feat(ber,power): Add the BER sweep and TR518 load; keep ce0 actually sending

Three new tools and one fix to an old one.

blanton_ber.sh - PRBS BER across every cabled port, init/start/report/
stop/clear, -u 0|1|all. A lane passes only below 1e-6 (equal to the
threshold fails). report ends with a per-unit summary carrying the worst
lane, so an all-PASS run still shows how much margin there was. init
checks every lane locked, because an unlocked lane still reports a BER
and it is a meaningless one. Script C runs it after the traffic report,
following SWB_UNIT0/SWB_UNIT1 like the traffic block does.

blanton_tr518.sh - the built-in packet test, used to load the rails
before measuring power. start settles 120s so the reading afterwards is
loaded rather than mid-ramp. stop sends port cd lb=none and nothing else,
exactly what the bench procedure does - l2 learning and test mode are
left as start set them, and stop says so instead of quietly leaving the
box in a state nobody asked about.

TH6_SWB{0,1}_power_readback.sh - 19 rails, V x I and total. These read
the two sensor tables ONCE. The previous version read them per rail: 38
invocations of a slow CLI at 38 different instants, so the "total" was a
sum of readings seconds apart - and under load the currents move (TH6_CORE
186 A -> 636 A). A rail missing from the table now warns on stderr instead
of silently contributing 0 W.

blanton_traffic_linespeed.sh - ce0 (VLAN 138) joins the test. It has no
loopback partner and a switch never sends a frame back out its ingress
port, so a tx burst was one round trip and then silence. init now sets an
ingress mirror of ce0 back to itself; the mirrored copy is not
egress-filtered, so packets keep lapping until stop turns the mirror off.
stop is what ends it - removing the VLAN membership does not, because the
copy never consulted the VLAN. TL_CE_MODE also drops to 'self': ps ce
shows one ce port per unit and a unit-0-only burst returned on unit 0.
Read as cross-unit, both links dying would still report PASS (0 == 0).

Fixes a parser bug worth remembering: bcmcmd returns CRLF, and the BER is
the last token on its line, so the CR stayed glued to the number. Every
lane read as NA, and printing the CR sent the cursor to column 1 so the
RESULT column overwrote the start of the row. One stray \r, two symptoms.

Not yet verified on hardware, all called out in the release notes: the
ce0 mirror (destport == srcport may be refused), the 120s settle (tr 518
may be time-limited), and 'test mode nr=no' on stop.

Script A -> V1.1.0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014RetWKFZFG1ZHcitQAyhwM

ARCHITECTURE.md

@@ -132,7 +132,9 @@ Blanton_TTL_Script/
 │   │                                      # ↑ 三份為手動貼上用的原始指令表，
 │   │                                      #   blanton_traffic_linespeed.sh 是其 bash 版
 │   ├── 100G_PRBS.txt                      # 100G PRBS 原始指令（port_prbs_monitor.sh 的來源）
-│   ├── TR518.txt                          # 內建封包測試 tr 518（Scenario=6 Profile=2）— 尚未腳本化
+│   ├── TR518.txt                          # 內建封包測試 tr 518 → blanton_tr518.sh
+│   ├── BER_Test.txt                       # 全機 PRBS BER 指令 → blanton_ber.sh
+│   ├── 100G_Traffic.txt                   # ce0 VLAN 138 打流 → blanton_traffic_linespeed.sh
 │   ├── fan_ctrl.txt                       # MAX31790 unbind/bind + fan-speed-control.sh 30
 │   └── gen_channel_map.sh                 # settings/*.conf → docs/LTC2980_channel_map.csv（需 gawk）
 │
@@ -185,6 +187,10 @@ Blanton_TTL_Script/
             ├── mgmt_ping_monitor.sh       # 10G/1G 管理網路 ping 監控（iproute2）
             │                              #   eth0→TARGET_10G、eth1→TARGET_1G，兩張卡同時持續 ping
             ├── port_prbs_monitor.sh       # 100G uplink PRBS 測試（bcmcmd phy diag）
+            ├── blanton_ber.sh             # 全機 SerDes BER 掃描（phydiag prbs / prbsstat）
+            ├── blanton_tr518.sh           # TR518 封包測試，量功耗前的負載來源
+            ├── TH6_SWB0_power_readback.sh # SWB0 19 條軌 V×I + 總功耗
+            ├── TH6_SWB1_power_readback.sh # SWB1 同上
             │                              #   ⚠️ 已納入交付，但 A/B/C 的呼叫仍註解掉（bring-up 中）
             ├── usb_target.sh              # 偵測 USB 裝置節點／掛載點（排除系統碟）
             ├── bmc_monitor.sh             # BMC 監控：free -m + I2C 寫入/讀回圖樣測試
@@ -338,8 +344,8 @@ PROFILE_CHANNELS=( "0:high:8" "1:low:8" ... )   # "channel:operation:change_perc
 |------|--------|------|
 | **Script A（Pre-test）** | `1_Blanton_Script_A.ttl` V1.0.7 | root 登入 → `date -s` 對時 → 清 job log → `hw-test-session start` → **設定風扇轉速** → **等資料面就緒**（`wait_init.ttl`）→ DUT 清單（boot/version/fwutil/syseeprom/ssdhealth/TPM/NVMe）→ BMC enroll + version/status → source bash 工具 → 清/讀 7 組 PCIe AER + `ras-mc-ctl --summary` → `lspci` → margin → PMON → dmesg → **10G/1G 管理網路 ping** → 100G uplink 設定與狀態 → **一輪流量基線** → `show uptime` |
 | **Script B（Stress）** | `2_Blanton_Script_B.ttl` | `mlucas-avx2 -cpu 0:15` + `bgctl run` 的 `memtester` / SSD / USB 壓力 + BMC DDR（`bmc-manager run memtester`）→ BMC USB net test（探測 cdc_ncm 介面，`systemd-run` 掛 4 小時 ping）→ 啟動 mgmt ping 監控 → `jobs` / `bgctl list` → traffic（依 `SWB_UNIT`）→ `while 1` 每輪完整 PMON + margin |
-| **Script C（Post-test）** | `3_Blanton_Script_C.ttl` | `kill $(jobs -p)` + `bgctl stop --all` / `reset` + 停 BMC USB unit 與 mgmt ping → PMON + dmesg → 7 組 AER + `ras-mc-ctl` → BMC USB `journalctl` → `ip -s link show eth0/eth1` → `cat` mlucas log → traffic `stop` + `report` → NVMe 健康 → `show reboot-cause` / `uptime` → **job log 複製到 USB（帶時戳）** → `hw-test-session finish` |
-| **SWB loopback 流量** | `blanton_traffic_linespeed <sub> [-u 0\|1\|all]` | `init`（VLAN 30..137，成對 `cdN`/`cdN+32`）→ `clear` → `start`（`tx 100 length=512`）→ `stop` → `report`（per-pair TX/RX 交叉比對 PASS/FAIL）；另有 `ps`（link/speed）與 `run`（一條龍） |
+| **Script C（Post-test）** | `3_Blanton_Script_C.ttl` | `kill $(jobs -p)` + `bgctl stop --all` / `reset` + 停 BMC USB unit 與 mgmt ping → PMON + dmesg → 7 組 AER + `ras-mc-ctl` → BMC USB `journalctl` → `ip -s link show eth0/eth1` → `cat` mlucas log → traffic `stop` + `report` → **BER 掃描**（依 `SWB_UNIT`）→ NVMe 健康 → `show reboot-cause` / `uptime` → **job log 複製到 USB（帶時戳）** → `hw-test-session finish` |
+| **SWB loopback 流量** | `blanton_traffic_linespeed <sub> [-u 0\|1\|all]` | `init`（VLAN 30..137，成對 `cdN`/`cdN+32`）→ `clear` → `start`（`tx 100 length=512`）→ `stop` → `report`（per-pair TX/RX 交叉比對 PASS/FAIL）；另有 `ps`（link/speed）與 `run`（一條龍）。**V0.6.0 起含 100G uplink `ce0`**（VLAN 138）：它沒有 loopback 對象，靠 **ingress mirror 打回自己**維持循環，`report` 最後一列就是它，底下再接一份跨 unit summary |
 | **FPGA 暫存器存取** | `cb_fpga <fn> <addr> [data]`、`fpga_rescan` | pcimem 打 `resource0` + BAR 相對 offset，32-bit word；BDF 於 source 時自動偵測；`pmc/icb/swb0/swb1_fpga` 走 VSPI 窗口 |
 | **CB I2C / PMBus** | `cb_i2c_init/scan/read/write`、`cb_pmbus_read/write/linear16` | FPGA F3 OpenCores master，**讀用 Repeated START**（SMBus/PMBus 裝置必需） |
 | **ICB / PDB 存取** | `vi2c_init/scan/read/write`、`vi2c_scan_all` | CB F3 VI2C proxy，~3.3 ms/reg，取代 VSPI 的 ~18 ms/reg（後者會踩 SMBus 25–35 ms timeout） |
@@ -351,6 +357,9 @@ PROFILE_CHANNELS=( "0:high:8" "1:low:8" ... )   # "channel:operation:change_perc
 | **BMC 監控** | `bmc_monitor.sh {start\|stop\|status\|fg\|tail\|clear}` | 由 host 端 `bmc-manager run` 週期取樣 `free -m`，另加一組 **I2C 寫入/讀回圖樣測試**（bus 1、addr 0x41、offset 0x00C0，寫 `55AA55AA` 讀回、再寫 `AA55AA55` 讀回）。B 啟動、C 停止並 `cat log/bmc_poll.log` |
 | **BMC DDR 壓力** | `bmc_monitor_ddr.sh` | ⚠️ **已停用** —— B/C 內呼叫處已註解，改由 `bgctl run bmc-manager run memtester` 取代。檔案保留未刪 |
 | **100G PRBS** | `port_prbs_monitor.sh {start [both\|a\|b]\|stop\|status\|report\|clear}` | 兩個 uplink 各一個 worker，可同時或單獨跑。setup（`lpmode off` → `prbs set` → `prbsstat STArt`）→ 週期 `prbs get`（判定）+ `prbsstat Ber`（只記錄）→ teardown（`STOp` + `prbs clear`）。輸出含 `PRBS OK!` 才算 PASS。**⚠️ A/B/C 的呼叫目前註解掉** |
+| **SerDes BER 掃描** | `blanton_ber.sh {init\|clear\|start\|stop\|report} [-u 0\|1\|all]` | 全機每個對接 port 的 PRBS BER：`prbs set p=3` + `prbs get`（確認每條 lane 都鎖上）→ `prbsstat STArt Interval=30` →（等一個 interval）→ `prbsstat Ber` → `STOp` → `prbs clear`。`report` 一列一條 lane，**BER < 1e-6 才 PASS**，最後跨 unit 的 summary 帶最差 lane。⚠️ PRBS 期間 link 顯示 DOWN、不過流量 |
+| **TR518 負載** | `blanton_tr518.sh {start\|stop} [-u 0\|1\|all]` | `port cd lb=mac` → `l2 learn off` → `test mode nr=yes` → `tr 518 ... testphase=1`，然後 settle `TR_SETTLE_SEC`（120s）再讓人量功耗。`stop` 只送 `port cd lb=none`（照 `TR518.txt`），L2 學習與 test mode **不會還原**，`TR_RESTORE_*=1` 才會 |
+| **SWB 軌功耗** | `TH6_SWB{0,1}_power_readback.sh` | 讀 `show platform voltage/current` **各一次**，19 條軌 V×I 與總功耗。舊版每軌各讀一次（38 次呼叫、每軌不同時刻），總和是不同瞬間的加總 |
 | **USB 目標偵測** | `usb_target.sh [-o dev\|mnt\|both\|id] [-n] [-r sec]` | 找出插入的 USB 儲存裝置，排除 `/` 與 `/host` 的底層碟（本平台可能從 USB DOM 開機），多顆時拒絕猜；掛載時會驗證真的可寫 |
 | **打包交付** | `publish/publish.sh [-v Ver] [-f] [-z] [-n]` | 版號讀 Script A 檔頭，複製成 `publish/Script_ABC_Blanton_<Ver>/`，排除 `*.log`，可另出 zip |
 
@@ -771,10 +780,20 @@ margin status、全部 VRM 軌的 Vin/Vout/Iout/Temp、CB + ICB 溫感讀值，
 - **風扇確認提示是無限等待**：`wait "Set all configured fan channels to"` 之後才 `sendln "y"`；
   若該版 `fan-speed-control.sh` 不再詢問（或字串改了），這個 `wait` 會永遠等下去，Script A 停在那裡
   且不報錯。加個 `timeout` + 分支會比較保險（記得還原 `timeout = 0`）。
-- **TR518 內建封包測試尚未腳本化**：`tools/TR518.txt` 記下了 `tr 518 Scenario=6 Profile=2 Count=260
-  PktSize=324 PortList=1-259,270-565` 這組指令（含 `port all lb=mac` + `l2 learn off` 前置），
-  目前只能手貼。它與 `blanton_traffic_linespeed` 是兩條互斥的打流路線（都會動 loopback 與 L2 學習），
-  要腳本化的話得先決定兩者怎麼共存，不能同時跑。
+- ✅ **TR518 已腳本化** —— `blanton_tr518.sh` V1.0.1（2026-08-28）。仍與 `blanton_traffic_linespeed`
+  互斥（兩者都會動 `port cd` loopback 與 L2 學習），檔頭與 help 都標了。剩下三件事：
+  `stop` 沒把 `l2 learn` / `test mode` 放回去（照 `TR518.txt` 的定義，旗標可開）；
+  **`sleep 120` 的方向還沒驗證** —— 若 `tr 518` 的流量是有時限的（參數含 `runtime=1`、
+  `CheckDataTime=200`），等 120 秒可能量到已經降下來的值，要上機比對 0s / 30s / 120s 三次；
+  TTL 尚未呼叫它。
+- **`blanton_ber.sh` 的 `sleep 30` 與 `BER_INTERVAL` 是兩處要同步改的數字**：Script C 寫死
+  `sendln "sleep 30"`，腳本預設 `BER_INTERVAL=30`。改一邊沒改另一邊，report 會讀到還沒累積完
+  一個 interval 的數字，而且不會有任何警告。
+- **`ce0` 的 ingress mirror 尚未上機驗證**：`mirror port ce0 Mode=Ingress DestPort=ce0` 這條路是
+  推論出來的（鏡像複本不受 egress filter 的 source-port knockout 限制），語法取自 DUT 的
+  `help mirror`，但**還沒證明硬體真的接受 destport == srcport**。驗證方式是隔 10 秒看兩次
+  `show c | grep POK.ce0`，數字有沒有繼續長 —— 光看 report 的 PASS 分不出來，因為一次性 burst
+  也是 TX==RX。不通的話備案是 `tr 518 PortList=268`。
 - **SWB 的 LTC2977 有兩條路可以到，目前工具兩條都在用**：`cb_pmbus_*`（CB FPGA F3 → pcimem）
   是 `margin_init` / `margin_status` / `margin_set` 走的路；原生 i2c bus（Ch+7 = bus 13/14/15/16）
   是 `margin_save blanton` 走的路。後者短很多 —— 不需要通道初始化、不需要 pcimem，