aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* ASD audit pass 1: first-level 0x180 handlers validate (ptr,len) but only cap ...user2026-10-08
* map ASD's service-2 message handler as the GCP-ROP -> ASD escalation surfaceuser2026-10-08
* answer the fuse question: not TA-reachable (service 3 needs type 1), but ASD ...user2026-10-08
* map the TA->kernel SVC surface under ROP; correct two SVC-OVERVIEW errors; ra...user2026-10-08
* [HW] graceful ROP: chain runs, TA completes with chosen status, ring survives...user2026-10-08
* [HW] a working ROP chain: 4 self-chaining strb gadgets write R0P! to the comm...user2026-10-08
* [HW] full stack pivot into the command buffer: arbitrary ROP confirmed, repor...user2026-10-07
* RETRACT Addenda C/D: it was a hit. One-invoke arbitrary chosen PC, confirmed ...user2026-10-07
* [HW] isolated per-slot writes refute the saved-LR route: Addendum B closed as...user2026-10-07
* [HW] saved-LR shot is a negative across [0x41bf90,0x41bfd8): stack is hit, no...user2026-10-07
* the chosen write can aim at the saved LR that the writing function itself pop...user2026-10-07
* read the FE0A parent before testing OOB reach: copy is unclamped, which bound...user2026-10-07
* [HW] FE0A selector 4: a GCP write with BOTH content and destination host-chos...user2026-10-07
* verify Add.146's reopening condition 1 by hand instead of asserting it; closu...user2026-10-07
* cross-build sweep closes the LSB-zero pivot line: 235 candidates across 10 bu...user2026-10-07
* close the re-entrancy requirement by enumeration: only three frames can hold ...user2026-10-07
* [HW] FE0A selector 8 confirmed on silicon: the store is real and host-aimed, ...user2026-10-07
* own-frame LSB-zero removes the ordering wall; .77 FE09 handler corrected; aut...user2026-10-07
* RETRACT Add.140's r8 identity, and record a second, NON-ZERO host-offset writ...user2026-10-07
* CORRECTION + upgrade: on .77 the r8 gadget base is a host buffer POINTER, not...user2026-10-07
* LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed...user2026-10-07
* retest .data properly: the limit is the shared-buffer window, not target sele...user2026-10-02
* document the partial-overwrite geometry and the three reasons it does not hel...user2026-10-02
* document FE09 version coverage (11/11 builds) and the written value (zero, fo...user2026-10-02
* FE09's displacement names any 32-bit address: the limit is page permissions, ...user2026-10-02
* the out-of-allocation write reach scales with the declared length: 516 KiB co...user2026-10-02
* LOAD_TA never validates cmd_buf_len against the allocation: TA output lands o...user2026-10-02
* the vacuous host-vs-host check class is GCP-only, with a control to back the ...user2026-10-02
* close the FE09 escalation question: negative displacements abort at the same ...user2026-10-02
* correct the FE09 finding: it is an out-of-bounds write, with the faulting PC ...user2026-10-02
* fault-oracle sweep of the never-covered TAs: ~4,237 cases, 0 faults, 6 new hangsuser2026-10-02
* fuzz GCP's real command space with the PSP fault oracle: 1,345 cases, no corr...user2026-10-02
* correct hand-over item 4: GCP's auth-gated routes are dead code, not an acces...user2026-10-02
* test the XGMI 0x1061 lead on hardware for the first time: blocked at the XGMI...user2026-10-02
* close the prior HDCP "not yet examined" copy sites: all bounded in the shippe...user2026-10-02
* correct my claim that TOCTOU was unswept; it was, and I rediscovered its item #1user2026-10-02
* close the FE09 unwrap lead: its state==2 precondition is never satisfiable in...user2026-10-02
* close the remaining static corruption classes after the window-enforcement re...user2026-10-02
* GCP FE09 ConfigureInitialize: host-chosen write offset, confirmed on silicon,...user2026-10-02
* record the host-reachable corruption sweep as a negative resultuser2026-10-02
* refute the OPM cmd05 lead: the panic veneer is noreturn, so the loop is an ar...user2026-10-02
* record OPM cmd05 index-clobber lead as unresolved, not a buguser2026-10-02
* generalise the DoS: 6 of 6 ungated TAs wedge, 4 of 4 gated TAs surviveuser2026-10-01
* confirm on silicon: RAS's missing length check is a host-triggerable persiste...user2026-10-01
* chase RAS finding: the type range is by design, but five of nine builds valid...user2026-10-01
* audit host-reachable TA attack surface: four modules dereference the request ...user2026-10-01
* screen all 55 diffs for security fixes: one confirmed, eleven refuted at byte...user2026-10-01
* add fw/diffs: 55 within-branch version diffs with a findings indexuser2026-10-01
* regenerate all 16 modules on one decoder; align the RPC naming so diffs mean ...user2026-10-01
* add fw/ta_diff.py: per-function cross-version diffs, and fix the naming it ex...user2026-10-01
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-06 23:05:40 +0000 — sl0p fork