From ba58dcdc5ad6ca021c723d279f33e3f14e1184df Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 2 Oct 2026 08:36:35 -0400 Subject: debug: add green-eye GSP/uproc RISC-V VM runtime analysis tooling Adds open-iov/debug/risc-v-gsp-rm-vm: a GDB-free instrumentation stack that boots uproc/GSP firmware in qemu-system-riscv64 and provides Frida-like hooks, breakpoints, watchpoints, memory dumps, structure decoding, snapshot diffs, recorded sessions, declarative probes, a plugin API and a Ghidra symbol/hit bridge. Verified: 25 tests green (including a live QEMU smoke test); the demo uproc boots with correct hook/leave/watch/schema/snapshot/fault evidence; the optional TCG trace plugin builds and recorded 15M trace lines in 3 s; the TU104 570.144 fwimage probe reports its first exception (load access fault at firmware vaddr 0x4009014 reading 0x2000000000000A00). Documentation: lean tool docs under debug/risc-v-gsp-rm-vm/docs/00-10, a new docs/05-operations/03-risc-v-gsp-rm-vm.md debugging document, and '# TOOL IN DEVELOPMENT - NOT READY YET!' markers in docs/README.md, the onboarding tooling table and the debugging workflows doc. Vendors qemu-plugin.h from QEMU v8.2.2 (GPL-2.0-or-later), with its license header intact, so the optional TCG plugin builds without a QEMU source tree. --- debug/risc-v-gsp-rm-vm/qemu/README.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 debug/risc-v-gsp-rm-vm/qemu/README.md (limited to 'debug/risc-v-gsp-rm-vm/qemu/README.md') diff --git a/debug/risc-v-gsp-rm-vm/qemu/README.md b/debug/risc-v-gsp-rm-vm/qemu/README.md new file mode 100644 index 0000000..a6be332 --- /dev/null +++ b/debug/risc-v-gsp-rm-vm/qemu/README.md @@ -0,0 +1,28 @@ +# green-eye QEMU helpers + +`greeneye_trace.c` is an optional QEMU TCG plugin that records **every** +instruction (opt-in) and every memory access as JSONL: + +```bash +make -C qemu # builds qemu/greeneye-trace.so +qemu-system-riscv64 -machine virt -m 256M -display none -serial file:/tmp/uart.log \ + -bios none -kernel -S -gdb tcp:127.0.0.1:4444 \ + -plugin qemu/greeneye-trace.so,path=/tmp/ge-trace.jsonl,start=0x80000000,end=0x80010000,exec=off +``` + +This observes more than green-eye's gdbstub layer can: memory accesses +between stops, instruction coverage, exact access sizes. Use it when you need +a *complete* memory-activity map; use green-eye hooks/watchpoints when you +need semantics (arguments, returns, structure decoding). + +The plugin header `qemu-plugin.h` is vendored from QEMU v8.2.2 +(`include/qemu/qemu-plugin.h`, GPL-2.0-or-later) so the plugin builds on +systems where the QEMU source tree is not installed. If you prefer your +distro's header, point `CFLAGS` at it instead. + +`launch.sh` starts a target through the package and keeps it alive for +`greeneye attach`: + +```bash +qemu/launch.sh --kernel firmware/uproc_demo/build/uproc_demo.elf +``` -- cgit v1.2.3