aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* Restructure the findings corpus: add INDEX.md, resolve duplicates, re-prioritiseuser2026-09-23
* Close the dma_transfer lead: the consumer is a bounded FIFO descriptor walkeruser2026-09-23
* dma_transfer: the staging buffer is sized for the cap -- not an overflowuser2026-09-23
* New lead: dma_transfer stages a client buffer into fixed SYS_DRV memoryuser2026-09-23
* Fuse/debug round 2: dma_transfer is live; fuse/debug paths are not on the boo...user2026-09-23
* Fuse/debug reachability round 1: method works, experiment under-powereduser2026-09-23
* Close the PTE-attribute and DF-config angles; question the fence's mapped shapeuser2026-09-23
* Refute TMZ tag-forging: the TMR fence is tag-agnostic, not just requester-agn...user2026-09-23
* Void my own VCN write-detection results: the MMIO detector never decodeduser2026-09-23
* Solve the VCN SMN->MMIO mapping; earlier write diffs were looking in the wron...user2026-09-23
* VCN write lands outside the MMIO window; parser confirmed walking our entriesuser2026-09-23
* Demonstrate the unsigned VCN register write on hardware, and measure its ABIuser2026-09-23
* The LOAD_IP_FW type 49 gate opens via an SMU message the host can senduser2026-09-23
* Refute my own Route C / VCN re-rating on hardwareuser2026-09-23
* Re-rate Route C: the scan that deflated it could not see its consumersuser2026-09-23
* Refute the confused-deputy-writer angle on hardwareuser2026-09-23
* Angle: make the PSP the writer -- host-chosen cmd_buf as a confused deputyuser2026-09-23
* Mine the NV22 map and symbol tables: fuse-write and debug-unlock surface founduser2026-09-23
* Drive RAS on real silicon: the 0xE575B8 blocker is missing state, confirmeduser2026-09-23
* Measure ASD's four unmodelled SVCs from a real boot instead of fabricating themuser2026-09-23
* Cover ASD on the card's build: resolve its dispatcher and validate_ptruser2026-09-23
* Add the card's own TAs and show HDCP/DTM findings reproduce on themuser2026-09-23
* Validate against real silicon: RAS matches the card, HDCP/DTM/ASD do notuser2026-09-23
* State where each gate model is applied, so check_range is not mistaken for liveuser2026-09-23
* Model sOS's SVC permission gate: SVCs no longer succeed unconditionallyuser2026-09-23
* Find that fuzz_asd's coverage rests on fabricated SVC returnsuser2026-09-23
* Measure async dispatch and scheduling instead of assuming they are absentuser2026-09-23
* Model the sOS gate's region validation, and retract the DACR claimuser2026-09-23
* Record the bounded search for what populates SYS_DRV's 0xE575B8 contextuser2026-09-23
* Trace RAS's last blocker to uninitialised SYS_DRV context, not a bad requestuser2026-09-23
* 0x3141 observation: no emitter in any module we have, so it is latentuser2026-09-23
* fuzz_sysdrv: respect the pointer allowlist by default; withdraw my own caveatuser2026-09-23
* full_system: require TA liveness, not just "some blocks executed"user2026-09-23
* full_system.py: sOS + SYS_DRV + all four TAs executing in one runuser2026-09-23
* Validator patches: drop the unnecessary one, quantify the load-bearing oneuser2026-09-23
* sysdrv_bridge: record that standalone replay of these opcodes is not faithfuluser2026-09-23
* sysdrv_bridge: bring the CCP up; 3 of RAS's 4 RPCs now succeeduser2026-09-23
* EXPERIMENTAL: bridge TA service-1 RPCs into a real SYS_DRV (does not yet open...user2026-09-23
* Trace RAS's init gate to a SYS_DRV RPC dependencyuser2026-09-22
* DTM: fix a loader base error that made it undrivable; add dtm_ras.pyuser2026-09-22
* fuzz_hdcp: model TA state persistence across commands (default on)user2026-09-22
* Refresh the fidelity table: asd_validate_ptr fixed, crypto gap boundeduser2026-09-22
* Bound the crypto-service fidelity gap: measurably not load-bearing for fuzz_hdcpuser2026-09-22
* RETRACT the unconditional "return-address control" claim in psp_emu/README.mduser2026-09-22
* Resolve the session-table redzone observation: harness artefact, not a defectuser2026-09-22
* fuzz_hdcp: drop the session-table redzone; it overlaid a real TA objectuser2026-09-22
* RESOLVED: 0x20A000 is a transient window; the workaround would have been wronguser2026-09-22
* Record the stage-2 blocker as a lead, and why the obvious fix is not takenuser2026-09-22
* boot_stage2_task: diagnose the stall instead of calling it "still running"user2026-09-22
* fuzz_asd: assert at startup that the pointer validator is live in both direct...user2026-09-22
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-09 02:38:15 +0000 — sl0p fork