1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
# GSP 570.144W - Complete RPC Handler Address Map
## Jump Table at 0x059bfeb0 (Decoded - Actual Handler Addresses)
| RPC Type | Name | Handler A | Handler B | Notes |
|----------|------|-----------|-----------|-------|
| 0x01 | ALLOC | - | - | Uses primary dispatcher |
| 0x02 | FREE | - | - | Uses primary dispatcher |
| 0x03 | MAP | 0x05766ab7 | 0x05778a37 | Two handlers |
| 0x04 | UNMAP | 0x057669b7 | 0x05779937 | Two handlers |
| 0x05 | PIN | 0x057664b7 | 0x0577a3b7 | Two handlers |
| 0x06 | UNPIN | 0x057682b7 | 0x05779fb7 | Two handlers |
| 0x07 | SCHEDULE | 0x05767f37 | 0x0575aeb7 | Two handlers |
| 0x08 | YIELD | 0x0575ae37 | 0x05767337 | Two handlers |
| 0x09 | NOTIFY | 0x0577c8b7 | 0x05767837 | Two handlers |
| 0x0A | BAR_TRAP | 0x057675b7 | - | Single handler |
| 0x0B | MIGRATE | - | - | Uses primary dispatcher |
| 0x0C | DEBUG | - | - | - |
## Primary Dispatcher (0x057a1ac0) Handles
- ALLOC (0x01), UNMAP (0x04), PIN (0x05), MIGRATE (0x0B), FREE (0x02), SCHEDULE (0x07)
- Jump table at 0x057a3ad8 (32 sub-command entries)
## Secondary Dispatcher (0x04ed39dc) Handles
- ALL 11 RPC types via branch-based dispatch
## Key Handler Implementations (from jump table)
### MAP Handlers (RPC 0x03)
- **0x05766ab7** - MAP handler A
- **0x05778a37** - MAP handler B
### UNMAP Handlers (RPC 0x04)
- **0x057669b7** - UNMAP handler A
- **0x05779937** - UNMAP handler B
### PIN Handlers (RPC 0x05)
- **0x057664b7** - PIN handler A
- **0x0577a3b7** - PIN handler B
### UNPIN Handlers (RPC 0x06)
- **0x057682b7** - UNPIN handler A
- **0x05779fb7** - UNPIN handler B
### SCHEDULE Handlers (RPC 0x07)
- **0x05767f37** - SCHEDULE handler A
- **0x0575aeb7** - SCHEDULE handler B (also at 0x051efbf4 - rpc_schedule_main)
### YIELD Handlers (RPC 0x08)
- **0x0575ae37** - YIELD handler A
- **0x05767337** - YIELD handler B
### NOTIFY Handlers (RPC 0x09)
- **0x0577c8b7** - NOTIFY handler A
- **0x05767837** - NOTIFY handler B
### BAR_TRAP Handler (RPC 0x0A)
- **0x057675b7** - BAR trap handler (also at 0x04cb8189 via first jump table)
## Specialized Main Handlers
- **0x057e94ec** - rpc_alloc_main (ALLOC implementation)
- **0x051efbf4** - rpc_schedule_main (SCHEDULE implementation)
- **0x04cb8189** - rpc_bar_trap_handler (BAR_TRAP implementation)
- **0x04ed34b8** - rpc_pin_handler (from secondary dispatcher)
## Calling Convention
```
RA saved to: s1 (x9), s4 (x12), or s10 (x20)
Frame pointer: s0 (x8)
Stack frame: addi sp, sp, -N (N = 96-560 bytes)
Callee-saved: s1-s11 saved to stack
```
## Integration Points for vGPU-IO
### Memory Management (ALLOC/FREE/MAP/UNMAP)
```c
// Primary entry: 0x057a1ac0 (primary dispatcher)
// Sub-commands via jump table at 0x057a3ad8
// Main implementation: 0x057e94ec (alloc_main)
```
### Page Pinning (PIN/UNPIN)
```c
// Handler A: 0x057664b7
// Handler B: 0x0577a3b7
// Secondary dispatcher entry: 0x04ed34b8
```
### Scheduling (SCHEDULE/YIELD)
```c
// SCHEDULE: 0x05767f37, 0x0575aeb7, 0x051efbf4
// YIELD: 0x0575ae37, 0x05767337
```
### BAR Emulation (BAR_TRAP)
```c
// Main handler: 0x057675b7 (from jump table)
// Also: 0x04cb8189 (from first jump table at 0x059be7f4)
// Strings: BAR1, Bar1Rest, ForceBarAccess, Bar1Mapping, Bar1Aperture, Bar1Size
```
### WPR Management
```c
// String references (60 locations):
// WPR_WRITE_COMPLETE, WPR_READ_COMPLETE
// WPR_WRITE_TIMEOUT, WPR_READ_TIMEOUT
// NV_WPR_WRITE_COMPLETE, NV_WPR_READ_COMPLETE
// NV_WPR_WRITE_TIMEOUT, NV_WPR_READ_TIMEOUT
```
### Migration (MIGRATE)
```c
// Handled by primary dispatcher (0x057a1ac0)
// RPC type 0x0B
```
## Next Steps for Implementation
1. **Decompile jump table handlers** (0x057664b7, 0x057669b7, 0x05766ab7, etc.) to pseudo-C
2. **Map primary dispatcher sub-commands** (32 entries at 0x057a3ad8)
3. **Implement kernel RPC client** calling 0x057a1ac0 with proper message format
4. **Register BAR trap handler** at 0x057675b7 / 0x04cb8189
5. **Hook WPR completion callbacks** from string reference locations
|
