From 86a3cb50b1833d3327cfd7fb87f389151f681a17 Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Sun, 16 Aug 2026 22:36:24 +0300
Subject: [PATCH 1/2] web: refuse frame-blast SoCs instead of failing at the
 wire
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

66 of the 109 chips in the browser dropdown cannot be recovered by this
build. Their bootrom needs a frame-blast handshake — an active 0xAA+HEAD
blast rather than passively waiting for the 0x20 markers, plus a PRESTEP0
block sent ahead of DDRSTEP0 — and web/ implements neither. The inline
PROFILES blob has had PRESTEP0 stripped from every entry, so the data
isn't even present to send.

Until now those chips were selectable. A user picked one, watched the
U-Boot download succeed and verify its SHA-256, hit Start Recovery, and
then sat through a handshake that was never going to complete, with
nothing on screen suggesting the tool couldn't drive their part.

The affected list is not exotic: hi3516ev300, hi3516ev200, hi3516cv300,
hi3516cv500, hi3516av200 and hi3518ev200 are all common camera SoCs, and
hi3516ev300 in particular is one of the most widely deployed parts we
support. We have been actively pointing people here from OpenIPC/wiki#484
and from replies on firmware#1494/#1532/#1674/#1827.

This is the interim fix from #121 — block them clearly rather than
implement frame-blast in JS:

- FRAME_BLAST_SOCS + needsFrameBlast() in protocol.js
- affected options render as "<chip> — CLI only"; the count now reads
  "43 of 109 supported in browser"
- selecting one replaces the download UI with the equivalent CLI command
  and a link to #121, and Start Recovery stays disabled

Why the drift went unnoticed: profile lookup follows alias files, and an
alias holds nothing but a filename — hi3516ev300.json contains the single
line "hi3516ev200.json". Checking hi3516ev300.json for a PRESTEP0 finds
none because it has no fields at all, which reads as "plain handshake"
unless you resolve the alias first. I got this wrong myself before
catching it.

So the guard resolves aliases the same way loader.py does, recomputes the
frame-blast set from src/defib/profiles/data, and fails if it disagrees
with FRAME_BLAST_SOCS in either direction. Verified it catches the
regression by deleting hi3516ev300 from the list. Also asserts every web
chip has a CLI profile behind it, and that PRESTEP0 data never reappears
in the web blob without an implementation to use it.

Does not close #121 — the real fix is generating PROFILES from the CLI
data and implementing frame-blast in protocol.js.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/ci.yml   |   2 +-
 web/index.html             |  42 +++++++++++++--
 web/profile-parity.test.js | 104 +++++++++++++++++++++++++++++++++++++
 web/protocol.js            |  33 ++++++++++++
 4 files changed, 177 insertions(+), 4 deletions(-)
 create mode 100644 web/profile-parity.test.js

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bdef5b1..ce12c5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,4 +87,4 @@ jobs:
           node-version: "22"
 
       - name: Run JS tests
-        run: node --test web/protocol.test.js
+        run: node --test web/protocol.test.js web/profile-parity.test.js
diff --git a/web/index.html b/web/index.html
index 88d075f..376b3e5 100644
--- a/web/index.html
+++ b/web/index.html
@@ -71,6 +71,12 @@
 .status-msg { padding: 12px 16px; border-radius: var(--radius); margin-top: 12px; font-weight: 600; text-align: center; }
 .status-msg.success { background: rgba(158,206,106,0.15); color: var(--green); }
 .status-msg.failure { background: rgba(247,118,142,0.15); color: var(--red); }
+.notice-warn { margin-top: 10px; padding: 12px 14px; border-radius: var(--radius);
+  background: rgba(224,175,104,0.12); border: 1px solid rgba(224,175,104,0.35);
+  font-size: 0.88em; line-height: 1.5; }
+.notice-warn pre { margin: 8px 0; padding: 8px 10px; border-radius: 6px;
+  background: rgba(0,0,0,0.28); overflow-x: auto; font-size: 0.95em; }
+.notice-warn code { background: rgba(0,0,0,0.28); padding: 1px 4px; border-radius: 3px; }
 .unsupported {
   background: var(--red); color: #fff; padding: 16px; border-radius: var(--radius);
   text-align: center; margin-bottom: 16px;
@@ -95,6 +101,7 @@ <h1>⚡ <span>defib</span></h1>
     <h2>Recovery Setup</h2>
     <label>Chip Model <span class="chip-count" id="chip-count"></span></label>
     <select id="chip-select"><option value="">Loading...</option></select>
+    <div id="chip-unsupported" class="notice-warn" style="display:none"></div>
 
     <label>U-Boot image</label>
     <div id="fw-auto" class="btn-row" style="display:none;margin-top:0">
@@ -599,6 +606,29 @@ <h2 style="color:var(--accent)">Serial Console</h2>
   const hint = document.getElementById('fw-hint');
   const btn = document.getElementById('fw-download-btn');
   const status = document.getElementById('fw-status');
+  const unsupported = document.getElementById('chip-unsupported');
+
+  // Frame-blast parts can't be driven from the browser at all — say so up
+  // front instead of letting the user download an image and then watch the
+  // handshake fail for reasons the UI can't explain.
+  if (chip && needsFrameBlast(chip)) {
+    unsupported.style.display = '';
+    unsupported.innerHTML =
+      `<strong>${chip} needs the command-line tool.</strong> Its bootrom uses a ` +
+      `frame-blast handshake (an active <code>0xAA</code>+HEAD blast plus a ` +
+      `PRESTEP0 block) that this browser build does not implement, so the ` +
+      `upload cannot complete here. Install defib and run:` +
+      `<pre>uv tool install defib\ndefib burn -c ${chip} -p /dev/ttyUSB0 -t</pre>` +
+      `Start it before you power-cycle the camera. ` +
+      `<a href="https://github.com/OpenIPC/defib/issues/121" target="_blank" ` +
+      `rel="noopener">Tracking issue</a>.`;
+    autoDiv.style.display = 'none';
+    hint.textContent = '';
+    firmwareData = null;
+    updateStartButton();
+    return;
+  }
+  unsupported.style.display = 'none';
 
   if (chip && hasFirmware(chip)) {
     autoDiv.style.display = '';
@@ -629,8 +659,13 @@ <h2 style="color:var(--accent)">Serial Console</h2>
   ];
   const unique = [...new Set(allChips)].sort();
   sel.innerHTML = '<option value="">— Select chip model —</option>';
-  for (const c of unique) sel.innerHTML += `<option value="${c}">${c}</option>`;
-  document.getElementById('chip-count').textContent = `(${unique.length} supported)`;
+  for (const c of unique) {
+    const suffix = needsFrameBlast(c) ? ' — CLI only' : '';
+    sel.innerHTML += `<option value="${c}">${c}${suffix}</option>`;
+  }
+  const usable = unique.filter(c => !needsFrameBlast(c)).length;
+  document.getElementById('chip-count').textContent =
+    `(${usable} of ${unique.length} supported in browser)`;
   sel.onchange = onChipChanged;
   // Warm the release index so availability reflects what OpenIPC actually
   // publishes today rather than the hardcoded fallback list. Refresh only if
@@ -658,7 +693,8 @@ <h2 style="color:var(--accent)">Serial Console</h2>
 
 function updateStartButton() {
   const chip = document.getElementById('chip-select').value;
-  document.getElementById('start-btn').disabled = !(chip && firmwareData && selectedPort);
+  document.getElementById('start-btn').disabled =
+    !(chip && firmwareData && selectedPort) || needsFrameBlast(chip);
 }
 
 function setStage(name) {
diff --git a/web/profile-parity.test.js b/web/profile-parity.test.js
new file mode 100644
index 0000000..ce5b7f0
--- /dev/null
+++ b/web/profile-parity.test.js
@@ -0,0 +1,104 @@
+/**
+ * Parity between the browser build's inline PROFILES blob and the CLI's
+ * profile data under src/defib/profiles/data.
+ *
+ * web/index.html carries its own hand-maintained copy of the SoC profiles so
+ * the page can be deployed as static files. Nothing regenerates it, so it can
+ * drift from the CLI — which is exactly how every chip in it ended up with its
+ * PRESTEP0 stripped while staying selectable in the dropdown (defib#121).
+ *
+ * These tests fail when that happens again.
+ *
+ * Run: node --test web/profile-parity.test.js
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { FRAME_BLAST_SOCS } = require('./protocol.js');
+
+const REPO_ROOT = path.join(__dirname, '..');
+const DATA_DIR = path.join(REPO_ROOT, 'src', 'defib', 'profiles', 'data');
+const MAX_ALIAS_DEPTH = 23;
+
+/**
+ * Resolve a chip to its profile object, following alias files.
+ *
+ * An alias is a profile file whose entire contents are a single token ending
+ * in `.json` — e.g. hi3516ev300.json contains just "hi3516ev200.json". Missing
+ * this indirection is what made the PRESTEP0 drift invisible: a naive read of
+ * hi3516ev300.json finds no PRESTEP0 because it holds no fields at all.
+ * Mirrors load_profile() in src/defib/profiles/loader.py.
+ */
+function resolveProfile(chip, depth = 0) {
+  if (depth > MAX_ALIAS_DEPTH) return null;
+  const file = path.join(DATA_DIR, `${chip}.json`);
+  if (!fs.existsSync(file)) return null;
+  const raw = fs.readFileSync(file, 'utf8').trim();
+  const tokens = raw.split(/\s+/);
+  if (tokens.length === 1 && tokens[0].endsWith('.json')) {
+    return resolveProfile(tokens[0].slice(0, -5), depth + 1);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+/** Pull the inline `const PROFILES = {...};` blob out of web/index.html. */
+function readWebProfiles() {
+  const html = fs.readFileSync(path.join(__dirname, 'index.html'), 'utf8');
+  const m = html.match(/const PROFILES = (\{[\s\S]*?\});\n/);
+  assert.ok(m, 'could not locate the PROFILES blob in web/index.html');
+  return JSON.parse(m[1]);
+}
+
+describe('web PROFILES vs CLI profile data', () => {
+  const webProfiles = readWebProfiles();
+
+  it('every chip in the web dropdown has a CLI profile behind it', () => {
+    const orphans = Object.keys(webProfiles).filter(c => resolveProfile(c) === null);
+    assert.deepEqual(orphans, [],
+      `web-only chips with no resolvable CLI profile: ${orphans.join(', ')}`);
+  });
+
+  it('FRAME_BLAST_SOCS matches the chips whose resolved profile has PRESTEP0', () => {
+    const expected = Object.keys(webProfiles)
+      .filter(c => {
+        const p = resolveProfile(c);
+        return p && p.PRESTEP0 != null;
+      })
+      .sort();
+    const actual = [...FRAME_BLAST_SOCS].sort();
+
+    const missing = expected.filter(c => !FRAME_BLAST_SOCS.has(c));
+    const extra = actual.filter(c => !expected.includes(c));
+
+    assert.deepEqual(missing, [],
+      `these chips need a frame-blast handshake but are not in FRAME_BLAST_SOCS, ` +
+      `so the UI will let users start a recovery that cannot succeed: ${missing.join(', ')}`);
+    assert.deepEqual(extra, [],
+      `these are listed in FRAME_BLAST_SOCS but their resolved profile has no ` +
+      `PRESTEP0, so they are being blocked for no reason: ${extra.join(', ')}`);
+  });
+
+  it('the web build does not claim to send PRESTEP0 it has no data for', () => {
+    // If a future change starts shipping PRESTEP0 in the web blob, the
+    // frame-blast path must be implemented in protocol.js at the same time —
+    // otherwise the data is inert and the block list above silently wrong.
+    const withPrestep = Object.entries(webProfiles)
+      .filter(([, p]) => p.PRESTEP0 != null)
+      .map(([c]) => c);
+    const protocolSrc = fs.readFileSync(path.join(__dirname, 'protocol.js'), 'utf8');
+    const implemented = /function\s+buildPrestepFrames|sendFrameForStart/.test(protocolSrc);
+    if (withPrestep.length > 0) {
+      assert.ok(implemented,
+        `web PROFILES now carry PRESTEP0 for ${withPrestep.join(', ')} but ` +
+        `protocol.js still has no frame-blast implementation — either implement ` +
+        `it or drop the data`);
+    }
+  });
+});
diff --git a/web/protocol.js b/web/protocol.js
index c52c8ea..e47596d 100644
--- a/web/protocol.js
+++ b/web/protocol.js
@@ -138,6 +138,38 @@ function parseCv6xxBoot(data) {
 const V500_SOCS = new Set(["gk7205v500","gk7205v510","gk7205v530","xm7205v500","xm7205v510","xm7205v530"]);
 const CV6XX_SOCS = new Set(["hi3516cv608","hi3516cv610","hi3516cv613","hi3516dv500","hi3519dv500"]);
 
+// Standard-protocol SoCs whose bootrom needs the frame-blast handshake: an
+// active 0xAA+HEAD blast instead of passively waiting for the 0x20 markers,
+// followed by a PRESTEP0 block sent ahead of DDRSTEP0.  The CLI drives this
+// from HiSiliconStandard._send_frame_for_start(); this build implements
+// neither, so standardHandshake()/standardSendFirmware() cannot bring these
+// parts up.  Refuse them in the UI rather than fail silently at the wire.
+//
+// Derived from the chips whose *resolved* profile under
+// src/defib/profiles/data carries a PRESTEP0 — resolution matters, since
+// e.g. hi3516ev300.json is a one-line alias pointing at hi3516ev200.json.
+// profile-parity.test.js recomputes this and fails if it drifts.
+const FRAME_BLAST_SOCS = new Set([
+  "hi3110ev500", "hi3110ev500-ca", "hi3231v520", "hi3231v530", "hi3251v500",
+  "hi3251v510", "hi3516a", "hi3516av200", "hi3516cv300", "hi3516cv500",
+  "hi3516ev200", "hi3516ev300", "hi3518ev200", "hi3519", "hi3519v101",
+  "hi3520dv400", "hi3521a", "hi3521dv100", "hi3531a", "hi3531dv100",
+  "hi3536", "hi3536c", "hi3536dv100", "hi3556av100", "hi3559av100",
+  "hi3559av100es", "hi3559v100", "hi3559v200", "hi3712v100", "hi3716dv100",
+  "hi3716dv100-ca", "hi3716dv110", "hi3716dv110h", "hi3716mv310", "hi3716mv310-ca",
+  "hi3716mv320", "hi3716mv330", "hi3716mv330-ca", "hi3716mv410", "hi3716mv410-ca",
+  "hi3716mv410-ca-n", "hi3716mv420-ca-n", "hi3716mv430", "hi3731v100", "hi3731v101",
+  "hi3731v201", "hi3731v202", "hi3751v310", "hi3751v320", "hi3751v500-ca",
+  "hi3751v510", "hi3751v530", "hi3751v551", "hi3751v553", "hi3751v600",
+  "hi3751v600-ca", "hi3751v620", "hi3751v810", "hi3751v811", "hi3796mv200",
+  "hi3798cv200", "hi3798mv100", "hi3798mv100-ca", "hi3798mv200", "hi3798mv300",
+  "hi3798mv310",
+]);
+
+function needsFrameBlast(chip) {
+  return FRAME_BLAST_SOCS.has(chip);
+}
+
 // ================================================================
 // OpenIPC U-Boot asset resolution
 //
@@ -308,6 +340,7 @@ if (typeof module !== 'undefined' && module.exports) {
     CRC_TABLE, calcCrc, appendCrc, appendCrcLE, verifyCrc,
     buildHeadFrame, buildDataFrame, buildTailFrame, chunkData,
     parseCv6xxBoot, V500_SOCS, CV6XX_SOCS,
+    FRAME_BLAST_SOCS, needsFrameBlast,
     FW_RELEASE_API, FW_DIRECT_BASE, FW_ASSET_RE, FW_PROXIES,
     CHIP_FW_ALIAS, fwNameForChip, parseReleaseAssets, parseDigest,
     fwSourceUrls, bytesToHex, verifyFirmwareBytes,

From 4577ae29878f226820fd00a49f1dfafc6a49bd3e Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Sun, 16 Aug 2026 22:59:07 +0300
Subject: [PATCH 2/2] web: fix two issues from review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both raised by Qodo on #122, both reproduced before fixing.

Stranded local file selection. The frame-blast branch cleared
firmwareData on the way out, but the file input keeps its selection, so
the normal path won't reload it — it only clears when no file is
selected — and the change handler doesn't re-fire. Selecting a local
image, browsing to a CLI-only chip and back left Start disabled with a
file still visibly selected. Drop the clear: Start is already gated by
needsFrameBlast(), and moving between two supported chips still
invalidates a downloaded image via the existing path.

CRLF-brittle PROFILES extraction. The parity test anchored on `};\n`,
which doesn't match `};\r\n`, so a checkout with core.autocrlf=true
failed on a line ending rather than on real drift. Verified: the old
pattern finds no match against CRLF input, the new one parses all 109
profiles under both endings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 web/index.html             | 7 ++++++-
 web/profile-parity.test.js | 4 +++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/web/index.html b/web/index.html
index 376b3e5..b5e8307 100644
--- a/web/index.html
+++ b/web/index.html
@@ -624,7 +624,12 @@ <h2 style="color:var(--accent)">Serial Console</h2>
       `rel="noopener">Tracking issue</a>.`;
     autoDiv.style.display = 'none';
     hint.textContent = '';
-    firmwareData = null;
+    // Deliberately leave firmwareData alone. Start is already blocked by
+    // needsFrameBlast() below, and clearing it here would strand a locally
+    // selected file: the file input keeps its selection, so the normal path
+    // won't reload it (it only clears when no file is selected) and the
+    // change handler won't re-fire — leaving Start disabled on the way back
+    // to a supported chip.
     updateStartButton();
     return;
   }
diff --git a/web/profile-parity.test.js b/web/profile-parity.test.js
index ce5b7f0..47ae85c 100644
--- a/web/profile-parity.test.js
+++ b/web/profile-parity.test.js
@@ -51,7 +51,9 @@ function resolveProfile(chip, depth = 0) {
 /** Pull the inline `const PROFILES = {...};` blob out of web/index.html. */
 function readWebProfiles() {
   const html = fs.readFileSync(path.join(__dirname, 'index.html'), 'utf8');
-  const m = html.match(/const PROFILES = (\{[\s\S]*?\});\n/);
+  // Tolerate CRLF and trailing whitespace — a checkout with core.autocrlf=true
+  // would otherwise fail this on a formatting detail rather than a real drift.
+  const m = html.match(/const PROFILES = (\{[\s\S]*?\});[ \t]*\r?$/m);
   assert.ok(m, 'could not locate the PROFILES blob in web/index.html');
   return JSON.parse(m[1]);
 }