I have a design that relies on RSU for remote updates. I currently encrypt the .pof file for JTAG programming. When generating that encrypted .pof file, I also choose to generate the .rpd files that go into CFM1. When downloading the .rpd files with the encrypted .pof and .ekp programmed via JTAG, the RSU is unsuccessful. I see a revert to application image 0, which my design will only go to if there is a problem with application image 1. The encrypted .pof file does not seem to like downloading a n.rpd file. Is there any way to get an .rpd file to download with an encrypted .pof

Hello, if referring to : https://www.intel.com/content/www/us/en/docs/programmable/683762/21-4/generating-the-initial-rsu-image.html"For security application when you need to generate a signed or encrypted .rbf file, you need to first generate .rbf file from a .sof file, and only then generate the initial RSU image from the .rbf file."Is it possible to follow above instruction for security application? regards,Farabi

That document refers to a Stratix10, I am using a Max10. I can try the equivalent on Max10. The process for generating the encrypted files is as follows: 1. Compile design, .sof is created 2. Take .sof into Convert Programming Files 3. Using .key file, generate encrypted .pof and encrypted .rpd and .ekp file from the base .sof 4. JTAG program the encrypted .pof with the .ekp What you're telling me to do is add a step in step 3 where I would generate a .rbf file from the .sof, then encrypt that .rbf to make an .rpd file that is encrypted that can be downloaded into flash?

This does not work. Please advice. Is there a way, on a MAX10, to perform a remote update with encryption enabled?

Hi rt52,Could you please provide any error message or screenshot when the issue occurred?Regards,Fakhrul

There is no option for "Internal Configuration" when trying to convert programming files with .rbf. The design uses MAX10 internal flash, not a QSPI.

MAX10 RSU with encrypted .pof | Altera Community

24 Replies

FakhrulA_altera
Regular Contributor
3 years ago
Hi rt52,

I tried to do some research on this issue. I found a record that previously there was an issue with MAX 10 having a failure on performing RSU with encrypted POF. The engineering was able to come up with a workaround by using JTAG to program encrypted .jic to QSPI instead. You may refer to the guideline under 1.7.2. Programming the QSPI sub-topic in the AN 741: Remote System Upgrade for MAX 10 FPGA Devices over UART with the Nios II Processor user guide. I'm afraid this is the only possible workaround provided by the engineering team since MAX 10 is quite an old device. Hope it works.

Regards,
Fakhrul
FakhrulA_altera
Regular Contributor
3 years ago
Hi rt52,

I wish to follow up with you about this case.
Do you still have further inquiries on this issue?
Else I would like to have your permission to close this forum ticket

Regards,
Fakhrul
- rt52
  Occasional Contributor
  3 years ago
  Thanks for looking into this. Unfortunately this design does not have a QSPI chip and only uses the internal flash of the MAX10, is it possible to use the .jic format to program to the internal flash?
FakhrulA_altera
Regular Contributor
3 years ago
Hi rt52,

My apologies I mixed up my explanation earlier, the above mentioned workaround was meant for the stratix 10 device, not Max 10. Also. MAX10, it actually has a built-in configuration memory and doesn't support JIC. What I can only suggest for now, try to check the “Enable real-time ISP” option in the programmer GUI. There's a case whereby the customer was able to perform configuration on an encrypted file (not RSU). Though, it is because when you enable this real-time ISP, it is a slow mode and normally user will not have this issue if program without speedmode (real-time ISP enabled) but the programming time is longer.

Regards,

Fakhrul
- rt52
  Occasional Contributor
  3 years ago
  I do not see how this will help. My issue is not programming an encrypted .pof with jtag, that works just fine without checking that box. Is there anything else to try when downloading an encrypted .rpd file? This device will have jtag disabled when shipped so having an update over jtag is not an option.
FakhrulA_altera
Regular Contributor
3 years ago
Hi rt52,

There was a successful case whereby the encrypted configuration would succeed only by using .jbc file instead of .pof and also enabling the real-time ISP at the same time as mentioned above. But, this customer was using a jam player and it not involving RSU. You may give it a try. I hope it would work. Sorry for the inconvenience.

Regards,
Fakhrul
FakhrulA_altera
Regular Contributor
3 years ago
Hi rt52,

I wish to follow up with you on this case. Do you still have further inquiries on this issue? Please feel free to let me know if there is any concern so that we could further assist you. Otherwise, this thread will be idling and marked as inactive, thus it will be transitioned to community support because there is no update received from you in a while. As for the workaround regarding this issue, my apologies, the above-mentioned steps are the only workaround provided by the engineering team.

Regards,
Fakhrul

Forum Discussion

MAX10 RSU with encrypted .pof

24 Replies

Recent Discussions

Will serialization factor of 6 in LVDS serdes IP be supported in the future on Agilex5?

System PLL of Agliex5 PCIE example design cannot be locked after configuration

JTAG Chain Broken on Agilex 7-I Dev Kit

Request for Cyclone V Pinout File Information

Cyclone 10 LP's Extended Industrial parts