Downgrade protection works only for the app_core -image-and not for the net-core -image

[Georg]

Hallo,

we are using the nrf5340 and the ncs Version 2.6.1.

I activated the software downgrade protection as described here Downgrade protection (nordicsemi.com). 

Then I made some simultaneious FOTA updates (App-image + Net-image) by using the nRF Connect app with different versions.

What I see is that the downngrade protection works for the App-image. It is not possible to update an App-image V2.0.0. with an App-image V1.0.0.

But it is possible to downgrade the Net- image V2.0.0 with the Net-image V1.0.0

How can I activate the downgrade protection also for the net-core ?

 

Best regards,

Georg

[Amanda Hsieh]

Hi, 

Do you test the MCUBoot version by adjusting CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE?

How do you check the version number? You can check the version by 

imgtool verify build/zephyr/net_core_app_update.bin

Regards,
Amanda H.

[Georg]

Hi,

I checked the version information by looking into the header of the net_core_app update.bin file.  

Here are the configuration switches which I have added to activate the downgrade prevention:

CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y

In the build configuration I added:

-DSB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

And  there is also a VERSION file which looks like this:

Some additional information:

We are using a serial external flash to store the secondary images of the app-core and the net-core.

After making an simultaineious update by using dfu_application.zip it seems that the header ifnormation of the net_core_app_update.bin is corrupt when lokking into the memory of the nrf5340-net-core. So there is no version information any more.

When looking into the memory of the app-core the header information seems to be ok 

Best regards,

Georg

[Georg]

Hi,

are there some new ideas concerning this problem ?

Best regards, 

Georg

[Amanda Hsieh]

Add CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf and check whether `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config

[Georg]

Hi, 

there is no subdirectory "/b0n/zephyr" under the directory "/ncs/v2.6.1/zephyr/samples/bluetooth/hci_ipc" in the ncs sdk 2.6.1.

Best regards

Georg

[Georg]

Hi,

I set CONFIG_PCD_READ_NETCORE_APP_VERSION=y in nrf\samples\nrf5340\netboot\prj.conf 

When loooking into MyProject\build\hci_ipc\b0n\zephyr\.config  the CONFIG_PCD_READ_NETCORE_APP_VERSION is commented out.

The problem (hanging in the do while loop) still exists.

What to do next ?

Best regards,

Georg

[Georg]

Hi,

Ignore my last 2 messages

After adding CONFIG_PCD_READ_NETCORE_APP_VERSION=y to nrf\samples\nrf5340\netboot\prj.conf I see that `CONFIG_PCD_READ_NETCORE_APP_VERSION is set in hci_ipc/b0n/zephyr/.config 

Now the application boots and  Mcuboot  doesn't hang in the "do while" loop.

But downgrade protection doesn't still work for the net core.

1. APP-Core = V1, NET-Core = V1

2. Fota Update with V2

3.  APP-Core = V2, NET-Core = V2

4. Fota Update with V1 (downgrading)

5. APP-Core = V2, NET Core= V1

Best regards,

Georg