Sample BIF for a Fielded System - 2025.1 English - UG1209

The following BIF file is an example for a fielded system. For this BIF file to work on a board, it requires the RSA_EN, PPK0 Digest, black AES key and PUF helper data to all be programmed in the eFUSEs. Because programming these eFUSEs severely limits the use of the device or board for testing and debugging, it is only included here as a reference. It is not part of the tutorial.

The following changes are made to the final generation.bif file reach the following result:

1. Change from PUF boot header mode to PUF eFUSE mode.

   1. Change the keysrc_encryption attribute to efuse_blk_key.

   2. Remove the bh_keyfile and puf_file lines.

   3. Remove the puf4kmode and pufhd_bh attributes from the fsbl_config line.

2. Change from boot header authentication to eFUSE authentication. Remove the bh_auth_enable attribute from the fsbl_config line.

   //arch = zynqmp; split = false; format = BIN; key_part_name = zcu9eg
   the_ROM_image:
   {
   [pskfile]C:\edt\secure_boot_sd\bootgen_files\psk0.pem
   [sskfile]C:\edt\secure_boot_sd\bootgen_files\ssk0.pem
   [auth_params]spk_id = 0; ppk_select = 0
   [keysrc_encryption]bh_blk_key
   [bh_key_iv]black_iv.txt
   [bh_keyfile]black_key.txt
   [puf_file]helperdata.txt
   [fsbl_config]a53_x64, bh_auth_enable, opt_key, puf4kmode,shutter=0x0100005E,pufhd_bh
   [bootloader, encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.nky, blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.elf
   [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\pmufw.nky, destination_cpu = pmu, blocks =1728(*)]C:\edt\secure_boot_sd\bootgen_files\pmufw.elf
   [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.nky, destination_device= pl, blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.bit
   [authentication = rsa, destination_cpu = a53-0, exception_level = el-3,trustzone]C:\edt\secure_boot_sd\bootgen_files\bl31.elf
   [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.nky, destination_cpu = r5-0,blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.elf
   [authentication = rsa, destination_cpu = a53-0, exception_level = el-2]C:\edt\secure_boot_sd\bootgen_files\u-boot.elf
   [authentication = rsa, load = 0x2000000, destination_cpu = a53-0]C:\edt\secure_boot_sd\bootgen_files\image.ub
   }