The programmable device image (PDI) generation is provided with the Vivado tools. Both encrypted as well as non-encrypted PDI can be generated. For AES PDI encryption, select the option to enable encryption, and specify a 256-bit key as an input to the Vivado PDI generation tool.
After the PDI and key are generated, the encryption key can be loaded onto a device through the JTAG interface. The Vivado device programmer can accept the key file as an input and program the device with the key through JTAG, using a supported AMD programming cable. The key can be programmed into one-time-programmable eFUSE bits. After programming, a CRC can be applied to verify proper programming of the key, but the key itself cannot be read back. The encryption key itself can be encrypted using the PUF or a fixed key that is never visible in the device.
After the device has been programmed with the correct encryption key, the device can be configured with an encrypted PDI. After configuration with an encrypted PDI, it is not possible to read the configuration memory.
While the device holds an encryption key, a non-encrypted PDI can be used to
configure the device only after PROGRAM_B or power-on reset (after a
power cycle) is asserted, thus clearing out the configuration memory. In this case the
key is ignored. The encryption key cannot be read out of the device if a non-encrypted
PDI is programmed, preventing the use of Trojan Horse PDI to defeat the FPGA encryption
scheme. If the device is provisioned for S-HWRoT, it will only configure from an
encrypted PDI.
An encrypted PDI can be delivered through any configuration interface: JTAG,
serial, SPI, OSPI, and SelectMAP. PDI can be created with both compression and
encryption. After configuration, the device cannot be reconfigured without toggling the
PROGRAM_B pin, cycling power, or issuing the
SYS_RST instruction. After configuration, the device cannot be reconfigured without
resetting the device by toggling the PROGRAM_B, issuing
a JTAG instruction SYS_RST, or cycling the power. A mismatch between the key in the
encrypted PDI and the key stored in the device causes configuration to fail with the
INIT_B pin driving Low.