Using MCUboot in nRF Connect SDK

The nRF Connect SDK includes MCUboot-specific integration files located in the modules/mcuboot subfolder in the sdk-nrf repository.

You can use MCUboot in the nRF Connect SDK in one of the following roles:

• As an Immutable first-stage bootloader that can perform device firmware updates (DFU) to the application. Enable SB_CONFIG_BOOTLOADER_MCUBOOT in sysbuild to use it in this role.

• As an Second-stage upgradable bootloader that can perform device firmware updates to both itself and the application. Enable both SB_CONFIG_BOOTLOADER_MCUBOOT and SB_CONFIG_SECURE_BOOT_APPCORE in sysbuild to use it in this role.

See the following user guides for more information on adding, configuring, and testing MCUboot for your application build in the nRF Connect SDK:

• Secure bootloader chain

• Enabling a bootloader chain using sysbuild

• MCUboot and NSIB

• Partitioning device memory

• Customizing the bootloader

• Signature keys

When you add MCUboot to your application build, the nRF Connect SDK build system will automatically generate files that you can use for firmware upgrades (DFU or FOTA). See the MCUboot output build files page for a list of all these files.

Using MCUboot in the direct-xip mode

When you use MCUboot in the direct-xip mode, enable the SB_CONFIG_MCUBOOT_BUILD_DIRECT_XIP_VARIANT sysbuild Kconfig option to let the build system generate an additional set of files for the second application slot. For platforms other than nRF54H20, these files are identical to those listed on the MCUboot output build files page. However, they are placed in the mcuboot_secondary_app folder for the main application, while the files for the remaining applications are located in their respective <application>_secondary_app folders. For example, the mcuboot_secondary_app/zephyr/zephyr.signed.bin file is created and placed in the second slot on the target device when the zephyr.signed.bin file is placed in the first slot. Similarly, the ipc_radio_secondary_app/zephyr/zephyr.signed.bin file is created and placed in the second slot on the target device when the ipc_radio/zephyr/zephyr.signed.bin file is placed in the first slot.

For the nRF54H20 SoC, the merged-slot variant is used, in which the application and radio core images are merged into a single image. In this case, the update files are located in the common zephyr directory, rather than within any specific application folder. The file used for the primary application is zephyr.signed.bin, while the file used for the secondary application is zephyr_secondary_app.signed.bin.

For more information about the direct-xip mode, see the Equal slots (direct-xip) section in the Bootloader documentation.