diff options
Diffstat (limited to 'docs/05-operations/03-risc-v-gsp-rm-vm.md')
| -rw-r--r-- | docs/05-operations/03-risc-v-gsp-rm-vm.md | 34 |
1 files changed, 32 insertions, 2 deletions
diff --git a/docs/05-operations/03-risc-v-gsp-rm-vm.md b/docs/05-operations/03-risc-v-gsp-rm-vm.md index a55e3ac..b6e52db 100644 --- a/docs/05-operations/03-risc-v-gsp-rm-vm.md +++ b/docs/05-operations/03-risc-v-gsp-rm-vm.md @@ -67,6 +67,14 @@ run the same stimulus in risc-v-gsp-rm-debugger, and compare the recorded sessio `docs/06-ACCURACY.md`. Portability runs (new GSP, new device, GB10-class architecture) are described in `docs/07-PORTABILITY-PLAYBOOKS.md`. +When the question is an accept/refuse predicate on a control or entry (e.g. a +promote/shape the firmware keeps refusing), run the firmware's own validation +branch offline first with `harness/valprobe.py` (crafted state, labelled +outcome addresses, deterministic; `docs/47-VALIDATION-PREDICATE-PROBE.md`) — +it answers in seconds what would otherwise cost a static guess or a supervised +cycle. Use `harness/rehost.py` (`docs/46-SURGICAL-REHOST.md`) for a whole +handler/function whose first missing state is itself the finding. + ## 4. Quick start From the repository root: @@ -93,8 +101,30 @@ hooks/breakpoints/watchpoints, memory tools, structure decoding, session recording and analysis, declarative probes, plugins, remote calls and run-to-cursor, the injection SDK with direct and firmware-dispatched service invocation, the Ghidra symbol/hit bridge and Ghidra control bridge, the -real-firmware first-fault probe, and the TCG full-memory trace plugin. Not -implemented: device model (R1), custom simulator (R2), MCP plugin (R3) — all +real-firmware first-fault probe, and the TCG full-memory trace plugin. + +Standalone simulator increments (2026-10-06): the native RV64 machine with a +GSP device model and a deterministic real-firmware boot ladder to **B3** +(570.144 image, ~474k instructions, two-run identical), one-command release +triage, GMMU/FBIF observe-only windows and the PTE/PDE decoder, the RM RPC +capture decode/compare/stimulus tooling (`harness/rm_capture.py`, docs/45), +surgical rehost (`harness/rehost.py`, docs/46) and the validation-predicate +probe (`harness/valprobe.py`, docs/47). The predicate probe executes the +shipped firmware's own accept/refuse branch offline with crafted state and +labelled outcomes (seconds, deterministic) — the intended first stop for +control/entry-shape questions before any supervised cycle. The functional +GMMU page-table walker and launch memory-contract auditor +(`sim/gmmu_walk.py`, `harness/launch_audit.py`, docs/48) resolve every +engine-visible address of a submission (ring, inline-QMD destination, +parameter/program pages, release slot) against captured page tables and +classify mismatches, so "where would the engine read/write this VA?" is an +offline question. The suite is at 489 tests. + +Limits: fidelity is instruction/memory semantics (L0/L1) — no timing (L2) and +no device environment (L3); host message traffic (B4/B5) is not yet served, +so sessions stay boot-state/predicate level; the GR engine and other GPU +execution units are **not** modelled, so engine/silicon behaviour remains a +hardware question. Not implemented: custom simulator (R2), MCP plugin (R3) — roadmap. The long-term program (adversarial navigation, adjacent microcontrollers, custom simulator, Verilog soft-core, agentic platform) is documented in `debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md`. |