Validate GBL magic and size before erasing the app slot#3
Open
balloob wants to merge 1 commit into
Open
Conversation
AppLoader OTA is single-bank and in-place: writing control byte 0x00 erases the application slot, then the firmware is streamed with no validation. A truncated download, an HTML error page, a .hex, or an nRF .zip would leave the device app-less until a successful retry. Validate the image before connecting/erasing: require the GBL header magic (EB 17 A6 03 = tag 0x03A617EB) and a sane minimum size. On failure raise SilabsOTAError with an actionable message and never proceed to erase. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012g2e8mr132vcizx92WsgiR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
perform_silabs_otawrites control byte0x00(which makes the AppLoader erase the application slot) and then streams the firmware with no validation — not even the 4-byte GBL magic.AppLoader OTA is single-bank / in-place, so once
0x00is written the old app is gone. Feeding a truncated download, an HTML error page, a.hex, or an nRF.zipleaves the device app-less until a successful retry — an avoidable brick.Fix
Validate the firmware bytes before connecting/erasing:
EB 17 A6 03(little-endian header tag0x03A617EB,GBL_TAG_ID_HEADER_V3).MIN_GBL_SIZE = 64; no real GBL is smaller than its header + end tag).On failure it raises the existing typed
SilabsOTAErrorwith an actionable message and never proceeds to the boot delay, connect, or erase — the device's app slot is left intact.Tests
test_rejects_wrong_magic_before_erase— a wrong-magic blob raises andestablish_connectionis never awaited.test_rejects_too_short_before_erase— an empty and a magic-only (too short) blob raise before connecting.test_valid_magic_passes_validation— a correctly-magic'd, sane-size blob passes validation and reaches the0x00start.Existing transfer tests updated to use valid GBL blobs via a small
_gbl(size)helper. Full suite passes (uv run pytest -q→ 14 passed);ruff checkandmypyclean.🤖 Generated with Claude Code
https://claude.ai/code/session_012g2e8mr132vcizx92WsgiR