blob: 54a3482074f9d7e35ab7a77bcfaa4ff0eeec033c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
# Glossary
> **Historical document — superseded.** The authoritative glossary is
> [`../docs/09-reference/glossary-and-faq.md`](../docs/09-reference/glossary-and-faq.md).
## Terms & Abbreviations
### General
| Term | Definition |
|------|------------|
| **GSP** | GPU System Processor - NVIDIA's on-GPU RISC-V microcontroller |
| **vGPU** | Virtual GPU - Partitioned GPU for multi-tenant workloads |
| **VF** | Virtual Function - Single vGPU instance with dedicated resources |
| **PF** | Physical Function - Host GPU managing VFs (SR-IOV) |
| **IOV** | I/O Virtualization - SR-IOV implementation |
| **RPC** | Remote Procedure Call - GSP-host communication protocol |
| **BAR** | Base Address Register - PCIe memory-mapped I/O window |
| **WPR** | Write-Protected Region - VRAM area reserved for firmware |
| **SR-IOV** | Single Root I/O Virtualization - PCIe virtualization standard |
### Firmware Architecture
| Term | Definition |
|------|------------|
| **RV64IMAC** | RISC-V 64-bit ISA with Integer, Multiply, Atomic, Compressed extensions |
| **Dispatcher** | Central RPC routing function (primary/secondary) |
| **Jump Table** | Array of function pointers for sub-command dispatch |
| **Sub-Command** | Specific operation within an RPC type |
| **Descriptor** | Return structure with ID and echoed parameters |
| **Entry Point** | Firmware boot address (0x04009000) |
| **Frame Guard** | Stack canary at 0x041DC350 |
### Memory Management
| Term | Definition |
|------|------------|
| **VRAM** | Video RAM - GPU local memory |
| **Sysmem** | System Memory - Host DRAM |
| **Page Table** | GPU virtual-to-physical mapping tables |
| **Pinning** | Locking pages for DMA access |
| **Bounce Buffer** | Intermediate buffer for data transfer |
| **Aperture** | Mappable BAR window size |
| **Backing Store** | Memory backing emulated BAR regions |
### RPC Types
| RPC | Name | Purpose |
|-----|------|---------|
| 0x01 | **ALLOC** | Allocate GPU memory |
| 0x02 | **FREE** | Free GPU memory |
| 0x03 | **MAP** | Map memory to VF address space |
| 0x04 | **UNMAP** | Unmap memory from VF |
| 0x05 | **PIN** | Pin pages for DMA |
| 0x06 | **UNPIN** | Unpin pages |
| 0x07 | **SCHEDULE** | VF scheduling control |
| 0x08 | **YIELD** | Voluntary yield |
| 0x09 | **NOTIFY** | Event notification |
| 0x0A | **BAR_TRAP** | BAR access emulation |
| 0x0B | **MIGRATE** | Live VF migration |
| 0xFF | **DEBUG** | Debug interface |
### Migration
| Term | Definition |
|------|------------|
| **Pre-copy** | Iterative page transfer while VF runs |
| **Post-copy** | Start VF on destination, fetch pages on demand |
| **Quiesce** | Pause VF for consistent state snapshot |
| **Dirty Page** | Page modified since last transfer |
| **Cutover** | Switch execution from source to destination |
| **Token** | Opaque migration context handle |
### BAR Emulation
| Term | Definition |
|------|------------|
| **BAR1** | 256 MB VRAM aperture (the register interface is BAR0, 16 MB; BAR3 is the instance/PRAMIN window) |
| **Bar1Rest** | BAR1 state restoration |
| **ForceBarAccess** | Hypervisor bypass of VF permissions |
| **Aperture** | Configurable BAR window size/offset |
### WPR (Write-Protected Region)
| Term | Definition |
|------|------------|
| **Write Protect** | Trap on write access to region |
| **Read Protect** | Trap on read access to region |
| **NV_WPR** | NVIDIA-specific WPR extensions |
| **Completion** | Successful trap handling |
| **Timeout** | Trap handling exceeded time limit |
### Hardware Registers
| Register | Purpose |
|----------|---------|
| **Doorbell** | Host→GSP notification (PCIe BAR0 + 0x1000) |
| **Message Ring** | Shared memory for RPC messages |
| **Cache Manager** | 0x429B428 - Flush/invalidate |
| **Allocator Arena** | 0x429B450 - Memory allocation |
| **Global Error Flag** | 0x04296048 - Global error state |
| **Stack Canary** | 0x041DC350 - Frame integrity |
### Tools & Scripts
| Tool | Purpose |
|------|---------|
| **analyzeHeadless** | Ghidra headless analyzer |
| **DecompileFunctions.java** | Ghidra script for batch decompilation |
| **trace_all_subsystems.py** | Binary analysis script |
| **RPC_HANDLER_MAP.md** | Complete RPC address map |
| **FINAL_REPORT.md** | Full analysis report |
### Debugging
| Term | Definition |
|------|------------|
| **ebreak** | RISC-V breakpoint instruction (fatal in FW) |
| **String Ref** | Cross-reference to string literal |
| **XRef** | Cross-reference (code/data) |
| **Pcode** | Ghidra's intermediate representation |
| **VBIOS** | Video BIOS - firmware for GPU initialization |
### Calling Convention (RISC-V)
| Register | ABI Name | Purpose |
|----------|----------|---------|
| x0 | zero | Hardwired zero |
| x1 | ra | Return address |
| x2 | sp | Stack pointer |
| x3 | gp | Global pointer |
| x4 | tp | Thread pointer |
| x5-7 | t0-t2 | Temporaries |
| x8 | s0/fp | Frame pointer |
| x9 | s1 | Callee-saved (RA save) |
| x10-11 | a0-a1 | Arguments/returns |
| x12 | s4 | Callee-saved (RA save) |
| x13-17 | a2-a6 | Arguments |
| x18-27 | s2-s11 | Callee-saved |
| x28-31 | t3-t6 | Temporaries |
### Firmware Sections (ELF)
| Section | Purpose |
|---------|---------|
| `.text` | Executable code |
| `.rodata` | Read-only data |
| `.data` | Initialized data |
| `.bss` | Zero-initialized data |
| `.section_task_rm_*` | Task-specific sections |
### Migration Phases
| Phase | Description |
|-------|-------------|
| **QUERY** | Check migratability |
| **PREPARE** | Quiesce, snapshot |
| **TRANSFER** | Iterative page copy |
| **COMMIT** | Final sync, cutover |
| **CLEANUP** | Release resources |
## File Naming Conventions
### Decompiled Output
```
FUN_ram_<ADDRESS>_ram_<ADDRESS>.c
```
- `FUN_ram_057A1AC0_ram_057A1AC0.c` = Function at 0x057A1AC0
### Ghidra Projects
```
gsp-<purpose>/
```
- `gsp-subcmds`, `gsp-rpc-handlers`, `gsp-bar-fns`, etc.
## References
- RISC-V ISA: https://riscv.org/technical/specifications/
- SR-IOV Spec: https://pcisig.com/specifications/iov/
- Ghidra: https://ghidra-sre.org/
|
