Downgrade protection works only for the app_core -image-and not for the net-core -image

[Georg]

Hallo,

we are using the nrf5340 and the ncs Version 2.6.1.

I activated the software downgrade protection as described here Downgrade protection (nordicsemi.com). 

Then I made some simultaneious FOTA updates (App-image + Net-image) by using the nRF Connect app with different versions.

What I see is that the downngrade protection works for the App-image. It is not possible to update an App-image V2.0.0. with an App-image V1.0.0.

But it is possible to downgrade the Net- image V2.0.0 with the Net-image V1.0.0

How can I activate the downgrade protection also for the net-core ?

 

Best regards,

Georg

[Amanda Hsieh]

Hi, 

Do you test the MCUBoot version by adjusting CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE?

How do you check the version number? You can check the version by 

imgtool verify build/zephyr/net_core_app_update.bin

Regards,
Amanda H.

[Georg]

Hi,

I checked the version information by looking into the header of the net_core_app update.bin file.  

Here are the configuration switches which I have added to activate the downgrade prevention:

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

In the build configuration I added:

-DSB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

And  there is also a VERSION file which looks like this:

Some additional information:

We are using a serial external flash to store the secondary images of the app-core and the net-core.

After making an simultaineious update by using dfu_application.zip it seems that the header ifnormation of the net_core_app_update.bin is corrupt when lokking into the memory of the nrf5340-net-core. So there is no version information any more.

When looking into the memory of the app-core the header information seems to be ok 

Best regards,

Georg

[Georg]

Hi,

this is what I added to the config files to activate the downgrade protection in complete.

mcuboot.conf under child_image folder:

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y

CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

CONFIG_FW_INFO=y
CONFIG_PCD_APP=y
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

hci_ipc.conf under child_image folder:

CONFIG_FW_INFO_FIRMWARE_VERSION=2

b0n.conf under child_image folder:

CONFIG_PCD_READ_NETCORE_APP_VERSION=y

prj.conf:

CONFIG_FW_INFO=y
CONFIG_PCD_APP=y
CONFIG_PCD_READ_NETCORE_APP_VERSION=y

Since my last mail, I added only the 3 config switches in the prj.conf file.

The application doesn't boot and the mcuboot hangs in the loop as described above.

Best regards,

Georg

[Amanda Hsieh]

Sounds it works as expected now with your configs files. Right?

[Georg]

Hi,

no, it doesn't work. The system doesn't boot and hangs still in the "do while" of the mcuboot.

[Georg]

Hi,

are there some new ideas concerning this problem ?

Best regards, 

Georg

[Amanda Hsieh]

Add CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf and check whether `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config

[Georg]

Hi, 

there is no subdirectory "/b0n/zephyr" under the directory "/ncs/v2.6.1/zephyr/samples/bluetooth/hci_ipc" in the ncs sdk 2.6.1.

Best regards

Georg

[Georg]

Hi,

I set CONFIG_PCD_READ_NETCORE_APP_VERSION=y in nrf\samples\nrf5340\netboot\prj.conf 

When loooking into MyProject\build\hci_ipc\b0n\zephyr\.config  the CONFIG_PCD_READ_NETCORE_APP_VERSION is commented out.

The problem (hanging in the do while loop) still exists.

What to do next ?

Best regards,

Georg

[Georg]

Hi,

Ignore my last 2 messages

After adding CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf I see that `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config 

Now the application boots and  Mcuboot  doesn't hang in the "do while" loop.

But downgrade protection doesn't still work for the net core.

1. APP-Core = V1, NET-Core = V1

2. Fota Update with V2

3.  APP-Core = V2, NET-Core = V2

4. Fota Update with V1 (downgrading)

5. APP-Core = V2, NET Core= V1

Best regards,

Georg

[Amanda Hsieh]

Hi, 

Please try to delete the build folder and build again. It should work. 

If you don't want to modify anything of the nrf\samples\nrf5340\netboot, you can build the project with this config for netboot(b0n) 

-Dhci_ipc_b0n_CONFIG_PCD_READ_NETCORE_APP_VERSION=y

-Amanda H.

[Georg]

Hi,

after deleting the build directory and creating a new V1 zip file and a new V2 zip file I got the same results as described in my last mail.

1. APP-Core = V1, NET-Core = V1

2. Fota Update with V2 Zip file

3.  APP-Core = V2, NET-Core = V2

4. Fota Update with V1 Zip file (downgrading)

5. APP-Core = V2, NET Core= V1

The problem still exists.

After programming a new Version I always read out the memory of the nrf5340 and checked which version is programmed in the APP-Core and the NET-Core.

Do you have an example that works ?

Georg