mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-10-29 17:54:14 +08:00
DrDoof
c3b4cc893b
Dynamic link aggregation on top of the static LAGG, for RTL8372/8373: receive, selection and mux state machines (coupled mux, one aggregator per group), with "lacp show" to look inside. Each of the four trunk groups runs its own aggregator on the candidate ports assigned with "lag <n> lacp <ports>"; the engine starts with the first such group and stops with the last. LACPDUs reach the CPU through the reserved-multicast trap, so delivery needs no L2 entry and nothing written per VLAN or per PVID. The trap acts on the address before the VLAN lookup and before the ingress filters, so a LACPDU also arrives on a port that admits tagged frames only and on a port STP holds in blocking, neither of which a forwarded one reaches. A trapped frame carries no VLAN tag, so lacp_in() takes the offset of the PDU body from TRAP_RX_BODY(). The action is set with trap_rma_set(), which leaves the flags sharing that register alone, and "lacp off" puts the slow-protocols drop default back. doc/lacp.md and doc/link_aggregation.md record what was measured, including why the trap looked like a dead end at first. The web UI gets a Static/LACP mode per group on the LAG page with live status, and the startup-config validator knows the per-group syntax. A host-side sandbox for the state machines runs in the test harness together with the LAG hash check. It drives both forms of an incoming LACPDU, so the body offset of a trapped one is covered as well. The L2 table page iterated with the "next unicast" read method, so static multicast entries such as an IGMP group were invisible. It now iterates with "next address", skips L3 entries (their layout carries IP addresses where a MAC is expected), and reports the lowest member of a multicast entry's port mask, so such an entry shows up as a static entry on that port. A port taken out of LACP forgets its partner, so "lacp show" after "lacp off" no longer reports one. Applying the same candidate set to a group again, as the LAG page does on every Apply, leaves the trunk alone instead of tearing it down for a second or two. lacp_in() checks the frame length and ethertype before reading a LACPDU, so a runt or a foreign frame on the slow-protocols address cannot leave stale buffer bytes as a partner. The sandbox covers these three in T20-T22. On the LAG page, LACP mode with no ports checked sends "lag N lacp off", and the startup-config validator wants at least one port after "lacp".
65 lines
4.0 KiB
Markdown
65 lines
4.0 KiB
Markdown
# Host unit-test harness
|
|
|
|
Compile and test individual firmware translation units on the build host with
|
|
**gcc + AddressSanitizer + UBSan** — no SDCC, no flashing, no hardware. This is
|
|
the fast inner loop for the logic-level bugs in `../../NOTES/08-findings.md`
|
|
(parser, line editor, HTTP header, DHCP): edit → `make` → see red/green in
|
|
seconds instead of a minutes-long flash-and-reboot cycle.
|
|
|
|
## Run
|
|
```
|
|
cd test
|
|
make # build + run all tests (ASan/UBSan on)
|
|
make clean
|
|
```
|
|
Exit status is non-zero if any check fails, a sanitizer trips, or the watchdog
|
|
fires — so it drops straight into CI.
|
|
|
|
## How it works
|
|
- **`sdcc_shim.h`** (force-included) erases SDCC 8051 keywords (`__xdata`,
|
|
`__code`, `__banked`, …) so firmware sources compile under host gcc. It changes
|
|
no logic — the code under test is byte-for-byte the firmware source.
|
|
- **`hw_mock.c` / `hw_mock.h`** simulate the ASIC edge: a flat register file
|
|
behind `reg_read`/`reg_write` and the `SFR_DATA_*` registers, with a table
|
|
engine that performs a VLAN or L2 operation the moment `TBL_CTRL` is written,
|
|
fetches a MIB counter on `STAT_GET` and drops entries on `L2_TBL_FLUSH_CTRL`.
|
|
Nothing ever reports busy, so a polling loop runs once. The header states the
|
|
VLAN and L2 entry layouts independently of the firmware, so a test can hold
|
|
what `rtl837x_port.c` writes against what `page_impl.c` reads.
|
|
- **`env_tables.c`** carries the globals and leaf calls those two modules link
|
|
against; **`stub/`** stands in for the two headers only a firmware build
|
|
generates, so the harness needs no SDCC build first.
|
|
- **`support.c` / `support.h`** mock the hardware edges: the 16-byte serial ring
|
|
(`sbuf`), the command/history buffers, and the character-output sink
|
|
(`write_char` etc.). Buffers are sized **exactly** as on target, so ASan
|
|
redzones catch the same off-by-one overflows the 8051 hits.
|
|
- Builds define **`RTLP_HOST_TEST`**, which hides the firmware's libc-named
|
|
prototypes (`memset`/`strlen`/…) in `rtl837x_common.h` so they don't clash with
|
|
glibc. Argument order matches libc, so on-host callers transparently use the C
|
|
library. This guard is compiled out of normal firmware builds — zero on-target
|
|
effect.
|
|
- A **SIGALRM watchdog** (`watchdog_arm`) turns an infinite-loop bug into a fast
|
|
test failure instead of a hung runner.
|
|
|
|
## Current coverage
|
|
| Test binary | TU under test | Findings exercised |
|
|
|-------------|---------------|--------------------|
|
|
| `test_cmd_editor` | `cmd_editor.c` | **C4** — full-line hang + `cmd_buffer` 1-byte overflow; basic entry & backspace regressions |
|
|
| `test_port_tables` | `rtl837x_port.c` | VLAN entry layout and round trip, PVID register sharing, static multicast and management entries, per-port flush, trunk membership and hash seed |
|
|
| `test_page_json` | `httpd/page_impl.c` + `rtl837x_port.c` | `/vlan.json`, `/vlanlist`, `/l2.json` (walk, wrap marker, paging inside `outbuf`), 64-bit counters in `/status.json` and `/counters.json` |
|
|
| `test_httpd_tx` | `httpd/httpd.c` + `uip/uip.c` | a GET of a static file against a client that moves its receive window: ACK accounting, continuation chunks out of flash, retransmission |
|
|
| `lacp/` | `rtl837x_lacp.c` | state machines against a simulated 802.3ad partner: convergence, mis-cabling, expiry, re-election, two groups, LACPDU containment entries |
|
|
| `port_hash/` | `port_lag_members_set()` | a LAG seeds its own hash register |
|
|
|
|
## Adding a test for another module
|
|
1. Write `test_<module>.c` with `main()` driving the module's entry points and
|
|
`CHECK(cond, msg)` assertions.
|
|
2. Add any missing mocked symbols to `support.c` (only what the linker asks for).
|
|
3. Add a target in the `Makefile` listing `test_<module>.c support.c ../<module>.c`.
|
|
4. If the module calls a firmware libc-name (`memcpy`/`strcpy`/…), it will use the
|
|
C library on host (compatible arg order); provide a `fw_*`-style mock only if
|
|
the semantics differ in a way the test cares about.
|
|
|
|
Good next targets (pure logic, high finding density): `cmd_parser.c` (C6/C8),
|
|
the HTTP header parser in `httpd/httpd.c` (S1), `dhcp.c` (S5).
|