From 89ba602e4fad32c1c5d175a6cd2619ccc4ef7080 Mon Sep 17 00:00:00 2001 From: wangfq Date: Mon, 17 Aug 2026 14:18:52 +0800 Subject: [PATCH] =?UTF-8?q?fix(vd960DBN):=20=E6=A0=88=E6=BA=A2=E5=87=BA?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E9=97=AD=E7=8E=AF=20=E2=80=94=20=E6=89=93?= =?UTF-8?q?=E5=8D=B0=E6=81=A2=E5=A4=8D=20+=20=E5=AD=97=E7=AC=A6=E4=B8=B20?= =?UTF-8?q?=E7=BB=88=E6=AD=A2=E4=BF=9D=E9=99=A9=20(2026-08-17)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RAM 瘦身后栈 1.9KB→~4.75KB (END 0x2000f834→0x2000ed3c 实测), printf 峰值安全: - cfig_flash.c: 恢复 load_cfg 3 处调试 PRINT (magic mismatch×2 + Sub_Code) - cfig_flash.c: 字符串 0 终止保险 (remote_addr/client_id/username/password/topic_pub/sub 末字节强制 '\0', 防 Flash 字符串不足定长时 %s 越界打印) - peripheral_main.c: 恢复 output_cfg_from_flash() (调试配置打印) - 注释更新为修复闭环说明 设备实测: 无复位, MQTT 连 159.75.137.141:1883, BLE 广播正常 --- .../OnlyUpdateApp_Peripheral/APP/cfig_flash.c | 22 ++++++++++++++----- .../APP/peripheral_main.c | 14 +++++------- 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c index 49a7422..c41ab26 100644 --- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c +++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/cfig_flash.c @@ -245,8 +245,8 @@ void load_cfg_from_flash(void) 现场: SPI_Flash_Write(参数区 0x00, 512B) → RST=0x00000000 硬件复位 → magic 写不进 → 无限复位循环。SPI 写触发硬件复位实锤(与快照区无关)。 临时方案: 不写 Flash, 用内存默认配置继续 (恢复原逻辑删本块即可) */ - /* 2026-08-17 栈溢出修复: 调试 PRINT 栈峰值触顶(1.9KB栈), #if 0 */ - /* PRINT("CFG: magic mismatch - MEMORY DEFAULTS (factory SPI write disabled)\n"); */ + /* 2026-08-17 栈溢出修复后恢复 (栈~4.75KB) */ + PRINT("CFG: magic mismatch - MEMORY DEFAULTS (factory SPI write disabled)\n"); memset(g_dev_number, 0, 6); memcpy(g_dev_number, gMacAddr, 6); sprintf(g_dev_number_str, "%02X%02X%02X%02X%02X%02X", @@ -290,8 +290,8 @@ void load_cfg_from_flash(void) g_sub_code_enable.dgdus_enable = 0; g_sub_code_enable.wbdus_enable = 0; g_sub_code_enable.radar_enable = 0; - /* 2026-08-17 栈溢出修复: #if 0 */ - /* PRINT("CFG: memory defaults OK (no factory write)\n"); */ + /* 2026-08-17 栈溢出修复后恢复 */ + PRINT("CFG: memory defaults OK (no factory write)\n"); return; } @@ -352,6 +352,16 @@ void load_cfg_from_flash(void) + + /* 2026-08-17: 字符串 0 终止保险 — Flash 中字符串若不足定长且后续 0xFF, + %s 打印会越界(历史乱码根因之一)。强制定长缓冲末字节为 '\0' */ + iot_net_info.remote_addr[63] = '\0'; + iot_net_info.client_id[63] = '\0'; + iot_net_info.username[63] = '\0'; + iot_net_info.password[31] = '\0'; + g_iot_topic.topic_pub[63] = '\0'; + g_iot_topic.topic_sub[63] = '\0'; + free(mBuff); g_sub_code_enable.net_enable = g_sub_code_enable.code_set & 0x01; @@ -362,8 +372,8 @@ void load_cfg_from_flash(void) g_sub_code_enable.wbdus_enable = (g_sub_code_enable.code_set >> 5) & 0x01; g_sub_code_enable.radar_enable = (g_sub_code_enable.code_set >> 6) & 0x01; - /* 2026-08-17 栈溢出修复: #if 0 */ - /* PRINT("\nSub_Code: 0x%04X, net_enable:%d, iot_enable:%d\n", g_sub_code_enable.code_set, g_sub_code_enable.net_enable, g_sub_code_enable.iot_enable); */ + /* 2026-08-17 栈溢出修复后恢复 */ + PRINT("\nSub_Code: 0x%04X, net_enable:%d, iot_enable:%d\n", g_sub_code_enable.code_set, g_sub_code_enable.net_enable, g_sub_code_enable.iot_enable); // g_sub_code_enable.laser_enable = (g_sub_code_enable.code_set >> 9) & 0x01; // g_sub_code_enable.lora_enable = (g_sub_code_enable.code_set >> 15) & 0x01; diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c index f83bb49..f918544 100644 --- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c +++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/peripheral_main.c @@ -357,15 +357,13 @@ int main(void) OFFLOG_RCC_RSTSCKR |= OFFLOG_RST_RMVF; /* RMVF (bit24): 清复位标志 */ } - /* ===== 栈溢出修复 (2026-08-17): 实验D确认 load_cfg/output_cfg 为触发点 ===== - .bss≈46KB → 栈仅~1.9KB; load_cfg 的 printf 栈峰值触顶 → 跑飞。 - 修复: load_cfg 恢复(保留配置加载), 其内部调试 PRINT 已 #if 0 (cfig_flash.c); - output_cfg 全部为调试打印, 调用暂 #if 0 (栈峰值来源)。 - 根治: 减 .bss 给栈腾 4KB+ (待 .map 确认大数组) */ + /* ===== 栈溢出修复闭环 (2026-08-17) ===== + 根因: .bss≈46KB → 栈仅~1.9KB; load_cfg/output_cfg 的 printf 栈峰值触顶 + → 覆盖 .noinit+返回地址 → PC 跑飞循环。 + 修复: ①实验D定位触发点 ②RAM 瘦身 (ETH 768/payload 800/MQTT buf 800, + 栈 1.9KB→~4.75KB) ③load_cfg 字符串 0 终止保险 ④打印恢复。 */ load_cfg_from_flash(); -#if 0 - output_cfg_from_flash(); /* 调试打印专用, 栈峰值高, 恢复前需减栈压力 */ -#endif + output_cfg_from_flash(); /* 2026-08-17: 栈瘦身后恢复 (栈~4.75KB, printf 峰值安全) */ #endif PRINT("MAC: %02X %02X %02X %02X %02X %02X\r\n", gMacAddr[0],gMacAddr[1], gMacAddr[2], gMacAddr[3],gMacAddr[4],gMacAddr[5]);