Files

T

marfrit 5aef5bd118 benchmark/TRM_FINDINGS.md: register-name corrections from RK3588 TRM

TRM Part 2 chapter 2 (DMC, 522 pages) reveals the offsets we poll at
+0x10080/+0x10090/+0x10514 are NOT PHY firmware scratch regs as our
earlier analysis guessed. They are uMCTL2 controller registers:

  +0x10080 = DDRCTL_MRCTRL0  (Mode Register Control)
  +0x10090 = DDRCTL_MRSTAT   (Mode Register Status — wait for MR complete)
  +0x10514 = DDRCTL_DFISTAT  (DFI Status — wait for PHY handshake)

Semantics are now grounded in vendor docs instead of educated guesses.
The PHY-side polls (0x110, 0x118, 0x184 etc. in d328) remain
undocumented — TRM does not republish the Synopsys DWC PUB register
map. Still need RE for those.

TRM cached at boltzmann:~/projects/AMPere/vendor/trm/ (pdf + txt).
Fetched via Stanford mirror (surfaced by the Chinese-language research
sibling alongside rk-open-docs, mfkiwl/rk-open-docs which has Rockchip
internal DDR docs for RK322x..RK1808 era — Innosilicon PHY, not our
DWC multiPHY, so useful for methodology but not direct reference).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-15 08:19:18 +02:00

2.9 KiB

Raw Blame History

RK3588 TRM Part 2 findings — 2026-04-15

Fetched rk3588_part2.pdf (55 MB, Rockchip 2022-03-15) via Stanford mirror. Chapter 2 is a 522-page DMC section. Key facts for this project:

Register corrections

Our earlier BUG_ANALYSIS.md / rk3588_regs_annotated.h named three poll-target registers based on educated guesses. The TRM gives us vendor-canonical names:

blob offset	old guess (ours)	TRM canonical	meaning
+0x10080	MicroReset	DDRCTL_MRCTRL0	Mode Register Control — write to trigger MRS command to DRAM
+0x10090	MicroContMuxSel	DDRCTL_MRSTAT	Mode Register Status — `mr_wr_busy` bit clears when MRS accepted
+0x10514	UctWriteProtShadow	DDRCTL_DFISTAT	DFI Interface Status — `dfi_init_complete` bit from PHY

These are Rockchip uMCTL2 controller registers, not PHY firmware registers. The polls that wait on them are:

MRSTAT polls: wait for MRS command to complete round-trip to DRAM
DFISTAT polls: wait for PHY to finish DFI handshake with controller

Both have well-defined meanings. Much easier to reason about than the "PHY firmware scratch state" interpretation we had.

What's still undocumented

The low-offset polls in our d328 function (+0x110, +0x118, +0x120, +0x154, +0x160, +0x184) plus +0x684, +0xa24, +0xb88 are not in this TRM. They're Synopsys DWC PUB registers — Rockchip wraps the uMCTL2+PUB IP but doesn't republish the PUB register map. Still requires black-box RE for those.

4 DDR channels

TRM confirms RK3588 has four DDRCTL blocks (DDRCTL0..DDRCTL3). Each with its own register space at a distinct base. The blob's ctx->b8[ch] array of channel base pointers lines up with this.

What's still useful from the TRM

The full MRCTRL0 / MRSTAT / DFISTAT bit definitions — lets us write Ghidra comments that say // poll DFISTAT.dfi_init_complete instead of // poll +0x10514.
The MRS command protocol: what mr_wr, mr_addr, mr_rank mean.
The DFI protocol (chapter 2's DFI subsections) — names every step of the handshake between controller and PHY.
All the DDRCTL timing parameter registers (TIMING_, DRAMTMG) — if we ever need to identify timing-table offsets in the blob.

What the TRM is NOT

It is not the PHY PUB register manual. Separate document (Synopsys DWC_ddrphy_pub_databook, NDA'd). We're still on our own for interpreting those poll sites.
It doesn't document the DDR-init blob format (header, sections, parameter table layout). That's Rockchip-internal.

Files cached

boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.pdf — 55 MB original (don't commit — too big for git).
boltzmann:~/projects/AMPere/vendor/trm/rk3588_part2.txt — pdftotext output, greppable. Keep out of git (3 MB).

Part 1 (peripherals + clocks) also cached; relevant for PLL / power domain / reset registers used by the DDR bring-up sequence, but not for the poll sites themselves.

2.9 KiB Raw Blame History