diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/harness/qemu_line')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json | 289 | ||||
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md | 102 |
2 files changed, 391 insertions, 0 deletions
diff --git a/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json new file mode 100644 index 0000000..4df3593 --- /dev/null +++ b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json @@ -0,0 +1,289 @@ +{ + "above_qemu_line": true, + "features": { + "features": { + "analyze_compare": { + "detail": { + "analyze_chars": 444, + "analyze_session": "harness/qemu_line/sessions/native-1", + "compare_chars": 526, + "compare_headers": [ + "Breakpoint profile delta (A vs B)", + "Watchpoint delta", + "Written pages delta" + ], + "compare_pair": [ + "harness/qemu_line/sessions/native-1", + "harness/qemu_line/sessions/native-2" + ] + }, + "status": "pass" + }, + "breakpoints": { + "detail": { + "attached_then_removed": true, + "kind": "sw", + "run_until_hit": 2147483912 + }, + "status": "pass" + }, + "hooks": { + "detail": { + "cmds": [ + 1, + 2 + ], + "rpc_dispatch_hits": 1 + }, + "status": "pass" + }, + "injection": { + "detail": { + "blob": "sdk/build/injected_demo.elf", + "dir": "harness/qemu_line/sessions/features-inject", + "expected": 48814, + "hashes": { + "events.jsonl": "08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95", + "session.json": "f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e", + "summary.md": "59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f" + }, + "ping_result": 48814, + "slot": 6 + }, + "status": "pass" + }, + "mcp": { + "reason": "native MCP surface is S3's deliverable (plugins/mcp_server.py); S4 must not race that work. Re-run after S3 lands (docs/37).", + "status": "not_run" + }, + "memory": { + "detail": { + "ctrl": 2147485760, + "magic": 1196642353 + }, + "status": "pass" + }, + "sessions": { + "detail": { + "dir": "harness/qemu_line/sessions/features", + "event_counts": { + "bp_hit": 2, + "hook": 1, + "image_loaded": 1, + "mem_read": 2, + "mem_write": 4, + "session_end": 1, + "session_start": 1, + "stop": 2, + "watch": 1, + "watch_hit": 1 + }, + "hashes": { + "events.jsonl": "a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e", + "session.json": "2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4", + "summary.md": "6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706" + } + }, + "status": "pass" + }, + "struct": { + "detail": { + "fields": 14, + "schema": "gsp_ctrl.schema.json" + }, + "status": "pass" + }, + "trace": { + "detail": { + "blob": "harness/qemu_line/sessions/features-trace/blobs/trace.jsonl", + "dir": "harness/qemu_line/sessions/features-trace", + "events": 4001, + "hashes": { + "events.jsonl": "36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a", + "session.json": "a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e", + "summary.md": "10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44" + }, + "max_events": 4000 + }, + "status": "pass" + }, + "watch": { + "detail": { + "pcs": [ + 2147484066 + ], + "result_field_stores": 1 + }, + "status": "pass" + } + }, + "ran": true, + "reason": "ok" + }, + "firmware": { + "name": "gsp-570.144.fwimage.bin", + "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea" + }, + "harness": "harness/sim_qemu_line.py", + "line_definition": "docs/35-GREENEYE-SIMULATOR-DESIGN.md 1.1 + 3.3", + "native": { + "backend": "native", + "compare": { + "chars": 526, + "headers": [ + "Breakpoint profile delta (A vs B)", + "Watchpoint delta", + "Written pages delta" + ], + "ran": true + }, + "device_model_used": true, + "identical": true, + "instructions_budget": 200000, + "pair_wall_s": 0.3093, + "profile": "sim/profiles/tu104-570.144.json", + "ran": true, + "reason": "ok", + "repeat": 2, + "rung": "B2", + "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)", + "runs": [ + { + "cycle_model": "rv64imac-modeled/1", + "cycles": 27294, + "device_accesses": 1, + "device_state_sha256": "3fa264b9f81081e8455a9cd26c0c2a721e3ac272e1079105a0eb191b1497f83d", + "device_unhandled": 0, + "first_unknown_mmio": null, + "instructions": 14682, + "milestones": [ + "bootargs_consumer", + "relocation_copy" + ], + "mmio_unknown": 0, + "rung": "B2", + "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)", + "session": "harness/qemu_line/sessions/native-1", + "session_hashes": { + "events.jsonl": "f1f336af84b750b0c8bf8f8e9a7a3952161eb884418f5580f08cb3e26a070713", + "session.json": "c756f8078812aa1ed03628e097ee517320d7de3664089f1133861c96130d5b5b", + "summary.md": "c0aa5d5b2cb306fda703a7144af455c36fe72b9d1e2c73ddcdab905d36cdc8a7" + }, + "stop": { + "pc": 67168780, + "pc_fw": 67168780, + "reason": "fault" + }, + "wall_s": 0.1561 + }, + { + "cycle_model": "rv64imac-modeled/1", + "cycles": 27294, + "device_accesses": 1, + "device_state_sha256": "3fa264b9f81081e8455a9cd26c0c2a721e3ac272e1079105a0eb191b1497f83d", + "device_unhandled": 0, + "first_unknown_mmio": null, + "instructions": 14682, + "milestones": [ + "bootargs_consumer", + "relocation_copy" + ], + "mmio_unknown": 0, + "rung": "B2", + "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)", + "session": "harness/qemu_line/sessions/native-2", + "session_hashes": { + "events.jsonl": "d0d15816dbde8c85c30ba2576f97c9d5e3f470e6c38d9b4762d266a612cafe12", + "session.json": "8c7f0ea958a930edb814690bc0b233be01fcab3f747332abff39989e66642c2e", + "summary.md": "d2d6154ec22f4ee0d942543a32c29699ccb8031188df955c415d836462d04fd3" + }, + "stop": { + "pc": 67168780, + "pc_fw": 67168780, + "reason": "fault" + }, + "wall_s": 0.1524 + } + ] + }, + "not_verified": [ + "lenient MMIO (B0) is observation, not device semantics", + "B3/B4 are not reached: the S1 device model stops at the B2 DMEM-runspace unknown", + "the boot shim values (bootargs/WPR meta/DMEM mirror) are declared assumptions", + "MCP on native is S3-owned and not exercised here", + "L2 timing: cycles are modeled (docs/32), never silicon claims", + "no hardware/GPU/guest/module involvement by design" + ], + "qemu": { + "backend": "qemu", + "device_map_entries": 2, + "fault_count_window": 5269, + "first_fault": { + "access_addr": 2305843009213696512, + "cause": 5, + "desc": "fault_load", + "epc": 2214629396, + "epc_fw": 67145748, + "reason": "rejected", + "rw": "read", + "size": 4 + }, + "first_touch_match": true, + "log_window_capped": true, + "ran": true, + "reason": "ok", + "rung": "pre-B0", + "session": "harness/qemu_line/sessions/qemu-probe", + "session_hashes": { + "events.jsonl": "cdba69c63e306f4c3de220b171e2ea7c1de4bd4abf18cdba1fb51bc681d5d172", + "session.json": "7e3f0f8b24c0403d114e59f68ed1b923e44abbfbf19f4865bd566a1b631c64ac", + "summary.md": "d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b" + }, + "stopped_pc": 0, + "wall_s": 0.9519 + }, + "rerun_when_s1_lands": [ + "python3 harness/sim_qemu_line.py", + "S1 landed (2026-10-03): sim/profiles/*.json is discovered and the native side runs sim.gsp_boot", + "sim/devices/*.json with greeneye-device-map/1 (or a device_map key) is still picked up as an observational map" + ], + "rung_order": [ + "pre-B0", + "B0", + "B1", + "B2", + "B3", + "B4", + "B5" + ], + "rung_progress": true, + "s1_integration": { + "declared_rung": null, + "notes": [ + "using sim/profiles/tu104-570.144.json (greeneye-sim-profile/1, firmware_sha256 matched)" + ], + "profile": "sim/profiles/tu104-570.144.json", + "source": "sim/profiles/tu104-570.144.json" + }, + "schema": "greeneye-sim-qemu-line/1", + "threshold_checks": { + "all": true, + "device_model_documented": true, + "identical_runs": true, + "native_above_qemu": true, + "native_pair_wall_s": true, + "qemu_first_fault_reproduced": true + }, + "thresholds": { + "device_model_required": true, + "frozen_on": "2026-10-03", + "identical_runs": 2, + "native_pair_wall_s": 20.0, + "native_rungs_above_qemu": 1, + "qemu_first_fault_fw": 67145748, + "qemu_first_touch": 2305843009213696512 + }, + "verdict": "above", + "verdict_explanation": "all frozen checks passed: QEMU fault reproduced, native >= QEMU + 1 rung, identical runs, wall bound, documented device model", + "x86_vms_running": 0 +} diff --git a/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md new file mode 100644 index 0000000..4e546b3 --- /dev/null +++ b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md @@ -0,0 +1,102 @@ +# Simulator vs the QEMU line - measured report + +* schema: `greeneye-sim-qemu-line/1` +* harness: `harness/sim_qemu_line.py` +* line: docs/35-GREENEYE-SIMULATOR-DESIGN.md 1.1 + 3.3 +* firmware: `gsp-570.144.fwimage.bin` sha256 `2d1bb5c60b208cfd...` +* verdict: **above** (above_qemu_line=True) +* verdict meaning: all frozen checks passed: QEMU fault reproduced, native >= QEMU + 1 rung, identical runs, wall bound, documented device model + +## Rung table + +| side | ran | rung | instructions | cycles (modeled) | stop | wall s | evidence | +|---|---|---|---:|---:|---|---:|---| +| QEMU probe | True | pre-B0 | - | - | fault | 0.9519 | `harness/qemu_line/sessions/qemu-probe` | +| native run 1 | True | B2 | 14682 | 27294 | fault@0x400ea0c | 0.1561 | `harness/qemu_line/sessions/native-1` | +| native run 2 | True | B2 | 14682 | 27294 | fault@0x400ea0c | 0.1524 | `harness/qemu_line/sessions/native-2` | + +### QEMU first fault + +* fault_load at fw vaddr `0x4009014` accessing `0x2000000000000a00` (4 bytes, read) +* first-touch matches the documented reference: True +* fault records in the capped log window: 5269 + +## Frozen thresholds + +| check | pass | +|---|---| +| qemu_first_fault_reproduced | True | +| native_above_qemu | True | +| identical_runs | True | +| native_pair_wall_s | True | +| device_model_documented | True | +| all | True | + +Thresholds (frozen 2026-10-03): native >= QEMU + 1 rung(s); 2 identical runs; pair wall <= 20.0 s. + +## Determinism + +* identical across 2 native runs: True +* session compare ran: True (['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta']) + +## Session hashes (sha256) + +| session | file | sha256 | +|---|---|---| +| qemu-probe | events.jsonl | `cdba69c63e306f4c3de220b171e2ea7c1de4bd4abf18cdba1fb51bc681d5d172` | +| qemu-probe | session.json | `7e3f0f8b24c0403d114e59f68ed1b923e44abbfbf19f4865bd566a1b631c64ac` | +| qemu-probe | summary.md | `d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b` | +| native-1 | events.jsonl | `f1f336af84b750b0c8bf8f8e9a7a3952161eb884418f5580f08cb3e26a070713` | +| native-1 | session.json | `c756f8078812aa1ed03628e097ee517320d7de3664089f1133861c96130d5b5b` | +| native-1 | summary.md | `c0aa5d5b2cb306fda703a7144af455c36fe72b9d1e2c73ddcdab905d36cdc8a7` | +| native-2 | events.jsonl | `d0d15816dbde8c85c30ba2576f97c9d5e3f470e6c38d9b4762d266a612cafe12` | +| native-2 | session.json | `8c7f0ea958a930edb814690bc0b233be01fcab3f747332abff39989e66642c2e` | +| native-2 | summary.md | `d2d6154ec22f4ee0d942543a32c29699ccb8031188df955c415d836462d04fd3` | +| sessions | events.jsonl | `a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e` | +| sessions | session.json | `2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4` | +| sessions | summary.md | `6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706` | +| trace | events.jsonl | `36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a` | +| trace | session.json | `a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e` | +| trace | summary.md | `10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44` | +| injection | events.jsonl | `08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95` | +| injection | session.json | `f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e` | +| injection | summary.md | `59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f` | + +## Native feature matrix (demo firmware) + +| feature | status | detail | +|---|---|---| +| analyze_compare | pass | {'analyze_session': 'harness/qemu_line/sessions/native-1', 'analyze_chars': 444, 'compare_pair': ['harness/qemu_line/sessions/native-1', 'harness/qemu_line/sessions/native-2'], 'compare_chars': 526, 'compare_headers': ['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta']} | +| breakpoints | pass | {'run_until_hit': 2147483912, 'attached_then_removed': True, 'kind': 'sw'} | +| hooks | pass | {'rpc_dispatch_hits': 1, 'cmds': [1, 2]} | +| injection | pass | {'dir': 'harness/qemu_line/sessions/features-inject', 'blob': 'sdk/build/injected_demo.elf', 'slot': 6, 'ping_result': 48814, 'expected': 48814, 'hashes': {'session.json': 'f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e', 'events.jsonl': '08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95', 'summary.md': '59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f'}} | +| mcp | not_run | native MCP surface is S3's deliverable (plugins/mcp_server.py); S4 must not race that work. Re-run after S3 lands (docs/37). | +| memory | pass | {'ctrl': 2147485760, 'magic': 1196642353} | +| sessions | pass | {'dir': 'harness/qemu_line/sessions/features', 'event_counts': {'bp_hit': 2, 'hook': 1, 'image_loaded': 1, 'mem_read': 2, 'mem_write': 4, 'session_end': 1, 'session_start': 1, 'stop': 2, 'watch': 1, 'watch_hit': 1}, 'hashes': {'session.json': '2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4', 'events.jsonl': 'a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e', 'summary.md': '6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706'}} | +| struct | pass | {'schema': 'gsp_ctrl.schema.json', 'fields': 14} | +| trace | pass | {'dir': 'harness/qemu_line/sessions/features-trace', 'blob': 'harness/qemu_line/sessions/features-trace/blobs/trace.jsonl', 'events': 4001, 'max_events': 4000, 'hashes': {'session.json': 'a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e', 'events.jsonl': '36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a', 'summary.md': '10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44'}} | +| watch | pass | {'result_field_stores': 1, 'pcs': [2147484066]} | + +## S1 integration + +* device source: sim/profiles/tu104-570.144.json +* profile: sim/profiles/tu104-570.144.json +* declared rung: None +* note: using sim/profiles/tu104-570.144.json (greeneye-sim-profile/1, firmware_sha256 matched) + +## Not verified + +* lenient MMIO (B0) is observation, not device semantics +* B3/B4 are not reached: the S1 device model stops at the B2 DMEM-runspace unknown +* the boot shim values (bootargs/WPR meta/DMEM mirror) are declared assumptions +* MCP on native is S3-owned and not exercised here +* L2 timing: cycles are modeled (docs/32), never silicon claims +* no hardware/GPU/guest/module involvement by design + +## S1 integration notes + +* `python3 harness/sim_qemu_line.py` +* S1 landed (2026-10-03): sim/profiles/*.json is discovered and the native side runs sim.gsp_boot +* sim/devices/*.json with greeneye-device-map/1 (or a device_map key) is still picked up as an observational map + +* other agents' x86 QEMU VMs observed (never touched): 0 |