CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION in NRF5340 multi update

[Julien]

Hi,

I would like to add MCU boot hardware downgrade prevention in my project. 

So i had the following config in prj.conf

CONFIG_MCUBOOT_IMGTOOL_SIGN_VERSION="1.1.0+0"
CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION=y

Then, when i flash my board i get this error on log

*** Booting nRF Connect SDK 3758bcbfa5cd ***
E: Security counter update failed after image validation.
E: Unable to find bootable image

This config was working when multi image update was not enable. 

To be sure, that was not my project who create this error, i try it in ncs courses intermediation lesson 8 exercise 3; and issue still occurs.

Is there any config i missing on mcuboot.conf or hci_ipc.conf ?

To test it, you only need to add the config on prj.conf in this lesson.

I am using nrf5340dk abd ncs sdk v2.6.1.

Best regards,

Julien

[Elfving]

Hello Julien,

After a quick look here, it seems to me like you are missing a few configs.

CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION

CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_SLOTS

CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE

Do these help?

Regards,

Elfving

[Julien]

Hi Elfving,

Issue is still here. Indeed, if CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_SLOTS and CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE are not configured in prj.conf, they take the default value '1' and '240'.

Best regards,

Julien

[Julien]

The error come from the function bootutil_get_img_security_cnt on mcuboot source file "image_validate.c", because hdr->ih_protect_tlv_size = 0.

This value come from boot_read_image_header_hook on nrf53_hooks.c source file, where the image header are prefill when it's the image index 1 on slot 0.

Regards,

Julien

[Elfving]

I just had a talk with the relevant R&D team about this. They got it working.

To configure, must enable:

      - mcuboot_CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y
      - <netcore_name>_CONFIG_FW_INFO_FIRMWARE_VERSION=2  # to upload use lower number
      - b0n_CONFIG_PCD_READ_NETCORE_APP_VERSION=y

(for legacy child images must use <netcore_name>_b0n_CONFIG_PCD_READ_NETCORE_APP_VERSION=y)

There is not checked MCUBOOT_IMGTOOL_SIGN_VERSION but FW_INFO_FIRMWARE_VERSION

This previous case might also be interesting to you.

Regards,

Elfving

[Julien]

Hi,

Thanks for the answerd, it's working well now.

Best regards,

Julien