Open-IOV: initial public release

Open-IOV virtualizes NVIDIA GPUs so that unmodified guest drivers run with
real GPU functionality - CUDA first, 3D and video to follow - on unmodified
hosts, without a proprietary vGPU license and without patching any driver,
firmware or hypervisor.

Core principle: emulate the interface, pass through the work.

  kernel/     open-iov-vfio.ko - host VFIO mdev driver: virtual GPU device
              (PCI config space, BAR shadows, MSI-X), GSP boot emulation,
              GSP-RM message-queue/RPC emulation, memory model (GPU-VA to
              guest-PA discovery) and the semaphore-completion service that
              advances guest UVM progress.
  userspace/  libiov.so management API and examples.
  tools/      guest diagnostics, firmware analysis wrappers, RM probes.
  scripts/    stack manager, VM harness, build/load/test automation.
  config/     hardware/version profiles (the portability surface).
  docs/       documentation tree - start at docs/README.md.
  wiki/       long-form firmware and protocol deep dives.

Status: initialization works end to end for a stock 570.144 Linux guest on
Turing (TU104): driver probe, nvidia-smi, the full GSP-RM control battery,
object creation and the early CUDA/UVM start-up path. GPU work forwarding -
the step that makes CUDA kernels execute on real hardware - is the active
work item; see docs/04-implementation/01-known-knowns-and-unknowns.md.

License: BSD-3-Clause for the project; GPL-2.0 for kernel modules that link
GPL-only kernel interfaces. See LICENSE and docs/09-reference/legal-and-licensing.md.

1 files changed, 111 insertions, 0 deletions

diff --git a/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md b/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md
new file mode 100644
index 0000000..b628290
--- /dev/null
+++ b/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md
@@ -0,0 +1,111 @@
+# GSP Firmware 570.144W Analysis Summary
+
+## Firmware Details
+- **Version**: 570.144W (TU102/TU104)
+- **Binary**: 28,528,288 bytes ELF at base 0x04000000
+- **Architecture**: RISC-V 64-bit (RV64IMAC)
+
+## Key Findings
+
+### 1. Function Discovery
+- **134,203 unique call targets** identified from JAL instructions
+- **490/500 top call targets** reference RPC type constants → likely RPC handlers/dispatcher
+- Calling convention: **ra saved to callee-saved register (s1/s4/s10)**, s0 = frame pointer
+
+### 2. RPC Dispatcher Candidates
+Top functions referencing **multiple RPC types** (likely main dispatcher switch):
+
+| Address | Calls | Stack | RPC Types Referenced |
+|---------|-------|-------|---------------------|
+| **0x057a1ac0** | 224 | - | ALLOC, UNMAP, PIN, MIGRATE, FREE, SCHEDULE (6 types) |
+| **0x04ed39dc** | 139 | - | MAP, ALLOC, YIELD, SCHEDULE, UNPIN, PIN, UNMAP, FREE, MIGRATE, BAR_TRAP, NOTIFY (11 types) |
+| **0x05adc298** | 117 | - | FREE, PIN, ALLOC, YIELD, BAR_TRAP (5 types) |
+| **0x04ecbcb0** | 94 | - | MAP, FREE, ALLOC, MIGRATE, NOTIFY, BAR_TRAP (6 types) |
+| **0x04cc58f8** | 53 | 160 | YIELD, SCHEDULE, UNPIN, PIN, UNMAP, MAP, FREE, MIGRATE, BAR_TRAP, ALLOC, NOTIFY (11 types) |
+| **0x05723ef4** | 53 | 96 | ALLOC, UNMAP, FREE, MAP, UNPIN, YIELD, NOTIFY, BAR_TRAP, MIGRATE, PIN (10 types) |
+
+**Primary Dispatcher**: **0x057a1ac0** - highest call count among multi-RPC functions, references 6 RPC types in first 1KB
+
+### 3. Specialized Handler Candidates
+Functions dominated by **single RPC type** (likely specific handlers):
+
+| Address | Calls | Primary RPC Type |
+|---------|-------|------------------|
+| 0x04efeac8 | 445 | (recursive, no RPC refs in 1KB) |
+| 0x057e94ec | 142 | ALLOC (25+ refs) |
+| 0x04d00a18 | 106 | ALLOC (13+ refs) |
+| 0x054a7de0 | 86 | ALLOC (17+ refs) |
+| 0x051efbf4 | 59 | SCHEDULE (6+ refs) |
+| 0x05adc128 | 67 | ALLOC, YIELD, FREE, BAR_TRAP |
+
+### 4. Entry Point
+- **0x04009000**: Bootstrap code, calls 0x04009070 (JAL to self = halt loop)
+- References ALLOC at offset 8 (likely initialization)
+
+### 5. BAR Trap Handler
+- **0x04cb8189**: Identified from jump table at 0x059be7f4
+- Called for RPC_BAR_TRAP (0x0A) dispatch
+- Makes calls to 0x04bc1665
+
+### 6. Strings Found
+- **WPR**: 60 locations (e.g., "WPR_WRITE_COMPLETE", "WPR_READ_COMPLETE", "NV_WPR_*")
+- **BAR**: 28 locations (e.g., "BAR1", "Bar1Rest", "ForceBarAccess")
+- **RPC**: 4 locations
+- **GSP**: 25 locations
+
+### 7. Jump Tables
+- **0x059be7f4**: 12-entry table (matches 12 RPC types) - contains encoded pointers
+- **0x059bfeb0**: Another 12-entry encoded table
+- Pointers appear obfuscated (not direct addresses)
+
+## Architecture Summary
+
+### Calling Convention
+```
+Prologue:
+  addi sp, sp, -N          # Allocate stack frame (N >= 32)
+  sd s1, offset(sp)        # Save callee-saved registers s1-s11
+  sd s2, offset(sp)
+  ...
+  addi s0, sp, N           # Set frame pointer (s0 = sp + N)
+  mv sX, ra                # Save return address to callee-saved reg (s1/s4/s10)
+
+Epilogue:
+  mv ra, sX                # Restore return address
+  ld s1, offset(sp)        # Restore callee-saved registers
+  ld s2, offset(sp)
+  ...
+  addi sp, sp, N           # Deallocate stack
+  ret                      # jalr x0, 0(ra)
+```
+
+### RPC Types (from gsp_comm.h)
+| Value | Name | Description |
+|-------|------|-------------|
+| 0x01 | ALLOC | Memory allocation |
+| 0x02 | FREE | Memory free |
+| 0x03 | MAP | Memory map |
+| 0x04 | UNMAP | Memory unmap |
+| 0x05 | PIN | Pin pages |
+| 0x06 | UNPIN | Unpin pages |
+| 0x07 | SCHEDULE | Schedule work |
+| 0x08 | YIELD | Yield CPU |
+| 0x09 | NOTIFY | Notification |
+| 0x0A | BAR_TRAP | BAR register trap |
+| 0x0B | MIGRATE | Migration protocol |
+| 0xFF | DEBUG | Debug commands |
+
+## Next Steps for Full Decompilation
+
+1. **Focus Ghidra on dispatcher functions**: 0x057a1ac0, 0x04ed39dc, 0x04cc58f8, 0x05723ef4
+2. **Trace RPC handler calls** from dispatcher switch cases
+3. **Identify WPR management** via string references ("WPR_WRITE_COMPLETE", etc.)
+4. **Map BAR emulation** via "BAR1", "ForceBarAccess" strings
+5. **Find migration protocol** via RPC_MIGRATE (0x0B) handlers
+6. **Analyze entry/boot sequence** from 0x04009000
+
+## Files Generated
+- `all_call_targets.txt` - 134K call targets with counts
+- `analysis_results.json` - Structured analysis of top 500 functions
+- `found_prologues_v2.json` - Function prologue patterns
+- `analyze_firmware.py` - Python analysis tool