Merge pull request #4 from codex/jd-native-outbound-relay-20260806

fix(native): harden JD relay ACK and hardware reset

product-source/hololake-platform/guanghu-os/native/x86_64-bios/boot.asm

@@ -305,6 +305,9 @@ serial_write64:
 
 hardware_reset64:
     cli
+    mov dx, 0xcf9
+    mov al, 0x06
+    out dx, al
 .wait_kbc:
     in al, 0x64
     test al, 2
@@ -358,6 +361,9 @@ real_mode_write_proof:
     mov si, msg_disk_proof
     call serial_write16
     cli
+    mov dx, 0xcf9
+    mov al, 0x06
+    out dx, al
 .wait_kbc:
     in al, 0x64
     test al, 2

product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py

@@ -124,6 +124,8 @@ def main() -> None:
     parser.add_argument("--native-relay", action="store_true")
     parser.add_argument("--allowed-source")
     parser.add_argument("--native-ack-delay", type=float, default=0.25)
+    parser.add_argument("--native-ack-repetitions", type=int, default=4)
+    parser.add_argument("--native-ack-interval", type=float, default=0.1)
     args = parser.parse_args()
     if args.retry_interval < 1.0:
         raise SystemExit("--retry-interval must be at least 1 second")
@@ -133,6 +135,10 @@ def main() -> None:
         raise SystemExit("--resume-resident-count must be between 0 and 10")
     if not 0.0 <= args.native_ack_delay <= 2.0:
         raise SystemExit("--native-ack-delay must be between 0 and 2 seconds")
+    if not 1 <= args.native_ack_repetitions <= 10:
+        raise SystemExit("--native-ack-repetitions must be between 1 and 10")
+    if not 0.0 <= args.native_ack_interval <= 1.0:
+        raise SystemExit("--native-ack-interval must be between 0 and 1 second")
     if sum(
         (
             args.resident,
@@ -187,8 +193,14 @@ def main() -> None:
             # The public-cloud NAT path is established by the host kernel's
             # ordinary echo reply. Delay the authenticated ACK long enough for
             # the native guest to discard that reply and repost its RX buffer.
+            # Repeat the authenticated frame because the physical JD path can
+            # lose a single raw-socket reply after NAT has been established.
             time.sleep(args.native_ack_delay)
-            peer.sendto(native_ack_reply(packet), address)
+            reply = native_ack_reply(packet)
+            for repetition in range(args.native_ack_repetitions):
+                peer.sendto(reply, address)
+                if repetition + 1 < args.native_ack_repetitions:
+                    time.sleep(args.native_ack_interval)
             acknowledged.add(sequence)
             sources.add(source)
             if len(acknowledged) == len(pipeline) and completed_at is None:
@@ -205,6 +217,8 @@ def main() -> None:
             "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n"
             "native_ack_marker: HLDP-NATIVE-ACK!\n"
             f"native_ack_delay_seconds: {args.native_ack_delay:g}\n"
+            f"native_ack_repetitions: {args.native_ack_repetitions}\n"
+            f"native_ack_interval_seconds: {args.native_ack_interval:g}\n"
             "acknowledged_sequences: 1-16\n"
             f"observed_nat_sources: {','.join(sorted(sources))}\n"
             "login_reply_count: 3\n"

product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py

@@ -146,7 +146,11 @@ def main() -> None:
         verified_request(frame, sequence, magic)
         peer.sendto(ordinary_reply(frame), qemu)
         time.sleep(0.05)
-        peer.sendto(authenticated_reply(frame, magic), qemu)
+        reply = authenticated_reply(frame, magic)
+        for repetition in range(4):
+            peer.sendto(reply, qemu)
+            if repetition < 3:
+                time.sleep(0.01)
 
         terminal_sequence = 3 if args.login_only else (16 if args.resident else 5)
         if sequence != terminal_sequence:
@@ -156,6 +160,7 @@ def main() -> None:
                 "arp_gateway_reply: VERIFIED\n"
                 "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n"
                 "authenticated_relay_reply: VERIFIED\n"
+                "authenticated_relay_reply_burst: 4\n"
                 "ordinary_echo_reply_ignored: true\n"
                 "icmp_login_request_sent: true\n"
                 "icmp_login_reply_verified: true\n"

product-source/hololake-platform/guanghu-os/scripts/test-jd-native-resident-candidate.sh

@@ -62,6 +62,7 @@ peer_pid=
 grep -q '^handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP$' \
   "${test_root}/peer.hldp"
 grep -q '^authenticated_relay_reply: VERIFIED$' "${test_root}/peer.hldp"
+grep -q '^authenticated_relay_reply_burst: 4$' "${test_root}/peer.hldp"
 grep -q '^ordinary_echo_reply_ignored: true$' "${test_root}/peer.hldp"
 grep -q '^icmp_login_reply_count: 3$' "${test_root}/peer.hldp"
 grep -q '^code_commit_reply_verified: true$' "${test_root}/peer.hldp"