From 5dd8165f1754e156a0f9fb16c7a6bfa90e99ed60 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Mon, 14 Sep 2026 06:43:11 -0400
Subject: VFIO device registration fix + IOMMUFD callbacks + VFIO ioctl
 handlers

- Removed IOMMU group addition before vfio_register_emulated_iommu_dev() in nv_vgpu_mdev_create()
- Added IOMMUFD callbacks (bind_iommufd, unbind_iommufd, attach_ioas, detach_ioas) using kernel's vfio_iommufd_emulated_* functions
- Implemented VFIO ioctl handlers: GET_INFO, GET_REGION_INFO, GET_IRQ_INFO, SET_IRQS, MMAP
- Added config space read/write handlers at offset 0x70000000000
- Mmap handler for config space, BAR0 (emulation shadow), BAR1-5 (physical VRAM/registers)
- Interrupt handler for VFIO_DEVICE_SET_IRQS (DATA_EVENTFD, DATA_NONE, DATA_BOOL)
- Added udev rules for vfio group permissions
- Created stack_manager.sh unified tool
- Fixed mdev remove crash with deferred cleanup in vfio_device_release callback
- Kernel 6.8+ IOMMUFD compatibility
- QEMU launches successfully with vGPU passthrough
---
 firmware/57X-GSP/570.144/find_functions_v2.py | 223 ++++++++++++++++++++++++++
 1 file changed, 223 insertions(+)
 create mode 100644 firmware/57X-GSP/570.144/find_functions_v2.py

(limited to 'firmware/57X-GSP/570.144/find_functions_v2.py')

diff --git a/firmware/57X-GSP/570.144/find_functions_v2.py b/firmware/57X-GSP/570.144/find_functions_v2.py
new file mode 100644
index 0000000..12c344c
--- /dev/null
+++ b/firmware/57X-GSP/570.144/find_functions_v2.py
@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+"""
+Enhanced RISC-V function finder for GSP firmware.
+Searches for multiple prologue patterns.
+"""
+
+import struct
+import json
+
+FWIMAGE_PATH = "$OPEN_IOV_ROOT/firmware/570-GSP/gsp-570.144.fwimage.bin"
+OUTPUT_DIR = "$OPEN_IOV_ROOT/firmware/570-GSP"
+BASE_ADDR = 0x04000000
+
+def read_binary(path):
+    with open(path, 'rb') as f:
+        return f.read()
+
+def find_functions(data, base_addr):
+    functions = []
+    
+    # Pattern 1: Standard 32-bit prologue
+    # addi sp, sp, -imm (opcode=0x13, funct3=0, rd=2, rs1=2)
+    # sd ra, offset(sp) (opcode=0x23, funct3=3, rs1=2, rs2=1)
+    for i in range(0, len(data) - 8, 2):
+        if i + 8 <= len(data):
+            inst1 = struct.unpack('<I', data[i:i+4])[0]
+            inst2 = struct.unpack('<I', data[i+4:i+8])[0]
+            
+            # addi sp, sp, -imm
+            if (inst1 & 0x707F) == 0x0013:
+                rd = (inst1 >> 7) & 0x1F
+                rs1 = (inst1 >> 15) & 0x1F
+                if rd == 2 and rs1 == 2:
+                    imm = (inst1 >> 20) & 0xFFF
+                    if imm >= 0x800:
+                        imm = imm - 0x1000
+                    
+                    # sd ra, offset(sp)
+                    if (inst2 & 0x707F) == 0x23:
+                        funct3 = (inst2 >> 12) & 0x7
+                        rs1_2 = (inst2 >> 15) & 0x1F
+                        rs2 = (inst2 >> 20) & 0x1F
+                        if funct3 == 3 and rs1_2 == 2 and rs2 == 1:
+                            addr = base_addr + i
+                            functions.append({
+                                "address": f"0x{addr:08x}",
+                                "offset": i,
+                                "stack_size": -imm,
+                                "pattern": "std_prologue_addi_sd"
+                            })
+                            continue
+    
+    # Pattern 2: Compressed prologue
+    # c.addi sp, sp, imm
+    # c.sd ra, offset(sp)
+    for i in range(0, len(data) - 4, 2):
+        if i + 4 <= len(data):
+            inst1 = struct.unpack('<H', data[i:i+2])[0]
+            inst2 = struct.unpack('<H', data[i+2:i+4])[0]
+            
+            # c.addi sp, sp, imm
+            if (inst1 & 0xE003) == 0x6001:
+                rd_prime = (inst1 >> 7) & 0x7
+                if rd_prime == 2:
+                    # c.sd ra, offset(sp)
+                    if (inst2 & 0xE003) == 0xE000:
+                        rs1_prime = (inst2 >> 7) & 0x7
+                        rs2_prime = (inst2 >> 10) & 0x7
+                        if rs1_prime == 2 and rs2_prime == 1:
+                            addr = base_addr + i
+                            functions.append({
+                                "address": f"0x{addr:08x}",
+                                "offset": i,
+                                "pattern": "compressed_prologue"
+                            })
+                            continue
+    
+    # Pattern 3: Standard prologue with s0 save
+    # addi sp, sp, -N; sd ra, N-8(sp); sd s0, N-16(sp); addi s0, sp, N
+    for i in range(0, len(data) - 16, 2):
+        if i + 16 <= len(data):
+            inst1 = struct.unpack('<I', data[i:i+4])[0]
+            inst2 = struct.unpack('<I', data[i+4:i+8])[0]
+            inst3 = struct.unpack('<I', data[i+8:i+12])[0]
+            inst4 = struct.unpack('<I', data[i+12:i+16])[0]
+            
+            # addi sp, sp, -N
+            if (inst1 & 0x707F) == 0x0013:
+                rd = (inst1 >> 7) & 0x1F
+                rs1 = (inst1 >> 15) & 0x1F
+                if rd == 2 and rs1 == 2:
+                    imm = (inst1 >> 20) & 0xFFF
+                    if imm >= 0x800:
+                        imm = imm - 0x1000
+                    
+                    # sd ra, N-8(sp)
+                    if (inst2 & 0x707F) == 0x23:
+                        funct3 = (inst2 >> 12) & 0x7
+                        rs1_2 = (inst2 >> 15) & 0x1F
+                        rs2 = (inst2 >> 20) & 0x1F
+                        if funct3 == 3 and rs1_2 == 2 and rs2 == 1:
+                            # sd s0, N-16(sp)
+                            if (inst3 & 0x707F) == 0x23:
+                                funct3_3 = (inst3 >> 12) & 0x7
+                                rs1_3 = (inst3 >> 15) & 0x1F
+                                rs2_3 = (inst3 >> 20) & 0x1F
+                                if funct3_3 == 3 and rs1_3 == 2 and rs2_3 == 8:  # s0 = x8
+                                    # addi s0, sp, N
+                                    if (inst4 & 0x707F) == 0x0013:
+                                        rd4 = (inst4 >> 7) & 0x1F
+                                        rs1_4 = (inst4 >> 15) & 0x1F
+                                        if rd4 == 8 and rs1_4 == 2:
+                                            addr = base_addr + i
+                                            functions.append({
+                                                "address": f"0x{addr:08x}",
+                                                "offset": i,
+                                                "stack_size": -imm,
+                                                "pattern": "full_prologue_ra_s0"
+                                            })
+                                            continue
+    
+    # Pattern 4: Just sd ra, offset(sp) followed by code
+    # Many functions might just save ra
+    for i in range(0, len(data) - 4, 2):
+        if i + 4 <= len(data):
+            inst = struct.unpack('<I', data[i:i+4])[0]
+            
+            # sd ra, offset(sp)
+            if (inst & 0x707F) == 0x23:
+                funct3 = (inst >> 12) & 0x7
+                rs1 = (inst >> 15) & 0x1F
+                rs2 = (inst >> 20) & 0x1F
+                if funct3 == 3 and rs1 == 2 and rs2 == 1:
+                    # Check if previous instruction was addi sp, sp (within 8 bytes)
+                    has_addi_sp = False
+                    stack_size = 0
+                    for j in range(max(0, i-8), i, 2):
+                        if j >= 0:
+                            prev = struct.unpack('<I', data[j:j+4])[0]
+                            if (prev & 0x707F) == 0x0013:
+                                rd = (prev >> 7) & 0x1F
+                                rs1_p = (prev >> 15) & 0x1F
+                                if rd == 2 and rs1_p == 2:
+                                    imm = (prev >> 20) & 0xFFF
+                                    if imm >= 0x800:
+                                        imm = imm - 0x1000
+                                    has_addi_sp = True
+                                    stack_size = -imm
+                                    break
+                    
+                    if has_addi_sp:
+                        addr = base_addr + i
+                        # Avoid duplicates
+                        dup = False
+                        for f in functions:
+                            if f["offset"] == i:
+                                dup = True
+                                break
+                        if not dup:
+                            functions.append({
+                                "address": f"0x{addr:08x}",
+                                "offset": i,
+                                "stack_size": stack_size,
+                                "pattern": "sd_ra_with_addi_sp"
+                            })
+    
+    # Pattern 5: Jump/return instructions that might indicate function boundaries
+    # ret = jalr zero, 0(ra) = 0x00008067
+    # jr ra = jalr zero, 0(ra) (same)
+    for i in range(0, len(data) - 4, 2):
+        if i + 4 <= len(data):
+            inst = struct.unpack('<I', data[i:i+4])[0]
+            if inst == 0x00008067:  # ret / jalr zero, 0(ra)
+                addr = base_addr + i
+                functions.append({
+                    "address": f"0x{addr:08x}",
+                    "offset": i,
+                    "pattern": "return_instruction"
+                })
+    
+    return functions
+
+def main():
+    print(f"Reading firmware binary: {FWIMAGE_PATH}")
+    data = read_binary(FWIMAGE_PATH)
+    print(f"Binary size: {len(data)} bytes")
+    
+    print("Searching for function prologues...")
+    functions = find_functions(data, BASE_ADDR)
+    
+    print(f"Found {len(functions)} potential functions")
+    
+    # Deduplicate by address
+    seen = set()
+    unique = []
+    for f in functions:
+        if f["address"] not in seen:
+            seen.add(f["address"])
+            unique.append(f)
+    
+    # Sort by address
+    unique.sort(key=lambda x: x["offset"])
+    
+    print(f"Unique functions: {len(unique)}")
+    
+    # Save results
+    with open(f"{OUTPUT_DIR}/found_functions_v2.json", "w") as f:
+        json.dump(unique, f, indent=2)
+    
+    with open(f"{OUTPUT_DIR}/function_addresses_v2.txt", "w") as f:
+        for func in unique:
+            ss = func.get("stack_size", "?")
+            f.write(f"{func['address']}  stack_size={ss}  pattern={func['pattern']}\n")
+    
+    print(f"Results saved to {OUTPUT_DIR}/found_functions_v2.json")
+    
+    # Show all
+    for func in unique:
+        ss = func.get("stack_size", "?")
+        print(f"  {func['address']}  stack_size={ss}  pattern={func['pattern']}")
+
+if __name__ == "__main__":
+    main()
-- 
cgit v1.2.3