docs(N34)+test: E13 僵尸会话根因坐实；Phase 11 判据修正+一次性报告
E13（实验方案.md 新增 + E8/E11/E12 口径修正）： - 风暴态根因=僵尸会话，非芯片残渣：PC 网卡禁用/链路断开时 Windows 直接丢弃 socket 不发 FIN/RST → 芯片侧 ESTABLISHED 僵尸 → 单连接监听被占（:21 拒连）→ 下一 PASV 重监听与僵尸竞态 （accept 为垂死僵尸开枪 20ms 后 DISCONNECT）→ lftpd 5s 窗空转 → 425；每失败轮再生僵尸 → 自续数分钟 - "残渣跨烧录存活/需断电冷启动"口径作废：板上 CH395F RSTI 接 MCU NRST（V0.0 网表 :174），每次烧录即芯片硬件复位；"存活"是 锤击再生错觉。正确控制=下一臂前静置 ≥90s 清僵尸窗 - 自愈链端到端验证：TIMEOUT(在途 TX ≈30s)/keepalive(空闲 60/5/3) → pump → relisten → 端口恢复；E11 产品路径验证 17s 判死 PASS - 4 元组复用假设被否（pasv_probe.py：PASV 端口递增、PC 源端口随机） - e02_probe listener=FAIL 重解读：探针挂起 socket 未关（PC 内核 代 ACK keepalive）→ 拒连是单连接正确行为；真缺口=应用无法主动 拆会话 → 阶段 2 sock_reset 职责 Phase 11 测试修复（net_test_task.c，实跑暴露）： - 判据 >=60000ms 是按手册公式写的，实测判死 18~31s 会在正确固件 上假 FAIL → 改有界窗 10s~120s（下限防误杀存活空闲会话，上限 防判死缺位） - 报告后不释放 phase_active → 对已死连接 10ms 节奏刷 594 条假 FAIL → phase11_run 返回完成态，主循环释放等新连接再测 - 复跑两轮验证：30137ms 单次 PASS → 自动等新连接 → 二轮 accept 正常 - Test_Guide TC-NET-1101 判据/耗时同步；ch395f_test.h Phase 14 共存安全性注释（有整体超时不永久挡 accept） 工具：test/host/pasv_probe.py（每轮打印 PASV 端口+PC 源端口+结果）
This commit is contained in:
@@ -69,7 +69,9 @@ extern "C" {
|
||||
//#define ENABLE_PHASE12_TESTS /* [硬] SPI 字节命令 / DMA 时延基线（L1/L2，无需 PC）—— M1 已完成，基线见说明文档 §6.1 */
|
||||
/* ---- 链路时延（M2/M3；分段/阈值见 docs/测试说明/链路延迟测试说明.md）---- */
|
||||
//#define ENABLE_PHASE13_TESTS /* [网] 芯片 + 队列时延（L3~L7/L10，需 PC peer）—— M2 已完成，基线见说明文档 §6.2 */
|
||||
#define ENABLE_PHASE14_TESTS /* [网] 生产路径时延（L8~L11 + 模拟器 Δ）—— M3，需 peer --mode remo（:7003） */
|
||||
#define ENABLE_PHASE14_TESTS /* [网] 生产路径时延（L8~L11 + 模拟器 Δ）—— M3，需 peer --mode remo（:7003）；
|
||||
* 与 Phase 11 共存安全：peer 缺席时有 LAT_P14_TIMEOUT_MS 整体超时
|
||||
* 自动 done，不永久挡 accept */
|
||||
|
||||
#if defined(ENABLE_PHASE1_TESTS) || defined(ENABLE_PHASE2_TESTS) || \
|
||||
defined(ENABLE_PHASE3_TESTS) || defined(ENABLE_PHASE4_TESTS) || \
|
||||
|
||||
@@ -801,9 +801,9 @@ static void phase10_run(int32_t sockfd) {
|
||||
* 入口条件：Socket 处于 ESTABLISHED 且对端为**死对端**——PC 连 8080 后
|
||||
* 禁用网卡（存活对端会 ACK 探测、TIMEOUT 永不触发，本测试将
|
||||
* 一直等待；防火墙规则对已建立连接无效，E11 实证）。
|
||||
* 通过：从连接建立到 recv 返回 0 的间隔 ≥ 60s（IDLE 阈值）。
|
||||
* 注：芯片定时语义与手册公式（75s）不完全一致，实测判死窗口见
|
||||
* 实验方案 E11（对端失联后 ≈30s）。
|
||||
* 通过：从连接建立到 recv 返回 0 的间隔落在 10s~120s 有界窗
|
||||
* （芯片定时语义与手册公式 75s 不符，实测判死 18~31s——
|
||||
* 见实验方案 E11 与 phase11_run 内判据注释）。
|
||||
* =================================================================== */
|
||||
|
||||
#ifdef ENABLE_PHASE11_TESTS
|
||||
@@ -811,27 +811,40 @@ static int32_t s_phase11_armed = 0;
|
||||
static uint32_t s_phase11_start = 0;
|
||||
static uint8_t s_phase11_buf[64]; /* 专用小缓冲：不占 32KB s_rx_buf（RAM 余量） */
|
||||
|
||||
static void phase11_run(int32_t sockfd) {
|
||||
/* 返回值：0 = 测试进行中；1 = 已报告完成（主循环据此释放 phase_active，
|
||||
* 等待**新连接**再测。勿删本机制——报告后连接已死，recv 恒返 0，
|
||||
* 继续 arm 会以 10ms 节奏刷出数百条假 FAIL（2026-10-13 实跑实证） */
|
||||
static int phase11_run(int32_t sockfd) {
|
||||
/*
|
||||
* 第一次调用：记录开始时间并 arm。
|
||||
* 后续调用：非阻塞 recv，若返回 0 表示连接已断开（KeepAlive 触发）。
|
||||
* 计算耗时与 60s idle 阈值比较。
|
||||
* 计算耗时与有界窗判据比较。
|
||||
*/
|
||||
if (!s_phase11_armed) {
|
||||
s_phase11_armed = 1;
|
||||
s_phase11_start = HAL_GetTick();
|
||||
DBG_INFO("Phase11: idle wait for KeepAlive timeout (60s)");
|
||||
return;
|
||||
return 0;
|
||||
}
|
||||
|
||||
int32_t n = net_recv(sockfd, s_phase11_buf, 64, NET_MSG_DONTWAIT);
|
||||
if (n == 0) {
|
||||
uint32_t elapsed = HAL_GetTick() - s_phase11_start;
|
||||
TEST_CHECK(elapsed >= 60000,
|
||||
"Phase11: KeepAlive triggered after %lums (expect >=60000ms)", elapsed);
|
||||
/* 判据（E11 实测修正版）：芯片定时语义与手册公式(75s)不符——
|
||||
* 生产参数实测判死窗口 18~31s（产品验证 连接+30.5s、E11 T5
|
||||
* 对端失联+30s、T4 短参数 连接+~10s）。本 socket 无在途 TX、
|
||||
* 对端静默且已失联 → 唯一开枪源是 keepalive，故判据为
|
||||
* **有界窗**：>=10s（存活空闲会话 T2 实测 90s 不被杀，10s 下限
|
||||
* 区分"误杀"与"keepalive 判死"）且 <=120s（判死必须发生）。
|
||||
* 勿改回 >=60000——那是对着手册公式写的，会在正确固件上假 FAIL */
|
||||
TEST_CHECK(elapsed >= 10000U && elapsed <= 120000U,
|
||||
"Phase11: KeepAlive triggered after %lums (expect 10000..120000ms)",
|
||||
elapsed);
|
||||
TEST_REPORT("Phase 11");
|
||||
s_phase11_armed = 0;
|
||||
return 1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
#endif
|
||||
|
||||
@@ -920,7 +933,9 @@ void net_layer_test_main(void)
|
||||
phase10_run(sockfd);
|
||||
#endif
|
||||
#ifdef ENABLE_PHASE11_TESTS
|
||||
phase11_run(sockfd);
|
||||
if (phase11_run(sockfd)) {
|
||||
phase_active = 0; /* 已报告：释放主循环去 accept 新连接（net 层已 auto_relisten） */
|
||||
}
|
||||
#endif
|
||||
#ifdef ENABLE_PHASE13_TESTS
|
||||
/* Phase 13（链路时延 L3~L7/L10，M2）：独立运行，勿与其他 Phase 混选；
|
||||
|
||||
@@ -0,0 +1,123 @@
|
||||
#!/usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
pasv_probe.py — decisive probe for the "storm" signature (N34).
|
||||
|
||||
Per FTP round prints: device PASV port, PC data-socket SOURCE port, round
|
||||
result, and timing. Hypothesis under test: the CH395F reuses the same
|
||||
ephemeral PASV port for the next data listener while the previous data
|
||||
connection is still in chip-side TIME_WAIT with the same 4-tuple
|
||||
(PC source port reused too) -> chip reports CONNECT then RSTs ~10ms later
|
||||
(serial: "sock4 standalone accept" + "DISCONNECTED chip st=0x00/0x00").
|
||||
|
||||
Usage:
|
||||
python pasv_probe.py --rounds 5 --delay 2 # reproduce (fast rounds)
|
||||
python pasv_probe.py --rounds 3 --delay 35 # TIME_WAIT window test
|
||||
"""
|
||||
import argparse
|
||||
import re
|
||||
import socket
|
||||
import sys
|
||||
import time
|
||||
|
||||
IP_DEFAULT = "192.168.1.100"
|
||||
|
||||
|
||||
def ftp_stor_round(ip, user, pwd, fname, payload):
|
||||
"""One login -> PASV -> STOR -> verify transfer. Returns (ok, pasv_port,
|
||||
pc_src_port, detail)."""
|
||||
c = socket.create_connection((ip, 21), timeout=10)
|
||||
c.settimeout(10)
|
||||
pc_src = None
|
||||
pasv_port = None
|
||||
try:
|
||||
def readline():
|
||||
buf = b""
|
||||
while not buf.endswith(b"\n"):
|
||||
ch = c.recv(1)
|
||||
if not ch:
|
||||
break
|
||||
buf += ch
|
||||
return buf.decode(errors="replace").strip()
|
||||
|
||||
def cmd(line):
|
||||
c.sendall((line + "\r\n").encode())
|
||||
return readline()
|
||||
|
||||
greet = readline()
|
||||
if not greet.startswith("220"):
|
||||
return False, None, None, "no greeting: " + greet
|
||||
r = cmd("USER " + user)
|
||||
if not r.startswith("331"):
|
||||
return False, None, None, "USER: " + r
|
||||
r = cmd("PASS " + pwd)
|
||||
if not r.startswith("230"):
|
||||
return False, None, None, "PASS: " + r
|
||||
r = cmd("PASV")
|
||||
m = re.search(r"\((\d+),(\d+),(\d+),(\d+),(\d+),(\d+)\)", r)
|
||||
if not r.startswith("227") or not m:
|
||||
return False, None, None, "PASV: " + r
|
||||
g = [int(x) for x in m.groups()]
|
||||
pasv_port = g[4] * 256 + g[5]
|
||||
d = socket.create_connection((ip, pasv_port), timeout=8)
|
||||
pc_src = d.getsockname()[1]
|
||||
r = cmd("STOR " + fname)
|
||||
if not r.startswith(("125", "150")):
|
||||
d.close()
|
||||
return False, pasv_port, pc_src, "STOR: " + r
|
||||
d.sendall(payload)
|
||||
d.close()
|
||||
# drain until final 2xx (multi-line or single)
|
||||
final = ""
|
||||
t0 = time.time()
|
||||
while time.time() - t0 < 10:
|
||||
r = readline()
|
||||
if not r:
|
||||
break
|
||||
final = r
|
||||
if r[:1] in ("2", "4", "5"):
|
||||
break
|
||||
ok = final.startswith("2")
|
||||
cmd("QUIT")
|
||||
return ok, pasv_port, pc_src, ("OK" if ok else "final: " + final)
|
||||
finally:
|
||||
c.close()
|
||||
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--ip", default=IP_DEFAULT)
|
||||
ap.add_argument("--rounds", type=int, default=5)
|
||||
ap.add_argument("--delay", type=float, default=2.0,
|
||||
help="seconds between rounds")
|
||||
ap.add_argument("--user", default="admin")
|
||||
ap.add_argument("--pwd", default="admin")
|
||||
ap.add_argument("--size", type=int, default=1024)
|
||||
args = ap.parse_args()
|
||||
|
||||
payload = bytes((i * 7 + 3) & 0xFF for i in range(args.size))
|
||||
ports, srcs, oks = [], [], []
|
||||
for i in range(args.rounds):
|
||||
t = time.strftime("%H:%M:%S")
|
||||
ok, port, src, detail = ftp_stor_round(args.ip, args.user, args.pwd,
|
||||
"PP%d.BIN" % i, payload)
|
||||
ports.append(port)
|
||||
srcs.append(src)
|
||||
oks.append(ok)
|
||||
print("[%s] round %d: ok=%-5s pasv_port=%-6s pc_src=%-6s %s"
|
||||
% (t, i + 1, ok, port, src, detail))
|
||||
if i + 1 < args.rounds:
|
||||
time.sleep(args.delay)
|
||||
|
||||
print("\nports :", ports)
|
||||
print("pc_src:", srcs)
|
||||
print("ok :", oks)
|
||||
same_port = len(set(p for p in ports if p)) == 1
|
||||
same_src = len(set(s for s in srcs if s)) == 1
|
||||
print("PASV port constant: %s | PC source port constant: %s"
|
||||
% (same_port, same_src))
|
||||
return 0 if all(oks) else 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
Reference in New Issue
Block a user