RK3588 DDR Init Blob Reverse Engineering

Analysis of the closed-source Rockchip RK3588 DDR initialization binary blobs, decompiled with Ghidra on oppenheimer (Proxmox CT131 on data).

• Blob: rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.19.bin (76,704 bytes)
• Architecture: AArch64 (64-bit ARM), runs on A76/A55 cores during early boot
• Functions: 118 decompiled, 17,308 assembly instructions
• Tools: Ghidra 11.3.2 headless, hbiyik/rkddr
• Source files: boltzmann:~/src/rk3588-ddr-decompiled/

The “fast” (2112/2400 MHz) and “conservative” (1848/2112 MHz) blobs have identical code. Only 6 bytes of timing data and 8 bytes of version string differ:

This means custom DDR frequencies can be set by patching just these bytes.

The blob accesses 79 unique hardware registers across 9 blocks:

Base addresses verified against RK3588 TRM Part 2 and Linux kernel DT sources.

1. No timeout on hardware polls: FUN_000000e4 polls SGRF status (0xFE0500E0) in a tight loop. If SGRF doesn't respond, the system hangs permanently during boot.
2. Firewall opened wide: _DAT_fe030040 |= 0xffff opens all DDR firewall masters during init and never re-restricts them.
3. Single-channel direct access: Only DDRC CH0 (0xFE01xxxx) is accessed directly. Channels 1-3 are configured via broadcast through BUS_GRF.

1. DDR blob loaded by BL2 (TPL) during early boot
2. Configures DPLL via SCRU registers (0xFD7D0000)
3. Opens DDR firewall and SGRF for access
4. Configures BUS_GRF (27 registers — DDR bus interconnect)
5. Runs PHY training at configured frequency
6. Trains 6 frequency steps (main + 5 alternatives) for DVFS
7. Writes results to PMU GRF OS registers
8. Linux devfreq (rockchip-dfi driver) reads these for runtime frequency scaling

• rkddr — TUI tool to edit DDR blob parameters directly on the board. Supports any frequency + ODT/drive strength. Saves to eMMC/SPI flash IDB.
• ddrbin_tool (in rkbin/tools/) — Rockchip's official blob configuration tool.
• Manual patching — Change 6 bytes in data section as documented above.
• Device tree overlay — rockchip-rk3588-dmc-oc-3500mhz enables frequency steps up to 3200 MHz for devfreq.

Check your DRAM module:

cat /sys/bus/platform/drivers/rockchip-dmc/dmc/devfreq/dmc/available_frequencies

• SK Hynix LPDDR5 modules are rated for 6400 MT/s — safe to try 2736 or 3200
• Samsung varies — some 5500, some 6400
• Micron — typically 5500 MT/s max

Recommendation: try the old v1.15 blob (2736 MHz) first. If stable, use rkddr for 3200 MHz with stress testing (stressapptest).

Impact for LLM inference: 2400→3200 MHz = ~33% more memory bandwidth = proportional tok/s improvement on memory-bound workloads.

All analysis files on boltzmann:~/src/rk3588-ddr-decompiled/:

• ddr_decompiled.c — Decompiled C (fast blob, 118 functions, 11,923 lines)
• ddr_conservative_decompiled.c — Decompiled C (conservative blob)
• ddr_diff.txt — Diff between fast and conservative
• ddr_fast_asm.s / ddr_conservative_asm.s — Full disassembly (17,308 lines each)
• rk3588_ddr.h — Register definitions header (TRM-verified)
• rk3588_regs_annotated.h — All 79 MMIO registers with block annotations
• DDR_FREQUENCY_TABLE.md — Complete frequency table
• ANALYSIS.md — Full analysis report
• Ghidra project on oppenheimer (CT131 on data): /opt/work/ghidra_project/

Generated by Claude Code, 2026-04-03

DDR training is the calibration process where the memory controller and PHY find the optimal timing window to reliably communicate with DRAM chips. At 2400-3200 MHz (4800-6400 MT/s), signal integrity is the primary challenge.

Electrical signals on PCB traces experience:

• Propagation delay — different trace lengths = different arrival times
• Crosstalk — adjacent signals interfere
• ISI — previous bit values affect current bit shape
• PVT variation — process, voltage, temperature shift timing
• Impedance mismatch — causes reflections that distort signals

Training compensates by finding the “eye” — the timing/voltage window where data is reliably captured — for each signal individually.

The RK3588 uses a Synopsys DWC (DesignWare Core) LPDDR5/4X multiPHY. The training sequence in the blob:

1. ZQ Calibration — Calibrates output driver impedance. Polls CalBusy (PHY offset 0x684, 11 uses in code).
2. Write Leveling — Aligns DQS strobe with clock at the DRAM. Loops over 16 DQ bits.
3. Read Gate Training — Finds correct time to capture read data. Polls DfiStatus (offset 0xA24, 65 uses — most-used register).
4. Read/Write DQ Training — Per-bit timing adjustment using patterns 0xAA55AA55 / 0x55AA55AA (written to PHY offsets 0x93C-0x970).
5. Eye Training — Scans delay+voltage range for maximum margin. The “eyescan” blob variant does extended analysis.
6. VREF Training — Finds optimal voltage threshold. Uses PHY offsets 0x600/0x608/0x60C (67 combined uses).
7. CA Training — Calibrates command/address bus timing.

Results depend on temperature (shifts ~1-2 ps/°C), voltage, DRAM internal state, and component aging. Results are stored in SRAM (0x001FE000) and passed to the kernel via PMU GRF for DVFS.

The most serious bug class: do {} while loops polling hardware registers indefinitely. If hardware doesn't respond, the system hangs permanently during boot.

Impact: Cold boot failures, hangs at extreme temperatures, power supply issues during training.

Fix: Add timeout counters. The code already has error return paths (23 instances of return 0xFFFFFFFF) — the polls just don't use them.

ddr_open_firewall() grants all bus masters DDR access (FW_DDR |= 0xFFFF). The matching close may not be called on all error paths.

Training failure restarts the entire sequence from scratch. No selective retry (e.g., “only redo read gate training”). Each failure costs a full retrain (~100ms).

The RK3588 uses a Synopsys DWC LPDDR5/4X multiPHY (DWC_LPDDR54_PHY). The training stages map to specific register offsets found in the decompiled code:

Written to PHY offsets 0x93C-0x970, this alternating bit pattern maximizes switching noise and crosstalk — the worst-case scenario for signal integrity testing. Variations (0xAAAA5555, 0x55AA55AA) stress different inter-bit coupling scenarios on the PCB.

• Why 2736 MHz was dropped: Narrow PHY eye margins across varying DRAM batches (SK Hynix vs Samsung vs Micron)
• v1.18 single-rank LPDDR5 crash: Incorrect derate timing for MR4 on single-rank configs caused DVFS hangs
• Cold boot failures: Consistent with 20 timeout-less polls found in this analysis
• LPDDR5 bandwidth paradox: LPDDR5 showed worse latency than LPDDR4X at same data rates due to WCK synchronization overhead
• No open-source DDR init planned: Collabora confirmed Rockchip has “no plan” for open-sourcing DDR training

Full research with 40+ sources in boltzmann:~/src/rk3588-ddr-decompiled/COMMUNITY_RESEARCH.md

Generated by Claude Code, 2026-04-03. Analysis performed on oppenheimer (Proxmox CT131).