Using the Design Security Features with OpenCL Compiler

[MNumb]

I am not familiar with HDL and Quartus and I am using OpenCL for Arria 10 device. How can I encrypt the bitstream with .aocx files?

I have found out that .aocx file contains the top.rbf file content. And AFAIK from AN556 document .rbf file is what I need exactly. I can create equal file with quartus_cpf tool or Quartus GUI from top.kernel.pmsf file, and if I replace the part of .aocx file with the content obtained after this operation, my programs still works.

Using qcrypt tool for top.rbf file is unsuccessful due to top.rbf is rbf for partial reconfiguration. I just get the error "Unrecognized file format".

When I'm trying to convert base.sof or top.sof file to encrypted .rbf (as instructions say), quartus_cpf allows me to do that. Unencrypted and encrypted .rbfs are different, but they also differ from top.rbf file created during OpenCL compilation: .sof->.rbf creates 45MB files, top.rbf is 95MB file (.rbf for partial reconfiguration), so it seems to be dead end.

During converting .pmsf to .rbf, I can make the encrypted .rbf file, which is about 1.5 MB more than unencrypted. Using quartus_cpf does not allow me to do that for some reason (it just creates unencrypted file even if I use --key parameter), but using Quartus GUI is successfull. And when I create the .aocx file with encrypted top.rbf, it still works, even though I did not program the key. Why does device with no key runs this "encrypted" bitstream? Is it even encrypted? What do I miss?

[MNumb]

I have also discovered that programming key into device kills any interaction with OpenCL. When I start my application, I get the error "PCIe-to-fabric read test failed", OpenCL API cannot get device_id, etc. And even aocl diagnose doesn't work with the same error. Since I don't know how to clear the key, I have to reboot my PC to fix this problem.

Am I able to use device security features with OpenCL at all?

UPD: Also it seems that .rbf file encrypted with using the .qlk file (which is made from base.sof file) does not work causing the error "CL_INVALID_BINARY" when I insert it into the .aocx file.