Examples - 2025.1 English - UG1283

Bootgen User Guide (UG1283)

Document ID: UG1283
Release Date: 2025-09-10
Version: 2025.1 English

Introduction
Installing Bootgen
Boot Time Security
Boot Image Layout
Zynq 7000 SoC Boot and Configuration
Zynq 7000 SoC Boot Image Layout
Zynq 7000 SoC Boot Header
Zynq 7000 SoC Register Initialization Table
Zynq 7000 SoC Image Header Table
Zynq 7000 SoC Image Header
Zynq 7000 SoC Partition Header
Zynq 7000 SoC Partition Attribute Bits
Zynq 7000 SoC Authentication Certificate
Zynq 7000 SoC Authentication Certificate Header
Zynq 7000 SoC Boot Image Block Diagram
Zynq UltraScale+ MPSoC Boot and Configuration
Zynq UltraScale+ MPSoC Boot Image
Zynq UltraScale+ MPSoC Boot Header
Zynq UltraScale+ MPSoC Boot Header Attribute Bits
Zynq UltraScale+ MPSoC Register Initialization Table
Zynq UltraScale+ MPSoC PUF Helper Data
Zynq UltraScale+ MPSoC Image Header Table
Zynq UltraScale+ MPSoC Image Header
Zynq UltraScale+ MPSoC Partition Header
Zynq UltraScale+ MPSoC Partition Attribute Bits
Zynq UltraScale+ MPSoC Authentication Certificates
Zynq UltraScale+ MPSoC Authentication Certification Header
Zynq UltraScale+ MPSoC Secure Header
Zynq UltraScale+ MPSoC Boot Image Block Diagram
Versal Adaptive SoC Boot Image Format
Versal Adaptive SoC Boot Header
Versal Adaptive SoC Boot Header Attributes
Versal Adaptive SoC Image Header Table
Image Header Table Attributes
Optional Data
Versal Adaptive SoC Image Header
Versal Adaptive SoC Partition Header
Versal Adaptive SoC Authentication Certificates
Versal Adaptive SoC Authentication Certification Header
Spartan UltraScale+ Boot Image Format
Spartan UltraScale+ Boot Header
Spartan UltraScale+ Boot Header Attributes
Spartan UltraScale+ Authentication Certificate
Spartan UltraScale+ Authentication Header
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Boot Image Format
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Boot Header
Versal AI Edge Gen 2 and Versal Prime Gen 2 Boot Header Attributes
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Image Header Table
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Image Header Table Attributes
Optional Data
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Image Header
Versal AI Edge Gen 2 and Versal Prime Gen 2 Partition Header
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Authentication Certificate
Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Authentication Header
Creating Boot Images
Boot Image Format (BIF)
BIF Syntax and Supported File Types
BIF Syntax for Versal Adaptive SoC
Attributes
Using Bootgen GUI
Launch Bootgen GUI
Bootgen GUI for Zynq 7000 and Zynq UltraScale+ Devices
Using Bootgen GUI Options for Versal Adaptive SoCs
Using Bootgen on the Command Line
Commands and Descriptions
Boot Time Security
Using Encryption
Encryption Process
Decryption Process
Encrypting Zynq 7000 Device Partitions
Encrypting Zynq MPSoC Device Partitions
Operational Key
Rolling Keys
Gray/Obfuscated Keys
Key Generation
Black/PUF Keys
Multiple Encryption Key Files
Encrypting Versal Device Partitions
Rolling Keys
Key Generation
Black/PUF Keys
Meta Header Encryption
Encrypting Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 Device Partitions
Rolling Keys
Key Generation
Black/PUF Keys
Meta Header Encryption
Encrypting Spartan UltraScale+ Device Partitions
Rolling Keys
Black/PUF Keys
Using Authentication
Signing
Verifying
Zynq UltraScale+ MPSoC Authentication Support
NIST SHA-3 Support
Bitstream Authentication Using External Memory
User eFUSE Support with Enhanced RSA Key Revocation
Key Generation
PPK Hash for eFUSE
Versal Authentication Support
Hashing Scheme
Spartan UltraScale+ Authentication Support
Versal AI Edge Series Gen 2 and Versal Prime Gen 2 Authentication Support
Using HSM Mode
Creating a Boot Image Using HSM Mode: PSK is not Shared
Creating a Zynq 7000 SoC Device Boot Image using HSM Mode
Creating a Zynq UltraScale+ MPSoC Device Boot Image using HSM Mode
Creating a Versal Device Boot Image Using HSM
Generating the PDI
HSM Mode Steps
SSI Technology Support
SSI technology Non Secure BIF Example for a Single Slave SLR Device
SSI technology Non Secure BIF Example for a 2 Slave SLR Device
SSI technology Authentication BIF Example for a 3 Slave SLR Device
SSI Technology Encryption BIF Example for a 3 Slave SLR Device
HSM Mode for an SSI Technology Device
FPGA Support
Encryption and Authentication
HSM Mode
HSM Flow with Both Authentication and Encryption
Use Cases and Examples
Zynq MPSoC Use Cases
Simple Application Boot on Different Cores
PMU Firmware Load by BootROM
PMU Firmware Load by FSBL
Booting Linux
Encryption Flow: BBRAM Red Key
Encryption Flow: Red Key Stored in eFUSE
Encryption Flow: Black Key Stored in eFUSE
Encryption Flow: Black Key Stored in Boot Header
Encryption Flow: Gray Key Stored in eFUSE
Encryption Flow: Gray Key Stored in Boot Header
Operational Key
Using Op Key to Protect the Device Key in a Development Environment
Single Partition Image
Authentication Flow
BIF File with SHA-3 eFUSE RSA Authentication and PPK0
XIP
Split with "Offset" Attribute
Versal Adaptive SoC Use Cases
Bootloader, PMC_CDO
Bootloader, PMC_CDO with Load Address
Enable Checksum for Bootloader
Bootloader, PMC_CDO, PL CDO, NPI
Bootloader, PMC_CDO, PL CDO, NPI, PS CDO, and PS ELFs
AI Engine Configuration and AI Engine Partitions
Appending New Partitions to Existing PDI
RSA Authentication Example
ECDSA Authentication Example
AES Encryption Example
AES Encryption with Key Rolling Example
AES Encryption with Multiple Key Sources Example
AES Encryption and Authentication Example
Replacing PLM from an Existing PDI
Replace PLM and PMC CDO in SSI Technology PDIs
BIF Example for emmc/mmc as Secondary Boot Device with Multiple File System Partitions
Primary Boot BIF Pointing to First Filesystem Partition in emmc/mmc
Primary Boot BIF Pointing to Other Filesystem Partitions in emmc/mmc
PL-only Design
Spartan UltraScale+ Use Cases
Non-Secure BIF with PUF
PDI Generation with BIF Example
Versal AI Edge Gen 2 and Versal Prime Gen 2 Use Cases
PDI Generation with BIF Example
Golden NoC CDO Support
BIF Attribute Reference
aarch32_mode
aeskeyfile
alignment
auth_params
authentication
big_endian
bbram_kek_iv
bh_kek_iv
bh_keyfile
bh_key_iv
bhsignature
blocks
boot_config
boot_device
bootimage
bootloader
bootvectors
checksum
copy
core
delay_auth
delay_handoff
delay_load
destination_cpu
destination_device
dpacm_enable
early_handoff
efuse_kek_iv
efuse_user_kek0_iv
efuse_user_kek1_iv
encryption
exception_level
familykey
file
fsbl_config
headersignature
hivec
id
image
imagestore
init
keylife
keysrc
keysrc_encryption
load
metaheader
name
offset
optionaldata
parent_id
partition
partition_owner, owner
pcr_mindex
pid
pmufw_image
ppkfile
presign
pskfile
puf_file
reserve
revoke_id
split
spkfile
spksignature
spk_select
spk_revoke_id
sskfile
startup
trustzone
type
udf_bh
udf_data
userkeys
xip_mode
Command Reference
arch
authenticatedjtag
bif_help
dual_ospi_mode
dual_qspi_mode
dump
dump_dir
efuseppkbits
enable_auth_opt
encrypt
encryption_dump
fill
generate_hashes
generate_keys
h, help
image
log
nonbooting
o
overlay_cdo
p
padimageheader
process_bitstream
read
spksignature
split
verify
verify_kdf
w
zynqmpes1
Initialization Pairs and INT File Attribute
CDO Utility
Accessing
Usage
Command Line Options
Address Filter File
Examples
Converting Binary to Source without Annotations
Converting Binary to Source with Annotations
Editing Binary CDO File
Converting Source to Binary
Design Advisories for Bootgen
Troubleshooting Bootgen Error Codes
Bootgen Supported Devices
Encryption and Authentication Supported Features
Device Specific Special Features
Additional Resources and Legal Notices
Finding Additional Documentation
Support Resources
References
Revision History
Please Read: Important Legal Notices

Back to home page