Skip to content

bugfix: bound firmware to world checksum - #741

Open
scgbckbone wants to merge 2 commits into
Coldcard:masterfrom
scgbckbone:bugfix/firmware-world-checksum-limit
Open

bugfix: bound firmware to world checksum#741
scgbckbone wants to merge 2 commits into
Coldcard:masterfrom
scgbckbone:bugfix/firmware-world-checksum-limit

Conversation

@scgbckbone

@scgbckbone scgbckbone commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Reject firmware past the world-checksum-covered flash boundary and align the signing limit.

Tested: Mk4 and Q1 verifier builds.

@doc-hex doc-hex added the bootloader Affects bootloader ROM area, set in stone at factory. label Aug 17, 2026
doc-hex
doc-hex reviewed Aug 17, 2026
View reviewed changes
Comment thread stm32/mk4-bootloader/verify.c Outdated
scgbckbone
scgbckbone commented Aug 17, 2026
View reviewed changes

@scgbckbone scgbckbone left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK by KIMI 3

@scgbckbone
scgbckbone force-pushed the bugfix/firmware-world-checksum-limit branch from 2b3574a to 88fe2d3 Compare August 17, 2026 14:11
@doc-hex

doc-hex commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

worried this might block use of the ...-factory.dfu files. based on this from Codex:

One behavioral caveat: shared/actions.py applies the limit to the entire DFU container, not just
its firmware element. A multi-element development/factory DFU containing firmware plus a
bootloader could now be excluded even when its firmware element is valid. Official upgrade DFUs
contain only the firmware element, so normal customer upgrades are unaffected.

@scgbckbone
bugfix: separate DFU container limit from firmware bound
20f9f52 
FW_MAX_LENGTH_MK4 now bounds only the firmware itself to the
world-checksum-covered flash region (4k aligned, no DFU-wrapper slack
carved out). New FW_MAX_DFU_SIZE_MK4 adds room for the bootloader
element and DFU wrapper so multi-element -factory.dfu images remain
selectable in the MicroSD file picker.
@scgbckbone

scgbckbone commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator Author

worried this might block use of the ...-factory.dfu files. based on this from Codex:

One behavioral caveat: shared/actions.py applies the limit to the entire DFU container, not just
its firmware element. A multi-element development/factory DFU containing firmware plus a
bootloader could now be excluded even when its firmware element is valid. Official upgrade DFUs
contain only the firmware element, so normal customer upgrades are unaffected.

safer solution with 2 constants 20f9f52

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@doc-hex doc-hex doc-hex left review comments

Assignees

No one assigned

Labels

bootloader Affects bootloader ROM area, set in stone at factory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@scgbckbone @doc-hex