marfrit
5aef5bd118
TRM Part 2 chapter 2 (DMC, 522 pages) reveals the offsets we poll at +0x10080/+0x10090/+0x10514 are NOT PHY firmware scratch regs as our earlier analysis guessed. They are uMCTL2 controller registers: +0x10080 = DDRCTL_MRCTRL0 (Mode Register Control) +0x10090 = DDRCTL_MRSTAT (Mode Register Status — wait for MR complete) +0x10514 = DDRCTL_DFISTAT (DFI Status — wait for PHY handshake) Semantics are now grounded in vendor docs instead of educated guesses. The PHY-side polls (0x110, 0x118, 0x184 etc. in d328) remain undocumented — TRM does not republish the Synopsys DWC PUB register map. Still need RE for those. TRM cached at boltzmann:~/projects/AMPere/vendor/trm/ (pdf + txt). Fetched via Stanford mirror (surfaced by the Chinese-language research sibling alongside rk-open-docs, mfkiwl/rk-open-docs which has Rockchip internal DDR docs for RK322x..RK1808 era — Innosilicon PHY, not our DWC multiPHY, so useful for methodology but not direct reference). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2.9 KiB
RK3588 TRM Part 2 findings — 2026-04-15
Fetched rk3588_part2.pdf (55 MB, Rockchip 2022-03-15) via Stanford
mirror. Chapter 2 is a 522-page DMC section. Key facts for this
project:
Register corrections
Our earlier BUG_ANALYSIS.md / rk3588_regs_annotated.h named three
poll-target registers based on educated guesses. The TRM gives us
vendor-canonical names:
| blob offset | old guess (ours) | TRM canonical | meaning |
|---|---|---|---|
| +0x10080 | MicroReset | DDRCTL_MRCTRL0 | Mode Register Control — write to trigger MRS command to DRAM |
| +0x10090 | MicroContMuxSel | DDRCTL_MRSTAT | Mode Register Status — mr_wr_busy bit clears when MRS accepted |
| +0x10514 | UctWriteProtShadow | DDRCTL_DFISTAT | DFI Interface Status — dfi_init_complete bit from PHY |
These are Rockchip uMCTL2 controller registers, not PHY firmware registers. The polls that wait on them are:
- MRSTAT polls: wait for MRS command to complete round-trip to DRAM
- DFISTAT polls: wait for PHY to finish DFI handshake with controller
Both have well-defined meanings. Much easier to reason about than the "PHY firmware scratch state" interpretation we had.
What's still undocumented
The low-offset polls in our d328 function (+0x110, +0x118, +0x120,
+0x154, +0x160, +0x184) plus +0x684, +0xa24, +0xb88 are
not in this TRM. They're Synopsys DWC PUB registers — Rockchip
wraps the uMCTL2+PUB IP but doesn't republish the PUB register map.
Still requires black-box RE for those.
4 DDR channels
TRM confirms RK3588 has four DDRCTL blocks (DDRCTL0..DDRCTL3).
Each with its own register space at a distinct base. The blob's
ctx->b8[ch] array of channel base pointers lines up with this.
What's still useful from the TRM
- The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write
Ghidra comments that say
// poll DFISTAT.dfi_init_completeinstead of// poll +0x10514. - The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
- The DFI protocol (chapter 2's DFI subsections) — names every step of the handshake between controller and PHY.
- All the DDRCTL timing parameter registers (TIMING_, DRAMTMG) — if we ever need to identify timing-table offsets in the blob.
What the TRM is NOT
- It is not the PHY PUB register manual. Separate document (Synopsys DWC_ddrphy_pub_databook, NDA'd). We're still on our own for interpreting those poll sites.
- It doesn't document the DDR-init blob format (header, sections, parameter table layout). That's Rockchip-internal.
Files cached
boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf— 55 MB original (don't commit — too big for git).boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt— pdftotext output, greppable. Keep out of git (3 MB).
Part 1 (peripherals + clocks) also cached; relevant for PLL / power domain / reset registers used by the DDR bring-up sequence, but not for the poll sites themselves.