diff options
| author | user <user@clank> | 2026-10-08 19:04:04 +0200 |
|---|---|---|
| committer | user <user@clank> | 2026-10-08 19:04:04 +0200 |
| commit | 7ff44109c494e995c1fb884b9f6e30a6f37e4caf (patch) | |
| tree | 904f3c7a0465aaa857bd782be624b45ba60204d9 /hw/deep_param_sweep.py | |
| parent | GCP->ASD lead: aliasing resolved for our build (index 90) + HW service-2 reac... (diff) | |
| download | amd-psp-re-7ff44109c494e995c1fb884b9f6e30a6f37e4caf.tar.gz amd-psp-re-7ff44109c494e995c1fb884b9f6e30a6f37e4caf.tar.xz amd-psp-re-7ff44109c494e995c1fb884b9f6e30a6f37e4caf.zip | |
GCP->ASD 0x403: ASD-internal chain PROVEN end-to-end in emulator (real handlers)
gcp_asd_403_write.py runs real asd_topology_update(0x100) x2 + asd_platform_op_403(0x403) unpatched:
0x100(0) + 0x100(1,desc[0xC]=P) forge the op_403 allowlist entry via index-90 topology aliasing
(count slot v6.u16[126]=1, pointer slot v6[91]=P confirmed), then op_403(90,4,TARGET,VALUE,0,4) fires
SVC 0x7C with addr=0x5000000 value=0xC0FFEE42 width=4 = our CHOSEN operands. SUCCESS.
Chain now: GCP->ASD svc2 reach (HW proven) + flat ungated dispatch (verified) + 0x100x2 forge (emu
proven, real handlers) + op_403->SVC0x7C chosen write (emu proven) + SVC0x7C broad phys write GCP
lacks (static). Only remaining: HW end-to-end = deliver 3 svc2 RPCs in one FE0A ROP chain (one-shot/
boot) writing a benign observable target. Harness-extension task, not a new unknown. Updated eval doc.
Diffstat (limited to 'hw/deep_param_sweep.py')
0 files changed, 0 insertions, 0 deletions