{ "answers": { "q1_first_touch": { "addr": 2305843009213696512, "answer": "the first MMIO is a 4-byte read of PA 0x2000000000000a00 at fw PC 0x4009014; it is the QEMU-documented first fault", "matches_qemu_reference": true, "pc_fw": 67145748, "rw": "r", "size": 4 }, "q2_path": { "answer": "entry state is all-zero (no bootloader handoff modelled); the bootstrap builds the device PA with 5 arithmetic instructions (li/slli/addi/slli/addi), reads it, then runs the chip-ID comparison chain: 25 instructions recorded from entry until the halt at fw 0x4009070", "entry_regs_zero": false, "halt_pc_fw": 67145840, "halt_seen": true, "instructions_to_halt": 25, "trace_path_fw": [ 67145728, 67145732, 67145736, 67145740, 67145744, 67145748, 67145752, 67145756, 67145760, 67145764, 67145768, 67145772, 67145776, 67145780, 67145784, 67145788, 67145792, 67145796, 67145800, 67145804, 67145808, 67145812, 67145824, 67145828, 67145840 ] }, "q3_id_field": { "ampere_id": 368, "answer": "the read value's bits [28:20] are extracted (srli 20, andi 0x1ff) and compared against 354..360 (Turing) and 368 (Ampere); the image itself defines this as a chip-ID field", "disassembly": [ "0x84009000: 0010029b addiw t0,zero,1", "0x84009004: 03129293 slli t0,t0,49", "0x84009008: 00128293 addi t0,t0,1", "0x8400900c: 00c29293 slli t0,t0,12", "0x84009010: a0028293 addi t0,t0,-1536", "0x84009014: 0002a283 lw t0,0(t0)", "0x84009018: 0142d293 srli t0,t0,20", "0x8400901c: 1ff2f293 andi t0,t0,511" ], "mask": 511, "shift": 20, "turing_ids": [ 354, 355, 356, 357, 358, 359, 360 ] }, "q4_dispatch": { "answer": "ID 354..360 dispatches to .tu10x_text at 0x4007000; ID 368 dispatches to .ga100_text at 0x4005000; any other value (including the lenient zero) falls to the fail-closed `j .` loop at 0x4009070", "ga100_target": 67129344, "halt_pc": 67145840, "sections": { "bootstrap": ".bootstrap", "ga100_target": ".ga100_text", "tu10x_target": ".tu10x_text" }, "tu10x_target": 67137536 }, "q5_next_blocker": { "answer": "with a Turing ID served, .tu10x_text programs CSRs 0x7c8-0x7cc (region descriptors) and enables mstatus FP/SIMD state, then builds the absolute link-time address 0x40070f8 and jumps to it; because the loader relocates segments but not absolute immediates, that jump lands outside RAM and faults - a relocation artifact, so the next rung needs a chip-ID device model plus load-at-link-address/alias translation", "disassembly_tail": [ "0x840070e4: 1e0002b7 lui t0,0x1e000", "0x840070e8: 3002a073 csrs mstatus,t0", "0x840070ec: 040072b7 lui t0,0x4007", "0x840070f0: 0f828293 addi t0,t0,248", "0x840070f4: 00028067 jalr zero,0(t0)" ], "modeled_run": { "fault_signal": 11, "instructions": 74, "jumps": [ { "pc_fw": 67137780, "t0_absolute_target": 67137784, "target_fw": 67137784 } ], "stop_outside_ram": true, "stop_pc_fw": 67137784 } } }, "baseline": { "manual_estimate_s": 600.0, "manual_method": "floor estimate: ~90 instructions across .bootstrap + .tu10x_text + .ga100_text read by hand, dispatch table identified and correlated with the QEMU first-fault report; not measured in this run", "qemu_first_fault": { "access_addr": 2305843009213696512, "cause": 5, "desc": "fault_load", "epc": 2214629396, "epc_fw": 67145748, "reason": "rejected", "rw": "read", "size": 4 }, "qemu_method": "python3 -m greeneye.cli probe --duration 1.0 (here run via harness.run_qemu_baseline, 0.5 s bound)", "qemu_probe_wall_s": 0.9495, "qemu_session": "harness/re_demo/sessions/qemu-probe", "qemu_session_hashes": { "events.jsonl": "8c4dba8006a496d853c81ce9e2b16944cd27b8d6171c01777daa6e5738be02bc", "session.json": "c7bf5e4d29f534160d660dadb81f81942faa17cbfb1941587c60dcf78180f56c", "summary.md": "d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b" }, "total_s": 600.9495 }, "emulator": { "lenient": { "disassembly": [ "0x84009000: 0010029b addiw t0,zero,1", "0x84009004: 03129293 slli t0,t0,49", "0x84009008: 00128293 addi t0,t0,1", "0x8400900c: 00c29293 slli t0,t0,12", "0x84009010: a0028293 addi t0,t0,-1536", "0x84009014: 0002a283 lw t0,0(t0)", "0x84009018: 0142d293 srli t0,t0,20", "0x8400901c: 1ff2f293 andi t0,t0,511" ], "entry_regs_zero": false, "first_touch_fw_pc": 67145748, "first_touch_matches_qemu": true, "first_unknown_mmio": { "addr": 2305843009213696512, "pc": 2214629396, "rw": "r", "size": 4 }, "hook_stops": [ { "label": "first_touch_pc", "pc": 2214629396, "pc_fw": 67145748, "t0": 2305843009213696512, "t1": 0, "t2": 0 }, { "label": "halt", "pc": 2214629488, "pc_fw": 67145840, "t0": 0, "t1": 359, "t2": 368 } ], "instructions": 25, "session": "harness/re_demo/sessions/native-lenient", "session_hashes": { "events.jsonl": "ccb568588738c0609071ee542c9b04f7bb2868ee8fae12c28b2bfc5d9343721b", "session.json": "ec5944adce4b823a3d6fd7d5aa6385fb5b61c2f9542c7221f46f328601c12c66", "summary.md": "b50820afa60c35da0d4701e54f9907d4b7090c52721e1ecf656942a41bcf44db" }, "snapshot_bytes": 120, "stop_pc": 2214629488, "stop_pc_fw": 67145840, "trace_exec_count": 25, "trace_path_fw": [ 67145728, 67145732, 67145736, 67145740, 67145744, 67145748, 67145752, 67145756, 67145760, 67145764, 67145768, 67145772, 67145776, 67145780, 67145784, 67145788, 67145792, 67145796, 67145800, 67145804, 67145808, 67145812, 67145824, 67145828, 67145840 ], "wall_s": 0.0006 }, "modeled": { "assumed_chip_id": 354, "disassembly_tail": [ "0x840070e4: 1e0002b7 lui t0,0x1e000", "0x840070e8: 3002a073 csrs mstatus,t0", "0x840070ec: 040072b7 lui t0,0x4007", "0x840070f0: 0f828293 addi t0,t0,248", "0x840070f4: 00028067 jalr zero,0(t0)" ], "fault_signal": 11, "fault_stops": [ { "pc_fw": 67137784, "signal": 11 } ], "instructions": 74, "jumps": [ { "pc_fw": 67137780, "t0_absolute_target": 67137784, "target_fw": 67137784 } ], "modeled_id": 371195904, "session": "harness/re_demo/sessions/native-modeled-id", "session_hashes": { "events.jsonl": "fdf0756c3543741b74c9267dc9e4d22156f43a4b54463ffbfb1671c327444515", "session.json": "5ae7eeff56a19ed7eea093a164a3a3738965b56c39f35a563db3ee93a2c90d39", "summary.md": "bd670d207d23079173b494a9be9f9a0e7d31a10a11f9dc48fb8a134888442d0b" }, "stop_outside_ram": true, "stop_pc": 67137784, "stop_pc_fw": 67137784, "trace_exec_count": 74, "trace_path_fw": [ 67145728, 67145732, 67145736, 67145740, 67145744, 67145748, 67145752, 67145756, 67145760, 67145764, 67145816, 67145820, 67137536, 67137540, 67137544, 67137548, 67137552, 67137556, 67137560, 67137564, 67137568, 67137572, 67137576, 67137580, 67137584, 67137588, 67137592, 67137596, 67137600, 67137604, 67137608, 67137612, 67137616, 67137620, 67137624, 67137628, 67137632, 67137636, 67137640, 67137644, 67137648, 67137652, 67137656, 67137660, 67137664, 67137668, 67137672, 67137676, 67137680, 67137684, 67137688, 67137692, 67137696, 67137700, 67137704, 67137708, 67137712, 67137716, 67137720, 67137724, 67137728, 67137732, 67137736, 67137740, 67137744, 67137748, 67137752, 67137756, 67137760, 67137764, 67137768, 67137772, 67137776, 67137780 ], "wall_s": 0.0004 }, "wall_s": 0.1251 }, "firmware": { "name": "gsp-570.144.fwimage.bin", "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea" }, "lenient_repeat": { "disassembly": [ "0x84009000: 0010029b addiw t0,zero,1", "0x84009004: 03129293 slli t0,t0,49", "0x84009008: 00128293 addi t0,t0,1", "0x8400900c: 00c29293 slli t0,t0,12", "0x84009010: a0028293 addi t0,t0,-1536", "0x84009014: 0002a283 lw t0,0(t0)", "0x84009018: 0142d293 srli t0,t0,20", "0x8400901c: 1ff2f293 andi t0,t0,511" ], "entry_regs_zero": false, "first_touch_fw_pc": 67145748, "first_touch_matches_qemu": true, "first_unknown_mmio": { "addr": 2305843009213696512, "pc": 2214629396, "rw": "r", "size": 4 }, "hook_stops": [ { "label": "first_touch_pc", "pc": 2214629396, "pc_fw": 67145748, "t0": 2305843009213696512, "t1": 0, "t2": 0 }, { "label": "halt", "pc": 2214629488, "pc_fw": 67145840, "t0": 0, "t1": 359, "t2": 368 } ], "instructions": 25, "session": "harness/re_demo/sessions/native-lenient-repeat", "session_hashes": { "events.jsonl": "2cd28b4da009447d70505cfbba59e9c1bf8bd277e3a7ea696e2690f54f66f756", "session.json": "fe21ed52c05436d0f7886dfeb0886ec1a11b25678e4d827db3b9e4009d2187e4", "summary.md": "357d95a664e33128a2a48da7ecfc058bdbbea56fae130557593fd59ff2efa597" }, "snapshot_bytes": 120, "stop_pc": 2214629488, "stop_pc_fw": 67145840, "trace_exec_count": 25, "trace_path_fw": [ 67145728, 67145732, 67145736, 67145740, 67145744, 67145748, 67145752, 67145756, 67145760, 67145764, 67145768, 67145772, 67145776, 67145780, 67145784, 67145788, 67145792, 67145796, 67145800, 67145804, 67145808, 67145812, 67145824, 67145828, 67145840 ], "wall_s": 0.0005 }, "lenient_repeat_hashes": { "events.jsonl": "2cd28b4da009447d70505cfbba59e9c1bf8bd277e3a7ea696e2690f54f66f756", "session.json": "fe21ed52c05436d0f7886dfeb0886ec1a11b25678e4d827db3b9e4009d2187e4", "summary.md": "357d95a664e33128a2a48da7ecfc058bdbbea56fae130557593fd59ff2efa597" }, "not_verified": [ "the modeled chip-ID value is an assumption (the QEMU baseline faults before reading it); only the field position and the compared IDs are firmware evidence", "no timing/cycle claim: cycles are modeled (L2 not modelled, docs/06) and none are used in this answer", "L3 device environment is absent: the register's on-silicon semantics are inferred from firmware comparisons, not from a device model", "load-at-link-address and absolute-immediate relocation behaviour are not implemented; the B1 candidate fault is a relocation artifact of this harness", "watchpoints are not exercised on this path: the bootstrap performs no RAM data access before the fault (RAM watchpoints are exercised by harness/sim_qemu_line.py on the demo firmware)", "no hardware, GPU, mdev, module, guest or network involvement by design" ], "qemu_reference_first_fault": { "access_addr": 2305843009213696512, "cause": 5, "desc": "load access fault", "firmware_vaddr": 67145748, "rw": "read", "size": 4 }, "ran": true, "rerun": { "command": "python3 harness/re_demo.py", "cwd": "open-iov/debug/risc-v-gsp-rm-vm" }, "rerun_notes": [ "thresholds live in harness/re_demo.py (FROZEN_THRESHOLDS) and are not moved after the run", "the QEMU baseline needs qemu-system-riscv64; without it the emulator columns still reproduce and the baseline is marked unverified", "sessions are under harness/re_demo/sessions/ (hash-stamped); the report regenerates with the same command" ], "scenario": "What happens on the real GSP image between entry and the first fault/milestone, and what does the state tell us about boot?", "schema": "greeneye-re-demo/1", "script": "harness/re_demo.py", "threshold_checks": { "answers_complete": true, "baseline_beat": true, "deterministic_lenient_runs": true, "emulator_wall_s": true, "milestone_past_qemu": true, "pass": true }, "thresholds": { "answers_required": 5, "emulator_wall_s_max": 120.0, "frozen_on": "2026-10-03", "identical_lenient_runs": 2, "manual_static_estimate_s": 600.0, "milestone_past_qemu": true } }