diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md b/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md index 1ddd17e..c000d42 100644 --- a/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md +++ b/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md @@ -5,7 +5,7 @@ ## 1. Purpose and scope Open-IOV's hard problem is not writing the GSP emulation once; it is keeping -`open-iov-vfio` accurate while the firmware changes underneath it. New GSP +`vgsp` accurate while the firmware changes underneath it. New GSP images, device pairings and architectures arrive stripped, signed and hardware-coupled, and some actively resist analysis. This guide is the practical companion to `RISC-V-GSP-RM-DEBUGGER-ROADMAP.md` H4: how to move from "the new @@ -47,7 +47,7 @@ hardware coupling a simulator cannot yet exercise. question > Ghidra (static): decompile, dispatcher tables, symbols > risc-v-gsp-rm-debugger (dynamic): same stimulus, hooks, watchpoints, trace > sessions + hits TSV: risc-v-gsp-rm-debugger compare -> triage -> evidence pack - > open-iov-vfio change (with evidence) + > vgsp change (with evidence) ``` | Question | Ghidra answers | risc-v-gsp-rm-debugger answers | Shared artifact | @@ -170,7 +170,7 @@ with the capability model the emulation assumes. | write | `0x…` | w | `func+0x…` | not modelled | least-privilege candidate | | read | `0x…` | r | `func+0x…` | denied in emulation | potential fail-closed gap | - Least-privilege readings matter for `open-iov-vfio`, but a simulator + Least-privilege readings matter for `vgsp`, but a simulator observation is evidence about the firmware (docs/06 §6); confirm before it changes the product. @@ -294,7 +294,7 @@ reproduced physically; simulator-only divergence becomes a fidelity gap. The canonical accuracy loop (roadmap H4.5): (1) observe on hardware/VFIO; (2) observe in risc-v-gsp-rm-debugger (replayable session); (3) `compare` + M1–M6; -(4) implement in `open-iov-vfio` with the session directories attached as +(4) implement in `vgsp` with the session directories attached as evidence; (5) re-run the same stimulus and require the metric table to improve or stay equal. @@ -367,7 +367,7 @@ L0/L1 in simulator; L2 not claimed; L3 absent for <registers>. Physical reproduction required before product change: yes/no, why. ## Product action -open-iov-vfio change (or explicit "no change"): <link/notes> +vgsp change (or explicit "no change"): <link/notes> ``` ## 7. Boundaries, safety and ethics @@ -384,7 +384,7 @@ open-iov-vfio change (or explicit "no change"): <link/notes> * **Fuzzing is gated.** Mutation runs only against the simulator or re-hosted code, behind explicit harnesses, with session evidence (docs/12 §9, R5). Never use injection to defeat a hardware security boundary (docs/12 §1). -* **Escalate to physical.** Any conclusion that would change `open-iov-vfio` +* **Escalate to physical.** Any conclusion that would change `vgsp` must be confirmed against a physical capture (docs/06 §6, docs/07 P4.5). ## 8. Roadmap hooks |