Bootloaders

The bootloader is a firmware image that is responsible for booting the application. The bootloader chooses an application firmware image to boot and verifies it to ensure validity. The image validation can be used to ensure chain of trust.

Using a bootloader is closely related to device firmware update (DFU).

There are two types of bootloaders used by the nRF Connect SDK:

• Immutable first-stage bootloaders that cannot be upgraded through DFU and run after each reset.

• Upgradable second-stage bootloaders that can perform DFU to both themselves and the application, and are booted by the first-stage bootloader.

You can use a second-stage bootloader only in combination with a first-stage one. Also, not all bootloaders supported by the nRF Connect SDK can be used as either first-stage or second-stage ones. You can find an overview of currently supported bootloaders in the table below:

Bootloaders supported by nRF Connect SDK

Bootloader	Can be first-stage	Can be second-stage	Key type support	Public key revocation	SMP updates by the application	Downgrade protection	Versioning	Update methods (supported by nRF Connect SDK)
nRF Secure Immutable Bootloader	Yes	No	See list	Yes	No	Yes	Monotonic (HW)	Dual-slot direct-xip
MCUboot	Yes	Yes	See imgtool	No	Yes	Yes	Monotonic (HW), Semantic (SW)	Image swap - single primary Dual-slot direct-xip

See the following user guides to learn more:

Subpages:

• Secure bootloader chain
  • Chain of trust
  • Architecture
• Adding a bootloader chain
  • Adding an immutable bootloader
  • Adding an upgradable bootloader
• Testing the bootloader chain
• Using external flash memory partitions
  • Troubleshooting
• Customizing the bootloader
  • Using custom project configurations
  • Assigning Kconfig fragments
  • Customizing partitions
• Signature keys
  • Generating private keys
  • Using development keys
  • Revoking private keys
• Downgrade protection
  • Software-based downgrade protection
  • Hardware-based downgrade protection