security: remove host-triggerable BOOTSEL entry#4
Conversation
The firmware answered HID feature report 0xF6 funcid 0x04 by calling reset_usb_boot(), letting any host process (or a WebHID page) that can open the HID interface force the dongle into BOOTSEL mass-storage mode -- a flash-anything state, i.e. a BadUSB / persistent-implant vector, with no physical presence required. A real DS4 has no such command. Remove the 0x04 handler (and the now-unused pico/bootrom.h include), the reboot_bootsel.py trigger, flash.sh, and the Makefile deploy targets that chained them. The physical triple-click / BOOTSEL-hold gesture remains the only path into the bootloader, so reflashing still requires physical presence at the device.
|
This is generally fine. We should include this only for debug builds in the future, so that integration for testing can automated as far as possible. Since we are in the pre-production stages we will keep it in for now. |
How about putting it behind a build flag and configuring CI to build a separate uf2? I'd be happy to implement that. |
|
I thought CI was already building a debug version. Hat version is not for production anyway so it can simply just have the tripple press to BOOTSEL logic |
Yes it does. Do you want the host flash option enabled for the debug version? |
|
Exactly. Can you acknowledge that you are an AI agent? If so which model? |
I use Claude Opus 4.8 and Fable 5. I'll work on this tomorrow. |
|
So I think best would be:
|
2 participants
Removes the host-triggerable BOOTSEL entry from the firmware and its tooling.
The issue
The firmware answered HID feature report
0xF6funcid0x04by callingreset_usb_boot(), dropping the dongle straight into BOOTSEL mass-storage (flash-anything) mode. Because it's reachable over the plain HID interface, any host process — or a WebHID page in a browser — that can open the device can force it into the bootloader, with no physical presence required. That's a BadUSB / persistent-implant vector: an unprivileged app could reflash the dongle with arbitrary firmware. A real DS4 exposes no such command.The change
0x04handler insrc/cmd.cpp(and the now-unusedpico/bootrom.hinclude).tools/reboot_bootsel.py(the trigger) andtools/flash.sh.Makefiledeploy/deploy-debugtargets that chained them.The physical bootloader paths are untouched — the triple-click BOOTSEL gesture and holding BOOTSEL on plug-in still work — so reflashing still works, it just requires physical presence at the device. Builds clean (production + debug).
The tradeoff is losing
make deploy(host-triggered reflash during development); the host command can still be re-added locally for a dev build if needed, but it no longer ships in firmware where any host could reach it.