marfrit/rk3588-ddr-analysis
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RK3588 DDR init blob reverse engineering

Browse Source 
- Ghidra decompilation of v1.02-v1.19 blobs (118 functions)
- 53 functions renamed, 79 MMIO registers mapped to TRM
- 45 timeout-less poll loops identified and patched
- Production patcher (patch_prod.py) and QEMU emulator
- Comprehensive analysis, frequency tables, community research

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Markus Fritsche
2026-04-03 13:06:47 +02:00
commit 816848a474
23 changed files with 84690 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DDR_FREQUENCY_TABLE.md
+90
View File
@@ -0,0 +1,90 @@
# RK3588 LPDDR5 Frequency Table
## Available DDR Blob Frequencies (rkbin)
### Official Rockchip Blobs
| Version | LP4 Freq | LP5 Freq | LP5 Data Rate | LP5 Bandwidth/ch | Status |
|---------|----------|----------|--------------|-------------------|--------|
| v1.09 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Oldest available |
| v1.10-v1.14 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Iterative fixes |
| v1.15 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Last 2736 blob |
| v1.16 | 2112 MHz | **2400 MHz** | 4800 MT/s | 9.6 GB/s | 2736 dropped |
| v1.17-v1.19 | 2112 MHz | **2400 MHz** | 4800 MT/s | 9.6 GB/s | Current |
| v1.19 (cons.) | 1848 MHz | **2112 MHz** | 4224 MT/s | 8.4 GB/s | Conservative |
### Community-Achieved Frequencies (via rkddr tool / DT overlay)
| LP5 Freq | Data Rate | Bandwidth/ch | Source | Stability |
|----------|----------|-------------|--------|-----------|
| 2112 MHz | 4224 MT/s | 8.4 GB/s | Official conservative | Rock solid |
| 2400 MHz | 4800 MT/s | 9.6 GB/s | Official default | Stable |
| 2736 MHz | 5472 MT/s | 10.9 GB/s | Old official (v1.15) | Dropped by Rockchip |
| 3200 MHz | 6400 MT/s | 12.8 GB/s | Community (hbiyik rkddr) | Works with SK Hynix rated modules |
## Binary Differences Between Frequency Blobs
The code is identical across all frequency variants. Only **timing parameter
bytes** differ in the data section:
| LP5 Frequency | Timing Value (32-bit LE) | Blob Offset (v1.19) |
|--------------|-------------------------|---------------------|
| 2112 MHz | 0x00216840 | 0x11BF4 |
| 2400 MHz | 0x00216960 | 0x11BF4 |
| 2736 MHz | 0x00210AB0 | 0x10F64 (v1.15) |
And for LP4:
| LP4 Frequency | Timing Value (32-bit LE) | Blob Offset (v1.19) |
|--------------|-------------------------|---------------------|
| 1848 MHz | 0x00210738 | 0x11B8C |
| 2112 MHz | 0x00210840 | 0x11B8C |
## How DDR Frequency Training Works
1. The DDR blob is loaded by BL2 (TPL) during early boot
2. It configures the DPLL (DDR PLL) via SCRU registers (0xFD7D0000)
3. It runs PHY training at the configured frequency
4. It trains **6 frequency steps** (main + 5 alternatives) for DVFS
5. Results are written to PMU GRF OS registers for Linux to read
6. Linux devfreq (rockchip-dfi driver) uses these for runtime frequency scaling
## JEDEC LPDDR5 Speed Grades
| Speed Grade | Data Rate | Clock | Notes |
|------------|----------|-------|-------|
| LPDDR5-3200 | 3200 MT/s | 1600 MHz | Minimum LPDDR5 spec |
| LPDDR5-4267 | 4267 MT/s | 2133 MHz | ≈ conservative blob |
| LPDDR5-4800 | 4800 MT/s | 2400 MHz | = default blob |
| LPDDR5-5500 | 5500 MT/s | 2750 MHz | ≈ 2736 blob (TRM "optimized") |
| LPDDR5-6400 | 6400 MT/s | 3200 MHz | Max JEDEC spec, community OC |
| LPDDR5X-7500 | 7500 MT/s | 3750 MHz | LPDDR5X only, not in RK3588 |
## Tools for Frequency Configuration
1. **rkddr** (https://github.com/hbiyik/rkddr) — TUI tool to edit DDR blob
parameters directly on the board. Supports setting any frequency + ODT/
drive strength parameters. Saves to eMMC/SPI flash IDB directly.
2. **ddrbin_tool** (in rkbin/tools/) — Rockchip's official DDR blob
configuration tool. Can set frequency, channel config, etc.
3. **Manual patching** — Change 6 bytes in the blob data section (as
documented in this analysis).
4. **Device tree overlay** — `rockchip-rk3588-dmc-oc-3500mhz` enables
frequency steps up to 3200 MHz for the devfreq governor.
## Recommendations for Rock 5 ITX+
Check your DRAM module first:
```
cat /sys/bus/platform/drivers/rockchip-dmc/dmc/devfreq/dmc/available_frequencies
```
- **SK Hynix LPDDR5** modules are rated for 6400 MT/s — can safely try 2736 or 3200
- **Samsung LPDDR5** varies — some rated 5500, some 6400
- **Micron LPDDR5** — typically 5500 MT/s max
Conservative recommendation: try v1.15 blob (2736 MHz) first. If stable,
consider rkddr for 3200 MHz with proper stress testing (stressapptest).