Description
With MCUBOOT_BOOTSTRAP enabled, boot_prepare_image_for_update() runs a full boot_validate_slot() on the primary slot on every boot (in the swap type == NONE path) to decide whether to bootstrap from the secondary slot. For a signed image that is a public-key signature verification, and it runs on every normal boot even when the primary already holds a valid, confirmed image — and even when MCUBOOT_VALIDATE_PRIMARY_SLOT is disabled.
Impact
On a Cortex-M33 with ECDSA-P384/SHA-384 and FIH_PROFILE_HIGH, this adds ~14 s to every boot.
Analysis
The block's comment says header checks are done first because they are inexpensive, but the code runs the expensive boot_validate_slot(PRIMARY) first and the cheap boot_check_header_erased() second. The validation guards a present-but-invalid primary, which can only arise here for MCUBOOT_OVERWRITE_ONLY (an interrupted offset-0 copy can leave a valid header over an incomplete image). For swap-based modes the block runs only in the no-partial-swap branch (boot_status_is_reset()), after boot_complete_partial_swap() finished any interrupted swap, so the primary is already settled.
Environment
swap-using-offset; ECDSA-P384/SHA-384; FIH_PROFILE_HIGH; MCUBOOT_VALIDATE_PRIMARY_SLOT disabled.
PR to follow.
Description
With
MCUBOOT_BOOTSTRAPenabled,boot_prepare_image_for_update()runs a fullboot_validate_slot()on the primary slot on every boot (in theswap type == NONEpath) to decide whether to bootstrap from the secondary slot. For a signed image that is a public-key signature verification, and it runs on every normal boot even when the primary already holds a valid, confirmed image — and even whenMCUBOOT_VALIDATE_PRIMARY_SLOTis disabled.Impact
On a Cortex-M33 with ECDSA-P384/SHA-384 and
FIH_PROFILE_HIGH, this adds ~14 s to every boot.Analysis
The block's comment says header checks are done first because they are inexpensive, but the code runs the expensive
boot_validate_slot(PRIMARY)first and the cheapboot_check_header_erased()second. The validation guards a present-but-invalid primary, which can only arise here forMCUBOOT_OVERWRITE_ONLY(an interrupted offset-0 copy can leave a valid header over an incomplete image). For swap-based modes the block runs only in the no-partial-swap branch (boot_status_is_reset()), afterboot_complete_partial_swap()finished any interrupted swap, so the primary is already settled.Environment
swap-using-offset; ECDSA-P384/SHA-384;
FIH_PROFILE_HIGH;MCUBOOT_VALIDATE_PRIMARY_SLOTdisabled.PR to follow.