- Use the PACSign tool to create a root entry hash bitstream.
- Use the fpgasupdate tool to program the bitstream onto the Intel® FPGA PAC.
$ sudo fpgasupdate [--log-level=<level>] file [bdf]
All key operations are done using PACSign. PACSign is a standalone tool that is not required to be run on a machine with the Intel FPGA PAC installed. Key creation, signing, and cancellation bitstream creation are not runtime operations and can be performed at any time. The signing process prepends the signature to the AFU image file. The TCM RoT does not need access to the HSM at any point to verify a signature.