nRF54L15 + NCS v3.4.0: MCUboot fails with "Firmware has been invalidated: 0xffff0000" when using NSIB + MCUboot + BLE FOTA

[Mathiyazhagan S]

Hi Nordic Team,

I am trying to implement a secure boot chain on the nRF54L15 DK using NCS v3.4.0 (LTS) with the following configuration:

• Board: nrf54l15dk/nrf54l15/cpuapp
• NCS version: v3.4.0
• Boot chain:
  • NSIB
  • MCUboot
• Application:
  • BLE SMP FOTA using MCUmgr

I followed the available Nordic documentation and DevZone recommendations to configure NSIB + MCUboot together.

sysbuild.conf:

# Enable two-stage boot chain
SB_CONFIG_SECURE_BOOT_APPCORE=y
SB_CONFIG_BOOTLOADER_MCUBOOT=y

# ED25519 keys
SB_CONFIG_SECURE_BOOT_SIGNATURE_TYPE_ED25519=y
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

# Store MCUboot verification key in KMU
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y

# Signing keys
SB_CONFIG_SECURE_BOOT_SIGNING_KEY_FILE="${APP_DIR}/keys/nsib_priv.pem"
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="${APP_DIR}/keys/mcuboot_priv.pem"

# Generate KMU provisioning file
SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KEY_FILE=y

prj.conf:

CONFIG_SERIAL=y
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y
CONFIG_LOG=y
CONFIG_LOG_BACKEND_UART=y
CONFIG_PRINTK=y
CONFIG_LOG_MODE_IMMEDIATE=y

CONFIG_BT_PERIPHERAL=y

CONFIG_NCS_SAMPLE_MCUMGR_BT_OTA_DFU=y

CONFIG_MCUMGR_TRANSPORT_BT_PERM_RW_AUTHEN=y

Flashing
I perform a full recover before programming: west flash --recover and 
Programming completes successfully without any reported errors.

Relevant output:

-- west flash: rebuilding
[0/8] Performing build step for 'app'
ninja: no work to do.
[1/8] Performing build step for 'mcuboot'
ninja: no work to do.
[7/7] Completed 'mcuboot'
WARNING: Specifying runner options for multiple domains is experimental.
If problems are experienced, please specify a single domain using '--domain <domain>'
-- west flash: using runner nrfutil
Using board 001057728952
-- runners.nrfutil: Recovering and erasing all flash memory.
-- runners.nrfutil: Flashing file: app/build_v3.4.0_nrf54l15_/mcuboot/zephyr/zephyr.hex
-- runners.nrfutil: Provisioning key file: app/build_v3.4.0_nrf54l15_/keyfile.json
-- runners.nrfutil: Connecting to probe
-- runners.nrfutil: Recover
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: KEY Provision
-- runners.nrfutil: Board(s) with serial number(s) 1057728952 flashed successfully.
-- west flash: using runner nrfutil
-- runners.nrfutil: reset after flashing requested
-- runners.nrfutil: Flashing file: app/build_v3.4.0_nrf54l15_/nRF_Evaluations/zephyr/zephyr.signed.hex
-- runners.nrfutil: Connecting to probe
-- runners.nrfutil: Programming image
-- runners.nrfutil: Verifying image
-- runners.nrfutil: Reset

Boot Log:

Fprotect disabled. No protection applied.
LCS-awareness disabled.
Attempting to boot slot 0.
Attempting to boot from address 0x10800.
E: Firmware has been invalidated: 0xffff0000.
Failed to validate, permanently invalidating!
Attempting to boot slot 1.
Attempting to boot from address 0x20800.
E: Firmware has been invalidated: 0xffff0000.
Failed to validate, permanently invalidating!
No bootable image found. Aborting boot.

I also use the following custom flash partition layout: nrf54l15dk_nrf54l15_cpuapp.overlay

&cpuapp_rram {
    partitions {
        b0_partition: partition@0 {
            compatible = "zephyr,mapped-partition";
            label = "b0";
            reg = <0x0 0xC000>;
        };

        provision_partition: partition@C000 {
            compatible = "zephyr,mapped-partition";
            label = "provision";
            reg = <0xC000 0x4000>;
        };

        s0_partition: partition@10000 {
            compatible = "zephyr,mapped-partition";
            label = "s0";
            reg = <0x10000 0x10000>;
        };

        s1_partition: partition@20000 {
            compatible = "zephyr,mapped-partition";
            label = "s1";
            reg = <0x20000 0x10000>;
        };

        slot0_partition: partition@30000 {
            compatible = "zephyr,mapped-partition";
            label = "image-0";
            reg = <0x30000 0xE4000>;
        };

        slot1_partition: partition@114000 {
            compatible = "zephyr,mapped-partition";
            label = "image-1";
            reg = <0x114000 0xE4000>;
        };

        storage_partition: partition@155000 {
            compatible = "zephyr,mapped-partition";
            label = "storage";
            reg = <0x155000 0x10000>;
        };
    };
};

Questions:

1. What does the message Firmware has been invalidated: 0xffff0000 actually indicate?
2. Is my overall NSIB + MCUboot configuration correct for NCS v3.4.0, or are there additional configuration steps required to enable a two-stage boot chain with BLE SMP FOTA?
3. Is there anything incorrect with my custom partition layout that could cause MCUboot to attempt booting from 0x10800 and 0x20800 instead of the expected application slot?

I would appreciate any clarification regarding this issue. Thank you for your support.

Best regards,
Mathiyazhagan S.