95 lines
4.0 KiB
Markdown
95 lines
4.0 KiB
Markdown
# Firmware 9.60 probe transfer and one-time execution package
|
|
|
|
Status: **BLOCKED — do not transfer and do not execute**.
|
|
|
|
This is the separate review package requested after the offline build. It is
|
|
not an authorization request because the current artifact cannot satisfy the
|
|
project's no-kernel-change boundary.
|
|
|
|
## Bound artifact
|
|
|
|
- Filename:
|
|
`chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
|
|
- SHA-256:
|
|
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
|
|
- Size: 110424 bytes
|
|
- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
|
|
- Firmware build gate: exact `9.60`
|
|
- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
|
|
- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
|
|
- Transfer / execution recorded: false / false
|
|
- Execution eligible: false
|
|
- Permanent denylist: `manifests/artifact-denylist.json`
|
|
|
|
## Intended one-time project action
|
|
|
|
If a future replacement artifact closes every blocker, the first action would
|
|
be a single manual, foreground capability probe with application arguments:
|
|
|
|
```text
|
|
--firmware 9.60 --acknowledge-read-only-probe
|
|
```
|
|
|
|
Project code would open the candidate GNM module, perform exactly 21 `dlsym`
|
|
lookups, log names plus booleans, call none of the returned addresses, and
|
|
attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
|
|
draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
|
|
There would be no retry or automatic boot path.
|
|
|
|
## APIs and side effects under review
|
|
|
|
Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
|
|
`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
|
|
`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
|
|
`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
|
|
`chimera_gfx_status_string`.
|
|
|
|
Pinned SDK transitive path includes `__patch_init`, kernel credential and
|
|
syscall-permission writes, rtld initialization, possible
|
|
`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
|
|
metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
|
|
audited path is in the evidence document.
|
|
|
|
## Blocking findings
|
|
|
|
1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
|
|
gate cannot prevent them.
|
|
2. No bounded/cancellable loader API or safe external supervisor has been
|
|
proven. A hang can prevent cleanup.
|
|
3. Module start/stop internals on firmware 9.60 are unknown.
|
|
4. The gate trusts a supplied string and does not attest firmware.
|
|
5. Runtime delivery of the required four arguments has not been observed.
|
|
|
|
Likely failure outcomes range from a clean refusal or loader error to a payload
|
|
crash, persistent loaded-module/process state, or a console restart. GPU/display
|
|
effects are not requested, but driver-internal effects cannot be ruled out.
|
|
|
|
## Timeout, cleanup, and recovery status
|
|
|
|
No safe timeout or forced-cancellation procedure exists for this artifact.
|
|
Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
|
|
restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
|
|
recovery procedure is approved.
|
|
|
|
## Approval checklist
|
|
|
|
- [x] Offline artifact hash and source commit recorded
|
|
- [x] Full imports and call chain audited
|
|
- [x] VideoOut/Phase-1 excluded from the build
|
|
- [ ] Public, kernelwrite-free startup/loader path proven
|
|
- [ ] Replacement artifact built and newly hashed
|
|
- [ ] Firmware attestation and argument delivery proven
|
|
- [ ] Bounded timeout and cleanup/recovery proven
|
|
- [ ] New artifact-specific transfer approval
|
|
- [ ] New artifact-specific one-time execution approval
|
|
|
|
## Permission text
|
|
|
|
There is deliberately **no valid permission text for this hash**. Generic or
|
|
future approval must not be interpreted as authorization for it. After the
|
|
blockers are closed, a newly named and newly hashed replacement needs a new
|
|
package and an exact permission sentence that names that replacement hash.
|
|
|
|
ADR-0009 makes this hash permanently ineligible; closing future startup
|
|
blockers cannot rehabilitate these bytes.
|