How to speed up the HAB on MX6?

[kaloyandimitrov]

Hi! I'm failing to achieve acceptable authentication times with HAB on MX6DL.

Here's the code execution sequence:

- Startup code (both I- and D-caches on, MMU off, other stuff) in NOR flash.

- First executed module is the boostrap (BS) in NOR flash. It is authenticated by the automatically executed HAB (by hardware). BS is about 64kB in size.

- After the BS is validated and executed, it starts validation of the bootloader (BL) by calling the ROM HAB API manually.

BL is about 384 kB in size.

While the authentication time of the BS is directly proportional to its size, the manual authentication of the BL appears to

be irrelevant to the size of the BL (tried with different BL sizes, the measured time is same in all cases)!

Also, the time of 'automatic' HAB authentication seems quite unsatisfactory.

So, what could be done to speed the HAB up?

[Yuri]

Hello,

  There are the following fuses for HAB acceleration :

BT_MMU_DISABLE (BOOT_CFG3[6])
L1 I-Cache DISABLE (BOOT_CFG3[7])

By default they are configured for maximum performance, therefore
it may be recommended do not re-configure MMU in customer’s bootloaders.

  Another option : please check CAAM RNG configuration, using section

3.3.2 (RNG Trim fuses) of app note AN4581 (Secure Boot on i.MX50, i.MX53, and

i.MX 6 Series using HABv4).

http://www.nxp.com/files/32bit/doc/app_note/AN4581.pdf

Typical HAB time is 25 ms.

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[kaloyandimitrov]

Hello Yuri,

Can You elaborate a little bit what about those 25ms - how they are measured: I mean what HW configuration and image size?

I'm more curious about the second case - a 'manual' authentication (explicit call to authenticate_image() ROM API).

The problem is: when I call authenticate_image(), I measure 230ms execution time and that time does not depend on the image size! I've made a lot of trials with a lot of different images (in size), and the measured time is constant!

(I call the authenticate_image(), after the automatic HAB authentication is completed).

Why there is such huge performance difference between the 'automatic' HAB authentication and the 'manual' authentication?

[Yuri]

Hello,

    Some details of HAB cannot discussed  in public anyway,

this requires to be handled as a Service Request.

How to submit a new question for NXP Support

Regards,

Yuri