fix: Use STM32 hardware CRC32 algorithm (CRC32/MPEG-2, uint32 fed byte-reversed)

Author: tuxuser

firmware/README.md

@@ -13,42 +13,42 @@ This project is split into two independent components:
   * Tombstone info located at the end, at `0x0800_07E0-0x0800_0800`
   * Responsible for:
 
-    * Checking a GPIO pin for 2 s after reset.
+    * Checking a GPIO pin for 200 ms after reset.
     * If pressed → jump to the STM32 system ROM bootloader.
     * If not pressed → jump to the user application at `0x0800_0800`.
   * Contains a fixed **tombstone** block at the end of its flash region, with build metadata (magic, version, date).
 
 * **UAPP (User-app) @ `userapp/`**
 
-  * Section starts at `0x0800_0800` (tombstone: `0x0800_0800`, code: `0x0800_0820`)
+  * Section starts at `0x0800_0800` (tombstone: `0x0800_0800`, code: `0x0800_0A00`)
   * Normal user firmware, built with its own vector table and linker script.
   * At the very start, contains a **tombstone** block, to identify itself.
   * Uses the tombstone info (if needed) to check validity or report version.
 
 **Flash Memory Layout**
 
 ```
-+-----------------------+ 0x0800_0000
-| Preloader Vector      |
-| & Code                |
-|  (2 KB-32 bytes)      |
-+-----------------------+ 0x0800_07E0
-| Tombstone info IAPL   |
-| (32 bytes, fixed info)|
-+-----------------------+ 0x0800_0800
-| Tombstone info UAPP   |
-| (32 bytes, fixed info)|
-+-----------------------+ 0x0800_0820
-| User App Vector       |
-| & Code                |
-| (up to 30KB-32 bytes) |
-+-----------------------+ end of flash
++--------------------------+ 0x0800_0000
+| Preloader Vector         |
+| & Code                   |
+|  (2 KB-32 bytes)         |
++--------------------------+ 0x0800_07E0
+| Tombstone info IAPL      |
+| (32 bytes)               |
++--------------------------+ 0x0800_0800
+| Tombstone info UAPP      |
+| (32 bytes + padding)     |
++--------------------------+ 0x0800_0A00
+| User App Vector          |
+| & Code                   |
+| (up to 30KB-0x200 bytes) |
++--------------------------+ end of flash
 ```
 
 * **Preloader region**: `0x0800_0000 .. 0x0800_07E0`
 * **Tombstone IAPL**: `0x0800_07E0 .. 0x0800_0800`
 * **Tombstone UAPP**: `0x0800_0800 .. 0x0800_0820`
-* **User application**: `0x0800_0820 ..`
+* **User application**: `0x0800_0A00 ..`
 
 **Build/Flash**
 
@@ -68,9 +68,10 @@ Download from the latest release archive: [Release](https://github.com/xboxonere
 
 ### In-field update
 
-1. Disconnect PCB from console!
-2. Connect PCB to PC
-3. Use custom stm32flash tool from this [repo](https://github.com/xboxoneresearch/libaspect2)
+1. Disconnect PCB from console and PC!
+2. Press and hold the button on the PCB.
+3. Connect PCB to PC, keep button pressed for a second.
+4. Use custom stm32flash tool from this repo: [repo](https://github.com/xboxoneresearch/libaspect2)
 
 ## Development
 

firmware/common/bootloader.c

@@ -15,17 +15,16 @@ uint32_t calculateCrc32(uint8_t *data, uint32_t len) {
         return 0xFFFFFFFF;
     }
 
-    /* Configure and reset CRC peripheral: use byte-wise input and reversed output */
-    CRC->CR = CRC_CR_RESET | CRC_CR_REV_IN_0 | CRC_CR_REV_OUT;
+    /* Configure and reset CRC peripheral: use default algorithm */
+    CRC->CR = CRC_CR_RESET;
 
     /* Feed data as bytes so peripheral processes one byte per write */
-    uint8_t *p = (uint8_t *)data;
-    for (uint32_t i = 0; i < len; i++) {
-        *((volatile uint8_t *)&CRC->DR) = p[i];
+    uint32_t *p = (uint32_t *)data;
+    for (uint32_t i = 0; i < (len / sizeof(uint32_t)); i++) {
+        *((volatile uint32_t *)&CRC->DR) = p[i];
     }
 
-    /* Final XOR and return */
-    return (CRC->DR ^ 0xFFFFFFFF);
+    return CRC->DR;
 }
 
 void resetToSystemBootLoader()

firmware/scripts/fix_size_crc.py

@@ -17,7 +17,6 @@
 import argparse
 import enum
 import struct
-import zlib
 from typing import Tuple
 
 # Constants mirroring firmware common/bootloader.h
@@ -41,8 +40,22 @@ def write_le_u32(buf: bytearray, offset: int, value: int):
     buf[offset:offset+4] = struct.pack('<I', value & 0xFFFFFFFF)
 
 
-def crc32_final(data: bytes) -> int:
-    return zlib.crc32(data)
+def crc32_final(data: bytes, crc: int = 0xffffffff) -> int:
+    """
+    CRC32/MPEG-2 with data fed in byte-reversed u32-chunks
+    """
+    U32_SZ = 4
+    assert len(data) % 4 == 0
+    for position in range(0, len(data), U32_SZ):
+        uint32 = data[position:position+U32_SZ]
+        # Reverse bytes
+        uint32 = uint32[::-1]
+
+        for val in uint32:
+            crc ^= val << 24
+            for _ in range(8):
+                crc = crc << 1 if (crc & 0x80000000) == 0 else (crc << 1) ^ 0x104c11db7
+    return crc
 
 
 def compute_and_patch(buf: bytearray, ptype: ProgramType) -> Tuple[int, int, int]:
@@ -60,7 +73,6 @@ def compute_and_patch(buf: bytearray, ptype: ProgramType) -> Tuple[int, int, int
     elif ptype is ProgramType.UAPP:
         if len(buf) < UAPP_ENTRY_OFFSET:
             raise SystemExit("UAPP binary smaller than expected entry offset; cannot compute tombstone")
-        assert b"UAPP" == buf[UAPP_TOMBSTONE_OFF:UAPP_TOMBSTONE_OFF + 4]
         crc_region = bytes(buf[UAPP_ENTRY_OFFSET:])
         size = len(crc_region)
         crc = crc32_final(crc_region)

firmware/userapp/Core/Src/main.c

@@ -189,9 +189,9 @@ static void MX_CRC_Init(void)
   hcrc.Instance = CRC;
   hcrc.Init.DefaultPolynomialUse = DEFAULT_POLYNOMIAL_ENABLE;
   hcrc.Init.DefaultInitValueUse = DEFAULT_INIT_VALUE_ENABLE;
-  hcrc.Init.InputDataInversionMode = CRC_INPUTDATA_INVERSION_BYTE;
-  hcrc.Init.OutputDataInversionMode = CRC_OUTPUTDATA_INVERSION_ENABLE;
-  hcrc.InputDataFormat = CRC_INPUTDATA_FORMAT_BYTES;
+  hcrc.Init.InputDataInversionMode = CRC_INPUTDATA_INVERSION_NONE;
+  hcrc.Init.OutputDataInversionMode = CRC_OUTPUTDATA_INVERSION_DISABLE;
+  hcrc.InputDataFormat = CRC_INPUTDATA_FORMAT_WORDS;
   if (HAL_CRC_Init(&hcrc) != HAL_OK)
   {
     Error_Handler();