applications: nrf_desktop: Disable RWX for MCUboot on nRF54L SoCs

MarekPieta · rlubos · commit e795138a6e5a · 2026-05-26T14:48:04.000+02:00
Use CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX instead of CONFIG_FPROTECT to
improve protection of the MCUboot immutable bootloader code.

Jira: NCSDK-39101

Signed-off-by: Marek Pieta &lt;Marek.Pieta@nordicsemi.no&gt;
Signed-off-by: Pekka Niskanen &lt;pekka.niskanen@nordicsemi.no&gt;
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release_fast_pair.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release_fast_pair.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release_keyboard.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l05_cpuapp/images/mcuboot/prj_release_keyboard.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_fast_pair.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_fast_pair.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_keyboard.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_keyboard.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l10_cpuapp/images/mcuboot/prj_release.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_fast_pair.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_fast_pair.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_keyboard.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_keyboard.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/images/mcuboot/prj_release.conf
@@ -13,7 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_llvm.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_llvm.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_ram_load.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_ram_load.conf
@@ -14,6 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Enable retained memory and retention to support the MCUboot RAM load mode.
 CONFIG_RETAINED_MEM=y
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_release.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_release_ram_load.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20a_cpuapp/images/mcuboot/prj_release_ram_load.conf
@@ -14,6 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Enable retained memory and retention to support the MCUboot RAM load mode.
 CONFIG_RETAINED_MEM=y
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_llvm.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_llvm.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Reduce memory consumption
 CONFIG_BOOT_BANNER=n
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_ram_load.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_ram_load.conf
@@ -14,6 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Enable retained memory and retention to support the MCUboot RAM load mode.
 CONFIG_RETAINED_MEM=y
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_release.conf
@@ -13,6 +13,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_release_ram_load.conf b/applications/nrf_desktop/configuration/nrf54lm20dk_nrf54lm20b_cpuapp/images/mcuboot/prj_release_ram_load.conf
@@ -14,6 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 # Enable retained memory and retention to support the MCUboot RAM load mode.
 CONFIG_RETAINED_MEM=y
diff --git a/applications/nrf_desktop/configuration/nrf54ls05dk_nrf54ls05b_cpuapp/images/mcuboot/prj_release.conf b/applications/nrf_desktop/configuration/nrf54ls05dk_nrf54ls05b_cpuapp/images/mcuboot/prj_release.conf
@@ -14,7 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=n
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/applications/nrf_desktop/configuration/nrf54ls05dk_nrf54ls05b_cpuapp/images/mcuboot/prj_release_keyboard.conf b/applications/nrf_desktop/configuration/nrf54ls05dk_nrf54ls05b_cpuapp/images/mcuboot/prj_release_keyboard.conf
@@ -14,7 +14,7 @@ CONFIG_BOOT_BOOTSTRAP=n
 CONFIG_BOOT_VERSION_CMP_USE_BUILD_NUMBER=y
 
 CONFIG_FLASH=y
-CONFIG_FPROTECT=n
+CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX=y
 
 CONFIG_RESET_ON_FATAL_ERROR=y
 
diff --git a/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst b/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst
@@ -279,7 +279,9 @@ nRF Audio (formerly nRF5340 Audio)
 nRF Desktop
 -----------
 
-|no_changes_yet_note|
+* Updated application configurations to change the non-volatile memory self-protection mechanism in the MCUboot image on the nRF54L board targets (:kconfig:option:`CONFIG_SOC_SERIES_NRF54L`).
+  The :kconfig:option:`CONFIG_NCS_MCUBOOT_DISABLE_SELF_RWX` Kconfig option is used instead of the :kconfig:option:`CONFIG_FPROTECT` to disable read, write and execute from the memory area that holds the MCUboot bootloader.
+  This is done to improve the protection of the MCUboot immutable bootloader code.
 
 nRF Machine Learning (Edge Impulse)
 -----------------------------------
