diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md b/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md index 1a1ae82..47854d1 100644 --- a/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md +++ b/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md @@ -1,4 +1,4 @@ -# 06 — Accuracy: what the green-eye test bed does and does not prove +# 06 — Accuracy: what the risc-v-gsp-rm-debugger test bed does and does not prove > **# TOOL IN DEVELOPMENT - NOT READY YET!** See 00 for status. > This document is deliberately conservative. Treat every claim without a @@ -6,7 +6,7 @@ ## 1. Purpose -green-eye exists to measure how accurately Open-IOV's GSP emulation +risc-v-gsp-rm-debugger exists to measure how accurately Open-IOV's GSP emulation (`gsp-rm-vfio` and the in-kernel emulation) reproduces the behaviour of the real GSP firmware, and to make the firmware itself analysable. That makes accuracy a first-class deliverable, not an assumption. This document defines @@ -15,14 +15,14 @@ conclusions. ## 2. Fidelity levels -| Level | Property | green-eye today | +| Level | Property | risc-v-gsp-rm-debugger today | |---|---|---| | **L0 — instruction semantics** | RV64IMAC executes as on the device core | high (QEMU TCG, same ISA family) | | **L1 — memory behaviour** | reads/writes/ordering as firmware expects | high for RAM-resident code, *conditional* on mapping the same physical layout | | **L2 — time/concurrency** | cycle counts, DMA latency, interrupt timing | **not modelled** (do not claim) | | **L3 — device environment** | falcon windows, WPR2, CSB/TRANSCOM, PMU, timers, FB DMA, IRQ routing | **absent** (roadmap) | -The practical reading: green-eye is an **execution and memory** microscope, +The practical reading: risc-v-gsp-rm-debugger is an **execution and memory** microscope, not a timing or silicon model. Conclusions of the form "the firmware writes X before Y" are in scope; "the firmware takes N µs" is not. @@ -79,7 +79,7 @@ Define these metrics once and use them everywhere: | # | Metric | How it is measured | |---|---|---| -| M1 | **Inventory coverage** | set of controls/RPCs observed in a real run vs the emulation's handled set (and green-eye's observed set) | +| M1 | **Inventory coverage** | set of controls/RPCs observed in a real run vs the emulation's handled set (and risc-v-gsp-rm-debugger's observed set) | | M2 | **Reply agreement** | field-by-field diff of replies (real vs emulated); canonical-size and consumed-field checks included | | M3 | **Ordering agreement** | sequence alignment of the control/event stream (edit distance / LCS) | | M4 | **State agreement** | state-machine transitions observed in the firmware vs the emulation's internal state model | @@ -90,7 +90,7 @@ Define these metrics once and use them everywhere: Reference capture: * real hardware/backend: the project's existing RPC logs (module trace, `gsp-phys-log-dump`, status-queue drains) and the static-config oracle; -* green-eye: `events.jsonl` + snapshots, symbol-annotated. +* risc-v-gsp-rm-debugger: `events.jsonl` + snapshots, symbol-annotated. Comparison: `greeneye compare dumps/real-<run> dumps/greeneye-<run> --symbols`, then a short table of M1–M6 with counts. Never publish a single @@ -98,7 +98,7 @@ Comparison: `greeneye compare dumps/real-<run> dumps/greeneye-<run> ## 6. Adversarial interoperability use -green-eye is also a safe place to be adversarial: corrupt a reply, flip a +risc-v-gsp-rm-debugger is also a safe place to be adversarial: corrupt a reply, flip a capability bit, truncate a control payload, or inject a fault at a chosen firmware PC, then observe whether the emulation and the firmware agree on the failure path. The rules: @@ -112,7 +112,7 @@ failure path. The rules: ## 7. Validating the tool itself -Before trusting a green-eye session: +Before trusting a risc-v-gsp-rm-debugger session: * the demo firmware self-test must pass (`greeneye demo`, `make test`); * the session must contain the expected `hook`/`watch` registrations and a |