authjtag_config { ... } - authjtag_config { ... } - 2026.1 English - UG1283

Syntax

```
authjtag_config
{
    revoke_id     = <hex>
    spk_revoke_id = <hex>
    device_dna    = <16-byte hex string>
    jtag_timeout  = <hex>
    authjtag_sign = <signature file>
}
```

Description

Specifies the attributes for the Authenticated JTAG message generated by the-authenticatedjtag command-line option. The Auth JTAG message is signed with the BIF-rootpskfile/sskfile; the corresponding ppkfile/spkfile are embedded in the message. Per-partition key overrides do not affect the Auth JTAG message — to change the keys used, change the BIF-root ppkfile/pskfile/spkfile/sskfile.

For Versal AI Edge Series Gen 2 and Versal Prime Series Gen 2, both PPK and SPK are always embedded in the Auth JTAG message.

The options are:

revoke_id

Revocation ID for the Auth JTAG message itself. Default 0 (a warning is logged when omitted). Valid range 0–255.

Note: For Spartan UltraScale+, the valid range is 0–95.

spk_revoke_id

Revocation ID for the SPK in the Auth JTAG message. Valid range0–255. For Spartan UltraScale+, the valid range is 0–95.

Note: This attribute applies only to Versal AI Edge Series Gen 2, Versal Prime Series Gen 2, and Spartan UltraScale+. It is not applicable to Versal adaptive SoC.

device_dna

Device DNA the message is bound to. Must be a 16-byte (32 hex characters) value. When set, the corresponding mask bit in the Attributes word of the Auth JTAG message is set.

jtag_timeout

32-bit JTAG timeout value placed in the Auth JTAG message.

authjtag_sign

Pre-computed Auth JTAG message signature file. Used by the HSM /offline-signing flow when the SSK is not available on the build host. See Versal Authenticated JTAG HSM Flow for details.

Supported architecture: versal, versal_2ve_2vm, spartanup.

See authenticatedjtag in Command Reference.

Examples

Standalone Auth JTAG BIF (no boot image):

```
all:
{
    pskfile = primary.lms.prv
    ppkfile = primary.lms.pub
    sskfile = secondary.lms.prv
    spkfile = secondary.lms.pub

    authjtag_config
    {
        revoke_id    = 0x23
        device_dna   = 112233445566778899AABBCCDDEEFF11
        jtag_timeout = 0x11223344
    }
}
```

Command:

```
bootgen -arch versal_2ve_2vm -image authjtag.bif \
        -authenticatedjtag lms-sha256 authJtag-lms-sha256.bin
```

Boot BIF with authjtag_config (produces both BOOT.bin and the Auth JTAG image in one invocation):

```
new_bif:
{
    id_code           = 0x14ca8093
    extended_id_code  = 0x01
    id                = 0x2

    pskfile = primary.lms.prv
    ppkfile = primary.lms.pub
    sskfile = secondary.lms.prv
    spkfile = secondary.lms.pub

    authjtag_config
    {
        revoke_id    = 0x23
        device_dna   = 112233445566778899AABBCCDDEEFF11
        jtag_timeout = 0x11223344
    }

    image
    {
        name = pmc_subsys
        id   = 0x1c000001
        partition { id = 0x01, type = bootloader, authentication = lms-sha256, file = plm.elf }
        partition { id = 0x09, type = pmcdata, load = 0xf2000000, file = pmc_data.cdo }
    }
}
```

Command:

```
bootgen -arch versal_2ve_2vm -image boot.bif -w -o BOOT.bin \
        -authenticatedjtag lms-sha256 authJtag-lms-sha256.bin
```