# GSP Firmware 570.144W Analysis Summary

## Firmware Details
- **Version**: 570.144W (TU102/TU104)
- **Binary**: 28,528,288 bytes ELF at base 0x04000000
- **Architecture**: RISC-V 64-bit (RV64IMAC)

## Key Findings

### 1. Function Discovery
- **134,203 unique call targets** identified from JAL instructions
- **490/500 top call targets** reference RPC type constants → likely RPC handlers/dispatcher
- Calling convention: **ra saved to callee-saved register (s1/s4/s10)**, s0 = frame pointer

### 2. RPC Dispatcher Candidates
Top functions referencing **multiple RPC types** (likely main dispatcher switch):

| Address | Calls | Stack | RPC Types Referenced |
|---------|-------|-------|---------------------|
| **0x057a1ac0** | 224 | - | ALLOC, UNMAP, PIN, MIGRATE, FREE, SCHEDULE (6 types) |
| **0x04ed39dc** | 139 | - | MAP, ALLOC, YIELD, SCHEDULE, UNPIN, PIN, UNMAP, FREE, MIGRATE, BAR_TRAP, NOTIFY (11 types) |
| **0x05adc298** | 117 | - | FREE, PIN, ALLOC, YIELD, BAR_TRAP (5 types) |
| **0x04ecbcb0** | 94 | - | MAP, FREE, ALLOC, MIGRATE, NOTIFY, BAR_TRAP (6 types) |
| **0x04cc58f8** | 53 | 160 | YIELD, SCHEDULE, UNPIN, PIN, UNMAP, MAP, FREE, MIGRATE, BAR_TRAP, ALLOC, NOTIFY (11 types) |
| **0x05723ef4** | 53 | 96 | ALLOC, UNMAP, FREE, MAP, UNPIN, YIELD, NOTIFY, BAR_TRAP, MIGRATE, PIN (10 types) |

**Primary Dispatcher**: **0x057a1ac0** - highest call count among multi-RPC functions, references 6 RPC types in first 1KB

### 3. Specialized Handler Candidates
Functions dominated by **single RPC type** (likely specific handlers):

| Address | Calls | Primary RPC Type |
|---------|-------|------------------|
| 0x04efeac8 | 445 | (recursive, no RPC refs in 1KB) |
| 0x057e94ec | 142 | ALLOC (25+ refs) |
| 0x04d00a18 | 106 | ALLOC (13+ refs) |
| 0x054a7de0 | 86 | ALLOC (17+ refs) |
| 0x051efbf4 | 59 | SCHEDULE (6+ refs) |
| 0x05adc128 | 67 | ALLOC, YIELD, FREE, BAR_TRAP |

### 4. Entry Point
- **0x04009000**: Bootstrap code, calls 0x04009070 (JAL to self = halt loop)
- References ALLOC at offset 8 (likely initialization)

### 5. BAR Trap Handler
- **0x04cb8189**: Identified from jump table at 0x059be7f4
- Called for RPC_BAR_TRAP (0x0A) dispatch
- Makes calls to 0x04bc1665

### 6. Strings Found
- **WPR**: 60 locations (e.g., "WPR_WRITE_COMPLETE", "WPR_READ_COMPLETE", "NV_WPR_*")
- **BAR**: 28 locations (e.g., "BAR1", "Bar1Rest", "ForceBarAccess")
- **RPC**: 4 locations
- **GSP**: 25 locations

### 7. Jump Tables
- **0x059be7f4**: 12-entry table (matches 12 RPC types) - contains encoded pointers
- **0x059bfeb0**: Another 12-entry encoded table
- Pointers appear obfuscated (not direct addresses)

## Architecture Summary

### Calling Convention
```
Prologue:
  addi sp, sp, -N          # Allocate stack frame (N >= 32)
  sd s1, offset(sp)        # Save callee-saved registers s1-s11
  sd s2, offset(sp)
  ...
  addi s0, sp, N           # Set frame pointer (s0 = sp + N)
  mv sX, ra                # Save return address to callee-saved reg (s1/s4/s10)

Epilogue:
  mv ra, sX                # Restore return address
  ld s1, offset(sp)        # Restore callee-saved registers
  ld s2, offset(sp)
  ...
  addi sp, sp, N           # Deallocate stack
  ret                      # jalr x0, 0(ra)
```

### RPC Types (from gsp_comm.h)
| Value | Name | Description |
|-------|------|-------------|
| 0x01 | ALLOC | Memory allocation |
| 0x02 | FREE | Memory free |
| 0x03 | MAP | Memory map |
| 0x04 | UNMAP | Memory unmap |
| 0x05 | PIN | Pin pages |
| 0x06 | UNPIN | Unpin pages |
| 0x07 | SCHEDULE | Schedule work |
| 0x08 | YIELD | Yield CPU |
| 0x09 | NOTIFY | Notification |
| 0x0A | BAR_TRAP | BAR register trap |
| 0x0B | MIGRATE | Migration protocol |
| 0xFF | DEBUG | Debug commands |

## Next Steps for Full Decompilation

1. **Focus Ghidra on dispatcher functions**: 0x057a1ac0, 0x04ed39dc, 0x04cc58f8, 0x05723ef4
2. **Trace RPC handler calls** from dispatcher switch cases
3. **Identify WPR management** via string references ("WPR_WRITE_COMPLETE", etc.)
4. **Map BAR emulation** via "BAR1", "ForceBarAccess" strings
5. **Find migration protocol** via RPC_MIGRATE (0x0B) handlers
6. **Analyze entry/boot sequence** from 0x04009000

## Files Generated
- `all_call_targets.txt` - 134K call targets with counts
- `analysis_results.json` - Structured analysis of top 500 functions
- `found_prologues_v2.json` - Function prologue patterns
- `analyze_firmware.py` - Python analysis tool