Files
chimera-gfx-Public/docs/adr/0011-phase07-hardened-controlled-runtime.md
T
Chimera GFX release export a6037502d7
phase0-ci / build-and-audit (push) Successful in 2m14s
Publish Chimera GFX source
2026-09-03 03:27:14 +02:00

2.1 KiB

ADR-0011: Phase-0.7 hardened controlled runtime

  • Status: accepted for offline deployment preparation
  • Date: 2026-07-17
  • Decision: READY_FOR_HARDENED_RUNTIME_DEPLOYMENT

Context

Phase 0.6 identified exact upstream loader and Payload Manager versions but found unbounded ptrace completion, incomplete credential restoration, missing reaping/watchdog behavior, and a path-based unhashed launch route. Those findings were implementation inputs, not permanent platform blockers.

Jens explicitly confirmed exact firmware 9.60. Independent device attestation is therefore not a Phase-0.7 blocker. The controlled upload below /data/pldmgr/payloads/chimera-controlled is an allowed, removable application write and is not a firmware write.

Decision

Use private GPL-3.0 hardening forks based on:

  • elfldr 699e8bcff03e91e8d6ca6eba281af25c5a58d8c2;
  • Payload Manager cfbc70f30f419b09bf2b52283f7409e2d3117ee1;
  • PS5 Payload SDK d2e2e585740362976a39fdd5ccf390f199a7bc37.

The controlled route is a versioned loopback-only protocol with exact firmware, artifact ID, size, SHA-256, timeout, and no-retry metadata. elfldr rehashes received bytes, enforces the permanent denylist, applies bounded ptrace steps and cleanup, and reaps the child through a two-second watchdog. The controlled manager is compiled for one exact lifecycle artifact and opens, hashes, rewinds, and streams one no-follow file descriptor.

The lifecycle probe uses normal SDK v0.41 startup, performs one sceKernelSendNotificationRequest, and calls _exit; it does not return through payload_terminate.

Consequences

The three ELFs are eligible for a later, separately authorized hardened runtime installation. This decision does not authorize installation, transfer, or execution. The previously blocked SHA-256 4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63 remains permanently denied.

Normal SDK startup still reaches documented process-local patch and runtime initialization. The existing elfldr bootstrap still enables volatile QA flags. Both facts are explicit expected runtime effects; neither is silently claimed kernelwrite-free.