# Address Reference

## Firmware Base
| Symbol | Address | Description |
|--------|---------|-------------|
| `FW_BASE` | 0x04000000 | Firmware load address |
| `FW_SIZE` | 0x02000000 | ~32 MB |

## Dispatchers
| Name | Address | Size | Description |
|------|---------|------|-------------|
| Entry Point | 0x04009000 | 573B | Boot entry |
| Primary Dispatcher | 0x057A1AC0 | 558B | Main RPC dispatcher |
| Secondary Dispatcher | 0x04ED39DC | 141KB | Branch-based dispatcher |
| Tertiary Dispatcher | 0x05723EF4 | 13KB | Additional dispatcher |
| RPC Jump Table | 0x059BE7F4 | 4.9KB | 12 RPC type table |
| RPC Type Table | 0x059BFEB0 | — | Actual handler addresses |

## Primary Dispatcher Sub-Commands (Jump Table at 0x057A3AD8)
| Subcmd | Target | Decompiled |
|--------|--------|------------|
| 0 | 0x057A1DB4 | ✅ |
| 1 | 0x057A1C18 | ✅ |
| 2 | 0x057A39FC | ✅ |
| 3 | 0x057A1BCC | ✅ |
| 4 | 0x057A1EF4 | ✅ |
| 5 | 0x057A1E94 | ✅ |
| 6 | 0x057A3A28 | ✅ |
| 7 | 0x057A3A60 | ✅ |
| 8 | 0x057A1C6C | ✅ |
| 9 | 0x057A3A48 | ✅ |
| 10 | 0x057A1F6C | ✅ |
| 11 | 0x057A3AC4 | ✅ |
| 12 | 0x057A1E10 | ✅ |
| 13 | 0x057A3A90 | ✅ |
| 14 | 0x057A39BC | ✅ |
| 15 | 0x057A3AAC | ✅ |
| 16 | 0x057A3A78 | ✅ |
| 17 | 0x057A1CCC | ✅ |
| 18 | 0x057A39E0 | ✅ |
| 19 | 0x057A1FA8 | ✅ |
| 20 | 0x057A2094 | ✅ |
| 21 | 0x057A2074 | ✅ |
| 22 | 0x057A2044 | ✅ |
| 23 | 0x057A20D4 | ✅ |
| 24 | 0x057A20B4 | ✅ |
| 25 | 0x057A1FC8 | ✅ |
| 26 | 0x057A2008 | ✅ |
| 27 | 0x057A1FE8 | ✅ |
| 28 | 0x057A2024 | ✅ |
| 29 | 0x057A219C | ✅ |
| 30 | 0x057A20FC | ✅ |
| 31 | 0x057A214C | ✅ |

## Migration Jump Tables
### Table 1: 0x04179ED8 (MIGRATE branch at 0x057A1BDC)
| Index | Target | Decompiled |
|-------|--------|------------|
| 0 | 0x057A2344 | ✅ |
| 1 | 0x057A2320 | ✅ |
| 2 | 0x057A230C | ✅ |
| 3 | 0x057A22F8 | ✅ |
| 4 | 0x057A2388 | ✅ |
| 5 | 0x057A23D8 | ✅ |
| 6 | 0x057A23AC | ✅ |
| 7 | 0x057A2478 | ✅ |
| 8 | 0x057A2428 | ✅ |
| 9 | 0x057A2454 | ✅ |
| 10 | 0x057A2404 | ✅ |
| 11 | 0x057A2364 | ✅ |
| 12 | 0x057A1F3C | (dup) |
| 13 | 0x057A299C | — |
| 14 | 0x057A1F3C | (dup) |
| 15 | 0x057A1F3C | (dup) |

### Table 2: 0x04179FBC (MIGRATE branch at 0x057A1D5C)
| Index | Target | Decompiled |
|-------|--------|------------|
| 0 | 0x057A257C | ✅ |
| 1 | 0x057A25E4 | ✅ |
| 2 | 0x057A24EC | ✅ |
| 3 | 0x057A2608 | ✅ |
| 4 | 0x057A2534 | ✅ |
| 5 | 0x057A25C0 | ✅ |
| 6 | 0x057A24A4 | ✅ |
| 7 | 0x057A259C | ✅ |
| 8 | 0x057A2510 | ✅ |
| 9 | 0x057A2558 | ✅ |
| 10 | 0x057A24C8 | ✅ |
| 11 | 0x057A262C | ✅ |
| 12 | 0x057A345C | ✅ |
| 13 | 0x057A36D8 | ✅ |
| 14 | 0x057A35D8 | ✅ |
| 15 | 0x057A3658 | ✅ |

## RPC Handlers (from Jump Table at 0x059BFEB0)
| RPC Type | Name | Handler A | Handler B |
|----------|------|-----------|-----------|
| 0x01 | ALLOC | — | — |
| 0x02 | FREE | — | — |
| 0x03 | MAP | 0x05766AB7 | 0x05778A37 |
| 0x04 | UNMAP | 0x057669B7 | 0x05779937 |
| 0x05 | PIN | 0x057664B7 | 0x0577A3B7 |
| 0x06 | UNPIN | 0x057682B7 | 0x05779FB7 |
| 0x07 | SCHEDULE | 0x05767F37 | 0x0575AEB7 |
| 0x08 | YIELD | 0x0575AE37 | 0x05767337 |
| 0x09 | NOTIFY | 0x0577C8B7 | 0x05767837 |
| 0x0A | BAR_TRAP | 0x057675B7 | — |
| 0x0B | MIGRATE | — | — |
| 0x0C | DEBUG | — | — |

## Specialized Main Handlers
| Function | Address | Size |
|----------|---------|------|
| `rpc_alloc_main` | 0x057E94EC | 40 KB |
| `rpc_schedule_main` | 0x051EFBF4 | 1.8 KB |
| `rpc_bar_trap_handler` | 0x04CB8188 | 40 KB |
| `rpc_pin_handler` | 0x04ED34B8 | — |

## WPR Handlers
| Handler | Address | Size |
|---------|---------|------|
| WPR Handler 1 | 0x04F00B0C | 62 KB |
| WPR Handler 2 | 0x04F00C78 | 62 KB |

## Memory & Global State
| Symbol | Address | Description |
|--------|---------|-------------|
| Global Error Flag | 0x04296048 | `cRam0000000004296048` |
| Error Status Reg | 0x0429B750+0x111300 | Error register |
| Stack Canary | 0x041DC350 | Frame guard value |
| Allocator Arena | 0x429B000 | Base |
| Allocator Entry | 0x429B450 | `UNK_ram_058A1A9C` |
| Cache Manager | 0x429B428 | `UNK_ram_05895BF4` |

## String References

### BAR Strings
| String | Address |
|--------|---------|
| BAR1 | 0x0406570E, 0x04085DE0 |
| Bar1Rest | 0x040656DA |
| ForceBarAccess | 0x040656F2 |
| Bar1Aperture | 0x04065722 |
| Bar1Size | (referenced) |

### WPR Strings
| String | Address |
|--------|---------|
| WPR_WRITE_COMPLETE | 0x5E478F8 |
| WPR_READ_COMPLETE | 0x5E478E0 |
| WPR_WRITE_TIMEOUT | 0x5E47898 |
| WPR_READ_TIMEOUT | 0x5E47880 |
| NV_WPR_WRITE_COMPLETE | 0x5E478C8 |
| NV_WPR_READ_COMPLETE | 0x5E478B0 |
| NV_WPR_WRITE_TIMEOUT | 0x5E47868 |
| NV_WPR_READ_TIMEOUT | 0x5E47850 |

### VBIOS Signatures
| Signature | Value | Meaning |
|-----------|-------|---------|
| VBIOS Standard | 0xAA55 | VBIOS header |
| WPR Enable | 0x57464F4E ("WFON") | WPR on |
| WPR Version | 0x5746564E ("WFVN") | WPR version |

## Key Function Pointers (Indirect Calls)
| Address | Function | Purpose |
|---------|----------|---------|
| 0x05AB7DA0 | Logger | String logging |
| 0x05AC4B7C | Stack unwind | Frame recovery |
| 0x058A1A9C | Allocator | Memory alloc |
| 0x05895BF4 | Cache flush | Cache management |
| 0x0588F9C4 | DMA copy | Memory copy |
| 0x05AEC86C | Memory read | Read from addr |
| 0x05AE1430 | Size query | Region size |
| 0x05AF4D30 | Page fault | Page fault handler |
| 0x05B10C3C | Page map | Page mapping |
| 0x05AE9A2C | Crypto/verify | Integrity check |
| 0x05AED674 | WPR check | WPR validation |
| 0x05AED430 | WPR emulate | WPR emulation |
| 0x05CB30CC | Config read | Config access |
| 0x05CB25E0 | BAR config | BAR configuration |
| 0x05CB23D8 | BAR map | BAR mapping |

## Decompiled Output Files
All files in: `$OPEN_IOV_ROOT/firmware/570-GSP/decompiled/`

| Category | Files |
|----------|-------|
| Core | entry_ram_04009000.c, FUN_ram_057a1ac0_ram_057a1ac0.c |
| Sub-commands | FUN_ram_057a1bcc_ram_057a1bcc.c ... FUN_ram_057a214c_ram_057a214c.c (32) |
| Dispatchers | FUN_ram_04cc58f8_ram_04cc58f8.c, FUN_ram_04ed39dc_ram_04ed39dc.c, FUN_ram_05723ef4_ram_05723ef4.c |
| RPC Jump Table | FUN_ram_059be7f4_ram_059be7f4.c |
| BAR | FUN_ram_04cb8188_ram_04cb8188.c |
| WPR | FUN_ram_04f00b0c_ram_04f00b0c.c, FUN_ram_04f00c78_ram_04f00c78.c |
| ALLOC | FUN_ram_057e94ec_ram_057e94ec.c, FUN_ram_04d00a18_ram_04d00a18.c, FUN_ram_054a7de0_ram_054a7de0.c |
| SCHEDULE | FUN_ram_051efbf4_ram_051efbf4.c |
| RPC Handlers | FUN_ram_057664b7_ram_057664b7.c ... FUN_ram_0577c8b7_ram_0577c8b7.c (15) |
| Migration | FUN_ram_057a22f8_ram_057a22f8.c ... FUN_ram_057a3658_ram_057a3658.c (28) |

## Migration Sub-Command Descriptors (Sample)
| Handler | Returned ID | Phase |
|---------|-------------|-------|
| 0x057A22F8 | 0x10 | Prepare |
| 0x057A2344 | 0x14 | Prepare |
| Others | TBD | Transfer/Commit |