Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 HSM Flow Support - Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2 HSM Flow Support - 2026.1 English - UG1283

Test Procedure

Stage 0

Bootgen runs on the build host with -generate_hashes and writes one padded SHA file per item that needs an HSM signature.

Stage 1

The HSM signs every hash file (Bootgen is not used).

Stage 2

Bootgen runs again on the build host, consumes the .sig files returned by the HSM, and assembles the final PDI.

STAGE 0 -- Generate the hash files

stage0.bif (minimum HSM flow: authentication only, single image)

new_bif:
{
id_code = 0x04E88093
extended_id_code = 0x01
id = 0x2
boot_config {smap_width=32}
ppkfile = primary.hss.pub
spkfile = secondary.hss.pub
image
{	
name = pmc_subsys
id = 0x1c000001
partition
{
id = 0x01
type = bootloader
authentication = hss-shake256
file = plm.elf
}
partition
{
id = 0x09
type = pmcdata, load = 0xf2000000
file = pmc_data.cdo
}
}
image
{
name = lpd, id = 0x4210002
partition { id = 0x0C, type = cdo, authentication = hss-shake256,
file = lpd_data.cdo }
partition { id = 0x0B, core = asu, authentication = hss-shake256,
file = psm_fw.elf }
}
image
{
name = pl_cfi, id = 0x18700000
partition { id = 0x03, type = cdo, authentication = hss-shake256,
file = xpio_pad_markers.rcdo }
partition { id = 0x05, type = cdo, authentication = hss-shake256,
file = xpio_pad_markers.rnpi }
}
image
{
name = fpd, id = 0x420c003
partition { id = 0x08, type = cdo, authentication = hss-shake256,
file = lpd_data.cdo }
}
image
{
id = 0x1c000000
partition { core=a72-0, exception_level = el-3, trustzone,
authentication = hss-shake256, file=atf.elf }
partition { core=a72-0, exception_level = el-2, authentication =
hss-shake256, file=u-boot.elf }
}
}

Command:

 bootgen -arch versal_2ve_2vm -image stage0.bif -w on \
            -o pdi_stage0.bin -generate_hashes -log trace

STAGE 1 -- HSM signs each hash file (Bootgen is not used)

Take the .sha384 files produced in Stage 0 to the HSM. The HSM signs each one and returns a corresponding .sig file.

After Stage 1 there is one <file>.sig for every <file> produced in Stage 0.

STAGE 2 -- Assemble the final signed PDI

stage2.bif (same partition list as stage0.bif, plus four signature
attributes pointing to the .sig files returned by the HSM)
new_bif:
{
id_code = 0x04E88093
extended_id_code = 0x01
id = 0x2
boot_config {smap_width=32}
ppkfile = primary.hss.pub
spkfile = secondary.hss.pub
image
{
name = pmc_subsys
id = 0x1c000001
partition
{
id = 0x01
type = bootloader
authentication = hss-shake256
presign = plm.shake256.sig
spksignature = spk.shake256.sig
file = plm.elf
}
partition
{
id = 0x09
type = pmcdata, load = 0xf2000000
file = pmc_data.cdo
}
}
image
{
name = lpd, id = 0x4210002
partition { id = 0x0C, type = cdo, authentication = hss-shake256,
presign = lpd.shake256.sig, spksignature = spk.shake256.sig, file
= lpd_data.cdo }
partition { id = 0x0B, core = asu, authentication = hss-shake256,
file = psm_fw.elf }
}
image
{
name = pl_cfi, id = 0x18700000
partition { id = 0x03, type = cdo, authentication = hss-shake256,
file = xpio_pad_markers.rcdo }
partition { id = 0x05, type = cdo, authentication = hss-shake256,
file = xpio_pad_markers.rnpi }
}
image
{
name = fpd, id = 0x420c003
partition { id = 0x08, type = cdo, authentication = hss-shake256,
file = lpd_data.cdo }
}
image
{
id = 0x1c000000
partition { core=a72-0, exception_level = el-3, trustzone,
authentication = hss-shake256, file=atf.elf }
partition { core=a72-0, exception_level = el-2, authentication =
hss-shake256, file=u-boot.elf }
}
}

Command:

bootgen -arch versal_2ve_2vm -image stage2.bif -w on \
            -o final.pdi -log trace

Enabling Encryption

Encryption is performed by Bootgen on the build host during Stage 0; the boot ROM verifies each partition's signature over the encrypted bytes, so the hashes written by Stage 0 already cover the encrypted data. Stage 1 is unchanged.

Add these lines to the metaheader { } block in BOTH stage0.bif and stage2.bif.

encryption = aes,
    keysrc     = bbram_red_key,
    aeskeyfile = encr_keys/metaheader.nky,
    dpacm_enable

Add these lines to EVERY partition { } block in BOTH stage0.bif and stage2.bif.

encryption = aes,
    keysrc     = bbram_red_key,
    aeskeyfile = encr_keys/<partition>.nky,
    dpacm_enable

No other change. The same Stage 0 command writes the encrypted partitions alongside the same set of hash files; the same Stage 1 signing operations produce the same .sig files; the same Stage 2 command assembles the final encrypted-and-authenticated PDI.