Ports the ESP32 Wi-Fi emulation (esp32c3_wifi, esp32_wifi_ap, esp32_wlan_*)
from the lcgamboa/PICSimLab QEMU fork and integrates it behind the
esp32c3_wifi NIC model, plus the supporting radio peripherals
(ANA/PHYA/FE/PWR manager).
- Exposes an open SSID 'qemu' bridged to the host via QEMU user-mode NAT
(libslirp, now enabled in the native build).
- Adds ESP-IDF 5.5 compatibility fixes: channel resolution from the
beacon DS Parameter Set IE / AP lookup, persistent SYSCON register
backing (phy_module_has_clock_bits), DMA inlink/outlink descriptor
mirroring, RX descriptor ring reset on item.next==0, and descriptor
ownership/length semantics.
- xteink-emu now starts with -nic user,model=esp32c3_wifi and synthesizes
an eFuse image with a fixed guest MAC.
Verified against a stock Arduino-ESP32 sketch: scans, finds 'qemu',
associates, gets DHCP 192.168.4.15, and completes an outbound TCP
connection. Unmodified CrossPoint firmware still needs the power-button
hold during boot (tracked separately).
?stateflush reuses the app-flash no-chain window without differential shadowing.
It shows that returning to C between TBs does not materialize CPUArchState; the
nostoretci reader-open corruption still reproduces.
?ramrace logs off-vCPU guest DRAM reads/writes/maps and TLB flushes. The
open-window crash shows zero such accesses, ruling out IO-thread guest-RAM
access during inflate as the compiled-store corruption source.
Skips removeFunction recycling of WASM table indices. nostoretci+noremove still
crashes 4/4, ruling out table-index reuse as the corruption source and leaving a
vCPU/IO-thread guest-RAM data race as the standing hypothesis.
Counts compiled-TB DONE_FLAG redispatch/resume re-entries. Three crashing
nostoretci runs showed zero such re-entries, ruling out the store
block-replay-via-redispatch path as the corruption trigger and pointing at a
guest-RAM data race with concurrent device/timer callbacks.
Add wasm_set_store_tci_hash and wasm_set_store_bisect so store compilation can
be split by pc hash (both widths) or bisected per width at runtime, no rebuild.
Used to show the compiled-store corruption is a nondeterministic race, not a
specific miscompiled TB: identity-independent, and a fixed config alternates
crash/pass across runs. Default path unchanged (blanket store-TCI).
The 32-bit-only store-TCI fallback passes reader-open when it works, but a
3-run benchmark hit an app-init watchdog once. Restore the upstream blanket
store-TCI fallback for reliability; keep ?nostoretci as the all-compiled repro.
The compiled-store corruption requires 8-bit and 32-bit store TB populations
compiled together. Interpreting either width breaks the interaction; keep only
32-bit qemu store TBs on TCI and allow the rest to compile. ?nostoretci remains
the all-compiled repro path.
Add an opt-in wasm_disable_store_tci() probe so browser tests can run compiled
stores at normal speed without the differential harness. Also let E11 request
no-chain only for TBs inside its PC window, avoiding the global no-chain
watchdog artifact while preserving valid per-window comparisons.
This keeps production store-TCI unchanged unless explicitly disabled.
Mode 2 runs compiled LIVE and authoritative so corruption accumulates across
TBs as in the real crash, with a per-TB TCI shadow (restored from pre-snapshot)
as the known-good reference. Store-TCI disabled under this mode; compares
env/pc/DRAM per eligible store TB, now including slow-path completions.
Result: 153k+ live-compiled comparisons, zero divergence, confirming inline
store codegen is correct even under live accumulation. Cannot reach the reader
corruption in-browser: 2x-execution + full-state snapshot trips the guest
interrupt watchdog and is throughput-bound. Suspects narrowed to the store
slow-path (helper/unwind) and store-width interaction.
Runs authoritative TCI first, snapshots its result, rewinds guest state,
runs the compiled TB as a disposable shadow, compares GPRs/DRAM, then
restores TCI. Opt-in via wasm_diff_enable(); normal execution unchanged.
Valid comparison required restoring all state a single TB can touch:
- full CPUNegativeOffsetState (the env-8 interrupt check sits before env)
- deep CPUTLB.f[].table / d[].fulltlb per MMU mode
- and skipping async cpu_exit() force-exit races.
Only side-effect-safe candidates compared (store TB, no general helper).
Result: 160k+ store-TB comparisons during reader-open, zero divergence.
Per-TB store codegen is exonerated; corruption is emergent across TBs.
The reader draws a crisp BW page, then a 4-level grayscale antialiasing
pass with inverted plane polarity (white = level 0 = both planes clear)
and near-empty planes. The old model replaced the whole frame with those
planes, wiping the page to an inverted muddle.
Model it as e-ink actually behaves: keep a persistent surface, detect
grayscale vs BW by DTM2's set-fraction (background is the white
majority), and in grayscale treat level 0 as no-drive (keep pixel) so
only the sparse antialiased edges repaint over the retained BW page. BW
refreshes still repaint every pixel. Reader text now renders sharp.
A TB containing a guest store is miscompiled by the wasm backend: it
corrupts a pointer that a later load faults on. It reproduces in uzlib
inflate during the reader's font prewarm (browser panics with a rejected
Load access fault); native QEMU decompresses the same static flash font
fine, confirming a wasm32 codegen bug.
Force store-containing TBs onto the TCI interpreter as the working
workaround. Perf ceiling: those TBs no longer JIT-compile. Upgrade path:
localize the miscompiled op in tcg_wasm_out_qemu_st and drop this.
ssi-sd now enters token mode as it returns the final R1 byte, so the
write-data token that immediately follows is not discarded. SPI CMD13
returns the internal sd_r1 response (upstream fix) instead of sd_r2_s,
which the adapter converts to the two-byte SPI R2 status; this stops the
repeated "Unexpected response to cmd 13" loop on guest status polls.
Drops the experimental store-TB TCI forcing and sd-watch OOB logging now
that the raw FAT32 image path is stable.
Diagnostic: routes store-containing TBs through TCI and logs out-of-bounds
guest stores to isolate the SdSpiCard corruption. Also carries the FAT32
vvfat root/cluster fixes and ssi-sd command framing. Squash/split before
upstreaming.
evan
xteink