1 files changed, 106 insertions, 0 deletions
diff --git a/debug/risc-v-gsp-rm-vm/sim/profiles/tu104-570.144.json b/debug/risc-v-gsp-rm-vm/sim/profiles/tu104-570.144.json
new file mode 100644
index 0000000..919dffe
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/sim/profiles/tu104-570.144.json
@@ -0,0 +1,106 @@
+{
+  "schema": "greeneye-sim-profile/1",
+  "name": "tu104-570.144",
+  "description": "Turing TU104 GSP 570.144: device model windows, load layout and boot-shim assumptions. New firmware version = new profile, not a code fork.",
+  "firmware": {
+    "file": "firmware/57X-GSP/570.144/gsp-570.144.fwimage.bin",
+    "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea",
+    "entry": "0x4009000",
+    "link_base": "0x4000000",
+    "max_vaddr": "0x5bb9000",
+    "size": 28528288
+  },
+  "load": {
+    "ram_base": "0x0",
+    "memory_mb": 12288,
+    "note": "firmware executes at its link addresses; PRIV/PMC is at 0x2000000000000000, local memory covers IMEM/DMEM/EMEM (0x0..0x300000000)."
+  },
+  "devices": {
+    "pmc": {
+      "chip_id": "0x164",
+      "major": 0,
+      "minor": 0,
+      "minor_ext": 0,
+      "evidence": "NV_PMC_BOOT_42 at PMC+0xA00; CHIP_ID bits 28:20 compared against TU10x IDs by the boot code; TU104 = 0x164 (header field).",
+      "windows": [
+        {"base": "0x2000000000000000", "size": "0x1000"}
+      ]
+    },
+    "falcon": {
+      "shims": {
+        "debuginfo_host_consume": true
+      },
+      "debuginfo_stage_mask": "0x700000",
+      "debuginfo_stage_shift": 20,
+      "evidence": "Falcon register header offsets; boot writes MAILBOX0/MAILBOX1/DEBUGINFO/IRQSSET(HALT) and polls DEBUGINFO bits 22:20; DMA field layout and transfer semantics from the register header. DEBUGINFO host-consume is a boot shim, not a device claim.",
+      "windows": [
+        {"base": "0x2000000000110000", "size": "0x1000"},
+        {"base": "0x300000000", "size": "0x1000"}
+      ]
+    },
+    "priscv": {
+      "evidence": "RISC-V-local register header; boot reads TRACECTL/TRACE_RDIDX/TRACE_WTIDX/PRIV_ERR_STAT/IRQMASK through the libos private mapping at 0x300001000.",
+      "windows": [
+        {"base": "0x2000000000111000", "size": "0x1000"},
+        {"base": "0x300001000", "size": "0x1000"}
+      ]
+    },
+    "timer": {
+      "ns_per_insn": 1.0,
+      "evidence": "PTIMER register header (NV_PTIMER_TIME_0 0x9400, TIME_1 0x9410). Values are MODELED from the instruction count; the firmware has not been observed reading this block in the 570.144 boot runs.",
+      "windows": [
+        {"base": "0x2000000000009000", "size": "0x1000"}
+      ]
+    },
+    "fwsec": {
+      "wpr2_start": "0x2000000",
+      "wpr2_end": "0x6000000",
+      "evidence": "PFB WPR2 ADDR_LO/HI register header (0x1FA824/0x1FA828, 4KiB alignment, HI points at the last 128KiB block); values are boot-shim supplied (host/booter-written on real hardware).",
+      "windows": [
+        {"base": "0x20000000001FA000", "size": "0x1000"}
+      ]
+    },
+    "csb": {
+      "evidence": "CSB/TRANSCOM message-window seam. No register semantics are modelled until a message-window poll is observed (B3); a profile may declare individual registers with width/value/semantics.",
+      "registers": {},
+      "windows": []
+    },
+    "pmu": {
+      "evidence": "PMU stub: no PMU register has been observed; every access stays unhandled and logged.",
+      "windows": []
+    },
+    "dma": {
+      "evidence": "GSP RISC-V address map: SYSGPA/FBGPA apertures. In this flat model both apertures alias simulator RAM (documented assumption) so booter-style DMA and firmware aperture reads resolve; unmapped transfers are refused and recorded.",
+      "windows": [
+        {"pa": "0x8180000000000000", "sim": "0x0", "size": "0x8000000"},
+        {"pa": "0x6180000000000000", "sim": "0x0", "size": "0x8000000"}
+      ]
+    }
+  },
+  "boot_shim": {
+    "note": "Reset-time state the real SEC2 booter/host provides. Every value here is an assumption recorded in the session; the device model never fakes a register read.",
+    "registers": {
+      "a0": "0x80000",
+      "a1": "0x80000",
+      "a2": "0x4000000",
+      "a3": "0x1b34ea0",
+      "a4": "0x4000000",
+      "a5": "0x0"
+    },
+    "bootargs_pa": "0x80000",
+    "bootargs_size": 120,
+    "core_dump_pa": "0x40000",
+    "core_dump_size": "0x10000",
+    "wpr_meta_pa": "0x90000",
+    "image_at": "0x100000000",
+    "wpr": {
+      "elf_pa": "0x4000000",
+      "elf_size": "0x1b34ea0",
+      "wpr_start": "0x2000000",
+      "wpr_end": "0x6000000",
+      "boot_bin_offset": "0x3000000",
+      "gsp_fw_offset": "0x4000000",
+      "fb_size": "0x200000000"
+    }
+  }
+}