Hello Nordic Team,
I'm implementing a multi-instance FOTA system using the Advanced Firmware Update object (33629) with 3 instances:
- Instance 0: nRF9160 application (working)
- Instance 1: nRF9160 modem (disabled)
- Instance 2: nRF54L15 via SMP over UART (crashing)
## Hardware Setup
- **Main board:** nRF9160DK (application processor + LwM2M client)
- **Secondary board:** nRF54L15DK (Bluetooth controller + SMP server)
- **Connection:** UART2 (nRF9160) <--> UART20 (nRF54L15) at 115200 baud
- nRF9160 P0.23 (TX) → nRF54L15 P1.05 (RX)
- nRF9160 P0.21 (RX) → nRF54L15 P1.04 (TX)
## Software Configuration
**nRF Connect SDK:** v3.1.1
**nRF9160 (LwM2M Client + SMP Client):**
```c
CONFIG_LWM2M_CLIENT_UTILS_ADV_FIRMWARE_UPDATE_OBJ_SUPPORT=y
CONFIG_LWM2M_CLIENT_UTILS_ADV_FOTA_INSTANCE_COUNT=3
CONFIG_NRF_MCUMGR_SMP_CLIENT=y
CONFIG_DFU_TARGET_SMP=y
CONFIG_MCUMGR_TRANSPORT_UART=y
CONFIG_SMP_CLIENT=y
CONFIG_FOTA_DOWNLOAD=y
CONFIG_MAIN_STACK_SIZE=5120
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=3072
CONFIG_DOWNLOADER_STACK_SIZE=2560
CONFIG_HEAP_MEM_POOL_SIZE=24576
```
**nRF54L15 (SMP Server):**
```c
CONFIG_MCUMGR=y
CONFIG_MCUMGR_TRANSPORT_UART=y
CONFIG_MCUMGR_TRANSPORT_UART_MTU=256
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_SPI_NOR=y
CONFIG_PM_EXTERNAL_FLASH_MCUBOOT_SECONDARY=y
```
## The Problem
Instance 0 (nRF9160 application FOTA) works perfectly:
- Downloads 348KB firmware via HTTPS
- MCUboot swap successful
- Device reboots with new version
Instance 2 (nRF54L15 via SMP) crashes during download:
- All 3 LwM2M instances created successfully
- LwM2M registration to Leshan server OK
- SMP server starts correctly on nRF54L15
partie nrf54L15DK
*** Booting MCUboot v2.1.0-dev-9b4ae4cbc9e2 *** *** Using nRF Connect SDK v3.1.1-e2a97fe2578a *** *** Using Zephyr OS v4.1.99-ff8f0c579eeb *** I: Starting bootloader W: Cannot upgrade: not a compatible amount of sectors I: Bootloader chainload address offset: 0xe000 I: Image version: v0.0.0 [00:00:00.003,031] <inf> spi_nor: mx25r6435f@0: SFDP v 1.6 AP ff with 3 PH [00:00:00.003,045] <inf> spi_nor: PH0: ff00 rev 1.6: 16 DW @ 30 [00:00:00.003,180] <inf> spi_nor: mx25r6435f@0: 8 MiBy flash [00:00:00.003,190] <inf> spi_nor: PH1: ffc2 rev 1.0: 4 DW @ 110 *** Booting nRF Connect SDK v3.1.1-e2a97fe2578a *** *** Using Zephyr OS v4.1.99-ff8f0c579eeb *** [00:00:00.005,470] <inf> smp_sample: Starting MCUmgr UART transport [00:00:00.005,488] <inf> smp_sample: MCUmgr UART ready on uart@c6000 [00:00:00.005,492] <inf> smp_sample: build time: May 7 2026 15:07:48
partie nrf9160 DK [00:00:20.690,612] <dbg> lwm2m_firmware: write_dl_uri: write URI: https://xxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.693,084] <dbg> lwm2m_firmware: write_resource_to_settings: Permanently stored lwm2m:fir/33629/2/5
[00:00:20.695,617] <dbg> lwm2m_firmware: write_resource_to_settings: Permanently stored lwm2m:fir/33629/2/3
[00:00:20.695,648] <inf> app_lwm2m_client: FOTA download started for instance 2
[00:00:20.695,678] <dbg> lwm2m_adv_firmware: lwm2m_adv_firmware_set_update_state: Update 33629/2/3 state = 1
[00:00:20.698,333] <dbg> lwm2m_firmware: write_image_type_to_settings: Permanently stored lwm2m:fir/33629/2
[00:00:20.698,364] <inf> fota_download_util: Download url https://xxxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.698,455] <inf> fota_download_util: Download Path nrf54l15.signed.bin host https://xxxxxxxxxxxxx.cloud
[00:00:20.698,455] <err> fota_download_full_modem: dfu_target_full_modem_cfg failed: -22
[00:00:20.698,486] <err> fota_download_util: Full modem stream init fail -22
[00:00:20.699,432] <dbg> fota_download: set_host_and_file: URI checksums 2077867784,881407557,0,0
[00:00:20.699,523] <dbg> downloader: downloader_start: URL: https://xxxxxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.699,645] <dbg> downloader: state_set: state = 2 ()
[00:00:20.699,676] <dbg> downloader: parse_protocol: Port not specified, using default: 443
[00:00:20.700,683] <inf> downloader: Host lookup failed for hostname firmware.egconnect.cloud on IPv6 (err -22), attempting IPv4
[00:00:20.700,744] <dbg> downloader: dl_socket_host_lookup: host lookup xxxxxxxxxxxxxx.cloud, pdn id 0, family 1
[00:00:20.722,686] <dbg> lwm2m_firmware: write_dl_uri: write URI: https://xxxxxxxxxxxx/nrf54l15.signed.bin
[00:00:20.851,501] <dbg> downloader: dl_socket_create_and_connect: family: 1, type: 1, proto: 258
[00:00:20.851,989] <dbg> downloader: dl_socket_create_and_connect: Socket opened, fd 5
[00:00:20.852,020] <inf> downloader: Setting up TLS credentials, sec tag count 1
[00:00:20.852,142] <inf> downloader: Connecting to 91.134.59.209
[00:00:20.852,203] <dbg> downloader: dl_socket_create_and_connect: fd 5, addrlen 8, fam IPv4, port 443
[00:00:23.216,033] <dbg> downloader: http_get_request_send: Range request up to 2048 bytes
[00:00:23.216,094] <dbg> downloader: http_get_request_send: http request:
GET /nrf54l15.signed.bin HTTP/1.1
Host: firmware.egconnect.cloud
Range: bytes=0-2047
Connection: keep-alive
[00:00:23.216,888] <dbg> downloader: dl_http_download: Receiving up to 2048 bytes at 0x2001eb0a...
[00:00:23.339,294] <dbg> downloader: http_header_parse: (partial) http header response:
HTTP/1.1 206 Partial Content
Server: nginx
Date: Wed, 13 May 2026 07:54:30 GMT
Content-Type: application/octet-stream
Content-Length: 2048
Connection: keep-alive
Last-Modified: Mon, 27 Apr 2026 14:00:54 GMT
ETag: "69ef6c16-ab000"
Content-Range: bytes 0-2047/700416
[00:00:23.339,538] <dbg> downloader: http_header_parse: File size = 700416
[00:00:23.339,660] <dbg> downloader: dl_http_download: Receiving up to 2048 bytes at 0x2001eb0a...
[00:00:23.462,005] <dbg> downloader: dl_transport_evt_data: Read 2048 bytes from transport
[00:00:23.462,005] <inf> downloader: Downloaded 2048/700416 bytes (0%)
[00:00:23.464,691] <err> os: ***** SECURE FAULT *****
[00:00:23.464,721] <err> os: Address: 0x30
[00:00:23.464,721] <err> os: Attribution unit violation
[00:00:23.464,752] <err> os: r0/a1: 0x2002cd90 r1/a2: 0x00000000 r2/a3: 0x2002cdac
[00:00:23.464,752] <err> os: r3/a4: 0x2002cdac r12/ip: 0xffffffff r14/lr: 0x000259f5
[00:00:23.464,782] <err> os: xpsr: 0x61000000
[00:00:23.464,782] <err> os: Faulting instruction address (r15/pc): 0x00051d94
[00:00:23.464,813] <err> os: >>> ZEPHYR FATAL ERROR 41: Unknown error on CPU 0
[00:00:23.464,874] <err> os: Current thread: 0x20011a10 (downloader)
[00:00:23.677,947] <err> os: Halting system
## Code Implementation
**Callback after download (working):**
```c
case FOTA_DOWNLOAD_EVT_FINISHED:
download_active = false;
#if defined(CONFIG_APP_SMP_CLIENT_FOTA_EXTERNAL)
extern int fota_external_start(int obj_inst_id);
int ret = fota_external_start(2); // Instance 2
if (ret) {
LOG_ERR("Failed to start SMP transfer: %d", ret);
}
#endif
break;
```
**SMP client implementation:**
```c
int fota_external_start(int obj_inst_id)
{
LOG_INF("Starting SMP FOTA transfer for instance %d", obj_inst_id);
int ret = mcumgr_smp_client_update();
if (ret) {
LOG_ERR("SMP client update failed: %d", ret);
}
return ret;
}
```
## What I've Tried
Reduced log levels
Verified UART connections physically
Tested SMP server standalone (boots correctly)
Verified all 3 instances are created
Still crashes on first downloaded packet
## Questions
1. Is there a known memory conflict between `fota_download` and `mcumgr_smp_client`?
2. Should I disable certain features when using SMP client with LwM2M?
3. Is the SECURE FAULT related to TF-M permissions when accessing DFU target?
4. Are there recommended partition sizes for this use case?
5. Should I use a different approach for external MCU FOTA via UART?
## Additional Information
- Instance 0 FOTA tested successfully multiple times
- nRF54L15 SMP server responds to basic commands when tested separately
- The crash happens BEFORE any SMP transfer starts (during HTTP download phase)
- Memory usage: ~349KB FLASH (82%), ~144KB RAM (68%) on nRF9160
Any guidance would be greatly appreciated!
Best regards