From 5aef5bd1182580cda61bdaa2b914df26757caa69 Mon Sep 17 00:00:00 2001
From: Markus Fritsche <mfritsche@reauktion.de>
Date: Wed, 15 Apr 2026 08:19:18 +0200
Subject: [PATCH] benchmark/TRM_FINDINGS.md: register-name corrections from
 RK3588 TRM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TRM Part 2 chapter 2 (DMC, 522 pages) reveals the offsets we poll at
+0x10080/+0x10090/+0x10514 are NOT PHY firmware scratch regs as our
earlier analysis guessed. They are uMCTL2 controller registers:

  +0x10080 = DDRCTL_MRCTRL0  (Mode Register Control)
  +0x10090 = DDRCTL_MRSTAT   (Mode Register Status — wait for MR complete)
  +0x10514 = DDRCTL_DFISTAT  (DFI Status — wait for PHY handshake)

Semantics are now grounded in vendor docs instead of educated guesses.
The PHY-side polls (0x110, 0x118, 0x184 etc. in d328) remain
undocumented — TRM does not republish the Synopsys DWC PUB register
map. Still need RE for those.

TRM cached at boltzmann:~/projects/AMPere/vendor/trm/ (pdf + txt).
Fetched via Stanford mirror (surfaced by the Chinese-language research
sibling alongside rk-open-docs, mfkiwl/rk-open-docs which has Rockchip
internal DDR docs for RK322x..RK1808 era — Innosilicon PHY, not our
DWC multiPHY, so useful for methodology but not direct reference).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 benchmark/TRM_FINDINGS.md | 69 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 benchmark/TRM_FINDINGS.md

diff --git a/benchmark/TRM_FINDINGS.md b/benchmark/TRM_FINDINGS.md
new file mode 100644
index 0000000..1428c1e
--- /dev/null
+++ b/benchmark/TRM_FINDINGS.md
@@ -0,0 +1,69 @@
+# RK3588 TRM Part 2 findings — 2026-04-15
+
+Fetched `rk3588_part2.pdf` (55 MB, Rockchip 2022-03-15) via Stanford
+mirror. Chapter 2 is a 522-page DMC section. Key facts for this
+project:
+
+## Register corrections
+
+Our earlier `BUG_ANALYSIS.md` / `rk3588_regs_annotated.h` named three
+poll-target registers based on educated guesses. The TRM gives us
+vendor-canonical names:
+
+| blob offset | old guess (ours) | TRM canonical | meaning |
+|---|---|---|---|
+| +0x10080 | MicroReset | **DDRCTL_MRCTRL0** | Mode Register Control — write to trigger MRS command to DRAM |
+| +0x10090 | MicroContMuxSel | **DDRCTL_MRSTAT** | Mode Register Status — `mr_wr_busy` bit clears when MRS accepted |
+| +0x10514 | UctWriteProtShadow | **DDRCTL_DFISTAT** | DFI Interface Status — `dfi_init_complete` bit from PHY |
+
+**These are Rockchip uMCTL2 controller registers, not PHY firmware
+registers.** The polls that wait on them are:
+- MRSTAT polls: wait for MRS command to complete round-trip to DRAM
+- DFISTAT polls: wait for PHY to finish DFI handshake with controller
+
+Both have well-defined meanings. Much easier to reason about than the
+"PHY firmware scratch state" interpretation we had.
+
+## What's still undocumented
+
+The low-offset polls in our d328 function (`+0x110`, `+0x118`, `+0x120`,
+`+0x154`, `+0x160`, `+0x184`) plus `+0x684`, `+0xa24`, `+0xb88` are
+**not** in this TRM. They're Synopsys DWC PUB registers — Rockchip
+wraps the uMCTL2+PUB IP but doesn't republish the PUB register map.
+Still requires black-box RE for those.
+
+## 4 DDR channels
+
+TRM confirms RK3588 has **four DDRCTL blocks** (DDRCTL0..DDRCTL3).
+Each with its own register space at a distinct base. The blob's
+`ctx->b8[ch]` array of channel base pointers lines up with this.
+
+## What's still useful from the TRM
+
+- The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write
+  Ghidra comments that say `// poll DFISTAT.dfi_init_complete` instead
+  of `// poll +0x10514`.
+- The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
+- The DFI protocol (chapter 2's DFI subsections) — names every step
+  of the handshake between controller and PHY.
+- All the DDRCTL timing parameter registers (TIMING_*, DRAMTMG*) — if
+  we ever need to identify timing-table offsets in the blob.
+
+## What the TRM is NOT
+
+- It is not the **PHY PUB register manual**. Separate document (Synopsys
+  DWC_ddrphy_pub_databook, NDA'd). We're still on our own for
+  interpreting those poll sites.
+- It doesn't document the **DDR-init blob format** (header, sections,
+  parameter table layout). That's Rockchip-internal.
+
+## Files cached
+
+- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf` — 55 MB
+  original (don't commit — too big for git).
+- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt` — pdftotext
+  output, greppable. Keep out of git (3 MB).
+
+Part 1 (peripherals + clocks) also cached; relevant for PLL / power
+domain / reset registers used by the DDR bring-up sequence, but not
+for the poll sites themselves.