MCUboot minimal configuration

The MCUboot minimal configuration sample provides the minimal and recommended settings for MCUboot on nRF54L15 DK and nRF54H20 DK using the Zephyr’s SMP server sample, where MCUboot is configured as a sub-image.

Overview

This sample shows how to configure MCUboot for secure boot and Device Firmware Update (DFU) capabilities using the Zephyr RTOS. The MCUboot is configured to utilize hardware cryptography with the ED25519 signature. Additionally, for nRF54L15 DK Key Management Unit (KMU) for secure key storage is used. The setup uses LTO and disables non-essential functionalities to downsize the MCUboot non-volatile memory footprint.

The SMP server sample is configured to support Bluetooth® LE and shell for the MCUmgr protocol, which facilitates image management and OS commands.

To achieve minimal size, direct-xip mode can be used, though you can build the sample with the swap using move mode as well.

Requirements

The sample supports the following development kits:

Hardware platforms

PCA

Board name

Board target

nRF54LS05 DK

PCA10214

nrf54ls05dk

nrf54ls05dk/nrf54ls05b/cpuapp

nRF54L15 DK

PCA10156

nrf54l15dk

nrf54l15dk/nrf54l15/cpuapp

nRF54H20 DK

PCA10175

nrf54h20dk

nrf54h20dk/nrf54h20/cpuapp

Building and running

This sample can be found under samples/dfu/smp_svr_mini_boot in the nRF Connect SDK folder structure.

To build the sample, follow the instructions in Building an application for your preferred building environment. See also Programming an application for programming steps and Testing and optimization for general information about testing and debugging in the nRF Connect SDK.

Note

When building repository applications in the SDK repositories, building with sysbuild is enabled by default. If you work with out-of-tree freestanding applications, you need to manually pass the --sysbuild parameter to every build command or configure west to always use it.

For nRF54L15 DK, make sure you are building your project with the SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KEY_FILE Kconfig option enabled.

For direct-xip mode, you must build the sample with the SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP Kconfig option enabled. For swap using move mode, use the SB_CONFIG_MCUBOOT_MODE_SWAP_USING_MOVE Kconfig option instead.

You will notice that the size of MCUboot is significantly reduced in comparison to the default configuration.

If you are using command line, you must run the west flash --erase command to enable KMU provisioning.

Testing

After programming the device, complete the following steps to verify its functionality:

  1. Connect to the device’s serial console.

  2. Reset the device.

  3. Observe the boot logs confirming the successful start of the SMP Server application, as shown in the serial console output:

    *** Booting nRF Connect SDK v3.0.99-1d43aec8a694 ***
*** Using Zephyr OS v4.1.99-a6a46c1
[00:00:00.005,669] <inf> littlefs: FS at rram-controller@5004b000:0xc9000 is 4 0x1000-byte blocks...
[00:00:00.007,960] <inf> smp_bt_sample: Advertising successfully started
[00:00:00.007,978] <inf> smp_sample: build time: Jul  2 2025 13:59:16
uart:~$

You can now test the sample with other functionalities. For instance, you can rebuild the modified project and follow the steps on how to perform a DFU.