aboutsummaryrefslogtreecommitdiffstats
path: root/hw (unfollow)
Commit message (Expand)Author
2026-10-09Record PSP security investigation artifacts and probesHEADmainuser
2026-10-08crypto ROP harness: multi-op (two-svc) validated on silicon + usage/status docuser
2026-10-08add clean GCP->SYS_DRV crypto ROP harness (hw/gcp_rop_crypto.py)user
2026-10-08[HW] round-2 sweep: OTP-read (0x6001), MMIO-write (0x6002), reg-access (0x70x...user
2026-10-08[HW] measured svc 0xf2 SYS_DRV reachability: ALL ACL ranges rejected, only fr...user
2026-10-08[HW] CORRECTION: version is right (.54 confirmed), but the opcode ACL rejects...user
2026-10-08[HW] svc 0xf2 issued from GCP ROP via stack migration; ASD survive-check passesuser
2026-10-08[HW] graceful ROP: chain runs, TA completes with chosen status, ring survives...user
2026-10-08[HW] a working ROP chain: 4 self-chaining strb gadgets write R0P! to the comm...user
2026-10-07[HW] full stack pivot into the command buffer: arbitrary ROP confirmed, repor...user
2026-10-07RETRACT Addenda C/D: it was a hit. One-invoke arbitrary chosen PC, confirmed ...user
2026-10-07[HW] isolated per-slot writes refute the saved-LR route: Addendum B closed as...user
2026-10-07[HW] saved-LR shot is a negative across [0x41bf90,0x41bfd8): stack is hit, no...user
2026-10-07[HW] FE0A selector 4: a GCP write with BOTH content and destination host-chos...user
2026-10-07[HW] FE0A selector 8 confirmed on silicon: the store is real and host-aimed, ...user
2026-10-07LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed...user
2026-10-02FE09's displacement names any 32-bit address: the limit is page permissions, ...user
2026-10-02the out-of-allocation write reach scales with the declared length: 516 KiB co...user
2026-10-02LOAD_TA never validates cmd_buf_len against the allocation: TA output lands o...user
2026-10-02close the FE09 escalation question: negative displacements abort at the same ...user
2026-10-02correct the FE09 finding: it is an out-of-bounds write, with the faulting PC ...user
2026-10-02fault-oracle sweep of the never-covered TAs: ~4,237 cases, 0 faults, 6 new hangsuser
2026-10-02fuzz GCP's real command space with the PSP fault oracle: 1,345 cases, no corr...user
2026-10-02test the XGMI 0x1061 lead on hardware for the first time: blocked at the XGMI...user
2026-10-02GCP FE09 ConfigureInitialize: host-chosen write offset, confirmed on silicon,...user
2026-10-01confirm on silicon: RAS's missing length check is a host-triggerable persiste...user
2026-09-30close the last avenue the rollback opened: no extra applications loaduser
2026-09-30confirm whole-set rollback with the processor's own version registeruser
2026-09-30finding: the bootloader accepts an older signed system driver, with no versio...user
2026-09-30close the runtime bootloader question: component loads are refused after bootuser
2026-09-30finding: the processor's bootloader command interface is still live after bootuser
2026-09-30record the interrupt-ring-set probe as vacuous rather than as a passing checkuser
2026-09-30enumerate the ring control command space: all ids inertuser
2026-09-30finding: the ring base is accepted misaligned and then wedges on first submituser
2026-09-30close the ring index: bounded, and handled gracefullyuser
2026-09-30close the last ring-frame field and publish the complete field mapuser
2026-09-30characterise the vmid fault and rule out two explanations by measurementuser
2026-09-30finding: the ring frame's vmid byte is host-controlled, propagated into the p...user
2026-09-30finding: the ring frame's fence address is not range-checked, unlike the comm...user
2026-09-30hundred-and-seventeenth pass: image and command-buffer aliasing is handleduser
2026-09-30hundred-and-sixteenth pass: loader class confusion is correctly handleduser
2026-09-30hundred-and-fifteenth pass: sweep the driver-class load path across all corpu...user
2026-09-30hundred-and-fourteenth pass: close the last acknowledged weak spot in coverageuser
2026-09-30index the hardware probes so they are discoverable and usableuser
2026-09-30hundred-and-thirteenth pass: multi-session stateful fuzz with slot recyclinguser
2026-09-30hundred-and-twelfth pass: stateful sequence fuzz closes the weakest axisuser
2026-09-30hundred-and-eleventh pass: multi-field mutations across the full windowuser
2026-09-30hundred-and-tenth pass: full-resolution sweep of the entire shared bufferuser
2026-09-30hundred-and-ninth pass: full-resolution sweep of the load command structureuser
2026-09-30hundred-and-eighth pass: characterise the one validated field in the invoke s...user
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-05 21:10:01 +0000 — sl0p fork