Drive the Athena F5200 from the mpfs250 test-app

Author: dgarske

docs/PolarFire.md

@@ -1240,6 +1240,31 @@ The AES offload is worth about 4.2x on the decrypt. **The hash offload is about
 
 Athena also does not fit eNVM alongside the full feature set: with the manifest linked it needs both `GZIP` and `MPFS_SBI_SC_FLASH` dropped. Dropping `GZIP` costs nothing when the FIT's kernel is stored uncompressed.
 
+The port also serves AES-ECB, which is how AES-XTS reaches the engine: wolfCrypt's XTS masks the whole buffer with the tweak chain and issues one bulk ECB call per XTS call (`HAVE_AES_ECB` required, distinct in/out buffers), while the tweak math stays in software. wolfBoot itself encrypts images with CTR and has no XTS use; the ECB path is for an application. Requests under `WC_MPFS_ATHENA_AES_MIN_SZ` (32 bytes) are declined to software, which keeps the XTS tweak and ciphertext-stealing blocks off the engine. Beyond what wolfBoot uses, the port offloads the rest of SHA-2, AES-CBC, AES-GCM, AES-CMAC and AES key wrap at every key size, the NRBG as a seed source, ECDSA, ECDH and EC key generation, and RSA. See `wolfcrypt/src/port/microchip/README.md` in wolfSSL.
+
+#### Measuring the offload bare-metal
+
+The test application doubles as a bare-metal wolfCrypt test and benchmark harness for the engine, in the same M-mode environment wolfBoot uses, so its figures compare with the software build of the same app and not with a Linux userspace benchmark:
+
+```sh
+cp config/examples/polarfire_mpfs250_m_qspi.config .config
+make clean
+make MPFS_ATHENA=1 MPFS_ATHENA_CAL_DIR=/path/to/hart-software-services/services/crypto \
+    WOLFCRYPT_BENCHMARK=1 WOLFBOOT_L2SCRATCH_SIZE=512k
+```
+
+Load `test-app/image_v1_signed.bin` with `mpfs_qspi_prog.py` as for any M-mode test app. The benchmark app is about 240 KB and is loaded at `0x0A020200`, so the bootloader's stack has to sit at the top of all four scratchpad ways rather than the default 256 KB, which is what `WOLFBOOT_L2SCRATCH_SIZE=512k` does; `test-app/RISCV64-mpfs250.ld` reserves 64 KB for the app's own stack above that, sized for the benchmark's SP math frames. The `WOLFCRYPT_TEST=1` app is about 370 KB and does not fit the scratchpad beside the bootloader: build it on `polarfire_mpfs250_m_qspi_ddr.config` with its `-DWOLFBOOT_MMODE_SMODE_BOOT` line removed, which loads the signed app into DDR and enters it with the M-mode direct jump, and with `NO_ASM=1`, since the test-app's RISC-V SHA assembly does not assemble against the test configuration. `MPFS_ATHENA=1` makes the app bring the engine up itself, so the bootloader it runs under may be built with or without the offload. With `MPFS_ATHENA=1` the test and benchmark build also turns on SHA-224, AES key wrap and CMAC, and seeds wolfCrypt's DRBG from the engine's NRBG, so every offload is exercised; RSA is covered when the configuration signs with RSA. The app registers the port, runs its known-answer self-test and prints `Athena: self-test passed, engine served N call(s)`, or the failing test followed by `Athena: halted`, in which case it stops there; the stock `wolfcrypt_test()` and `benchmark_test()` then drive the engine through `WC_USE_DEVID`, with the benchmark labelling offloaded results `HW`. The benchmark runs once per call size in `MPFS_BENCH_SIZES` (default 1 KiB, 512 B and 4 KiB; each needs twice that from `WOLFSSL_STATIC_MEMORY_TEST_SZ`), since one engine transfer per call amortises very differently at sector size and in bulk. The app ends with the total engine call count: a passing test or a plausible rate proves nothing about offload on its own, because every case the port declines runs in software. The same app built without `MPFS_ATHENA` is the software baseline. Object files are configuration-specific, so `make clean` between the two builds.
+
+Measured on the Video Kit with the DDR configuration (E51 at 600 MHz), the software column being wolfCrypt's default C AES for RISC-V:
+
+| Call size | AES-256-XTS software | AES-256-XTS Athena | AES-256-CTR Athena | SHA-384 software | SHA-384 Athena |
+|---|---|---|---|---|---|
+| 512 B | 48 KiB/s | 1.23 MiB/s | 12.9 MiB/s | 5.7 MiB/s | 11.4 MiB/s |
+| 1 KiB | 49 KiB/s | 2.06 MiB/s | 14.6 MiB/s | 5.8 MiB/s | 13.2 MiB/s |
+| 4 KiB | 49 KiB/s | 4.2 MiB/s | 16.1 MiB/s | 5.8 MiB/s | 14.8 MiB/s |
+
+The app keeps the five MSS watchdogs refreshed from a machine timer interrupt every 5 s, since a test or benchmark pass runs far longer than their window, and its M-mode trap handler prints the cause and halts instead of resuming at the faulting instruction. The RISC-V harts trap on misaligned accesses, so `user_settings.h` defines `WOLFSSL_USE_ALIGN` for `ARCH_RISCV64`; the AES-GCM tests and benchmark also need the wolfSSL change that takes the byte-wise GCM table multiply under that define on 64-bit builds.
+
 ## Source files
 
 `hal/mpfs250.c` - Hardware abstraction layer (UART, QSPI, SD/eMMC, multi-hart)

docs/Targets.md

@@ -916,7 +916,7 @@ Make variables, on the command line or in the `.config`. See [PolarFire.md](Pola
 | `MPFS_SD_EMMC_DEMUX_ADDR` | Fabric register that selects the SD slot or the eMMC on designs with the demux in the fabric (Icicle Kit: `0x4FFFFF00`); unset, the Video Kit's IOMUX override is used. |
 | `MPFS_SC_PROBE` | Read-only System Controller service survey at boot (device serial, TRNG nonce, PUF emulation): status and stability only, never a value. On by default for M-mode builds; `MPFS_SC_PROBE=0` disables it. |
 | `MPFS_DDR_MEMTEST` | `=1`: CPU pattern test over the DDR windows the design's SEG registers map, after training, reporting the error count per 64 MB chunk; independent of `DEBUG_DDR`. |
-| `MPFS_ATHENA` (+ `MPFS_ATHENA_CAL_DIR`) | SHA-384 and AES-256-CTR offload to the Athena F5200 (TeraFire), with a mandatory self-check. |
+| `MPFS_ATHENA` (+ `MPFS_ATHENA_CAL_DIR`) | SHA-384, AES-256-CTR and AES-256-ECB (AES-XTS) offload to the Athena F5200 (TeraFire), with a mandatory self-check. With `WOLFCRYPT_TEST=1` or `WOLFCRYPT_BENCHMARK=1` the test-app also drives the engine, across every algorithm the wolfSSL port offloads. |
 | `SNVM_KEYSTORE`, `SNVM_KEYSTORE_PROVISION`, `SNVM_KEYSTORE_REQUIRE_ROM` | Serve the verification keystore from secure NVM; the one-time writer; refuse to boot unless every keystore page is ROM-flagged. |
 | `SNVM_KEK`, `SNVM_ENCKEY_PROVISION` | PUF-derived KEK with RFC 3394 key-wrap for the sNVM-stored image-encryption key, and its one-time writer. |
 | `MPFS_SCB_SMODE_DENY` | Fence S-mode off the System Controller mailbox (PMP plus dtb node removal), so nothing after wolfBoot can reach the sNVM write service. |

hal/mpfs250.c

@@ -146,10 +146,6 @@ extern uint8_t _main_hart_hls; /* linker-provided address symbol; typed as uint8
 
 /* CLINT MSIP register for IPI delivery */
 #define CLINT_MSIP_REG(hart) (*(volatile uint32_t*)(CLINT_BASE + (hart) * 4))
-/* CLINT machine-timer comparator (per hart) and MTIME counter */
-#define CLINT_MTIMECMP_REG(hart) \
-    (*(volatile uint64_t*)(CLINT_BASE + 0x4000UL + (hart) * 8UL))
-#define CLINT_MTIME_REG (*(volatile uint64_t*)(CLINT_BASE + 0xBFF8UL))
 
 /* Signal secondary harts that E51 (main hart) is ready. */
 static void mpfs_signal_main_hart_started(void)
@@ -217,10 +213,10 @@ void secondary_hart_entry(unsigned long hartid, HLS_DATA* hls)
     }
 }
 
-#if defined(MPFS_DDR_INIT) && defined(WOLFBOOT_MMODE_SMODE_BOOT)
+#ifdef WOLFBOOT_RISCV_MMODE
 /* Enable the CLINT MTIME counter via the SYSREG RTC clock divider.  Without it
  * MTIME never advances and an S-mode OS has no scheduler tick. */
-static void mpfs_enable_mtime(void)
+void mpfs_enable_mtime(void)
 {
     volatile uint32_t *rtc_cr = (volatile uint32_t *)(SYSREG_BASE + 0x0CUL);
     uint32_t div;
@@ -233,7 +229,9 @@ static void mpfs_enable_mtime(void)
     *rtc_cr |= (1UL << 16);    /* enable RTC/time-base clock */
     __asm__ volatile("fence iorw, iorw" ::: "memory");
 }
+#endif /* WOLFBOOT_RISCV_MMODE */
 
+#if defined(MPFS_DDR_INIT) && defined(WOLFBOOT_MMODE_SMODE_BOOT)
 /* SBI HSM hart_start backend: stage the target hart's mailbox and ring its
  * MSIP; it enters S-mode at saddr with a0=hartid, a1=opaque. */
 int sbi_hal_hart_start(unsigned long hartid, unsigned long saddr,

hal/mpfs250.h

@@ -392,6 +392,10 @@ int mpfs_nonce(uint8_t *nonce);
 #ifndef CLINT_BASE
 #define CLINT_BASE                  0x02000000UL
 #endif
+/* Machine-timer comparator (per hart) and the MTIME counter. */
+#define CLINT_MTIMECMP_REG(hart) \
+    (*(volatile uint64_t*)(CLINT_BASE + 0x4000UL + (hart) * 8UL))
+#define CLINT_MTIME_REG (*(volatile uint64_t*)(CLINT_BASE + 0xBFF8UL))
 
 /* RTC Clock Frequency (1 MHz after divisor) */
 #define RTC_CLOCK_FREQ              1000000UL
@@ -476,6 +480,7 @@ void uart_write(const char* buf, unsigned int sz);
 #endif
 #ifdef WOLFBOOT_RISCV_MMODE
 void secondary_hart_entry(unsigned long hartid, HLS_DATA* hls);
+void mpfs_enable_mtime(void);
 #endif
 #endif /* __ASSEMBLER__ */
 

include/user_settings.h

@@ -596,6 +596,14 @@ extern int tolower(int c);
 #   endif
 #endif
 
+/* The RISC-V harts trap on a misaligned load or store with nothing to emulate
+ * it bare-metal, so make wolfCrypt's ALIGN* attributes real: without this the
+ * word-sized casts it makes on struct members (the AES-GCM table, for one)
+ * fault. */
+#ifdef ARCH_RISCV64
+#   define WOLFSSL_USE_ALIGN
+#endif
+
 #if defined(EXT_ENCRYPTED)
 #   define HAVE_PWDBASED
 #endif
@@ -745,6 +753,25 @@ extern int tolower(int c);
             #define WOLFSSL_SHA256
             #define WOLFSSL_SHA384
             #define WOLFSSL_SHA512
+        #elif defined(TARGET_mpfs250) && defined(MPFS_ATHENA)
+            /* wolfCrypt's DRBG seeded from the Athena NRBG, so the test also
+             * covers the engine's entropy source, and every algorithm the
+             * wolfSSL port offloads. */
+            #define HAVE_HASHDRBG
+            #define CUSTOM_RAND_GENERATE_SEED wc_MpfsAthena_GenerateSeed
+            #ifndef __ASSEMBLER__
+            extern int wc_MpfsAthena_GenerateSeed(unsigned char* output,
+                unsigned int sz);
+            #endif
+            #define WOLFSSL_AES_COUNTER
+            #define HAVE_AES_ECB
+            #define WOLFSSL_AES_XTS
+            #define WOLFSSL_AES_DIRECT
+            #define HAVE_AES_KEYWRAP
+            #define WOLFSSL_AES_KEYWRAP_PADDING
+            #define WOLFSSL_CMAC
+            #define WOLFSSL_SHA224
+            #define WOLFSSL_SHA3
         #elif defined(TARGET_ti_am64x_r5)
             #ifndef WOLFSSL_TI_AM64X_R5
                 #define WC_NO_RNG
@@ -764,7 +791,9 @@ extern int tolower(int c);
             #define WC_NO_HASHDRBG
             #define CUSTOM_RAND_GENERATE_SEED my_rng_seed_gen
             #define CUSTOM_RAND_GENERATE_BLOCK my_rng_seed_gen
+            #ifndef __ASSEMBLER__
             extern int my_rng_seed_gen(unsigned char* output, unsigned int sz);
+            #endif
 
             /* Full test/benchmark algo set: AES ECB/CBC/CTR/GCM/XTS,
              * SHA-256/384/512, SHA-3. (AES-CBC/GCM added below; SHA-384/512
@@ -919,7 +948,17 @@ extern int tolower(int c);
         #define WOLFSSL_STATIC_MEMORY
     #endif
     #ifndef WOLFSSL_STATIC_MEMORY_TEST_SZ
-        #define WOLFSSL_STATIC_MEMORY_TEST_SZ (10 * 1024)
+        #if defined(TARGET_mpfs250) && defined(MPFS_DDR_INIT)
+            /* Every default bucket, including the two above 4 KB that the
+             * benchmark's 4 KB buffers and the test's larger contexts need;
+             * a pool without them hands out something else. Only with DDR:
+             * the L2 scratchpad app has no room for it. */
+            #define WOLFSSL_STATIC_MEMORY_TEST_SZ (128 * 1024)
+        #elif defined(TARGET_mpfs250)
+            #define WOLFSSL_STATIC_MEMORY_TEST_SZ (64 * 1024)
+        #else
+            #define WOLFSSL_STATIC_MEMORY_TEST_SZ (10 * 1024)
+        #endif
     #endif
     #define WOLFSSL_STATIC_MEMORY_LEAN
 
@@ -929,7 +968,9 @@ extern int tolower(int c);
     /* User time functions provided */
     #define WOLFSSL_USER_CURRTIME
     #define XTIME my_time
+    #ifndef __ASSEMBLER__
     extern unsigned long my_time(unsigned long* timer);
+    #endif
 #endif
 
 #if !defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK)
@@ -941,6 +982,26 @@ extern int tolower(int c);
 #undef NO_KDF
 #endif
 
+#if (defined(WOLFCRYPT_TEST) || defined(WOLFCRYPT_BENCHMARK)) && \
+    defined(TARGET_mpfs250) && defined(MPFS_ATHENA)
+#undef NO_CMAC
+#endif
+
+/* The bootloader offloads only its image hash and cipher: keep the rest of the
+ * wolfSSL Athena port out of the image, which has little room to spare. */
+#if defined(MPFS_ATHENA) && !defined(WOLFCRYPT_TEST) && \
+    !defined(WOLFCRYPT_BENCHMARK)
+#   define WC_MPFS_ATHENA_NO_SHA256
+#   define WC_MPFS_ATHENA_NO_SHA512
+#   define WC_MPFS_ATHENA_NO_CBC
+#   define WC_MPFS_ATHENA_NO_GCM
+#   define WC_MPFS_ATHENA_NO_KEYWRAP
+#   define WC_MPFS_ATHENA_NO_CMAC
+#   define WC_MPFS_ATHENA_NO_RNG
+#   define WC_MPFS_ATHENA_NO_ECC
+#   define WC_MPFS_ATHENA_NO_RSA
+#endif
+
 #if defined(WOLFBOOT_TZ_FWTPM)
 #undef NO_CMAC
 #undef NO_KDF

test-app/Makefile

@@ -268,6 +268,18 @@ ifeq ($(SEC_QORIQ),1)
   APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/nxp/sec_qoriq_baremetal.o
 endif
 
+# PolarFire SoC Athena F5200.  options.mk already supplies the defines, the CAL
+# include path and the archive in LIBS; the port objects are added here because
+# the apps build their own wolfCrypt object list.
+ifeq ($(MPFS_ATHENA),1)
+  ifeq ($(WOLFCRYPT_TEST)$(WOLFCRYPT_BENCHMARK),)
+    $(warning MPFS_ATHENA=1 without WOLFCRYPT_TEST or WOLFCRYPT_BENCHMARK only runs the engine self-test in the test-app)
+  endif
+  WOLFCRYPT_SUPPORT=1
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/cryptocb.o
+  APP_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/microchip/mpfs_athena.o
+endif
+
 ifeq ($(WOLFCRYPT_TEST),1)
   CFLAGS+=-DWOLFCRYPT_TEST
   WOLFCRYPT_SUPPORT=1
@@ -1530,6 +1542,13 @@ endif
 ifeq ($(TARGET),mpfs250)
   LSCRIPT_TEMPLATE:=RISCV64-mpfs250.ld
   CFLAGS+=-DRAMFUNCTION='__attribute__((used,section(".ramcode")))'
+  # The wolfCrypt test and benchmark need far more stack than the plain app,
+  # which the L2 scratchpad configurations have no room to reserve.
+  ifneq ($(filter 1,$(WOLFCRYPT_TEST) $(WOLFCRYPT_BENCHMARK)),)
+    TEST_APP_STACK_SIZE?=0x00010000
+  else
+    TEST_APP_STACK_SIZE?=0x00002000
+  endif
 endif
 
 # $(CYPRESS_PDL)/devices/templates/COMPONENT_MTB/COMPONENT_CM0P/system_psoc6_cm0plus.o
@@ -2011,7 +2030,8 @@ endif
 		sed -e "s/@WOLFBOOT_PARTITION_BOOT_ADDRESS@/$(WOLFBOOT_PARTITION_BOOT_ADDRESS)/g" | \
 		sed -e "s/@WOLFBOOT_PARTITION_SIZE@/$(WOLFBOOT_PARTITION_SIZE)/g" | \
 		sed -e "s/@WOLFBOOT_PARTITION_UPDATE_ADDRESS@/$(WOLFBOOT_PARTITION_UPDATE_ADDRESS)/g" | \
-		sed -e "s/@WOLFBOOT_PARTITION_SWAP_ADDRESS@/$(WOLFBOOT_PARTITION_SWAP_ADDRESS)/g" \
+		sed -e "s/@WOLFBOOT_PARTITION_SWAP_ADDRESS@/$(WOLFBOOT_PARTITION_SWAP_ADDRESS)/g" | \
+		sed -e "s/@TEST_APP_STACK_SIZE@/$(TEST_APP_STACK_SIZE)/g" \
 		> $(@)
 	$(Q)rm -f .app-size .entry-point .wolfboot-offset .partition-size .header-size
 

test-app/RISCV64-mpfs250.ld

@@ -4,7 +4,7 @@
 /* TODO: Update with actual memory map for MPFS250 */
 
 _Min_Heap_Size  = 0x00002000; /* required amount of heap  */
-_Min_Stack_Size = 0x00002000; /* required amount of stack */
+_Min_Stack_Size = @TEST_APP_STACK_SIZE@; /* required amount of stack */
 
 OUTPUT_ARCH( "riscv" )
 

test-app/app_mpfs250.c

@@ -46,6 +46,94 @@ int wolfcrypt_test(void *args);
 int benchmark_test(void *args);
 #endif
 
+#ifdef WOLFCRYPT_BENCHMARK
+/* Buffer sizes the whole benchmark is run at, in turn: the Athena F5200 does
+ * one engine transfer per call, so a sector-sized call and a bulk one amortise
+ * the setup very differently, and the software build runs the same set as the
+ * baseline. Each needs twice the size from the static pool
+ * (WOLFSSL_STATIC_MEMORY_TEST_SZ). */
+#ifndef MPFS_BENCH_SIZES
+#define MPFS_BENCH_SIZES { 1024, 512, 4096 }
+#endif
+#endif /* WOLFCRYPT_BENCHMARK */
+
+#ifdef MPFS_ATHENA
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/port/microchip/mpfs_athena.h>
+
+/* Nothing after a failed bring-up or self-test can be trusted to the engine,
+ * so stop here, as the bootloader's own self-check does. */
+static void mpfs_athena_app_halt(void)
+{
+    wolfBoot_printf("Athena: halted\r\n");
+    while (1) {
+        /* halt */
+    }
+}
+
+static void mpfs_athena_app_init(void)
+{
+    int ret;
+
+    /* The engine is brought up here, not by the bootloader: a wolfBoot built
+     * without MPFS_ATHENA never touched it, and the port's own init handles
+     * one that did. wolfcrypt_test and benchmark_test register the device
+     * again, which the port accepts. */
+    ret = wolfCrypt_Init();
+    if (ret != 0) {
+        wolfBoot_printf("Athena: wolfCrypt_Init failed (%d)\r\n", ret);
+        mpfs_athena_app_halt();
+    }
+    ret = wc_MpfsAthena_RegisterDevice(WC_MPFS_ATHENA_DEVID);
+    if (ret != 0) {
+        wolfBoot_printf("Athena: RegisterDevice failed (%d)\r\n", ret);
+        mpfs_athena_app_halt();
+    }
+    ret = wc_MpfsAthena_SelfTest();
+    if (ret != 0) {
+        wolfBoot_printf("Athena: self-test failed: %s (rc %d)\r\n",
+            wc_MpfsAthena_SelfTestDesc(), ret);
+        mpfs_athena_app_halt();
+    }
+    wolfBoot_printf("Athena: self-test passed, engine served %u call(s)\r\n",
+        (unsigned int)wc_MpfsAthena_GetCbCount());
+}
+
+#endif /* MPFS_ATHENA */
+
+
+#ifdef WOLFBOOT_RISCV_MMODE
+#include "../hal/riscv.h"
+/* MTIME is not running in an M-mode boot: start it, then let the machine
+ * timer interrupt refresh the watchdogs every 5 s for as long as the app
+ * runs. */
+#define MPFS_WDT_PET_TICKS (5ULL * RTC_CLOCK_FREQ)
+
+/* The vector saved the caller's registers, so plain C: refresh the five MSS
+ * watchdogs, which the bitstream arms and which reset the chip well inside a
+ * test run, then rearm. */
+void isr_mtimer(void)
+{
+    mpfs_wdt_pet_all();
+    CLINT_MTIMECMP_REG(0) = CLINT_MTIME_REG + MPFS_WDT_PET_TICKS;
+}
+
+static void mpfs_wdt_timer_start(void)
+{
+    mpfs_enable_mtime();
+    CLINT_MTIMECMP_REG(0) = CLINT_MTIME_REG + MPFS_WDT_PET_TICKS;
+    csr_set(mie, MIE_MTIE);
+    csr_set(mstatus, MSTATUS_MIE);
+#ifdef MPFS_DDR_INIT
+    /* The bootloader raised the E51 to the Libero PLL rate; this copy of the
+     * HAL's clock variable, which times the benchmark, still holds the reset
+     * rate. Without DDR init the clock is never raised and that reset rate is
+     * the right one. */
+    mpfs_cpu_freq_mhz =
+        (uint32_t)(LIBERO_SETTING_MSS_COREPLEX_CPU_CLK / 1000000UL);
+#endif
+}
+#endif
 
 void main(void)
 {
@@ -61,6 +149,14 @@ void main(void)
     wolfBoot_printf("GPL v3\r\n");
     wolfBoot_printf("========================\r\n");
 
+#ifdef WOLFBOOT_RISCV_MMODE
+    mpfs_wdt_timer_start();
+#endif
+
+#ifdef MPFS_ATHENA
+    mpfs_athena_app_init();
+#endif
+
 #ifdef WOLFCRYPT_TEST
     wolfBoot_printf("\r\nRunning wolfCrypt tests...\r\n");
     wolfCrypt_Init();
@@ -72,11 +168,30 @@ void main(void)
 #ifdef WOLFCRYPT_BENCHMARK
     wolfBoot_printf("Running wolfCrypt benchmarks...\r\n");
     wolfCrypt_Init();
-    benchmark_test(NULL);
+    {
+        static const unsigned int sizes[] = MPFS_BENCH_SIZES;
+        unsigned int i;
+        /* benchmark_test() puts the block size back to its default on its
+         * first run, so take that run's setup first and configure after. */
+        benchmark_init();
+        benchmark_free();
+        for (i = 0; i < sizeof(sizes) / sizeof(sizes[0]); i++) {
+            wolfBoot_printf("\r\n--- %u-byte calls ---\r\n", sizes[i]);
+            benchmark_configure(sizes[i]);
+            benchmark_test(NULL);
+        }
+    }
     wolfCrypt_Cleanup();
     wolfBoot_printf("Benchmarks complete.\r\n\r\n");
 #endif
 
+#ifdef MPFS_ATHENA
+    /* A passing test or a plausible figure proves nothing about offload on
+     * its own: every case the port declines runs in software. */
+    wolfBoot_printf("Athena: engine served %u call(s) in total\r\n",
+        (unsigned int)wc_MpfsAthena_GetCbCount());
+#endif
+
     while(1) {
         /* Main application loop */
         /* TODO: Add watchdog feed if needed */