Secure bootloader for FPGA-based Linux systems

Connect secure boot to Linux

Integrate KiviBoot-NanoBL and KiviBoot-SecureBL with the platform-specific stages used to start your Linux system

Start with a board reference

Use prepared boot components and an example application to explore the signing and verified-startup workflow.

Fast availability and direct support

Evaluation packages and documentation are available via download, with rapid responsive web support to keep your project moving.

European technology

Developed in Germany, with predictable availability giving design teams transparency, control, and long-term planning security.

KiviBoot-Linux Overview

KiviBoot-Linux extends the KiviBoot architecture towards Linux-based FPGA systems. It combines the two boot stages KiviBoot-NanoBL and KiviBoot-SecureBL with AES and SHA hardware acceleration and integration of the platform-specific Linux boot environment.

KiviBoot-NanoBL establishes the initial software stage in protected on-chip memory and checks KiviBoot-SecureBL before handing over execution. KiviBoot-SecureBL provides the next trusted boot stage and the starting point for integration with subsequent Linux boot components.

The Linux integration includes OpenSBI and U-Boot where required by the target architecture, together with loading Linux kernel and device tree components. Their sequence, storage locations and verification policy are defined for the selected platform.

The initial boot components, FPGA configuration and keys must be protected by the target platform’s security architecture. The agreed verification scope determines which subsequent components are authenticated before use.

Tested reference platforms

KiviBoot-Linux has been implemented on the following reference systems. Each uses a platform-specific memory layout and boot flow.

Reference Boards	Processor	External execution memory
Efinix Titanium Ti375 C529 Development Board	Hardened Sapphire RISC-V SoC	DDR RAM
TRS-STAR T*Square Ti60-256 Education Board	Sapphire RISC-V softcore	HyperRAM
Digilent Arty A7-100T	MicroBlaze RISC-V softcore on AMD Artix-7	DDR3L RAM
Digilent Arty Z7-20	Arm Cortex-A9 on AMD Zynq-7000	DDR3 RAM

Key Features

Two KiviBoot software stages: KiviBoot-NanoBL and KiviBoot-SecureBL
FPGA-based AES and SHA acceleration
Platform-specific integration with OpenSBI and U-Boot
Support for loading Linux kernel and device tree components
Adaptation to external flash, SD card and system memory architecture
Integration concept for FPGA SoCs and softcore processor systems
Application-specific verification scope and boot policy
Encryption and signature toolchain for the configured image workflow.

Applications

FPGA-based Linux systems requiring an explicitly defined chain of trust beyond initial hardware startup
Embedded Linux designs with boot components distributed across flash and SD-card storage
Projects combining FPGA crypto acceleration with platform-specific bootloader integration
Teams defining verified startup together with product-specific update and recovery policies

Licensing and deliverables

License type	Purpose	Scope	Fee	Deliverables
Product License	Manufacture of products intended for commercial distribution.	Valid for single-instance implementation into one device (e.g., one type of SoC, or FPGA) for a specific project or product definition.	One-time fee	KiviBoot-NanoBL source code KiviBoot-SecureBL source code Reference application source code Encryption and signature toolchain Documentation
Evaluation License	Usability and evaluation for upcoming design	Valid for single-instance implementation into one device (SoC, or FPGA) for a specific upcoming design project.	Free, no license fee	Bitstream w/ KiviBoot-NanoBL KiviBoot-SecureBL image Reference application binary & source code Encryption and signature toolchain Documentation

Support and maintenance

Maintenance and updates of software included
Rapid bug fix cycles
Documentation and integration examples included
Web based support with response times of 8 hours (Mo to Fri)

KiviBoot-Linux

Secure boot for FPGA-based Linux systems