6 Commits

Include renames

Author	SHA1	Message	Date
JBJF	1cab5b2428	SPTM: confirm IOGPU/IOUAT user path on final 27.2 v6x-pandia	2026-10-31 17:50:19 +08:00
JBJF	c7d4043a8c	SPTM: MTE SK tag-page check is a PA-range gate; alias mapping does not bypass it	2026-10-31 17:35:59 +08:00
JBJF	bdb029bb37	SPTM: 27.2 TLBI verification is DeviceTree-gated and the gate is absent on iPhone19,7 ... - parser at 0xfffffff0270cbe18 sets the verify flag to 0 when /arm-io/sgx lacks verify-gmmu-tlbis-at-sync - BuildManifest maps iPhone19,7 -> v64sap; that DT lacks the key, as do iBoot, AGX and the kernelcache; only SPTM contains the strings - consequence: the GMMU TLBI completion window remains open on iPhone 27.2 (fix-gating gap, not a new memory-safety bug)	2026-10-31 17:30:36 +08:00
JBJF	0288f2e3ae	SPTM/MIE: hardware verification plans for GMMU TLBI race and tag-storage aliasing	2026-10-31 17:19:13 +08:00
JBJF	f14f7df318	SPTM: function-level TLBI evidence (369 vs 264 insns, added completion wait)	2026-10-31 17:18:14 +08:00
JBJF	09a02858f6	SPTM/MIE deep dive: sptm.t8160 820.22 -> 820.40.24 (+64 KiB) ... - docs/SPTM-MIE-27.2.md: separate SPTM firmware changed (kernel __DATA_SPTM is not the monitor); new DART GAPF race, GMMU TLBI verification, iommu refcount, Dekker locks, hibernation handoff/latch checks; TXM build-only; Exclave +229 KB; MIE SK tag-page check unchanged (210 insns, relocated) - candidate directions: DART unganged-GAPF race, hibernation handoff page count, SK tag-page aliasing, dangling tag storage; no working bypass - correct the earlier claim that SPTM was unchanged - tools: fw_diff, string_xref, func_string_diff	2026-10-31 17:14:56 +08:00