System Example Using the Vitis IDE Create Boot Image Wizard - 2024.2 English - UG1209

The previous sections enabled the various security features (authentication, confidentiality, DPA protections, and black key storage) by hand editing the BIF file. This section performs the same operations, but uses the Bootgen Wizard as a starting point. The Bootgen Wizard creates a base BIF file, and then adds the additional security features that are not supported by the wizard using a text editor.

1. Change directory to the bootgen_files directory.

   cd C:\edt\secure_boot_sd\bootgen_files
   

2. Copy the below data from the previous example to this example.

   cp ../keys/*nky .
   cp ../keys/*pem .
   cp ../keys/black_iv.txt .
   cp ../keys/helperdata.txt .
   cp ../keys/*.elf .
   cp ../keys/edt_zcu102_wrapper.bit .
   cp ../keys/image.ub .
   cp ../keys/black_key.txt.
   

3. Click Programs → Xilinx Design Tools → Vitis <version number> → Vitis 2024.2 to launch the Vitis IDE.

4. Click Vitis → Create Boot Image from the menu bar to launch the Create Boot Image wizard.

5. Select Zynq UltraScale+ as the Architecture.

6. Enter the Output BIF file path as C:\edt\secure_boot_sd\bootgen_files\design_bh_bkey_keyrolling.bif.

7. Select BIN as the output format.

8. Enter the output path C:\edt\secure_boot_sd\bootgen_files\BOOT.bin.

9. Enable authentication.

   1. Check the Use Authentication check box.

   2. Browse to select the psk0.pem file for the PSK File and the ssk0.pem for the SSK File.

   3. Ensure PPK select is 0.

   4. Enter SPK ID as 0.

   5. Check the Use BH Auth check box.

      

10. Enable encryption.

    1. Check the Use Encryption check box.

    2. Provide the part name as zcu9eg.

    3. Check the Operational Key check box.

       

11. Add the FSBL binary to the boot image.

    1. Click the Add button.

    2. Use the browse button to select the fsbl.elf file.

    3. Make sure the partition type is bootloader and the destination CPU is a53-0.

    4. Change the authentication to RSA.

    5. Change the encryption to AES.

    6. Browse to the fsbl_a53.nky file that was generated earlier and add the key file.

    7. Click OK.

       

12. Add the PMU firmware binary to the boot image.

    1. Click the Add button.

    2. Use the browse button to select the pmufw.elf file.

    3. Make sure the partition type is datafile.

    4. Change the destination CPU to PMU.

    5. Change the authentication to RSA.

    6. Change the encryption to AES.

    7. Add the pmufw.nky file as the key file.

    8. Click OK.

       

13. Add the PL bitstream to the boot image.

    1. Click the Add.

    2. Use the browse button to select the edt_zcu102_wrapper.bit file.

    3. Make sure the partition type is datafile.

    4. Make sure the destination device is PL.

    5. Change the authentication to RSA.

    6. Change the encryption to AES.

    7. Add the edt_zcu102_wrapper.nky file as the key file.

    8. Click OK.

       

14. Add the Trusted Firmware-A (TF-A) binary to the image.

    1. Click the Add button.

    2. Use the browse button to select the bl31.elf file.

    3. Make sure the partition type is datafile.

    4. Make sure the destination CPU is A53 0.

    5. Change the authentication to RSA.

    6. Make sure the encryption is none.

    7. Make sure the exception level is EL3 and click Enable TrustZone.

    8. Click OK.

       

15. Add the R5 software binary to the boot image.

    1. Click the Add button.

    2. Use the browse button to select the tmr_psled_r5.elf file.

    3. Make sure the partition type is datafile.

    4. Make sure the destination CPU is R5 0.

    5. Change the authentication to RSA.

    6. Change the encryption to AES.

    7. Add the tmr_psled_r5.nky file as the key file.

    8. Click OK.

       

16. Add the U-Boot software binary to the boot image.

    1. Click the Add button.

    2. Use the browse button to select the u-boot.elf file.

    3. Make sure the partition type is datafile.

    4. Make sure the destination CPU is A53 0.

    5. Change the authentication to RSA.

    6. Make sure that encryption is none.

    7. Change the exception level to EL2.

    8. Click OK.

    

17. Add the Linux image to the boot image.

    1. Click the Add button.

    2. Use the browse button to select the image.ub file.

    3. Make sure the partition type is datafile.

    4. Make sure the destination CPU is A53 0.

    5. Change the authentication to RSA.

    6. Make sure that the encryption is none.

    7. Update the load field to 0x2000000.

    8. Click OK.

       

18. Click Create image.

    

19. The design_bh_bkey_keyrolling.bif file should look similar to the following:

    //arch = zynqmp; split = false; format = BIN; key_part_name = zcu9eg
    the_ROM_image:
    {
    [pskfile]C:\edt\secure_boot_sd\bootgen_files\psk0.pem
    [sskfile]C:\edt\secure_boot_sd\bootgen_files\ssk0.pem
    [auth_params]spk_id = 0; ppk_select = 0
    [keysrc_encryption]efuse_red_key
    [fsbl_config]bh_auth_enable, opt_key
    [bootloader, encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.nky]C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\pmufw.nky, destination_cpu = pmu]C:\edt\secure_boot_sd\bootgen_files\pmufw.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.nky, destination_device = pl]C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.bit
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-3, trustzone]C:\edt\secure_boot_sd\bootgen_files\bl31.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.nky, destination_cpu =r5-0]C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.elf
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-2]C:\edt\secure_boot_sd\bootgen_files\u-boot.elf
    [authentication = rsa, load = 0x2000000, destination_cpu = a53-0]C:\edt\secure_boot_sd\bootgen_files\image.ub
    }
    

    Note

    This BIF file is still missing several security features that are not supported by the Create Boot Image wizard. These are features are key rolling and black key store.

20. Add black key store by changing the keysrc_encryption and adding the other additional items so that the BIF file looks like the following:

    the_ROM_image:
    {
    [pskfile]C:\edt\secure_boot_sd\bootgen_files\psk0.pem
    [sskfile]C:\edt\secure_boot_sd\bootgen_files\ssk0.pem
    [auth_params]spk_id = 0; ppk_select = 0
    [keysrc_encryption]bh_blk_key
    [bh_key_iv]black_iv.txt
    [bh_keyfile]black_key.txt
    [puf_file]helperdata.txt
    [fsbl_config]a53_x64, bh_auth_enable, opt_key,puf4kmode,shutter=0x0100005E,pufhd_bh
    [bootloader, encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.nky]C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\pmufw.nky, destination_cpu = pmu]C:\edt\secure_boot_sd\bootgen_files\pmufw.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.nky, destination_device= pl]C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.bit
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-3, trustzone]C:\edt\secure_boot_sd\bootgen_files\bl31.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.nky, destination_cpu = r5-0]C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.elf
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-2]C:\edt\secure_boot_sd\bootgen_files\u-boot.elf
    [authentication = rsa, load = 0x2000000, destination_cpu = a53-0]C:\edt\secure_boot_sd\bootgen_files\image.ub
    }
    

21. Enable key rolling by adding the block attributes to the encrypted partitions. The updated BIF file should now look like the following:

    //arch = zynqmp; split = false; format = BIN; key_part_name = zcu9eg
    the_ROM_image:
    {
    [pskfile]C:\edt\secure_boot_sd\bootgen_files\psk0.pem
    [sskfile]C:\edt\secure_boot_sd\bootgen_files\ssk0.pem
    [auth_params]spk_id = 0; ppk_select = 0
    [keysrc_encryption]bh_blk_key
    [bh_key_iv]black_iv.txt
    [bh_keyfile]black_key.txt
    [puf_file]helperdata.txt
    [fsbl_config]a53_x64, bh_auth_enable, opt_key, puf4kmode,shutter=0x0100005E,pufhd_bh
    [bootloader, encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\fsbl_a53.nky, blocks = 1728(*)]C:\edt  \secure_boot_sd\bootgen_files\fsbl_a53.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\pmufw.nky, destination_cpu = pmu, blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\pmufw.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.nky, destination_device = pl, blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\edt_zcu102_wrapper.bit
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-3, trustzone]C:\edt\secure_boot_sd\bootgen_files\bl31.elf
    [encryption = aes, authentication = rsa, aeskeyfile = C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.nky, destination_cpu = r5-0, blocks = 1728(*)]C:\edt\secure_boot_sd\bootgen_files\tmr_psled_r5.elf
    [authentication = rsa, destination_cpu = a53-0, exception_level = el-2]C:\edt\secure_boot_sd\bootgen_files\u-boot.elf
    [authentication = rsa, load = 0x2000000, destination_cpu = a53-0]C:\edt\secure_boot_sd\bootgen_files\image.ub
    }
    

22. Generate the boot image by running the following command. Note that the - encryption_dump flag has been added. This flag causes the log file aes_log.txt to be created. The log file details all encryption operations that were used. This allows you to see which keys and IVs were used on which sections of the boot image.

bootgen -p zcu9eg -arch zynqmp -image design_bh_bkey_keyrolling.bif -w -o BOOT.bin -encryption_dump