test0r
816848a474
- Ghidra decompilation of v1.02-v1.19 blobs (118 functions) - 53 functions renamed, 79 MMIO registers mapped to TRM - 45 timeout-less poll loops identified and patched - Production patcher (patch_prod.py) and QEMU emulator - Comprehensive analysis, frequency tables, community research Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
91 lines
3.8 KiB
Markdown
91 lines
3.8 KiB
Markdown
# RK3588 LPDDR5 Frequency Table
|
|
|
|
## Available DDR Blob Frequencies (rkbin)
|
|
|
|
### Official Rockchip Blobs
|
|
|
|
| Version | LP4 Freq | LP5 Freq | LP5 Data Rate | LP5 Bandwidth/ch | Status |
|
|
|---------|----------|----------|--------------|-------------------|--------|
|
|
| v1.09 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Oldest available |
|
|
| v1.10-v1.14 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Iterative fixes |
|
|
| v1.15 | 2112 MHz | **2736 MHz** | 5472 MT/s | 10.9 GB/s | Last 2736 blob |
|
|
| v1.16 | 2112 MHz | **2400 MHz** | 4800 MT/s | 9.6 GB/s | 2736 dropped |
|
|
| v1.17-v1.19 | 2112 MHz | **2400 MHz** | 4800 MT/s | 9.6 GB/s | Current |
|
|
| v1.19 (cons.) | 1848 MHz | **2112 MHz** | 4224 MT/s | 8.4 GB/s | Conservative |
|
|
|
|
### Community-Achieved Frequencies (via rkddr tool / DT overlay)
|
|
|
|
| LP5 Freq | Data Rate | Bandwidth/ch | Source | Stability |
|
|
|----------|----------|-------------|--------|-----------|
|
|
| 2112 MHz | 4224 MT/s | 8.4 GB/s | Official conservative | Rock solid |
|
|
| 2400 MHz | 4800 MT/s | 9.6 GB/s | Official default | Stable |
|
|
| 2736 MHz | 5472 MT/s | 10.9 GB/s | Old official (v1.15) | Dropped by Rockchip |
|
|
| 3200 MHz | 6400 MT/s | 12.8 GB/s | Community (hbiyik rkddr) | Works with SK Hynix rated modules |
|
|
|
|
## Binary Differences Between Frequency Blobs
|
|
|
|
The code is identical across all frequency variants. Only **timing parameter
|
|
bytes** differ in the data section:
|
|
|
|
| LP5 Frequency | Timing Value (32-bit LE) | Blob Offset (v1.19) |
|
|
|--------------|-------------------------|---------------------|
|
|
| 2112 MHz | 0x00216840 | 0x11BF4 |
|
|
| 2400 MHz | 0x00216960 | 0x11BF4 |
|
|
| 2736 MHz | 0x00210AB0 | 0x10F64 (v1.15) |
|
|
|
|
And for LP4:
|
|
|
|
| LP4 Frequency | Timing Value (32-bit LE) | Blob Offset (v1.19) |
|
|
|--------------|-------------------------|---------------------|
|
|
| 1848 MHz | 0x00210738 | 0x11B8C |
|
|
| 2112 MHz | 0x00210840 | 0x11B8C |
|
|
|
|
## How DDR Frequency Training Works
|
|
|
|
1. The DDR blob is loaded by BL2 (TPL) during early boot
|
|
2. It configures the DPLL (DDR PLL) via SCRU registers (0xFD7D0000)
|
|
3. It runs PHY training at the configured frequency
|
|
4. It trains **6 frequency steps** (main + 5 alternatives) for DVFS
|
|
5. Results are written to PMU GRF OS registers for Linux to read
|
|
6. Linux devfreq (rockchip-dfi driver) uses these for runtime frequency scaling
|
|
|
|
## JEDEC LPDDR5 Speed Grades
|
|
|
|
| Speed Grade | Data Rate | Clock | Notes |
|
|
|------------|----------|-------|-------|
|
|
| LPDDR5-3200 | 3200 MT/s | 1600 MHz | Minimum LPDDR5 spec |
|
|
| LPDDR5-4267 | 4267 MT/s | 2133 MHz | ≈ conservative blob |
|
|
| LPDDR5-4800 | 4800 MT/s | 2400 MHz | = default blob |
|
|
| LPDDR5-5500 | 5500 MT/s | 2750 MHz | ≈ 2736 blob (TRM "optimized") |
|
|
| LPDDR5-6400 | 6400 MT/s | 3200 MHz | Max JEDEC spec, community OC |
|
|
| LPDDR5X-7500 | 7500 MT/s | 3750 MHz | LPDDR5X only, not in RK3588 |
|
|
|
|
## Tools for Frequency Configuration
|
|
|
|
1. **rkddr** (https://github.com/hbiyik/rkddr) — TUI tool to edit DDR blob
|
|
parameters directly on the board. Supports setting any frequency + ODT/
|
|
drive strength parameters. Saves to eMMC/SPI flash IDB directly.
|
|
|
|
2. **ddrbin_tool** (in rkbin/tools/) — Rockchip's official DDR blob
|
|
configuration tool. Can set frequency, channel config, etc.
|
|
|
|
3. **Manual patching** — Change 6 bytes in the blob data section (as
|
|
documented in this analysis).
|
|
|
|
4. **Device tree overlay** — `rockchip-rk3588-dmc-oc-3500mhz` enables
|
|
frequency steps up to 3200 MHz for the devfreq governor.
|
|
|
|
## Recommendations for Rock 5 ITX+
|
|
|
|
Check your DRAM module first:
|
|
```
|
|
cat /sys/bus/platform/drivers/rockchip-dmc/dmc/devfreq/dmc/available_frequencies
|
|
```
|
|
|
|
- **SK Hynix LPDDR5** modules are rated for 6400 MT/s — can safely try 2736 or 3200
|
|
- **Samsung LPDDR5** varies — some rated 5500, some 6400
|
|
- **Micron LPDDR5** — typically 5500 MT/s max
|
|
|
|
Conservative recommendation: try v1.15 blob (2736 MHz) first. If stable,
|
|
consider rkddr for 3200 MHz with proper stress testing (stressapptest).
|