Zephyr: introduce bootloader requests #477

tomchy · 2025-07-24T12:39:20Z

In some cases, a Zephyr platform is not able to use the RAM-based retention subsystem. This results in no ability to communicate with the bootloader to:

Request the recovery mode from the main application
Request the firmware loader mode from the main application

The other case in which the application wants to communicate with the bootloader are platforms that want to have the active slot configured as read-only. In such case, the following flow can be introduced to mitigate this restriction:

The main application sends a request to the bootloader informing which image should be confirmed.
The main application reboots the device.
The device reboots and resets memory permissions so that the bootloader can perform the updates.
In the permitted state, the bootloader processes the confirmation requests, before analyzing the state of the slots.
The bootloader continues the logic as if the application had confirmed the slot.

There is also a third use case for the application requests in the Direct XIP mode:

Currently, the decision of which slot to boot is based only on the version number.
Even if there are two valid slots on the device, a user cannot request a temporary rollback to the previous firmware.
By introducing a request for slot preference, the slot selection logic may be extended with custom logic that runs as part of the main application and sends such a request to the bootloader to alter the default behavior.

This PR introduces an API that can be used to collect all of the above requests in a single module.
The Kconfig to select or extend the boot request format is located in the configuration file of the mcuboot module in the Zephyr repository.
In addition, a simple integration with bootutil library is included, allowing this feature to be used with an existing MCUmgr implementation.

boot/bootutil/zephyr/include/boot_request/boot_request.h

boot/bootutil/zephyr/src/boot_request_retention.c

boot/zephyr/CMakeLists.txt

boot/bootutil/zephyr/src/boot_request_retention.c

boot/bootutil/src/bootutil_public.c

nordicjm · 2025-08-01T08:39:00Z

boot/bootutil/include/bootutil/boot_request.h

+/**
+ * @brief Request a bootloader to boot recovery image.
+ *
+ * @return 0 if requested, negative error code otherwise.
+ */
+int boot_request_enter_recovery(void);
+
+/**
+ * @brief Request a bootloader to boot firmware loader image.
+ *
+ * @return 0 if requested, negative error code otherwise.
+ */
+int boot_request_enter_firmware_loader(void);


can both be combined into boot_request_enter_recovery there is either serial recovery or firmware loader, not both

I do not really like to enter firmware loader by calling boot_request_enter_recovery API.

nordicjm · 2025-08-01T08:39:21Z

boot/bootutil/include/bootutil/boot_request.h

+/**
+ * @brief Check if there is a request to boot recovery image.
+ *
+ * @return true if requested, false otherwise.
+ */
+bool boot_request_detect_recovery(void);
+
+/**
+ * @brief Check if there is a request to boot firmware loader image.
+ *
+ * @return true if requested, false otherwise.
+ */
+bool boot_request_detect_firmware_loader(void);


boot/bootutil/zephyr/src/boot_request_retention.c

nordicjm · 2025-08-01T08:40:50Z

boot/bootutil/zephyr/src/boot_request_retention.c

+
+enum boot_request_type {
+    /** Invalid request. */
+    BOOT_REQUEST_INVALID = 0,


nit. enums start at 0 and count up anyway, the values don't need to be explicitly set

I prefer to keep explicit values in enums if they define a value, that is shared between two contexts (app and bl), even if they follow the "automatic" assignment.

nordicjm · 2025-08-01T08:41:53Z

boot/bootutil/zephyr/src/boot_request_retention.c

+        *slot = 0;
+        break;
+    case BOOT_REQUEST_IMG_PREFERENCE:
+        *slot = 1 + image * BOOT_REQUEST_PER_IMAGE;
+        break;
+    case BOOT_REQUEST_IMG_CONFIRM:
+        *slot = 2 + image * BOOT_REQUEST_PER_IMAGE;


use enum for what these values mean, can actually then have a _COUNT in the enum and use that for the number of states instead of just defining to 2 separately

boot/bootutil/zephyr/src/boot_request_retention.c

nordicjm · 2025-08-01T08:43:18Z

boot/bootutil/zephyr/src/boot_request_retention.c

+    case 0:
+        value = BOOT_REQUEST_SLOT_PRIMARY;
+        break;
+    case 1:
+        value = BOOT_REQUEST_SLOT_SECONDARY;
+        break;


nordicjm · 2025-08-01T08:43:41Z

boot/bootutil/zephyr/src/boot_request_retention.c

+    case 0:
+        value = BOOT_REQUEST_SLOT_PRIMARY;
+        break;
+    case 1:
+        value = BOOT_REQUEST_SLOT_SECONDARY;
+        break;


and further below

boot/zephyr/Kconfig

nvlsianpu · 2025-08-01T09:53:41Z

boot/bootutil/zephyr/src/boot_request_retention.c

+ * @return 0 on success; nonzero on failure.
+ */
+static int
+boot_request_slot_find(enum boot_request_type type, boot_request_img_t image, size_t *slot)


slot term is used for image partitions in MCUboot.
Can we have different name there - index, reqest_idx, req_idx, entry_idx?
And so one for any code related to request entries?

Decided to go with the entry name instead.

boot/bootutil/zephyr/src/boot_request_retention.c

boot/zephyr/Kconfig

boot/zephyr/Kconfig.firmware_loader

boot/zephyr/Kconfig.serial_recovery

nvlsianpu · 2025-08-01T10:18:28Z

boot/bootutil/src/bootutil_public.c

just wonder whether flash_area_to_image() -> flash_area_to_image() can more associated with a upstream patch?

Yet I do not have an argument, why this change is needed there...

Add a bootloader hook to alter the logic of the active slot selection in Direct XIP modes. Signed-off-by: Tomasz Chyrowicz <[email protected]> (cherry picked from commit 7c4ec9a)

Add a Kconfig option to enable a bootloader hook to alter the logic of the active slot selection in Direct XIP modes. Signed-off-by: Tomasz Chyrowicz <[email protected]> (cherry picked from commit d5f84b4)

Add a capability inside the Zephyr bootloader to handle memory-based bootloader requests to: - Boot recovery firmware - Boot firmware loader - Confirm an image - Set the slot preference Ref: NCSDK-34429 Signed-off-by: Tomasz Chyrowicz <[email protected]>

sonarqubecloud · 2025-08-18T08:08:48Z

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.6% Duplication on New Code

See analysis details on SonarQube Cloud

NordicBuilder mentioned this pull request Jul 24, 2025

samples: Add sample to verify bootloader requests nrfconnect/sdk-nrf#23452

Open

ahasztag reviewed Jul 25, 2025

View reviewed changes

boot/bootutil/zephyr/include/boot_request/boot_request.h Outdated Show resolved Hide resolved

boot/bootutil/zephyr/include/boot_request/boot_request.h Outdated Show resolved Hide resolved

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from 832b4c9 to ce1a921 Compare July 25, 2025 12:15

tomchy requested a review from ahasztag July 25, 2025 12:23

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from ce1a921 to f6f21a3 Compare July 28, 2025 10:50

tomchy marked this pull request as ready for review July 28, 2025 11:07

tomchy requested review from nordicjm and de-nordic as code owners July 28, 2025 11:07

nordicjm requested changes Jul 28, 2025

View reviewed changes

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from f6f21a3 to 0b5d331 Compare July 28, 2025 14:30

tomchy requested a review from nordicjm July 28, 2025 14:34

ahasztag requested changes Jul 29, 2025

View reviewed changes

boot/bootutil/zephyr/src/boot_request_retention.c Outdated Show resolved Hide resolved

ahasztag reviewed Jul 29, 2025

View reviewed changes

boot/bootutil/src/bootutil_public.c Outdated Show resolved Hide resolved

boot/bootutil/src/bootutil_public.c Outdated Show resolved Hide resolved

boot/bootutil/src/bootutil_public.c Outdated Show resolved Hide resolved

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from 0b5d331 to 911bb8c Compare July 29, 2025 09:38

tomchy requested a review from ahasztag July 29, 2025 09:38

ahasztag reviewed Jul 29, 2025

View reviewed changes

boot/bootutil/src/bootutil_public.c Outdated Show resolved Hide resolved

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from 911bb8c to 2be0d3d Compare July 29, 2025 10:31

tomchy requested a review from ahasztag July 29, 2025 10:35

ahasztag approved these changes Jul 29, 2025

View reviewed changes

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch 3 times, most recently from 4e1ece5 to 9be377a Compare July 31, 2025 14:48

nordicjm reviewed Aug 1, 2025

View reviewed changes

nvlsianpu reviewed Aug 1, 2025

View reviewed changes

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch 2 times, most recently from ad1c9eb to dc8f8c6 Compare August 1, 2025 11:14

tomchy requested review from nordicjm and nvlsianpu August 1, 2025 11:21

rlubos force-pushed the main branch from 4e48cbd to d69621e Compare August 1, 2025 13:56

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from dc8f8c6 to cb3eee7 Compare August 1, 2025 14:16

tomchy force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from cb3eee7 to 0ac02e0 Compare August 1, 2025 15:19

tomchy added 2 commits August 18, 2025 08:58

[nrf fromtree] loader: Add boot hook for slot selection

a26d01e

Add a bootloader hook to alter the logic of the active slot selection in Direct XIP modes. Signed-off-by: Tomasz Chyrowicz <[email protected]> (cherry picked from commit 7c4ec9a)

[nrf fromtree] zephyr: Add support for slot selection boot hook

1fae83e

Add a Kconfig option to enable a bootloader hook to alter the logic of the active slot selection in Direct XIP modes. Signed-off-by: Tomasz Chyrowicz <[email protected]> (cherry picked from commit d5f84b4)

ahasztag force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from 0ac02e0 to 8e08f2f Compare August 18, 2025 06:59

ahasztag force-pushed the feature/zephyr/NCSDK-NONE_boot_requests_nrf branch from 8e08f2f to 17ac549 Compare August 18, 2025 08:07

Zephyr: introduce bootloader requests #477

Are you sure you want to change the base?

Zephyr: introduce bootloader requests #477

Uh oh!

Conversation

tomchy commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nordicjm Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomchy Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Aug 18, 2025

Quality Gate passed

Uh oh!

Uh oh!

tomchy commented Jul 24, 2025 •

edited

Loading

nordicjm Aug 1, 2025 •

edited

Loading

tomchy Aug 1, 2025 •

edited

Loading