MCUboot: BOOT_IMAGE_ACCESS_HOOK_NRF5340 enabled by default

[floorchuck]

Hi everyone,

We are using the nRF52840 and nRF54L15 in our designs. We want to perform board validation before an image swap in MCUboot to ensure that the incoming image was compiled for our specific configuration.

To achieve this, we want to use image access hooks. However, we noticed an issue in the Kconfig file located at mcuboot/boot/zephyr:

config BOOT_IMAGE_ACCESS_HOOK_NRF5340
	bool "Enable default nRF5340 hook"
	default y if BOOT_IMAGE_ACCESS_HOOKS
	depends on BOOT_IMAGE_ACCESS_HOOKS

Because BOOT_IMAGE_ACCESS_HOOKS_NRF5340 defaults to y when BOOT_IMAGE_ACCESS_HOOKS is enabled, it automatically pulls in an nRF5340-specific configuration. This forces us to manually disable a completely unrelated option (CONFIG_BOOT_IMAGE_ACCESS_HOOKS_NRF5340=n) in our nRF52840 and nRF54L15 projects.

My question is: is this default behavior intended, or is it a bug in the Kconfig dependencies?

Best regards,
Mikołaj

[Amanda Hsieh]

Hi Mikołaj,

We want to perform board validation before an image swap in MCUboot to ensure that the incoming image was compiled for our specific configuration.

MCUboot always validates the image (hash/signature) before swapping. It does not have a built-in “board health check” hook for board/product-specific rules you add hooks or image-matching config. I recommend you use SIGNATURE_KEY to control the update package for the boards. 

In NCS Kconfig, hooks are auto-enabled only on the nRF5340 application core when a network-core image is part of the MCUboot update. For typical MCUboot DFU on nRF52840 and nRF54L15, you do not need CONFIG_BOOT_IMAGE_ACCESS_HOOKS.

Regards,
Amanda H.