{
  "schema": "greeneye-sim-profile/1",
  "name": "tu104-570.144",
  "description": "Turing TU104 GSP 570.144: device model windows, load layout and boot-shim assumptions. New firmware version = new profile, not a code fork.",
  "firmware": {
    "file": "firmware/57X-GSP/570.144/gsp-570.144.fwimage.bin",
    "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea",
    "entry": "0x4009000",
    "link_base": "0x4000000",
    "max_vaddr": "0x5bb9000",
    "size": 28528288
  },
  "load": {
    "ram_base": "0x0",
    "memory_mb": 12288,
    "note": "firmware executes at its link addresses; PRIV/PMC is at 0x2000000000000000, local memory covers IMEM/DMEM/EMEM (0x0..0x300000000)."
  },
  "devices": {
    "pmc": {
      "chip_id": "0x164",
      "major": 0,
      "minor": 0,
      "minor_ext": 0,
      "evidence": "NV_PMC_BOOT_42 at PMC+0xA00; CHIP_ID bits 28:20 compared against TU10x IDs by the boot code; TU104 = 0x164 (header field).",
      "windows": [
        {"base": "0x2000000000000000", "size": "0x1000"}
      ]
    },
    "falcon": {
      "shims": {
        "debuginfo_host_consume": true
      },
      "debuginfo_stage_mask": "0x700000",
      "debuginfo_stage_shift": 20,
      "evidence": "Falcon register header offsets; boot writes MAILBOX0/MAILBOX1/DEBUGINFO/IRQSSET(HALT) and polls DEBUGINFO bits 22:20; DMA field layout and transfer semantics from the register header. DEBUGINFO host-consume is a boot shim, not a device claim.",
      "windows": [
        {"base": "0x2000000000110000", "size": "0x1000"},
        {"base": "0x300000000", "size": "0x1000"}
      ]
    },
    "priscv": {
      "evidence": "RISC-V-local register header; boot reads TRACECTL/TRACE_RDIDX/TRACE_WTIDX/PRIV_ERR_STAT/IRQMASK through the libos private mapping at 0x300001000.",
      "windows": [
        {"base": "0x2000000000111000", "size": "0x1000"},
        {"base": "0x300001000", "size": "0x1000"}
      ]
    },
    "timer": {
      "ns_per_insn": 1.0,
      "evidence": "PTIMER register header (NV_PTIMER_TIME_0 0x9400, TIME_1 0x9410). Values are MODELED from the instruction count; the firmware has not been observed reading this block in the 570.144 boot runs.",
      "windows": [
        {"base": "0x2000000000009000", "size": "0x1000"}
      ]
    },
    "fwsec": {
      "wpr2_start": "0x2000000",
      "wpr2_end": "0x6000000",
      "evidence": "PFB WPR2 ADDR_LO/HI register header (0x1FA824/0x1FA828, 4KiB alignment, HI points at the last 128KiB block); values are boot-shim supplied (host/booter-written on real hardware).",
      "windows": [
        {"base": "0x20000000001FA000", "size": "0x1000"}
      ]
    },
    "csb": {
      "evidence": "CSB/TRANSCOM message-window seam. No register semantics are modelled until a message-window poll is observed (B3); a profile may declare individual registers with width/value/semantics.",
      "registers": {},
      "windows": []
    },
    "pmu": {
      "evidence": "PMU stub: no PMU register has been observed; every access stays unhandled and logged.",
      "windows": []
    },
    "dma": {
      "evidence": "GSP RISC-V address map: SYSGPA/FBGPA apertures. In this flat model both apertures alias simulator RAM (documented assumption) so booter-style DMA and firmware aperture reads resolve; unmapped transfers are refused and recorded.",
      "windows": [
        {"pa": "0x8180000000000000", "sim": "0x0", "size": "0x8000000"},
        {"pa": "0x6180000000000000", "sim": "0x0", "size": "0x8000000"}
      ]
    }
  },
  "boot_shim": {
    "note": "Reset-time state the real SEC2 booter/host provides. Every value here is an assumption recorded in the session; the device model never fakes a register read.",
    "registers": {
      "a0": "0x80000",
      "a1": "0x80000",
      "a2": "0x4000000",
      "a3": "0x1b34ea0",
      "a4": "0x4000000",
      "a5": "0x0"
    },
    "bootargs_pa": "0x80000",
    "bootargs_size": 120,
    "core_dump_pa": "0x40000",
    "core_dump_size": "0x10000",
    "wpr_meta_pa": "0x90000",
    "image_at": "0x100000000",
    "wpr": {
      "elf_pa": "0x4000000",
      "elf_size": "0x1b34ea0",
      "wpr_start": "0x2000000",
      "wpr_end": "0x6000000",
      "boot_bin_offset": "0x3000000",
      "gsp_fw_offset": "0x4000000",
      "fb_size": "0x200000000"
    }
  }
}