Timeout exit from the boot loader

RE: Timeout exit from the boot loader

Vidar Berg — Mon, 19 Jan 2026 08:51:46 GMT

I agree with your points. In case you didn't see it, I updated my previous about WDT setup in bootloader already being supported in upstream mcuboot which should be included in our next SDK release.

RE: Timeout exit from the boot loader

nick_bike — Mon, 19 Jan 2026 08:45:42 GMT

The scenario is where the device is in the hands of an end customer and they have limited ability to troubleshoot or do anything technical. When enough devices are manufactured, all possible error states do occur.

If the end customer has managed to get the device into a dead-end state (e.g. reset while holding the recovery button, with a USB plugged in, which has been observed to half-trigger the DFU.) it needs to recover in the most sensible way.

I think being able to enable the watchdog from mcuboot Kconfig flags (and set the timeout) is the most sensible approach that solves requirements for a number of different cases, and also being able to choose whether mcuboot feeds the watchdog, or not. This would allow the device to reset if mcuboot ended up waiting for DFU bytes forever. It also protects against other unforseen future niche bugs with mcuboot.

EDIT: Noted that a WD update has been created. We'll integrate this once it reaches the nrf SDK.

RE: Timeout exit from the boot loader

Vidar Berg — Mon, 19 Jan 2026 08:31:52 GMT

Thank you for the update. I will report this internally for review and to (re)consider what the expected behavior should be. I think it makes sense to fall back to the application, or at least provide the option to do so, even in cases where serial recovery mode has been entered but then stopped (for example with an inactivity timer). Allowing the WD to be started from the bootloader could also be something to consider.

EDIT: I see someone already contributed a solution for setting up the WD in the bootloader here: https://github.com/mcu-tools/mcuboot/pull/2566/commits

RE: Timeout exit from the boot loader

nick_bike — Sat, 17 Jan 2026 09:28:01 GMT

I have reviewed the main.c code and it appears (interestingly) that CONFIG_BOOT_USB_DFU_WAIT is being used in two ways.

1. If CONFIG_BOOT_USB_DFU_GPIO=n

Pin DFU is not used - so, enters DFU mode for the duration of CONFIG_BOOT_USB_DFU_WAIT_DELAY_MS.

2. If CONFIG_BOOT_USB_DFU_GPIO=y along with CONFIG_BOOT_USB_DFU_WAIT=y

mcuboot does NOT enter DFU automatically. The CONFIG_BOOT_USB_DFU_GPIO rule changes the operation of CONFIG_BOOT_USB_DFU_WAIT. DFU is only entered if the DFU pin is active. DFU times out after CONFIG_BOOT_USB_DFU_WAIT_DELAY_MS.

My observation is that DFU boot never exits if DFU has been started in any way, including error bytes being written into the serial RX. I will look ito enabling the watchdog in mcuboot.

RE: Timeout exit from the boot loader

Vidar Berg — Mon, 12 Jan 2026 13:50:23 GMT

Looking at this commit it looks like it should be possible already to have it timeout automatically: https://github.com/mcu-tools/mcuboot/pull/2277/commits/ab2d7bc44f3b658f870f2a93bef58e6f59bf6872 if you use CONFIG_BOOT_USB_DFU_GPIO together with CONFIG_BOOT_USB_DFU_WAIT. Are you using CONFIG_BOOT_USB_DFU_GPIO as your entry method?

RE: Timeout exit from the boot loader

nick_bike — Sat, 10 Jan 2026 19:43:48 GMT

I'd like to +1 this functionality. We have a product with a permanently installed battery. We want mcuboot serial recovery via USB (ACM) when a button is pushed;but, if a user accidentally presses that button on turn on, mcuboot sits there forever waiting for a command. We're up for creative ideas, such as having a global watchdog of maybe 2 minutes, and not feeding the watchdog from mcuboot - which in our understanding would force a reboot and allow up to 2 minutes for a device recovery, which seems sufficient.

Thanks!

RE: Timeout exit from the boot loader

Vidar Berg — Thu, 03 Apr 2025 06:49:41 GMT

Possible options that come to mind:

1. Create a patch file that you apply that you and your coworkers can apply to the SDK during installation

2. Submit a PR to propose your change at https://github.com/mcu-tools/mcuboot

3. Create a workspace application that includes a fork of the https://github.com/nrfconnect/sdk-mcuboot repository (see Forking a repository of the nRF Connect SDK).

RE: Timeout exit from the boot loader

DX_HK — Wed, 02 Apr 2025 09:29:35 GMT

Thank you. I have performed a test implementation and it is working properly.

This bootloader timeout feature seems more commonly needed.
This time, I customized the bootloader, but customization by general users is not a good thing.
I think such basic functions should be selectable without modifying the code.

What should we do if multiple people are developing this custom bootloader?
Specifically, there are several engineers in the company who develop using Zephyr, and the bootloader should be common, so this change should be synchronized via git (github).

For example, would it be possible for us to create a fork of NCS and use that instead of the nordic repository?

RE: Timeout exit from the boot loader

Vidar Berg — Tue, 01 Apr 2025 12:22:50 GMT

I would start by just making changes directly to the main.c file for the bootloader in the SDK tree /v2.8.0/bootloader/mcuboot/boot/zephyr/ to verify that your changes work. You can then decide how you want to include these changes into your project setup.

RE: Timeout exit from the boot loader

DX_HK — Tue, 01 Apr 2025 11:14:30 GMT

The bootloader is provided by NCS.
I don't think it's that difficult to customize the code,
but if I want to customize NCS, how should I change it?

RE: Timeout exit from the boot loader

Vidar Berg — Thu, 27 Mar 2025 12:42:06 GMT

It is possible, but this is also something that will require customization of the bootloader.

RE: Timeout exit from the boot loader

DX_HK — Thu, 27 Mar 2025 07:06:01 GMT

Is there a way to exit mcuboot using a button (not the reset button)?

RE: Timeout exit from the boot loader

Vidar Berg — Thu, 27 Mar 2025 06:07:08 GMT

CONFIG_BOOT_SERIAL_WAIT_FOR_DFU_TIMEOUT only works in conjunction with CONFIG_BOOT_SERIAL_WAIT_FOR_DFU. If you want the same timeout for other entry methods you will need to modify the bootloader.

RE: Timeout exit from the boot loader

DX_HK — Wed, 26 Mar 2025 08:48:53 GMT

After the bootloader starts, if no operations are performed for, say, one minute, is it possible to start an application?

RE: Timeout exit from the boot loader

DX_HK — Fri, 21 Mar 2025 08:10:02 GMT

The bootloader is starting fine.

If no bootloader operation is performed by mcumgr for a certain period of time, I want to terminate the bootloader and start an application.

RE: Timeout exit from the boot loader

Vidar Berg — Fri, 21 Mar 2025 07:45:14 GMT

Then you need to select CONFIG_BOOT_SERIAL_BOOT_MODE and CONFIG_RETENTION_BOOT_MODE

instead of CONFIG_BOOT_SERIAL_WAIT_FOR_DFU in your bootloader as explained here: https://docs.zephyrproject.org/latest/services/retention/index.html#boot-mode

The bootloader is always executed first in the boot sequence, but bootmode_set() can be used to signal to the bootloader on next boot whether it should enter serial recovery (DFU) mode or proceed to boot the application.

RE: Timeout exit from the boot loader

DX_HK — Fri, 21 Mar 2025 07:02:45 GMT

No, I don't want the bootloader to start during normal boot.

In other words, the bootloader will only start with
bootmode_set(BOOT_MODE_TYPE_BOOTLOADER);

RE: Timeout exit from the boot loader

Vidar Berg — Fri, 21 Mar 2025 06:31:53 GMT

Hello,

Please correct me if I'm wrong, but is my understanding correct that you're fine with the bootloader always enter serial recovery mode on startup, but you prefer not to expose any mcumgr commands in the application?

Thanks,

Vidar