wandering1
a12367981d
48 轮直读 SINT 矩阵（8 周期×6 变体）复核历史"丢中断"说法：芯片侧事件 丢失 = 0。归类：drain 读清消费 3/48（drain-int 探针现场抓获）、门控 竞态 2/48、主机同步 1/48、幽灵态 0/48 未复现。 根除性修复：net_listen_locked / net_listener_try 的排事件读清从 listen 后挪至 LISTEN 命令之前——新连接 CONNECT 落进该窗即被本方读清 吞掉，即"数据被吞"的生产侧自伤机制（台架 3/48 为同形态放大版）。 全局读收口：全局中断寄存器唯一读者 = net_poll（I7）；生产/测试/台架 游离全局读全部删除，ch395f.h 声明处加护栏注释。 归因更正：17 文件约 40 处"丢中断"措辞改为"事件未收到/读清消费竞态" （机制全部保留，仅归因更正）；设计文档 §5.2 新增 E14 锚点；Trap Records TRAP-NET-17/-20/B3 归因更正段；配图生成器与 SVG 重生成。 台架：事件未收到复核探针保留（drain-int / SINT 补读×3 / 超时归类）， 下次跑矩阵自动归类；实验注册（main.c/uvprojx）已完全还原。 验证：@build 0 错误 0 警告；ci_local L0 32/0 + gitlint + L0.5 953/953；doc-links --all --sections-strict 通过；@test PASS（无 [ERR]，net init 619ms）；回归 :7003 300ms×10 = 10/10、:21 n30×50 = 0/50 失败。
124 lines
4.1 KiB
Python
124 lines
4.1 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
"""
|
|
pasv_probe.py — decisive probe for the "storm" signature (self-heal audit E8).
|
|
|
|
Per FTP round prints: device PASV port, PC data-socket SOURCE port, round
|
|
result, and timing. Hypothesis under test: the CH395F reuses the same
|
|
ephemeral PASV port for the next data listener while the previous data
|
|
connection is still in chip-side TIME_WAIT with the same 4-tuple
|
|
(PC source port reused too) -> chip reports CONNECT then RSTs ~10ms later
|
|
(serial: "sock4 standalone accept" + "DISCONNECTED chip st=0x00/0x00").
|
|
|
|
Usage:
|
|
python pasv_probe.py --rounds 5 --delay 2 # reproduce (fast rounds)
|
|
python pasv_probe.py --rounds 3 --delay 35 # TIME_WAIT window test
|
|
"""
|
|
import argparse
|
|
import re
|
|
import socket
|
|
import sys
|
|
import time
|
|
|
|
IP_DEFAULT = "192.168.1.100"
|
|
|
|
|
|
def ftp_stor_round(ip, user, pwd, fname, payload):
|
|
"""One login -> PASV -> STOR -> verify transfer. Returns (ok, pasv_port,
|
|
pc_src_port, detail)."""
|
|
c = socket.create_connection((ip, 21), timeout=10)
|
|
c.settimeout(10)
|
|
pc_src = None
|
|
pasv_port = None
|
|
try:
|
|
def readline():
|
|
buf = b""
|
|
while not buf.endswith(b"\n"):
|
|
ch = c.recv(1)
|
|
if not ch:
|
|
break
|
|
buf += ch
|
|
return buf.decode(errors="replace").strip()
|
|
|
|
def cmd(line):
|
|
c.sendall((line + "\r\n").encode())
|
|
return readline()
|
|
|
|
greet = readline()
|
|
if not greet.startswith("220"):
|
|
return False, None, None, "no greeting: " + greet
|
|
r = cmd("USER " + user)
|
|
if not r.startswith("331"):
|
|
return False, None, None, "USER: " + r
|
|
r = cmd("PASS " + pwd)
|
|
if not r.startswith("230"):
|
|
return False, None, None, "PASS: " + r
|
|
r = cmd("PASV")
|
|
m = re.search(r"\((\d+),(\d+),(\d+),(\d+),(\d+),(\d+)\)", r)
|
|
if not r.startswith("227") or not m:
|
|
return False, None, None, "PASV: " + r
|
|
g = [int(x) for x in m.groups()]
|
|
pasv_port = g[4] * 256 + g[5]
|
|
d = socket.create_connection((ip, pasv_port), timeout=8)
|
|
pc_src = d.getsockname()[1]
|
|
r = cmd("STOR " + fname)
|
|
if not r.startswith(("125", "150")):
|
|
d.close()
|
|
return False, pasv_port, pc_src, "STOR: " + r
|
|
d.sendall(payload)
|
|
d.close()
|
|
# drain until final 2xx (multi-line or single)
|
|
final = ""
|
|
t0 = time.time()
|
|
while time.time() - t0 < 10:
|
|
r = readline()
|
|
if not r:
|
|
break
|
|
final = r
|
|
if r[:1] in ("2", "4", "5"):
|
|
break
|
|
ok = final.startswith("2")
|
|
cmd("QUIT")
|
|
return ok, pasv_port, pc_src, ("OK" if ok else "final: " + final)
|
|
finally:
|
|
c.close()
|
|
|
|
|
|
def main():
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument("--ip", default=IP_DEFAULT)
|
|
ap.add_argument("--rounds", type=int, default=5)
|
|
ap.add_argument("--delay", type=float, default=2.0,
|
|
help="seconds between rounds")
|
|
ap.add_argument("--user", default="admin")
|
|
ap.add_argument("--pwd", default="admin")
|
|
ap.add_argument("--size", type=int, default=1024)
|
|
args = ap.parse_args()
|
|
|
|
payload = bytes((i * 7 + 3) & 0xFF for i in range(args.size))
|
|
ports, srcs, oks = [], [], []
|
|
for i in range(args.rounds):
|
|
t = time.strftime("%H:%M:%S")
|
|
ok, port, src, detail = ftp_stor_round(args.ip, args.user, args.pwd,
|
|
"PP%d.BIN" % i, payload)
|
|
ports.append(port)
|
|
srcs.append(src)
|
|
oks.append(ok)
|
|
print("[%s] round %d: ok=%-5s pasv_port=%-6s pc_src=%-6s %s"
|
|
% (t, i + 1, ok, port, src, detail))
|
|
if i + 1 < args.rounds:
|
|
time.sleep(args.delay)
|
|
|
|
print("\nports :", ports)
|
|
print("pc_src:", srcs)
|
|
print("ok :", oks)
|
|
same_port = len(set(p for p in ports if p)) == 1
|
|
same_src = len(set(s for s in srcs if s)) == 1
|
|
print("PASV port constant: %s | PC source port constant: %s"
|
|
% (same_port, same_src))
|
|
return 0 if all(oks) else 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|