Files

T

test0r 816848a474 RK3588 DDR init blob reverse engineering

- Ghidra decompilation of v1.02-v1.19 blobs (118 functions)
- 53 functions renamed, 79 MMIO registers mapped to TRM
- 45 timeout-less poll loops identified and patched
- Production patcher (patch_prod.py) and QEMU emulator
- Comprehensive analysis, frequency tables, community research

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-03 13:06:47 +02:00

3.8 KiB

Raw Permalink Blame History

RK3588 LPDDR5 Frequency Table

Available DDR Blob Frequencies (rkbin)

Official Rockchip Blobs

Version	LP4 Freq	LP5 Freq	LP5 Data Rate	LP5 Bandwidth/ch	Status
v1.09	2112 MHz	2736 MHz	5472 MT/s	10.9 GB/s	Oldest available
v1.10-v1.14	2112 MHz	2736 MHz	5472 MT/s	10.9 GB/s	Iterative fixes
v1.15	2112 MHz	2736 MHz	5472 MT/s	10.9 GB/s	Last 2736 blob
v1.16	2112 MHz	2400 MHz	4800 MT/s	9.6 GB/s	2736 dropped
v1.17-v1.19	2112 MHz	2400 MHz	4800 MT/s	9.6 GB/s	Current
v1.19 (cons.)	1848 MHz	2112 MHz	4224 MT/s	8.4 GB/s	Conservative

Community-Achieved Frequencies (via rkddr tool / DT overlay)

LP5 Freq	Data Rate	Bandwidth/ch	Source	Stability
2112 MHz	4224 MT/s	8.4 GB/s	Official conservative	Rock solid
2400 MHz	4800 MT/s	9.6 GB/s	Official default	Stable
2736 MHz	5472 MT/s	10.9 GB/s	Old official (v1.15)	Dropped by Rockchip
3200 MHz	6400 MT/s	12.8 GB/s	Community (hbiyik rkddr)	Works with SK Hynix rated modules

Binary Differences Between Frequency Blobs

The code is identical across all frequency variants. Only timing parameter bytes differ in the data section:

LP5 Frequency	Timing Value (32-bit LE)	Blob Offset (v1.19)
2112 MHz	0x00216840	0x11BF4
2400 MHz	0x00216960	0x11BF4
2736 MHz	0x00210AB0	0x10F64 (v1.15)

And for LP4:

LP4 Frequency	Timing Value (32-bit LE)	Blob Offset (v1.19)
1848 MHz	0x00210738	0x11B8C
2112 MHz	0x00210840	0x11B8C

How DDR Frequency Training Works

The DDR blob is loaded by BL2 (TPL) during early boot
It configures the DPLL (DDR PLL) via SCRU registers (0xFD7D0000)
It runs PHY training at the configured frequency
It trains 6 frequency steps (main + 5 alternatives) for DVFS
Results are written to PMU GRF OS registers for Linux to read
Linux devfreq (rockchip-dfi driver) uses these for runtime frequency scaling

JEDEC LPDDR5 Speed Grades

Speed Grade	Data Rate	Clock	Notes
LPDDR5-3200	3200 MT/s	1600 MHz	Minimum LPDDR5 spec
LPDDR5-4267	4267 MT/s	2133 MHz	≈ conservative blob
LPDDR5-4800	4800 MT/s	2400 MHz	= default blob
LPDDR5-5500	5500 MT/s	2750 MHz	≈ 2736 blob (TRM "optimized")
LPDDR5-6400	6400 MT/s	3200 MHz	Max JEDEC spec, community OC
LPDDR5X-7500	7500 MT/s	3750 MHz	LPDDR5X only, not in RK3588

Tools for Frequency Configuration

rkddr (https://github.com/hbiyik/rkddr) — TUI tool to edit DDR blob parameters directly on the board. Supports setting any frequency + ODT/ drive strength parameters. Saves to eMMC/SPI flash IDB directly.
ddrbin_tool (in rkbin/tools/) — Rockchip's official DDR blob configuration tool. Can set frequency, channel config, etc.
Manual patching — Change 6 bytes in the blob data section (as documented in this analysis).
Device tree overlay — rockchip-rk3588-dmc-oc-3500mhz enables frequency steps up to 3200 MHz for the devfreq governor.

Recommendations for Rock 5 ITX+

Check your DRAM module first:

cat /sys/bus/platform/drivers/rockchip-dmc/dmc/devfreq/dmc/available_frequencies

SK Hynix LPDDR5 modules are rated for 6400 MT/s — can safely try 2736 or 3200
Samsung LPDDR5 varies — some rated 5500, some 6400
Micron LPDDR5 — typically 5500 MT/s max

Conservative recommendation: try v1.15 blob (2736 MHz) first. If stable, consider rkddr for 3200 MHz with proper stress testing (stressapptest).

3.8 KiB Raw Permalink Blame History