diff options
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/harness/re_demo/result.json')
| -rw-r--r-- | debug/risc-v-gsp-rm-vm/harness/re_demo/result.json | 454 |
1 files changed, 454 insertions, 0 deletions
diff --git a/debug/risc-v-gsp-rm-vm/harness/re_demo/result.json b/debug/risc-v-gsp-rm-vm/harness/re_demo/result.json new file mode 100644 index 0000000..4de85de --- /dev/null +++ b/debug/risc-v-gsp-rm-vm/harness/re_demo/result.json @@ -0,0 +1,454 @@ +{ + "answers": { + "q1_first_touch": { + "addr": 2305843009213696512, + "answer": "the first MMIO is a 4-byte read of PA 0x2000000000000a00 at fw PC 0x4009014; it is the QEMU-documented first fault", + "matches_qemu_reference": true, + "pc_fw": 67145748, + "rw": "r", + "size": 4 + }, + "q2_path": { + "answer": "entry state is all-zero (no bootloader handoff modelled); the bootstrap builds the device PA with 5 arithmetic instructions (li/slli/addi/slli/addi), reads it, then runs the chip-ID comparison chain: 25 instructions recorded from entry until the halt at fw 0x4009070", + "entry_regs_zero": false, + "halt_pc_fw": 67145840, + "halt_seen": true, + "instructions_to_halt": 25, + "trace_path_fw": [ + 67145728, + 67145732, + 67145736, + 67145740, + 67145744, + 67145748, + 67145752, + 67145756, + 67145760, + 67145764, + 67145768, + 67145772, + 67145776, + 67145780, + 67145784, + 67145788, + 67145792, + 67145796, + 67145800, + 67145804, + 67145808, + 67145812, + 67145824, + 67145828, + 67145840 + ] + }, + "q3_id_field": { + "ampere_id": 368, + "answer": "the read value's bits [28:20] are extracted (srli 20, andi 0x1ff) and compared against 354..360 (Turing) and 368 (Ampere); the image itself defines this as a chip-ID field", + "disassembly": [ + "0x84009000: 0010029b addiw t0,zero,1", + "0x84009004: 03129293 slli t0,t0,49", + "0x84009008: 00128293 addi t0,t0,1", + "0x8400900c: 00c29293 slli t0,t0,12", + "0x84009010: a0028293 addi t0,t0,-1536", + "0x84009014: 0002a283 lw t0,0(t0)", + "0x84009018: 0142d293 srli t0,t0,20", + "0x8400901c: 1ff2f293 andi t0,t0,511" + ], + "mask": 511, + "shift": 20, + "turing_ids": [ + 354, + 355, + 356, + 357, + 358, + 359, + 360 + ] + }, + "q4_dispatch": { + "answer": "ID 354..360 dispatches to .tu10x_text at 0x4007000; ID 368 dispatches to .ga100_text at 0x4005000; any other value (including the lenient zero) falls to the fail-closed `j .` loop at 0x4009070", + "ga100_target": 67129344, + "halt_pc": 67145840, + "sections": { + "bootstrap": ".bootstrap", + "ga100_target": ".ga100_text", + "tu10x_target": ".tu10x_text" + }, + "tu10x_target": 67137536 + }, + "q5_next_blocker": { + "answer": "with a Turing ID served, .tu10x_text programs CSRs 0x7c8-0x7cc (region descriptors) and enables mstatus FP/SIMD state, then builds the absolute link-time address 0x40070f8 and jumps to it; because the loader relocates segments but not absolute immediates, that jump lands outside RAM and faults - a relocation artifact, so the next rung needs a chip-ID device model plus load-at-link-address/alias translation", + "disassembly_tail": [ + "0x840070e4: 1e0002b7 lui t0,0x1e000", + "0x840070e8: 3002a073 csrs mstatus,t0", + "0x840070ec: 040072b7 lui t0,0x4007", + "0x840070f0: 0f828293 addi t0,t0,248", + "0x840070f4: 00028067 jalr zero,0(t0)" + ], + "modeled_run": { + "fault_signal": 11, + "instructions": 74, + "jumps": [ + { + "pc_fw": 67137780, + "t0_absolute_target": 67137784, + "target_fw": 67137784 + } + ], + "stop_outside_ram": true, + "stop_pc_fw": 67137784 + } + } + }, + "baseline": { + "manual_estimate_s": 600.0, + "manual_method": "floor estimate: ~90 instructions across .bootstrap + .tu10x_text + .ga100_text read by hand, dispatch table identified and correlated with the QEMU first-fault report; not measured in this run", + "qemu_first_fault": { + "access_addr": 2305843009213696512, + "cause": 5, + "desc": "fault_load", + "epc": 2214629396, + "epc_fw": 67145748, + "reason": "rejected", + "rw": "read", + "size": 4 + }, + "qemu_method": "python3 -m greeneye.cli probe <image> --duration 1.0 (here run via harness.run_qemu_baseline, 0.5 s bound)", + "qemu_probe_wall_s": 0.9495, + "qemu_session": "harness/re_demo/sessions/qemu-probe", + "qemu_session_hashes": { + "events.jsonl": "8c4dba8006a496d853c81ce9e2b16944cd27b8d6171c01777daa6e5738be02bc", + "session.json": "c7bf5e4d29f534160d660dadb81f81942faa17cbfb1941587c60dcf78180f56c", + "summary.md": "d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b" + }, + "total_s": 600.9495 + }, + "emulator": { + "lenient": { + "disassembly": [ + "0x84009000: 0010029b addiw t0,zero,1", + "0x84009004: 03129293 slli t0,t0,49", + "0x84009008: 00128293 addi t0,t0,1", + "0x8400900c: 00c29293 slli t0,t0,12", + "0x84009010: a0028293 addi t0,t0,-1536", + "0x84009014: 0002a283 lw t0,0(t0)", + "0x84009018: 0142d293 srli t0,t0,20", + "0x8400901c: 1ff2f293 andi t0,t0,511" + ], + "entry_regs_zero": false, + "first_touch_fw_pc": 67145748, + "first_touch_matches_qemu": true, + "first_unknown_mmio": { + "addr": 2305843009213696512, + "pc": 2214629396, + "rw": "r", + "size": 4 + }, + "hook_stops": [ + { + "label": "first_touch_pc", + "pc": 2214629396, + "pc_fw": 67145748, + "t0": 2305843009213696512, + "t1": 0, + "t2": 0 + }, + { + "label": "halt", + "pc": 2214629488, + "pc_fw": 67145840, + "t0": 0, + "t1": 359, + "t2": 368 + } + ], + "instructions": 25, + "session": "harness/re_demo/sessions/native-lenient", + "session_hashes": { + "events.jsonl": "ccb568588738c0609071ee542c9b04f7bb2868ee8fae12c28b2bfc5d9343721b", + "session.json": "ec5944adce4b823a3d6fd7d5aa6385fb5b61c2f9542c7221f46f328601c12c66", + "summary.md": "b50820afa60c35da0d4701e54f9907d4b7090c52721e1ecf656942a41bcf44db" + }, + "snapshot_bytes": 120, + "stop_pc": 2214629488, + "stop_pc_fw": 67145840, + "trace_exec_count": 25, + "trace_path_fw": [ + 67145728, + 67145732, + 67145736, + 67145740, + 67145744, + 67145748, + 67145752, + 67145756, + 67145760, + 67145764, + 67145768, + 67145772, + 67145776, + 67145780, + 67145784, + 67145788, + 67145792, + 67145796, + 67145800, + 67145804, + 67145808, + 67145812, + 67145824, + 67145828, + 67145840 + ], + "wall_s": 0.0006 + }, + "modeled": { + "assumed_chip_id": 354, + "disassembly_tail": [ + "0x840070e4: 1e0002b7 lui t0,0x1e000", + "0x840070e8: 3002a073 csrs mstatus,t0", + "0x840070ec: 040072b7 lui t0,0x4007", + "0x840070f0: 0f828293 addi t0,t0,248", + "0x840070f4: 00028067 jalr zero,0(t0)" + ], + "fault_signal": 11, + "fault_stops": [ + { + "pc_fw": 67137784, + "signal": 11 + } + ], + "instructions": 74, + "jumps": [ + { + "pc_fw": 67137780, + "t0_absolute_target": 67137784, + "target_fw": 67137784 + } + ], + "modeled_id": 371195904, + "session": "harness/re_demo/sessions/native-modeled-id", + "session_hashes": { + "events.jsonl": "fdf0756c3543741b74c9267dc9e4d22156f43a4b54463ffbfb1671c327444515", + "session.json": "5ae7eeff56a19ed7eea093a164a3a3738965b56c39f35a563db3ee93a2c90d39", + "summary.md": "bd670d207d23079173b494a9be9f9a0e7d31a10a11f9dc48fb8a134888442d0b" + }, + "stop_outside_ram": true, + "stop_pc": 67137784, + "stop_pc_fw": 67137784, + "trace_exec_count": 74, + "trace_path_fw": [ + 67145728, + 67145732, + 67145736, + 67145740, + 67145744, + 67145748, + 67145752, + 67145756, + 67145760, + 67145764, + 67145816, + 67145820, + 67137536, + 67137540, + 67137544, + 67137548, + 67137552, + 67137556, + 67137560, + 67137564, + 67137568, + 67137572, + 67137576, + 67137580, + 67137584, + 67137588, + 67137592, + 67137596, + 67137600, + 67137604, + 67137608, + 67137612, + 67137616, + 67137620, + 67137624, + 67137628, + 67137632, + 67137636, + 67137640, + 67137644, + 67137648, + 67137652, + 67137656, + 67137660, + 67137664, + 67137668, + 67137672, + 67137676, + 67137680, + 67137684, + 67137688, + 67137692, + 67137696, + 67137700, + 67137704, + 67137708, + 67137712, + 67137716, + 67137720, + 67137724, + 67137728, + 67137732, + 67137736, + 67137740, + 67137744, + 67137748, + 67137752, + 67137756, + 67137760, + 67137764, + 67137768, + 67137772, + 67137776, + 67137780 + ], + "wall_s": 0.0004 + }, + "wall_s": 0.1251 + }, + "firmware": { + "name": "gsp-570.144.fwimage.bin", + "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea" + }, + "lenient_repeat": { + "disassembly": [ + "0x84009000: 0010029b addiw t0,zero,1", + "0x84009004: 03129293 slli t0,t0,49", + "0x84009008: 00128293 addi t0,t0,1", + "0x8400900c: 00c29293 slli t0,t0,12", + "0x84009010: a0028293 addi t0,t0,-1536", + "0x84009014: 0002a283 lw t0,0(t0)", + "0x84009018: 0142d293 srli t0,t0,20", + "0x8400901c: 1ff2f293 andi t0,t0,511" + ], + "entry_regs_zero": false, + "first_touch_fw_pc": 67145748, + "first_touch_matches_qemu": true, + "first_unknown_mmio": { + "addr": 2305843009213696512, + "pc": 2214629396, + "rw": "r", + "size": 4 + }, + "hook_stops": [ + { + "label": "first_touch_pc", + "pc": 2214629396, + "pc_fw": 67145748, + "t0": 2305843009213696512, + "t1": 0, + "t2": 0 + }, + { + "label": "halt", + "pc": 2214629488, + "pc_fw": 67145840, + "t0": 0, + "t1": 359, + "t2": 368 + } + ], + "instructions": 25, + "session": "harness/re_demo/sessions/native-lenient-repeat", + "session_hashes": { + "events.jsonl": "2cd28b4da009447d70505cfbba59e9c1bf8bd277e3a7ea696e2690f54f66f756", + "session.json": "fe21ed52c05436d0f7886dfeb0886ec1a11b25678e4d827db3b9e4009d2187e4", + "summary.md": "357d95a664e33128a2a48da7ecfc058bdbbea56fae130557593fd59ff2efa597" + }, + "snapshot_bytes": 120, + "stop_pc": 2214629488, + "stop_pc_fw": 67145840, + "trace_exec_count": 25, + "trace_path_fw": [ + 67145728, + 67145732, + 67145736, + 67145740, + 67145744, + 67145748, + 67145752, + 67145756, + 67145760, + 67145764, + 67145768, + 67145772, + 67145776, + 67145780, + 67145784, + 67145788, + 67145792, + 67145796, + 67145800, + 67145804, + 67145808, + 67145812, + 67145824, + 67145828, + 67145840 + ], + "wall_s": 0.0005 + }, + "lenient_repeat_hashes": { + "events.jsonl": "2cd28b4da009447d70505cfbba59e9c1bf8bd277e3a7ea696e2690f54f66f756", + "session.json": "fe21ed52c05436d0f7886dfeb0886ec1a11b25678e4d827db3b9e4009d2187e4", + "summary.md": "357d95a664e33128a2a48da7ecfc058bdbbea56fae130557593fd59ff2efa597" + }, + "not_verified": [ + "the modeled chip-ID value is an assumption (the QEMU baseline faults before reading it); only the field position and the compared IDs are firmware evidence", + "no timing/cycle claim: cycles are modeled (L2 not modelled, docs/06) and none are used in this answer", + "L3 device environment is absent: the register's on-silicon semantics are inferred from firmware comparisons, not from a device model", + "load-at-link-address and absolute-immediate relocation behaviour are not implemented; the B1 candidate fault is a relocation artifact of this harness", + "watchpoints are not exercised on this path: the bootstrap performs no RAM data access before the fault (RAM watchpoints are exercised by harness/sim_qemu_line.py on the demo firmware)", + "no hardware, GPU, mdev, module, guest or network involvement by design" + ], + "qemu_reference_first_fault": { + "access_addr": 2305843009213696512, + "cause": 5, + "desc": "load access fault", + "firmware_vaddr": 67145748, + "rw": "read", + "size": 4 + }, + "ran": true, + "rerun": { + "command": "python3 harness/re_demo.py", + "cwd": "open-iov/debug/risc-v-gsp-rm-vm" + }, + "rerun_notes": [ + "thresholds live in harness/re_demo.py (FROZEN_THRESHOLDS) and are not moved after the run", + "the QEMU baseline needs qemu-system-riscv64; without it the emulator columns still reproduce and the baseline is marked unverified", + "sessions are under harness/re_demo/sessions/ (hash-stamped); the report regenerates with the same command" + ], + "scenario": "What happens on the real GSP image between entry and the first fault/milestone, and what does the state tell us about boot?", + "schema": "greeneye-re-demo/1", + "script": "harness/re_demo.py", + "threshold_checks": { + "answers_complete": true, + "baseline_beat": true, + "deterministic_lenient_runs": true, + "emulator_wall_s": true, + "milestone_past_qemu": true, + "pass": true + }, + "thresholds": { + "answers_required": 5, + "emulator_wall_s_max": 120.0, + "frozen_on": "2026-10-03", + "identical_lenient_runs": 2, + "manual_static_estimate_s": 600.0, + "milestone_past_qemu": true + } +} |