search

ufrisk / pcileech-fpga

FPGA modules used together with the PCILeech Direct Memory Access (DMA) Attack Software
917 stars 205 forks source link

Q about TLP completion timeout #151

Closed andreiw closed 11 months ago

andreiw commented 11 months ago

Does the firmware force a particular completion timeout range? (e.g. Device Control Register 2) Or is sending completions for BAR accesses and the like inherently racy?

ufrisk commented 11 months ago

There is a timeout range set in the xilinx core settings.

This is however not enforced. The TLP transaction interface is very dumb, it just receives or sends whatever packets I put on it.

BARs are currently not implemented in the firmware so if the host asking any data from a BAR it will time out the request and it will usually show 0xFFFFFFFF. There are some projects already having this like the ekknod-wifi pcileech-fpga fork.

I however have PCIe BAR support in software in LeechCore/PCILeech which will handle this. There are some code in PCILeech that demoes this: https://github.com/ufrisk/pcileech/blob/00eff8c8d1aecd69870a776b4e31759592d72912/pcileech/extra.c#L435

I have plans to implement BAR support in the next v4.13 version early next year, but we'll see if it lands in there...

Also if asking a lot of questions there is a Discord channel also: https://discord.gg/BCmfBhDPXX

Hope this answers your question.