marfrit
e30127d056
Per RK3588 TRM Part 2 chapter 2 (DMC, 522 pages): +0x10080 = DDRCTL_MRCTRL0 (Mode Register Control, was MicroReset) +0x10090 = DDRCTL_MRSTAT (MR Status mr_wr_busy, was MicroContMuxSel) +0x10514 = DDRCTL_DFISTAT (DFI Status dfi_init_complete, was UctWriteProtShadow) These are uMCTL2 controller registers — Rockchip-documented — NOT the opaque PHY firmware scratch regs our 2026-04 analysis guessed. Poll semantics now vendor-grounded: wait for MR command roundtrip, wait for PHY-side DFI handshake. Low-offset polls in train_phy_block (0x110, 0x118, 0x120, 0x154, 0x160, 0x184) plus the 0x684/0xa24/0xb88 ones remain DWC PUB and thus undocumented; kept the best-effort RE names with `(RE)` tag in the BUG_ANALYSIS table so a reader can tell which ones are vendor-canonical and which are guesses. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
125 lines
6.1 KiB
C
125 lines
6.1 KiB
C
/* RK3588 DDR Init Blob - Annotated MMIO Register Map
|
|
* Cross-referenced with TRM Part 2 and kernel sources
|
|
*/
|
|
|
|
/* === Blob-internal data tables (not MMIO) === */
|
|
/* 0x0001xxxx - timing params, DDR config tables within the binary */
|
|
/* 0x001Fxxxx - likely shared memory / mailbox area */
|
|
|
|
/* === PMU1 GRF (0xFD588000) === */
|
|
#define _DAT_fd588080 REG32(0xFD588080) /* PMU1_GRF: DDR status/config */
|
|
|
|
/* === DDR GRF CH2 (0xFD598000) === */
|
|
#define _DAT_fd59800c REG32(0xFD59800C) /* DDR_GRF_CH2: channel config */
|
|
|
|
/* === BUS GRF (0xFD5F4000 / 0xFD5F8000) === */
|
|
/* BUS_IOC or DDR-related bus fabric config - 27 registers */
|
|
#define _DAT_fd5f4000 REG32(0xFD5F4000) /* BUS_GRF: base config */
|
|
#define _DAT_fd5f400c REG32(0xFD5F400C) /* BUS_GRF: status */
|
|
/* 0xFD5F8000-0xFD5F809C: Dense register block - DDR bus interconnect */
|
|
/* These control AXI fabric, QoS, and DDR routing */
|
|
#define _DAT_fd5f800c REG32(0xFD5F800C) /* bus_grf: DDR route cfg */
|
|
#define _DAT_fd5f8018 REG32(0xFD5F8018)
|
|
#define _DAT_fd5f8020 REG32(0xFD5F8020)
|
|
#define _DAT_fd5f8028 REG32(0xFD5F8028)
|
|
#define _DAT_fd5f802c REG32(0xFD5F802C)
|
|
#define _DAT_fd5f8030 REG32(0xFD5F8030)
|
|
#define _DAT_fd5f8038 REG32(0xFD5F8038)
|
|
#define _DAT_fd5f8044 REG32(0xFD5F8044)
|
|
#define _DAT_fd5f804c REG32(0xFD5F804C)
|
|
#define _DAT_fd5f8050 REG32(0xFD5F8050)
|
|
#define _DAT_fd5f8054 REG32(0xFD5F8054)
|
|
#define _DAT_fd5f805c REG32(0xFD5F805C)
|
|
#define _DAT_fd5f8060 REG32(0xFD5F8060)
|
|
#define _DAT_fd5f8068 REG32(0xFD5F8068)
|
|
#define _DAT_fd5f806c REG32(0xFD5F806C)
|
|
#define _DAT_fd5f8070 REG32(0xFD5F8070)
|
|
#define _DAT_fd5f8074 REG32(0xFD5F8074)
|
|
#define _DAT_fd5f8078 REG32(0xFD5F8078)
|
|
#define _DAT_fd5f807c REG32(0xFD5F807C)
|
|
#define _DAT_fd5f8080 REG32(0xFD5F8080)
|
|
#define _DAT_fd5f8084 REG32(0xFD5F8084)
|
|
#define _DAT_fd5f8088 REG32(0xFD5F8088)
|
|
#define _DAT_fd5f808c REG32(0xFD5F808C)
|
|
#define _DAT_fd5f8098 REG32(0xFD5F8098)
|
|
#define _DAT_fd5f809c REG32(0xFD5F809C)
|
|
|
|
/* === PMU CRU / Secure CRU (0xFD8C8000) === */
|
|
/* Clock gate and reset controls for DDR subsystem */
|
|
#define _DAT_fd8c8004 REG32(0xFD8C8004) /* SCRU: DDR clock gate */
|
|
#define _DAT_fd8c8008 REG32(0xFD8C8008) /* SCRU: DDR reset */
|
|
#define _DAT_fd8c8014 REG32(0xFD8C8014) /* SCRU: DPLL config */
|
|
#define _DAT_fd8c8018 REG32(0xFD8C8018) /* SCRU: DPLL status */
|
|
|
|
/* === DDRC CH0 (0xFE010000) === */
|
|
/* Synopsys UMCTL2 registers - only 4 accessed directly */
|
|
#define _DAT_fe0100f0 REG32(0xFE0100F0) /* DDRC_CH0 + 0xF0: MSTR/timing? */
|
|
#define _DAT_fe0100f4 REG32(0xFE0100F4) /* DDRC_CH0 + 0xF4 */
|
|
#define _DAT_fe0100f8 REG32(0xFE0100F8) /* DDRC_CH0 + 0xF8 */
|
|
#define _DAT_fe0100fc REG32(0xFE0100FC) /* DDRC_CH0 + 0xFC */
|
|
|
|
/* === FIREWALL DDR (0xFE030000) === */
|
|
#define _DAT_fe030040 REG32(0xFE030040) /* FW_DDR: access control */
|
|
|
|
/* === SGRF (0xFE050000) - Security GRF === */
|
|
/* Controls which bus masters can access DDR regions */
|
|
#define _DAT_fe050000 REG32(0xFE050000) /* SGRF_DDR_CON0 */
|
|
#define _DAT_fe050004 REG32(0xFE050004) /* SGRF_DDR_CON1 */
|
|
#define _DAT_fe050008 REG32(0xFE050008) /* SGRF_DDR_CON2 */
|
|
#define _DAT_fe05000c REG32(0xFE05000C) /* SGRF_DDR_CON3 */
|
|
#define _DAT_fe05002c REG32(0xFE05002C) /* SGRF_DDR_CON11 */
|
|
#define _DAT_fe050054 REG32(0xFE050054) /* SGRF_DDR_CON21 */
|
|
#define _DAT_fe050058 REG32(0xFE050058) /* SGRF_DDR_CON22 */
|
|
#define _DAT_fe0500e0 REG32(0xFE0500E0) /* SGRF: status/busy poll */
|
|
#define _DAT_fe0500e4 REG32(0xFE0500E4) /* SGRF: enable/lock */
|
|
|
|
/* === Unknown 0xFECC0000 region === */
|
|
/* Possibly DDR Scramble / ECC or VO-related */
|
|
#define _DAT_fecc0004 REG32(0xFECC0004)
|
|
#define _DAT_fecc0008 REG32(0xFECC0008)
|
|
#define _DAT_fecc0020 REG32(0xFECC0020)
|
|
#define _DAT_fecc0084 REG32(0xFECC0084)
|
|
|
|
/* === SRAM (0xFF000000) === */
|
|
#define _DAT_ff000010 REG32(0xFF000010) /* SRAM: boot flag/mailbox */
|
|
|
|
/* =====================================================================
|
|
* TRM-CANONICAL names for poll-site registers (RK3588 TRM Part 2 Ch.2)
|
|
* Added 2026-04-15 after cross-referencing the 522-page DMC chapter.
|
|
* Offsets are within a DDRCTL (uMCTL2) per-channel base.
|
|
* =====================================================================
|
|
*/
|
|
|
|
#define DDRCTL_MRCTRL0 0x10080 /* Mode Register Control 0
|
|
- mr_wr[31]: write a MR command
|
|
- mr_addr[23:16]: MR address
|
|
- mr_data[15:0]: MR data to write
|
|
Previously guessed as "MicroReset". */
|
|
|
|
#define DDRCTL_MRSTAT 0x10090 /* Mode Register Status
|
|
- mr_wr_busy[0]: 1 while MR cmd in flight
|
|
Poll: WAIT for bit 0 == 0.
|
|
Previously guessed as "MicroContMuxSel". */
|
|
|
|
#define DDRCTL_DFISTAT 0x10514 /* DFI Status
|
|
- dfi_init_complete[0]: 1 when PHY ready
|
|
Poll: WAIT for bit 0 == 1.
|
|
Previously guessed as "UctWriteProtShadow". */
|
|
|
|
/* Low-offset polls in FUN_0000d328 (train_phy_block) and friends are
|
|
* Synopsys DWC PUB registers — NOT in RK3588 TRM. Still require RE.
|
|
* The heuristic labels below come from the d328 analysis (2026-04-15):
|
|
*/
|
|
#define PHY_OFF_BASE 0x8000 /* sub-block offset within a PHY used by d328 */
|
|
|
|
#define PHY_CTL_110 0x110 /* write 0xF000F000 to trigger step, 0xF0000000 to clear */
|
|
#define PHY_STAT_A_118 0x118 /* wait for bits[31:28] != 0 */
|
|
#define PHY_STAT_B_120 0x120 /* wait for bits[31:28] != 0 */
|
|
#define PHY_CFG_A_154 0x154 /* write 0x30003 (go), 0x30000 (end) */
|
|
#define PHY_CFG_B_160 0x160 /* write 0x30003 (go), 0x30000 (end) */
|
|
#define PHY_HANDSHAKE_184 0x184 /* wait for bits[1:0] non-zero, then zero */
|
|
|
|
/* The large-offset polls (0xb88, 0xa24, 0x684) in the early-cluster
|
|
* functions are also DWC PUB; semantic guesses in BUG_ANALYSIS.md. */
|
|
|