Xilinx Zynq-7000 Application Note - Hardware Root of Trust

Hardware Root of Trust

XAPP1309 (v1.0) March 7, 2017

 7

www.xilinx.com

Figure 5

 shows three possible system setups. The strongSwan software running on an Ubuntu 

server does both the remote attestation and the network security. The Ethernet connection can 

be either direct from the PC to the Avnet board or dynamic host configuration protocol (DHCP) 

using Ethernet wall sockets. In (a), the server is run on an Ubuntu installation on either 

VirtualBox or VMware on the PC. In (b), an Ubuntu-based PC runs the strongSwan server. In (c), 

the server runs on an Amazon web server (AWS). Xilinx does not provide the AWS account.

The reference system provides methods for a measured boot of a single client, providing 

remote attestation of early load software (BootROM, FSBL) which is new functionality for 

embedded systems. An actual connected system has multiple embedded devices, and the 

strongSwan server measures all Linux partitions loaded, not just the early load software.

Hardware Root of Trust

In Zynq-7000 AP SoCs, the HROT is based on the first code executed by the ARM® CPU0 at 

power-on. The code is stored in on-chip, metal-masked ROM, and is referred to as BootROM 

code. BootROM code is immutable, and its principle function is to perform device initialization 

and load the FSBL into read/writable on-chip memory (OCM). Neither the BootROM nor the 

OCM are accessible at device pins. The BootROM Configuration Flowchart figure in 

Zynq-7000 

All Programmable SoC Technical Reference Manual

 (UG585) 

[Ref 1]

 provides the flow of the 

BootROM code functionality. If secure boot is specified, the BootROM authenticates the FSBL 

using the RSA-2048 standard prior to execution of the FSBL. The Zynq-7000 AP SoC HROT is 

enhanced by adding a TPM to the embedded platform. The TPM provides partition 

measurements, cryptographic functions, and secure key storage for keys used by the Zynq-7000 

AP SoC.

X-Ref Target - Figure 5

Figure 5:

Reference System Hardware Setup Options

Laptop

Virtual Box

Ubuntu

strongSwan

IIoT 

Starter Kit

Laptop

Ubuntu

strongSwan

IIoT Starter Kit

Laptop

AWS

strongSwan

IIoT

Starter Kit

(a)

(b)

(c)

MicroZed

MicroZed

MicroZed

730

730

730

Server

Client

X18732-030617