Intel® Agilex™ Device Security User Guide

ID 683823
Date 11/22/2022
Public

A newer version of this document is available. Customers should click here to go to the newest version.

Document Table of Contents

4.2. Using QSPI Factory Default Helper Image on Owned Devices

The Intel® Quartus® Prime Programmer automatically creates and loads a QSPI factory default helper image when you select the initialize operation for a QSPI flash programming file. After programming an authentication root key hash, you must create and sign the QSPI factory default helper image, and program the signed QSPI factory helper image separately prior to programming the QSPI flash.

  1. You use the Intel® Quartus® Prime Programming File Generator command line tool to create the QSPI helper image, specifying the helper_image option, your helper_device type, the QSPI helper image subtype, and optionally a co-signed firmware .zip file:
    quartus_pfg --helper_image -o helper_device=AGFB014R24A -o subtype=QSPI \
    -o fw_source=signed_agilex.zip qspi_helper_image.rbf
  2. You sign the QSPI factory default helper image:
    quartus_sign --family=agilex --operation=sign \
    --qky=design0_sign_chain.qky \
    --pem=design0_sign_private.pem \
    qspi_helper_image.rbf signed_qspi_helper_image.rbf
  3. You may use any QSPI flash programming file format. The following examples use a configuration bitstream converted to .jic file format:
    quartus_pfg -c signed_bitstream.rbf signed_flash.jic \
    -o device=MT25QU128 -o flash_loader=AGFB014R24A -o mode=ASX4
  4. You program the signed helper image using the Intel® Quartus® Prime Programmer tool:
    quartus_pgm -c 1 -m jtag -o “p;signed_qspi_helper_image.rbf” --force
  5. You program the.jic image to flash using the Intel® Quartus® Prime Programmer tool:
    quartus_pgm -c 1 -m jtag -o “p;signed_flash.jic”