Overwrite Softdevice by application using Thread Secure DFU

RE: Overwrite Softdevice by application using Thread Secure DFU

PBeS — Thu, 07 Jul 2022 07:16:30 GMT

Hi,

I was able to prepare update with overwrite SD. This is my steps:

Prepare BL with sd-req 0x00, 0xAE and disable BLE support
DFU BL
Prepare APP with disabled BLE and set start app address to 0x1000 in ld script,
DFU APP

I did dump of MCU flash and my app start from 0x1000 address. It's exactly what I wanted.

Vidar, thanks for the right tips

RE: Overwrite Softdevice by application using Thread Secure DFU

PBeS — Wed, 06 Jul 2022 12:03:30 GMT

Yes, I saw it. I was change my app with sd-req 0x00,0xAE,0xCA and BL didin't activate update after downloading. Im trying to update BL with sd-req 0x00, 0xAE and i will try again. In your opinion is that good direction?

RE: Overwrite Softdevice by application using Thread Secure DFU

Vidar Berg — Wed, 06 Jul 2022 11:58:21 GMT

Then the app will not be allowed to overwrite the Softdevice. From the nrf_dfu_ver_valdation.c::sd_req_ok() check:

RE: Overwrite Softdevice by application using Thread Secure DFU

PBeS — Wed, 06 Jul 2022 11:54:41 GMT

No, first BL was build with BLE support and flash via serial.

RE: Overwrite Softdevice by application using Thread Secure DFU

Vidar Berg — Wed, 06 Jul 2022 11:44:05 GMT

I see. And is the bootloader built without BLE support as well (i.e. without BLE_STACK_SUPPORT_REQD flag and BLE dfu transport)

RE: Overwrite Softdevice by application using Thread Secure DFU

PBeS — Wed, 06 Jul 2022 11:25:33 GMT

Hi,

[quote userid="4240" url="~/f/nordic-q-a/89664/overwrite-softdevice-by-application-using-thread-secure-dfu/375749"]Are you doing DFU over serial so the bootloaader is not depentent on the Softdevice for receiving the images?[/quote]

I try to do DFU over Thread.

My old BL has configured sd_req = 0xAE (SD.6.1.0). Should I update BL with sd_req = 0x00 and then try update APP again?

RE: Overwrite Softdevice by application using Thread Secure DFU

Vidar Berg — Wed, 06 Jul 2022 11:14:23 GMT

Hi,

[quote userid="105977" url="~/f/nordic-q-a/89664/overwrite-softdevice-by-application-using-thread-secure-dfu/375739"]In my opinion, update bl+sd can brick device, because app start address is different than storedin flash.[/quote]

The app is always marked as invalid after a bl+sd update. This prevents the new bootloader from potentially booting a corrupted or incompatible app. There is also the app boot validation (Boot validation) that verifies the integrity of the image before booting it.

[quote userid="105977" url="~/f/nordic-q-a/89664/overwrite-softdevice-by-application-using-thread-secure-dfu/375739"]Could you tell me if this nrfutil pkg generate --hw-version 52 --sd-req 0x00 --application-version 60608 --application app.hex --key-file board_dfu_upgrade_key.pem customer-pkg.zip should overwrite SD by APP if I set flash addr to 0x1000? [/quote]

The bootloader has no way of knowing if the binary has been linked to the correct start address. Whether the app gets allowed to overwrite the Softdevice is determined by the sd-req field and if the bootloader is configured to support it.

Are you doing DFU over serial so the bootloaader is not depentent on the Softdevice for receiving the images?

RE: Overwrite Softdevice by application using Thread Secure DFU

PBeS — Wed, 06 Jul 2022 10:56:31 GMT

Hi Vidar,

Thanks for reply.

Yes, I have NRF_DFU_APP_DOWNGRADE_PREVENTION disabled.

In my old app there is s140_nrf52_6.1.0 (SDK-2) included. New APP doesn't need SD so I would like to remove It. In the other case if I would like to update SD to s140_nrf52_7.0.1 (SDK-4) app start address should be move:

MEMORY
{
  FLASH (rx) : ORIGIN = 0x26000, LENGTH = 0xC3000

MEMORY
{
  FLASH (rx) : ORIGIN = 0x27000, LENGTH = 0xC2000

In my opinion, update bl+sd can brick device, because app start address is different than storedin flash.

Could you tell me if this nrfutil pkg generate --hw-version 52 --sd-req 0x00 --application-version 60608 --application app.hex --key-file board_dfu_upgrade_key.pem customer-pkg.zip should overwrite SD by APP if I set flash addr to 0x1000?

RE: Overwrite Softdevice by application using Thread Secure DFU

Vidar Berg — Wed, 06 Jul 2022 10:18:58 GMT

Hi,

It is possible to replace the Softdevice through DFU if the bootloader is correctly configured for it. Have you disabled the NRF_DFU_APP_DOWNGRADE_PREVENTION setting in your bootloader? The bootloader will refuse the update otherwise.

Best regards,

Vidar