WikiBot: Fix repository links: point to the cgit tree URLs (git.vgpu.io/open-iov.git/tree/...)

2026-10-12T04:40:09Z

Fix repository links: point to the cgit tree URLs (git.vgpu.io/open-iov.git/tree/...)

← Older revision		Revision as of 04:40, 12 October 2026
Line 3:		Line 3:
	= NVIDIA GSP 570.144W Firmware Analysis (TU102/TU104) =		= NVIDIA GSP 570.144W Firmware Analysis (TU102/TU104) =

	<blockquote>'''Retained firmware-analysis record.''' This page documents the GSP 570.144W firmware binary (decompilation and firmware-side addresses) and the address tables below are the firmware-side record, not the host implementation. Current host architecture: [https://git.vgpu.io/open-iov/~~blob/master~~/docs/03-architecture/03-gsp-and-gsp-rm.md <code>../docs/03-architecture/03-gsp-and-gsp-rm.md</code>] and [https://git.vgpu.io/open-iov/~~blob/master~~/docs/03-architecture/06-host-module-and-hybrid-model.md <code>../docs/03-architecture/06-host-module-and-hybrid-model.md</code>]. The decompiled analysis output is not distributed; the file names below are</blockquote>		<blockquote>'''Retained firmware-analysis record.''' This page documents the GSP 570.144W firmware binary (decompilation and firmware-side addresses) and the address tables below are the firmware-side record, not the host implementation. Current host architecture: [https://git.vgpu.io/open-iov.git/tree/docs/03-architecture/03-gsp-and-gsp-rm.md <code>../docs/03-architecture/03-gsp-and-gsp-rm.md</code>] and [https://git.vgpu.io/open-iov.git/tree/docs/03-architecture/06-host-module-and-hybrid-model.md <code>../docs/03-architecture/06-host-module-and-hybrid-model.md</code>]. The decompiled analysis output is not distributed; the file names below are</blockquote>

	the analysis record.		the analysis record.
Line 664:		Line 664:
	== References ==		== References ==

	* RPC map: [https://git.vgpu.io/open-iov/~~blob/master~~/firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md <code>firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md</code>]		* RPC map: [https://git.vgpu.io/open-iov.git/tree/firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md <code>firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md</code>]
	* Final report: [https://git.vgpu.io/open-iov/~~blob/master~~/firmware/57X-GSP/570.144/FINAL_REPORT.md <code>firmware/57X-GSP/570.144/FINAL_REPORT.md</code>]		* Final report: [https://git.vgpu.io/open-iov.git/tree/firmware/57X-GSP/570.144/FINAL_REPORT.md <code>firmware/57X-GSP/570.144/FINAL_REPORT.md</code>]
	* Analysis results: [https://git.vgpu.io/open-iov/~~blob/master~~/firmware/57X-GSP/570.144/analysis_results.json <code>firmware/57X-GSP/570.144/analysis_results.json</code>]		* Analysis results: [https://git.vgpu.io/open-iov.git/tree/firmware/57X-GSP/570.144/analysis_results.json <code>firmware/57X-GSP/570.144/analysis_results.json</code>]

WikiBot: Carry the site-wide About/licensing message on every page (2026-10-12)

2026-10-12T04:29:45Z

Carry the site-wide About/licensing message on every page (2026-10-12)

← Older revision		Revision as of 04:29, 12 October 2026
Line 1:		Line 1:
			{{About message}}

	= NVIDIA GSP 570.144W Firmware Analysis (TU102/TU104) =		= NVIDIA GSP 570.144W Firmware Analysis (TU102/TU104) =

WikiBot: Re-sync page from tracked wiki source: fix cross-document links and diagram; refresh status

2026-10-12T04:10:03Z

Re-sync page from tracked wiki source: fix cross-document links and diagram; refresh status

Show changes

WikiBot: Remove unpaired blockquote tags left by reference cleanup

2026-10-12T03:58:29Z

Remove unpaired blockquote tags left by reference cleanup

New page

= NVIDIA GSP 570.144W Firmware Analysis (TU102/TU104) =


== Binary Information ==

* '''File''': <code>gsp-570.144.fwimage.bin</code>
* '''Size''': 28.5 MB
* '''Format''': ELF, RV64IMAC (RISC-V 64-bit)
* '''Base Address''': 0x04000000
* '''MD5''': <code>13ce12a392a31eeb79a2e6ebd3a4a93a</code>


== Architecture Overview ==


=== Memory Map ===

<pre>0x04000000 - 0x05FFFFFF: Code + Read-only data (~32 MB)
0x04296040: Global state structure (cRam0000000004296048)
0x0429B750: Error/status registers
0x041DC350: Stack canary / frame guard
0x429B000 - 0x429BFFF: Memory allocator arena (0x429B450 = alloc entry)</pre>

=== Calling Convention (RISC-V RV64IMAC) ===

{| class="wikitable"
|-
! Register
! Purpose
|-
| s0 (x8)
| Frame pointer
|-
| s1 (x9), s4 (x12), s10 (x20)
| RA save locations
|-
| s1-s11
| Callee-saved (pushed to stack)
|-
| a0-a7
| Arguments / return values
|-
| sp
| Stack pointer (grows down, frames 96-560 bytes)
|}

-----


== RPC System ==


=== 12 RPC Types (Jump Table at 0x059BFEB0) ===

{| class="wikitable"
|-
! Type
! Name
! Handler A
! Handler B
! Dispatcher
|-
| 0x01
| ALLOC
| —
| —
| Primary
|-
| 0x02
| FREE
| —
| —
| Primary
|-
| 0x03
| MAP
| 0x05766AB7
| 0x05778A37
| Secondary
|-
| 0x04
| UNMAP
| 0x057669B7
| 0x05779937
| Primary + Secondary
|-
| 0x05
| PIN
| 0x057664B7
| 0x0577A3B7
| Secondary
|-
| 0x06
| UNPIN
| 0x057682B7
| 0x05779FB7
| Secondary
|-
| 0x07
| SCHEDULE
| 0x05767F37
| 0x0575AEB7
| Primary + Secondary
|-
| 0x08
| YIELD
| 0x0575AE37
| 0x05767337
| Secondary
|-
| 0x09
| NOTIFY
| 0x0577C8B7
| 0x05767837
| Secondary
|-
| 0x0A
| BAR_TRAP
| 0x057675B7
| —
| Secondary
|-
| 0x0B
| MIGRATE
| —
| —
| Primary
|-
| 0x0C
| DEBUG
| —
| —
| —
|}


=== Primary Dispatcher (0x057A1AC0) ===

<pre>Entry: FUN_ram_057a1ac0(param_1, param_2, param_3, param_4, *out_id, *out_a, *out_b, *out_c)</pre>
* Extracts RPC type from <code>param_1</code>
* Validates against max type (bgeu x12, x13 checks for types 11 and 13)
* MIGRATE (0x0B) branches at 0x057A1BDC and 0x057A1D54
* Indexes into 32-entry jump table at '''0x057A3AD8'''


==== Primary Dispatcher Sub-Command Jump Table (0x057A3AD8) ====

{| class="wikitable"
|-
! Subcmd
! Target
! Decompiled
! Description
|-
| 0
| 0x057A1DB4
| ✅
| Returns ID=0x40
|-
| 1
| 0x057A1C18
| ✅
|
|-
| 2
| 0x057A39FC
| ✅
|
|-
| 3
| 0x057A1BCC
| ✅
|
|-
| 4
| 0x057A1EF4
| ✅
|
|-
| 5
| 0x057A1E94
| ✅
|
|-
| 6
| 0x057A3A28
| ✅
|
|-
| 7
| 0x057A3A60
| ✅
|
|-
| 8
| 0x057A1C6C
| ✅
|
|-
| 9
| 0x057A3A48
| ✅
|
|-
| 10
| 0x057A1F6C
| ✅
|
|-
| 11
| 0x057A3AC4
| ✅
|
|-
| 12
| 0x057A1E10
| ✅
|
|-
| 13
| 0x057A3A90
| ✅
|
|-
| 14
| 0x057A39BC
| ✅
|
|-
| 15
| 0x057A3AAC
| ✅
|
|-
| 16
| 0x057A3A78
| ✅
|
|-
| 17
| 0x057A1CCC
| ✅
|
|-
| 18
| 0x057A39E0
| ✅
|
|-
| 19
| 0x057A1FA8
| ✅
|
|-
| 20
| 0x057A2094
| ✅
|
|-
| 21
| 0x057A2074
| ✅
|
|-
| 22
| 0x057A2044
| ✅
|
|-
| 23
| 0x057A20D4
| ✅
|
|-
| 24
| 0x057A20B4
| ✅
|
|-
| 25
| 0x057A1FC8
| ✅
|
|-
| 26
| 0x057A2008
| ✅
|
|-
| 27
| 0x057A1FE8
| ✅
|
|-
| 28
| 0x057A2024
| ✅
|
|-
| 29
| 0x057A219C
| ✅
|
|-
| 30
| 0x057A20FC
| ✅
|
|-
| 31
| 0x057A214C
| ✅
|
|}

'''Pattern''': Each sub-command returns a constant ID in <code>*out_id</code> (e.g., 0x10, 0x14, 0x40) and echoes input params to output pointers.

=== Secondary Dispatcher (0x04ED39DC) ===

* Branch-based dispatch for ALL 11 RPC types
* 141 KB decompiled — handles MAP, UNMAP, PIN, UNPIN, SCHEDULE, YIELD, NOTIFY, BAR_TRAP
* Entry: 0x04ED34B8 (PIN handler from secondary)


=== Specialized Main Handlers ===

{| class="wikitable"
|-
! Function
! Address
! Size
! Role
|-
| <code>rpc_alloc_main</code>
| 0x057E94EC
| 40 KB
| Core ALLOC implementation
|-
| <code>rpc_schedule_main</code>
| 0x051EFBF4
| 1.8 KB
| Core SCHEDULE implementation
|-
| <code>rpc_bar_trap_handler</code>
| 0x04CB8188
| 40 KB
| BAR1 emulation
|-
| <code>rpc_pin_handler</code>
| 0x04ED34B8
| —
| PIN from secondary dispatcher
|}

-----


== BAR Emulation (RPC 0x0A) ==


=== Handler: 0x04CB8188 (40 KB) ===

'''Strings Referenced''':

* <code>BAR1</code> at 0x0406570E, 0x04085DE0
* <code>Bar1Rest</code> at 0x040656DA
* <code>ForceBarAccess</code> at 0x040656F2
* <code>Bar1Aperture</code> at 0x04065722

'''Key Operations''':

* Memory allocation via <code>UNK_ram_058A1A9C</code> at arena 0x429B450
* Buffer management with 0x429B428 (cache/flush)
* Error codes: 0x51 (OOM), 0x1E (timeout), 0x1D, 0x1F, 0x25, 0x37, 0x56
* Uses <code>ebreak</code> for fatal errors with logging at 0x05AB7DA0
* Stack canary check against 0x041DC350

'''Integration Point for vGPU-IO''':

<syntaxhighlight lang="c">// Register BAR trap handler at 0x04CB8188
// Monitor BAR1, Bar1Rest, ForceBarAccess, Bar1Aperture registers
// Emulate BAR1 aperture/size for guest VF</syntaxhighlight>

-----


== WPR Management ==


=== Handlers: 0x04F00B0C, 0x04F00C78 (62 KB each) ===

'''String References (60 locations)''':

* <code>WPR_WRITE_COMPLETE</code>, <code>WPR_READ_COMPLETE</code>
* <code>WPR_WRITE_TIMEOUT</code>, <code>WPR_READ_TIMEOUT</code>
* <code>NV_WPR_WRITE_COMPLETE</code>, <code>NV_WPR_READ_COMPLETE</code>
* <code>NV_WPR_WRITE_TIMEOUT</code>, <code>NV_WPR_READ_TIMEOUT</code>

'''Key Operations''':

* VBIOS parsing (checks for <code>0xAA55</code>, <code>0x57464F4E</code> "WFON", <code>0x5746564E</code> "WFVN")
* Memory allocation at 0x429B450
* DMA/copy via <code>UNK_ram_0588F9C4</code>, <code>UNK_ram_05AEC86C</code>
* State machine with completion/timeout handling
* Error codes: 0x1E-0x25, 0x37, 0x51, 0x56, 0xFFFF

'''Integration Point for vGPU-IO''':

<syntaxhighlight lang="c">// Hook WPR completion callbacks from string reference locations
// Implement NV_WPR_WRITE/READ_COMPLETE/TIMEOUT notifications
// Manage WPR regions for guest VF memory isolation</syntaxhighlight>

-----


== Migration Protocol (RPC 0x0B) ==


=== Dual Jump Tables ===


==== Table 1: 0x04179ED8 (Primary dispatcher MIGRATE branch at 0x057A1BDC) ====

{| class="wikitable"
|-
! Index
! Target
! Decompiled
|-
| 0
| 0x057A2344
| ✅ Returns ID=0x14, reads flag at <code>in_t1+0x7F9</code>
|-
| 1
| 0x057A2320
| ✅
|-
| 2
| 0x057A230C
| ✅
|-
| 3
| 0x057A22F8
| ✅ Returns ID=0x10
|-
| 4
| 0x057A2388
| ✅
|-
| 5
| 0x057A23D8
| ✅
|-
| 6
| 0x057A23AC
| ✅
|-
| 7
| 0x057A2478
| ✅
|-
| 8
| 0x057A2428
| ✅
|-
| 9
| 0x057A2454
| ✅
|-
| 10
| 0x057A2404
| ✅
|-
| 11
| 0x057A2364
| ✅
|-
| 12
| 0x057A1F3C
| (dup)
|-
| 13
| 0x057A299C
|
|-
| 14
| 0x057A1F3C
| (dup)
|-
| 15
| 0x057A1F3C
| (dup)
|}


==== Table 2: 0x04179FBC (Primary dispatcher MIGRATE branch at 0x057A1D5C) ====

{| class="wikitable"
|-
! Index
! Target
! Decompiled
|-
| 0
| 0x057A257C
| ✅
|-
| 1
| 0x057A25E4
| ✅
|-
| 2
| 0x057A24EC
| ✅
|-
| 3
| 0x057A2608
| ✅
|-
| 4
| 0x057A2534
| ✅
|-
| 5
| 0x057A25C0
| ✅
|-
| 6
| 0x057A24A4
| ✅
|-
| 7
| 0x057A259C
| ✅
|-
| 8
| 0x057A2510
| ✅
|-
| 9
| 0x057A2558
| ✅
|-
| 10
| 0x057A24C8
| ✅
|-
| 11
| 0x057A262C
| ✅
|-
| 12
| 0x057A345C
| ✅
|-
| 13
| 0x057A36D8
| ✅
|-
| 14
| 0x057A35D8
| ✅
|-
| 15
| 0x057A3658
| ✅
|}

'''Pattern''': Migration sub-commands follow same descriptor pattern as primary dispatcher — return constant ID, echo params.
-----


== Entry Point & Boot Sequence ==


=== 0x04009000 (573 bytes) ===

* Initializes global state at 0x04296040
* Sets up stack canary at 0x041DC350
* Configures memory allocator arena at 0x429B450
* Registers RPC dispatchers
* Jumps to main scheduler loop

-----


== Decompiled Output Directory ==

├── entry_ram_04009000.c # Boot entry
├── FUN_ram_04cb8188_ram_04cb8188.c # BAR trap handler (40 KB)
├── FUN_ram_04cc58f8_ram_04cc58f8.c # Secondary dispatcher (141 KB)
├── FUN_ram_04d00a18_ram_04d00a18.c # ALLOC-dominant (142 KB)
├── FUN_ram_04ed39dc_ram_04ed39dc.c # Secondary dispatcher (141 KB)
├── FUN_ram_04f00b0c_ram_04f00b0c.c # WPR handler 1 (62 KB)
├── FUN_ram_04f00c78_ram_04f00c78.c # WPR handler 2 (62 KB)
├── FUN_ram_051efbf4_ram_051efbf4.c # SCHEDULE main (1.8 KB)
├── FUN_ram_054a7de0_ram_054a7de0.c # ALLOC-dominant (67 KB)
├── FUN_ram_05723ef4_ram_05723ef4.c # Tertiary dispatcher (13 KB)
├── FUN_ram_057a1ac0_ram_057a1ac0.c # Primary dispatcher (558 B)
├── FUN_ram_057a1bcc_ram_057a1bcc.c.. # 32 sub-commands (~550 B each)
├── FUN_ram_057e94ec_ram_057e94ec.c # ALLOC main (40 KB)
├── FUN_ram_059be7f4_ram_059be7f4.c # RPC jump table (4.9 KB)
├── FUN_ram_057664b7_ram_057664b7.c.. # MAP/PIN/UNPIN/SCHED/YIELD/NOTIFY handlers
└── FUN_ram_057a22f8_ram_057a22f8.c.. # 28 migration handlers</pre>

-----


== vGPU-IO Integration Checklist ==


=== Memory Management (ALLOC/FREE/MAP/UNMAP) ===

* ☐ Implement kernel RPC client calling 0x057A1AC0
* ☐ Parse sub-command descriptors from 0x057A3AD8 jump table
* ☐ Hook ALLOC main at 0x057E94EC for vGPU memory carve-out


=== Page Pinning (PIN/UNPIN) ===

* ☐ Call secondary dispatcher PIN at 0x04ED34B8
* ☐ Implement UNPIN via 0x057682B7 / 0x05779FB7


=== Scheduling (SCHEDULE/YIELD) ===

* ☐ Use 0x05767F37 / 0x0575AEB7 / 0x051EFBF4 for vCPU scheduling
* ☐ Implement YIELD at 0x0575AE37 / 0x05767337


=== BAR Emulation (BAR_TRAP) ===

* ☐ Register handler at 0x04CB8188
* ☐ Emulate BAR1/Bar1Rest/ForceBarAccess/Bar1Aperture for VF
* ☐ Monitor 0x429B450 allocator for BAR backing store


=== WPR Management ===

* ☐ Hook completion callbacks from string refs (0x04F00B0C, 0x04F00C78)
* ☐ Implement NV_WPR_* notification forwarding to guest
* ☐ Manage WPR regions per-VF for isolation


=== Migration (MIGRATE) ===

* ☐ Implement dual jump table dispatch (0x04179ED8, 0x04179FBC)
* ☐ Handle 28 migration sub-commands
* ☐ Coordinate with guest VF live migration protocol

-----


== Tools & Scripts ==

{| class="wikitable"
|-
! Script
! Purpose
|-
| <code>DecompileFunctions.java</code>
| Ghidra headless decompilation
|-
| <code>trace_all_subsystems.py</code>
| Binary analysis: WPR/BAR/Migration strings, jump tables
|-
| <code>gsp-fwimage-570.144/</code>
| Ghidra project directory
|}


=== Ghidra Usage ===

<syntaxhighlight lang="bash">/snap/ghidra/current/ghidra/support/analyzeHeadless \
/path/to/project gsp-analysis \
-import gsp-570.144.fwimage.bin \
-noanalysis \
-postScript DecompileFunctions.java \
0xADDRESS1,0xADDRESS2,..</syntaxhighlight>

-----


== References ==

GSP 570.144W Firmware Analysis - Revision history

WikiBot: Fix repository links: point to the cgit tree URLs (git.vgpu.io/open-iov.git/tree/...)

WikiBot: Carry the site-wide About/licensing message on every page (2026-10-12)

WikiBot: Re-sync page from tracked wiki source: fix cross-document links and diagram; refresh status

WikiBot: Remove unpaired blockquote tags left by reference cleanup