Single Partition Image - Single Partition Image - 2026.1 English - UG1283

U-Boot Command for Loading Secure Images

zynqmp secure <srcaddr> <len> [key_addr] 

This command verifies secure images of $len bytes\ long at address $src. Specify the optional key_addr if the user key needs to be used for decryption.

Only Authentication Use Case

To use only authentication at U-Boot, create the authenticated image using bif as shown in the following example.

1. Create a single partition image that U-Boot authenticates.
   Note: If you provide an elf file, it should not contain multiple loadable sections. If your elf file contains multiple loadable sections, you should convert the input to the .bin format and provide the .bin as input in bif. An example bif is as follows:

   the_ROM_image:
   {
   	[pskfile]rsa4096_private1.pem
   	[sskfile]rsa4096_private2.pem
   	[auth_params] ppk_select=1;spk_id=0x1
   	[authentication = rsa]Data.bin
   }

2. When you generate the image, download the authenticated image to the DDR.
3. Execute the U-Boot command to authenticate the secure image as shown in the following example.

   ZynqMP> zynqmp secure 100000 2d000
   Verified image at 0x102800

4. U-Boot returns the start address of the actual partition after successful authentication. U-Boot prints an error code in the event of a failure. If RSA_EN eFUSE is programmed, then image authentication is mandatory. The system does not support boot header authentication when eFUSE RSA is enabled.

Only Encryption Use Case

If the image is only encrypted, the system doesn't support a device key. If authentication is disabled, the system supports only KUP key decryption.