bootutil: Add manifest-based loader for Direct XIP #2511

tomchy · 2025-10-21T13:00:31Z

Add a loader variant that is capable of booting images, based on a simple manifest.

Ideas:

The 1st Image (slot pair) is the main/lead image - it describes firmware bundle for the device. This image is manifest Image.
The firmware bundle description is provided in the protected TLV of the manifest image. Images relations are expressed as their hashes. Obviously hash of the manifest image is not in the TLV as it covers it as well.

boot/zephyr/Kconfig

boot/bootutil/src/loader_manifest_xip_ram.c

JarmouniA

Can we have some documentation for this feature? Thanks!

Add a possibility to attach a basic manifest with expected digests to an image. Alter the image verification logic, so only digests specified by the manifest are allowed on the device. Signed-off-by: Tomasz Chyrowicz <[email protected]>

Add a simple logic that allows to attach a manifest TLV to an image. Signed-off-by: Tomasz Chyrowicz <[email protected]>

Add a loader variant that is capable of booting images, based on a simple manifest. Signed-off-by: Tomasz Chyrowicz <[email protected]>

de-nordic · 2025-10-28T16:22:25Z

boot/bootutil/include/bootutil/mcuboot_manifest.h

+        return false;
+    }
+
+    if (manifest->image_count != BOOT_IMAGE_NUMBER - 1) {


() around arithmetic.

tomchy · 2025-10-31T12:30:59Z

boot/bootutil/src/loader_manifest_xip.c

+ * @return              0 on success; nonzero on failure.
+ */
+static int
+boot_select_or_erase(struct boot_loader_state *state)


TODO: This should be executed only on the manifest image. If a manifest image is erased/not present, all other images will be rejected on the digest check.

de-nordic · 2025-10-31T15:04:00Z

boot/bootutil/include/bootutil/mcuboot_manifest.h

+static inline const uint8_t *bootutil_get_image_hash(const struct mcuboot_manifest *manifest,
+                                                     uint32_t image_index)
+{
+    if (!bootutil_verify_manifest(manifest)) {
+        return NULL;
+    }
+
+    if (image_index >= BOOT_IMAGE_NUMBER) {
+        return NULL;
+    }
+
+    if (image_index < MCUBOOT_MANIFEST_IMAGE_NUMBER) {
+        return manifest->image_hash[image_index];
+    } else if (image_index > MCUBOOT_MANIFEST_IMAGE_NUMBER) {
+        return manifest->image_hash[image_index - 1];
+    }
+
+    return NULL;
+}


I am not sure this should be able to return NULL in any case.
This should panic on any parameter that is not expected.
Since the function is always called before boot_fih_memequal I think that both functions should be merged and the bootutil_get_image_hash should be changed to FIH return function that will be given enough parameter to compare a hash without pulling it out of the manifest object.
This should also reduce code size, since the boot_fih_memequal and will be combined here and no need for external null checks.

de-nordic · 2025-10-31T15:09:10Z

boot/bootutil/src/bootutil_priv.h

+
+#if defined(MCUBOOT_MANIFEST_UPDATES)
+    struct mcuboot_manifest manifest[BOOT_NUM_SLOTS];
+    bool manifest_valid[BOOT_NUM_SLOTS];


Can we move that into the mcuboot_manifest? We can have different structs for TLV and internal usage.

de-nordic · 2025-10-31T15:11:50Z

boot/bootutil/src/image_validate.c

+            if (image_index == MCUBOOT_MANIFEST_IMAGE_NUMBER) {
+                if (!state->manifest_valid[slot]) {
+                    /* Manifest TLV must be processed before any of the image's hash TLV. */
+                    BOOT_LOG_INF("bootutil_img_validate: image rejected, manifest not found before image %d hash",


Isn't that at least warning? It ends up in rc = -1, so basically fails the function.

de-nordic · 2025-10-31T15:13:57Z

boot/bootutil/src/image_validate.c

+
+            /* No matching manifest found. */
+            if (state->matching_manifest[image_index][slot] == BOOT_SLOT_NONE) {
+                BOOT_LOG_INF("bootutil_img_validate: image rejected, no valid manifest for image %d slot %d",


This is either warning or error, we are failing function here.

de-nordic · 2025-10-31T15:16:06Z

boot/bootutil/src/loader_manifest_xip.c

+{
+    uint32_t active_slot;
+
+    (void)state;


Seems to be used.

de-nordic · 2025-10-31T15:16:47Z

boot/bootutil/src/loader_manifest_xip.c

+            active_slot = find_slot_with_highest_version(state);
+        }
+        if (active_slot == BOOT_SLOT_NONE) {
+            BOOT_LOG_INF("No more manifest slots available");


de-nordic · 2025-10-31T15:19:10Z

boot/bootutil/src/loader_manifest_xip.c

+
+        /* Check headers in all slots */
+        for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
+            hdr = boot_img_hdr(state, slot);


Can be moved into if under 231, there is only usage of this.

de-nordic · 2025-10-31T15:21:30Z

boot/bootutil/src/image_validate.c


+#ifdef MCUBOOT_MANIFEST_UPDATES
+    if (image_index == MCUBOOT_MANIFEST_IMAGE_NUMBER && (!manifest_found || !manifest_valid)) {
+        BOOT_LOG_INF("bootutil_img_validate: slot %d rejected, manifest missing or invalid", slot);


Isn't this error?

tomchy force-pushed the feature/mcuboot/NCSDK-NONE_Transaction_manifest_xip_upstream branch 3 times, most recently from 6ebfcaf to aaf2a5a Compare October 21, 2025 14:10

tomchy commented Oct 22, 2025

View reviewed changes

boot/zephyr/Kconfig Show resolved Hide resolved

tomchy commented Oct 22, 2025

View reviewed changes

boot/bootutil/src/loader_manifest_xip_ram.c Outdated Show resolved Hide resolved

tomchy force-pushed the feature/mcuboot/NCSDK-NONE_Transaction_manifest_xip_upstream branch from aaf2a5a to d8e62ff Compare October 22, 2025 09:00

tomchy marked this pull request as ready for review October 22, 2025 15:13

tomchy requested review from almir-okato, d3zd3z, davidvincze, de-nordic and nordicjm as code owners October 22, 2025 15:13

tomchy force-pushed the feature/mcuboot/NCSDK-NONE_Transaction_manifest_xip_upstream branch from d8e62ff to 3688d72 Compare October 23, 2025 12:07

JarmouniA reviewed Oct 23, 2025

View reviewed changes

tomchy added 3 commits October 24, 2025 11:02

boot: Add MCUboot manifest TLV

af4fc45

Add a possibility to attach a basic manifest with expected digests to an image. Alter the image verification logic, so only digests specified by the manifest are allowed on the device. Signed-off-by: Tomasz Chyrowicz <[email protected]>

imgtool: Add a possibility to attach manifest TLV

8b60261

Add a simple logic that allows to attach a manifest TLV to an image. Signed-off-by: Tomasz Chyrowicz <[email protected]>

bootutil: Add manifest-based loader for Direct XIP

8eca34c

Add a loader variant that is capable of booting images, based on a simple manifest. Signed-off-by: Tomasz Chyrowicz <[email protected]>

tomchy force-pushed the feature/mcuboot/NCSDK-NONE_Transaction_manifest_xip_upstream branch from 3688d72 to 8eca34c Compare October 24, 2025 09:02

michalek-no approved these changes Oct 24, 2025

View reviewed changes

de-nordic reviewed Oct 28, 2025

View reviewed changes

tomchy commented Oct 31, 2025

View reviewed changes

de-nordic requested changes Oct 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

bootutil: Add manifest-based loader for Direct XIP #2511

bootutil: Add manifest-based loader for Direct XIP #2511

tomchy commented Oct 21, 2025 •

edited by nvlsianpu

Loading

Uh oh!

Uh oh!

Uh oh!

JarmouniA left a comment

Uh oh!

de-nordic Oct 28, 2025

Uh oh!

tomchy Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

de-nordic Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bootutil: Add manifest-based loader for Direct XIP #2511

Are you sure you want to change the base?

bootutil: Add manifest-based loader for Direct XIP #2511

Conversation

tomchy commented Oct 21, 2025 • edited by nvlsianpu Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JarmouniA left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tomchy commented Oct 21, 2025 •

edited by nvlsianpu

Loading