aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* MEC/PM4 round 4: correct the dispatch table, refute the length-bound guessuser2026-09-28
* Synthesise the corpus: test the strongest compound, and reorder the targetsuser2026-09-28
* Reach the PSR-SU dirty-rect path by state injection; writes stay boundeduser2026-09-28
* Scope the DMCUB findings by reachability, and test the user-influenced pathuser2026-09-28
* Hash the new firmware blobs into the manifestuser2026-09-28
* Inventory every loadable firmware component, and record the sweep hazarduser2026-09-28
* Read the F32 blobs: SDMA audited on hardware, RLC deprioritiseduser2026-09-28
* Probe the SMU host message ABI on silicon; all index args are boundeduser2026-09-28
* Audit MES, PFP and ME; settle the IMU ISA as Xtensauser2026-09-28
* Audit DMCUB end to end: ISA, command surface, and ten findingsuser2026-09-28
* Refute the TA-to-SMU reframing: SVC 0xE8/0xE9 are stubsuser2026-09-26
* Correct the SMU entry: not an attacker channel, and not currently truncating ...user2026-09-26
* Census external input channels and test register modelling for SYS_DRVuser2026-09-26
* Explore both untested sink items; both close negativelyuser2026-09-26
* Close the monitor question: the sink-derived-length parser is host-unreachableuser2026-09-26
* Answer what else a malicious monitor buys: 25 extra ASD blocks, all polling l...user2026-09-26
* Add a verified TA-space reader; confirm a malicious sink cannot open ASD 0x308user2026-09-25
* Record that the 0x308 header read over the ring is void (address-space transl...user2026-09-25
* Reach ASD 0x308 over the host ring; sink influence on its gate NOT yet testeduser2026-09-25
* Fuzz the modelled sink against the overflow path: reachability gated, no faultsuser2026-09-25
* END TO END: modelled display data steers real PSP firmware in the emulatoruser2026-09-25
* Record two failed sink-injection attempts, both instrumentation failuresuser2026-09-25
* Reach the sink boundary: real firmware performs DDC register reads via cmd 0x01user2026-09-25
* Locate the state-5 transition: an ASD callback with no command pathuser2026-09-25
* Find the only verified writer of entry+0x40: it stores 4, while the gate wants 5user2026-09-25
* Record two instrumentation gotchas that void "no writes observed" resultsuser2026-09-25
* Map the attach descriptor copy: entry+0x40 is set by a different commanduser2026-09-25
* Attach a display for real: firmware sets the presence flag from a host ring c...user2026-09-25
* Locate DTM's three display RPCs and drive the host -> DTM -> ASD pathuser2026-09-25
* Find the sender of ASD command 0x100: it is the DTM TA, which IS ring-invocableuser2026-09-25
* Record the negative search for ASD command 0x100's sender, including a false ...user2026-09-25
* Explain why ASD is unreachable via TA invoke: sOS's 0x4154 typeword gateuser2026-09-25
* Identify ASD command 0x100 as the display-attach setter; no TA we hold sends ituser2026-09-25
* Drive RPC 0x1a5 end to end via message id 0x10; correct the presence-writer c...user2026-09-25
* Locate the exact HDCP message id (0x10) that drives the display-presence RPCuser2026-09-25
* Identify RPC 0x1a5 as the display-presence command and drive cmd 0x0F over th...user2026-09-25
* Show ASD is not invocable as a ring TA session; the 4 comes from ta_send_commanduser2026-09-25
* Find ASD's display-presence gate; stage 3 still blocked on reaching its setteruser2026-09-25
* Stage 2 achieved: host ring drives HDCP into a display RPC serviced by real ASDuser2026-09-25
* Withdraw both stage-2 explanations; neither is supporteduser2026-09-25
* Identify the stage-2 blocker: CPU parks in FIQ mode with FIQ maskeduser2026-09-25
* Stage 2 blocked: the host mailbox stops answering once ASD registersuser2026-09-25
* Clear the display-surface blocker: ASD registers when the platform-id byte is...user2026-09-25
* Narrow ASD's registration failure to sub_D14AA4 returning 7user2026-09-25
* Locate ASD's 0x7: the loader's module-registration RPC, which ASD declinesuser2026-09-25
* Decode the sink boundary (svc 0x7b ABI); ASD refuses display commands in isol...user2026-09-25
* Locate the correct sink-modelling boundary: ASD's svc 0x7b register readsuser2026-09-25
* Narrow ASD's 0x7 to the second of three loader passes; eliminate svc 0x90user2026-09-25
* Trace ASD's 0x7 to bl_load_ta_image: sOS's loader declines the ASD imageuser2026-09-25
* Narrow ASD's load failure to ASD itself; eliminate two candidate causesuser2026-09-25
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-09 01:45:24 +0000 — sl0p fork