1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
# Simulator vs the QEMU line - measured report
* schema: `greeneye-sim-qemu-line/1`
* harness: `harness/sim_qemu_line.py`
* line: docs/35-GREENEYE-SIMULATOR-DESIGN.md 1.1 + 3.3
* firmware: `gsp-570.144.fwimage.bin` sha256 `2d1bb5c60b208cfd...`
* verdict: **above** (above_qemu_line=True)
* verdict meaning: all frozen checks passed: QEMU fault reproduced, native >= QEMU + 1 rung, identical runs, wall bound, documented device model
## Rung table
| side | ran | rung | instructions | cycles (modeled) | stop | wall s | evidence |
|---|---|---|---:|---:|---|---:|---|
| QEMU probe | True | pre-B0 | - | - | fault | 0.9578 | `harness/qemu_line/sessions/qemu-probe` |
| native run 1 | True | B3 | 474043 | 871904 | ecall@0x4018038 | 0.6548 | `harness/qemu_line/sessions/native-1` |
| native run 2 | True | B3 | 474043 | 871904 | ecall@0x4018038 | 0.6167 | `harness/qemu_line/sessions/native-2` |
### QEMU first fault
* fault_load at fw vaddr `0x4009014` accessing `0x2000000000000a00` (4 bytes, read)
* first-touch matches the documented reference: True
* fault records in the capped log window: 5269
## Frozen thresholds
| check | pass |
|---|---|
| qemu_first_fault_reproduced | True |
| native_above_qemu | True |
| identical_runs | True |
| native_pair_wall_s | True |
| device_model_documented | True |
| all | True |
Thresholds (frozen 2026-10-03): native >= QEMU + 1 rung(s); 2 identical runs; pair wall <= 20.0 s.
## Determinism
* identical across 2 native runs: True
* session compare ran: True (['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta'])
## Session hashes (sha256)
| session | file | sha256 |
|---|---|---|
| qemu-probe | events.jsonl | `0f59d5d26b51be185e1a38b4540dee06303f8a2c0661519d9e1a32d2e6b10062` |
| qemu-probe | session.json | `f3d1eaf6dab15c79b0f4c4019f431a8032dc2b014d3acb17f63407326eca5e26` |
| qemu-probe | summary.md | `d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b` |
| native-1 | events.jsonl | `0501ee6c127c8acfeb06c6b4c36aecacd791e872e05bf341883df22054d34315` |
| native-1 | session.json | `811b076cc5d4555062ce17474f302e64d6cb29e7af9e5c05cb7d7f67825bd315` |
| native-1 | summary.md | `9ad8c39a95078b9aca1cf1ca0b83a1f7ce22b0dd33e679aaa5f8eb5068a97b75` |
| native-2 | events.jsonl | `77b6fb63a1b0be8d2f5eef9e786795849c1ad74acab96cc8cfb7a37790bd804a` |
| native-2 | session.json | `626646f2bc8f8200a339d2f93a23297eaaf39160fb41de9a97867de7ad6dc131` |
| native-2 | summary.md | `1ad09477c1ba2611db4a6ff9e47a38441395fe3b198b407b659a8a8e4b28ab95` |
| sessions | events.jsonl | `4ed32100308c465d999c78b71a232ab096e3cfcbb82561f46c5046eb34a0f462` |
| sessions | session.json | `6c8c45b9b4be70b934c3a43b4bd00df4a1e875baafe7c8988b13d5a18dbc4813` |
| sessions | summary.md | `9e7af234005461bd8b4395498fa3b58a3da5e589184c51e34b399f8cba37d50b` |
| trace | events.jsonl | `649ddd072446b2184427b6ea18a7e6bad6c118a0aa63c77bfff591cf9165114d` |
| trace | session.json | `c6abc0bbae7539b0c5d6685e700a6105c55d64821f42451b0f8ea386e0568020` |
| trace | summary.md | `10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44` |
| injection | events.jsonl | `ce9c81fb9663813c5eefbacfb94af69dc4050ef563fd62e302869942ae207be1` |
| injection | session.json | `bb203d2e551f906cc24500c4b3f2d8263e1218267ce6aa809d99dd9c964caae2` |
| injection | summary.md | `a6a087528c23227628faa0e3ad3a646b66bf06c06489d26fda4e82091a7bb2ac` |
## Native feature matrix (demo firmware)
| feature | status | detail |
|---|---|---|
| analyze_compare | pass | {'analyze_session': 'harness/qemu_line/sessions/native-1', 'analyze_chars': 444, 'compare_pair': ['harness/qemu_line/sessions/native-1', 'harness/qemu_line/sessions/native-2'], 'compare_chars': 394, 'compare_headers': ['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta']} |
| breakpoints | pass | {'run_until_hit': 2147483912, 'attached_then_removed': True, 'kind': 'sw'} |
| hooks | pass | {'rpc_dispatch_hits': 1, 'cmds': [1, 2]} |
| injection | pass | {'dir': 'harness/qemu_line/sessions/features-inject', 'blob': 'sdk/build/injected_demo.elf', 'slot': 6, 'ping_result': 48814, 'expected': 48814, 'hashes': {'session.json': 'bb203d2e551f906cc24500c4b3f2d8263e1218267ce6aa809d99dd9c964caae2', 'events.jsonl': 'ce9c81fb9663813c5eefbacfb94af69dc4050ef563fd62e302869942ae207be1', 'summary.md': 'a6a087528c23227628faa0e3ad3a646b66bf06c06489d26fda4e82091a7bb2ac'}} |
| mcp | not_run | native MCP surface is S3's deliverable (plugins/mcp_server.py); S4 must not race that work. Re-run after S3 lands (docs/37). |
| memory | pass | {'ctrl': 2147485760, 'magic': 1196642353} |
| sessions | pass | {'dir': 'harness/qemu_line/sessions/features', 'event_counts': {'bp_hit': 2, 'hook': 1, 'image_loaded': 1, 'mem_read': 2, 'mem_write': 4, 'session_end': 1, 'session_start': 1, 'stop': 2, 'watch': 1, 'watch_hit': 1}, 'hashes': {'session.json': '6c8c45b9b4be70b934c3a43b4bd00df4a1e875baafe7c8988b13d5a18dbc4813', 'events.jsonl': '4ed32100308c465d999c78b71a232ab096e3cfcbb82561f46c5046eb34a0f462', 'summary.md': '9e7af234005461bd8b4395498fa3b58a3da5e589184c51e34b399f8cba37d50b'}} |
| struct | pass | {'schema': 'gsp_ctrl.schema.json', 'fields': 14} |
| trace | pass | {'dir': 'harness/qemu_line/sessions/features-trace', 'blob': 'harness/qemu_line/sessions/features-trace/blobs/trace.jsonl', 'events': 4001, 'max_events': 4000, 'hashes': {'session.json': 'c6abc0bbae7539b0c5d6685e700a6105c55d64821f42451b0f8ea386e0568020', 'events.jsonl': '649ddd072446b2184427b6ea18a7e6bad6c118a0aa63c77bfff591cf9165114d', 'summary.md': '10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44'}} |
| watch | pass | {'result_field_stores': 1, 'pcs': [2147484066]} |
## S1 integration
* device source: sim/profiles/tu104-570.144.json
* profile: sim/profiles/tu104-570.144.json
* declared rung: None
* note: using sim/profiles/tu104-570.144.json (greeneye-sim-profile/1, firmware_sha256 matched)
## Not verified
* lenient MMIO (B0) is observation, not device semantics
* B3/B4 are not reached: the S1 device model stops at the B2 DMEM-runspace unknown
* the boot shim values (bootargs/WPR meta/DMEM mirror) are declared assumptions
* MCP on native is S3-owned and not exercised here
* L2 timing: cycles are modeled (docs/32), never silicon claims
* no hardware/GPU/guest/module involvement by design
## S1 integration notes
* `python3 harness/sim_qemu_line.py`
* S1 landed (2026-10-03): sim/profiles/*.json is discovered and the native side runs sim.gsp_boot
* sim/devices/*.json with greeneye-device-map/1 (or a device_map key) is still picked up as an observational map
* other agents' x86 QEMU VMs observed (never touched): 0
|
