MCUboot rollback happening after successful upgrade on nRF9160 (NCS 2.7.0)

[purush123]

I am debugging an issue where my nRF9160 (NCS 2.7.0) rolls back to the previous firmware after a seemingly successful upgrade. I am not getting enough logs from MCUboot to understand the rollback reason.

Symptoms:

• Firmware upgrade completes successfully.

• After reboot, MCUboot attempts to boot the new image but then rolls back.

• Looks like a version-related validation failure, but I cannot confirm due to limited logs.

MCUboot configuration (summary):

CONFIG_FW_INFO=y
CONFIG_FW_INFO_FIRMWARE_VERSION=2
CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=n

CONFIG_MCUBOOT_SERIAL=y
CONFIG_BOOT_SERIAL_NO_APPLICATION=y
CONFIG_BOOT_SERIAL_BOOT_MODE=y
CONFIG_RETAINED_MEM=y
CONFIG_RETENTION=y
CONFIG_RETENTION_BOOT_MODE=y

CONFIG_BOOT_MAX_IMG_SECTORS=216
CONFIG_SIZE_OPTIMIZATIONS=y
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FPROTECT=y

My questions:

1. What are the typical reasons MCUboot rolls back even when signature verification succeeds?

2. Is there any additional logging option for MCUboot in NCS 2.7.0 to see the exact failure reason?

3. Is there any known issue around CONFIG_FW_INFO_FIRMWARE_VERSION or version comparison in NCS 2.7.0 for nRF9160?

4. How can I reliably debug when the bootloader decides that the new image is invalid or should be reverted?

Any guidance or recommended configs to increase verbosity or isolate version-validation issues would be very helpful.

[Hung Bui]

Hi Purushotham, 

What do you have in the log ? Have you enabled logging for MCUBoot ? I think by default it's enabled. You should see some log at boot. 

How did you do DFU update ? I assume with serial ? 

When you receive the new image, did the new image run ? Did you confirm the image or it only run on test ? If it run on test and then got a crash then reset the revert process will occur.

 I don't think it's a firmware version issue because the firmware version is checked when the header is sent before the actual image is sent. So if you see the image being transmitted most likely the firmware version check was passed. 

Have you tested with DFU update before ? I assume  you are familiar with different boot mode test, confirm etc ? 

[purush123]

We use FOTA , We keep the firmware in our server and download the image and install it, With serial ( nrfjprog ) flashing it always work. 

I am using NCS2.7.0, i am not sure which log option is available in mcuboot, but i get some logs

*** Using Zephyr OS v3.6.99-100befc70c74 ***
s0_info->version = 2, s1_info->version = 2
Attempting to boot slot 0.
Attempting to boot from address 0x8200.
Verifying signature against key 0.
Hash: 0x45...79
Firmware signature verified.
Firmware version 2
*** Booting Zephyr OS build v3.6.99-ncs2 ***

This is what i observed, In most cases i see device upgraded and it showed the new build details on the banner of console , Then immediately board rebooted and it went back to the old build. I am calling  boot_write_img_confirmed as the first call .

Another thing that i noticed is if i cut a formal release with proper versions like v2.2.2 then it worked, if i just do an incremental build and upload that to my server and download/install then i see this behaviour of rolling back , I am not sure which MCUBOOT configuration is causing it.