Initial commit: Open-IOV vGPU-IO complete stack

- Firmware decompilation: GSP 570.144W (28.5MB ELF, RV64IMAC), 132 decompiled C files
- Kernel modules: nvidia.ko (34MB, OpenRM), open-iov-vfio.ko (2.8MB, VFIO mdev), gsp-vgpu.ko (1.8MB, guest driver)
- Userspace: libiov.so/libvgpu.so (76KB), example_vgpu (28KB), rpc_emulator.c
- PCI config space emulation (256B with PM, MSI, MSI-X, PCIe caps)
- 12 RPC types fully mapped from firmware decompilation
- BAR trap, WPR, scheduling, notification, migration emulation
- Helper scripts: load_vgpu_stack, create_mdev, launch_qemu_vgpu, test_vgpu_stack, setup_guest_driver, unload_vgpu_stack
- Architecture documentation
- Wiki: 10 technical documents
- Git LFS for large binaries (.ko, .bin, .iso, .img, .o, ghidra repos)
- nvidia-open-gpu-kernel-modules as submodule

1 files changed, 206 insertions, 0 deletions

diff --git a/wiki/Address-Reference.md b/wiki/Address-Reference.md
new file mode 100644
index 0000000..08df1a8
--- /dev/null
+++ b/wiki/Address-Reference.md
@@ -0,0 +1,206 @@
+# Address Reference
+
+## Firmware Base
+| Symbol | Address | Description |
+|--------|---------|-------------|
+| `FW_BASE` | 0x04000000 | Firmware load address |
+| `FW_SIZE` | 0x02000000 | ~32 MB |
+
+## Dispatchers
+| Name | Address | Size | Description |
+|------|---------|------|-------------|
+| Entry Point | 0x04009000 | 573B | Boot entry |
+| Primary Dispatcher | 0x057A1AC0 | 558B | Main RPC dispatcher |
+| Secondary Dispatcher | 0x04ED39DC | 141KB | Branch-based dispatcher |
+| Tertiary Dispatcher | 0x05723EF4 | 13KB | Additional dispatcher |
+| RPC Jump Table | 0x059BE7F4 | 4.9KB | 12 RPC type table |
+| RPC Type Table | 0x059BFEB0 | — | Actual handler addresses |
+
+## Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8)
+| Subcmd | Target | Decompiled |
+|--------|--------|------------|
+| 0 | 0x057A1DB4 | ✅ |
+| 1 | 0x057A1C18 | ✅ |
+| 2 | 0x057A39FC | ✅ |
+| 3 | 0x057A1BCC | ✅ |
+| 4 | 0x057A1EF4 | ✅ |
+| 5 | 0x057A1E94 | ✅ |
+| 6 | 0x057A3A28 | ✅ |
+| 7 | 0x057A3A60 | ✅ |
+| 8 | 0x057A1C6C | ✅ |
+| 9 | 0x057A3A48 | ✅ |
+| 10 | 0x057A1F6C | ✅ |
+| 11 | 0x057A3AC4 | ✅ |
+| 12 | 0x057A1E10 | ✅ |
+| 13 | 0x057A3A90 | ✅ |
+| 14 | 0x057A39BC | ✅ |
+| 15 | 0x057A3AAC | ✅ |
+| 16 | 0x057A3A78 | ✅ |
+| 17 | 0x057A1CCC | ✅ |
+| 18 | 0x057A39E0 | ✅ |
+| 19 | 0x057A1FA8 | ✅ |
+| 20 | 0x057A2094 | ✅ |
+| 21 | 0x057A2074 | ✅ |
+| 22 | 0x057A2044 | ✅ |
+| 23 | 0x057A20D4 | ✅ |
+| 24 | 0x057A20B4 | ✅ |
+| 25 | 0x057A1FC8 | ✅ |
+| 26 | 0x057A2008 | ✅ |
+| 27 | 0x057A1FE8 | ✅ |
+| 28 | 0x057A2024 | ✅ |
+| 29 | 0x057A219C | ✅ |
+| 30 | 0x057A20FC | ✅ |
+| 31 | 0x057A214C | ✅ |
+
+## Migration Jump Tables
+### Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC)
+| Index | Target | Decompiled |
+|-------|--------|------------|
+| 0 | 0x057A2344 | ✅ |
+| 1 | 0x057A2320 | ✅ |
+| 2 | 0x057A230C | ✅ |
+| 3 | 0x057A22F8 | ✅ |
+| 4 | 0x057A2388 | ✅ |
+| 5 | 0x057A23D8 | ✅ |
+| 6 | 0x057A23AC | ✅ |
+| 7 | 0x057A2478 | ✅ |
+| 8 | 0x057A2428 | ✅ |
+| 9 | 0x057A2454 | ✅ |
+| 10 | 0x057A2404 | ✅ |
+| 11 | 0x057A2364 | ✅ |
+| 12 | 0x057A1F3C | (dup) |
+| 13 | 0x057A299C | — |
+| 14 | 0x057A1F3C | (dup) |
+| 15 | 0x057A1F3C | (dup) |
+
+### Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C)
+| Index | Target | Decompiled |
+|-------|--------|------------|
+| 0 | 0x057A257C | ✅ |
+| 1 | 0x057A25E4 | ✅ |
+| 2 | 0x057A24EC | ✅ |
+| 3 | 0x057A2608 | ✅ |
+| 4 | 0x057A2534 | ✅ |
+| 5 | 0x057A25C0 | ✅ |
+| 6 | 0x057A24A4 | ✅ |
+| 7 | 0x057A259C | ✅ |
+| 8 | 0x057A2510 | ✅ |
+| 9 | 0x057A2558 | ✅ |
+| 10 | 0x057A24C8 | ✅ |
+| 11 | 0x057A262C | ✅ |
+| 12 | 0x057A345C | ✅ |
+| 13 | 0x057A36D8 | ✅ |
+| 14 | 0x057A35D8 | ✅ |
+| 15 | 0x057A3658 | ✅ |
+
+## RPC Handlers (from Jump Table at 0x059BFEB0)
+| RPC Type | Name | Handler A | Handler B |
+|----------|------|-----------|-----------|
+| 0x01 | ALLOC | — | — |
+| 0x02 | FREE | — | — |
+| 0x03 | MAP | 0x05766AB7 | 0x05778A37 |
+| 0x04 | UNMAP | 0x057669B7 | 0x05779937 |
+| 0x05 | PIN | 0x057664B7 | 0x0577A3B7 |
+| 0x06 | UNPIN | 0x057682B7 | 0x05779FB7 |
+| 0x07 | SCHEDULE | 0x05767F37 | 0x0575AEB7 |
+| 0x08 | YIELD | 0x0575AE37 | 0x05767337 |
+| 0x09 | NOTIFY | 0x0577C8B7 | 0x05767837 |
+| 0x0A | BAR_TRAP | 0x057675B7 | — |
+| 0x0B | MIGRATE | — | — |
+| 0x0C | DEBUG | — | — |
+
+## Specialized Main Handlers
+| Function | Address | Size |
+|----------|---------|------|
+| `rpc_alloc_main` | 0x057E94EC | 40 KB |
+| `rpc_schedule_main` | 0x051EFBF4 | 1.8 KB |
+| `rpc_bar_trap_handler` | 0x04CB8188 | 40 KB |
+| `rpc_pin_handler` | 0x04ED34B8 | — |
+
+## WPR Handlers
+| Handler | Address | Size |
+|---------|---------|------|
+| WPR Handler 1 | 0x04F00B0C | 62 KB |
+| WPR Handler 2 | 0x04F00C78 | 62 KB |
+
+## Memory & Global State
+| Symbol | Address | Description |
+|--------|---------|-------------|
+| Global Error Flag | 0x04296048 | `cRam0000000004296048` |
+| Error Status Reg | 0x0429B750+0x111300 | Error register |
+| Stack Canary | 0x041DC350 | Frame guard value |
+| Allocator Arena | 0x429B000 | Base |
+| Allocator Entry | 0x429B450 | `UNK_ram_058A1A9C` |
+| Cache Manager | 0x429B428 | `UNK_ram_05895BF4` |
+
+## String References
+
+### BAR Strings
+| String | Address |
+|--------|---------|
+| BAR1 | 0x0406570E, 0x04085DE0 |
+| Bar1Rest | 0x040656DA |
+| ForceBarAccess | 0x040656F2 |
+| Bar1Aperture | 0x04065722 |
+| Bar1Size | (referenced) |
+
+### WPR Strings
+| String | Address |
+|--------|---------|
+| WPR_WRITE_COMPLETE | 0x5E478F8 |
+| WPR_READ_COMPLETE | 0x5E478E0 |
+| WPR_WRITE_TIMEOUT | 0x5E47898 |
+| WPR_READ_TIMEOUT | 0x5E47880 |
+| NV_WPR_WRITE_COMPLETE | 0x5E478C8 |
+| NV_WPR_READ_COMPLETE | 0x5E478B0 |
+| NV_WPR_WRITE_TIMEOUT | 0x5E47868 |
+| NV_WPR_READ_TIMEOUT | 0x5E47850 |
+
+### VBIOS Signatures
+| Signature | Value | Meaning |
+|-----------|-------|---------|
+| VBIOS Standard | 0xAA55 | VBIOS header |
+| WPR Enable | 0x57464F4E ("WFON") | WPR on |
+| WPR Version | 0x5746564E ("WFVN") | WPR version |
+
+## Key Function Pointers (Indirect Calls)
+| Address | Function | Purpose |
+|---------|----------|---------|
+| 0x05AB7DA0 | Logger | String logging |
+| 0x05AC4B7C | Stack unwind | Frame recovery |
+| 0x058A1A9C | Allocator | Memory alloc |
+| 0x05895BF4 | Cache flush | Cache management |
+| 0x0588F9C4 | DMA copy | Memory copy |
+| 0x05AEC86C | Memory read | Read from addr |
+| 0x05AE1430 | Size query | Region size |
+| 0x05AF4D30 | Page fault | Page fault handler |
+| 0x05B10C3C | Page map | Page mapping |
+| 0x05AE9A2C | Crypto/verify | Integrity check |
+| 0x05AED674 | WPR check | WPR validation |
+| 0x05AED430 | WPR emulate | WPR emulation |
+| 0x05CB30CC | Config read | Config access |
+| 0x05CB25E0 | BAR config | BAR configuration |
+| 0x05CB23D8 | BAR map | BAR mapping |
+
+## Decompiled Output Files
+All files in: `$OPEN_IOV_ROOT/firmware/570-GSP/decompiled/`
+
+| Category | Files |
+|----------|-------|
+| Core | entry_ram_04009000.c, FUN_ram_057a1ac0_ram_057a1ac0.c |
+| Sub-commands | FUN_ram_057a1bcc_ram_057a1bcc.c ... FUN_ram_057a214c_ram_057a214c.c (32) |
+| Dispatchers | FUN_ram_04cc58f8_ram_04cc58f8.c, FUN_ram_04ed39dc_ram_04ed39dc.c, FUN_ram_05723ef4_ram_05723ef4.c |
+| RPC Jump Table | FUN_ram_059be7f4_ram_059be7f4.c |
+| BAR | FUN_ram_04cb8188_ram_04cb8188.c |
+| WPR | FUN_ram_04f00b0c_ram_04f00b0c.c, FUN_ram_04f00c78_ram_04f00c78.c |
+| ALLOC | FUN_ram_057e94ec_ram_057e94ec.c, FUN_ram_04d00a18_ram_04d00a18.c, FUN_ram_054a7de0_ram_054a7de0.c |
+| SCHEDULE | FUN_ram_051efbf4_ram_051efbf4.c |
+| RPC Handlers | FUN_ram_057664b7_ram_057664b7.c ... FUN_ram_0577c8b7_ram_0577c8b7.c (15) |
+| Migration | FUN_ram_057a22f8_ram_057a22f8.c ... FUN_ram_057a3658_ram_057a3658.c (28) |
+
+## Migration Sub-Command Descriptors (Sample)
+| Handler | Returned ID | Phase |
+|---------|-------------|-------|
+| 0x057A22F8 | 0x10 | Prepare |
+| 0x057A2344 | 0x14 | Prepare |
+| Others | TBD | Transfer/Commit |
\ No newline at end of file