regs + POLL_SITE_MAP: TRM §2.4.3 register names for low-offset polls

Sibling went back into the TRM and found §2.4.3 'Registers Summary
For DDRPHY' which I'd missed — it names almost every PHY PUB register
we'd been calling 'RE guess':

  +0x110 = DDRPHY_CAL_RD_VWML0     (Read Valid Window Margin Left Code 0)
  +0x120 = DDRPHY_CAL_RD_VWMR0     (Read Valid Window Margin Right Code 0)
  +0x160 = DDRPHY_CAL_CON5         (Calibration Control 5: wrtrn_cyc_mode/en/th)
  +0x684 = DDRPHY_PRBS_CON0        (PRBS Training Control — was 'CalBusy')
  +0xa24 = DDRPHY_SCHD_TRAIN_CON0  (MASTER training scheduler; full bit map
                                    in the TRM — every training type + per-rank)
  +0xb88 = DDRPHY_DQSDUTY_CON2     (DQS rise-duty monitor — was 'UctShadow')

SCHD_TRAIN_CON0 is the master — the blob selects a training type via
its enable bits and polls bit[1] phy_train_done. Four of our 16 poll
sites are almost certainly polling this bit across different training
stages.

Still reserved in TRM: +0x118, +0x154, +0x184 — training-engine
private FSMs. Only dynamic tracing can name these.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

rk3588_regs_annotated.h

@@ -122,3 +122,69 @@
 /* The large-offset polls (0xb88, 0xa24, 0x684) in the early-cluster
  * functions are also DWC PUB; semantic guesses in BUG_ANALYSIS.md. */
 
+
+/* =====================================================================
+ * TRM §2.4.3 "Registers Summary For DDRPHY" — confirmed 2026-04-15
+ * (sibling research surfaced this section of the TRM we'd missed).
+ * All offsets are within a per-channel DDRPHY Operational Base.
+ * =====================================================================
+ */
+
+#define DDRPHY_CAL_RD_VWML0     0x0110   /* Calibration Read Valid Window
+                                            Margin Left Code 0  (TRM HIGH) */
+/* +0x118 : TRM-reserved in the register summary. RE: per-slice "window
+ * valid" or shadow register; the blob reads [31:28] as per-slice done
+ * flags. Private training-engine FSM register. */
+#define DDRPHY_CAL_RD_VWMR0     0x0120   /* Calibration Read Valid Window
+                                            Margin Right Code 0  (TRM HIGH) */
+/* +0x154 : TRM-reserved. RE: accompanies CAL_CON5 in d328; likely a
+ * per-slice write-training trigger or training-engine shadow. */
+#define DDRPHY_CAL_CON5         0x0160   /* Calibration Control Register 5:
+                                            [10]   binary_en (TBD)
+                                            [9:2]  wrtrn_cyc_th  (write training cycle threshold)
+                                            [1]    wrtrn_cyc_en  (write training cycle delay enable)
+                                            [0]    wrtrn_cyc_mode (1=low freq 500MHz-1GHz, 0=matched edges)
+                                                            (TRM HIGH) */
+/* +0x184 : TRM-reserved. RE: DFI phyupd / update-request handshake
+ * (pattern matches — wait non-zero, then wait zero). */
+#define DDRPHY_PRBS_CON0        0x0684   /* PRBS Training Control Register 0
+                                            (our old "CalBusy" guess was wrong)
+                                            LPDDR5 high-speed PRBS pattern
+                                            training start/done              (TRM HIGH) */
+#define DDRPHY_SCHD_TRAIN_CON0  0x0A24   /* **Master training scheduler**
+                                            [0]     phy_train_en   (start)
+                                            [1]     phy_train_done (RO, completion)
+                                            [2]     phy_cbt_en
+                                            [3]     phy_wrlvl_en
+                                            [4]     phy_gttrn_en   (gate leveling)
+                                            [5]     phy_rdtrn_en   (read training)
+                                            [6]     phy_wrtrn_en   (write training)
+                                            [7]     phy_wlcal_en
+                                            [9:8]   phy_wrlvl_rank_en
+                                            [11:10] phy_gttrn_rank_en
+                                            [13:12] phy_rdtrn_rank_en
+                                            [15:14] phy_wrtrn_rank_en
+                                            [17:16] dvfs_gttrn_en
+                                            [19:18] dvfs_wrtrn_en
+                                            [21:20] periodic_gttrn_en
+                                            [23:22] periodic_wrtrn_en
+                                                            (TRM EXTREMELY HIGH) */
+#define DDRPHY_DQSDUTY_CON2     0x0B88   /* DQS Rise-Duty rank1 DS0 —
+                                            duty-cycle monitor for DCM/DCA
+                                            (our old "UctShadow" guess wrong)
+                                                            (TRM HIGH) */
+
+/* -------------------------------------------------------------------
+ * Semantic re-interpretation of FUN_0000d328 (train_phy_block):
+ *   Writes 0x30003 to CAL_CON5 (+0x160):
+ *     bit[0] wrtrn_cyc_mode=1  (low-freq edge mode)
+ *     bit[1] wrtrn_cyc_en=1    (write training cycle delay enabled)
+ *     bits[17:16] are in the RESERVED range of CAL_CON5 — no-op there.
+ *   So d328 enables write-training cycle mode, waits for handshake,
+ *   then clears (writes 0x30000 ≈ bits[17:16] — clears the [1:0] bits
+ *   effectively).
+ *
+ *   NOT "DVFS gate training" as initial sibling hypothesis; d328 is
+ *   actually WRITE TRAINING setup/teardown (configuring the cycle
+ *   mode, not the master scheduler).
+ * ------------------------------------------------------------------- */