From 3fe5360d0efc439d59f2b7a9bf2f713aa9cdb918 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 2 Oct 2026 09:13:00 -0400 Subject: debug: green-eye wave 2 - injection SDK, Frida-like calls, Ghidra control bridge, long-term docs Adds to debug/risc-v-gsp-rm-vm/: - Session.call / run_until: Frida-like remote function calls and run-to-cursor, with register restoration; verified live (rpc_ping -> 0xaffe). - symbol+offset target resolution (gsp_ctrl+0x10) across all APIs and the REPL. - Injection SDK (sdk/) and 'greeneye inject': position-independent RV64 service blobs (verified zero relocations), loaded into RAM, registered in the demo handler table, and invoked either directly or through the firmware mailbox dispatcher. Demo ABI extended: mailbox 16..23 selects slots, arg0 carries the service command, arg2 added (struct now 0x190; schema updated). - Ghidra control bridge (greeneye ghidra + GreenEyeControl.java): run-until-here, breakpoints, memory/register access, remote calls, hit export; verified end-to-end with Ghidra headless (run_until reached rpc_sum from a GhidraScript). - MarkGreenEyeHits.java fixed for the Ghidra 12 createBookmark API; verified headless together with ExportForGreenEye.java. - Analyzer renders a QEMU first-fault table for probe sessions (fault count, epc with firmware vaddr translation, access address/size, reason). - Tests now 35 green, including injection, Ghidra bridge, remote call, run-until and REPL command smoke tests. - Documentation: docs/11-16 (GSP RM service developer guide, injection SDK specification, Ghidra control, adversarial interoperability guide, agentic GSP IDE, custom simulator design) and GREEN-EYE-ROADMAP.md (long-term H1-H7 program); doc maps and the project RISC-V VM doc updated. --- debug/risc-v-gsp-rm-vm/tests/test_injection.py | 121 +++++++++++++++++++++++++ 1 file changed, 121 insertions(+) create mode 100644 debug/risc-v-gsp-rm-vm/tests/test_injection.py (limited to 'debug/risc-v-gsp-rm-vm/tests/test_injection.py') diff --git a/debug/risc-v-gsp-rm-vm/tests/test_injection.py b/debug/risc-v-gsp-rm-vm/tests/test_injection.py new file mode 100644 index 0000000..5dca9cb --- /dev/null +++ b/debug/risc-v-gsp-rm-vm/tests/test_injection.py @@ -0,0 +1,121 @@ +"""Integration tests for Frida-like remote calls, run-until and service injection. + +Skipped cleanly when QEMU, the demo firmware, clang/lld or the SDK are absent. +""" +from __future__ import annotations + +import io +import contextlib +import os +import shutil +import subprocess +import unittest + +import greeneye as ge +from greeneye.errors import RspTimeout + +HERE = os.path.dirname(os.path.abspath(__file__)) +TOOL_ROOT = os.path.join(HERE, "..") +DEMO_ELF = os.path.join(TOOL_ROOT, "firmware", "uproc_demo", "build", "uproc_demo.elf") +SERVICE_ELF = os.path.join(TOOL_ROOT, "sdk", "build", "injected_demo.elf") + + +def qemu_available() -> bool: + return bool(os.environ.get("GREENEYE_QEMU") or shutil.which("qemu-system-riscv64")) + + +def toolchain_available() -> bool: + return bool(shutil.which("clang")) and ( + shutil.which("ld.lld") or os.path.exists("/usr/lib/llvm-18/bin/ld.lld") + ) + + +@unittest.skipUnless(qemu_available(), "qemu-system-riscv64 not installed") +@unittest.skipUnless(os.path.exists(DEMO_ELF), "demo firmware not built (make demo)") +class CallTests(unittest.TestCase): + def test_remote_call(self): + session = ge.launch(kernel=DEMO_ELF, name="unittest-call") + try: + result = session.call("rpc_ping", (0x1111,)) + self.assertEqual(result, 0x1111 ^ 0xBEEF) + # registers must be restored around the call + self.assertEqual(session.pc, 0x1000) + finally: + session.close() + + def test_run_until(self): + session = ge.launch(kernel=DEMO_ELF, name="unittest-rununtil") + try: + hit = session.run_until("rpc_sum", timeout=5.0) + self.assertEqual(hit.addr, session.symbols.lookup("rpc_sum")) + self.assertEqual(hit.kind, "breakpoint") + finally: + session.close() + + def test_run_until_timeout(self): + session = ge.launch(kernel=DEMO_ELF, name="unittest-rununtil-timeout") + try: + with self.assertRaises(RspTimeout): + session.run_until("rpc_fault", timeout=0.2) # self-test never calls it + finally: + session.close() + + +@unittest.skipUnless(qemu_available(), "qemu-system-riscv64 not installed") +@unittest.skipUnless(os.path.exists(DEMO_ELF), "demo firmware not built (make demo)") +class ReplTests(unittest.TestCase): + def test_repl_commands(self): + from greeneye.cli import GreenEyeRepl + from greeneye.plugins import PluginManager + + session = ge.launch(kernel=DEMO_ELF, record=True, name="unittest-repl") + output = io.StringIO() + try: + ctrl = session.symbols.lookup("gsp_ctrl") + repl = GreenEyeRepl(session, PluginManager(session)) + with contextlib.redirect_stdout(output): + repl.onecmd("bp rpc_sum") + repl.onecmd("watch gsp_ctrl+0x10 8 w") + repl.onecmd(f"x {ctrl:#x} 16") + repl.onecmd("sym rpc_ping") + repl.onecmd("c 0.6") + repl.onecmd("events 5") + text = output.getvalue() + self.assertIn("rpc_sum", text) + self.assertIn(f"{ctrl:08x}", text) + self.assertIn(f"watch w@{ctrl + 0x10:#x}", text) + finally: + session.close() + + +@unittest.skipUnless(qemu_available(), "qemu-system-riscv64 not installed") +@unittest.skipUnless(os.path.exists(DEMO_ELF), "demo firmware not built") +@unittest.skipUnless(toolchain_available(), "clang/lld not available") +class InjectionTests(unittest.TestCase): + @classmethod + def setUpClass(cls): + result = subprocess.run( + ["make", "-C", os.path.join(TOOL_ROOT, "sdk")], + capture_output=True, + text=True, + ) + if result.returncode != 0 or not os.path.exists(SERVICE_ELF): + raise unittest.SkipTest(f"SDK build failed: {result.stderr[-200:]}") + + def test_direct_and_firmware_invocation(self): + from greeneye.inject import invoke_remote, invoke_via_firmware, load_service + + session = ge.launch(kernel=DEMO_ELF, record=True, name="unittest-inject") + try: + service = load_service(session, SERVICE_ELF, slot=6) + self.assertEqual(invoke_remote(session, service, 1, 0x41), 0x41 ^ 0xBEEF) + self.assertEqual(invoke_remote(session, service, 2, 0x10, 0x20), 0x30) + session.run(duration=0.3) + self.assertEqual(invoke_via_firmware(session, service, 1, 0x41), 0x41 ^ 0xBEEF) + self.assertEqual(invoke_via_firmware(session, service, 2, 0x10, 0x20), 0x30) + finally: + session.close() + + +if __name__ == "__main__": + unittest.main() -- cgit v1.2.3