ESP32 死机怎么看？从 backtrace 到 watchdog 和栈溢出

# POSIX shell · 配合本节前提逐项执行
export LAB_PROJECT="$PWD"
export LAB_BUILD="$HOME/esp32-labs/r02-safe"
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_BUILD" -D SDKCONFIG="$LAB_BUILD/sdkconfig" build
# 确认板型、串口和备份后才自行执行；本文没有执行烧录。
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_BUILD" -p YOUR_SERIAL_PORT flash monitor

# POSIX shell · 配合本节前提逐项执行
export LAB_FAULT_BUILD="$HOME/esp32-labs/r02-faults"
python "$IDF_PATH/tools/idf.py" -C "$LAB_PROJECT" -B "$LAB_FAULT_BUILD" -D SDKCONFIG="$LAB_FAULT_BUILD/sdkconfig" -D 'SDKCONFIG_DEFAULTS=sdkconfig.defaults;config/faults.defaults' build
# 按前述要求自行flash/monitor该目录；一次只做一项并保存完整原log。

# POSIX shell · 配合本节前提逐项执行
python -c 'import hashlib,pathlib; p=pathlib.Path("/ABS/PATH/to/esp32_crash_watchdog_backtrace.elf"); print(hashlib.sha256(p.read_bytes()).hexdigest())'
python tools/decode_trace.py --elf /ABS/PATH/to/esp32_crash_watchdog_backtrace.elf --trace /ABS/PATH/raw-panic.log --expected-elf-sha YOUR_64_LOWERCASE_HEX --provenance hardware

# POSIX shell · 配合本节前提逐项执行
cc -std=c11 -Wall -Wextra -Werror -Imain host/policy_test.c -o /tmp/r02-policy
/tmp/r02-policy
python tools/make_synthetic_trace.py --elf /ABS/PATH/to/faults/esp32_crash_watchdog_backtrace.elf --out /tmp/r02-synthetic.log
python tools/decode_trace.py --elf /ABS/PATH/to/faults/esp32_crash_watchdog_backtrace.elf --trace /tmp/r02-synthetic.log --expected-elf-sha YOUR_64_LOWERCASE_HEX --provenance synthetic

// ---- main/main.c ----
/* SPDX-License-Identifier: MIT */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <inttypes.h>
#include "sdkconfig.h"
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "esp_system.h"
#include "esp_app_desc.h"
#include "esp_timer.h"
#include "esp_task_wdt.h"
#include "fault_policy.h"
static volatile uint32_t probe_sink;
__attribute__((noinline)) void diagnostic_checkpoint(uint32_t n) { probe_sink=n; }
static void heartbeat(void *unused) {
 (void)unused;
 for (;;) { diagnostic_checkpoint(probe_sink+1); vTaskDelay(pdMS_TO_TICKS(500)); }
}
#if CONFIG_HX_ENABLE_FAULTS
static volatile uint32_t stack_sink;
__attribute__((noinline)) void fault_abort(void) { abort(); }
__attribute__((noinline)) void stack_recurse(unsigned depth) {
 volatile unsigned char pad[384]; pad[0]=(unsigned char)depth; pad[383]=(unsigned char)(depth+1);
 vTaskDelay(1); /* Let the scheduler check the guard; outcome still target-specific. */
 if (depth<32) stack_recurse(depth+1);
 stack_sink+=pad[0]+pad[383]; /* Prevent tail-call elimination. */
}
static void stack_task(void *unused) { (void)unused; stack_recurse(0); vTaskDelete(NULL); }
static void deliberate_twdt(void) {
 esp_task_wdt_config_t c={.timeout_ms=2000,.idle_core_mask=(1U<<portNUM_PROCESSORS)-1,.trigger_panic=true};
 esp_err_t e=esp_task_wdt_reconfigure(&c);
 if (e==ESP_ERR_INVALID_STATE) e=esp_task_wdt_init(&c);
 ESP_ERROR_CHECK(e);
 if (esp_task_wdt_status(NULL)!=ESP_OK) ESP_ERROR_CHECK(esp_task_wdt_add(NULL));
 puts("INJECTION TWDT: this subscribed task intentionally will not feed; yields for10s");
 fflush(stdout); vTaskDelay(pdMS_TO_TICKS(10000));
 puts("TWDT_NOT_OBSERVED: retain log, do not claim panic; reset lab board");
}
#endif
void app_main(void) {
 printf("R02 reset_reason=%d idf=%s firmware=%s; no fault auto-start\n",esp_reset_reason(),esp_get_idf_version(),esp_app_get_description()->version);
 if (xTaskCreate(heartbeat,"heartbeat",3072,NULL,2,NULL)!=pdPASS) { puts("TASK_ALLOC_FAILED"); return; }
#if CONFIG_HX_ENABLE_FAULTS
 puts("FAULT LAB COMPILED: exact ARM ABORT / ARM TWDT / ARM STACK can reset/corrupt this isolated run. No peripherals.");
 const int enabled=1;
#else
 puts("SAFE BUILD: ARM commands are disabled. Build explicit faults.defaults for isolated experiment only.");
 const int enabled=0;
#endif
 FaultLine input={0};
 for (;;) {
  int c=getchar();
  if(c==EOF){clearerr(stdin);vTaskDelay(pdMS_TO_TICKS(20));continue;}
  bool ready=false;Fault f=fault_feed(&input,(unsigned char)c,enabled,&ready);
  if(!ready)continue;
  printf("COMMAND t_us=%"PRId64" fault=%u free=%lu min=%lu main_stack_low_bytes=%u\n",esp_timer_get_time(),(unsigned)f,(unsigned long)esp_get_free_heap_size(),(unsigned long)esp_get_minimum_free_heap_size(),(unsigned)uxTaskGetStackHighWaterMark(NULL)); fflush(stdout);
#if CONFIG_HX_ENABLE_FAULTS
  if (f==FAULT_ABORT) fault_abort();
  else if (f==FAULT_TWDT) deliberate_twdt();
  else if (f==FAULT_STACK) { if(xTaskCreate(stack_task,"intentional_stack",2048,NULL,3,NULL)!=pdPASS) puts("FAULT_TASK_ALLOC_FAILED; no overflow executed"); }
#else
  (void)f;
#endif
 }
}

// ---- main/fault_policy.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include <string.h>
typedef enum { FAULT_NONE, FAULT_ABORT, FAULT_TWDT, FAULT_STACK } Fault;
static inline Fault fault_command(const char *text, int enabled) {
 if (!enabled || !text) return FAULT_NONE;
 if (!strcmp(text,"ARM ABORT")) return FAULT_ABORT;
 if (!strcmp(text,"ARM TWDT")) return FAULT_TWDT;
 if (!strcmp(text,"ARM STACK")) return FAULT_STACK;
 return FAULT_NONE;
}

#include <stdbool.h>
typedef struct { char bytes[80]; unsigned used; bool rejected; } FaultLine;
/* Assemble one full CR/LF terminated line, including across UART read batches.
 * Reject overflow/control bytes until the next terminator, never parse chunks. */
static inline Fault fault_feed(FaultLine *line,unsigned char c,int enabled,bool *ready) {
 *ready=false;
 if(c=='\r'||c=='\n') {
  *ready=line->used>0||line->rejected;
  line->bytes[line->used]=0;
  Fault f=line->rejected?FAULT_NONE:fault_command(line->bytes,enabled);
  line->used=0;line->rejected=false;return f;
 }
 if(c<32||c>126)line->rejected=true;
 if(!line->rejected) {
  if(line->used<sizeof(line->bytes)-1)line->bytes[line->used++]=(char)c;
  else line->rejected=true;
 }
 return FAULT_NONE;
}

# ---- tools/decode_trace.py ----
#!/usr/bin/env python3
# SPDX-License-Identifier: MIT
"""Symbolication only. Does not prove PC origin, unwind or real ESP32 panic."""
import argparse,pathlib,hashlib,json,re,subprocess

def frames(text):
    result=[]
    for block in re.findall(r'Backtrace:\s*([^\r\n]*)',text):
        for pc,sp in re.findall(r'(0x[0-9a-fA-F]{8}):(0x[0-9a-fA-F]{8})',block):result.append((pc,sp))
    if not result or len(result)>32:raise ValueError('need1..32 PC:SP pairs from Backtrace lines; preserve raw/corrupted suffix separately')
    return result

def decode(elf,trace,expected,tool,provenance):
    if not re.fullmatch('[0-9a-f]{64}',expected) or hashlib.sha256(elf.read_bytes()).hexdigest()!=expected:raise ValueError('ELF SHA mismatch; do not decode against a different build')
    if trace.stat().st_size>1048576:raise ValueError('trace exceeds1MiB cap')
    text=trace.read_text()
    if 'SYNTHETIC' in text and provenance!='synthetic':raise ValueError('synthetic fixture cannot be labeled hardware/simulation')
    pairs=frames(text);items=[]
    for pc,sp in pairs:
        r=subprocess.run([tool,'-a','-f','-C','-i','-e',str(elf),pc],capture_output=True,text=True,check=True)
        items.append({'pc':pc,'sp':sp,'symbolication':r.stdout,'unresolved': '??' in r.stdout})
    return {'provenanceProvidedByOperator':provenance,'elfSHA256':expected,'traceSHA256':hashlib.sha256(trace.read_bytes()).hexdigest(),'scope':'symbolication only; synthetic PCs/SPs do not prove execution/unwind. ROM/corrupted/outside-ELF frames may remain unresolved. Preserve complete raw log.','frames':items}
if __name__=='__main__':
    p=argparse.ArgumentParser();p.add_argument('--elf',type=pathlib.Path,required=True);p.add_argument('--trace',type=pathlib.Path,required=True);p.add_argument('--expected-elf-sha',required=True);p.add_argument('--addr2line',default='xtensa-esp32s3-elf-addr2line');p.add_argument('--provenance',choices=['hardware','synthetic','simulation'],required=True);a=p.parse_args()
    try:print(json.dumps(decode(a.elf,a.trace,a.expected_elf_sha,a.addr2line,a.provenance),indent=2))
    except (ValueError,OSError,subprocess.SubprocessError) as e:p.exit(2,str(e)+'\n')