Xilinx Zynq-7000 User manual

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 1

UG585 (DRAFT) February 15, 2012

Zynq-7000 EPP TRM

Chapter 33: Device Security

XTP176 (Draft) February 15, 2012

NOTICE: This pre-release document contains confidential and proprietary information of Xilinx, Inc. and is being disclosed to

you as a participant in an early access program, under obligation of confidentiality. You may print one (1) copy of this document

for evaluation purposes. You may not modify, distribute, or disclose this material to anyone, including your employees,

coworkers, or contractors (these individuals must apply for separate access to the program). This document contains

preliminary information and is subject to change without notice. Information provided herein relates to products and/or services

not yet available for sale, and provided solely for information purposes and are not intended, or to be construed, as an offer for

sale or an attempted commercialization of the products and/or services referred to herein.

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 2

UG585 (DRAFT) February 15, 2012

The information disclosed to you hereunder (the "Materials") is provided solely for the selection and use of Xilinx products. To the

maximum extent permitted by applicable law: (1) Materials are made available "AS IS" and with all faults, Xilinx hereby DISCLAIMS

ALL WARRANTIES AND CONDITIONS, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO

WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, OR FITNESS FOR ANY PARTICULAR PURPOSE; and (2) Xilinx

shall not be liable (whether in contract or tort, including negligence, or under any other theory of liability) for any loss or damage of any

kind or nature related to, arising under, or in connection with, the Materials (including your use of the Materials), including for any

direct, indirect, special, incidental, or consequential loss or damage (including loss of data, profits, goodwill, or any type of loss or

damage suffered as a result of any action brought by a third party) even if such damage or loss was reasonably foreseeable or Xilinx

had been advised of the possibility of the same. Xilinx assumes no obligation to correct any errors contained in the Materials, or to

advise you of any corrections or update. You may not reproduce, modify, distribute, or publicly display the Materials without prior

written consent. Certain products are subject to the terms and conditions of the Limited Warranties which can be viewed

at http://www.xilinx.com/warranty.htm; IP cores may be subject to warranty and support terms contained in a license issued to you by

Xilinx. Xilinx products are not designed or intended to be fail-safe or for use in any application requiring fail-safe performance; you

assume sole risk and liability for use of Xilinx products in Critical Applications: http://www.xilinx.com/warranty.htm#critapps

designated brands included herein are trademarks of Xilinx in the United States and other countries. AMBA, AMBA Designer,

ARM, ARM1176JZ-S, CoreSight, Cortex, PrimeCell, ARM Powered, and ARM Connected Partner are trademarks of ARM

Ltd. All other trademarks are the property of their respective owners.

Third Party Intellectual Property Disclosure

This manual contains copyrighted material provided under license from the legal owner of the intellectual property (IP).

The following gives the required disclosure for each IP licensor to their IP used in the specified functional unit:

APU, SCU, Global Timer, GIC, WDT Cortex-A9 MPCore, Part DDI 0407F (ID043010)

L2 Cache ARM AMBA Level 2 Cache Controller (L2C-310)

DMAC ARM AMBA DMA Controller DMA-330, ARM part DDI 0424C (ID080710)

SDT Part Number: T-CS-PE-0004-100

TTC Triple Timer Counter (TTC)

USB Chipidea/Synopsys CI13612a (CI133210A) HighSpeed USB OnTheGo Controller

Core,

GEM Gigabit Ethernet MAC (GEM), Part Number: T-CS-ET-0005-100

SDIO Arasan SD2.0/ SDIO2.0/ MMC3.31 AHB Host Controller

I2C Part Number: T-CS-PE-0007-100

SPI Part Number: T-CS-PE-0009-100

UART Part Number: T-CS-PE-0001-100

DMC IntelliTM DDR Arbiter Interface, Part Number: DS-114-pkg16

SMC ARM Part number PL353 - DDI 0380G,

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 3

UG585 (DRAFT) February 15, 2012

Chapter 33

Device Security

33 Device Security

33.1 Introduction

The Zynq-7000 devices support the ability to perform a secure boot to load encrypted PS images and PL bitstreams.

33.1.1 Terminology

In order to reduce confusion, the following terminology will be used in this chapter:

Term

AES

Definition

Advanced Encryption Standard

First Stage Boot Loader

(FSBL) Code for the ARM PS initial boot and configuration

Image PS software, i.e. FSBL, software application, etc…

Bitstream PL configuration file

Boot Image File stored in external boot memory. Contains header information

used by the internal boot ROM to successfully load the FSBL. May

also contain multiple partitions containing additional PS images or

PL configuration bitstreams

Cipher Text Encrypted text, data or file

Plain Text Unencrypted text, data or file

PCAP Processor Configuration Access Port

PCAP-ICAP PCAP emulating ICAP

PCAP-SMAP PCAP emulating SelectMAP configuration

Chapter 32: Device Security

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 4

UG585 (DRAFT) February 15, 2012

33.2 Master Secure Boot

The Master Secure Boot mode is the only secure boot mode that Zynq-7000 supports. It uses the hardened AES de-

cryption engine and the hardened HMAC authentication engine within the PL to decrypt the encrypted image. The

boot process and data flow for the Master Secure Boot mode are shown in Figure 1.

Figure 1: Boot Process

The PS will boot first from the on-chip ROM (step 1). It then reads the encrypted PS boot image from the external boot

device. As the encrypted image is read, it is sent to the AES decryption and HMAC authentication engines which

reside in the PL via the PCAP (step 2). The PL configuration logic loops back the decrypted, authenticated image

immediately without internal buffering to be stored in the PS OCM (step 3). The PS reads the final authentication

status from the PL configuration logic to ensure the images was properly authenticated. If it fails, the PS will trigger a

system secure reset.

Once the PS image has been successfully loaded and authenticated, control is turned over to the plain text FSBL which

now resides in the OCM. Based on the user application, the FSBL could then either start processing, configure the PL

(step 4), load additional software, or wait for further instruction from and external source.

The Master Secure Boot mode uses the AES decryption and HMAC authentication engines within the PL, therefore,

the PL must be powered on during the secure boot process. The boot ROM will ensure that the PL is powered before

reading the encrypted image from the external boot device.

Chapter 32: Device Security

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 5

UG585 (DRAFT) February 15, 2012

33.2.1 External Boot Devices

Zynq-7000 secure boot mode is restricted to NOR, NAND, or Quad SPI FLASH as the external boot device. A secure

boot from JTAG or any other external interface is not allowed.

33.2.2 Secure Boot Image

Figure 2 Secure Boot Image Format

The secure boot image format is show in Figure 2. The secure boot image consists of a boot ROM header, a FSBL

partition (required), and any number, including zero of succeeding partitions. The boot ROM header identifies the

boot image as secure or non-secure at offset 0x028. The value stored in the boot header at offset 0x028 determines the

key source, see Table 1.

Chapter 32: Device Security

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 6

UG585 (DRAFT) February 15, 2012

Table 1: Boot ROM Header Summary

Boot ROM Header Value at 0x028 Description

0xA5C3C5A3 Encrypted image using eFuse key

0x3A5C3C5A Encrypted image using BBRAM key

All other Non-encrypted image

The boot ROM header and partition headers are not encrypted. Partition data is signed and encrypted. The partition

data will be decrypted and authenticated by the AES and HMAC engines within the PL. When encryption is used, all

partitions will be encrypted. There cannot be a mix of encrypted and non-encrypted partitions in a boot image.

33.2.3 eFuse Settings

The Zynq-7000 secure boot features can also be controlled via three PL eFuse bits that are described in Table 2.

Table 2 eFuse Settings Summary

eFuse

Description

eFuse Secure Boot

The Zynq device must boot securely and use the eFuse key as the

AES key source. Non-secure boot of the device is not allowed. If

the boot image header doesn’t match this setting, a security

lockdown will occur.

BBRAM Key Disable If the Zynq device is booted in secure mode, then the eFuse key

must be selected. Non-secure boot of the device is allowed. If the

boot image header doesn’t match this setting, a security lockdown

will occur.

JTAG Chain Disable The ARM DAP controller is permanently set in bypass mode. Any

attempt to activate the ARM DAP controller will cause a security

lockdown.

See the 7-Series FPGA Configuration User Guide for information regarding PL eFuses.

33.3 Encryption, Authentication and Key Management

33.3.1 Boot Image and Bitstream Encryption

Boot images and PL configuration bitstreams are encrypted by running bootgen. This program will created a boot

image with the correct header. See the Bootgen User Guide for more information.

33.3.2 Boot Image and Bitstream Decryption and Authentication

For cipher text decryption, Xilinx uses the Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC)

mode with a 256-bit key. PS images and PL bitstreams are authenticated with a Keyed-Hashed Message Authentica-

tion Code (HMAC) using the SHA-256 hash algorithm (FIPS180-2). When the Boot ROM detects that the FSBL

image is encrypted, it enables the decryption and authentication engines within the PL. Both are enabled or disabled in

tandem.

Subsequent PS images do not have to be encrypted. Once an encrypted FSBL has been loaded, it is “trusted” and can

then load a plain text second stage boot loader or application. The path from the external memory to the OCM can

bypass the decryption / authentication engines within the PL. Loading of plain text PS images after a secure boot is not

recommended and should only be done after fully evaluating the system-level security.

Chapter 32: Device Security

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 7

UG585 (DRAFT) February 15, 2012

33.3.3 HMAC Signature

The authentication method requires a signature that must also be supplied to the bootgen software. This signature is

not loaded into the PL directly via JTAG like the AES key. It is contained and protected by the encrypted boot image

and the encrypted bitstream. During the on-chip decryption process, this HMAC signature will be extracted from the

boot image and bitstream and used by the authentication algorithm. No on-chip storage for the HMAC signature is

required.

33.3.4 Key Management

The AES encryption key is stored on-chip within the PL. It can be loaded into either volatile battery-backed RAM

(BBRAM) or in non-volatile eFuse storage. The keys are loaded into the PL via the JTAG interface using the iMPACT

software see the 7-series Configuration User Guide for more information.

33.4 Zynq Security Features

33.4.1 Non-Secure State Allowances

The non-secure state is entered when the boot ROM detects that the FSBL is not encrypted. In this state the decryption

and authentication engines are disabled and locked requiring a power-on reset to re-enable. All subsequent PS images,

PL configuration bitstreams, and PL partial reconfiguration bitstreams loaded via PCAP-SMAP, PCAP-ICAP, or

ICAP must ne unencrypted.

There is no mechanism to move from the non-secure state to the secure state, besides power-on reset (POR). Any

attempt to load encrypted data after unencrypted data will result in security violation and security lockdown.

33.4.2 Secure State Allowances

Zynq is either operating in a secure state or a non-secure state. Note that this is not the same as the secure and

non-secure worlds of TrustZone, but rather the state of the device. The secure state is entered when the boot ROM

reads the encryption status from the boot ROM header section of the boot image. In this state the encrypted FSBL will

be loaded into the PS and any PL configuration using the PCAP-SMAP port must also be encrypted.

Since the encrypted FSBL loaded in a secure boot is “trusted”, it is possible to load additional PS images in plain text

mode. PL partial reconfiguration bitstreams can be loaded via the PCAP-ICAP or ICAP interface as either cipher text

or plain text. Subsequent PS images or PL bitstreams must use the same key source as the FSBL, key switching is not

allowed. Loading of plain text images or bitstreams after a secure boot is not recommended.

33.4.3 Security Reset

The PS’s device configuration interface contains a security policy block that is used to monitor the system security.

When conflicting status is detected either from the PS or the PL that could indicate inconsistent system configuration

or tampering, a security reset is triggered. In a security reset the on-chip RAM is cleared along with all the system

caches. The PL is reset and the PS enters a lockdown mode that can only be exited by issuing a power-on reset.

33.4.4 Golden Image Search

The Zynq Boot ROM supports the capability to fall-back and reload to a “golden” image (multi-boot). If the FSBL is

plain text, the subsequent golden images must also be plain text. Loading an encrypted golden image after loading a

plain text FSBL is not supported. Likewise, if the FSBL is cipher text, the golden image must also be encrypted with

the same key as the FSBL. Loading a plain text golden image after loading a cipher text FSBL is not supported.

33.4.5 JTAG and Debug Considerations

In secure boot, the PS DAP and the PL TAP controllers are bypassed by default, eliminating any JTAG access to the

Zynq device. JTAG access can be restored in secure mode by the FSBL or subsequent PS images since these appli-

cations are considered “trusted”. Access to the DAP enable registers can be locked out using the Device Configuration

Interface LOCK register.

Chapter 32: Device Security

XILINX CONFIDENTIAL — DISCLOSED UNDER NDA

Zynq-7000 EPP Technical Reference Manual www.xilinx.com 8

UG585 (DRAFT) February 15, 2012

The PS DAP controller can be permanently bypassed using the “JTAG CHAIN DISABLE” eFuse. The JTAG access

to the PL can be disabled by setting the DISABLE_JTAG configuration option when creating the PL bitstream see

UG628, Command Line Tools User Guide for more information.

33.4.6 Readback

Whenever an encrypted bitstream is loaded into the PL, readback of the internal configuration memory cannot be

performed by any of the external interfaces, including JTAG. The only readback access to the configuration memory

after an encrypted bitstream load is via PCAP-ICAP or ICAP. The PCAP-ICAP and ICAP interfaces are “trusted”

channels since access to these interfaces are from an authenticated PS image or an authenticated PL bitstream.

33.5 Source Documents

Other manuals for Zynq-7000

Table of contents

Other Xilinx Computer Hardware manuals

Xilinx

Xilinx VIODC User manual

Xilinx

Xilinx SP701 User manual

Xilinx

Xilinx Virtex-4 QV FPGA User manual

Xilinx

Xilinx ML52 Series User manual

Xilinx

Xilinx Spartan-3A DSP FPGA Series User manual

Xilinx

Xilinx Kintex-7 FPGA KC705 User manual

Xilinx

Xilinx Virtex-6 FPGA User manual

Xilinx

Xilinx Virtex-II Pro ML300 User manual

Xilinx

Xilinx 7 Series User manual

Xilinx

Xilinx 7 Series User manual

Xilinx

Xilinx ML630 Si570 User manual

Xilinx

Xilinx ML628 User manual

Xilinx

Xilinx VC709 User manual

Xilinx

Xilinx AC701 Si570 Owner's manual

Xilinx

Xilinx Virtex-4 LX Prototype Platform User manual

Xilinx

Xilinx DPU IP User manual

Xilinx

Xilinx ML403 Installation and operating instructions

Xilinx

Xilinx LogiCORE IP Video In to AXI4-Stream v1.0 User manual

Xilinx

Xilinx Alveo U200 User manual

Xilinx

Xilinx Spartan-3A DSP FPGA Series User manual

Xilinx

Xilinx Spartan-3A DSP FPGA Series Quick start guide

Xilinx

Xilinx Alveo U200 User manual

Xilinx

Xilinx Spartan-3A DSP FPGA Series User manual

Xilinx

Xilinx ML506 User manual

Popular Computer Hardware manuals by other brands

EMC2

EMC2 VNX Series Hardware Information Guide

Panasonic

Panasonic DV0PM20105 Operation manual

Mitsubishi Electric

Mitsubishi Electric Q81BD-J61BT11 user manual

Gigabyte

Gigabyte B660M DS3H AX DDR4 user manual

Raidon

Raidon iT2300 Quick installation guide

National Instruments

National Instruments PXI-8186 user manual

Hauppauge

Hauppauge WinTV-HVR-2250 Quick installation guide

Kontron

Kontron CP6002 user guide

Manhattan

Manhattan 702843 user manual

Aphex

Aphex 230 instruction manual

AMD

AMD Phenom II Product data sheet

Intel

Intel NUC 12 Pro user guide

dbx

dbx Zone Pro 1260 user manual

Galaxy

Galaxy GHDX2-2430S-24F4D Installation and hardware reference manual

Intel

Intel AXXRMFBU4 Quick installation user's guide

Kontron

Kontron DIMM-PC/MD product manual

ST X-NUCLEO-SAFEA1B How to use

STEINWAY LYNGDORF

STEINWAY LYNGDORF SP-1 installation manual