The following table lists the Bootgen attributes. Each attribute has a link to a longer description in the left column with a short description in the right column. The architecture name indicates which Xilinx® devices uses that attribute:
-
zynq: Zynq-7000 SoC device -
zynqmp: Zynq® UltraScale+™ MPSoC device -
fpga: Any 7 series and above devices -
versal: Versal® ACAP
| Option/Attribute | Description | Used By |
|---|---|---|
| aarch32_mode | Specifies the binary file that is to be executed in 32-bit mode. |
|
| aeskeyfile <aes_key_filepath> | The path to the AES keyfile. The keyfile contains the AES key used to encrypt the partitions. The contents of the key file needs to written to eFUSE or BBRAM. If the key file is not present in the path specified, a new key is generated by Bootgen, which is used for encryption. For example: If encryption is selected for bitstream in the BIF file, the output is an encrypted bitstream. |
|
| alignment <byte> | Sets the byte alignment. The partition will be padded to be aligned to a multiple of this value. This attribute cannot be used with offset. |
|
| auth_params <options> | Extra options for authentication:
|
|
| authentication <option> | Specifies the partition to be authenticated.
|
|
|
bbram_kek_iv <filename> |
Specifies the IV that is used to encrypt the
corresponding key. bbram_kek_iv is
valid with keysrc=bbram_blk_key. |
|
|
bh_kek_iv <filename> |
Specifies the IV that is used to encrypt the
corresponding key. bh_kek_iv is valid
with keysrc=bh_blk_key. |
|
| bh_key_iv <filename> |
Initialization vector used when decrypting the obfuscated key or a black key. |
|
| bh_keyfile <filename> |
256-bit obfuscated key or black key to be stored in
the Boot Header. This is only valid when Note: Obfuscated key is not supported for
Versal devices.
|
|
| bhsignature <filename> | Imports Boot Header signature into authentication certificate. This can be used if you do not want to share the secret key PSK. You can create a signature and provide it to Bootgen. The file format is bootheader.sha384.sig. |
|
| big_endian | Specifies the binary file is in big endian format. |
|
| blocks <block sizes> | Specifies block sizes for key-rolling feature in Encryption. Each module is encrypted using its own unique key. The initial key is stored at the key source on the device, while keys for each successive blocks are encrypted (wrapped) in the previous module. |
|
| boot_config <options> | This attribute specifies the parameters that are used to configure the boot image. |
|
| boot_device <options> | Specifies the secondary boot device. Indicates the
device on which the partition is present. Options are:
Note: These options are supported for
various devices in Bootgen. For a list of secondary boot options,
see the
Versal
ACAP System Software Developers Guide (UG1304)
or the
Zynq
UltraScale+ MPSoC: Software Developers Guide (UG1137).
For hardware/register/interface information and primary boot modes,
refer to the corresponding TRM, such as the
Zynq
UltraScale+ Device Technical Reference Manual (UG1085), the
Versal
ACAP Technical Reference Manual (AM011), or the
Versal
ACAP Register Reference (AM012).
|
|
| bootimage <filename.bin> | Specifies that the listed input file is a boot image that was created by Bootgen. |
|
| bootloader <partition> |
Specifies the partition is a bootloader (FSBL/PLM). This attribute is specified along with other partition BIF attributes. |
|
| bootvectors <vector_values> | Specifies the vector table for execute in place (XIP). |
|
| checksum <options> | Specifies that the partition needs to be
checksummed. This option is not supported along with more secure
features like authentication and encryption. Checksum algorithms are:
Note:
Zynq devices do not support checksum for bootloaders.
The following devices do support checksum operation for
bootloaders:
|
|
| copy <address> | This attribute specifies that the image is to be copied to memory at specified address. |
|
| core <options> | This attributes specifies which core executes the
partition. The options for
Versal®
ACAP are:
|
|
| delay_handoff | This attribute specifies that the hand-off to the subsystem/image is delayed. |
|
| delay_load | This attribute specifies that the loading of the subsystem/image is delayed. |
|
| destination_device <device_type> | This specifies if the partition is targeted for PS
or PL. The options are:
|
|
| destination_cpu <device_core> | Specifies the core on which the partition should be executed.
|
|
| early_handoff | This flag ensures that the handoff to applications that are critical immediately after the partition is loaded; otherwise, all the partitions are loaded sequentially first, and then the handoff also happens in a sequential fashion. |
|
| efuse_kek_iv <filename> | Specifies the IV that is used to encrypt the
corresponding key. efuse_kek_iv is
valid with keysrc=efuse_blk_key. |
|
| efuse_user_kek0_iv <filename> | Specifies the IV that is used to encrypt the
corresponding key. efuse_user_kek0_iv
is valid with keysrc=efuse_user_blk_key0. |
|
| efuse_user_kek1_iv <filename> | Specifies the IV that is used to encrypt the
corresponding key. efuse_user_kek1_iv
is valid with keysrc=efuse_user_blk_key1. |
|
| encryption <option> | Specifies the partition to be encrypted. Encryption algorithms are: zynq uses AES-CBC, while
zynqmp and Versal use AES-GCM.
The partition
options are:
|
|
| exception_level <options> | Exception level for which the core should be
configured. Options are:
|
|
| familykey <key file> | Specifies the family key. |
|
| file <path/to/file> | This attribute specifies the file for creating the partition. |
|
| fsbl_config <options> | Specifies the sub-attributes used to configure the
bootimage. Those sub-attributes are:
|
|
| headersignature <signature_file> | Imports the header signature into an Authentication Certificate. This can be used in case the user does not want to share the secret key. The user can create a signature and provide it to Bootgen. |
|
| hivec | Specifies the location of exception vector table as
hivec (Hi-Vector). The default value is lovec (Low-Vector). This is
applicable with A53 (32 bit) and R5 cores only.
|
|
| id <id> | This attribute specifies the following IDs based on
the place its defined:
|
|
| image | Defines a subsystem/image. |
|
| init <filename> | Register initialization block at the end of the bootloader, built by parsing the init (.int) file specification. A maximum of 256 address-value init pairs are allowed. The init files have a specific format. |
|
| keysrc | Specifies key source for encryption for Versal ACAP. The keysrc can be
specified for individual partitions.
|
|
| keysrc_encryption | Specifies the key source for encryption. The keys are:
|
|
| load <partition_address> | Sets the load address for the partition in memory. |
|
| metaheader | This attribute is used to define encryption and authentication attributes for meta headers like keys, key sources, and so on. |
|
| name <name> | This attribute specifies the name of the image/subsystem. |
|
| offset <offset> | Sets the absolute offset of the partition in the boot image. |
|
| parent_id | This attribute specifies the ID for the parent PDI. This is used to identify the relationship between a partial PDI and its corresponding boot PDI. |
|
| partition | This attribute is used to define a partition. It is an optional attribute to make the BIF short and readable. |
|
| partition_owner, owner <option> | Owner of the partition which is responsible to load
the partition. Options are: For Zynq/Zynq UltraScale+ MPSoC:
For Versal:
|
|
| pid <ID> | Specifies the Partition ID. PID can be a 32-bit value (0 to 0xFFFFFFFF). |
|
| pmufw_image <image_name> | PMU firmware image to be loaded by BootROM, before loading the FSBL. |
|
| ppkfile <key filename> | Primary Public Key (PPK). Used to authenticate
partitions in the boot image. See Using Authentication for more information. |
|
| presign <sig_filename> | Partition signature (.sig) file. |
|
| pskfile <key filename> | Primary Secret Key (PSK). Used to authenticate
partitions in the boot image. See the Using Authentication for more information. |
|
| puf_file <filename> | PUF helper data file. PUF is used with black key as encryption key source. PUF helper data is of 1544 bytes.1536 bytes of PUF HD + 4 bytes of HASH + 3 bytes of AUX + 1 byte alignment. |
|
| reserve <size in bytes> | Reserves the memory, which is padded after the partition. |
|
| spk_select <SPK_ID> | Specify an SPK ID in user eFUSE. |
|
| spkfile <filename> | Keys used to authenticate partitions in the boot image. See Using Authentication for more information. |
|
| spksignature <signature_file> | Imports the SPK signature into an Authentication Certificate. See Using Authentication. This can be used in case the user does not want to share the secret key PSK, The user can create a signature and provide it to Bootgen. |
|
| split <options> | Splits the image into parts, based on the mode.
Split options are:
Along with the split mode, output format can also be specified as bin or mcs. Note: The option
split mode normal is same as the command line option split. This
command line option is deprecated. Split ulaveboot is supported only
for Zynq UltraScale+ MPSoC.
|
|
| sskfile <key filename> | Secondary Secret Key (SSK) key authenticates partitions in the Boot Image. The primary keys authenticate the secondary keys; the secondary keys authenticate the partitions. |
|
| startup <address> | Sets the entry address for the partition, after it is loaded. This is ignored for partitions that do not execute. |
|
| trustzone <option> |
The trustzone options are:
|
|
| type <options> | This attribute specifies the type of partition. The
options are:
|
|
| udf_bh <data_file> | Imports a file of data to be copied to the user defined field (UDF) of the Boot Header. The UDF is provided through a text file in the form of a hex string. Total number of bytes in UDF are: zynq = 76 bytes; zynqmp= 40 bytes. |
|
| udf_data <data_file> | Imports a file containing up to 56 bytes of data into user defined field (UDF) of the Authentication Certificate. |
|
| userkeys <filename> | The path to the user keyfile. |
|
| xip_mode | Indicates eXecute In Place (XIP) for FSBL to be executed directly from QSPI flash. |
|