Overview - Overview - 2026.1 English - UG643

Standalone Library Documentation: BSP and Libraries Document Collection (UG643)
Document ID
UG643
Release Date
2026-06-23
Version
2026.1 English

The XilSecure library provide APIs to access cryptographic accelerators on the AMD Zynq™ UltraScale+™ MPSoC devices. The library is designed to run on top of AMD standalone BSPs. It is tested for Arm Cortex™-A53, Arm Cortex-R5F, and AMD MicroBlaze™ processors. XilSecure is used during the secure boot process. The primary post-boot use case is to run this library on the PMU MicroBlaze with PMUFW to service requests from the U-Boot or Linux for cryptographic acceleration.

The XilSecure library includes:

Note: The XilSecure library does not check for memory bounds while performing cryptographic operations. You must check the bounds before using the functions provided in this library. If needed, you can take advantage of the XMPU, XPPU, or TrustZone to limit memory access.
  • SHA-3/384 engine for 384 bit hash calculation.
  • AES-GCM engine for symmetric key encryption and decryption using a 256-bit key.
  • RSA engine for signature generation, signature verification, encryption, and decryption. Key sizes supported include 2048, 3072, and 4096.
CAUTION:
Vitis defaults to using a software stack in DDR and any variables used by XilSecure is placed in the DDR memory. For better security, change the linker settings to make sure the stack used by XilSecure is either in the OCM or the TCM.

Board Support Package Settings

XilSecure provides configuration in the BSP settings to enable or disable secure environment. The parameter is valid only when BSP is build for the PMU MicroBlaze for post boot use cases and XilSecure is accessed using the IPI response calls to PMUFW from Linux, u-boot, or baremetal applications. When the application environment is secure and trusted, set this variable to TRUE. For more information on BSP configuration, see Setting Up Software System in the Vitis Unified IDE.

By default, PMUFW does not allow device key for any decryption operation requested through IP Integrator response unless authentication is enabled. If the user space is secure and trusted PMUFW can be build by setting the xsecure_environment variable. Only then the PMUFW allows usage of the device key for encrypting or decrypting the data blobs, decryption of bitstream, or image.

Table 1. Board Support Package Settings
Parameter Description
xsecure_environment Default = FALSE. Set the value to TRUE to allow usage of device key through the IPI response calls.
tpm_support Default = FALSE. Enables decryption of bitstream to memory and then writes it to PCAP, allows calculation of SHA on the decrypted bitstream in chunks. Valid configuration only for FSBL BSP.

Source Files

The source files for the library are available here https://github.com/Xilinx/embeddedsw/tree/master/lib/sw_services/xilsecure/src/server/zynqmp