Bootgen User Guide (UG1283) - 2020.2 English - This Bootgen User Guide describes how to generate boot images for Zynq®-7000 SoC, 7 series FPGAs, and Versal™ ACAP devices. - UG1283
Document_ID
UG1283
Release_Date
2020-12-15
Version
2020.2 English
Revision History
Introduction
Navigating Content by Design Process
Installing Bootgen
Boot Time Security
Boot Image Layout
Zynq-7000 SoC Boot and Configuration
Zynq-7000 SoC Boot Image Layout
Zynq-7000 SoC Boot Header
Zynq-7000 SoC Register Initialization Table
Zynq-7000 SoC Image Header Table
Zynq-7000 SoC Image Header
Zynq-7000 SoC Partition Header
Zynq-7000 SoC Partition Attribute Bits
Zynq-7000 SoC Authentication Certificate
Zynq-7000 SoC Authentication Certificate Header
Zynq-7000 SoC Boot Image Block Diagram
Zynq UltraScale+ MPSoC Boot and Configuration
Zynq UltraScale+ MPSoC Boot Image
Zynq UltraScale+ MPSoC Boot Header
Zynq UltraScale+ MPSoC Boot Header Attribute Bits
Zynq UltraScale+ MPSoC Register Initialization Table
Zynq UltraScale+ MPSoC PUF Helper Data
Zynq UltraScale+ MPSoC Image Header Table
Zynq UltraScale+ MPSoC Image Header
Zynq UltraScale+ MPSoC Partition Header
Zynq UltraScale+ MPSoC Partition Attribute Bits
Zynq UltraScale+ MPSoC Authentication Certificates
Zynq UltraScale+ MPSoC Authentication Certification Header
Zynq UltraScale+ MPSoC Secure Header
Zynq UltraScale+ MPSoC Boot Image Block Diagram
Versal ACAP Boot Image Format
Versal ACAP Boot Header
Boot Header Attributes
Versal ACAP Image Header Table
Versal ACAP Image Header
Versal ACAP Partition Header
Versal ACAP Authentication Certificates
Versal ACAP Authentication Certification Header
Creating Boot Images
Boot Image Format (BIF)
BIF Syntax and Supported File Types
BIF Syntax for Versal ACAP
Attributes
Using Bootgen Interfaces
Bootgen GUI Options
Using Bootgen on the Command Line
Commands and Descriptions
Boot Time Security
Using Encryption
Encryption Process
Decryption Process
Encrypting Zynq-7000 Device Partitions
Encrypting Zynq MPSoC Device Partitions
Operational Key
Rolling Keys
Gray/Obfuscated Keys
Key Generation
Black/PUF Keys
Multiple Encryption Key Files
Encrypting Versal Device Partitions
Rolling Keys
Key Generation
Black/PUF Keys
Meta Header Encryption
Using Authentication
Signing
Verifying
Zynq UltraScale+ MPSoC Authentication Support
NIST SHA-3 Support
Bitstream Authentication Using External Memory
User eFUSE Support with Enhanced RSA Key Revocation
Key Generation
PPK Hash for eFUSE
Versal Authentication Support
Using HSM Mode
Creating a Boot Image Using HSM Mode: PSK is not Shared
Creating a Zynq-7000 SoC Device Boot Image using HSM Mode
Creating a Zynq UltraScale+ MPSoC Device Boot Image using HSM Mode
Creating a Versal Device Boot Image using HSM
Generating the PDI
HSM Mode Steps
FPGA Support
Encryption and Authentication
HSM Mode
Use Cases and Examples
Zynq MPSoC Use Cases
Simple Application Boot on Different Cores
PMU Firmware Load by BootROM
PMU Firmware Load by FSBL
Booting Linux
Encryption Flow: BBRAM Red Key
Encryption Flow: Red Key Stored in eFUSE
Encryption Flow: Black Key Stored in eFUSE
Encryption Flow: Black Key Stored in Boot Header
Encryption Flow: Gray Key Stored in eFUSE
Encryption Flow: Gray Key Stored in Boot Header
Operational Key
Using Op Key to Protect the Device Key in a Development Environment
Single Partition Image
Authentication Flow
BIF File with SHA-3 eFUSE RSA Authentication and PPK0
XIP
Split with "Offset" Attribute
Versal ACAP Use Cases
Bootloader, PMC_CDO
Bootloader, PMC_CDO with Load Address
Enable Checksum for Bootloader
Bootloader, PMC_CDO, PL CDO, NPI
Bootloader, PMC_CDO, PL CDO, NPI, PS CDO, and PS ELFs
AI Engine Configuration and AI Engine Partitions
Appending New Partitions to Existing PDI
RSA Authentication
ECDSA Authentication
AES Encryption
AES Encryption with Key Rolling
AES Encryption with Multiple Key Sources
AES Encryption and Authentication
Replacing PLM from an Existing PDI
BIF Attribute Reference
aarch32_mode
aeskeyfile
a_hwrot
alignment
auth_params
authentication
big_endian
bbram_kek_iv
bh_kek_iv
bh_keyfile
bh_key_iv
bhsignature
blocks
boot_device
bootimage
bootloader
bootvectors
boot_config
checksum
copy
core
delay_handoff
delay_load
destination_cpu
destination_device
early_handoff
efuse_kek_iv
efuse_user_kek0_iv
efuse_user_kek1_iv
encryption
exception_level
familykey
file
fsbl_config
headersignature
hivec
id
image
init
keysrc
keysrc_encryption
load
metaheader
name
offset
parent_id
partition
partition_owner, owner
partition_type
pid
pmufw_image
ppkfile
presign
pskfile
puf_file
reserve
s_hwrot
split
spkfile
spksignature
spk_select
sskfile
startup
trustzone
type
udf_bh
udf_data
xip_mode
Command Reference
arch
authenticatedjtag
bif_help
dual_ospi_mode
dual_qspi_mode
dump
dump_dir
efuseppkbits
encrypt
encryption_dump
fill
generate_hashes
generate_keys
h, help
image
log
nonbooting
o
p
padimageheader
process_bitstream
read
spksignature
split
verify
verify_kdf
w
zynqmpes1
Initialization Pairs and INT File Attribute
CDO Utility
Accessing
Usage
Command Line Options
Address Filter File
Examples
Converting Binary to Source without Annotations
Converting Binary to Source with Annotations
Editing Binary CDO File
Converting Source to Binary
Bootgen Utility
Additional Resources and Legal Notices
Documentation Navigator and Design Hubs
Xilinx Resources
Additional Resources
Please Read: Important Legal Notices