Fail to boot after upgrade to NCS 3.1.1

RE: Fail to boot after upgrade to NCS 3.1.1

Kazi Afroza Sultana — Fri, 12 Dec 2025 15:20:20 GMT

Hello,

Can you try this sample samples_for_NCS/bootloader/sysbuild/4_dfu_uart/2_54l15_chain_priv_key at main · aHaugl/samples_for_NCS · GitHub?

Addition config which mentioned in point 2 most probably present in main

config SB_MONOTONIC_COUNTER_IS_ENABLED
    bool "Secure boot monotonic counter is enabled"
    default n
    help
      sample text:  Internal flag used by sysbuild to indicate that the secure boot
      monotonic counter is enabled.
      Normally this is set automatically by sysbuild; do not change
      it manually unless you know what you are doing.
 
config SB_MONOTONIC_COUNTER_ROLLBACK_PROTECTION
    bool "Secure boot monotonic counter rollback protection"
    default n
    help
      sample text: Enables rollback protection using the secure boot monotonic counter.
      This is controlled by sysbuild; normally you do not need to change
      it manually

RE: Fail to boot after upgrade to NCS 3.1.1

SimonV — Tue, 09 Dec 2025 14:09:02 GMT

Thanks. I went and tested 3.2.0-rc2 and it seems to work. However if i define fprotect (CONFIG_FPROTECT=y) in my prj.conf i get rramc errors. It seems that the reason is that i am building a non secure application. Can you confirm if this is true.

If i remove the fprotect declaration everything builds fine. I am attaching the build log of where it failed:

devzone.nordicsemi.com/.../1134._5B00_261371_5D00_-Building-C-object-modulesh.txt

I checked the build files that are made and inside i found:

PS C:\Users\SV\Documents\smartcup> cat build\mcuboot\zephyr\.config | findstr "FPROTECT"
CONFIG_FPROTECT_BLOCK_SIZE=0x1000
CONFIG_FPROTECT=y
# CONFIG_FPROTECT_APP is not set
CONFIG_FPROTECT_ALLOW_COMBINED_REGIONS=y

Which makes me think that fprotect is enabled even if i did not explicitlymake the setting.

Also it seems that i have found a bug in 3.2.0-rc2 when i provision the key with

west ncs-provision upload -k private_key.pem

the key doesn't seem to get provisioned I needed to add the --keyname option

 west ncs-provision upload -k private_key.pem --keyname BL_PUBKEY

This way of provisioning seems to work. Is this intended?

RE: Fail to boot after upgrade to NCS 3.1.1

Kazi Afroza Sultana — Tue, 02 Dec 2025 11:38:46 GMT

Hello,

Here is the link of potential fix of this issue

https://github.com/nrfconnect/sdk-mcuboot/pull/576

https://github.com/nrfconnect/sdk-nrf/pull/25655

RE: Fail to boot after upgrade to NCS 3.1.1

Igor — Tue, 02 Dec 2025 08:49:41 GMT

Kazi Afroza Sultana Anything new regarding this issue?

RE: Fail to boot after upgrade to NCS 3.1.1

Kazi Afroza Sultana — Thu, 27 Nov 2025 12:03:38 GMT

Hello,

I have talked team. I am waiting for the reply. In the meantime, you can just try to delete the MCUBOOT partition size config and try to build again.

RE: Fail to boot after upgrade to NCS 3.1.1

SimonV — Fri, 21 Nov 2025 12:28:17 GMT

Hello!

I am working on this issue with Igor.

Disabling FPROTECT works, however we need this feature.

I have checked the partition sizes and MCUboot partition is 48kb. Do you have any other potential fixes.

I am including the partition report and build logs. have also tried reducing mcuboot partition to 40kb and increasing it to 60kb both of which give the same error that Igor posted. I also tried to use dynamic partition allocation and that gives the same mcuboot flash failed error when i flash the device. Do you have any suggestion what might be wrong? I am also attaching the pm_static file that we are using.

devzone.nordicsemi.com/.../5153.pm_5F00_static.txt

devzone.nordicsemi.com/.../partition_5F00_report.txt devzone.nordicsemi.com/.../Build-logs.txt. I

RE: Fail to boot after upgrade to NCS 3.1.1

Kazi Afroza Sultana — Tue, 14 Oct 2025 08:34:14 GMT

Hello,

This error ''E: Protect mcuboot flash failed, cancel startup.'' is a common issue after upgrading to NCS 3.1.1 on nRF54L15. It is related to MCUboot handling flash protection (FPROTECT) and partition sizes in recent SDK versions.

You can read this here Known issues.

''FPROTECT can support locking up to 62 KB of RRAM on nRF54L SoCs when used by immutable MCUboot. Either the partition declared for MCUboot or its size might be too large for using FPROTECT (depends on MCUboot configuration). Without access to MCUboot logs, this might be misrecognized as an application that is not working or starting''

You need to check the MCUboot partition size and make sure that it does not exceed 62KB if FROTECT is enable; or disable FPROTECT in your configuration by setting CONFIG_FPROTECT=n in your MCUboot prj.conf or sysbuild.conf.

You can also configure the MCUboot partition size dynamically from the mcuboot.conf file; for example:

CONFIG_PM_PARTITION_SIZE_MCUBOOT=0xF800

After this, try to rebuild and flash the sample again. Let me know if it works or not.

Thanks.

BR
Kazi