how to confirm the signed image is booted in the EVK(GenesysZU5EV) board?

[sarvan]

Hi,

We have created the signed image and copied (BOOT.BIN)to SD card and loaded in EVK(GenesysZU5EV board). The board is booted successfully up to u-boot.

We used the bootgen verify command to check the created BOOT.BIN file.The bin file includes the FSBL/PMUFW/ATF/system.bit/u-boot. The log information is below

    xsct% bootgen -arch zynqmp -verify BOOT.BIN                                                                                                                                                            
                                                                                                                                                                                                           
     
    ****** Xilinx Bootgen v2019.1
      **** Build date : May 24 2019-14:54:05
        ** Copyright 1986-2019 Xilinx, Inc. All Rights Reserved.
     
    ---------------------------------------------------------------------
    Verifying Header Authentication Certificate
        SPK Signature Verified
        Header Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'zynqmp_fsbl.elf.0' Authentication Certificate
        BootHeader Signature Verified
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'pmufw.elf.0' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'pmufw.elf.1' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'pmufw.elf.2' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'system.bit.0' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'bl31.elf.0' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Verifying Partition 'u-boot.elf.0' Authentication Certificate
        SPK Signature Verified
        Partition Signature Verified
    ---------------------------------------------------------------------
    Authentication is verified on bootimage BOOT.BIN

1. Is the Image loaded in the EVK is authenticated when booting?

2. How to confirm the authentication is done for the signed image when booting?

3. Is there any serial logs will prints the authenticated information?

Help much appreciated

Thanks

saravanan

[JColvin]

Hi @sarvan,

The boot images that Digilent provides for our products are not encrypted or authenticated. If you are wanting to confirm that the signed image you created is indeed the one that is loaded into the Zynq Ultrascale+ part, I would recommend reading through Xilinx's documentation on the subject, https://docs.xilinx.com/r/en-US/ug1085-zynq-ultrascale-trm/Secure-Boot, as Digilent does not have any direct experience with this.

If you have further questions on the design flow for properly encrypting and securing your device, I would recommend reaching out on the Xilinx forums where you can receive accurate answers on this topic more directly.

Thanks,
JColvin