# Poll-site → register map (RK3588 DDR v1.19)

Each of the 16 timeout-less poll sites in the v1.19 stock conservative
blob, decoded against the RK3588 TRM Part 2 (Ch. 2, DMC) where
possible. Sites without TRM coverage are Synopsys DWC PUB registers —
not republished by Rockchip; names ending in `(RE)` are our educated
guesses from the code context.

Site index comes from `patch_timeouts_v3.py` (ascending-offset order
after `find_poll_loops()`).

## Early cluster (sites 0–7): 0x07b78..0x07f08

| # | branch @ | body | load | addr (symbolic) | register | src |
|---|---------|------|------|-----------------|----------|-----|
| 0 | 0x07b78 | 2 | `ldr w1, [x0+0x114]` on x0=PHY+0x20000 | PHY + 0x20114 | `PHY_TRAIN_INTERLOCK_114` (RE) | —   |
| 1 | 0x07ba4 | 2 | `ldr w1, [x26+0xb88]`  where x26=PHY+0x10000 | PHY + 0x10b88 | `PHY_SHADOW_BB8` (RE) | —   |
| 2 | 0x07c8c | 3 | `ldr w0, [x1+0x14]`   where x1=DDRCTL+0x10000 | **DDRCTL + 0x10014** | `DDRCTL_PWRCTL`? (TBD — 0x14 offset in uMCTL2 is typically PWRCTL or STAT) | TRM (partial) |
| 3 | 0x07ca8 | 2 | `ldr w1, [x0+0x514]`  where x0=DDRCTL+0x10000 | **DDRCTL + 0x10514** | **DDRCTL_DFISTAT** `dfi_init_complete` | **TRM Part 2 Ch.2** |
| 4 | 0x07cd4 | 3 | `ldr w0, [x1+0x14]`   same pattern as site 2 | DDRCTL + 0x10014 | same as #2 | TRM (partial) |
| 5 | 0x07ce8 | 3 | same +0x14 load, different mask | DDRCTL + 0x10014 | same as #2 | TRM (partial) |
| 6 | 0x07d0c | 3 | `ldr w0, [x26+0xb88]` where x26=PHY+0x10000 | PHY + 0x10b88 | `PHY_SHADOW_BB8` (RE) — same reg as site 1, different mask | —   |
| 7 | 0x07f08 | 3 | `ldr w1, [x0+0x14]`   same DDRCTL family | DDRCTL + 0x10014 | same as #2 | TRM (partial) |

## Mid cluster (sites 8–10): 0x09124..0x0aaf8

| # | branch @ | body | register | src |
|---|---------|------|----------|-----|
| 8  | 0x09124 | 3 | DDRCTL + (via x27) — needs further context trace | — |
| 9  | 0x0aa84 | 3 | DDRCTL + (via x24) — ditto | — |
| 10 | 0x0aaf8 | 3 | abs `0xff000024` per decoder — **SRAM mirror of a GRF?** non-obvious | — |

**Site 10 is unusual** — absolute `0xff000024` is in the SRAM_BOOT
region, not a controller or PHY block. Possibly a BL2 handoff word
the blob waits on before continuing. Worth its own trace.

## Late cluster (sites 11–15): 0x0d154..0x0d378

| # | branch @ | body | register | src |
|---|---------|------|----------|-----|
| 11 | 0x0d154 | 3 | `ldr w5, [x0+0x14]` where x0=PHY+0x10000 → **PHY + 0x10014**, test `&0x7 == 1` | `PHY_STATE_014` (RE) — wait for state 1 | — |
| 12 | 0x0d340 | 2 | `ldr w1, [x0+0x118]` where x0=PHY+0x8000 → PHY + 0x8118 | `PHY_STAT_A_118` (RE) — train_phy_block | — |
| 13 | 0x0d34c | 2 | `ldr w1, [x0+0x120]` → PHY + 0x8120 | `PHY_STAT_B_120` (RE) | — |
| 14 | 0x0d364 | 2 | `ldr w1, [x0+0x184]` → PHY + 0x8184 | `PHY_HANDSHAKE_184` (RE, ack assert) | — |
| 15 | 0x0d378 | 2 | `ldr w1, [x0+0x184]` → PHY + 0x8184 | `PHY_HANDSHAKE_184` (RE, ack deassert) | — |

## Summary by coverage

- **TRM-documented (vendor-canonical names):** 1 site (site 3 — DDRCTL_DFISTAT).
- **TRM-documented family (0x14 offset in uMCTL2 space, exact register TBD):** 4 sites (2, 4, 5, 7).
- **DWC PUB / Innosilicon PHY — undocumented, RE names only:** 11 sites.

## Known tensions

1. **Site 3 tests DFISTAT bits[2:1] (mask 0x6), not bit[0].** Generic
   uMCTL2 DFISTAT has only bit[0] defined (`dfi_init_complete`); bits
   1+ are reserved. RK3588's blob treating bits[2:1] as meaningful
   suggests Rockchip extended the DFISTAT register with vendor-specific
   bits. Worth checking TRM bit tables for DFISTAT directly.

2. **Sites 2/4/5/7 all poll DDRCTL + 0x10014** with different bit
   masks (&0x7==1, &0x7==3, &0x30==0x20, &0x7==3). At offset +0x14 in
   uMCTL2 is `STAT` (Operating Mode Status Register) per generic DWC
   docs — `operating_mode[2:0]` field encodes: 0=Init, 1=Normal, 2=Power-down,
   3=Self-refresh, 5=Deep-power-down, 6=Deep-power-down init. RK3588
   probably follows this convention — these polls wait for the
   controller to enter specific operating modes.

3. **Site 10 at absolute `0xff000024`** is suspect. That region is
   SRAM_BOOT in our emulator map. Possibly a BL2 handshake word. If
   so, patching this site to "bounded retry" is safe — worst case
   we skip one BL2 handoff. Should flag this separately.

## Action items

- Extract DFISTAT bit-field description from TRM Part 2 to confirm/deny
  the RK3588 vendor extension hypothesis for site 3.
- Extract STAT (+0x14) bit-field description from TRM to confirm/deny
  the "operating_mode" mapping for sites 2/4/5/7.
- Special-case site 10 in the bisection plan — it's not a normal PHY
  poll and may need different treatment.