Update version checks during DFU update by xorptr · Pull Request #253 · google/libhoth

xorptr · 2026-05-19T07:47:29Z

Do not fail desired ROM_EXT version checks if the running ROM_EXT will cause ROM_EXT boot slot to not change after update
Check that the application security version is allowed by current minimum BL0 security version, and fail early if it isn't
Do not fail DFU check if the running ROM_EXT version is not the same as the one in the image being checked in cases where this is expected

xorptr · 2026-05-27T07:19:54Z

~~dfu check fails because current logic does not extract security version from firmware update package~~ Fixed now

- Do not fail desired ROM_EXT version checks if the running ROM_EXT will cause ROM_EXT boot slot to not change after update - Check that the application security version is allowed by current minimum BL0 security version, and fail early if it isn't - Allow use to skip this check during force install - Do not fail DFU check if the running ROM_EXT version is not the same as the one in the image being checked in cases where this is expected

xorptr requested review from korran and stevenportley May 19, 2026 07:47

korran reviewed May 19, 2026

View reviewed changes

Comment thread protocol/opentitan_version.c Outdated

stevenportley reviewed May 19, 2026

View reviewed changes

Comment thread protocol/opentitan_version.c Outdated

xorptr force-pushed the dfu_update_version_check branch from 7a9b65f to c66504e Compare May 19, 2026 18:14