Intel® Stratix® 10 Device Security User Guide

ID 683642
Date 12/15/2021
Public
Download
Document Table of Contents

4.1. Using SDM Provision Firmware

The Intel® Quartus® Prime Programmer automatically creates and loads a factory default helper image when you select the initialize operation and a command to program something other than a configuration bitstream.

Depending on the programming command specified, the factory default helper image is one of two types:
  • Provisioning helper image—consists of one bitstream section containing the SDM provisioning firmware.
  • QSPI helper image—consists of two bitstream sections, one containing the SDM main firmware and one I/O section.

You may create a factory default helper image file to load into your device prior to performing any programming command. After programming an authentication root key hash, you must create and sign a QSPI factory default helper image because of the included I/O section. If you additionally program the co-signed firmware security setting eFuse, you must create provisioning and QSPI factory default helper images with co-signed firmware. You may use a co-signed factory default helper image on an unprovisioned device as the unprovisioned device ignores non-Intel signature chains over SDM firmware. Refer to Using QSPI Factory Default Helper Image on Owned Devices for more details about creating, signing, and using the QSPI factory default helper image.

The provisioning factory default helper image performs a provisioning action, such as programming the authentication root key hash, security setting fuses, PUF enrollment, or black key provisioning. You use the Intel® Quartus® Prime Programming File Generator command line tool to create the provisioning helper image, specifying the helper_image option, your helper_device name, the provision helper image subtype, and optionally a co-signed firmware .zip file:
quartus_pfg --helper_image -o helper_device=1SX280LH2 -o subtype=PROVISION \ 
-o fw_source=signed_Stratix10.zip signed_provision_helper_image.rbf
Program the helper image using the Intel® Quartus® Prime Programmer tool:
quartus_pgm -c 1 -m jtag -o “p;signed_provision_helper_image.rbf” --force

You may omit the initialize operation from examples provided in this chapter if you have already programmed a provision helper image.