How to use Hardware-based downgrade protection

[a.da]

Hello.

I am trying to follow Downgrade protection using MCUboot to enable Hardware-based downgrade protection.
However, an error occurred, and the software did not start. It is also from the initial flash, not after the update.

*** Booting MCUboot v2.1.0-dev-12e5ee106034 ***
*** Using nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
I: Starting bootloader
I: Image index: 0, Swap type: none
I: Image index: 1, Swap type: none
E: Security counter update failed after image validation.
E: Unable to find bootable image

The "sysbuild.conf" is as follows.
It is the minimum configuration according to Exercise 5 – FOTA over Bluetooth Low Energy and Simultaneous updates for both cores of the nRF5340.
Naturally, if the last three lines related to downgrade protection are disabled, the software will start.

# STEP 2.1 Enable MCUboot
SB_CONFIG_BOOTLOADER_MCUBOOT=y

# STEP 6.3 - Configure project to use external flash for DFU
SB_CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y

 # STEP 7.2 - Add b0n image
SB_CONFIG_SECURE_BOOT_NETCORE=y

# STEP 7.3 - Set up multiple partitions
SB_CONFIG_MCUBOOT_UPDATEABLE_IMAGES=2

# STEP 7.4 - Add support to netcore for DFU
SB_CONFIG_NETCORE_APP_UPDATE=y

# STEP 7.5 - Add support to mcuboot for updating
# two cores simultaneously
SB_CONFIG_MCUBOOT_NRF53_MULTI_IMAGE_UPDATE=y

# STEP 7.6 - Simultaneous FOTA does not support rollback
SB_CONFIG_MCUBOOT_MODE_OVERWRITE_ONLY=y

# Enable Hardware-based downgrade protection
SB_CONFIG_MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION=y
SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_SLOTS=24
SB_CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION_COUNTER_VALUE=1

Also, a similar issue was reported in another person's ticket.
However, even following the configuration there, the issue did not change.

Thanks for reading.

a.da

[Amanda Hsieh]

Hi, 

It should get fixed by this PR: https://github.com/nrfconnect/sdk-nrf/pull/20787. 

-Amanda H.

[a.da]

Hi Amanda, thanks for your reply.

Unfortunately, the issue has not changed.
I have reflected the changes written in the PR into nRF Connect SDK v2.9.0.
Since overwriting directly with the files attached to the PR results in a Build Error, I only applied the differences.
Do you know the steps to confirm that the issue has been fixed?

Also, I have some doubts about the changes.
It seems that dependencies necessary for enabling MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION have been added.
Even after reflecting these changes, MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION remained enabled.
What could be the problem?

a.da

Addendum:

I overlooked this. This PR also needs to be reflected, right?
I’ll check again.