Hi,
I have B0, mcuboot and then application as my partitions. We plan to support upgrade of both mcuboot and application.
Based on this below Kconfig snippet, it looks like the hardware based downgrade protection for the application is not supported when B0 is enabled ? Can you please confirm if it is so ? AI generated answer seems to indicate this is due to number of OTP slots needed to support both upgrades. If we limit the # of supported upgrades for mcuboot, is it possible to allow hardware protection for app also. If only one image can be protected with hardware, is it possible to do that for application instead of mcuboot ( as app will be upgraded lot more than mcuboot ).
ncs\v3.4.0\nrf\sysbuild
menuconfig MCUBOOT_HARDWARE_DOWNGRADE_PREVENTION
bool "Downgrade prevention using hardware security counters"
depends on (SOC_NRF5340_CPUAPP || SOC_SERIES_NRF91 || SOC_SERIES_NRF54L || SOC_SERIES_NRF54H || SOC_SERIES_NRF71)
depends on !SECURE_BOOT_APPCORE
depends on !QSPI_XIP_SPLIT_IMAGE
help
This option can be enabled by the application and will ensure that the
MCUBOOT_HW_DOWNGRADE_PREVENTION Kconfig option is enabled in the MCUboot image.
Note that this can only be used on first image, it will not be applied to the second
image (network core updates) on nRF5340 which will use software downgrade protection
on the network core CPU instead.