Security User Guide: Intel® Programmable Acceleration Card with Intel® Arria® 10 GX FPGA

ID 683453
Date 3/06/2020
Public
Document Table of Contents

3.7.1.2.2. Example: Creating an Unsigned .aocx File Using OpenSSL Manager

Command syntax:

$AOCL_BOARD_PACKAGE_ROOT/linux64/libexec/sign_aocx.sh -H openssl_manager \
-i <path_to_input_file/input_filename.aocx> -r NULL -k NULL \
-o <path_to_output_file/output_filename.aocx>

Because no root key or code signing key is provided, the script asks if you would like to create unsigned bitstream, as shown below. Type Y to accept an unsigned bitstream.

No root key specified.  Generate unsigned bitstream? Y = yes, N = no: Y
No CSK specified.  Generate unsigned bitstream? Y = yes, N = no: Y

Example output:

$ $AOCL_BOARD_PACKAGE_ROOT/linux64/libexec/sign_aocx.sh -H openssl_manager \
-i vector_add.aocx -r NULL -k NULL -o unsigned_vector_add.aocx

The script assumes the PACsign and Intel Acceleration Stack environment is setup. If not run the command : <stack_installation_path>/init_env.sh
hsm_manager=openssl_manager
aocx filename/path=vector_add.aocx
root_public_key=NULL
csk_public_key=NULL
output filename/path=unsigned_vector_add.aocx
null=1
openssl hsm_manager_options=openssl_manager 
input path =.
input filename =vector_add.aocx
output path =.
output filename =unsigned_vector_add.aocx
Extracted the filename as unsigned_vector_add 
1. Extracted the bin from the aocx 
2. Extracted the gzip compressed GBS file from the .bin
3. Uncompressed .gz it to get the GBS file
Initiating PACSign tool to sign the GBS. This process will take a couple of minutes...
Creating unsigned aocx file by signing a NULL key 
No root key specified.  Generate unsigned bitstream? Y = yes, N = no: Y
No CSK specified.  Generate unsigned bitstream? Y = yes, N = no: Y
2020-01-13 17:57:17,052 - PACSign.log - WARNING - Bitstream is already signed - removing signature blocks
4. Signed the GBS 
5. Compressed the gbs file 
6. Added the signed gzip file to fpga.bin 
7. Added the fpga.bin file back into aocx file
The signed file unsigned_vector_add.aocx has been generated. Use the command aocl program <device_name> <filename>.aocx to program it on the FPGA card

Did you find the information on this page useful?

Characters remaining:

Feedback Message