# Newly opened firmware: SDMA, RLC, IMU — all plaintext, all host-adjacent

Extracted from the pinned linux-firmware cache (commit `0a6871b1`) into
`psp_out/`. None of these had ever been opened in this project.

| blob | size | entropy | verdict |
|---|---|---|---|
| `sdma_6_0_0.bin` | 34560 | 4.895 | **plaintext** |
| `sdma_prev.bin` (prior build) | 34560 | 4.809 | **plaintext** — diffable |
| `gc_11_0_0_rlc.bin` | 185376 | 4.958 | **plaintext** |
| `gc_11_0_0_imu.bin` | 132352 | 2.019 | **plaintext**, highly structured |

Compare: `vcn_4_0_0.bin` is 7.146 (encrypted, closed — see prior turn).

## SDMA structure
`common_firmware_header` (256 B) then a `$PS1` container at body+16 declaring
size `0x4200`. Code region is body `0x800 … 0x6900`; the tail is zero-filled.

## ISA: AMD proprietary F32, not any standard architecture
Capstone coverage on the code region:

    arm-le 0%   arm-be 1%   mips32 5%   ppc 2%   sparc 1%   riscv32/64 0%

So it is **not** RV64 (unlike MEC, which decoded cleanly). Structural evidence
for a fixed-width 32-bit proprietary encoding:

* 6208 code dwords, 135 distinct top bytes, 54 distinct `bits31:26` opcodes
* `0x90000000` appears 125x — almost certainly NOP
* recurring forms `0x7c414001`, `0x25540001`, `0x7c418001`, `0x04140001`

This is AMD's "F32" microengine ISA used by the CP/SDMA cores. There is no
public disassembler and no IDA processor module for it.

## Why this matters, and why it is not a quick win
SDMA and RLC both parse **host-written** data:
* SDMA consumes host ring packets (copy/fill/PTE-update opcodes) — a genuine
  host-reachable parser surface.
* RLC mediates **RLCG register access**, i.e. it is the arbiter that decides
  which registers a requester may touch. A flaw there is a privilege boundary
  flaw, which makes it the most security-relevant of the three.

But: deriving the F32 ISA from scratch is a substantial project on its own, and
by the same argument already established for MEC, **neither SDMA nor RLC can
reach MP0/PSP** — their register windows and DMA are GPUVM/aperture-confined.
So this surface is real and unexplored, but it is *not* a path to the PSP, which
is the stated objective of this project.

Recorded as available surface, not as a claimed finding.