Open-IOV: initial public release

Open-IOV virtualizes NVIDIA GPUs so that unmodified guest drivers run with
real GPU functionality - CUDA first, 3D and video to follow - on unmodified
hosts, without a proprietary vGPU license and without patching any driver,
firmware or hypervisor.

Core principle: emulate the interface, pass through the work.

  kernel/     open-iov-vfio.ko - host VFIO mdev driver: virtual GPU device
              (PCI config space, BAR shadows, MSI-X), GSP boot emulation,
              GSP-RM message-queue/RPC emulation, memory model (GPU-VA to
              guest-PA discovery) and the semaphore-completion service that
              advances guest UVM progress.
  userspace/  libiov.so management API and examples.
  tools/      guest diagnostics, firmware analysis wrappers, RM probes.
  scripts/    stack manager, VM harness, build/load/test automation.
  config/     hardware/version profiles (the portability surface).
  docs/       documentation tree - start at docs/README.md.
  wiki/       long-form firmware and protocol deep dives.

Status: initialization works end to end for a stock 570.144 Linux guest on
Turing (TU104): driver probe, nvidia-smi, the full GSP-RM control battery,
object creation and the early CUDA/UVM start-up path. GPU work forwarding -
the step that makes CUDA kernels execute on real hardware - is the active
work item; see docs/04-implementation/01-known-knowns-and-unknowns.md.

License: BSD-3-Clause for the project; GPL-2.0 for kernel modules that link
GPL-only kernel interfaces. See LICENSE and docs/09-reference/legal-and-licensing.md.

1 files changed, 124 insertions, 0 deletions

diff --git a/firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md b/firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md
new file mode 100644
index 0000000..23a1a0d
--- /dev/null
+++ b/firmware/57X-GSP/570.144/RPC_HANDLER_MAP.md
@@ -0,0 +1,124 @@
+# GSP 570.144W - Complete RPC Handler Address Map
+
+## Jump Table at 0x059bfeb0 (Decoded - Actual Handler Addresses)
+
+| RPC Type | Name | Handler A | Handler B | Notes |
+|----------|------|-----------|-----------|-------|
+| 0x01 | ALLOC | - | - | Uses primary dispatcher |
+| 0x02 | FREE | - | - | Uses primary dispatcher |
+| 0x03 | MAP | 0x05766ab7 | 0x05778a37 | Two handlers |
+| 0x04 | UNMAP | 0x057669b7 | 0x05779937 | Two handlers |
+| 0x05 | PIN | 0x057664b7 | 0x0577a3b7 | Two handlers |
+| 0x06 | UNPIN | 0x057682b7 | 0x05779fb7 | Two handlers |
+| 0x07 | SCHEDULE | 0x05767f37 | 0x0575aeb7 | Two handlers |
+| 0x08 | YIELD | 0x0575ae37 | 0x05767337 | Two handlers |
+| 0x09 | NOTIFY | 0x0577c8b7 | 0x05767837 | Two handlers |
+| 0x0A | BAR_TRAP | 0x057675b7 | - | Single handler |
+| 0x0B | MIGRATE | - | - | Uses primary dispatcher |
+| 0x0C | DEBUG | - | - | - |
+
+## Primary Dispatcher (0x057a1ac0) Handles
+- ALLOC (0x01), UNMAP (0x04), PIN (0x05), MIGRATE (0x0B), FREE (0x02), SCHEDULE (0x07)
+- Jump table at 0x057a3ad8 (32 sub-command entries)
+
+## Secondary Dispatcher (0x04ed39dc) Handles
+- ALL 11 RPC types via branch-based dispatch
+
+## Key Handler Implementations (from jump table)
+
+### MAP Handlers (RPC 0x03)
+- **0x05766ab7** - MAP handler A
+- **0x05778a37** - MAP handler B
+
+### UNMAP Handlers (RPC 0x04)
+- **0x057669b7** - UNMAP handler A
+- **0x05779937** - UNMAP handler B
+
+### PIN Handlers (RPC 0x05)
+- **0x057664b7** - PIN handler A
+- **0x0577a3b7** - PIN handler B
+
+### UNPIN Handlers (RPC 0x06)
+- **0x057682b7** - UNPIN handler A
+- **0x05779fb7** - UNPIN handler B
+
+### SCHEDULE Handlers (RPC 0x07)
+- **0x05767f37** - SCHEDULE handler A
+- **0x0575aeb7** - SCHEDULE handler B (also at 0x051efbf4 - rpc_schedule_main)
+
+### YIELD Handlers (RPC 0x08)
+- **0x0575ae37** - YIELD handler A
+- **0x05767337** - YIELD handler B
+
+### NOTIFY Handlers (RPC 0x09)
+- **0x0577c8b7** - NOTIFY handler A
+- **0x05767837** - NOTIFY handler B
+
+### BAR_TRAP Handler (RPC 0x0A)
+- **0x057675b7** - BAR trap handler (also at 0x04cb8189 via first jump table)
+
+## Specialized Main Handlers
+- **0x057e94ec** - rpc_alloc_main (ALLOC implementation)
+- **0x051efbf4** - rpc_schedule_main (SCHEDULE implementation)
+- **0x04cb8189** - rpc_bar_trap_handler (BAR_TRAP implementation)
+- **0x04ed34b8** - rpc_pin_handler (from secondary dispatcher)
+
+## Calling Convention
+```
+RA saved to: s1 (x9), s4 (x12), or s10 (x20)
+Frame pointer: s0 (x8)
+Stack frame: addi sp, sp, -N (N = 96-560 bytes)
+Callee-saved: s1-s11 saved to stack
+```
+
+## Integration Points for vGPU-IO
+
+### Memory Management (ALLOC/FREE/MAP/UNMAP)
+```c
+// Primary entry: 0x057a1ac0 (primary dispatcher)
+// Sub-commands via jump table at 0x057a3ad8
+// Main implementation: 0x057e94ec (alloc_main)
+```
+
+### Page Pinning (PIN/UNPIN)
+```c
+// Handler A: 0x057664b7
+// Handler B: 0x0577a3b7
+// Secondary dispatcher entry: 0x04ed34b8
+```
+
+### Scheduling (SCHEDULE/YIELD)
+```c
+// SCHEDULE: 0x05767f37, 0x0575aeb7, 0x051efbf4
+// YIELD: 0x0575ae37, 0x05767337
+```
+
+### BAR Emulation (BAR_TRAP)
+```c
+// Main handler: 0x057675b7 (from jump table)
+// Also: 0x04cb8189 (from first jump table at 0x059be7f4)
+// Strings: BAR1, Bar1Rest, ForceBarAccess, Bar1Mapping, Bar1Aperture, Bar1Size
+```
+
+### WPR Management
+```c
+// String references (60 locations):
+// WPR_WRITE_COMPLETE, WPR_READ_COMPLETE
+// WPR_WRITE_TIMEOUT, WPR_READ_TIMEOUT
+// NV_WPR_WRITE_COMPLETE, NV_WPR_READ_COMPLETE
+// NV_WPR_WRITE_TIMEOUT, NV_WPR_READ_TIMEOUT
+```
+
+### Migration (MIGRATE)
+```c
+// Handled by primary dispatcher (0x057a1ac0)
+// RPC type 0x0B
+```
+
+## Next Steps for Implementation
+
+1. **Decompile jump table handlers** (0x057664b7, 0x057669b7, 0x05766ab7, etc.) to pseudo-C
+2. **Map primary dispatcher sub-commands** (32 entries at 0x057a3ad8)
+3. **Implement kernel RPC client** calling 0x057a1ac0 with proper message format
+4. **Register BAR trap handler** at 0x057675b7 / 0x04cb8189
+5. **Hook WPR completion callbacks** from string reference locations