/* RK3588 DDR Init Blob - Annotated MMIO Register Map * Cross-referenced with TRM Part 2 and kernel sources */ /* === Blob-internal data tables (not MMIO) === */ /* 0x0001xxxx - timing params, DDR config tables within the binary */ /* 0x001Fxxxx - likely shared memory / mailbox area */ /* === PMU1 GRF (0xFD588000) === */ #define _DAT_fd588080 REG32(0xFD588080) /* PMU1_GRF: DDR status/config */ /* === DDR GRF CH2 (0xFD598000) === */ #define _DAT_fd59800c REG32(0xFD59800C) /* DDR_GRF_CH2: channel config */ /* === BUS GRF (0xFD5F4000 / 0xFD5F8000) === */ /* BUS_IOC or DDR-related bus fabric config - 27 registers */ #define _DAT_fd5f4000 REG32(0xFD5F4000) /* BUS_GRF: base config */ #define _DAT_fd5f400c REG32(0xFD5F400C) /* BUS_GRF: status */ /* 0xFD5F8000-0xFD5F809C: Dense register block - DDR bus interconnect */ /* These control AXI fabric, QoS, and DDR routing */ #define _DAT_fd5f800c REG32(0xFD5F800C) /* bus_grf: DDR route cfg */ #define _DAT_fd5f8018 REG32(0xFD5F8018) #define _DAT_fd5f8020 REG32(0xFD5F8020) #define _DAT_fd5f8028 REG32(0xFD5F8028) #define _DAT_fd5f802c REG32(0xFD5F802C) #define _DAT_fd5f8030 REG32(0xFD5F8030) #define _DAT_fd5f8038 REG32(0xFD5F8038) #define _DAT_fd5f8044 REG32(0xFD5F8044) #define _DAT_fd5f804c REG32(0xFD5F804C) #define _DAT_fd5f8050 REG32(0xFD5F8050) #define _DAT_fd5f8054 REG32(0xFD5F8054) #define _DAT_fd5f805c REG32(0xFD5F805C) #define _DAT_fd5f8060 REG32(0xFD5F8060) #define _DAT_fd5f8068 REG32(0xFD5F8068) #define _DAT_fd5f806c REG32(0xFD5F806C) #define _DAT_fd5f8070 REG32(0xFD5F8070) #define _DAT_fd5f8074 REG32(0xFD5F8074) #define _DAT_fd5f8078 REG32(0xFD5F8078) #define _DAT_fd5f807c REG32(0xFD5F807C) #define _DAT_fd5f8080 REG32(0xFD5F8080) #define _DAT_fd5f8084 REG32(0xFD5F8084) #define _DAT_fd5f8088 REG32(0xFD5F8088) #define _DAT_fd5f808c REG32(0xFD5F808C) #define _DAT_fd5f8098 REG32(0xFD5F8098) #define _DAT_fd5f809c REG32(0xFD5F809C) /* === PMU CRU / Secure CRU (0xFD8C8000) === */ /* Clock gate and reset controls for DDR subsystem */ #define _DAT_fd8c8004 REG32(0xFD8C8004) /* SCRU: DDR clock gate */ #define _DAT_fd8c8008 REG32(0xFD8C8008) /* SCRU: DDR reset */ #define _DAT_fd8c8014 REG32(0xFD8C8014) /* SCRU: DPLL config */ #define _DAT_fd8c8018 REG32(0xFD8C8018) /* SCRU: DPLL status */ /* === DDRC CH0 (0xFE010000) === */ /* Synopsys UMCTL2 registers - only 4 accessed directly */ #define _DAT_fe0100f0 REG32(0xFE0100F0) /* DDRC_CH0 + 0xF0: MSTR/timing? */ #define _DAT_fe0100f4 REG32(0xFE0100F4) /* DDRC_CH0 + 0xF4 */ #define _DAT_fe0100f8 REG32(0xFE0100F8) /* DDRC_CH0 + 0xF8 */ #define _DAT_fe0100fc REG32(0xFE0100FC) /* DDRC_CH0 + 0xFC */ /* === FIREWALL DDR (0xFE030000) === */ #define _DAT_fe030040 REG32(0xFE030040) /* FW_DDR: access control */ /* === SGRF (0xFE050000) - Security GRF === */ /* Controls which bus masters can access DDR regions */ #define _DAT_fe050000 REG32(0xFE050000) /* SGRF_DDR_CON0 */ #define _DAT_fe050004 REG32(0xFE050004) /* SGRF_DDR_CON1 */ #define _DAT_fe050008 REG32(0xFE050008) /* SGRF_DDR_CON2 */ #define _DAT_fe05000c REG32(0xFE05000C) /* SGRF_DDR_CON3 */ #define _DAT_fe05002c REG32(0xFE05002C) /* SGRF_DDR_CON11 */ #define _DAT_fe050054 REG32(0xFE050054) /* SGRF_DDR_CON21 */ #define _DAT_fe050058 REG32(0xFE050058) /* SGRF_DDR_CON22 */ #define _DAT_fe0500e0 REG32(0xFE0500E0) /* SGRF: status/busy poll */ #define _DAT_fe0500e4 REG32(0xFE0500E4) /* SGRF: enable/lock */ /* === Unknown 0xFECC0000 region === */ /* Possibly DDR Scramble / ECC or VO-related */ #define _DAT_fecc0004 REG32(0xFECC0004) #define _DAT_fecc0008 REG32(0xFECC0008) #define _DAT_fecc0020 REG32(0xFECC0020) #define _DAT_fecc0084 REG32(0xFECC0084) /* === SRAM (0xFF000000) === */ #define _DAT_ff000010 REG32(0xFF000010) /* SRAM: boot flag/mailbox */ /* ===================================================================== * TRM-CANONICAL names for poll-site registers (RK3588 TRM Part 2 Ch.2) * Added 2026-04-15 after cross-referencing the 522-page DMC chapter. * Offsets are within a DDRCTL (uMCTL2) per-channel base. * ===================================================================== */ #define DDRCTL_MRCTRL0 0x10080 /* Mode Register Control 0 - mr_wr[31]: write a MR command - mr_addr[23:16]: MR address - mr_data[15:0]: MR data to write Previously guessed as "MicroReset". */ #define DDRCTL_MRSTAT 0x10090 /* Mode Register Status - mr_wr_busy[0]: 1 while MR cmd in flight Poll: WAIT for bit 0 == 0. Previously guessed as "MicroContMuxSel". */ #define DDRCTL_DFISTAT 0x10514 /* DFI Status - dfi_init_complete[0]: 1 when PHY ready Poll: WAIT for bit 0 == 1. Previously guessed as "UctWriteProtShadow". */ /* Low-offset polls in FUN_0000d328 (train_phy_block) and friends are * Synopsys DWC PUB registers — NOT in RK3588 TRM. Still require RE. * The heuristic labels below come from the d328 analysis (2026-04-15): */ #define PHY_OFF_BASE 0x8000 /* sub-block offset within a PHY used by d328 */ #define PHY_CTL_110 0x110 /* write 0xF000F000 to trigger step, 0xF0000000 to clear */ #define PHY_STAT_A_118 0x118 /* wait for bits[31:28] != 0 */ #define PHY_STAT_B_120 0x120 /* wait for bits[31:28] != 0 */ #define PHY_CFG_A_154 0x154 /* write 0x30003 (go), 0x30000 (end) */ #define PHY_CFG_B_160 0x160 /* write 0x30003 (go), 0x30000 (end) */ #define PHY_HANDSHAKE_184 0x184 /* wait for bits[1:0] non-zero, then zero */ /* The large-offset polls (0xb88, 0xa24, 0x684) in the early-cluster * functions are also DWC PUB; semantic guesses in BUG_ANALYSIS.md. */ /* ===================================================================== * TRM §2.4.3 "Registers Summary For DDRPHY" — confirmed 2026-04-15 * (sibling research surfaced this section of the TRM we'd missed). * All offsets are within a per-channel DDRPHY Operational Base. * ===================================================================== */ #define DDRPHY_CAL_RD_VWML0 0x0110 /* Calibration Read Valid Window Margin Left Code 0 (TRM HIGH) */ /* +0x118 : TRM-reserved in the register summary. RE: per-slice "window * valid" or shadow register; the blob reads [31:28] as per-slice done * flags. Private training-engine FSM register. */ #define DDRPHY_CAL_RD_VWMR0 0x0120 /* Calibration Read Valid Window Margin Right Code 0 (TRM HIGH) */ /* +0x154 : TRM-reserved. RE: accompanies CAL_CON5 in d328; likely a * per-slice write-training trigger or training-engine shadow. */ #define DDRPHY_CAL_CON5 0x0160 /* Calibration Control Register 5: [10] binary_en (TBD) [9:2] wrtrn_cyc_th (write training cycle threshold) [1] wrtrn_cyc_en (write training cycle delay enable) [0] wrtrn_cyc_mode (1=low freq 500MHz-1GHz, 0=matched edges) (TRM HIGH) */ /* +0x184 : TRM-reserved. RE: DFI phyupd / update-request handshake * (pattern matches — wait non-zero, then wait zero). */ #define DDRPHY_PRBS_CON0 0x0684 /* PRBS Training Control Register 0 (our old "CalBusy" guess was wrong) LPDDR5 high-speed PRBS pattern training start/done (TRM HIGH) */ #define DDRPHY_SCHD_TRAIN_CON0 0x0A24 /* **Master training scheduler** [0] phy_train_en (start) [1] phy_train_done (RO, completion) [2] phy_cbt_en [3] phy_wrlvl_en [4] phy_gttrn_en (gate leveling) [5] phy_rdtrn_en (read training) [6] phy_wrtrn_en (write training) [7] phy_wlcal_en [9:8] phy_wrlvl_rank_en [11:10] phy_gttrn_rank_en [13:12] phy_rdtrn_rank_en [15:14] phy_wrtrn_rank_en [17:16] dvfs_gttrn_en [19:18] dvfs_wrtrn_en [21:20] periodic_gttrn_en [23:22] periodic_wrtrn_en (TRM EXTREMELY HIGH) */ #define DDRPHY_DQSDUTY_CON2 0x0B88 /* DQS Rise-Duty rank1 DS0 — duty-cycle monitor for DCM/DCA (our old "UctShadow" guess wrong) (TRM HIGH) */ /* ------------------------------------------------------------------- * CORRECTION 2026-04-15 LATE EVENING: * The 'CAL_RD_VWML0' etc. names above apply to DDRPHY_OPB + small * offsets. d328's accesses are at DDRPHY_OPB + 0x8000 + small, * which is an UNDOCUMENTED sub-block of the DDRPHY space. * Writing 0xF000F000 to a TRM-documented READ-ONLY register * would be a no-op — contradicting the blob's actual behaviour — * so those names DO NOT apply here. The `PHY_CTL_110` etc. * heuristic labels (in the block above) are the safe fallback. * * Semantic re-interpretation of FUN_0000d328 (train_phy_block): * Writes 0x30003 to CAL_CON5 (+0x160): * bit[0] wrtrn_cyc_mode=1 (low-freq edge mode) * bit[1] wrtrn_cyc_en=1 (write training cycle delay enabled) * bits[17:16] are in the RESERVED range of CAL_CON5 — no-op there. * So d328 enables write-training cycle mode, waits for handshake, * then clears (writes 0x30000 ≈ bits[17:16] — clears the [1:0] bits * effectively). * * NOT "DVFS gate training" as initial sibling hypothesis; d328 is * actually WRITE TRAINING setup/teardown (configuring the cycle * mode, not the master scheduler). * ------------------------------------------------------------------- */