Forum Discussion
Occasional ContributorMAX10 RSU with encrypted .pof
I have a design that relies on RSU for remote updates. I currently encrypt the .pof file for JTAG programming. When generating that encrypted .pof file, I also choose to generate the .rpd files that go into CFM1. When downloading the .rpd files with the encrypted .pof and .ekp programmed via JTAG, the RSU is unsuccessful. I see a revert to application image 0, which my design will only go to if there is a problem with application image 1. The encrypted .pof file does not seem to like downloading a n.rpd file.
Is there any way to get an .rpd file to download with an encrypted .pof
24 Replies
FakhrulA_alteraRegular Contributor
Hi rt52,
My apologies for the late reply. I am checking this internally for more clarification
Will get to you once there are any findings.
Regards,
Fakhrul
- FakhrulA_altera
Hi rt52,
I'm not sure you have taken a look the following steps on generating .ekp File and Encrypt Configuration File in the User Guide on page 41 as I'm assuming there could be some problems on the file generation.
Regards,
Fakhrul
rt52Hello, this is the .cof file I am using to generate the encrypted .pof and .rpd. I have a script that replaces the generic values with the inputs to the script that are the respective .sof, . ekp and .key file. The generated .pof is labeled as "encrypted" and the CFM 1 .rpd file is used and the other 2 are removed because I do not use those. This .cof is identical to how the unencrypted one works except for the .key/.ekp fields which are excluded. The same process is used to give me the final .rpd and .pof but the unencrypted version works perfectly and the encrypted one does not.
- FakhrulA_altera
Hi rt52,
Sorry for the late reply. Could you please take a look at the following steps on Generating files for Remote System Upgrade on page 8:
Generating files for Remote System Upgrade
Regards,
Fakhrul
- rt52
Thank you for the document. Currently I am able to successfully perform an RSU with an .rpd file without encryption.
As soon as I choose to use an encrypted .pof, the .rpd file generated in the same step (from checking the generate .rpd box) does not work. I do a readback of the boot source register in the dual boot IP and the device is booting from the fallback image. This only happens when using the encrypted option.
- FakhrulA_altera
Hi rt52,
Could you please provide any error message or screenshot when the issue occurred?
Regards,
Fakhrul
- rt52
There is no option for "Internal Configuration" when trying to convert programming files with .rbf. The design uses MAX10 internal flash, not a QSPI.
Farabi_AlteraHello,
if referring to : https://www.intel.com/content/www/us/en/docs/programmable/683762/21-4/generating-the-initial-rsu-image.html
"For security application when you need to generate a signed or encrypted .rbf file, you need to first generate .rbf file from a .sof file, and only then generate the initial RSU image from the .rbf file."
Is it possible to follow above instruction for security application?
regards,
Farabi
- rt52
This does not work. Please advice. Is there a way, on a MAX10, to perform a remote update with encryption enabled?
- rt52
That document refers to a Stratix10, I am using a Max10. I can try the equivalent on Max10.
The process for generating the encrypted files is as follows:
1. Compile design, .sof is created
2. Take .sof into Convert Programming Files
3. Using .key file, generate encrypted .pof and encrypted .rpd and .ekp file from the base .sof
4. JTAG program the encrypted .pof with the .ekp
What you're telling me to do is add a step in step 3 where I would generate a .rbf file from the .sof, then encrypt that .rbf to make an .rpd file that is encrypted that can be downloaded into flash?
