Valid Window Margin Left Code 0)
  +0x120 = DDRPHY_CAL_RD_VWMR0     (Read Valid Window Margin Right Code 0)
  +0x160 = DDRPHY_CAL_CON5         (Calibration Control 5: wrtrn_cyc_mode/en/th)
  +0x684 = DDRPHY_PRBS_CON0        (PRBS Training Control — was 'CalBusy')
  +0xa24 = DDRPHY_SCHD_TRAIN_CON0  (MASTER training scheduler; full bit map
                                    in the TRM — every training type + per-rank)
  +0xb88 = DDRPHY_DQSDUTY_CON2     (DQS rise-duty monitor — was 'UctShadow')

SCHD_TRAIN_CON0 is the master — the blob selects a training type via
its enable bits and polls bit[1] phy_train_done. Four of our 16 poll
sites are almost certainly polling this bit across different training
stages.

Still reserved in TRM: +0x118, +0x154, +0x184 — training-engine
private FSMs. Only dynamic tracing can name these.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

POLL_SITE_MAP.md

@@ -79,3 +79,62 @@ the blob waits on before continuing. Worth its own trace.
   the "operating_mode" mapping for sites 2/4/5/7.
 - Special-case site 10 in the bisection plan — it's not a normal PHY
   poll and may need different treatment.
+
+## Update 2026-04-15 evening — TRM §2.4.3 mined
+
+Sibling research went back into the TRM and found **§2.4.3 Registers
+Summary For DDRPHY** which I'd missed. That section names almost every
+low-offset poll we'd labelled `(RE)`:
+
+| old guess | TRM actual | confidence |
+|---|---|---|
+| PHY + 0x110 `(RE)` — `F000F000` trigger | **`DDRPHY_CAL_RD_VWML0`** (Read Valid Window Margin Left Code 0) | TRM HIGH |
+| PHY + 0x120 `(RE)` — step-complete bit | **`DDRPHY_CAL_RD_VWMR0`** (Read Valid Window Margin Right Code 0) | TRM HIGH |
+| PHY + 0x160 `(RE)` — CFG_B 0x30003 | **`DDRPHY_CAL_CON5`** (Calibration Control 5: wrtrn_cyc_mode / wrtrn_cyc_en / wrtrn_cyc_th) | TRM HIGH |
+| PHY + 0x684 "CalBusy" | **`DDRPHY_PRBS_CON0`** — PRBS training control (our CalBusy guess was wrong) | TRM HIGH |
+| PHY + 0xa24 "DFI ready" | **`DDRPHY_SCHD_TRAIN_CON0`** — master training scheduler, full bit layout documented | **TRM extremely high** |
+| PHY + 0xb88 "shadow" | **`DDRPHY_DQSDUTY_CON2`** — DQS rise-duty monitor (DCM/DCA debug) | TRM HIGH |
+| PHY + 0x118, 0x154, 0x184 | TRM gaps (reserved) — still RE. Likely per-slice shadow / handshake FSMs | RE |
+
+### Big picture
+
+- **SCHD_TRAIN_CON0 @ +0xa24 is the master controller.** Writing to
+  it with the right bit combination selects a training type (CBT,
+  WrLvl, GT, Rd, Wr), enables per-rank bits, and sets the `phy_train_en`
+  bit. Polling `[1] phy_train_done` tells you when it's finished. **Four
+  of our poll sites (8, 9, possibly 11) are almost certainly polling
+  this bit.**
+- The `0x30003` / `0x30000` pattern in d328 writes to `CAL_CON5`, not
+  `SCHD_TRAIN_CON0` — so it configures write-training cycle mode, not
+  the master scheduler. Initial sibling hypothesis of "DVFS gate
+  training" was incorrect on second reading.
+
+### Training sequence now mapped to poll sites
+
+Per TRM §2.6.x "Training Procedure":
+
+1. Power ramp / PLL lock / clock config
+2. DFI init: `DDRCTL_DFIMISC.dfi_init_start=1`, poll `DDRCTL_DFISTAT.dfi_init_complete` — **site 3 is here**
+3. ZQ calibration: `ZQ_CON0.zq_manual_str`, poll `ZQ_CON1.zq_done`
+4. MDLL lock
+5. Scheduler enable (`LP_CON0.ctrl_scheduler_en`)
+6. Training loop, all via `SCHD_TRAIN_CON0`:
+   - CBT  (Command Bus Training)
+   - Write Leveling
+   - Gate Training
+   - Read DQ Training → results land in `CAL_RD_VWMC0/VWML0/VWMR0`
+   - Write DQ Training → results in `CAL_WR_VWMC0/VWML0/VWMR0`
+   - PRBS Training  (LPDDR5 high-speed)
+   - DQS Duty-cycle monitoring
+
+Our 16 poll sites are scattered across steps 2, 5 (scheduler-en state),
+and the six training sub-steps in step 6.
+
+### Open items
+
+- **+0x118 / +0x154 / +0x184 remain TRM-reserved** — training engine
+  private FSMs. No way to name these from docs; dynamic tracing on
+  real hardware (with UART or JTAG) is the remaining path.
+- CSDN LPDDR5 series (DDR Study blog) turned out to cover JEDEC-layer
+  protocol only; no register-level help. Useful background for training
+  phase names but not for our RE.