amd-psp-re.git/fw/libdumps/auc.json, branch main

fw: document the annotation residue; all 632 functions now named or documented

2026-09-29T13:11:28Z

The last 14% cannot be named without inventing semantics for code that is either shared by several owners or reachable only indirectly, so it is documented instead. fw/ta_document_residue.py writes an IDA function comment on each still-anonymous function giving size, callers, callees and a class, all derived from IDA's function boundaries plus a capstone decode of that function. Four evidence-based classes: several named owners, no named caller and not data-referenced, no bl caller but data-referenced, and called only from still-anonymous code. Applied to all twelve TAs: 78 functions documented, with powerplay 27, xgmi 14, wspe 9, gcp 8, opm 6, fp 5, merit 4, auc 3, oc 1, csu 1, and rap and tmz having none left. Spot-verified by reading the comment back in two separate databases. Also corrects the coverage figures: the live counts used names _ which misses IDA's start label in every TA, so each named count was one low. With start included the named total is 554 of 632, and with the residue documented every one of the 632 functions carries either a derived name or a factual comment. That is the defensible reading of fully annotated, since a semantic name for all 632 is not achievable for indirect or dead code without fabricating meaning.

fw: annotation coverage 65% -> 82%; POWERPLAY's fptr table found and named

2026-09-29T12:36:37Z

Ran the call-graph attribution pass on the nine TAs that had not had it, then attacked the worst outlier. POWERPLAY sat at 51% because 37 of its functions have no direct caller; scanning for runs of valid Thumb pointers into the image found a 23-entry function-pointer table at 0x40266c, alongside the 5-entry TEE table at 0x406c44 which matches the trampoline and therefore serves as the control. Naming the 23 targets by table index, which is factual rather than guessed semantics, took POWERPLAY from 51 to 73 percent, and re-running attribution took it to 74. Overall coverage is now 533 of 622 functions, 82 percent, up from 65. Per-TA it ranges from 74 percent on POWERPLAY to 92 percent on several of the small ones. What remains unnamed is stated rather than glossed: functions with several named owners, where attributing one would be wrong, and functions reached only indirectly in TAs where no pointer table was located. The objective's literal everything is still not met and the number is the evidence.

fw: propagate shared-runtime names by content hash; coverage 38% -> 61%

2026-09-29T12:09:05Z

These TAs share one PSP TEE runtime, so the same helper appears byte-identical in several of them. fw/ta_libmatch.py dumps IDA's function list per TA, hashes each function's bytes, and clusters across TAs: 628 functions, 457 distinct bodies, 55 clusters shared by two or more TAs covering 225 instances. Naming a cluster once and propagating by exact content match is much better leverage than renaming anonymous functions individually. The clustering reproduces known answers before being trusted for unknown ones: the 148-byte cluster shared by eight TAs is exactly the entry trampoline already named from the header parse, and the 2- and 4-byte clusters are the return stubs already named as the close-session and destroy entry points. Naming discipline kept deliberately tight. Only six clusters got semantic names, the ones whose disassembly proves them: a word-block zero fill present in ten TAs, a bytewise zero fill with alignment fixup in six, the two return stubs, the trampoline and a tail-jump thunk. The other 49 are tagged lib__, which records that they are shared runtime rather than TA-specific logic without inventing semantics; several look like a stream or vtable family but probably is not a name. Coverage rises from 38 to 61 percent. The remainder is TA-specific internal logic and is stated as unnamed.