From f692be0c9034d067d6701f165dbbf1c29e5b3e52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com> Date: Thu, 6 Aug 2026 22:42:53 +0800 Subject: [PATCH] fix(native): harden JD relay ACK and hardware reset --- .../guanghu-os/native/x86_64-bios/boot.asm | 6 ++++++ .../scripts/physical-native-icmp-peer.py | 16 +++++++++++++++- .../guanghu-os/scripts/qemu-native-net-peer.py | 7 ++++++- .../scripts/test-jd-native-resident-candidate.sh | 1 + 4 files changed, 28 insertions(+), 2 deletions(-) diff --git a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/boot.asm b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/boot.asm index 3a3f6c4..cc0c4b6 100644 --- a/product-source/hololake-platform/guanghu-os/native/x86_64-bios/boot.asm +++ b/product-source/hololake-platform/guanghu-os/native/x86_64-bios/boot.asm @@ -305,6 +305,9 @@ serial_write64: hardware_reset64: cli + mov dx, 0xcf9 + mov al, 0x06 + out dx, al .wait_kbc: in al, 0x64 test al, 2 @@ -358,6 +361,9 @@ real_mode_write_proof: mov si, msg_disk_proof call serial_write16 cli + mov dx, 0xcf9 + mov al, 0x06 + out dx, al .wait_kbc: in al, 0x64 test al, 2 diff --git a/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py b/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py index 516aaa3..4fb3ab3 100755 --- a/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py +++ b/product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py @@ -124,6 +124,8 @@ def main() -> None: parser.add_argument("--native-relay", action="store_true") parser.add_argument("--allowed-source") parser.add_argument("--native-ack-delay", type=float, default=0.25) + parser.add_argument("--native-ack-repetitions", type=int, default=4) + parser.add_argument("--native-ack-interval", type=float, default=0.1) args = parser.parse_args() if args.retry_interval < 1.0: raise SystemExit("--retry-interval must be at least 1 second") @@ -133,6 +135,10 @@ def main() -> None: raise SystemExit("--resume-resident-count must be between 0 and 10") if not 0.0 <= args.native_ack_delay <= 2.0: raise SystemExit("--native-ack-delay must be between 0 and 2 seconds") + if not 1 <= args.native_ack_repetitions <= 10: + raise SystemExit("--native-ack-repetitions must be between 1 and 10") + if not 0.0 <= args.native_ack_interval <= 1.0: + raise SystemExit("--native-ack-interval must be between 0 and 1 second") if sum( ( args.resident, @@ -187,8 +193,14 @@ def main() -> None: # The public-cloud NAT path is established by the host kernel's # ordinary echo reply. Delay the authenticated ACK long enough for # the native guest to discard that reply and repost its RX buffer. + # Repeat the authenticated frame because the physical JD path can + # lose a single raw-socket reply after NAT has been established. time.sleep(args.native_ack_delay) - peer.sendto(native_ack_reply(packet), address) + reply = native_ack_reply(packet) + for repetition in range(args.native_ack_repetitions): + peer.sendto(reply, address) + if repetition + 1 < args.native_ack_repetitions: + time.sleep(args.native_ack_interval) acknowledged.add(sequence) sources.add(source) if len(acknowledged) == len(pipeline) and completed_at is None: @@ -205,6 +217,8 @@ def main() -> None: "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n" "native_ack_marker: HLDP-NATIVE-ACK!\n" f"native_ack_delay_seconds: {args.native_ack_delay:g}\n" + f"native_ack_repetitions: {args.native_ack_repetitions}\n" + f"native_ack_interval_seconds: {args.native_ack_interval:g}\n" "acknowledged_sequences: 1-16\n" f"observed_nat_sources: {','.join(sorted(sources))}\n" "login_reply_count: 3\n" diff --git a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py index f3ee755..368acf7 100644 --- a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py +++ b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py @@ -146,7 +146,11 @@ def main() -> None: verified_request(frame, sequence, magic) peer.sendto(ordinary_reply(frame), qemu) time.sleep(0.05) - peer.sendto(authenticated_reply(frame, magic), qemu) + reply = authenticated_reply(frame, magic) + for repetition in range(4): + peer.sendto(reply, qemu) + if repetition < 3: + time.sleep(0.01) terminal_sequence = 3 if args.login_only else (16 if args.resident else 5) if sequence != terminal_sequence: @@ -156,6 +160,7 @@ def main() -> None: "arp_gateway_reply: VERIFIED\n" "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n" "authenticated_relay_reply: VERIFIED\n" + "authenticated_relay_reply_burst: 4\n" "ordinary_echo_reply_ignored: true\n" "icmp_login_request_sent: true\n" "icmp_login_reply_verified: true\n" diff --git a/product-source/hololake-platform/guanghu-os/scripts/test-jd-native-resident-candidate.sh b/product-source/hololake-platform/guanghu-os/scripts/test-jd-native-resident-candidate.sh index 41009ee..181d8c0 100755 --- a/product-source/hololake-platform/guanghu-os/scripts/test-jd-native-resident-candidate.sh +++ b/product-source/hololake-platform/guanghu-os/scripts/test-jd-native-resident-candidate.sh @@ -62,6 +62,7 @@ peer_pid= grep -q '^handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP$' \ "${test_root}/peer.hldp" grep -q '^authenticated_relay_reply: VERIFIED$' "${test_root}/peer.hldp" +grep -q '^authenticated_relay_reply_burst: 4$' "${test_root}/peer.hldp" grep -q '^ordinary_echo_reply_ignored: true$' "${test_root}/peer.hldp" grep -q '^icmp_login_reply_count: 3$' "${test_root}/peer.hldp" grep -q '^code_commit_reply_verified: true$' "${test_root}/peer.hldp"