1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
# GSP Firmware 570.144W Analysis Summary
## Firmware Details
- **Version**: 570.144W (TU102/TU104)
- **Binary**: 28,528,288 bytes ELF at base 0x04000000
- **Architecture**: RISC-V 64-bit (RV64IMAC)
## Key Findings
### 1. Function Discovery
- **134,203 unique call targets** identified from JAL instructions
- **490/500 top call targets** reference RPC type constants → likely RPC handlers/dispatcher
- Calling convention: **ra saved to callee-saved register (s1/s4/s10)**, s0 = frame pointer
### 2. RPC Dispatcher Candidates
Top functions referencing **multiple RPC types** (likely main dispatcher switch):
| Address | Calls | Stack | RPC Types Referenced |
|---------|-------|-------|---------------------|
| **0x057a1ac0** | 224 | - | ALLOC, UNMAP, PIN, MIGRATE, FREE, SCHEDULE (6 types) |
| **0x04ed39dc** | 139 | - | MAP, ALLOC, YIELD, SCHEDULE, UNPIN, PIN, UNMAP, FREE, MIGRATE, BAR_TRAP, NOTIFY (11 types) |
| **0x05adc298** | 117 | - | FREE, PIN, ALLOC, YIELD, BAR_TRAP (5 types) |
| **0x04ecbcb0** | 94 | - | MAP, FREE, ALLOC, MIGRATE, NOTIFY, BAR_TRAP (6 types) |
| **0x04cc58f8** | 53 | 160 | YIELD, SCHEDULE, UNPIN, PIN, UNMAP, MAP, FREE, MIGRATE, BAR_TRAP, ALLOC, NOTIFY (11 types) |
| **0x05723ef4** | 53 | 96 | ALLOC, UNMAP, FREE, MAP, UNPIN, YIELD, NOTIFY, BAR_TRAP, MIGRATE, PIN (10 types) |
**Primary Dispatcher**: **0x057a1ac0** - highest call count among multi-RPC functions, references 6 RPC types in first 1KB
### 3. Specialized Handler Candidates
Functions dominated by **single RPC type** (likely specific handlers):
| Address | Calls | Primary RPC Type |
|---------|-------|------------------|
| 0x04efeac8 | 445 | (recursive, no RPC refs in 1KB) |
| 0x057e94ec | 142 | ALLOC (25+ refs) |
| 0x04d00a18 | 106 | ALLOC (13+ refs) |
| 0x054a7de0 | 86 | ALLOC (17+ refs) |
| 0x051efbf4 | 59 | SCHEDULE (6+ refs) |
| 0x05adc128 | 67 | ALLOC, YIELD, FREE, BAR_TRAP |
### 4. Entry Point
- **0x04009000**: Bootstrap code, calls 0x04009070 (JAL to self = halt loop)
- References ALLOC at offset 8 (likely initialization)
### 5. BAR Trap Handler
- **0x04cb8189**: Identified from jump table at 0x059be7f4
- Called for RPC_BAR_TRAP (0x0A) dispatch
- Makes calls to 0x04bc1665
### 6. Strings Found
- **WPR**: 60 locations (e.g., "WPR_WRITE_COMPLETE", "WPR_READ_COMPLETE", "NV_WPR_*")
- **BAR**: 28 locations (e.g., "BAR1", "Bar1Rest", "ForceBarAccess")
- **RPC**: 4 locations
- **GSP**: 25 locations
### 7. Jump Tables
- **0x059be7f4**: 12-entry table (matches 12 RPC types) - contains encoded pointers
- **0x059bfeb0**: Another 12-entry encoded table
- Pointers appear obfuscated (not direct addresses)
## Architecture Summary
### Calling Convention
```
Prologue:
addi sp, sp, -N # Allocate stack frame (N >= 32)
sd s1, offset(sp) # Save callee-saved registers s1-s11
sd s2, offset(sp)
...
addi s0, sp, N # Set frame pointer (s0 = sp + N)
mv sX, ra # Save return address to callee-saved reg (s1/s4/s10)
Epilogue:
mv ra, sX # Restore return address
ld s1, offset(sp) # Restore callee-saved registers
ld s2, offset(sp)
...
addi sp, sp, N # Deallocate stack
ret # jalr x0, 0(ra)
```
### RPC Types (from gsp_comm.h)
| Value | Name | Description |
|-------|------|-------------|
| 0x01 | ALLOC | Memory allocation |
| 0x02 | FREE | Memory free |
| 0x03 | MAP | Memory map |
| 0x04 | UNMAP | Memory unmap |
| 0x05 | PIN | Pin pages |
| 0x06 | UNPIN | Unpin pages |
| 0x07 | SCHEDULE | Schedule work |
| 0x08 | YIELD | Yield CPU |
| 0x09 | NOTIFY | Notification |
| 0x0A | BAR_TRAP | BAR register trap |
| 0x0B | MIGRATE | Migration protocol |
| 0xFF | DEBUG | Debug commands |
## Next Steps for Full Decompilation
1. **Focus Ghidra on dispatcher functions**: 0x057a1ac0, 0x04ed39dc, 0x04cc58f8, 0x05723ef4
2. **Trace RPC handler calls** from dispatcher switch cases
3. **Identify WPR management** via string references ("WPR_WRITE_COMPLETE", etc.)
4. **Map BAR emulation** via "BAR1", "ForceBarAccess" strings
5. **Find migration protocol** via RPC_MIGRATE (0x0B) handlers
6. **Analyze entry/boot sequence** from 0x04009000
## Files Generated
- `all_call_targets.txt` - 134K call targets with counts
- `analysis_results.json` - Structured analysis of top 500 functions
- `found_prologues_v2.json` - Function prologue patterns
- `analyze_firmware.py` - Python analysis tool
|
