Intel Agilex® 7 Device Security User Guide

ID 683823
Date 7/07/2023
Document Table of Contents

4.2. Using QSPI Factory Default Helper Image on Owned Devices

The Intel® Quartus® Prime Programmer automatically creates and loads a QSPI factory default helper image when you select the initialize operation for a QSPI flash programming file. After programming an authentication root key hash, you must create and sign the QSPI factory default helper image, and program the signed QSPI factory helper image separately prior to programming the QSPI flash.

  1. You use the Intel® Quartus® Prime Programming File Generator command line tool to create the QSPI helper image, specifying the helper_image option, your helper_device type, the QSPI helper image subtype, and optionally a co-signed firmware .zip file:
    quartus_pfg --helper_image -o helper_device=AGFB014R24A -o subtype=QSPI \
    -o qspi_helper_image.rbf
  2. You sign the QSPI factory default helper image:
    quartus_sign --family=agilex --operation=sign \
    --qky=design0_sign_chain.qky \
    --pem=design0_sign_private.pem \
    qspi_helper_image.rbf signed_qspi_helper_image.rbf
  3. You may use any QSPI flash programming file format. The following examples use a configuration bitstream converted to the .jic file format:
    quartus_pfg -c signed_bitstream.rbf signed_flash.jic \
    -o device=MT25QU128 -o flash_loader=AGFB014R24A -o mode=ASX4
  4. You program the signed helper image using the Intel® Quartus® Prime Programmer tool:
    quartus_pgm -c 1 -m jtag -o “p;signed_qspi_helper_image.rbf” --force
  5. You program the .jic image to flash using the Intel® Quartus® Prime Programmer tool:
    quartus_pgm -c 1 -m jtag -o “p;signed_flash.jic”

Did you find the information on this page useful?

Characters remaining:

Feedback Message