1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
{
"schema": "greeneye-sim-profile/1",
"name": "tu104-570.144",
"description": "Turing TU104 GSP 570.144: device model windows, load layout and boot-shim assumptions. New firmware version = new profile, not a code fork.",
"firmware": {
"file": "firmware/57X-GSP/570.144/gsp-570.144.fwimage.bin",
"sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea",
"entry": "0x4009000",
"link_base": "0x4000000",
"max_vaddr": "0x5bb9000",
"size": 28528288
},
"load": {
"ram_base": "0x0",
"memory_mb": 12288,
"note": "firmware executes at its link addresses; PRIV/PMC is at 0x2000000000000000, local memory covers IMEM/DMEM/EMEM (0x0..0x300000000)."
},
"devices": {
"pmc": {
"chip_id": "0x164",
"major": 0,
"minor": 0,
"minor_ext": 0,
"evidence": "NV_PMC_BOOT_42 at PMC+0xA00; CHIP_ID bits 28:20 compared against TU10x IDs by the boot code; TU104 = 0x164 (header field).",
"windows": [
{"base": "0x2000000000000000", "size": "0x1000"}
]
},
"falcon": {
"shims": {
"debuginfo_host_consume": true
},
"debuginfo_stage_mask": "0x700000",
"debuginfo_stage_shift": 20,
"evidence": "Falcon register header offsets; boot writes MAILBOX0/MAILBOX1/DEBUGINFO/IRQSSET(HALT) and polls DEBUGINFO bits 22:20; DMA field layout and transfer semantics from the register header. DEBUGINFO host-consume is a boot shim, not a device claim.",
"windows": [
{"base": "0x2000000000110000", "size": "0x1000"},
{"base": "0x300000000", "size": "0x1000"}
]
},
"priscv": {
"evidence": "RISC-V-local register header; boot reads TRACECTL/TRACE_RDIDX/TRACE_WTIDX/PRIV_ERR_STAT/IRQMASK through the libos private mapping at 0x300001000.",
"windows": [
{"base": "0x2000000000111000", "size": "0x1000"},
{"base": "0x300001000", "size": "0x1000"}
]
},
"timer": {
"ns_per_insn": 1.0,
"evidence": "PTIMER register header (NV_PTIMER_TIME_0 0x9400, TIME_1 0x9410). Values are MODELED from the instruction count; the firmware has not been observed reading this block in the 570.144 boot runs.",
"windows": [
{"base": "0x2000000000009000", "size": "0x1000"}
]
},
"fwsec": {
"wpr2_start": "0x2000000",
"wpr2_end": "0x6000000",
"evidence": "PFB WPR2 ADDR_LO/HI register header (0x1FA824/0x1FA828, 4KiB alignment, HI points at the last 128KiB block); values are boot-shim supplied (host/booter-written on real hardware).",
"windows": [
{"base": "0x20000000001FA000", "size": "0x1000"}
]
},
"csb": {
"evidence": "CSB/TRANSCOM message-window seam. No register semantics are modelled until a message-window poll is observed (B3); a profile may declare individual registers with width/value/semantics.",
"registers": {},
"windows": []
},
"pmu": {
"evidence": "PMU stub: no PMU register has been observed; every access stays unhandled and logged.",
"windows": []
},
"dma": {
"evidence": "GSP RISC-V address map: SYSGPA/FBGPA apertures. In this flat model both apertures alias simulator RAM (documented assumption) so booter-style DMA and firmware aperture reads resolve; unmapped transfers are refused and recorded.",
"windows": [
{"pa": "0x8180000000000000", "sim": "0x0", "size": "0x8000000"},
{"pa": "0x6180000000000000", "sim": "0x0", "size": "0x8000000"}
]
}
},
"boot_shim": {
"note": "Reset-time state the real SEC2 booter/host provides. Every value here is an assumption recorded in the session; the device model never fakes a register read.",
"registers": {
"a0": "0x80000",
"a1": "0x80000",
"a2": "0x4000000",
"a3": "0x1b34ea0",
"a4": "0x4000000",
"a5": "0x0"
},
"bootargs_pa": "0x80000",
"bootargs_size": 120,
"core_dump_pa": "0x40000",
"core_dump_size": "0x10000",
"wpr_meta_pa": "0x90000",
"image_at": "0x100000000",
"wpr": {
"elf_pa": "0x4000000",
"elf_size": "0x1b34ea0",
"wpr_start": "0x2000000",
"wpr_end": "0x6000000",
"boot_bin_offset": "0x3000000",
"gsp_fw_offset": "0x4000000",
"fb_size": "0x200000000"
}
}
}
|
