ufrisk / pcileech-fpga

FPGA modules used together with the PCILeech Direct Memory Access (DMA) Attack Software
875 stars 192 forks source link

About solutions to some problems and some overlooked code. #159

Closed zr5177 closed 8 months ago

zr5177 commented 8 months ago

Some questions about PCie configuration space customization Use COE to highly customize everything except VEND_ID and DEV_ID: set rw[203]<= 1'b0; // CFGTLP ZERO DATA parameter in pcileech_fifo.sv to 0, if you want to use the configuration space defined by COE It is writable, please set CFGTLP PCIE WRITE ENABLE to 1. Then set the EXT_CFG_CAP_PTR and EXT_CFG_XP_CAP_PTR parameters in pcie_7x_0_core_top.v to 01. 01 means that you want the coe coverage to start from the 0x04 address of the configuration space. If the DEV_CAP_MAX_PAYLOAD_SUPPORTED parameter in your COE file is not 0, please turn on the MPS_FORCE parameter, search for the cfg_force_mps parameter, and assign it the value of DEV_CAP_MAX_PAYLOAD_SUPPORTED indicated by your coe to solve the minor TLP problem. Bit 13 of the status register is set to 1 after active communication. This problem can be solved by setting rw[20] <= 1; in pcileech_pcie_cfga7.sv to 1. But it is not recommended to set rw[21] <= 0; to 1, because the value of the command register is usually controlled by the hardware driver. I apologize for initiating this question which is not a question, this question is to share some issues and knowledge that I encountered and solved. If others have any questions, you can discuss them together. Finally, I wish ufrisk a happy New Year (Chinese New Year) (*^^*)

kilmu1337 commented 8 months ago

sorry to bother you, "Use COE to highly customize everything" refer to the pcileech_cfgspace.coe?

zr5177 commented 8 months ago

Yes, the bram_pcie_cfgspace IP core's pcileech_cfgspace.coe file can fully customize all PCIe configuration spaces given a specific PCIe IP core configuration.

kilmu1337 commented 8 months ago

Yes, the bram_pcie_cfgspace IP core's pcileech_cfgspace.coe file can fully customize all PCIe configuration spaces given a specific PCIe IP core configuration.

thank you very much.and some questions

"Then set the EXT_CFG_CAP_PTR and EXT_CFG_XP_CAP_PTR parameters in pcie_7x_0_core_top.v to 01. 01 means that you want the coe coverage to start from the 0x04 address of the configuration space."

why set 01 rather 04 like this

parameter [5:0]   EXT_CFG_CAP_PTR = 6'h04,    
parameter [9:0]   EXT_CFG_XP_CAP_PTR = 10'h04,
zr5177 commented 8 months ago

In this parameter, each increment of one digit represents a 64-bit extension of the coe coverage, which corresponds to 4 addresses in the configuration space. Therefore, the parameter 01 represents coverage starting from address 0x04, while the parameter 04 represents coverage starting from address 0x10 (in hexadecimal).

CottonCollecter commented 8 months ago

epic post

kilmu1337 commented 8 months ago

In this parameter, each increment of one digit represents a 64-bit extension of the coe coverage, which corresponds to 4 addresses in the configuration space. Therefore, the parameter 01 represents coverage starting from address 0x04, while the parameter 04 represents coverage starting from address 0x10 (in hexadecimal).

ok,thank you very much , i think i figure it out

zr5177 commented 8 months ago

您的修改方式,貌似跟我经常使用的不太一样,我在上面强调的是在VIVADO中直接修改IP核内的pcie_7x_0_core_top.v文件。而根据你的配置空间表现来看,貌似有几个问题:pcie IP核的EXT_CFG_CAP_PTR参数的值是 2A, bram_pcie_cfgspace IP 核没有正确识别到COE的更改,可能是因为没有重新打开IP核保存修改的COE文件。

zr5177 commented 8 months ago

Your modification method seems different from what I often use. I emphasized above that I directly modify the pcie_7x_0_core_top.v file within the IP core in VIVADO. Based on the performance of your configuration space, there seem to be some issues: the value of the EXT_CFG_CAP_PTR parameter of the PCIe IP core is 2A, and the bram_pcie_cfgspace IP core has not correctly recognized the changes to the COE, possibly because the modified COE file wasn't reopened and saved in the IP core.

zr5177 commented 8 months ago

It seems many people are facing the same issue. I will describe in more detail how to modify the corresponding parameters here. First, launch Vivado and open your PCILeech-FPGA project, ensuring the "CFGTLP ZERO DATA" parameter is set to 0. Open the "PCIE_7X_0.XCI" file, then change a minor parameter and click "OK". At this point, do not select "Out of context per IP", instead, choose "global". Then click "GENERATE". Next, click on the "PCIE_7X_0.XCI" file, select "Properties", find "IS_MANAGED" and turn it off. This action will make the files of the IP core editable. Expand the IP core folder, find the "pcie_7x_0_core_top.v" file, modify the aforementioned two parameters, and then save it. Afterwards, find and open the "bram_pcie_cfgspace.xci" file, click on "Other Options", edit your COE there and save it, and then click "OK", proceed to generate your bitstream file. By doing so, the configuration space should be as you desired. If not, try executing the reset_run synth_1 command and then regenerate the bitstream file.

zr5177 commented 8 months ago

After modifications like these, if the PC card likely fails during the boot phase, it could be due to the PCIe configuration space not adhering to specifications. Please cautiously handle every byte within the COE, and repeatedly experiment to ensure your parameter modifications occur at the intended location. Many tools that save configuration space files may have issues with endianness and formats not meeting expectations, requiring you to manually convert them to your desired format.

zr5177 commented 8 months ago

When the driver suspects that the device is not operating normally, it usually involves interactions based on the BAR (Base Address Register) space. It's not a problem that can simply be solved by emulating the configuration space. I think ekknod's pcileech-wifi could provide you with more inspiration.

zr5177 commented 8 months ago

I'm not familiar with the structure of the latest version of PCILEECH, as the BAR space implementation I'm currently using was built by myself before version 4.12. In my experience, most PCIe endpoint devices perform register mapping to the BAR in hardware, such as EEPROMs commonly used in wireless network cards. Therefore, you might want to learn ekknod's approach. As for more in-depth emulation, it might not be appropriate to discuss here.

ufrisk commented 8 months ago

I'm closing this issue since it's not really an issue, more of a discussion. I think it will be possible to continue to post in the thread though, or keep the discussion going in some other forum.

Best wishes with your projects.