vestigia, branch HEAD

merge impl/darwin: the executable built on darwin

2026-10-31T10:15:00Z

commit d1ba0f13fc50033002a28370dbb88a004e64c645 parent cff3978264d31bf45b063e144875fa8daa25eff8 Author: Jared Tobin Date: Sat, 31 Oct 2026 14:15:00 +0400 merge impl/darwin: the executable built on darwin Setup builds the executable in dist/build/vestigia, which a case-insensitive filesystem merges with the library's dist/build/Vestigia. Clang's preprocessor flagged the case mismatch in Paths_vestigia's include path, and -Werror made it fatal, so the flake failed to build on darwin. The executable now passes -Wno-nonportable-include-path to the preprocessor on darwin only. Tested on aarch64-darwin: the flake builds and all 46 tests pass.

cabal: build the executable on darwin

2026-10-31T10:15:00Z

commit c9e26d4b4f02155483cd603bcd141c1d9a168119 parent cff3978264d31bf45b063e144875fa8daa25eff8 Author: Jared Tobin Date: Sat, 31 Oct 2026 14:15:00 +0400 cabal: build the executable on darwin

misc: bounds, docs badge

2026-10-31T10:09:21Z

commit cff3978264d31bf45b063e144875fa8daa25eff8 parent 55d04c6faf8638efff157778993fed022cf4240c Author: Jared Tobin Date: Sat, 31 Oct 2026 14:09:21 +0400 misc: bounds, docs badge

readme: tweak

2026-10-31T09:51:07Z

commit 55d04c6faf8638efff157778993fed022cf4240c parent 13cb016c38aa7391ec85013a7c78e008581b969e Author: Jared Tobin Date: Sat, 31 Oct 2026 13:51:07 +0400 readme: tweak

release: v0.2.0

2026-10-31T09:23:20Z

commit 13cb016c38aa7391ec85013a7c78e008581b969e parent 87dfbfa3744d0903c988918f841aff3e48719dff Author: Jared Tobin Date: Sat, 31 Oct 2026 13:23:20 +0400 release: v0.2.0

merge impl/cpu-models: a CPU model for QEMU to emulate

2026-10-31T09:22:12Z

commit 87dfbfa3744d0903c988918f841aff3e48719dff parent c6911c285ec337df8733870c7e5c434aceb1ea26 Author: Jared Tobin Date: Sat, 31 Oct 2026 13:22:12 +0400 merge impl/cpu-models: a CPU model for QEMU to emulate record --cpu MODEL has QEMU emulate MODEL (its -cpu) and records it in the dump; diff refuses runs recorded on other models and names the model in its report; diffOf takes cpu. QEMU's AArch64 models take crypto=off (qemu-crypto.patch), removing the cryptographic extension as a CPU without it reports.

merge impl/object-paths: objects resolved to the files they name

2026-10-31T09:22:12Z

commit c6911c285ec337df8733870c7e5c434aceb1ea26 parent 83a5e59a7681a797cd5315696d88f163c43dfbad Author: Jared Tobin Date: Sat, 31 Oct 2026 13:22:12 +0400 merge impl/object-paths: objects resolved to the files they name read resolves the objects a harness reports to the files they name, as memcheck names a frame's object, so a library linked by soname has its sites placed by offset.

record: a CPU model for QEMU to emulate

2026-10-30T18:19:38Z

commit 7396cbfed0475215df3399ed3c660aba615323c5 parent 70a30ecfce7bf56a2deed0510e93d8aefbfab62e Author: Jared Tobin Date: Fri, 30 Oct 2026 22:19:38 +0400 record: a CPU model for QEMU to emulate A harness choosing its code by the CPU's features runs the code the emulated CPU leads it to, and QEMU's default model is no CPU in the field (on x86_64 an AMD of family 6 with AES-NI). record --cpu MODEL passes MODEL to QEMU as -cpu, properties and all, and appends it to the dump's record (P); diff refuses runs recorded on other models, as it refuses runs under other contracts, and names the model in its report; diffOf takes it as cpu. No QEMU Arm model can be told to lack the cryptographic extension, which a Raspberry Pi 4's Cortex-A72 lacks: qemu-crypto.patch gives every AArch64 model crypto=off, which clears the extension's ID register fields, so the instructions UNDEF and HWCAP and ID register reads say they are absent.

read: objects resolved to the files they name

2026-10-30T14:35:40Z

commit 70a30ecfce7bf56a2deed0510e93d8aefbfab62e parent 83a5e59a7681a797cd5315696d88f163c43dfbad Author: Jared Tobin Date: Fri, 30 Oct 2026 18:35:40 +0400 read: objects resolved to the files they name A harness reports each object as its loader reached it, which for a library linked by soname is the soname's link (libfoo.so.1), while memcheck names a frame's object by the file the link leads to (libfoo.so.1.2.3). Neither the path nor the file name matched, so every site in such a library went without an offset, and a consumer placing sites by offset could not place it. read resolves the reported paths before locating frames; one that names nothing where read runs is kept as reported.

readme: update

2026-10-27T16:31:40Z

commit 83a5e59a7681a797cd5315696d88f163c43dfbad parent fa5ed7309389266d7f1f60f354fcbf68aef320f3 Author: Jared Tobin Date: Tue, 27 Oct 2026 20:31:40 +0400 readme: update

merge impl/watch-once: the watch list made once per comparison

2026-10-27T08:00:16Z

commit fa5ed7309389266d7f1f60f354fcbf68aef320f3 parent 628e38440d5b27024c7bfaa7720117f8be29d69d Author: Jared Tobin Date: Tue, 27 Oct 2026 12:00:16 +0400 merge impl/watch-once: the watch list made once per comparison vestigia watch writes the list of instructions outside the contract for a program, and record --contract NAME --watch FILE reads it, so the runs of one comparison share it rather than each disassembling and classifying the objects under audit again. diffOf lists it once, kept in its output as watch.

watch: list what lies outside the contract once, for every run

2026-10-27T08:00:16Z

commit f036a025212aa897e86f97b4036534a6318e5687 parent 628e38440d5b27024c7bfaa7720117f8be29d69d Author: Jared Tobin Date: Tue, 27 Oct 2026 12:00:16 +0400 watch: list what lies outside the contract once, for every run Making the watch list reads every object under audit, which costs more than recording a short run. vestigia watch writes it, record --watch reads it, and diffOf lists it once, kept as watch, for all its runs.

merge impl/contract: data-independent-timing contracts

2026-10-27T07:19:14Z

commit 628e38440d5b27024c7bfaa7720117f8be29d69d parent 80b530d9bc9977e9f8e14174ef86a9fefbe64bf0 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:14 +0400 merge impl/contract: data-independent-timing contracts record --contract arm-dit or intel-doitm has the plugin fingerprint the operands of every instruction outside the ISA's contract in the objects --object names, as it does a division's. The tables are generated from the vendors' statements: Arm's A64 ISA XML (2022-12), every encoding with its source registers, and Intel's list 768547 (2026-02-23). diff reports such an instruction run on other operands under outside, apart from the origins: the contract says nothing of its time either way, so it qualifies a report rather than failing it. A division stays an operand origin. The report (vestigia/diff-v4) names the ISA and the contract and counts what ran outside it; runs recorded under other contracts are refused. The probe divides its secret in floating point and checks each ISA's contract finds it.

readme, changelog: data-independent-timing contracts

2026-10-27T07:19:04Z

commit b0630194cc5c11d1a0c84867a89ffca9f5e00cc6 parent 8a8465281e50c54f7930b0e7e029882790b78776 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:04 +0400 readme, changelog: data-independent-timing contracts

nix: diffOf under a contract, and the probe's floating-point division

2026-10-27T07:19:04Z

commit 8a8465281e50c54f7930b0e7e029882790b78776 parent dd561dc3aeea8b244fe48229f71e8d6033499e75 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:04 +0400 nix: diffOf under a contract, and the probe's floating-point division diffOf takes a contract, and the command finds llvm-objdump through VESTIGIA_OBJDUMP. The probe divides its secret in floating point, outside either contract, and checks each differential trace under its ISA's contract finds it there and nothing more.

record, diff: instructions outside the contract, reported apart

2026-10-27T07:19:03Z

commit dd561dc3aeea8b244fe48229f71e8d6033499e75 parent f6057154d6ff7290f382fba8a9a7cec97af509a8 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:03 +0400 record, diff: instructions outside the contract, reported apart record --contract writes the watch list for the objects the program loads that --object names, and appends the guest's ISA and the contract to its dump. diff reports an instruction outside the contract run equally often on other operands under outside, apart from the origins, with how many such instructions ran (vestigia/diff-v4), and refuses runs recorded under other contracts.

plugin: fingerprint the operands of what a watch list names

2026-10-27T07:19:03Z

commit f6057154d6ff7290f382fba8a9a7cec97af509a8 parent 6a14fae8f2feb8c177fe6cfc3c0d122494f893b5 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:03 +0400 plugin: fingerprint the operands of what a watch list names Given watch=FILE, an instruction outside the contract, by its object and address there, has the registers the list names fingerprinted before it runs, and any value it accesses, as a division's operands are; its dump gives U and W lines. A CPU with SVE names its SIMD&FP registers by their scalable views.

contract: Arm's DIT and Intel's DOITM, and what each makes of an instruction

2026-10-27T07:19:03Z

commit 6a14fae8f2feb8c177fe6cfc3c0d122494f893b5 parent 80b530d9bc9977e9f8e14174ef86a9fefbe64bf0 Author: Jared Tobin Date: Tue, 27 Oct 2026 11:19:03 +0400 contract: Arm's DIT and Intel's DOITM, and what each makes of an instruction The tables are generated from the vendors' own statements: every A64 encoding outside SVE and SME from Arm's A64 ISA XML (2022-12), with its fixed bits and source registers, and the rows of Intel's list 768547 (2026-02-23). An instruction read from llvm-objdump is covered, control flow or system, a division, or outside the contract with the registers it reads; the last make the plugin's watch list.

release: v0.1.0

2026-10-22T04:07:04Z

commit 80b530d9bc9977e9f8e14174ef86a9fefbe64bf0 parent 104efd26339a2471d68d9820cf7417a2ff1d9b0e Author: Jared Tobin Date: Thu, 22 Oct 2026 08:07:04 +0400 release: v0.1.0

merge impl/gaps: the gaps a review found, closed

2026-10-21T07:03:16Z

commit 104efd26339a2471d68d9820cf7417a2ff1d9b0e parent 9113a280893f9493a01519d7af1510dbc4a36f62 Author: Jared Tobin Date: Wed, 21 Oct 2026 11:03:16 +0400 merge impl/gaps: the gaps a review found, closed - checks: a probe harness (etc/probe/harness.c) under both instruments, and built for aarch64 differentially on an x86_64 host, each report held to exactly what the harness does (checks..probe, on Linux). - plugin: an instruction named by its address in its object, from the file's program headers, not its file offset; a GHC harness linked at a fixed address had every origin unnamed. - plugin: a guest that starts a second thread is stopped and its dump refused, rather than recorded by threads racing on unlocked state. - record: the run's arguments, environment size, and exit status appended to its dump; diff refuses runs of another program or with arguments or an environment of another size than the first run's, and a control that does not repeat the first run's arguments. diff-v3 lists each run with its arguments and status. - record: QEMU chosen by the harness's ELF machine, so an aarch64 harness traces on an x86_64 builder. - diff: a return is downstream, never an origin (Penumbra's `retq` origins, four or five a root, gone and nothing else). - diff and memcheck: an integer division on other operands, or on an undefined one, is an `operand` origin or site (the plugin reads the operands; nix/memcheck-operand.patch adds UninitOperand), and memcheck keeps the instruction pointer exact at every instruction so a register division is named where it divides. - trace: taint over every run, merged (run --dir, read RUN..., trace-v2, traceOf's runs), each site with the runs that reached it. - symbol: LLVM's addr2line, which names inlined frames by their own functions and code no symbol covers by none; legacy Rust names unescaped. - diff: each origin with the calls that reached it, from a shadow call stack in the plugin, as `stacks` shaped as a taint report's. - README and CHANGELOG say what changed, and the caveats left: an address a secret branch moved, other variable-time instructions, GHC's calls and returns by jumping. Built and tested on pollux: the probe check, the unit suite, and the Penumbra, poly1305, and secp256k1 spikes.

readme, changelog: the gaps closed, and the caveats left

2026-10-21T06:42:15Z

commit eb4aa5947f7848b4eb9c54965468a3fe4a107ec8 parent 806a148127eee54b9b2fc5f7e3f68e3147300439 Author: Jared Tobin Date: Wed, 21 Oct 2026 10:42:15 +0400 readme, changelog: the gaps closed, and the caveats left The README says what the probe check is and how to run it, gives the caveats the branch leaves open (an address origin may be an address a secret branch moved; only divisions are read for operands; GHC's calls and returns are jumps), and the CHANGELOG's entry for 0.1.0 is regrouped by command now that it says more.

diff: each origin with the calls that reached it

2026-10-21T06:41:07Z

commit 806a148127eee54b9b2fc5f7e3f68e3147300439 parent 5ee48803f1f90d28d65229525953692310b59771 Author: Jared Tobin Date: Wed, 21 Oct 2026 10:41:07 +0400 diff: each origin with the calls that reached it memcheck gives a site its callers, out to the root, but an origin the differential trace alone saw (one downstream of a secret branch, which memcheck's taint does not follow) had only the inline chain at its own address, so a reader of it saw the function it was in and not who called that. The plugin now marks calls too (x86_64's CALL rel32 and CALL r/m, aarch64's BL, BLR, and their authenticated forms) and keeps a shadow stack of the calls in progress: a call pushes its return address and enters the context made by it in the current one; a return pops to the innermost call returning where it went, and leaves the stack as it is where none does. Each instruction that could be an origin (one ending a translation block, as every branch does, one touching memory, or a division) keeps the contexts it ran in, sixteen at most, saying where it ran in more; a call site caches the context it last made, and an instruction past its sixteen stops looking. The dump gives the contexts (C lines) and each instruction's (K lines). diff resolves an origin's contexts in the declared and designed runs into chains of calls, each named by its object and address there (24 at most, as memcheck keeps), and reports their distinct chains, sixteen at most, as the origin's `stacks`: its own frames then each call's, innermost first, each frame with the object and address it names, as a taint report's stacks are, beside `partial` where more were seen. GHC calls by jumping, so a GHC origin's stack is its own frames alone. On pollux Penumbra's origins reach out to main through the audited library (hashbrown's get_inner through sqrt_ratio_zeta and vartime_compress to public_key), and a root's diff takes about a quarter longer. The probe check holds each origin's stack, on x86_64 and aarch64, to the call in main that reached it.

symbol: LLVM's addr2line, which names what it can and no more

2026-10-21T06:15:23Z

commit 5ee48803f1f90d28d65229525953692310b59771 parent 93e98d61cb94ee92bb02ba7a555a15405bdebefd Author: Jared Tobin Date: Wed, 21 Oct 2026 10:15:23 +0400 symbol: LLVM's addr2line, which names what it can and no more With instructions now named by their addresses in their objects, binutils' addr2line named the origins in the spikes' GHC harnesses, but wrongly: code with no debug information was given the name of the nearest function symbol before it, vestigia_public, whatever lay between. And for an inlined instruction it gave the innermost frame the name of the function it was inlined into, beside the inlined function's own line: Penumbra's origin at 0xe9d6 read vartime_compress_to_field at sign.rs:11, a line of abs. LLVM's addr2line names an address no symbol covers by none, as memcheck does, and each inlined frame by its own function; it reads either ISA's objects too, so the wrapper bakes it in where binutils for all targets was. It leaves a legacy Rust symbol as an Itanium demangler does, its `$LT$`-style escapes and hash in place, so Vestigia.Symbol undoes them as rustc-demangle would (rustLegacy). On pollux, the poly1305 spike's GHC origins now read `?`, as memcheck's own sites there do, and Penumbra's innermost frames name the inlined functions the lines are in. Synthesis keys a line by the symbol its disassembly encloses it in, not by this name.

spikes: traceOf given its runs

2026-10-21T05:47:01Z

commit 93e98d61cb94ee92bb02ba7a555a15405bdebefd parent 6f6de0af575252d584a009333475ff3a19df7aa3 Author: Jared Tobin Date: Wed, 21 Oct 2026 09:47:01 +0400 spikes: traceOf given its runs traceOf takes a list of runs; each spike's trace is the one run it was.

trace: taint over every run, merged

2026-10-21T05:46:34Z

commit 6f6de0af575252d584a009333475ff3a19df7aa3 parent 5570e76dd4246b6fd6eb59a9091ddb6a347cfd23 Author: Jared Tobin Date: Wed, 21 Oct 2026 09:46:34 +0400 trace: taint over every run, merged memcheck sees the path a run takes, and traceOf ran the harness on one secret, so a site on a path another secret took, a designed one especially, was seen by neither instrument when the differential trace saw it only as downstream of a branch. synthesis's TRACES.md names it a follow-up. `vestigia run --dir DIR` keeps a run: memcheck's XML, the objects the harness's first mark wrote, and the harness's exit status (it replaces --xml). `vestigia read` takes several such runs, or memcheck XML files made elsewhere, and reports on them as one: a site is one instruction and class, named by its address in its object where the run's objects say, so that runs loading an object apart agree on it, with its count over every run and the runs that reached it. A kept run that marked no secret is refused, as `run` refuses it. The report becomes vestigia/trace-v2: `runs` gives each run's command, exit, valgrind, and objects, in place of the top-level fields; each site lists its runs, and each unrelated error or fault names its run. traceOf takes `runs`, a list of argument lists as diffOf's is, keeps each run as run-K, and reads them together. The probe harness gains a table index on a path the third secret alone takes; the check finds it under taint, in that run alone.

memcheck: a division's undefined operand reported, at its instruction

2026-10-21T05:37:20Z

commit 5570e76dd4246b6fd6eb59a9091ddb6a347cfd23 parent cc5c97fb59c911df9f6727b21cb6e29df071f70a Author: Jared Tobin Date: Wed, 21 Oct 2026 09:37:20 +0400 memcheck: a division's undefined operand reported, at its instruction memcheck propagates an undefined operand into a division's quotient and says nothing, so a taint run missed a division of or by a secret as the differential one did until the last commit. nix/memcheck-operand.patch, applied to the valgrind vestigia runs, adds an error kind, UninitOperand ("Integer division depends on uninitialised value(s)"), with its origin tracked, and reports it for each undefined operand of every integer division VEX lifts guest code to: x86_64's DIV and IDIV, aarch64's UDIV and SDIV, and the rest. Unlike memcheck's checks before an address or a branch, it leaves the operands undefined after reporting them, so what is reported downstream is as it was. Vestigia.Trace reads a client-request UninitOperand as an `operand` site. memcheck keeps the instruction pointer exact only where an instruction touches memory, by default, so a division by a register was reported at the memory access before it. `run` now passes --px-file-backed=allregs-at-each-insn, which keeps every register exact at each instruction of the program's own code, so such a site is named by its own address. The probe check finds both divisions under taint and holds them to the addresses the differential trace gives.

diff: a division on other operands is an operand origin

2026-10-21T05:23:56Z

commit cc5c97fb59c911df9f6727b21cb6e29df071f70a parent e6ba0a8ba439af99443ca053df69b96a4ae16e23 Author: Jared Tobin Date: Wed, 21 Oct 2026 09:23:56 +0400 diff: a division on other operands is an operand origin An integer division takes a time that depends on its operands on most processors, so a division of or by a secret leaks it, as KyberSlash showed of Kyber's reference code. Neither instrument saw one: the plugin recorded where instructions branched and what they addressed, not what they computed on, and memcheck lets an undefined operand flow into the quotient without a word. synthesis judges a traced function by its trace, and substratum proves no division secret, so such a leak was left to censor alone. The plugin now decodes x86_64's DIV and IDIV and aarch64's UDIV and SDIV at translation, and for each keeps an order-sensitive fingerprint of the values it divided: before it runs, the dividend (AX, or DX:AX to RDX:RAX, by width) and a register divisor, read through QEMU's register interface, masked to the width; a divisor in memory as it is loaded, through the value QEMU reports for the access. A D line gives each division's fingerprint. diff reports a division run equally often in every declared run, on other operands in one, as an `operand` origin, grouped by the runs alike there; a control dividing other operands sets it apart as unsteady, and a designed run speaks to it no more than to an address. The probe harness divides a secret by a public modulus, the divisor in a register, and a public value by a secret, the divisor read from memory; the check finds both, on x86_64 and on aarch64, and fails without the memory path.

diff: a return is downstream, never an origin

2026-10-21T05:15:00Z

commit e6ba0a8ba439af99443ca053df69b96a4ae16e23 parent 32a90ed1c2548dfe6e6bb9368fbf484bfd544cdf Author: Jared Tobin Date: Wed, 21 Oct 2026 09:15:00 +0400 diff: a return is downstream, never an origin A return goes where the call before it sent it. When control diverges before a function is called, from one site in one run and another in the next, the function's return takes its targets in other proportions or another order, and diff reported it as a control origin, in the callee, away from the branch that chose. On the Penumbra spike four or five of each root's 23 to 27 control origins were `retq`. The plugin now reads each instruction's bytes at translation and marks the returns, x86_64's RET and aarch64's RET, RETAA, and RETAB, with an R line. diff counts a return whose transfers differ as downstream, whether or not it ran as often in every run, and never as an origin. GHC returns to a continuation by an indirect jump, which is not marked and stays an origin where its targets differ. The probe harness gains a helper called from two sites the secret chooses between; with the returns unmarked, the check fails on a control origin in the helper.

record: QEMU chosen by the harness's architecture

2026-10-21T05:08:36Z

commit 32a90ed1c2548dfe6e6bb9368fbf484bfd544cdf parent 164ae07e7fb7c0ebb37c7cfdce5662bf1eac4130 Author: Jared Tobin Date: Wed, 21 Oct 2026 09:08:36 +0400 record: QEMU chosen by the harness's architecture record ran the QEMU for the host's ISA ($VESTIGIA_QEMU, which the wrapper set to the host's), though the QEMU vestigia builds runs both x86_64 and aarch64 guests, so an aarch64 harness could not be traced on an x86_64 builder without --qemu. And addr2line was binutils for the host alone, which cannot read another ISA's objects, so such a trace's origins would have come back unnamed. record now reads the program's ELF header and runs the QEMU for its machine: --qemu, else $VESTIGIA_QEMU_X86_64 or $VESTIGIA_QEMU_AARCH64, which the wrapper sets, else qemu-x86_64 or qemu-aarch64 on PATH; a program of another kind is refused. The wrapper's addr2line is binutils for all targets. The probe check builds its harness for aarch64 as well and, on an x86_64 host, holds that harness's differential origins to the native ones, named.

record: how a run was made kept in its dump; runs made apart refused

2026-10-21T05:03:58Z

commit 164ae07e7fb7c0ebb37c7cfdce5662bf1eac4130 parent dbca2b60ce279520826d4c578fcab75e60452541 Author: Jared Tobin Date: Wed, 21 Oct 2026 09:03:58 +0400 record: how a run was made kept in its dump; runs made apart refused A dump said what the guest executed, not how the run was made, so diff could not tell runs that differ in the secret alone from runs of another program, or with a longer argument, or a larger environment, each of which lays the guest's stack out apart and so differs at every stack address; nor a control from a run repeating some other secret. Those were caveats in the README, and diffOf kept each run's exit status in a file beside its dump. record now appends to the dump, after QEMU exits, the program and its arguments (their bytes, in hex), the guest environment's variables and the bytes they take, and the exit status. diff refuses a dump without that record, a run whose program, argument count or lengths, or environment size differ from the first run's, and a control whose arguments are not the first run's, naming the run. The report becomes vestigia/diff-v3: `runs` lists each run, declared, designed, or control, with its arguments and exit status, in place of the counts. readDump reads the record whole or not at all; runApart says why two runs cannot be compared. The probe check holds the report's runs to the ones made, and diff to refusing a control of another secret and a run with a longer argument.

plugin: a guest that starts a second thread is stopped, its dump refused

2026-10-21T04:56:49Z

commit dbca2b60ce279520826d4c578fcab75e60452541 parent 9b367ba45596268931c1e3728400053b8fe333ee Author: Jared Tobin Date: Wed, 21 Oct 2026 08:56:49 +0400 plugin: a guest that starts a second thread is stopped, its dump refused The plugin's state is unlocked and its successor fingerprints follow one stream of instructions, so it records one guest thread. A guest that started another (QEMU's user mode gives each thread a vCPU) was recorded anyway, by threads racing on that state: a dump that could be wrong anywhere, or a crash. The plugin now counts vCPUs as they start. At the second, it writes a dump holding only `T 2`, says why on stderr, and exits; readDump refuses such a dump. The probe check runs a guest that starts a thread and holds record and diff to failing on it.

plugin: an instruction named by its address in its object

2026-10-21T04:53:39Z

commit 9b367ba45596268931c1e3728400053b8fe333ee parent d8e416b049070463033e5564ee2b3f88cead8a69 Author: Jared Tobin Date: Wed, 21 Oct 2026 08:53:39 +0400 plugin: an instruction named by its address in its object The plugin named an instruction by its offset in the file it was mapped from, and diff passed that offset to addr2line and reported it as the instruction's place in its object. The two coincide in the executable segments of a shared library as GNU ld lays them out, but not in an executable linked at a fixed address: a GHC harness loads at 0x400000, so its instructions' offsets named nothing, and every origin in the spikes' GHC harnesses was reported without a function. They need not coincide in a library either. At exit the plugin now reads each mapped file's program headers and writes the address its loadable segments give the instruction, which is what the file's disassembly and line tables name it by, and what a memcheck site's offset (its address less the load bias) already was. A file whose program headers cannot be read names its instructions by no object, and is said to. The probe check's harness is now linked at a fixed address; with the old plugin its origins come back unnamed and the check fails.

checks: a probe harness under both instruments, on Linux

2026-10-21T04:44:55Z

commit d8e416b049070463033e5564ee2b3f88cead8a69 parent 9113a280893f9493a01519d7af1510dbc4a36f62 Author: Jared Tobin Date: Wed, 21 Oct 2026 08:44:55 +0400 checks: a probe harness under both instruments, on Linux etc/probe/harness.c takes its secret in hex and lets it reach a loop's bound and a table index, beside a constant-time select that reaches neither. nix/probe.nix builds it, runs it under traceOf and diffOf, and holds each report's (class, function) pairs in the harness to the expected ones exactly: a site or origin missing, or one more, fails the check. The flake exposes it as checks..probe on Linux, where both instruments run.

merge impl/layout: QEMU's allocations kept off the guest's; runs laid out apart refused

2026-10-20T10:44:12Z

commit 9113a280893f9493a01519d7af1510dbc4a36f62 parent be310c5ab67061fe0913fd988a26d44934d1af4d Author: Jared Tobin Date: Tue, 20 Oct 2026 14:44:12 +0400 merge impl/layout: QEMU's allocations kept off the guest's; runs laid out apart refused - record runs QEMU with one malloc arena and large blocks taken from the heap (GLIBC_TUNABLES, set for QEMU and kept from the guest), so QEMU's own allocations no longer take the room of the guest's libraries or heap. Under load, runs of one secret had laid out apart: on pollux, six at a time, 16 of 23 runs of a secp256k1 harness and 10 of 23 of a Penumbra harness differed from the first. With the fix, the Penumbra runs all agree, and the secp256k1 runs differ only in five glibc instructions' addresses, outside the objects under audit. - diff refuses runs that loaded an object at different addresses, naming the run and the object; such runs differ wherever they touch memory, which had buried a planted table-index leak among instructions counted as downstream. - loadBases and layoutApart in Vestigia.Diff, with tests; README and CHANGELOG say what record and diff now do.

record: QEMU's allocations kept off the guest's; runs laid out apart refused

2026-10-20T10:25:17Z

commit ed38ddaac22f0684bf444a76644267647e332853 parent be310c5ab67061fe0913fd988a26d44934d1af4d Author: Jared Tobin Date: Tue, 20 Oct 2026 14:25:17 +0400 record: QEMU's allocations kept off the guest's; runs laid out apart refused QEMU in user mode maps the guest's libraries and heap in its own address space, wherever its own allocations leave room. Those vary with how its threads are scheduled: a second malloc arena, or a large block mapped rather than taken from the heap, can take the room the guest's next mapping would have had. With address randomisation off, runs of one secret still laid out apart under load. On pollux, six at a time, 16 of 23 runs of a secp256k1 harness differed from the first, some of them in every object, and 10 of 23 runs of a Penumbra harness moved their heap. Such a run differs wherever it touches memory, which buried the planted table-index leak among instructions counted as downstream, and set the instructions of a moved heap apart as unsteady. record now runs QEMU with one malloc arena and large blocks taken from the heap (GLIBC_TUNABLES, set for QEMU and kept from the guest), and the same parallel runs of the Penumbra harness then agree, 0 of 23 differing. diff refuses runs that loaded an object at different addresses, naming the run and the object, rather than reporting their differences as the secret's.

merge impl/readme-trim: the README trimmed

2026-10-20T09:21:41Z

commit be310c5ab67061fe0913fd988a26d44934d1af4d parent ea2106c74490e26a040f0f3a2bd040e78dd0df0c Author: Jared Tobin Date: Tue, 20 Oct 2026 13:21:41 +0400 merge impl/readme-trim: the README trimmed The README keeps what a user needs: marking a secret, the run, record, and diff commands with their examples, the derivations, why both instruments are run, and the caveats. The longer exposition and the implementation detail behind them are cut, and censor is linked.

readme: censor linked

2026-10-20T09:21:12Z

commit ec72f09361d8f1d78cb7de3dc7b203720ce544ac parent 2e498fe4ab06c7d1b09e53c671056b5919da6ae7 Author: Jared Tobin Date: Tue, 20 Oct 2026 13:21:12 +0400 readme: censor linked

readme: trimmed to what a user needs

2026-10-20T09:18:24Z

commit 2e498fe4ab06c7d1b09e53c671056b5919da6ae7 parent ea2106c74490e26a040f0f3a2bd040e78dd0df0c Author: Jared Tobin Date: Tue, 20 Oct 2026 13:18:24 +0400 readme: trimmed to what a user needs

merge impl/objects: a taint run kept to the objects, the version exported

2026-10-20T08:25:26Z

commit ea2106c74490e26a040f0f3a2bd040e78dd0df0c parent d782f95f24aa25035b6f67ce3b7508ce4562886c Author: Jared Tobin Date: Tue, 20 Oct 2026 12:25:26 +0400 merge impl/objects: a taint run kept to the objects, the version exported `vestigia run` and `read` take --object, keeping sites in objects whose path contains the given text, as `diff` keeps its origins, and traceOf takes `objects` as diffOf does. nix/lib.nix exports the version the cabal file declares, so a consumer pinning vestigia reads it rather than parsing the cabal file itself.

objects: a taint run kept to the objects under audit; version exported

2026-10-20T07:53:30Z

commit 9afe63cb68e32c6034372b54673605664bb56bd0 parent d782f95f24aa25035b6f67ce3b7508ce4562886c Author: Jared Tobin Date: Tue, 20 Oct 2026 11:53:30 +0400 objects: a taint run kept to the objects under audit; version exported `vestigia run` and `read` take `--object`, keeping sites in objects whose path contains the given text, as `diff` keeps its origins; `traceOf` takes `objects` as `diffOf` does. nix/lib.nix exports the version the cabal file declares, so a consumer pinning vestigia reads it rather than parsing the cabal file itself.

merge impl/plugin-linux: the plugin on Linux alone

2026-10-19T10:21:55Z

commit d782f95f24aa25035b6f67ce3b7508ce4562886c parent fb627c0089ad2134f20072b1ba531d981cba59bf Author: Jared Tobin Date: Mon, 19 Oct 2026 14:21:55 +0400 merge impl/plugin-linux: the plugin on Linux alone - packages.plugin is exported for Linux systems only: it is built against QEMU's user mode, which nixpkgs offers on Linux alone, and exporting it everywhere made the flake check fail on Darwin.

flake: the plugin on Linux alone

2026-10-19T10:21:55Z

commit a3f68da76b90401fbd9a4a99fe6067e559c8b5be parent fb627c0089ad2134f20072b1ba531d981cba59bf Author: Jared Tobin Date: Mon, 19 Oct 2026 14:21:55 +0400 flake: the plugin on Linux alone The plugin is built against QEMU's user mode, which nixpkgs offers on Linux alone, and is only ever loaded there. Exporting it for every system made the flake's check fail to evaluate on Darwin; it is now a package of Linux systems only.

merge impl/sound: outcome order compared, runs that prove nothing refused

2026-10-19T10:19:44Z

commit fb627c0089ad2134f20072b1ba531d981cba59bf parent e07799b18a84745a35c7ebd88f25d97cd4a1c265 Author: Jared Tobin Date: Mon, 19 Oct 2026 14:19:44 +0400 merge impl/sound: outcome order compared, runs that prove nothing refused - The QEMU plugin fingerprints, per instruction, the order of what followed it, and the diff compares it: a branch run as often, taking each outcome as often, in another order, is a control origin. Counting outcomes alone missed it. - A taint run that marked no secret is refused, as is a dump in which no instruction ran: neither records a run, and both had read clean. - Runs are made repeatable or refused. vestigia builds QEMU's user mode alone, patched so a guest's getrandom, answered by the host as before (its flags, length, and errors the kernel's), is filled from the generator -seed fixes; record refuses to run when it cannot turn address randomisation off. - The README states the designed-run contract: the same harness and arguments, only the secret, chosen to reach a path. Checked against the previous vestigia on pollux with a probe: an order-only branch is now an origin (was missed), a branch on getrandom is steady across runs and the control (15 instructions differed), an invalid getrandom flag still fails with EINVAL, and an unmarked harness's run is refused (it read clean). 26 tests pass.

merge impl/behaviour: each origin names the runs alike at it

2026-10-19T10:19:44Z

commit e07799b18a84745a35c7ebd88f25d97cd4a1c265 parent 200dfd9496267c8d8bae5dd3b45116676348eccf Author: Jared Tobin Date: Mon, 19 Oct 2026 14:19:44 +0400 merge impl/behaviour: each origin names the runs alike at it - The diff report becomes vestigia/diff-v2. Each origin names how the runs behaved there: the runs alike, grouped, and the runs that never reached it, each by its dump's file name, so a reader can tell which secrets the execution told apart, and whether two secrets a function accepted differed at a site or only an accepted and a refused one. - What ran a different number of times only downstream of an origin is listed per object, and --object restricts it as it restricts origins. diffOf passes its dumps in run order rather than by glob. synthesis reads the groups to settle each trace site from the runs alone (varies, rejects, downstream, steady) before any model reads it.

qemu: getrandom keeps the kernel's flags and length

2026-10-19T10:06:08Z

commit 55966ebc12eb233ad93cf1ff580a82945247ff74 parent 9dfe7c4c5de9c88f0c2c77bf3230f5b5804238eb Author: Jared Tobin Date: Mon, 19 Oct 2026 14:06:08 +0400 qemu: getrandom keeps the kernel's flags and length The patch answered a guest's getrandom from the seeded generator alone, ignoring its flags and always returning the length asked for: a call the kernel refuses (an invalid flag, EINVAL) succeeded, which could change the path a harness takes. The host now answers the call as before, checking its flags and choosing its length and errors, and only the bytes it returned are drawn from the seeded generator.

diff: a dump in which nothing ran is refused

2026-10-19T10:05:40Z

commit 9dfe7c4c5de9c88f0c2c77bf3230f5b5804238eb parent 6c739b82dac5cdf1c2e3b36151b41b4767f69db1 Author: Jared Tobin Date: Mon, 19 Oct 2026 14:05:40 +0400 diff: a dump in which nothing ran is refused The plugin writes every instruction the guest executed, so a dump in which none ran records no run: a recording that failed before the plugin wrote anything, or a file left empty. readDump parsed it as a run that did nothing, and two such dumps compared clean, with no origins and nothing executed. It is now refused, and diff with it.

diff: each origin names the runs alike at it (diff-v2)

2026-10-19T09:42:14Z

commit 8b69178513d4f42a3f2645d66adf23d4a7b6b713 parent 200dfd9496267c8d8bae5dd3b45116676348eccf Author: Jared Tobin Date: Mon, 19 Oct 2026 13:42:14 +0400 diff: each origin names the runs alike at it (diff-v2) The diff report becomes vestigia/diff-v2. Each origin now says how the runs behaved there: the runs that behaved alike, grouped, and the runs that never reached it, each named by its dump's file name. A reader can then tell which secrets the execution told apart, and so whether two secrets a function accepted differed at a site, or only an accepted and a refused one. What ran a different number of times only downstream of an origin is listed per object rather than counted, and --object restricts it as it restricts origins. diffOf passes its dumps in run order, not by glob.

diff: outcome order compared, and runs that prove nothing refused

2026-10-19T09:42:14Z

commit 6c739b82dac5cdf1c2e3b36151b41b4767f69db1 parent 8b69178513d4f42a3f2645d66adf23d4a7b6b713 Author: Jared Tobin Date: Mon, 19 Oct 2026 13:42:14 +0400 diff: outcome order compared, and runs that prove nothing refused The QEMU plugin now keeps, for each instruction, an order-sensitive fingerprint of the instructions that followed it, and the diff compares it. A branch that runs as often, and takes each of its outcomes as often, in two runs, but in another order, is now a control origin. Counting outcomes alone missed it, so a site memcheck saw the secret reach, and that no run appeared to vary, could be called steady when it was not. A taint run that marked no secret is refused. The first secret mark of any bytes is what writes the loaded objects, so an empty objects file means nothing was secret, and a clean report of such a run said nothing about the code. Runs are made repeatable, or refused. QEMU's user mode answered a guest's getrandom from the host, which -seed does not reach, so two runs of one secret could differ wherever the program computed on its entropy; those instructions were set aside as unsteady, together with anything at them that also depended on the secret. vestigia now builds QEMU's user mode alone, patched to draw getrandom from the seeded generator. record refuses to run when it cannot turn address randomisation off, rather than warning and comparing runs laid out differently. The README states the contract for designed runs plainly: the same harness and arguments, only the secret, chosen to reach a path.

merge impl/designed: runs designed for a path, compared apart

2026-10-18T08:03:29Z

commit 200dfd9496267c8d8bae5dd3b45116676348eccf parent f319ea2c4c6186ac2f244dd58ba9d8125081cb96 Author: Jared Tobin Date: Sun, 18 Oct 2026 12:03:29 +0400 merge impl/designed: runs designed for a path, compared apart - vestigia diff --designed DUMP (diffOf designed): a run aimed at a particular path counts toward the control origins and what was executed, never toward the address origins, which only runs alike in all but the secret can show. Mixed in with the others, a run that went elsewhere, or that the root rejected early, left almost every instruction run a different number of times across the set, and the address origins vanished (Penumbra spend_auth_sign: 0 of 59).

diff: runs designed for a path, compared for control and coverage alone

2026-10-18T08:03:29Z

commit d977ab84713434e4cca65e08c1741fe79aea5513 parent f319ea2c4c6186ac2f244dd58ba9d8125081cb96 Author: Jared Tobin Date: Sun, 18 Oct 2026 12:03:29 +0400 diff: runs designed for a path, compared for control and coverage alone

merge impl/executed: diff reports what the runs executed

2026-10-18T03:14:07Z

commit f319ea2c4c6186ac2f244dd58ba9d8125081cb96 parent 89244a3ad19b085993be5a2f0ca660964b8202b7 Author: Jared Tobin Date: Sun, 18 Oct 2026 07:14:07 +0400 merge impl/executed: diff reports what the runs executed - The diff report (vestigia/diff-v1) lists, per object, the offset of every instruction some run, control or not, executed: what the chosen secrets exercised, to set against what the code could execute. --object restricts it as it restricts origins.

diff: what every run executed, per object

2026-10-18T03:14:07Z

commit 2284937a6cab40688bf8f09a15b4062f6cef7e9e parent 89244a3ad19b085993be5a2f0ca660964b8202b7 Author: Jared Tobin Date: Sun, 18 Oct 2026 07:14:07 +0400 diff: what every run executed, per object

marks: a compilation unit that records where each object sits

2026-10-17T19:43:47Z

commit 89244a3ad19b085993be5a2f0ca660964b8202b7 parent b9cdbe93429f6df5a4e1c243c147bfd3910781b8 Author: Jared Tobin Date: Sat, 17 Oct 2026 23:43:47 +0400 marks: a compilation unit that records where each object sits A site is reported at a run-time address, and only the loader knows where it put the object holding it. The marks move from the header into include/vestigia.c (vestigia.h declares them), which sets _GNU_SOURCE for dl_iterate_phdr and, on the first secret mark, writes each loaded object's load bias and path to the file VESTIGIA_OBJECTS names. `vestigia run` sets it, lists the objects in its report, and gives every frame its address in its object. The same file serves a foreign function interface, so vestigia-ffi.c goes.

readme: the diff summary as one line

2026-10-17T18:23:50Z

commit b9cdbe93429f6df5a4e1c243c147bfd3910781b8 parent 7440899be79afbd1839f87c905c68515643be54f Author: Jared Tobin Date: Sat, 17 Oct 2026 22:23:50 +0400 readme: the diff summary as one line

diff: controls, seeded entropy, and nix/lib.nix for consumers

2026-10-17T18:23:36Z

commit 7440899be79afbd1839f87c905c68515643be54f parent f87fdf896e5a6dda1ed834261a44b398bc60cfa6 Author: Jared Tobin Date: Sat, 17 Oct 2026 22:23:36 +0400 diff: controls, seeded entropy, and nix/lib.nix for consumers

readme: what vestigia reads, how, and what it cannot

2026-10-17T17:47:22Z

commit f87fdf896e5a6dda1ed834261a44b398bc60cfa6 parent d6d86b943a2ac2d3b97686c8911d08655f420bbf Author: Jared Tobin Date: Sat, 17 Oct 2026 21:47:22 +0400 readme: what vestigia reads, how, and what it cannot

spikes: ppad-poly1305 and ppad-secp256k1, and the FFI marks

2026-10-17T17:32:37Z

commit d6d86b943a2ac2d3b97686c8911d08655f420bbf parent 8d46e7117f4f6961f0c197430a3a055b1c01ad75 Author: Jared Tobin Date: Sat, 17 Oct 2026 21:32:37 +0400 spikes: ppad-poly1305 and ppad-secp256k1, and the FFI marks

spike: Penumbra results

2026-10-17T16:11:46Z

commit 8d46e7117f4f6961f0c197430a3a055b1c01ad75 parent 3b28eb354393ee5d36e747b3489f70591b438764 Author: Jared Tobin Date: Sat, 17 Oct 2026 20:11:46 +0400 spike: Penumbra results

vestigia: differential leakage traces under QEMU, and the Penumbra spike

2026-10-17T16:11:35Z

commit 3b28eb354393ee5d36e747b3489f70591b438764 parent d46bfe999c7d30bc3eb120bbab1f68471653a533 Author: Jared Tobin Date: Sat, 17 Oct 2026 20:11:35 +0400 vestigia: differential leakage traces under QEMU, and the Penumbra spike

vestigia: memcheck's report of where an execution depended on a secret

2026-10-17T15:40:19Z

commit d46bfe999c7d30bc3eb120bbab1f68471653a533 Author: Jared Tobin Date: Sat, 17 Oct 2026 19:40:19 +0400 vestigia: memcheck's report of where an execution depended on a secret