Adds a 'memory' subcommand and matching web tab that show how much of each
ESP32-C3 RAM window the guest has written, plus raw region dumps via QMP
pmemsave.
Browse, edit, upload, and delete files on the FAT32 image with mtools,
mirroring the wasm emulator's Files tab. Mutations stop the emulator
first because QEMU caches the card, so host writes to a live image would
be lost.
Split the emulator script into an xteink package so the CLI and the new
web UI share one QEMU driver. The web UI uploads firmware and an SD image,
boots them, drives the buttons, and long-polls the panel frame generation
so the screen updates on each e-ink refresh.
The wasm front end already tracked panel refreshes; make the counter
unconditional and alias it onto the machine so native front ends can
redraw on refresh instead of on a timer.
Report SOF and serial-in-empty as always pending and route the peripheral
IRQ through the interrupt matrix so the ESP-IDF console driver progresses.
Merge emulator stdout into serial.log so crash output lands in one place.
Ports the ESP32 Wi-Fi emulation (esp32c3_wifi, esp32_wifi_ap, esp32_wlan_*)
from the lcgamboa/PICSimLab QEMU fork and integrates it behind the
esp32c3_wifi NIC model, plus the supporting radio peripherals
(ANA/PHYA/FE/PWR manager).
- Exposes an open SSID 'qemu' bridged to the host via QEMU user-mode NAT
(libslirp, now enabled in the native build).
- Adds ESP-IDF 5.5 compatibility fixes: channel resolution from the
beacon DS Parameter Set IE / AP lookup, persistent SYSCON register
backing (phy_module_has_clock_bits), DMA inlink/outlink descriptor
mirroring, RX descriptor ring reset on item.next==0, and descriptor
ownership/length semantics.
- xteink-emu now starts with -nic user,model=esp32c3_wifi and synthesizes
an eFuse image with a fixed guest MAC.
Verified against a stock Arduino-ESP32 sketch: scans, finds 'qemu',
associates, gets DHCP 192.168.4.15, and completes an outbound TCP
connection. Unmodified CrossPoint firmware still needs the power-button
hold during boot (tracked separately).
?stateflush reuses the app-flash no-chain window without differential shadowing.
It shows that returning to C between TBs does not materialize CPUArchState; the
nostoretci reader-open corruption still reproduces.
?ramrace logs off-vCPU guest DRAM reads/writes/maps and TLB flushes. The
open-window crash shows zero such accesses, ruling out IO-thread guest-RAM
access during inflate as the compiled-store corruption source.
Skips removeFunction recycling of WASM table indices. nostoretci+noremove still
crashes 4/4, ruling out table-index reuse as the corruption source and leaving a
vCPU/IO-thread guest-RAM data race as the standing hypothesis.
Counts compiled-TB DONE_FLAG redispatch/resume re-entries. Three crashing
nostoretci runs showed zero such re-entries, ruling out the store
block-replay-via-redispatch path as the corruption trigger and pointing at a
guest-RAM data race with concurrent device/timer callbacks.
Add wasm_set_store_tci_hash and wasm_set_store_bisect so store compilation can
be split by pc hash (both widths) or bisected per width at runtime, no rebuild.
Used to show the compiled-store corruption is a nondeterministic race, not a
specific miscompiled TB: identity-independent, and a fixed config alternates
crash/pass across runs. Default path unchanged (blanket store-TCI).
The 32-bit-only store-TCI fallback passes reader-open when it works, but a
3-run benchmark hit an app-init watchdog once. Restore the upstream blanket
store-TCI fallback for reliability; keep ?nostoretci as the all-compiled repro.
The compiled-store corruption requires 8-bit and 32-bit store TB populations
compiled together. Interpreting either width breaks the interaction; keep only
32-bit qemu store TBs on TCI and allow the rest to compile. ?nostoretci remains
the all-compiled repro path.
Add an opt-in wasm_disable_store_tci() probe so browser tests can run compiled
stores at normal speed without the differential harness. Also let E11 request
no-chain only for TBs inside its PC window, avoiding the global no-chain
watchdog artifact while preserving valid per-window comparisons.
This keeps production store-TCI unchanged unless explicitly disabled.
Mode 2 runs compiled LIVE and authoritative so corruption accumulates across
TBs as in the real crash, with a per-TB TCI shadow (restored from pre-snapshot)
as the known-good reference. Store-TCI disabled under this mode; compares
env/pc/DRAM per eligible store TB, now including slow-path completions.
Result: 153k+ live-compiled comparisons, zero divergence, confirming inline
store codegen is correct even under live accumulation. Cannot reach the reader
corruption in-browser: 2x-execution + full-state snapshot trips the guest
interrupt watchdog and is throughput-bound. Suspects narrowed to the store
slow-path (helper/unwind) and store-width interaction.
Runs authoritative TCI first, snapshots its result, rewinds guest state,
runs the compiled TB as a disposable shadow, compares GPRs/DRAM, then
restores TCI. Opt-in via wasm_diff_enable(); normal execution unchanged.
Valid comparison required restoring all state a single TB can touch:
- full CPUNegativeOffsetState (the env-8 interrupt check sits before env)
- deep CPUTLB.f[].table / d[].fulltlb per MMU mode
- and skipping async cpu_exit() force-exit races.
Only side-effect-safe candidates compared (store TB, no general helper).
Result: 160k+ store-TB comparisons during reader-open, zero divergence.
Per-TB store codegen is exonerated; corruption is emergent across TBs.
The reader draws a crisp BW page, then a 4-level grayscale antialiasing
pass with inverted plane polarity (white = level 0 = both planes clear)
and near-empty planes. The old model replaced the whole frame with those
planes, wiping the page to an inverted muddle.
Model it as e-ink actually behaves: keep a persistent surface, detect
grayscale vs BW by DTM2's set-fraction (background is the white
majority), and in grayscale treat level 0 as no-drive (keep pixel) so
only the sparse antialiased edges repaint over the retained BW page. BW
refreshes still repaint every pixel. Reader text now renders sharp.
A TB containing a guest store is miscompiled by the wasm backend: it
corrupts a pointer that a later load faults on. It reproduces in uzlib
inflate during the reader's font prewarm (browser panics with a rejected
Load access fault); native QEMU decompresses the same static flash font
fine, confirming a wasm32 codegen bug.
Force store-containing TBs onto the TCI interpreter as the working
workaround. Perf ceiling: those TBs no longer JIT-compile. Upgrade path:
localize the miscompiled op in tcg_wasm_out_qemu_st and drop this.
ssi-sd now enters token mode as it returns the final R1 byte, so the
write-data token that immediately follows is not discarded. SPI CMD13
returns the internal sd_r1 response (upstream fix) instead of sd_r2_s,
which the adapter converts to the two-byte SPI R2 status; this stops the
repeated "Unexpected response to cmd 13" loop on guest status polls.
Drops the experimental store-TB TCI forcing and sd-watch OOB logging now
that the raw FAT32 image path is stable.
Diagnostic: routes store-containing TBs through TCI and logs out-of-bounds
guest stores to isolate the SdSpiCard corruption. Also carries the FAT32
vvfat root/cluster fixes and ssi-sd command framing. Squash/split before
upstreaming.
evan
xteink