3 files changed, 87 insertions, 0 deletions
diff --git a/debug/risc-v-gsp-rm-vm/examples/probes/demo_probes.json b/debug/risc-v-gsp-rm-vm/examples/probes/demo_probes.json
new file mode 100644
index 0000000..db623f1
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/examples/probes/demo_probes.json
@@ -0,0 +1,25 @@
+{
+  "probes": [
+    {
+      "name": "sum-nonzero",
+      "symbol": "rpc_sum",
+      "when": "a1 > 0",
+      "on_enter": {
+        "log": ["a0", "a1"],
+        "dump": [{"reg": "a0", "len": 32, "label": "sum-input"}],
+        "note": "rpc_sum with a non-zero length"
+      },
+      "on_leave": {"log": ["retval"]}
+    },
+    {
+      "name": "state-machine",
+      "symbol": "rpc_state",
+      "on_leave": {"log": ["retval"], "note": "state transition"}
+    },
+    {
+      "name": "trap",
+      "symbol": "rpc_fault",
+      "on_enter": {"note": "rpc_fault entered; the ebreak trap follows"}
+    }
+  ]
+}
diff --git a/debug/risc-v-gsp-rm-vm/examples/scripts/dump_diff.py b/debug/risc-v-gsp-rm-vm/examples/scripts/dump_diff.py
new file mode 100644
index 0000000..329ffb1
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/examples/scripts/dump_diff.py
@@ -0,0 +1,33 @@
+"""Snapshot-diff the uproc control block across a host-injected PING.
+
+Run from the tool root:
+
+    ./greeneye.sh run examples/scripts/dump_diff.py
+
+Demonstrates: symbol -> structure schema decoding, snapshot + diff, host
+stimulus via memory writes, and symbol-annotated output.
+"""
+import json
+from pathlib import Path
+
+from greeneye import Memory
+from greeneye.structs import render, schema_from_json
+
+TOOL_ROOT = Path(__file__).resolve().parents[2]
+schema = schema_from_json(json.loads((TOOL_ROOT / "firmware/uproc_demo/gsp_ctrl.schema.json").read_text()))
+ctrl = symbols.lookup("gsp_ctrl")
+
+# Let the firmware self-test settle.
+s.run(duration=0.4)
+before = s.snapshot(ctrl, schema.size, "ctrl-before-ping")
+
+# Host stimulus: PING with argument 0x1234.
+memory.write_u64(ctrl + 32, 1)   # mailbox
+memory.write_u64(ctrl + 40, 0x1234)
+s.run(duration=0.4)
+after = s.snapshot(ctrl, schema.size, "ctrl-after-ping")
+
+print("decoded control block:")
+print(render(schema, schema.decode(after, base=ctrl)))
+print("\nchanged bytes:")
+print(Memory.render_diff(Memory.diff(before, after, base=ctrl), symbols))
diff --git a/debug/risc-v-gsp-rm-vm/examples/scripts/trace_rpc.py b/debug/risc-v-gsp-rm-vm/examples/scripts/trace_rpc.py
new file mode 100644
index 0000000..12b912b
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/examples/scripts/trace_rpc.py
@@ -0,0 +1,29 @@
+"""Trace every uproc RPC handler with enter/leave hooks.
+
+Run from the tool root:
+
+    ./greeneye.sh run examples/scripts/trace_rpc.py
+
+The script namespace provides ``s``/``session``, ``memory``, ``symbols``,
+``recorder`` and ``ge`` (the greeneye package).
+"""
+NAMES = ["rpc_ping", "rpc_echo", "rpc_fill", "rpc_sum", "rpc_state", "rpc_fault"]
+events = []
+
+for name in NAMES:
+    sym = symbols.get(name)
+    if sym is None:
+        print(f"symbol {name} not found")
+        continue
+    s.hook(
+        sym.addr,
+        on_enter=lambda hit: events.append(("enter", hit.label(), hit.arg(0))),
+        on_leave=lambda hit: events.append(("leave", hit.label(), hit.retval)),
+    )
+
+s.run(duration=1.0)
+
+print(f"{len(events)} hook events:")
+for kind, label, value in events:
+    print(f"  {kind:5} {label:14} {value:#018x}")
+recorder.event("trace_complete", events=len(events))