marfrit
5aef5bd118
TRM Part 2 chapter 2 (DMC, 522 pages) reveals the offsets we poll at +0x10080/+0x10090/+0x10514 are NOT PHY firmware scratch regs as our earlier analysis guessed. They are uMCTL2 controller registers: +0x10080 = DDRCTL_MRCTRL0 (Mode Register Control) +0x10090 = DDRCTL_MRSTAT (Mode Register Status — wait for MR complete) +0x10514 = DDRCTL_DFISTAT (DFI Status — wait for PHY handshake) Semantics are now grounded in vendor docs instead of educated guesses. The PHY-side polls (0x110, 0x118, 0x184 etc. in d328) remain undocumented — TRM does not republish the Synopsys DWC PUB register map. Still need RE for those. TRM cached at boltzmann:~/projects/AMPere/vendor/trm/ (pdf + txt). Fetched via Stanford mirror (surfaced by the Chinese-language research sibling alongside rk-open-docs, mfkiwl/rk-open-docs which has Rockchip internal DDR docs for RK322x..RK1808 era — Innosilicon PHY, not our DWC multiPHY, so useful for methodology but not direct reference). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
70 lines
2.9 KiB
Markdown
70 lines
2.9 KiB
Markdown
# RK3588 TRM Part 2 findings — 2026-04-15
|
|
|
|
Fetched `rk3588_part2.pdf` (55 MB, Rockchip 2022-03-15) via Stanford
|
|
mirror. Chapter 2 is a 522-page DMC section. Key facts for this
|
|
project:
|
|
|
|
## Register corrections
|
|
|
|
Our earlier `BUG_ANALYSIS.md` / `rk3588_regs_annotated.h` named three
|
|
poll-target registers based on educated guesses. The TRM gives us
|
|
vendor-canonical names:
|
|
|
|
| blob offset | old guess (ours) | TRM canonical | meaning |
|
|
|---|---|---|---|
|
|
| +0x10080 | MicroReset | **DDRCTL_MRCTRL0** | Mode Register Control — write to trigger MRS command to DRAM |
|
|
| +0x10090 | MicroContMuxSel | **DDRCTL_MRSTAT** | Mode Register Status — `mr_wr_busy` bit clears when MRS accepted |
|
|
| +0x10514 | UctWriteProtShadow | **DDRCTL_DFISTAT** | DFI Interface Status — `dfi_init_complete` bit from PHY |
|
|
|
|
**These are Rockchip uMCTL2 controller registers, not PHY firmware
|
|
registers.** The polls that wait on them are:
|
|
- MRSTAT polls: wait for MRS command to complete round-trip to DRAM
|
|
- DFISTAT polls: wait for PHY to finish DFI handshake with controller
|
|
|
|
Both have well-defined meanings. Much easier to reason about than the
|
|
"PHY firmware scratch state" interpretation we had.
|
|
|
|
## What's still undocumented
|
|
|
|
The low-offset polls in our d328 function (`+0x110`, `+0x118`, `+0x120`,
|
|
`+0x154`, `+0x160`, `+0x184`) plus `+0x684`, `+0xa24`, `+0xb88` are
|
|
**not** in this TRM. They're Synopsys DWC PUB registers — Rockchip
|
|
wraps the uMCTL2+PUB IP but doesn't republish the PUB register map.
|
|
Still requires black-box RE for those.
|
|
|
|
## 4 DDR channels
|
|
|
|
TRM confirms RK3588 has **four DDRCTL blocks** (DDRCTL0..DDRCTL3).
|
|
Each with its own register space at a distinct base. The blob's
|
|
`ctx->b8[ch]` array of channel base pointers lines up with this.
|
|
|
|
## What's still useful from the TRM
|
|
|
|
- The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write
|
|
Ghidra comments that say `// poll DFISTAT.dfi_init_complete` instead
|
|
of `// poll +0x10514`.
|
|
- The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
|
|
- The DFI protocol (chapter 2's DFI subsections) — names every step
|
|
of the handshake between controller and PHY.
|
|
- All the DDRCTL timing parameter registers (TIMING_*, DRAMTMG*) — if
|
|
we ever need to identify timing-table offsets in the blob.
|
|
|
|
## What the TRM is NOT
|
|
|
|
- It is not the **PHY PUB register manual**. Separate document (Synopsys
|
|
DWC_ddrphy_pub_databook, NDA'd). We're still on our own for
|
|
interpreting those poll sites.
|
|
- It doesn't document the **DDR-init blob format** (header, sections,
|
|
parameter table layout). That's Rockchip-internal.
|
|
|
|
## Files cached
|
|
|
|
- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf` — 55 MB
|
|
original (don't commit — too big for git).
|
|
- `boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt` — pdftotext
|
|
output, greppable. Keep out of git (3 MB).
|
|
|
|
Part 1 (peripherals + clocks) also cached; relevant for PLL / power
|
|
domain / reset registers used by the DDR bring-up sequence, but not
|
|
for the poll sites themselves.
|