From 5dd8165f1754e156a0f9fb16c7a6bfa90e99ed60 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 14 Sep 2026 06:43:11 -0400 Subject: VFIO device registration fix + IOMMUFD callbacks + VFIO ioctl handlers - Removed IOMMU group addition before vfio_register_emulated_iommu_dev() in nv_vgpu_mdev_create() - Added IOMMUFD callbacks (bind_iommufd, unbind_iommufd, attach_ioas, detach_ioas) using kernel's vfio_iommufd_emulated_* functions - Implemented VFIO ioctl handlers: GET_INFO, GET_REGION_INFO, GET_IRQ_INFO, SET_IRQS, MMAP - Added config space read/write handlers at offset 0x70000000000 - Mmap handler for config space, BAR0 (emulation shadow), BAR1-5 (physical VRAM/registers) - Interrupt handler for VFIO_DEVICE_SET_IRQS (DATA_EVENTFD, DATA_NONE, DATA_BOOL) - Added udev rules for vfio group permissions - Created stack_manager.sh unified tool - Fixed mdev remove crash with deferred cleanup in vfio_device_release callback - Kernel 6.8+ IOMMUFD compatibility - QEMU launches successfully with vGPU passthrough --- firmware/57X-GSP/570.144/find_prologues.py | 197 +++++++++++++++++++++++++++++ 1 file changed, 197 insertions(+) create mode 100644 firmware/57X-GSP/570.144/find_prologues.py (limited to 'firmware/57X-GSP/570.144/find_prologues.py') diff --git a/firmware/57X-GSP/570.144/find_prologues.py b/firmware/57X-GSP/570.144/find_prologues.py new file mode 100644 index 0000000..a4dc2d2 --- /dev/null +++ b/firmware/57X-GSP/570.144/find_prologues.py @@ -0,0 +1,197 @@ +#!/usr/bin/env python3 +""" +Focused search for RISC-V function prologues in GSP firmware. +Only searches in executable code sections. +""" + +import struct +import json + +FWIMAGE_PATH = "$OPEN_IOV_ROOT/firmware/570-GSP/gsp-570.144.fwimage.bin" +OUTPUT_DIR = "$OPEN_IOV_ROOT/firmware/570-GSP" +BASE_ADDR = 0x04000000 + +# Executable sections from memory_blocks.json +EXEC_SECTIONS = [ + (0x04005000, 0x04006413), # .ga100_text + (0x04007000, 0x04008413), # .tu10x_text + (0x04009000, 0x04009073), # .bootstrap + (0x0400a000, 0x0400cfff), # .ga100_resident_text + (0x0400e000, 0x04010fff), # .tu10x_resident_text + (0x04018000, 0x0401cfff), # .section_task_init_elf_text_instance + (0x04c58000, 0x05b21fff), # .section_task_rm_elf_text_instance (MAIN - 15.5MB) +] + +def read_binary(path): + with open(path, 'rb') as f: + return f.read() + +def is_in_exec_section(addr, offset): + """Check if address is in an executable section.""" + for start, end in EXEC_SECTIONS: + if start <= addr <= end: + return True + return False + +def find_prologues(data, base_addr): + functions = [] + + # Pattern 1: Standard 32-bit prologue (addi sp, sp, -N; sd ra, offset(sp)) + for i in range(0, len(data) - 8, 2): + addr = base_addr + i + if not is_in_exec_section(addr, i): + continue + + if i + 8 <= len(data): + inst1 = struct.unpack('> 7) & 0x1F + rs1 = (inst1 >> 15) & 0x1F + if rd == 2 and rs1 == 2: + imm = (inst1 >> 20) & 0xFFF + if imm >= 0x800: + imm = imm - 0x1000 + + # sd ra, offset(sp) (opcode=0x23, funct3=3, rs1=2, rs2=1) + if (inst2 & 0x707F) == 0x23: + funct3 = (inst2 >> 12) & 0x7 + rs1_2 = (inst2 >> 15) & 0x1F + rs2 = (inst2 >> 20) & 0x1F + if funct3 == 3 and rs1_2 == 2 and rs2 == 1: + functions.append({ + "address": f"0x{addr:08x}", + "offset": i, + "stack_size": -imm, + "pattern": "std_prologue" + }) + continue + + # Pattern 2: Compressed prologue (c.addi sp, sp, imm; c.sd ra, offset(sp)) + for i in range(0, len(data) - 4, 2): + addr = base_addr + i + if not is_in_exec_section(addr, i): + continue + + if i + 4 <= len(data): + inst1 = struct.unpack('> 7) & 0x7 + if rd_prime == 2: + # c.sd ra, offset(sp) + if (inst2 & 0xE003) == 0xE000: + rs1_prime = (inst2 >> 7) & 0x7 + rs2_prime = (inst2 >> 10) & 0x7 + if rs1_prime == 2 and rs2_prime == 1: + functions.append({ + "address": f"0x{addr:08x}", + "offset": i, + "pattern": "compressed_prologue" + }) + continue + + # Pattern 3: Full prologue with s0 (addi sp, sp, -N; sd ra, N-8(sp); sd s0, N-16(sp); addi s0, sp, N) + for i in range(0, len(data) - 16, 2): + addr = base_addr + i + if not is_in_exec_section(addr, i): + continue + + if i + 16 <= len(data): + inst1 = struct.unpack('> 7) & 0x1F + rs1 = (inst1 >> 15) & 0x1F + if rd == 2 and rs1 == 2: + imm = (inst1 >> 20) & 0xFFF + if imm >= 0x800: + imm = imm - 0x1000 + + # sd ra, N-8(sp) + if (inst2 & 0x707F) == 0x23: + funct3 = (inst2 >> 12) & 0x7 + rs1_2 = (inst2 >> 15) & 0x1F + rs2 = (inst2 >> 20) & 0x1F + if funct3 == 3 and rs1_2 == 2 and rs2 == 1: + # sd s0, N-16(sp) + if (inst3 & 0x707F) == 0x23: + funct3_3 = (inst3 >> 12) & 0x7 + rs1_3 = (inst3 >> 15) & 0x1F + rs2_3 = (inst3 >> 20) & 0x1F + if funct3_3 == 3 and rs1_3 == 2 and rs2_3 == 8: # s0 = x8 + # addi s0, sp, N + if (inst4 & 0x707F) == 0x0013: + rd4 = (inst4 >> 7) & 0x1F + rs1_4 = (inst4 >> 15) & 0x1F + if rd4 == 8 and rs1_4 == 2: + functions.append({ + "address": f"0x{addr:08x}", + "offset": i, + "stack_size": -imm, + "pattern": "full_prologue" + }) + continue + + return functions + +def main(): + print(f"Reading firmware binary: {FWIMAGE_PATH}") + data = read_binary(FWIMAGE_PATH) + print(f"Binary size: {len(data)} bytes") + + print("Searching for function prologues in executable sections...") + functions = find_prologues(data, BASE_ADDR) + + print(f"Found {len(functions)} potential functions") + + # Deduplicate by address + seen = set() + unique = [] + for f in functions: + if f["address"] not in seen: + seen.add(f["address"]) + unique.append(f) + + # Sort by address + unique.sort(key=lambda x: x["offset"]) + + print(f"Unique functions: {len(unique)}") + + # Save results + with open(f"{OUTPUT_DIR}/found_prologues.json", "w") as f: + json.dump(unique, f, indent=2) + + with open(f"{OUTPUT_DIR}/prologue_addresses.txt", "w") as f: + for func in unique: + ss = func.get("stack_size", "?") + f.write(f"{func['address']} stack_size={ss} pattern={func['pattern']}\n") + + print(f"Results saved to {OUTPUT_DIR}/found_prologues.json") + + # Group by pattern + by_pattern = {} + for func in unique: + p = func["pattern"] + if p not in by_pattern: + by_pattern[p] = [] + by_pattern[p].append(func) + + for pattern, funcs in by_pattern.items(): + print(f"\n{pattern}: {len(funcs)} functions") + for func in funcs[:20]: + ss = func.get("stack_size", "?") + print(f" {func['address']} stack_size={ss}") + if len(funcs) > 20: + print(f" ... and {len(funcs) - 20} more") + +if __name__ == "__main__": + main() -- cgit v1.2.3