Close 13 emulation gaps: NVMe backing store, xHCI ring engine, multi-BAR, vendor dispatch fixes#2
Open
NetVar1337 wants to merge 38 commits into
Open
Close 13 emulation gaps: NVMe backing store, xHCI ring engine, multi-BAR, vendor dispatch fixes#2NetVar1337 wants to merge 38 commits into
NetVar1337 wants to merge 38 commits into
Conversation
…ure2 firmware: improve donor metadata and validation
…-trace-import trace: import offline mmiotrace logs
…rp2-main Handle NVMe admin PRP2 page crossings
…eechgen-with-new-features Fix board source path overrides
…store Clean NVMe admin HDL width handling
Handle NVMe formatting I/O queues
…nd ILA debug core Logging & diagnostics - Global --log-level/--log-file/--json-logs flags with a tee'd file sink so the whole pre/mid/post-generation run is capturable; check/validate output tees too. - code10_report.txt + console warnings from build-time facts: BAR0 truncation, per-class FSM completeness, intr_req->cfg_interrupt routing verification, MSI-X BIR relocation, all-FF/empty BAR, missing MSI/MSI-X, DSN, link clamp. Emulation-gap fixes - --mmio-trace wires the donor timing histogram into the TLP latency emulator (was always the synthesized uniform CDF). - NVMe Identify: model number disambiguated by DeviceID, NSZE donor-derived, no invalid all-zero OUI. - Zero the full body of pruned capabilities, not just the 2 header bytes. - Preserve donor AER mask/severity instead of canned constants; keep status clear. - Emit pcileech_cfgspace_w1cmask.coe (per-bit write-1-to-clear mask). Behavioral RTL (sim/, iverilog) - cfg_w1c_shadow, msix_pba, nvme_store modules + testbenches + run harness and a make sim target. Integration into the full datapath still needs Vivado + hardware. ILA debug core - --ila/--ila-depth insert a Vivado ILA probing BAR/TLP/interrupt signals, with advanced trigger + 2 match units/probe (arm on e.g. wr_addr == CQ0 doorbell or intr_req) and capture/storage qualification for the small on-card buffer. - Generated ila_debug.txt documents the JTAG-only pre-trigger / warm-reboot capture workflow. One canonical probe list drives both the TCL and the SV.
… BAR") BAR profiling mmaps the donor BAR read-write and writes 0xFFFFFFFF/0x0/test patterns to every register to map RW/W1C bits. On firmware-mailbox NICs like Aquantia 10GbE (Gen3 x4) this deadlocks the on-chip firmware and the next MMIO read hangs the CPU - the device "hangs on BAR" during data collection. - Never write-probe network-class donors (base class 0x02); a read-only dump is enough to clone them and devclass models supply the register behavior. - Add --probe-bars (default true) so any other donor that hangs can be collected read-only with --probe-bars=false.
- README: --mmio-trace/--ila/--ila-depth/--probe-bars + global log flags, new artifacts (w1cmask coe, code10_report.txt, ila_debug.txt), make sim. - KNOWN_ISSUES: correct stale NVMe note (IO queues exist; backing store is the gap) and add the Aquantia "hangs on BAR" entry + --probe-bars=false workaround.
…re error") SATA/AHCI clones had no command engine: PxCI was a static register that never cleared and no completion FIS was posted, so storahci times out at init -> Code 10. New behavioral RTL ahci_engine.sv implements the slot-0 command FSM: walks the command list -> command table H2D FIS -> PRDT, services IDENTIFY and READ/ WRITE DMA EXT over a BRAM sector store, writes the D2H Register FIS, sets PxTFD ready + PxIS.DHRS + intr, and clears PxCI. iverilog testbench proves IDENTIFY completion and a WRITE->READ sector round-trip (10 checks). Logic verified under simulation; wiring into the generated controller (BAR5/ ABAR datapath, real PCIe TLP DMA, donor IDENTIFY block) is the next step and needs Vivado + on-hardware validation.
New internal/firmware/ahci builds the 256-word ATA IDENTIFY DEVICE block (model, serial, LBA48 sector count, feature words, integrity checksum) and renders it as 128-dword hex for the AHCI engine's identify ROM. writer emits ahci_identify_init.hex for SATA-class donors so the cloned disk returns a valid IDENTIFY instead of a placeholder. Tested: string round-trip, LBA48 count, checksum zero, 128-line hex.
…BAR, vendor dispatch fixes, SATA/quirks/fallback/Thunderbolt - NVMe: real BRAM sector-store backing IO read/write (was zero-read/discard-write) - xHCI: command/event ring engine surviving driver init handshake (was register-only facade); fixes DBOFF/RTSOFF canonicalization and TLP backpressure along the way - BAR3-6 unblocked for donors needing more than 2 extra apertures (GPUs, HBAs) - strategy.go: xHCI dispatch now gated on progIF==0x30 (was misrouting UHCI/OHCI/EHCI); GPU and Ethernet get real vendor-specific dispatch instead of one-size-fits-all NVIDIA/Realtek profiles; 0x0280 catch-all no longer force-fits WWAN/modem silicon into a WiFi profile - New SD Host Controller (SDHCI) profile for class 0x0805 - SATA: BRAM-size-aware port clamping (PI/Px* no longer overclaim ports the board can't back) - Vendor quirks: ASMedia/VIA xHCI entries alongside the existing Renesas one - fallback package wired into the real build pipeline (was fully built, tested, and never called), now respects PreferredBAR - DeviceContext now captures multi-function sibling relationships (donor/collector.go)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| for _, pattern := range []string{filepath.Join(outputDir, "*.bit"), filepath.Join(outputDir, "*.bin")} { | ||
| matches, _ := filepath.Glob(pattern) | ||
| for _, m := range matches { | ||
| if err := os.Lchown(m, int(uid), int(gid)); err != nil { |
| for _, pattern := range []string{filepath.Join(outputDir, "*.bit"), filepath.Join(outputDir, "*.bin")} { | ||
| matches, _ := filepath.Glob(pattern) | ||
| for _, m := range matches { | ||
| if err := os.Lchown(m, int(uid), int(gid)); err != nil { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the 13 emulation-gap items from the audit: NVMe IO backing store, a real xHCI command/event-ring engine (was register-facade only), BAR3-6 unblocked for multi-BAR donors, several device-class dispatch bugs (xHCI progIF gate, GPU/Ethernet vendor-specific profiles, WWAN-vs-WiFi routing under class 0x0280), a new SDHCI profile, SATA BRAM-aware port clamping, ASMedia/VIA vendor quirks, the previously-unwired
fallbackpackage now hooked into the real build pipeline, and Thunderbolt sibling-function capture inDeviceContext.Two scope notes vs. the original audit (repo had moved since it was written):
sim/nvme_store.svprototype).Went through an independent review pass after implementation, which caught (and this PR includes the fixes for):
treadybackpressure gate in the new xHCI DMA bridge (dropped beats under load)fallback.ApplyignoringPreferredBARdespite its own doc commentKnown accepted debt, left commented rather than silently fixed:
pcileech_xhci_dma_bridgeduplicatespcileech_nvme_dma_bridgebyte-for-byte — sharing it is a separate, riskier refactor touching the already-shipped NVMe path.Test plan
go build ./...,go vet ./...,go test ./...— all cleanbash sim/run.sh— all 5 testbenches pass (ahci_engine, cfg_w1c_shadow, msix_pba, nvme_store, xhci_ring_engine)sim/README.mdis sim-proven first, hardware-validated as a separate step)