marfrit
be59c91707
Decoded all 16 poll sites against RK3588 TRM Part 2 where possible:
- 1 site (site 3) polls DDRCTL_DFISTAT (vendor-canonical, TRM-named)
- 4 sites (2,4,5,7) poll DDRCTL + 0x10014 — likely STAT.operating_mode
per generic DWC uMCTL2 convention; TRM cross-ref TBD
- 11 sites are DWC PUB / Innosilicon PHY — still RE-only (TRM does
not republish the PHY register map)
- 1 unusual site (site 10) polls absolute 0xff000024 in SRAM_BOOT
region — possibly a BL2 handoff word, not a PHY poll. Flagged for
special treatment in the v3fb bisection plan.
Known tensions documented:
- Site 3's DFISTAT test uses bits[2:1] (mask 0x6), generic uMCTL2 has
only bit[0] defined there → RK3588 likely extends DFISTAT with
vendor-specific bits. Need to verify from TRM bit tables.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
82 lines
4.6 KiB
Markdown
82 lines
4.6 KiB
Markdown
# Poll-site → register map (RK3588 DDR v1.19)
|
||
|
||
Each of the 16 timeout-less poll sites in the v1.19 stock conservative
|
||
blob, decoded against the RK3588 TRM Part 2 (Ch. 2, DMC) where
|
||
possible. Sites without TRM coverage are Synopsys DWC PUB registers —
|
||
not republished by Rockchip; names ending in `(RE)` are our educated
|
||
guesses from the code context.
|
||
|
||
Site index comes from `patch_timeouts_v3.py` (ascending-offset order
|
||
after `find_poll_loops()`).
|
||
|
||
## Early cluster (sites 0–7): 0x07b78..0x07f08
|
||
|
||
| # | branch @ | body | load | addr (symbolic) | register | src |
|
||
|---|---------|------|------|-----------------|----------|-----|
|
||
| 0 | 0x07b78 | 2 | `ldr w1, [x0+0x114]` on x0=PHY+0x20000 | PHY + 0x20114 | `PHY_TRAIN_INTERLOCK_114` (RE) | — |
|
||
| 1 | 0x07ba4 | 2 | `ldr w1, [x26+0xb88]` where x26=PHY+0x10000 | PHY + 0x10b88 | `PHY_SHADOW_BB8` (RE) | — |
|
||
| 2 | 0x07c8c | 3 | `ldr w0, [x1+0x14]` where x1=DDRCTL+0x10000 | **DDRCTL + 0x10014** | `DDRCTL_PWRCTL`? (TBD — 0x14 offset in uMCTL2 is typically PWRCTL or STAT) | TRM (partial) |
|
||
| 3 | 0x07ca8 | 2 | `ldr w1, [x0+0x514]` where x0=DDRCTL+0x10000 | **DDRCTL + 0x10514** | **DDRCTL_DFISTAT** `dfi_init_complete` | **TRM Part 2 Ch.2** |
|
||
| 4 | 0x07cd4 | 3 | `ldr w0, [x1+0x14]` same pattern as site 2 | DDRCTL + 0x10014 | same as #2 | TRM (partial) |
|
||
| 5 | 0x07ce8 | 3 | same +0x14 load, different mask | DDRCTL + 0x10014 | same as #2 | TRM (partial) |
|
||
| 6 | 0x07d0c | 3 | `ldr w0, [x26+0xb88]` where x26=PHY+0x10000 | PHY + 0x10b88 | `PHY_SHADOW_BB8` (RE) — same reg as site 1, different mask | — |
|
||
| 7 | 0x07f08 | 3 | `ldr w1, [x0+0x14]` same DDRCTL family | DDRCTL + 0x10014 | same as #2 | TRM (partial) |
|
||
|
||
## Mid cluster (sites 8–10): 0x09124..0x0aaf8
|
||
|
||
| # | branch @ | body | register | src |
|
||
|---|---------|------|----------|-----|
|
||
| 8 | 0x09124 | 3 | DDRCTL + (via x27) — needs further context trace | — |
|
||
| 9 | 0x0aa84 | 3 | DDRCTL + (via x24) — ditto | — |
|
||
| 10 | 0x0aaf8 | 3 | abs `0xff000024` per decoder — **SRAM mirror of a GRF?** non-obvious | — |
|
||
|
||
**Site 10 is unusual** — absolute `0xff000024` is in the SRAM_BOOT
|
||
region, not a controller or PHY block. Possibly a BL2 handoff word
|
||
the blob waits on before continuing. Worth its own trace.
|
||
|
||
## Late cluster (sites 11–15): 0x0d154..0x0d378
|
||
|
||
| # | branch @ | body | register | src |
|
||
|---|---------|------|----------|-----|
|
||
| 11 | 0x0d154 | 3 | `ldr w5, [x0+0x14]` where x0=PHY+0x10000 → **PHY + 0x10014**, test `&0x7 == 1` | `PHY_STATE_014` (RE) — wait for state 1 | — |
|
||
| 12 | 0x0d340 | 2 | `ldr w1, [x0+0x118]` where x0=PHY+0x8000 → PHY + 0x8118 | `PHY_STAT_A_118` (RE) — train_phy_block | — |
|
||
| 13 | 0x0d34c | 2 | `ldr w1, [x0+0x120]` → PHY + 0x8120 | `PHY_STAT_B_120` (RE) | — |
|
||
| 14 | 0x0d364 | 2 | `ldr w1, [x0+0x184]` → PHY + 0x8184 | `PHY_HANDSHAKE_184` (RE, ack assert) | — |
|
||
| 15 | 0x0d378 | 2 | `ldr w1, [x0+0x184]` → PHY + 0x8184 | `PHY_HANDSHAKE_184` (RE, ack deassert) | — |
|
||
|
||
## Summary by coverage
|
||
|
||
- **TRM-documented (vendor-canonical names):** 1 site (site 3 — DDRCTL_DFISTAT).
|
||
- **TRM-documented family (0x14 offset in uMCTL2 space, exact register TBD):** 4 sites (2, 4, 5, 7).
|
||
- **DWC PUB / Innosilicon PHY — undocumented, RE names only:** 11 sites.
|
||
|
||
## Known tensions
|
||
|
||
1. **Site 3 tests DFISTAT bits[2:1] (mask 0x6), not bit[0].** Generic
|
||
uMCTL2 DFISTAT has only bit[0] defined (`dfi_init_complete`); bits
|
||
1+ are reserved. RK3588's blob treating bits[2:1] as meaningful
|
||
suggests Rockchip extended the DFISTAT register with vendor-specific
|
||
bits. Worth checking TRM bit tables for DFISTAT directly.
|
||
|
||
2. **Sites 2/4/5/7 all poll DDRCTL + 0x10014** with different bit
|
||
masks (&0x7==1, &0x7==3, &0x30==0x20, &0x7==3). At offset +0x14 in
|
||
uMCTL2 is `STAT` (Operating Mode Status Register) per generic DWC
|
||
docs — `operating_mode[2:0]` field encodes: 0=Init, 1=Normal, 2=Power-down,
|
||
3=Self-refresh, 5=Deep-power-down, 6=Deep-power-down init. RK3588
|
||
probably follows this convention — these polls wait for the
|
||
controller to enter specific operating modes.
|
||
|
||
3. **Site 10 at absolute `0xff000024`** is suspect. That region is
|
||
SRAM_BOOT in our emulator map. Possibly a BL2 handshake word. If
|
||
so, patching this site to "bounded retry" is safe — worst case
|
||
we skip one BL2 handoff. Should flag this separately.
|
||
|
||
## Action items
|
||
|
||
- Extract DFISTAT bit-field description from TRM Part 2 to confirm/deny
|
||
the RK3588 vendor extension hypothesis for site 3.
|
||
- Extract STAT (+0x14) bit-field description from TRM to confirm/deny
|
||
the "operating_mode" mapping for sites 2/4/5/7.
|
||
- Special-case site 10 in the bisection plan — it's not a normal PHY
|
||
poll and may need different treatment.
|