Downgrade protection works only for the app_core -image-and not for the net-core -image

[Georg]

Hallo,

we are using the nrf5340 and the ncs Version 2.6.1.

I activated the software downgrade protection as described here Downgrade protection (nordicsemi.com). 

Then I made some simultaneious FOTA updates (App-image + Net-image) by using the nRF Connect app with different versions.

What I see is that the downngrade protection works for the App-image. It is not possible to update an App-image V2.0.0. with an App-image V1.0.0.

But it is possible to downgrade the Net- image V2.0.0 with the Net-image V1.0.0

How can I activate the downgrade protection also for the net-core ?

 

Best regards,

Georg

[Amanda Hsieh]

Hi, 

Do you test the MCUBoot version by adjusting CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE?

How do you check the version number? You can check the version by 

imgtool verify build/zephyr/net_core_app_update.bin

Regards,
Amanda H.

[Georg]

Hi,

I checked the version information by looking into the header of the net_core_app update.bin file.  

Here are the configuration switches which I have added to activate the downgrade prevention:

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

In the build configuration I added:

-DSB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

And  there is also a VERSION file which looks like this:

Some additional information:

We are using a serial external flash to store the secondary images of the app-core and the net-core.

After making an simultaineious update by using dfu_application.zip it seems that the header ifnormation of the net_core_app_update.bin is corrupt when lokking into the memory of the nrf5340-net-core. So there is no version information any more.

When looking into the memory of the app-core the header information seems to be ok 

Best regards,

Georg

[Georg]

Hi, 

the program hangs  in the "do while" loop  of the function: network_core_pcd_cmdset in the file pcd.c

The command_status is PCD_STATUS_READ_VERSION

tatic int network_core_pcd_cmdset(uint32_t cmd, const void *src_addr, size_t len, bool wait)
{
	int err;
	enum pcd_status command_status;

	/* Ensure that the network core is turned off */
	nrf_reset_network_force_off(NRF_RESET, true);

	err = pcd_cmd_write(cmd, src_addr, len, PCD_NET_CORE_APP_OFFSET);
	if (err != 0) {
		LOG_INF("Error while writing PCD cmd: %d", err);
		return err;
	}

	enum pcd_status initial_command_status = pcd_fw_copy_status_get();

	nrf_reset_network_force_off(NRF_RESET, false);
	LOG_INF("Turned on network core");

	if (!wait) {
		return 0;
	}

	do {
		/* Wait for 1 second to avoid issue where network core
		 * is unable to write to shared RAM.
		 */
		k_busy_wait(1 * USEC_PER_SEC);

		command_status = pcd_fw_copy_status_get();
	} while (command_status == initial_command_status);

Best regards,

Georg

[Amanda Hsieh]

Did you add CONFIG_PCD_READ_NETCORE_APP_VERSION for b0n? This option must be enabled in APP, MCUboot, and b0n configuration (when b0n is not configured, than application hangs after reboot).

[Georg]

Hi,

this is what I added to the config files to activate the downgrade protection in complete.

mcuboot.conf under child_image folder:

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

CONFIG_FW_INFO=y
CONFIG_PCD_APP=y
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

hci_ipc.conf under child_image folder:

CONFIG_FW_INFO_FIRMWARE_VERSION=2

b0n.conf under child_image folder:

CONFIG_PCD_READ_NETCORE_APP_VERSION=y

prj.conf:

CONFIG_FW_INFO=y
CONFIG_PCD_APP=y
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

Since my last mail, I added only the 3 config switches in the prj.conf file.

The application doesn't boot and the mcuboot hangs in the loop as described above.

Best regards,

Georg

[Amanda Hsieh]

Sounds it works as expected now with your configs files. Right?

[Georg]

Hi,

no, it doesn't work. The system doesn't boot and hangs still in the "do while" of the mcuboot.

[Georg]

Hi,

are there some new ideas concerning this problem ?

Best regards, 

Georg

[Amanda Hsieh]

Add CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf and check whether `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config

[Georg]

Hi, 

there is no subdirectory "/b0n/zephyr" under the directory "/ncs/v2.6.1/zephyr/samples/bluetooth/hci_ipc" in the ncs sdk 2.6.1.

Best regards

Georg

[Georg]

Hi,

I set CONFIG_PCD_READ_NETCORE_APP_VERSION=y in nrf\samples\nrf5340\netboot\prj.conf 

When loooking into MyProject\build\hci_ipc\b0n\zephyr\.config  the CONFIG_PCD_READ_NETCORE_APP_VERSION is commented out.

The problem (hanging in the do while loop) still exists.

What to do next ?

Best regards,

Georg

[Georg]

Hi,

Ignore my last 2 messages

After adding CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf I see that `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config 

Now the application boots and  Mcuboot  doesn't hang in the "do while" loop.

But downgrade protection doesn't still work for the net core.

1. APP-Core = V1, NET-Core = V1

2. Fota Update with V2

3.  APP-Core = V2, NET-Core = V2

4. Fota Update with V1 (downgrading)

5. APP-Core = V2, NET Core= V1

Best regards,

Georg