firmware: L2 CRC retry, libtropic v4.1.0, SE firmware 2.1.0 - #22
Merged
Conversation
0xEthamin
force-pushed
the
feat/l2-crc-retry
branch
from
August 20, 2026 19:36
b5d02d1 to
d63e5a3
Compare
Three related changes, all triggered by the libtropic 4.1.0 release. L2 CRC RETRY. Close a parity gap dating from libtropic 4.0.0, where the driver raised a CRC fault straight to the caller with no reprise. One seam in l2/retry.rs now carries all eight L2 call sites, and the two faults get opposite cures. A chip-reported CRC error (status 0x7C) means TROPIC01 ignored the frame, so the identical request is replayed, which the datasheet confirms is safe even for a firmware-write chunk or a monotonic counter. A locally detected bad CRC on an otherwise valid response means the request may already have run, so the driver asks for a Resend_Req and never replays. DELIBERATE DEVIATION, STRICTER THAN UPSTREAM. One shared retry budget covers a whole chunked L3 packet, where libtropic refills its budget on every successful chunk and so lets the worst case grow with message length. A link needing more than three retries on one packet is failing rather than recovering, so a hard predictable bound is preferred. Error-path latency becomes a caller-visible concern and is documented as such, bounded per exchange by (1 + CRC_RETRY_ATTEMPTS) * READ_MAX_TRIES * READ_RETRY_DELAY_MS. The Startup_Req CRC relaxation stays confined by construction. The parameterised parser is private and only two named wrappers are exposed, so no caller can ask for the relaxed check. The gate reproduces libtropic condition for condition and no longer leaks into the resend path. LIBTROPIC v4.1.0. Move the pinned reference to v4.1.0. It carries no protocol change and no API change, and model_cfg.yml is byte-identical so the cert-store golden does not move. SE FIRMWARE TARGET 2.1.0 AND SPECT 1.3.0. App FW 2.1.0 fixes a Resend_Req arriving during a multi-chunk L3 result, which could double-encrypt the result or advance to the next chunk early. That removes at its source the hazard the resend path otherwise leaves to the host length and tag checks. SPECT 1.3.0 carries the side-channel hardening of the ECC engine: scalar additive splitting, branch-free and CSWAP-free long routines, a changed power and EM profile, and public-key validity checks on read.
0xEthamin
force-pushed
the
feat/l2-crc-retry
branch
from
August 20, 2026 19:36
d63e5a3 to
e47dd26
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three related changes, all triggered by the libtropic 4.1.0 release.
L2 CRC RETRY. Close a parity gap dating from libtropic 4.0.0, where the driver raised a CRC fault straight to the caller with no reprise. One seam in l2/retry.rs now carries all eight L2 call sites, and the two faults get opposite cures. A chip-reported CRC error (status 0x7C) means TROPIC01 ignored the frame, so the identical request is replayed, which the datasheet confirms is safe even for a firmware-write chunk or a monotonic counter. A locally detected bad CRC on an otherwise valid response means the request may already have run, so the driver asks for a Resend_Req and never replays.
DELIBERATE DEVIATION, STRICTER THAN UPSTREAM. One shared retry budget covers a whole chunked L3 packet, where libtropic refills its budget on every successful chunk and so lets the worst case grow with message length. A link needing more than three retries on one packet is failing rather than recovering, so a hard predictable bound is preferred.
Error-path latency becomes a caller-visible concern and is documented as such, bounded per exchange by
(1 + CRC_RETRY_ATTEMPTS) * READ_MAX_TRIES * READ_RETRY_DELAY_MS.
The Startup_Req CRC relaxation stays confined by construction. The parameterised parser is private and only two named wrappers are exposed, so no caller can ask for the relaxed check. The gate reproduces libtropic condition for condition and no longer leaks into the resend path.
LIBTROPIC v4.1.0. Move the pinned reference to v4.1.0. It carries no protocol change and no API change, and model_cfg.yml is byte-identical so the cert-store golden does not move.
SE FIRMWARE TARGET 2.1.0 AND SPECT 1.3.0. App FW 2.1.0 fixes a Resend_Req arriving during a multi-chunk L3 result, which could double-encrypt the result or advance to the next chunk early. That removes at its source the hazard the resend path otherwise leaves to the host length and tag checks. SPECT 1.3.0 carries the side-channel hardening of the ECC engine: scalar additive splitting, branch-free and CSWAP-free long routines, a changed power and EM profile, and public-key validity checks on read.