diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md | 46 |
1 files changed, 23 insertions, 23 deletions
diff --git a/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md b/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md index 79d17b8..1a4c62f 100644 --- a/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md +++ b/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md @@ -1,10 +1,10 @@ -# 15 — green-eye as an agentic integrated development, analysis and debugging environment for the GPU System Processor +# 15 — risc-v-gsp-rm-debugger as an agentic integrated development, analysis and debugging environment for the GPU System Processor > **# TOOL IN DEVELOPMENT - NOT READY YET!** See 00 for status. ## 1. Vision and what "agentic" means here -green-eye already has the two properties that make an agent loop possible: +risc-v-gsp-rm-debugger already has the two properties that make an agent loop possible: a **deterministic, scriptable harness** (`ge.launch`/`ge.attach`, `Session`, `record`, `compare`) and a **durable evidence format** (the session directory). "Agentic" here means: @@ -27,7 +27,7 @@ hooks that would make a full agent platform real. ``` +-------------------- agents (triage / hypothesis / RE / portability) ----+ | | - | CLI: ./greeneye.sh info|demo|run|attach|launch|probe|record|analyze| | + | CLI: ./risc-v-gsp-rm-debugger.sh info|demo|run|attach|launch|probe|record|analyze| | | compare|symbols|plugins|inject|ghidra | | Python: ge.launch/attach, Session.*, memory.*, symbols.*, structs, | | probes, plugins, ghidra.export_hits, inject.* | @@ -55,11 +55,11 @@ primitive: it turns two sessions into hit/watch/write deltas. Format ### 2.2 Surfaces an agent may use -* `./greeneye.sh …` — the stable CLI (all real subcommands listed above). -* `./greeneye.sh run script.py` — the preloaded Python namespace (`ge`, +* `./risc-v-gsp-rm-debugger.sh …` — the stable CLI (all real subcommands listed above). +* `./risc-v-gsp-rm-debugger.sh run script.py` — the preloaded Python namespace (`ge`, `session`/`s`, `memory`, `symbols`, `recorder`) makes a harness file the unit of automation. -* `./greeneye.sh ghidra` + `GreenEyeControl.java` — JSON-lines bridge for the +* `./risc-v-gsp-rm-debugger.sh ghidra` + `GreenEyeControl.java` — JSON-lines bridge for the decompiler loop (`run_until`, `bp_set`, `read_mem`, `call`, `hits`, `export_hits`; protocol in docs/13 §3). * Plugins — the extension point (docs/04). A plugin's `register(ge)` can add @@ -103,17 +103,17 @@ Question template: "For control `<X>`, does the firmware set field `<Y>` of the reply/object, and in what order relative to `<Z>`?" 1. Frame it as A/B: the emulation's reply (reference capture, docs/07 P4) and - the firmware's reply in green-eye. One session alone cannot answer it. + the firmware's reply in risc-v-gsp-rm-debugger. One session alone cannot answer it. 2. Resolve the handler and object from the symbol DB; never hardcode: ```bash - ./greeneye.sh symbols resolve --db symbols-<ver>.json <handler-or-addr> + ./risc-v-gsp-rm-debugger.sh symbols resolve --db symbols-<ver>.json <handler-or-addr> ``` 3. Capture the firmware side with a hook + before/after snapshots: ```python - # reply_q.py -- ./greeneye.sh run reply_q.py --kernel <rehosted.elf> + # reply_q.py -- ./risc-v-gsp-rm-debugger.sh run reply_q.py --kernel <rehosted.elf> import greeneye as ge from greeneye import Memory @@ -144,7 +144,7 @@ the reply/object, and in what order relative to `<Z>`?" ``` 5. Compare against the reference capture with - `greeneye.analyze.compare_sessions(...)` / `./greeneye.sh compare …` for + `greeneye.analyze.compare_sessions(...)` / `./risc-v-gsp-rm-debugger.sh compare …` for ordering (M3) and state the field diff in words (M2). If the reply is in a different object, repeat step 3 on that object's address. 6. Report: question, session pair, `compare` output, M2/M3 rows, fidelity @@ -158,14 +158,14 @@ the reply/object, and in what order relative to `<Z>`?" $GHIDRA/support/analyzeHeadless <proj> <name> -process <program> -noanalysis \ -scriptPath debug/risc-v-gsp-rm-vm/ghidra \ -postScript ExportForGreenEye.java /tmp/symbols-<ver>.tsv - ./greeneye.sh symbols export --index /tmp/symbols-<ver>.tsv --bias 0 -o symbols-<ver>.json + ./risc-v-gsp-rm-debugger.sh symbols export --index /tmp/symbols-<ver>.tsv --bias 0 -o symbols-<ver>.json diff <(cut -f2 /tmp/symbols-old.tsv | sort) <(cut -f2 /tmp/symbols-new.tsv | sort) ``` 2. Probe the new image for early structure changes: ```bash - ./greeneye.sh probe <new.fwimage> --symbols symbols-<ver>.json --record + ./risc-v-gsp-rm-debugger.sh probe <new.fwimage> --symbols symbols-<ver>.json --record ``` 3. Record the same stimulus against each version. Hook the old handler name; @@ -175,8 +175,8 @@ the reply/object, and in what order relative to `<Z>`?" 4. Compare the sessions: ```bash - ./greeneye.sh compare dumps/<old-run> dumps/<new-run> --symbols - ./greeneye.sh analyze dumps/<new-run> --symbols symbols-<ver>.json --out new.md + ./risc-v-gsp-rm-debugger.sh compare dumps/<old-run> dumps/<new-run> --symbols + ./risc-v-gsp-rm-debugger.sh analyze dumps/<new-run> --symbols symbols-<ver>.json --out new.md ``` 5. Classify the disappearance with the table below, then confirm in Ghidra: @@ -188,7 +188,7 @@ the reply/object, and in what order relative to `<Z>`?" | old function exists, zero hits under the standard stimulus | coverage gap or decoy | widen stimulus, check xrefs from the dispatch table | | dispatch table entry changed but code identical | behaviour moved (state/input) | inspect the table with bridge `read_mem`/snapshot | -6. With the bridge running (`./greeneye.sh ghidra --kernel <elf>`), execute +6. With the bridge running (`./risc-v-gsp-rm-debugger.sh ghidra --kernel <elf>`), execute until the dispatch site from the decompiler and set breakpoints: ```bash @@ -200,7 +200,7 @@ the reply/object, and in what order relative to `<Z>`?" 7. Export hits and annotate the old function's fate: ```bash - ./greeneye.sh analyze dumps/<new-run> --symbols symbols-<ver>.json --out new.md + ./risc-v-gsp-rm-debugger.sh analyze dumps/<new-run> --symbols symbols-<ver>.json --out new.md python3 - <<'PY' from greeneye.ghidra import export_hits from greeneye.symbols import SymbolDB @@ -225,7 +225,7 @@ the reply/object, and in what order relative to `<Z>`?" mailbox dispatch): ```bash - ./greeneye.sh inject --service sdk/build/injected_demo.elf \ + ./risc-v-gsp-rm-debugger.sh inject --service sdk/build/injected_demo.elf \ --cmd 1 --arg0 0x41 --arg1 0x42 ``` @@ -244,7 +244,7 @@ the reply/object, and in what order relative to `<Z>`?" 5. Compare two versions of the service to see the behavioural delta: ```bash - ./greeneye.sh compare dumps/<svc-v1> dumps/<svc-v2> --symbols + ./risc-v-gsp-rm-debugger.sh compare dumps/<svc-v1> dumps/<svc-v2> --symbols ``` 6. Stop condition: direct and firmware-dispatched results agree, the session @@ -257,13 +257,13 @@ the reply/object, and in what order relative to `<Z>`?" 1. Follow the P1 loop in docs/07-PORTABILITY-PLAYBOOKS.md with real commands: ```bash - ./greeneye.sh probe <old.fwimage> --symbols symbols-old.json --record - ./greeneye.sh probe <new.fwimage> --symbols symbols-new.json --record - ./greeneye.sh record --kernel <rehosted-old.elf> --duration 2.0 \ + ./risc-v-gsp-rm-debugger.sh probe <old.fwimage> --symbols symbols-old.json --record + ./risc-v-gsp-rm-debugger.sh probe <new.fwimage> --symbols symbols-new.json --record + ./risc-v-gsp-rm-debugger.sh record --kernel <rehosted-old.elf> --duration 2.0 \ --watch gsp_ctrl+0x10:8 --snapshot gsp_ctrl:392 - ./greeneye.sh record --kernel <rehosted-new.elf> --duration 2.0 \ + ./risc-v-gsp-rm-debugger.sh record --kernel <rehosted-new.elf> --duration 2.0 \ --watch gsp_ctrl+0x10:8 --snapshot gsp_ctrl:392 - ./greeneye.sh compare dumps/<old-run> dumps/<new-run> --symbols + ./risc-v-gsp-rm-debugger.sh compare dumps/<old-run> dumps/<new-run> --symbols ``` 2. Keep the stimulus identical across versions: use one script/probe spec and |