aboutsummaryrefslogtreecommitdiffstats
path: root/hw (follow)
Commit message (Expand)AuthorAge
* Record PSP security investigation artifacts and probesHEADmainuser2026-10-09
* crypto ROP harness: multi-op (two-svc) validated on silicon + usage/status docuser2026-10-08
* add clean GCP->SYS_DRV crypto ROP harness (hw/gcp_rop_crypto.py)user2026-10-08
* [HW] round-2 sweep: OTP-read (0x6001), MMIO-write (0x6002), reg-access (0x70x...user2026-10-08
* [HW] measured svc 0xf2 SYS_DRV reachability: ALL ACL ranges rejected, only fr...user2026-10-08
* [HW] CORRECTION: version is right (.54 confirmed), but the opcode ACL rejects...user2026-10-08
* [HW] svc 0xf2 issued from GCP ROP via stack migration; ASD survive-check passesuser2026-10-08
* [HW] graceful ROP: chain runs, TA completes with chosen status, ring survives...user2026-10-08
* [HW] a working ROP chain: 4 self-chaining strb gadgets write R0P! to the comm...user2026-10-08
* [HW] full stack pivot into the command buffer: arbitrary ROP confirmed, repor...user2026-10-07
* RETRACT Addenda C/D: it was a hit. One-invoke arbitrary chosen PC, confirmed ...user2026-10-07
* [HW] isolated per-slot writes refute the saved-LR route: Addendum B closed as...user2026-10-07
* [HW] saved-LR shot is a negative across [0x41bf90,0x41bfd8): stack is hit, no...user2026-10-07
* [HW] FE0A selector 4: a GCP write with BOTH content and destination host-chos...user2026-10-07
* [HW] FE0A selector 8 confirmed on silicon: the store is real and host-aimed, ...user2026-10-07
* LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed...user2026-10-07
* FE09's displacement names any 32-bit address: the limit is page permissions, ...user2026-10-02
* the out-of-allocation write reach scales with the declared length: 516 KiB co...user2026-10-02
* LOAD_TA never validates cmd_buf_len against the allocation: TA output lands o...user2026-10-02
* close the FE09 escalation question: negative displacements abort at the same ...user2026-10-02
* correct the FE09 finding: it is an out-of-bounds write, with the faulting PC ...user2026-10-02
* fault-oracle sweep of the never-covered TAs: ~4,237 cases, 0 faults, 6 new hangsuser2026-10-02
* fuzz GCP's real command space with the PSP fault oracle: 1,345 cases, no corr...user2026-10-02
* test the XGMI 0x1061 lead on hardware for the first time: blocked at the XGMI...user2026-10-02
* GCP FE09 ConfigureInitialize: host-chosen write offset, confirmed on silicon,...user2026-10-02
* confirm on silicon: RAS's missing length check is a host-triggerable persiste...user2026-10-01
* close the last avenue the rollback opened: no extra applications loaduser2026-09-30
* confirm whole-set rollback with the processor's own version registeruser2026-09-30
* finding: the bootloader accepts an older signed system driver, with no versio...user2026-09-30
* close the runtime bootloader question: component loads are refused after bootuser2026-09-30
* finding: the processor's bootloader command interface is still live after bootuser2026-09-30
* record the interrupt-ring-set probe as vacuous rather than as a passing checkuser2026-09-30
* enumerate the ring control command space: all ids inertuser2026-09-30
* finding: the ring base is accepted misaligned and then wedges on first submituser2026-09-30
* close the ring index: bounded, and handled gracefullyuser2026-09-30
* close the last ring-frame field and publish the complete field mapuser2026-09-30
* characterise the vmid fault and rule out two explanations by measurementuser2026-09-30
* finding: the ring frame's vmid byte is host-controlled, propagated into the p...user2026-09-30
* finding: the ring frame's fence address is not range-checked, unlike the comm...user2026-09-30
* hundred-and-seventeenth pass: image and command-buffer aliasing is handleduser2026-09-30
* hundred-and-sixteenth pass: loader class confusion is correctly handleduser2026-09-30
* hundred-and-fifteenth pass: sweep the driver-class load path across all corpu...user2026-09-30
* hundred-and-fourteenth pass: close the last acknowledged weak spot in coverageuser2026-09-30
* index the hardware probes so they are discoverable and usableuser2026-09-30
* hundred-and-thirteenth pass: multi-session stateful fuzz with slot recyclinguser2026-09-30
* hundred-and-twelfth pass: stateful sequence fuzz closes the weakest axisuser2026-09-30
* hundred-and-eleventh pass: multi-field mutations across the full windowuser2026-09-30
* hundred-and-tenth pass: full-resolution sweep of the entire shared bufferuser2026-09-30
* hundred-and-ninth pass: full-resolution sweep of the load command structureuser2026-09-30
* hundred-and-eighth pass: characterise the one validated field in the invoke s...user2026-09-30
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-04 12:40:42 +0000 — sl0p fork