Firmware version and downgrade protection

RE: Firmware version and downgrade protection

Einar Thorsrud — Wed, 24 Apr 2024 15:14:38 GMT

Hi Patrick.

I don't see any issues in this description, but the feature should work and I have not seen any other reports of problems with downgrade protection. Can you upload a project you use to test along with exact instructions for each step you take so that I can attempt to reproudce on my end?

Br,

Einar

RE: Firmware version and downgrade protection

SirBuhi — Tue, 23 Apr 2024 12:59:38 GMT

Dear Einar,

I defined the application firmware version with the VERSION file to lets say 9.8.7. Built the firmware and flashed it to the nRF5340.

I then reduced the number of the version to lets say 8.8.7 as well as a change in a blinky timer (for visual testing) and built the firmware. Loaded the app_update.bin to the smartphone and performed a DFU with either the "Device Manager" or "nRF Connect" application.

The same test was performed with setting the CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION to similar values as described above.

Other settings in the prj.conf were not changed.

Loading the new application with a lower version number and booting from it was possible, without any issue. Same as loading and booting the higher version again.

In regards to the CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE, do I understand that correctly, that the value defines the version number of the McuBoot?

Kind regards,

Patrick

RE: Firmware version and downgrade protection

Einar Thorsrud — Tue, 23 Apr 2024 12:16:41 GMT

Hi Patrick,

Did you test with different firmware versions by setting the application frirmware version as desribed here and the MCUBoot veersion by adjusting CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE? And if you do, is it MCUboot downgrade protection that does not seem to work or application downgrade prevention? Can you elaborate on how you test?