|
|
DMCUB had been skipped for months. Identify it as Tensilica Xtensa (windowed
ABI, with in-tree positive/negative controls), correct the load base to
VA = 0x60000000 + file - 0x200 after finding the nested $PS1 header, and build
the tooling to read it: parser, CFG, disassembler with capstone-6 gaps patched,
register map, jump-table and copy-length auditors.
All 24 implemented DMUB_CMD__* types get a verdict, plus the GPINT doorbell
(114-entry table, 12 implemented, all bounded -- a clean negative).
Hardware, via PSP load on the 7900 XTX:
FINDING-1 [HW] ABM_INIT_CONFIG's unchecked u16 writes ~32 KB past a 712-byte
slot
FINDING-2 [HW] type 8 returns memory at an unbounded 16-bit panel_inst
FINDING-5 [HW] CW0/CW1/SEC_CNTL are not host-writable; PSP signature enforced
FINDING-6 [HW] one command wedges the inbox loop (display DoS)
FINDING-7 [HW] no arbitrary write: writes follow the host-owned CW6 window
FINDING-8 [HW] auth is neither version- nor ASIC-bound; rollback works
FINDING-9 [ST] DCN4 LSDMA: host-programmed DMA with only a count != 0 check
FINDING-10 [HW] REG_REG_WAIT is an arbitrary-address read oracle whose timing
leaks PSP-protected memory; a full CW0 sweep shows the TMR
image is byte-identical to public firmware, which bounds it
FINDING-3 and -4 are downgraded to latent with the evidence that did not
support them. Liveness must be measured by ring consumption, not SCRATCH0 --
that mistake silently voided ~120 negative measurements and is recorded in
place.
|
