diff --git a/benchmark/TRM_FINDINGS.md b/benchmark/TRM_FINDINGS.md
new file mode 100644
index 0000000..1428c1e
--- /dev/null
+++ b/benchmark/TRM_FINDINGS.md
@@ -0,0 +1,69 @@
+# RK3588 TRM Part 2 findings — 2026-04-15
+
+Fetched `rk3588_part2.pdf` (55 MB, Rockchip 2022-03-15) via Stanford
+mirror. Chapter 2 is a 522-page DMC section. Key facts for this
+project:
+
+## Register corrections
+
+Our earlier `BUG_ANALYSIS.md` / `rk3588_regs_annotated.h` named three
+poll-target registers based on educated guesses. The TRM gives us
+vendor-canonical names:
+
+| blob offset | old guess (ours) | TRM canonical | meaning |
+|---|---|---|---|
+| +0x10080 | MicroReset | **DDRCTL_MRCTRL0** | Mode Register Control — write to trigger MRS command to DRAM |
+| +0x10090 | MicroContMuxSel | **DDRCTL_MRSTAT** | Mode Register Status — `mr_wr_busy` bit clears when MRS accepted |
+| +0x10514 | UctWriteProtShadow | **DDRCTL_DFISTAT** | DFI Interface Status — `dfi_init_complete` bit from PHY |
+
+**These are Rockchip uMCTL2 controller registers, not PHY firmware
+registers.** The polls that wait on them are:
+- MRSTAT polls: wait for MRS command to complete round-trip to DRAM
+- DFISTAT polls: wait for PHY to finish DFI handshake with controller
+
+Both have well-defined meanings. Much easier to reason about than the
+"PHY firmware scratch state" interpretation we had.
+
+## What's still undocumented
+
+The low-offset polls in our d328 function (`+0x110`, `+0x118`, `+0x120`,
+`+0x154`, `+0x160`, `+0x184`) plus `+0x684`, `+0xa24`, `+0xb88` are
+**not** in this TRM. They're Synopsys DWC PUB registers — Rockchip
+wraps the uMCTL2+PUB IP but doesn't republish the PUB register map.
+Still requires black-box RE for those.
+
+## 4 DDR channels
+
+TRM confirms RK3588 has **four DDRCTL blocks** (DDRCTL0..DDRCTL3).
+Each with its own register space at a distinct base. The blob's
+`ctx->b8[ch]` array of channel base pointers lines up with this.
+
+## What's still useful from the TRM
+
+- The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write
+  Ghidra comments that say `// poll DFISTAT.dfi_init_complete` instead
+  of `// poll +0x10514`.
+- The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
+- The DFI protocol (chapter 2's DFI subsections) — names every step
+  of the handshake between controller and PHY.
+- All the DDRCTL timing parameter registers (TIMING_*, DRAMTMG*) — if
+  we ever need to identify timing-table offsets in the blob.
+
+## What the TRM is NOT
+
+- It is not the **PHY PUB register manual**. Separate document (Synopsys
+  DWC_ddrphy_pub_databook, NDA'd). We're still on our own for
+  interpreting those poll sites.
+- It doesn't document the **DDR-init blob format** (header, sections,
+  parameter table layout). That's Rockchip-internal.
+
+## Files cached
+
+- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf` — 55 MB
+  original (don't commit — too big for git).
+- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt` — pdftotext
+  output, greppable. Keep out of git (3 MB).
+
+Part 1 (peripherals + clocks) also cached; relevant for PLL / power
+domain / reset registers used by the DDR bring-up sequence, but not
+for the poll sites themselves.