Address Reference
Retained firmware-side address record. The tables below list addresses inside the GSP 570.144W firmware image (the firmware-side record), not host implementation details. Current architecture: ../docs/03-architecture/03-gsp-and-gsp-rm.md and ../docs/03-architecture/06-host-module-and-hybrid-model.md. Decompiled files live under firmware/57X-GSP/570.144/decompiled/.
Firmware Base
| Symbol
|
Address
|
Description
|
FW_BASE
|
0x04000000
|
Firmware load address
|
FW_SIZE
|
0x02000000
|
~32 MB
|
Dispatchers
| Name
|
Address
|
Size
|
Description
|
| Entry Point
|
0x04009000
|
573B
|
Boot entry
|
| Primary Dispatcher
|
0x057A1AC0
|
558B
|
Main RPC dispatcher
|
| Secondary Dispatcher
|
0x04ED39DC
|
141KB
|
Branch-based dispatcher
|
| Tertiary Dispatcher
|
0x05723EF4
|
13KB
|
Additional dispatcher
|
| RPC Jump Table
|
0x059BE7F4
|
4.9KB
|
12 RPC type table
|
| RPC Type Table
|
0x059BFEB0
|
—
|
Actual handler addresses
|
Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8)
| Subcmd
|
Target
|
Decompiled
|
| 0
|
0x057A1DB4
|
✅
|
| 1
|
0x057A1C18
|
✅
|
| 2
|
0x057A39FC
|
✅
|
| 3
|
0x057A1BCC
|
✅
|
| 4
|
0x057A1EF4
|
✅
|
| 5
|
0x057A1E94
|
✅
|
| 6
|
0x057A3A28
|
✅
|
| 7
|
0x057A3A60
|
✅
|
| 8
|
0x057A1C6C
|
✅
|
| 9
|
0x057A3A48
|
✅
|
| 10
|
0x057A1F6C
|
✅
|
| 11
|
0x057A3AC4
|
✅
|
| 12
|
0x057A1E10
|
✅
|
| 13
|
0x057A3A90
|
✅
|
| 14
|
0x057A39BC
|
✅
|
| 15
|
0x057A3AAC
|
✅
|
| 16
|
0x057A3A78
|
✅
|
| 17
|
0x057A1CCC
|
✅
|
| 18
|
0x057A39E0
|
✅
|
| 19
|
0x057A1FA8
|
✅
|
| 20
|
0x057A2094
|
✅
|
| 21
|
0x057A2074
|
✅
|
| 22
|
0x057A2044
|
✅
|
| 23
|
0x057A20D4
|
✅
|
| 24
|
0x057A20B4
|
✅
|
| 25
|
0x057A1FC8
|
✅
|
| 26
|
0x057A2008
|
✅
|
| 27
|
0x057A1FE8
|
✅
|
| 28
|
0x057A2024
|
✅
|
| 29
|
0x057A219C
|
✅
|
| 30
|
0x057A20FC
|
✅
|
| 31
|
0x057A214C
|
✅
|
Migration Jump Tables
Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC)
| Index
|
Target
|
Decompiled
|
| 0
|
0x057A2344
|
✅
|
| 1
|
0x057A2320
|
✅
|
| 2
|
0x057A230C
|
✅
|
| 3
|
0x057A22F8
|
✅
|
| 4
|
0x057A2388
|
✅
|
| 5
|
0x057A23D8
|
✅
|
| 6
|
0x057A23AC
|
✅
|
| 7
|
0x057A2478
|
✅
|
| 8
|
0x057A2428
|
✅
|
| 9
|
0x057A2454
|
✅
|
| 10
|
0x057A2404
|
✅
|
| 11
|
0x057A2364
|
✅
|
| 12
|
0x057A1F3C
|
(dup)
|
| 13
|
0x057A299C
|
—
|
| 14
|
0x057A1F3C
|
(dup)
|
| 15
|
0x057A1F3C
|
(dup)
|
Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C)
| Index
|
Target
|
Decompiled
|
| 0
|
0x057A257C
|
✅
|
| 1
|
0x057A25E4
|
✅
|
| 2
|
0x057A24EC
|
✅
|
| 3
|
0x057A2608
|
✅
|
| 4
|
0x057A2534
|
✅
|
| 5
|
0x057A25C0
|
✅
|
| 6
|
0x057A24A4
|
✅
|
| 7
|
0x057A259C
|
✅
|
| 8
|
0x057A2510
|
✅
|
| 9
|
0x057A2558
|
✅
|
| 10
|
0x057A24C8
|
✅
|
| 11
|
0x057A262C
|
✅
|
| 12
|
0x057A345C
|
✅
|
| 13
|
0x057A36D8
|
✅
|
| 14
|
0x057A35D8
|
✅
|
| 15
|
0x057A3658
|
✅
|
RPC Handlers (from Jump Table at 0x059BFEB0)
| RPC Type
|
Name
|
Handler A
|
Handler B
|
| 0x01
|
ALLOC
|
—
|
—
|
| 0x02
|
FREE
|
—
|
—
|
| 0x03
|
MAP
|
0x05766AB7
|
0x05778A37
|
| 0x04
|
UNMAP
|
0x057669B7
|
0x05779937
|
| 0x05
|
PIN
|
0x057664B7
|
0x0577A3B7
|
| 0x06
|
UNPIN
|
0x057682B7
|
0x05779FB7
|
| 0x07
|
SCHEDULE
|
0x05767F37
|
0x0575AEB7
|
| 0x08
|
YIELD
|
0x0575AE37
|
0x05767337
|
| 0x09
|
NOTIFY
|
0x0577C8B7
|
0x05767837
|
| 0x0A
|
BAR_TRAP
|
0x057675B7
|
—
|
| 0x0B
|
MIGRATE
|
—
|
—
|
| 0x0C
|
DEBUG
|
—
|
—
|
Specialized Main Handlers
| Function
|
Address
|
Size
|
rpc_alloc_main
|
0x057E94EC
|
40 KB
|
rpc_schedule_main
|
0x051EFBF4
|
1.8 KB
|
rpc_bar_trap_handler
|
0x04CB8188
|
40 KB
|
rpc_pin_handler
|
0x04ED34B8
|
—
|
WPR Handlers
| Handler
|
Address
|
Size
|
| WPR Handler 1
|
0x04F00B0C
|
62 KB
|
| WPR Handler 2
|
0x04F00C78
|
62 KB
|
Memory & Global State
| Symbol
|
Address
|
Description
|
| Global Error Flag
|
0x04296048
|
cRam0000000004296048
|
| Error Status Reg
|
0x0429B750+0x111300
|
Error register
|
| Stack Canary
|
0x041DC350
|
Frame guard value
|
| Allocator Arena
|
0x429B000
|
Base
|
| Allocator Entry
|
0x429B450
|
UNK_ram_058A1A9C
|
| Cache Manager
|
0x429B428
|
UNK_ram_05895BF4
|
String References
BAR Strings
| String
|
Address
|
| BAR1
|
0x0406570E, 0x04085DE0
|
| Bar1Rest
|
0x040656DA
|
| ForceBarAccess
|
0x040656F2
|
| Bar1Aperture
|
0x04065722
|
| Bar1Size
|
(referenced)
|
WPR Strings
| String
|
Address
|
| WPR_WRITE_COMPLETE
|
0x5E478F8
|
| WPR_READ_COMPLETE
|
0x5E478E0
|
| WPR_WRITE_TIMEOUT
|
0x5E47898
|
| WPR_READ_TIMEOUT
|
0x5E47880
|
| NV_WPR_WRITE_COMPLETE
|
0x5E478C8
|
| NV_WPR_READ_COMPLETE
|
0x5E478B0
|
| NV_WPR_WRITE_TIMEOUT
|
0x5E47868
|
| NV_WPR_READ_TIMEOUT
|
0x5E47850
|
VBIOS Signatures
| Signature
|
Value
|
Meaning
|
| VBIOS Standard
|
0xAA55
|
VBIOS header
|
| WPR Enable
|
0x57464F4E ("WFON")
|
WPR on
|
| WPR Version
|
0x5746564E ("WFVN")
|
WPR version
|
Key Function Pointers (Indirect Calls)
| Address
|
Function
|
Purpose
|
| 0x05AB7DA0
|
Logger
|
String logging
|
| 0x05AC4B7C
|
Stack unwind
|
Frame recovery
|
| 0x058A1A9C
|
Allocator
|
Memory alloc
|
| 0x05895BF4
|
Cache flush
|
Cache management
|
| 0x0588F9C4
|
DMA copy
|
Memory copy
|
| 0x05AEC86C
|
Memory read
|
Read from addr
|
| 0x05AE1430
|
Size query
|
Region size
|
| 0x05AF4D30
|
Page fault
|
Page fault handler
|
| 0x05B10C3C
|
Page map
|
Page mapping
|
| 0x05AE9A2C
|
Crypto/verify
|
Integrity check
|
| 0x05AED674
|
WPR check
|
WPR validation
|
| 0x05AED430
|
WPR emulate
|
WPR emulation
|
| 0x05CB30CC
|
Config read
|
Config access
|
| 0x05CB25E0
|
BAR config
|
BAR configuration
|
| 0x05CB23D8
|
BAR map
|
BAR mapping
|
Decompiled Output Files
The decompiled analysis output is not distributed; the file names below record what the analysis produced (one decompiled function per firmware address).
| Category
|
Files
|
| Core
|
entry_ram_04009000.c, FUN_ram_057a1ac0_ram_057a1ac0.c
|
| Sub-commands
|
FUN_ram_057a1bcc_ram_057a1bcc.c ... FUN_ram_057a214c_ram_057a214c.c (32)
|
| Dispatchers
|
FUN_ram_04cc58f8_ram_04cc58f8.c, FUN_ram_04ed39dc_ram_04ed39dc.c, FUN_ram_05723ef4_ram_05723ef4.c
|
| RPC Jump Table
|
FUN_ram_059be7f4_ram_059be7f4.c
|
| BAR
|
FUN_ram_04cb8188_ram_04cb8188.c
|
| WPR
|
FUN_ram_04f00b0c_ram_04f00b0c.c, FUN_ram_04f00c78_ram_04f00c78.c
|
| ALLOC
|
FUN_ram_057e94ec_ram_057e94ec.c, FUN_ram_04d00a18_ram_04d00a18.c, FUN_ram_054a7de0_ram_054a7de0.c
|
| SCHEDULE
|
FUN_ram_051efbf4_ram_051efbf4.c
|
| RPC Handlers
|
FUN_ram_057664b7_ram_057664b7.c ... FUN_ram_0577c8b7_ram_0577c8b7.c (15)
|
| Migration
|
FUN_ram_057a22f8_ram_057a22f8.c ... FUN_ram_057a3658_ram_057a3658.c (28)
|
Migration Sub-Command Descriptors (Sample)
| Handler
|
Returned ID
|
Phase
|
| 0x057A22F8
|
0x10
|
Prepare
|
| 0x057A2344
|
0x14
|
Prepare
|
| Others
|
TBD
|
Transfer/Commit
|