diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md | 45 |
1 files changed, 26 insertions, 19 deletions
diff --git a/debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md b/debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md index 77e1298..57ee33b 100644 --- a/debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md +++ b/debug/risc-v-gsp-rm-vm/docs/41-STABILITY-AND-TIME-TO-VALUE.md @@ -3,15 +3,16 @@ > **Date:** 2026-10-03. **Scope:** the simulator/debugger workstream inside > `debug/risc-v-gsp-rm-vm/` only. **Verdict:** the minimum bar for marking the > *tool and standalone GSP simulator* as **stable (conditional)** is passed: -> 298 tests green twice, deterministic real-firmware runs, an independently +> 417 tests green (298 at the first review; the XMPU/libos wave added the +> rest), deterministic real-firmware runs, an independently > reproduced A/B verdict "above the QEMU line", and reproducible value > measurements. Conditions are listed in §7 — chiefly that the device model -> currently reaches boot rung B2 (not the message loop) and cycle numbers are +> currently reaches boot rung B3 (message-loop port wait; the CSB poll awaits +> host traffic) and cycle numbers are > modelled, not silicon-calibrated. > -> Local notes: `../../../../handoff-simulator.md` (directive ledger, top work), -> `../LOCAL-REVIEW-NOTES.md` (local provenance). Public text describes -> components and behaviour only. +> Companion: `../../../../handoff-simulator.md` (directive ledger, top work). +> Public text describes components and behaviour only. ## 1. What we were doing before (the QEMU baseline) @@ -29,8 +30,8 @@ | Phase | Improvement | Status | |---|---|---| -| P1 | **GSP device model** (`sim/devices/`, `sim/profiles/`) with PMC/FALCON/PRISCV/timer/CSB/FWSEC/PMU/DMA/IRQ windows, versioned profile, boot shims | B2: 14,682 instr, fault `0x400EA0C`, 0 unknown MMIO, two-run identical | -| P2 | **`sim.gsp_boot` boot-ladder runner** with rung classification and serialisable device state | B0–B2 (B3/B4 targets) | +| P1 | **GSP device model** (`sim/devices/`, `sim/profiles/`) with PMC/FALCON/PRISCV/timer/CSB/FWSEC/PMU/DMA/IRQ windows, versioned profile, boot shims, **XMPU model** (`sim/mpu.py`) and **libos service model** (`sim/libos.py`) | B3: 474,043 instr, `ecall` port wait, 0 unknown MMIO, two-run identical | +| P2 | **`sim.gsp_boot` boot-ladder runner** with rung classification and serialisable device state | B0–B3 (B4/B5 targets) | | P3 | **One-command release triage** (`./risc-v-gsp-rm-debugger.sh triage`) orchestrating identity/QEMU probe/native boot/A-B eval/version diff/readiness | 570.144 in ~2.7 s; baseline pair ~11.4 s | | P4 | **QEMU-line A/B evaluation harness** (`harness/sim_qemu_line.py`, frozen checks) | verdict `above`, all threshold checks computed from live runs | | P5 | **Real RE demonstration** (`harness/re_demo.py`) answering a concrete bootstrap question with simulator tools | PASS 5/5, 0.13 s vs 601 s baseline floor | @@ -41,7 +42,7 @@ | Scenario | Before | Now | Evidence | |---|---|---|---| -| What happens in GSP boot before the first wall? | QEMU: fault at `0x4009014`, stop | Device model serves the path; deterministic B2 fault `0x400EA0C`; unknown accesses 0 | `python3 -m sim.gsp_boot`; sessions `dumps/gsp-boot-b2-run1/2` | +| What happens in GSP boot before the first wall? | QEMU: fault at `0x4009014`, stop | Device model serves the path; deterministic B3 port wait (`ecall @ 0x4018038`); unknown accesses 0 | `python3 -m sim.gsp_boot`; sessions `dumps/gsp-boot-b3-run1/2` | | Triage a new firmware image | manual probe + reading, ~1800 s estimated | one command, **2.68 s**, JSON+MD report with hashes | `./risc-v-gsp-rm-debugger.sh triage --firmware … --version 570.144` | | Is the emulator better than QEMU? | no mechanism | validators run both, compute rung/feature deltas; verdict `above` | `python3 harness/sim_qemu_line.py` | | Answer a bootstrap RE question | static reading only | 5/5 recorded answers in 0.13 s | `python3 harness/re_demo.py` | @@ -54,10 +55,10 @@ one-line command in the report/doc that produced it. ## 4. Stability evidence -* `python3 -m unittest discover -s tests -t .` → **298 tests, OK**, twice - (rounded identity across runs); MCP 55, triage 14, device model 34 new - checks included. -* Determinism: B1/B2 device-state SHA identical across runs; triage sessions +* `python3 -m unittest discover -s tests -t .` → **417 tests, OK** (298 at + the first review; the XMPU/libos wave added 13 boot/MPU checks plus WPR2 + and trace-number updates); MCP 55, triage 14, device model 35 included. +* Determinism: B1/B3 device-state SHA identical across runs; triage sessions hashed; A/B harness repeats native runs and compares. * Back-compat: `Session`, `RspClient`, `SimClient` and CLI keep prior behaviour; additions are keyword/default forms; QEMU path untouched @@ -79,15 +80,20 @@ one-line command in the report/doc that produced it. derivation, DMA refusal counting, PMC chip-ID duplication, overlapping window fallback, stale doc counts, `session_launch` documentation, docs/40 measurement labels). One latent item recorded: WPR2 window offsets versus - profile base (firmware never touches it in B0–B2). + profile base — left unserved because the old B2 run never reached the read; + the XMPU/libos wave reached it and the offset defect was fixed (relative and + absolute forms both accepted, docs/36 §3). * Verdict after fixes: conditional stability as stated in §7; no unverified "beats silicon" or "boots RM" statement anywhere. ## 6. Top work for the next session (time-to-value first) -1. **Push the device model to B3/B4** (CSB/TRANSCOM mailbox semantics, - DMEM runspace source, PMU/FWSEC stubs) — this is the gate to serving a - real RM message and the largest remaining time-to-value lever. +1. **Push the device model to B4/B5** (host-traffic-triggered CSB/TRANSCOM + poll semantics, one scripted message served end-to-end) — this is the gate + to serving a real RM message and the largest remaining time-to-value + lever. *Update 2026-10-03, session 4c: the XMPU model, bootstrap-args shim + and libos service model landed; the ladder is now B3 (was B2), with the + former DMEM-runspace unknown resolved.* 2. **Surgical rehost of the live GR engine-context promote/commit wall** (docs/39 top-3): convert the manual, multi-cycle physical campaign into device-free hook/watch/compare sessions. @@ -99,7 +105,8 @@ one-line command in the report/doc that produced it. ## 7. Conditions on the stability claim -1. Device model ceiling is B2; B3/B4 pending profile semantics. +1. Device model ceiling is B3 (libos init complete; message-loop port wait); + B4/B5 (host-traffic-triggered CSB poll, scripted message) pending. 2. Cycle counts are modelled defaults, not calibrated bands. 3. Manual-baseline speedups use labelled estimates, not timed human studies. 4. Cross-version triage was exercised as a self-diff rehearsal (no second @@ -111,8 +118,8 @@ one-line command in the report/doc that produced it. ```bash cd open-iov/debug/risc-v-gsp-rm-vm -python3 -m unittest discover -s tests -t . # 298 tests -python3 -m sim.gsp_boot # B2 +python3 -m unittest discover -s tests -t . # 417 tests +python3 -m sim.gsp_boot # B3 (port wait) python3 -m sim.gsp_boot --no-shim # B1 budget stop python3 harness/sim_qemu_line.py # verdict "above" python3 harness/re_demo.py # PASS 5/5 |