# RK3588 TRM Part 2 findings — 2026-04-15

Fetched `rk3588_part2.pdf` (55 MB, Rockchip 2022-03-15) via Stanford
mirror. Chapter 2 is a 522-page DMC section. Key facts for this
project:

## Register corrections

Our earlier `BUG_ANALYSIS.md` / `rk3588_regs_annotated.h` named three
poll-target registers based on educated guesses. The TRM gives us
vendor-canonical names:

| blob offset | old guess (ours) | TRM canonical | meaning |
|---|---|---|---|
| +0x10080 | MicroReset | **DDRCTL_MRCTRL0** | Mode Register Control — write to trigger MRS command to DRAM |
| +0x10090 | MicroContMuxSel | **DDRCTL_MRSTAT** | Mode Register Status — `mr_wr_busy` bit clears when MRS accepted |
| +0x10514 | UctWriteProtShadow | **DDRCTL_DFISTAT** | DFI Interface Status — `dfi_init_complete` bit from PHY |

**These are Rockchip uMCTL2 controller registers, not PHY firmware
registers.** The polls that wait on them are:
- MRSTAT polls: wait for MRS command to complete round-trip to DRAM
- DFISTAT polls: wait for PHY to finish DFI handshake with controller

Both have well-defined meanings. Much easier to reason about than the
"PHY firmware scratch state" interpretation we had.

## What's still undocumented

The low-offset polls in our d328 function (`+0x110`, `+0x118`, `+0x120`,
`+0x154`, `+0x160`, `+0x184`) plus `+0x684`, `+0xa24`, `+0xb88` are
**not** in this TRM. They're Synopsys DWC PUB registers — Rockchip
wraps the uMCTL2+PUB IP but doesn't republish the PUB register map.
Still requires black-box RE for those.

## 4 DDR channels

TRM confirms RK3588 has **four DDRCTL blocks** (DDRCTL0..DDRCTL3).
Each with its own register space at a distinct base. The blob's
`ctx->b8[ch]` array of channel base pointers lines up with this.

## What's still useful from the TRM

- The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write
  Ghidra comments that say `// poll DFISTAT.dfi_init_complete` instead
  of `// poll +0x10514`.
- The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
- The DFI protocol (chapter 2's DFI subsections) — names every step
  of the handshake between controller and PHY.
- All the DDRCTL timing parameter registers (TIMING_*, DRAMTMG*) — if
  we ever need to identify timing-table offsets in the blob.

## What the TRM is NOT

- It is not the **PHY PUB register manual**. Separate document (Synopsys
  DWC_ddrphy_pub_databook, NDA'd). We're still on our own for
  interpreting those poll sites.
- It doesn't document the **DDR-init blob format** (header, sections,
  parameter table layout). That's Rockchip-internal.

## Files cached

- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf` — 55 MB
  original (don't commit — too big for git).
- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt` — pdftotext
  output, greppable. Keep out of git (3 MB).

Part 1 (peripherals + clocks) also cached; relevant for PLL / power
domain / reset registers used by the DDR bring-up sequence, but not
for the poll sites themselves.