From 3fe5360d0efc439d59f2b7a9bf2f713aa9cdb918 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 2 Oct 2026 09:13:00 -0400 Subject: debug: green-eye wave 2 - injection SDK, Frida-like calls, Ghidra control bridge, long-term docs Adds to debug/risc-v-gsp-rm-vm/: - Session.call / run_until: Frida-like remote function calls and run-to-cursor, with register restoration; verified live (rpc_ping -> 0xaffe). - symbol+offset target resolution (gsp_ctrl+0x10) across all APIs and the REPL. - Injection SDK (sdk/) and 'greeneye inject': position-independent RV64 service blobs (verified zero relocations), loaded into RAM, registered in the demo handler table, and invoked either directly or through the firmware mailbox dispatcher. Demo ABI extended: mailbox 16..23 selects slots, arg0 carries the service command, arg2 added (struct now 0x190; schema updated). - Ghidra control bridge (greeneye ghidra + GreenEyeControl.java): run-until-here, breakpoints, memory/register access, remote calls, hit export; verified end-to-end with Ghidra headless (run_until reached rpc_sum from a GhidraScript). - MarkGreenEyeHits.java fixed for the Ghidra 12 createBookmark API; verified headless together with ExportForGreenEye.java. - Analyzer renders a QEMU first-fault table for probe sessions (fault count, epc with firmware vaddr translation, access address/size, reason). - Tests now 35 green, including injection, Ghidra bridge, remote call, run-until and REPL command smoke tests. - Documentation: docs/11-16 (GSP RM service developer guide, injection SDK specification, Ghidra control, adversarial interoperability guide, agentic GSP IDE, custom simulator design) and GREEN-EYE-ROADMAP.md (long-term H1-H7 program); doc maps and the project RISC-V VM doc updated. --- docs/05-operations/03-risc-v-gsp-rm-vm.md | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) (limited to 'docs/05-operations') diff --git a/docs/05-operations/03-risc-v-gsp-rm-vm.md b/docs/05-operations/03-risc-v-gsp-rm-vm.md index 8d3cf7c..c21124b 100644 --- a/docs/05-operations/03-risc-v-gsp-rm-vm.md +++ b/docs/05-operations/03-risc-v-gsp-rm-vm.md @@ -18,7 +18,14 @@ its runtime behaviour inspectable with Frida-like primitives: * memory read/write/hexdump/search, structure decoding, snapshot diffing, * recorded sessions: a replayable event stream plus memory dumps (`events.jsonl`, snapshots, `summary.md`), -* declarative probe specs, a plugin API and a Ghidra symbol/hit bridge. +* Frida-like remote calls (`Session.call`) and run-to-cursor + (`Session.run_until`), +* **code injection**: build a position-independent RV64 service with the + `sdk/`, load it into the running firmware and register it so the firmware + dispatches to it (`greeneye inject`), +* declarative probe specs, a plugin API, a Ghidra symbol/hit bridge and a + **Ghidra control bridge** (`greeneye ghidra` + `GreenEyeControl.java`) for + "execute until here" from the decompiler. Its stated purpose is **simulating and inspecting the GSP firmware's runtime memory for `gsp-rm-vfio` accuracy measurements**: capture how the firmware @@ -66,24 +73,30 @@ From the repository root: ```bash cd debug/risc-v-gsp-rm-vm ./greeneye.sh info # environment check (QEMU, toolchain) -make demo # build the bundled RV64 uproc demo +make demo sdk # build the demo uproc and the injection SDK ./greeneye.sh demo # canned instrumentation pass; records a session ./greeneye.sh analyze dumps/ ./greeneye.sh probe # real GSP image: report the first divergence +./greeneye.sh inject # load and invoke an injected service +./greeneye.sh ghidra # serve the session to GhidraScripts ``` Requirements: `qemu-system-riscv64` (Ubuntu `qemu-system-misc`), Python 3.10+ -(stdlib only), `clang` + `lld` for the demo firmware. The tool touches no GPU, -no mdev, no kernel module and no host driver. +(stdlib only), `clang` + `lld` for the demo firmware and the SDK. The tool +touches no GPU, no mdev, no kernel module and no host driver. ## 5. Status and limits (v0.1) Working and live-verified: QEMU boot and gdbstub transport without GDB, hooks/breakpoints/watchpoints, memory tools, structure decoding, session -recording and analysis, declarative probes, plugins, the Ghidra bridge, and -the real-firmware first-fault probe. The TCG full-memory trace plugin builds -and records. Not implemented: device model (R1), custom simulator (R2), MCP -plugin (R3) — all roadmap. +recording and analysis, declarative probes, plugins, remote calls and +run-to-cursor, the injection SDK with direct and firmware-dispatched service +invocation, the Ghidra symbol/hit bridge and Ghidra control bridge, the +real-firmware first-fault probe, and the TCG full-memory trace plugin. Not +implemented: device model (R1), custom simulator (R2), MCP plugin (R3) — all +roadmap. The long-term program (adversarial navigation, adjacent +microcontrollers, custom simulator, Verilog soft-core, agentic platform) is +documented in `debug/risc-v-gsp-rm-vm/GREEN-EYE-ROADMAP.md`. ## 6. When the development flag can be removed -- cgit v1.2.3