1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
# Newly opened firmware: SDMA, RLC, IMU — all plaintext, all host-adjacent
Extracted from the pinned linux-firmware cache (commit `0a6871b1`) into
`psp_out/`. None of these had ever been opened in this project.
| blob | size | entropy | verdict |
|---|---|---|---|
| `sdma_6_0_0.bin` | 34560 | 4.895 | **plaintext** |
| `sdma_prev.bin` (prior build) | 34560 | 4.809 | **plaintext** — diffable |
| `gc_11_0_0_rlc.bin` | 185376 | 4.958 | **plaintext** |
| `gc_11_0_0_imu.bin` | 132352 | 2.019 | **plaintext**, highly structured |
Compare: `vcn_4_0_0.bin` is 7.146 (encrypted, closed — see prior turn).
## SDMA structure
`common_firmware_header` (256 B) then a `$PS1` container at body+16 declaring
size `0x4200`. Code region is body `0x800 … 0x6900`; the tail is zero-filled.
## ISA: AMD proprietary F32, not any standard architecture
Capstone coverage on the code region:
arm-le 0% arm-be 1% mips32 5% ppc 2% sparc 1% riscv32/64 0%
So it is **not** RV64 (unlike MEC, which decoded cleanly). Structural evidence
for a fixed-width 32-bit proprietary encoding:
* 6208 code dwords, 135 distinct top bytes, 54 distinct `bits31:26` opcodes
* `0x90000000` appears 125x — almost certainly NOP
* recurring forms `0x7c414001`, `0x25540001`, `0x7c418001`, `0x04140001`
This is AMD's "F32" microengine ISA used by the CP/SDMA cores. There is no
public disassembler and no IDA processor module for it.
## Why this matters, and why it is not a quick win
SDMA and RLC both parse **host-written** data:
* SDMA consumes host ring packets (copy/fill/PTE-update opcodes) — a genuine
host-reachable parser surface.
* RLC mediates **RLCG register access**, i.e. it is the arbiter that decides
which registers a requester may touch. A flaw there is a privilege boundary
flaw, which makes it the most security-relevant of the three.
But: deriving the F32 ISA from scratch is a substantial project on its own, and
by the same argument already established for MEC, **neither SDMA nor RLC can
reach MP0/PSP** — their register windows and DMA are GPUVM/aperture-confined.
So this surface is real and unexplored, but it is *not* a path to the PSP, which
is the stated objective of this project.
Recorded as available surface, not as a claimed finding.
|
