diff options
Diffstat (limited to 'firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md')
| -rw-r--r-- | firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md | 111 |
1 files changed, 111 insertions, 0 deletions
diff --git a/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md b/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md new file mode 100644 index 0000000..b628290 --- /dev/null +++ b/firmware/57X-GSP/570.144/ANALYSIS_SUMMARY.md @@ -0,0 +1,111 @@ +# GSP Firmware 570.144W Analysis Summary + +## Firmware Details +- **Version**: 570.144W (TU102/TU104) +- **Binary**: 28,528,288 bytes ELF at base 0x04000000 +- **Architecture**: RISC-V 64-bit (RV64IMAC) + +## Key Findings + +### 1. Function Discovery +- **134,203 unique call targets** identified from JAL instructions +- **490/500 top call targets** reference RPC type constants → likely RPC handlers/dispatcher +- Calling convention: **ra saved to callee-saved register (s1/s4/s10)**, s0 = frame pointer + +### 2. RPC Dispatcher Candidates +Top functions referencing **multiple RPC types** (likely main dispatcher switch): + +| Address | Calls | Stack | RPC Types Referenced | +|---------|-------|-------|---------------------| +| **0x057a1ac0** | 224 | - | ALLOC, UNMAP, PIN, MIGRATE, FREE, SCHEDULE (6 types) | +| **0x04ed39dc** | 139 | - | MAP, ALLOC, YIELD, SCHEDULE, UNPIN, PIN, UNMAP, FREE, MIGRATE, BAR_TRAP, NOTIFY (11 types) | +| **0x05adc298** | 117 | - | FREE, PIN, ALLOC, YIELD, BAR_TRAP (5 types) | +| **0x04ecbcb0** | 94 | - | MAP, FREE, ALLOC, MIGRATE, NOTIFY, BAR_TRAP (6 types) | +| **0x04cc58f8** | 53 | 160 | YIELD, SCHEDULE, UNPIN, PIN, UNMAP, MAP, FREE, MIGRATE, BAR_TRAP, ALLOC, NOTIFY (11 types) | +| **0x05723ef4** | 53 | 96 | ALLOC, UNMAP, FREE, MAP, UNPIN, YIELD, NOTIFY, BAR_TRAP, MIGRATE, PIN (10 types) | + +**Primary Dispatcher**: **0x057a1ac0** - highest call count among multi-RPC functions, references 6 RPC types in first 1KB + +### 3. Specialized Handler Candidates +Functions dominated by **single RPC type** (likely specific handlers): + +| Address | Calls | Primary RPC Type | +|---------|-------|------------------| +| 0x04efeac8 | 445 | (recursive, no RPC refs in 1KB) | +| 0x057e94ec | 142 | ALLOC (25+ refs) | +| 0x04d00a18 | 106 | ALLOC (13+ refs) | +| 0x054a7de0 | 86 | ALLOC (17+ refs) | +| 0x051efbf4 | 59 | SCHEDULE (6+ refs) | +| 0x05adc128 | 67 | ALLOC, YIELD, FREE, BAR_TRAP | + +### 4. Entry Point +- **0x04009000**: Bootstrap code, calls 0x04009070 (JAL to self = halt loop) +- References ALLOC at offset 8 (likely initialization) + +### 5. BAR Trap Handler +- **0x04cb8189**: Identified from jump table at 0x059be7f4 +- Called for RPC_BAR_TRAP (0x0A) dispatch +- Makes calls to 0x04bc1665 + +### 6. Strings Found +- **WPR**: 60 locations (e.g., "WPR_WRITE_COMPLETE", "WPR_READ_COMPLETE", "NV_WPR_*") +- **BAR**: 28 locations (e.g., "BAR1", "Bar1Rest", "ForceBarAccess") +- **RPC**: 4 locations +- **GSP**: 25 locations + +### 7. Jump Tables +- **0x059be7f4**: 12-entry table (matches 12 RPC types) - contains encoded pointers +- **0x059bfeb0**: Another 12-entry encoded table +- Pointers appear obfuscated (not direct addresses) + +## Architecture Summary + +### Calling Convention +``` +Prologue: + addi sp, sp, -N # Allocate stack frame (N >= 32) + sd s1, offset(sp) # Save callee-saved registers s1-s11 + sd s2, offset(sp) + ... + addi s0, sp, N # Set frame pointer (s0 = sp + N) + mv sX, ra # Save return address to callee-saved reg (s1/s4/s10) + +Epilogue: + mv ra, sX # Restore return address + ld s1, offset(sp) # Restore callee-saved registers + ld s2, offset(sp) + ... + addi sp, sp, N # Deallocate stack + ret # jalr x0, 0(ra) +``` + +### RPC Types (from gsp_comm.h) +| Value | Name | Description | +|-------|------|-------------| +| 0x01 | ALLOC | Memory allocation | +| 0x02 | FREE | Memory free | +| 0x03 | MAP | Memory map | +| 0x04 | UNMAP | Memory unmap | +| 0x05 | PIN | Pin pages | +| 0x06 | UNPIN | Unpin pages | +| 0x07 | SCHEDULE | Schedule work | +| 0x08 | YIELD | Yield CPU | +| 0x09 | NOTIFY | Notification | +| 0x0A | BAR_TRAP | BAR register trap | +| 0x0B | MIGRATE | Migration protocol | +| 0xFF | DEBUG | Debug commands | + +## Next Steps for Full Decompilation + +1. **Focus Ghidra on dispatcher functions**: 0x057a1ac0, 0x04ed39dc, 0x04cc58f8, 0x05723ef4 +2. **Trace RPC handler calls** from dispatcher switch cases +3. **Identify WPR management** via string references ("WPR_WRITE_COMPLETE", etc.) +4. **Map BAR emulation** via "BAR1", "ForceBarAccess" strings +5. **Find migration protocol** via RPC_MIGRATE (0x0B) handlers +6. **Analyze entry/boot sequence** from 0x04009000 + +## Files Generated +- `all_call_targets.txt` - 134K call targets with counts +- `analysis_results.json` - Structured analysis of top 500 functions +- `found_prologues_v2.json` - Function prologue patterns +- `analyze_firmware.py` - Python analysis tool |