# GSP 570.144W - Complete RPC Handler Address Map

## Jump Table at 0x059bfeb0 (Decoded - Actual Handler Addresses)

| RPC Type | Name | Handler A | Handler B | Notes |
|----------|------|-----------|-----------|-------|
| 0x01 | ALLOC | - | - | Uses primary dispatcher |
| 0x02 | FREE | - | - | Uses primary dispatcher |
| 0x03 | MAP | 0x05766ab7 | 0x05778a37 | Two handlers |
| 0x04 | UNMAP | 0x057669b7 | 0x05779937 | Two handlers |
| 0x05 | PIN | 0x057664b7 | 0x0577a3b7 | Two handlers |
| 0x06 | UNPIN | 0x057682b7 | 0x05779fb7 | Two handlers |
| 0x07 | SCHEDULE | 0x05767f37 | 0x0575aeb7 | Two handlers |
| 0x08 | YIELD | 0x0575ae37 | 0x05767337 | Two handlers |
| 0x09 | NOTIFY | 0x0577c8b7 | 0x05767837 | Two handlers |
| 0x0A | BAR_TRAP | 0x057675b7 | - | Single handler |
| 0x0B | MIGRATE | - | - | Uses primary dispatcher |
| 0x0C | DEBUG | - | - | - |

## Primary Dispatcher (0x057a1ac0) Handles
- ALLOC (0x01), UNMAP (0x04), PIN (0x05), MIGRATE (0x0B), FREE (0x02), SCHEDULE (0x07)
- Jump table at 0x057a3ad8 (32 sub-command entries)

## Secondary Dispatcher (0x04ed39dc) Handles
- ALL 11 RPC types via branch-based dispatch

## Key Handler Implementations (from jump table)

### MAP Handlers (RPC 0x03)
- **0x05766ab7** - MAP handler A
- **0x05778a37** - MAP handler B

### UNMAP Handlers (RPC 0x04)
- **0x057669b7** - UNMAP handler A
- **0x05779937** - UNMAP handler B

### PIN Handlers (RPC 0x05)
- **0x057664b7** - PIN handler A
- **0x0577a3b7** - PIN handler B

### UNPIN Handlers (RPC 0x06)
- **0x057682b7** - UNPIN handler A
- **0x05779fb7** - UNPIN handler B

### SCHEDULE Handlers (RPC 0x07)
- **0x05767f37** - SCHEDULE handler A
- **0x0575aeb7** - SCHEDULE handler B (also at 0x051efbf4 - rpc_schedule_main)

### YIELD Handlers (RPC 0x08)
- **0x0575ae37** - YIELD handler A
- **0x05767337** - YIELD handler B

### NOTIFY Handlers (RPC 0x09)
- **0x0577c8b7** - NOTIFY handler A
- **0x05767837** - NOTIFY handler B

### BAR_TRAP Handler (RPC 0x0A)
- **0x057675b7** - BAR trap handler (also at 0x04cb8189 via first jump table)

## Specialized Main Handlers
- **0x057e94ec** - rpc_alloc_main (ALLOC implementation)
- **0x051efbf4** - rpc_schedule_main (SCHEDULE implementation)
- **0x04cb8189** - rpc_bar_trap_handler (BAR_TRAP implementation)
- **0x04ed34b8** - rpc_pin_handler (from secondary dispatcher)

## Calling Convention
```
RA saved to: s1 (x9), s4 (x12), or s10 (x20)
Frame pointer: s0 (x8)
Stack frame: addi sp, sp, -N (N = 96-560 bytes)
Callee-saved: s1-s11 saved to stack
```

## Integration Points for vGPU-IO

### Memory Management (ALLOC/FREE/MAP/UNMAP)
```c
// Primary entry: 0x057a1ac0 (primary dispatcher)
// Sub-commands via jump table at 0x057a3ad8
// Main implementation: 0x057e94ec (alloc_main)
```

### Page Pinning (PIN/UNPIN)
```c
// Handler A: 0x057664b7
// Handler B: 0x0577a3b7
// Secondary dispatcher entry: 0x04ed34b8
```

### Scheduling (SCHEDULE/YIELD)
```c
// SCHEDULE: 0x05767f37, 0x0575aeb7, 0x051efbf4
// YIELD: 0x0575ae37, 0x05767337
```

### BAR Emulation (BAR_TRAP)
```c
// Main handler: 0x057675b7 (from jump table)
// Also: 0x04cb8189 (from first jump table at 0x059be7f4)
// Strings: BAR1, Bar1Rest, ForceBarAccess, Bar1Mapping, Bar1Aperture, Bar1Size
```

### WPR Management
```c
// String references (60 locations):
// WPR_WRITE_COMPLETE, WPR_READ_COMPLETE
// WPR_WRITE_TIMEOUT, WPR_READ_TIMEOUT
// NV_WPR_WRITE_COMPLETE, NV_WPR_READ_COMPLETE
// NV_WPR_WRITE_TIMEOUT, NV_WPR_READ_TIMEOUT
```

### Migration (MIGRATE)
```c
// Handled by primary dispatcher (0x057a1ac0)
// RPC type 0x0B
```

## Next Steps for Implementation

1. **Decompile jump table handlers** (0x057664b7, 0x057669b7, 0x05766ab7, etc.) to pseudo-C
2. **Map primary dispatcher sub-commands** (32 entries at 0x057a3ad8)
3. **Implement kernel RPC client** calling 0x057a1ac0 with proper message format
4. **Register BAR trap handler** at 0x057675b7 / 0x04cb8189
5. **Hook WPR completion callbacks** from string reference locations