DFU FW downgrade protection

[Tommy F Kristensen]

Hi Nordic 

What is the best way to protect against downgrading the APP FW via DFU.

I seems that im able to downgrade even 2 config below are set.

I tested it on SDK 2.7.0 and here it was not possible to downgrade, but on latest it is

 

Im Using SDK 3.0.2 and 54L15

Can it be done with the config parameter, or are more needed 

CONFIG_BOOT_UPGRADE_ONLY=y

CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION=y

Best regards

Tommy F Kristensen

[Vidar Berg]

Hi Tommy,

SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION is now a sysbuild configuration and must be added as an argument to your build command or added to sysbuild.conf in your project root instead of being added to the project configuration file for mcuboot directly.

Also, CONFIG_BOOT_UPGRADE_ONLY=y is now the same as SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y. However, this is not directly related to downgrade protection but rather how the image is moved from the secondary slot to the primary slot : https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/bootloaders_dfu/mcuboot_nsib/bootloader_main_config.html#operational_modes_of_mcuboot 

Best regards,

Vidar

[Tommy F Kristensen]

Hi Vidar 

Thanks for the advice

I tried to put the SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION into the sysbuild config for the nrf54L15 project. But it is not enabled due to missing dependencies.

But it seems that is dependent of below defines that points to that the chip should be eather nrF5340 of nrF91x. SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION was undefined but figured out that  SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION is defined in the project

Build error:

warning: MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION (defined at
C:/ncs/v3.0.2/nrf/sysbuild\Kconfig.mcuboot:15) was assigned the value 'y' but got the value 'n'.
Check these unsatisfied dependencies: (SOC_NRF5340_CPUAPP || SOC_SERIES_NRF91X) (=n). See
docs.zephyrproject.org/.../kconfig.html
and/or look up MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION in the menuconfig/guiconfig interface. The
Application Development Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices
sections of the manual might be helpful too.

Best Regards

Tommy  F Kristensen

[Vidar Berg]

Hi Tommy,

It looks like it's maybe just the dependency list for this symbol that hadn't been updated in this release. It's supported in v3.1.0 : https://github.com/nrfconnect/sdk-nrf/commit/bb4869b32360f7b8a35ac44be767dfa6cd340a1d. Could you try with this change and see if it works? 

Best regards,

Vidar

[Tommy F Kristensen]

Hi Vidar

I have patched our SDK 3.0.2 as we havent planned to update the SDK now

I did enable the SB_CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION=y 

But im missing 900 Bytes to be able to link the mcuboot

I was trying to allocate more flash using 

in /sysbuild/mcuboot/prj.conf i did update

From:

CONFIG_PM_PARTITION_SIZE_MCUBOOT=0xe000

To:

CONFIG_PM_PARTITION_SIZE_MCUBOOT=0xe400

but mcuboot remains the same size

Is there an other place to change to make partion_tool generate new partitions. I did try go generate a full new build to ensure nothing was cashed

Best Regards

Tommy  F Kristensen

[Vidar Berg]

Hi Tommy,

Not sure if that's the issue here, but please note that the CONFIG_PM_PARTITION_SIZE_MCUBOOT settings is ignored if you have a static partitioning file. Another thing is that the size has to be aligned to 0x1000 bytes. Could you post your prj.conf file, maybe there are some settings that can be adjusted to allow the bootloader to fit in the current region.

Best regards,

Vidar