Difference between revisions of "Address Reference"

From Open-IOV
Jump to navigation Jump to search
(Remove unpaired blockquote tags left by reference cleanup)
 
m (Fix repository links: point to the cgit tree URLs (git.vgpu.io/open-iov.git/tree/...))
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
<span id="address-reference"></span>
{{About message}}
 
= Address Reference =
= Address Reference =


<span id="firmware-base"></span>
<blockquote>'''Retained firmware-side address record.''' The tables below list addresses inside the GSP 570.144W firmware image (the firmware-side record), not host implementation details. Current architecture: [https://git.vgpu.io/open-iov.git/tree/docs/03-architecture/03-gsp-and-gsp-rm.md <code>../docs/03-architecture/03-gsp-and-gsp-rm.md</code>] and [https://git.vgpu.io/open-iov.git/tree/docs/03-architecture/06-host-module-and-hybrid-model.md <code>../docs/03-architecture/06-host-module-and-hybrid-model.md</code>]. Decompiled files live under <code>firmware/57X-GSP/570.144/decompiled/</code>.</blockquote>
 
== Firmware Base ==
== Firmware Base ==


Line 20: Line 22:
|}
|}


<span id="dispatchers"></span>
== Dispatchers ==
== Dispatchers ==


Line 61: Line 62:
|}
|}


<span id="primary-dispatcher-sub-commands-jump-table-at-0x057a3ad8"></span>
== Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8) ==
== Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8) ==


Line 199: Line 199:
|}
|}


<span id="migration-jump-tables"></span>
== Migration Jump Tables ==
== Migration Jump Tables ==


<span id="table-1-0x04179ed8-migrate-branch-at-0x057a1bdc"></span>
=== Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC) ===
=== Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC) ===


Line 276: Line 274:
|}
|}


<span id="table-2-0x04179fbc-migrate-branch-at-0x057a1d5c"></span>
=== Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C) ===
=== Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C) ===


Line 350: Line 347:
|}
|}


<span id="rpc-handlers-from-jump-table-at-0x059bfeb0"></span>
== RPC Handlers (from Jump Table at 0x059BFEB0) ==
== RPC Handlers (from Jump Table at 0x059BFEB0) ==


Line 421: Line 417:
|}
|}


<span id="specialized-main-handlers"></span>
== Specialized Main Handlers ==
== Specialized Main Handlers ==


Line 447: Line 442:
|}
|}


<span id="wpr-handlers"></span>
== WPR Handlers ==
== WPR Handlers ==


Line 465: Line 459:
|}
|}


<span id="memory--global-state"></span>
== Memory &amp; Global State ==
== Memory &amp; Global State ==


Line 499: Line 492:
|}
|}


<span id="string-references"></span>
== String References ==
== String References ==


<span id="bar-strings"></span>
=== BAR Strings ===
=== BAR Strings ===


Line 526: Line 517:
|}
|}


<span id="wpr-strings"></span>
=== WPR Strings ===
=== WPR Strings ===


Line 559: Line 549:
|}
|}


<span id="vbios-signatures"></span>
=== VBIOS Signatures ===
=== VBIOS Signatures ===


Line 573: Line 562:
|-
|-
| WPR Enable
| WPR Enable
| 0x57464F4E (&quot;WFON&quot;)
| 0x57464F4E ("WFON")
| WPR on
| WPR on
|-
|-
| WPR Version
| WPR Version
| 0x5746564E (&quot;WFVN&quot;)
| 0x5746564E ("WFVN")
| WPR version
| WPR version
|}
|}


<span id="key-function-pointers-indirect-calls"></span>
== Key Function Pointers (Indirect Calls) ==
== Key Function Pointers (Indirect Calls) ==


Line 651: Line 639:
|}
|}


<span id="decompiled-output-files"></span>
== Decompiled Output Files ==
== Decompiled Output Files ==
The decompiled analysis output is not distributed; the file names below record what the analysis produced (one decompiled function per firmware address).


{| class="wikitable"
{| class="wikitable"
Line 663: Line 652:
|-
|-
| Sub-commands
| Sub-commands
| FUN_ram_057a1bcc_ram_057a1bcc.c.. FUN_ram_057a214c_ram_057a214c.c (32)
| FUN_ram_057a1bcc_ram_057a1bcc.c ... FUN_ram_057a214c_ram_057a214c.c (32)
|-
|-
| Dispatchers
| Dispatchers
Line 684: Line 673:
|-
|-
| RPC Handlers
| RPC Handlers
| FUN_ram_057664b7_ram_057664b7.c.. FUN_ram_0577c8b7_ram_0577c8b7.c (15)
| FUN_ram_057664b7_ram_057664b7.c ... FUN_ram_0577c8b7_ram_0577c8b7.c (15)
|-
|-
| Migration
| Migration
| FUN_ram_057a22f8_ram_057a22f8.c.. FUN_ram_057a3658_ram_057a3658.c (28)
| FUN_ram_057a22f8_ram_057a22f8.c ... FUN_ram_057a3658_ram_057a3658.c (28)
|}
|}


<span id="migration-sub-command-descriptors-sample"></span>
== Migration Sub-Command Descriptors (Sample) ==
== Migration Sub-Command Descriptors (Sample) ==


Latest revision as of 04:40, 12 October 2026

An absence of critical technical documentation has historically slowed growth and adoption of developer ecosystems for GPU virtualization.

This CC-BY-4.0 licensed content can either be used with attribution, or used as inspiration for new documentation, created by GPU vendors for public commercial distribution as developer documentation.

Where possible, this documentation will clearly label dates and versions of observed-but-not-guaranteed behaviour vs. vendor-documented stable interfaces/behaviour with guarantees of forward or backward compatibility.

Address Reference

Retained firmware-side address record. The tables below list addresses inside the GSP 570.144W firmware image (the firmware-side record), not host implementation details. Current architecture: ../docs/03-architecture/03-gsp-and-gsp-rm.md and ../docs/03-architecture/06-host-module-and-hybrid-model.md. Decompiled files live under firmware/57X-GSP/570.144/decompiled/.

Firmware Base

Symbol Address Description
FW_BASE 0x04000000 Firmware load address
FW_SIZE 0x02000000 ~32 MB

Dispatchers

Name Address Size Description
Entry Point 0x04009000 573B Boot entry
Primary Dispatcher 0x057A1AC0 558B Main RPC dispatcher
Secondary Dispatcher 0x04ED39DC 141KB Branch-based dispatcher
Tertiary Dispatcher 0x05723EF4 13KB Additional dispatcher
RPC Jump Table 0x059BE7F4 4.9KB 12 RPC type table
RPC Type Table 0x059BFEB0 — Actual handler addresses

Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8)

Subcmd Target Decompiled
0 0x057A1DB4 ✅
1 0x057A1C18 ✅
2 0x057A39FC ✅
3 0x057A1BCC ✅
4 0x057A1EF4 ✅
5 0x057A1E94 ✅
6 0x057A3A28 ✅
7 0x057A3A60 ✅
8 0x057A1C6C ✅
9 0x057A3A48 ✅
10 0x057A1F6C ✅
11 0x057A3AC4 ✅
12 0x057A1E10 ✅
13 0x057A3A90 ✅
14 0x057A39BC ✅
15 0x057A3AAC ✅
16 0x057A3A78 ✅
17 0x057A1CCC ✅
18 0x057A39E0 ✅
19 0x057A1FA8 ✅
20 0x057A2094 ✅
21 0x057A2074 ✅
22 0x057A2044 ✅
23 0x057A20D4 ✅
24 0x057A20B4 ✅
25 0x057A1FC8 ✅
26 0x057A2008 ✅
27 0x057A1FE8 ✅
28 0x057A2024 ✅
29 0x057A219C ✅
30 0x057A20FC ✅
31 0x057A214C ✅

Migration Jump Tables

Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC)

Index Target Decompiled
0 0x057A2344 ✅
1 0x057A2320 ✅
2 0x057A230C ✅
3 0x057A22F8 ✅
4 0x057A2388 ✅
5 0x057A23D8 ✅
6 0x057A23AC ✅
7 0x057A2478 ✅
8 0x057A2428 ✅
9 0x057A2454 ✅
10 0x057A2404 ✅
11 0x057A2364 ✅
12 0x057A1F3C (dup)
13 0x057A299C —
14 0x057A1F3C (dup)
15 0x057A1F3C (dup)

Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C)

Index Target Decompiled
0 0x057A257C ✅
1 0x057A25E4 ✅
2 0x057A24EC ✅
3 0x057A2608 ✅
4 0x057A2534 ✅
5 0x057A25C0 ✅
6 0x057A24A4 ✅
7 0x057A259C ✅
8 0x057A2510 ✅
9 0x057A2558 ✅
10 0x057A24C8 ✅
11 0x057A262C ✅
12 0x057A345C ✅
13 0x057A36D8 ✅
14 0x057A35D8 ✅
15 0x057A3658 ✅

RPC Handlers (from Jump Table at 0x059BFEB0)

RPC Type Name Handler A Handler B
0x01 ALLOC — —
0x02 FREE — —
0x03 MAP 0x05766AB7 0x05778A37
0x04 UNMAP 0x057669B7 0x05779937
0x05 PIN 0x057664B7 0x0577A3B7
0x06 UNPIN 0x057682B7 0x05779FB7
0x07 SCHEDULE 0x05767F37 0x0575AEB7
0x08 YIELD 0x0575AE37 0x05767337
0x09 NOTIFY 0x0577C8B7 0x05767837
0x0A BAR_TRAP 0x057675B7 —
0x0B MIGRATE — —
0x0C DEBUG — —

Specialized Main Handlers

Function Address Size
rpc_alloc_main 0x057E94EC 40 KB
rpc_schedule_main 0x051EFBF4 1.8 KB
rpc_bar_trap_handler 0x04CB8188 40 KB
rpc_pin_handler 0x04ED34B8 —

WPR Handlers

Handler Address Size
WPR Handler 1 0x04F00B0C 62 KB
WPR Handler 2 0x04F00C78 62 KB

Memory & Global State

Symbol Address Description
Global Error Flag 0x04296048 cRam0000000004296048
Error Status Reg 0x0429B750+0x111300 Error register
Stack Canary 0x041DC350 Frame guard value
Allocator Arena 0x429B000 Base
Allocator Entry 0x429B450 UNK_ram_058A1A9C
Cache Manager 0x429B428 UNK_ram_05895BF4

String References

BAR Strings

String Address
BAR1 0x0406570E, 0x04085DE0
Bar1Rest 0x040656DA
ForceBarAccess 0x040656F2
Bar1Aperture 0x04065722
Bar1Size (referenced)

WPR Strings

String Address
WPR_WRITE_COMPLETE 0x5E478F8
WPR_READ_COMPLETE 0x5E478E0
WPR_WRITE_TIMEOUT 0x5E47898
WPR_READ_TIMEOUT 0x5E47880
NV_WPR_WRITE_COMPLETE 0x5E478C8
NV_WPR_READ_COMPLETE 0x5E478B0
NV_WPR_WRITE_TIMEOUT 0x5E47868
NV_WPR_READ_TIMEOUT 0x5E47850

VBIOS Signatures

Signature Value Meaning
VBIOS Standard 0xAA55 VBIOS header
WPR Enable 0x57464F4E ("WFON") WPR on
WPR Version 0x5746564E ("WFVN") WPR version

Key Function Pointers (Indirect Calls)

Address Function Purpose
0x05AB7DA0 Logger String logging
0x05AC4B7C Stack unwind Frame recovery
0x058A1A9C Allocator Memory alloc
0x05895BF4 Cache flush Cache management
0x0588F9C4 DMA copy Memory copy
0x05AEC86C Memory read Read from addr
0x05AE1430 Size query Region size
0x05AF4D30 Page fault Page fault handler
0x05B10C3C Page map Page mapping
0x05AE9A2C Crypto/verify Integrity check
0x05AED674 WPR check WPR validation
0x05AED430 WPR emulate WPR emulation
0x05CB30CC Config read Config access
0x05CB25E0 BAR config BAR configuration
0x05CB23D8 BAR map BAR mapping

Decompiled Output Files

The decompiled analysis output is not distributed; the file names below record what the analysis produced (one decompiled function per firmware address).

Category Files
Core entry_ram_04009000.c, FUN_ram_057a1ac0_ram_057a1ac0.c
Sub-commands FUN_ram_057a1bcc_ram_057a1bcc.c ... FUN_ram_057a214c_ram_057a214c.c (32)
Dispatchers FUN_ram_04cc58f8_ram_04cc58f8.c, FUN_ram_04ed39dc_ram_04ed39dc.c, FUN_ram_05723ef4_ram_05723ef4.c
RPC Jump Table FUN_ram_059be7f4_ram_059be7f4.c
BAR FUN_ram_04cb8188_ram_04cb8188.c
WPR FUN_ram_04f00b0c_ram_04f00b0c.c, FUN_ram_04f00c78_ram_04f00c78.c
ALLOC FUN_ram_057e94ec_ram_057e94ec.c, FUN_ram_04d00a18_ram_04d00a18.c, FUN_ram_054a7de0_ram_054a7de0.c
SCHEDULE FUN_ram_051efbf4_ram_051efbf4.c
RPC Handlers FUN_ram_057664b7_ram_057664b7.c ... FUN_ram_0577c8b7_ram_0577c8b7.c (15)
Migration FUN_ram_057a22f8_ram_057a22f8.c ... FUN_ram_057a3658_ram_057a3658.c (28)

Migration Sub-Command Descriptors (Sample)

Handler Returned ID Phase
0x057A22F8 0x10 Prepare
0x057A2344 0x14 Prepare
Others TBD Transfer/Commit
Retrieved from "https://open-iov.org/index.php?title=Address_Reference&oldid=23961"