Reducing startup time with MCUBoot in nRF Desktop

[nrbrook]

I am building a firmware based on nRF Desktop, but can reproduce the issue in nRF Desktop SDK 2.9.0. The issue is that MCUBoot takes almost 1s to start the app, even with RC oscillator LF clock source and with slot0 validation disabled.

To reproduce the issue:

• Modify the nRF52840dk_nrf52840 configuration:
  • To images/mcuboot/prj_fast_pair.conf add:
    

    CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y
    CONFIG_BOOT_VALIDATE_SLOT0=n

  • To prj_fast_pair.conf add:
    

    CONFIG_CAF_POWER_MANAGER_TIMEOUT=20
    CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y

  • To prj.conf add:
    

    CONFIG_CAF_POWER_MANAGER_TIMEOUT=20
    CONFIG_CLOCK_CONTROL_NRF_K32SRC_RC=y

• Modify main.c:
  

  #include <app_event_manager.h>
  
  #define MODULE main
  #include <caf/events/module_state_event.h>
  
  #include <zephyr/logging/log.h>
  LOG_MODULE_REGISTER(MODULE);
  
  #include <zephyr/drivers/gpio.h>
  
  static const struct gpio_dt_spec led3 = GPIO_DT_SPEC_GET(DT_NODELABEL(led3), gpios);
  
  int main(void)
  {
  	gpio_pin_configure_dt(&led3, GPIO_OUTPUT_LOW);
  	if (app_event_manager_init()) {
  		LOG_ERR("Application Event Manager not initialized");
  	} else {
  		module_set_state(MODULE_STATE_READY);
  	}
  	return 0;
  }

• With the base configuration and the fast pair configuration, wait for the firmware to power down, then with a logic analyser record P.11 and P.16 and press button 1 until the LEDs light up.

With the base configuration, the delta between button press and LED3 on is about 55ms. With fast pair (MCUBoot) it is 980ms. How can startup time be reduced further when using MCUBoot? Reading other forum posts, the main culprits are usually entropy source, LF oscillator source, and image validation. However with all those modified, it is still slow, slower than should be expected.

[Amanda Hsieh]

Hi, 

Could you also add CONFIG_NRFX_CLOCK_LFXO_TWO_STAGE_ENABLED=n to images/mcuboot/prj_fast_pair.conf? Does it help?

Regards,
Amanda H.

[nrbrook]

No, it is just the same.

[Amanda Hsieh]

Could you test with nRF52840DK? We got virtually no delay between button presses and led the operation.

[nrbrook]

That is what I was testing with. With base configuration I get no delay. With fast pair I get 1s. 

[Amanda Hsieh]

Could you try the following and let me know?

--- a/applications/nrf_desktop/configuration/nrf52840dk_nrf52840/sysbuild_fast_pair.conf
+++ b/applications/nrf_desktop/configuration/nrf52840dk_nrf52840/sysbuild_fast_pair.conf
@@ -8,5 +8,6 @@
SB_CONFIG_BT_FAST_PAIR=y
SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_MCUBOOT_MODE_DIRECT_XIP=y
-SB_CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
-SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private_fast_pair.pem"
+SB_CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256=y
+SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APPLICATION_CONFIG_DIR}/images/mcuboot/mcuboot_private_ed.pem"

cp ../../nrf52840gmouse_nrf52840/images/mcuboot/mcuboot_private.pem mcuboot/mcuboot_private_ed.pem

[nrbrook]

I had to generate a key using 

python ../../../../../../../bootloader/mcuboot/scripts/imgtool.py keygen -k mcuboot_private_ed.pem -t ecdsa-p256

from the mcuboot directory, because the key you specified didn't exist.

Then it started in 120ms  – much better! But why is RSA so much slower given CONFIG_BOOT_VALIDATE_SLOT0=n

Furthermore, my real application is on nrf52832, which has smaller flash, and I recall ecdsa requires much more space in the bootloader.

[Amanda Hsieh]

52832 has no hardware crypto. Having some sort of signature is a must for you?

RSA is mbedtls which is slower than a tortoise, and ecdsa is tinycrypt.

[nrbrook]

I only want signature verification at DFU. After that, I don't need it every boot. But it seems CONFIG_BOOT_VALIDATE_SLOT0 isn't disabling it, how can it be disabled (while still validating during DFU)?

[Amanda Hsieh]

nrbrook said:

it seems CONFIG_BOOT_VALIDATE_SLOT0 isn't disabling it, how can it be disabled (while still validating during DFU)?

How do you add CONFIG_BOOT_VALIDATE_SLOT0?

I add CONFIG_BOOT_VALIDATE_SLOT0=n in the nrf_desktop/configuration/nrf52840dk_nrf52840/images/mcuboot/prj_fast_pair.conf, and CONFIG_BOOT_VALIDATE_SLOT0 is not set in the .config under build/mcuboot/zephyr.