cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
bmassey
Visitor
Visitor
911 Views
Registered: ‎04-12-2017

bootgen Issue with ZYNQMP using Rolling Key Encryption, the PMU is reported to be larger than allowable

Jump to solution

I'm using ZynqMP (on the zcu104 board)   part = xczu7eg

When I setup my 'BIF' file to use rolling key encryption with the rolling key block size set to anything less than 8192 I get the following error during bootgen:

[ERROR] : Total PMU Firmware size 158KB > maximum allowable size (128KB)

If I change the block size to 8192, ie. blocks=8192(*) , bootgen works but the resultant BOOT.BIN file does not boot.

If I disable rolling key for the FSBL (Just do normal encryption on the FSBL), but all the other partitions are encrypted with rolling key... it works.

I've attached the working BIF file I spoke of.. I've also attached the nonWorking.bif ... the only difference between the two is the blocks= setting on the FSBL PARTITION

Any help would be appreciated.

-Bud Massey

 

0 Kudos
Reply
1 Solution

Accepted Solutions
rdarapun
Xilinx Employee
Xilinx Employee
831 Views
Registered: ‎03-27-2018

Hi @bmassey 

Your understanding of increase in size with key rolling is correct. But, decryption is of fsbl/pmufw image is NOT done directly while reading from the flash.
The complete encrypted FSBL is copied into OCM, and then decrypted. This is applicable to pmufw image as well.
So, increase in encrypted FSBL size beyond available OCM(250KB) doesn't work.
Similarly, incearse in encypted pmufw size beyond available PMU RAM(128KB) also doesn't work.

Can you please try key rolling on FSBL/PMUFW, so that the encrypted size is not beyond the above mentioned?

View solution in original post

4 Replies
pmallad
Xilinx Employee
Xilinx Employee
864 Views
Registered: ‎01-15-2014

Hi Bud Massey,

When you enable key rolling, there is an overhead added to the encrypted image. If there are n blocks created during key rolling, the overhead added will be (64 + n * 64)  bytes. The error you were seeing with <8192 bytes for block, was because of the size of PMU FW getting increased because of this overhead and was going out of limit expected for PMU FW.

When blocks=8192(*) is specified, the issue with PMU FW is not there anymore, as the size of the PMU FW with the overhead could have been less than the expected size. But the reason for not booting properly could be because of overall size of PMU FW + FSBL + total encryption overhead crossing the actual OCM size.

Can you try increasing the block size more and give it a try?

 

 

0 Kudos
Reply
bmassey
Visitor
Visitor
855 Views
Registered: ‎04-12-2017

 

I understand that when you use rolling key it increases the size of the encrypted image in flash (that makes sense).  So the FSBL and PMU images stored in flash are larger.  During boot the encrypted images are read out of flash and decrypted and written to memory (OCM).  Once unencrypted the PMU and FSBL sizes are fine and fit into memory.  So I don't see why rolling key should not work regardless of block size. 

Block size of 8192 worked with bootgen (I didn't get the PMU oversize error), but the resulting BOOT.bin file did not boot.

 

Thanks for the reply.

0 Kudos
Reply
rdarapun
Xilinx Employee
Xilinx Employee
832 Views
Registered: ‎03-27-2018

Hi @bmassey 

Your understanding of increase in size with key rolling is correct. But, decryption is of fsbl/pmufw image is NOT done directly while reading from the flash.
The complete encrypted FSBL is copied into OCM, and then decrypted. This is applicable to pmufw image as well.
So, increase in encrypted FSBL size beyond available OCM(250KB) doesn't work.
Similarly, incearse in encypted pmufw size beyond available PMU RAM(128KB) also doesn't work.

Can you please try key rolling on FSBL/PMUFW, so that the encrypted size is not beyond the above mentioned?

View solution in original post

bmassey
Visitor
Visitor
796 Views
Registered: ‎04-12-2017

Hi@rdarapun   Sorry for the slow response.  I was out of the office.  I've tried your suggestion.

I tried rolling key on the FSBL/PMU for the following.  

Block Size        Issue

  • 256                 Bootgen error PMU too large 
  • 1024               Bootgen error PMU too large
  • 8K                  Bootgen worked but resulting BOOT.bin did not boot properly 
  • 16K                Bootgen worked and device boots properly

I'll go with 16K block size for the FSBL. 

Note:  There is only a problem if you are including a PMU partition.

Thanks for the response.

 

0 Kudos
Reply