Can the TPM Persistent Handle and NV Storage Size Be Increased on Jetson Devices?

Robotics & Edge Computing Jetson Systems Jetson Orin NX
,
1

Is it possible to increase the available number of TPM persistent handles or extend the usable capacity of the NV storage?
I would like to manage additional key pairs and certificates.

The following device has the fTPM feature enabled:

Environment:

  • Device: reComputer Industrial Orin J401
  • JetPack: 6.2.2 (L4T R36.5.0)
  • OP-TEE: fTPM feature enabled

Persistent Handle Capacity:

A total of 3 handles can be used.

As configured:

TPM2_PT_HR_PERSISTENT: 0x3  
TPM2_PT_HR_PERSISTENT_AVAIL: 0x0

Attempting to exceed this limit results in an insufficient space for NV allocation error.
Operations succeed when the count is below this threshold.

root@test-desktop:~/work# tpm2_getcap properties-variable
TPM2_PT_PERMANENT:
  ownerAuthSet:              0
  endorsementAuthSet:        0
  lockoutAuthSet:            0
  reserved1:                 0
  disableClear:              0
  inLockout:                 0
  tpmGeneratedEPS:           1
  reserved2:                 0
TPM2_PT_STARTUP_CLEAR:
  phEnable:                  1
  shEnable:                  1
  ehEnable:                  1
  phEnableNV:                1
  reserved1:                 0
  orderly:                   1
TPM2_PT_HR_NV_INDEX: 0x2  
TPM2_PT_HR_LOADED: 0x0  
TPM2_PT_HR_LOADED_AVAIL: 0x3  
TPM2_PT_HR_ACTIVE: 0x0  
TPM2_PT_HR_ACTIVE_AVAIL: 0x40  
TPM2_PT_HR_TRANSIENT_AVAIL: 0x3  
TPM2_PT_HR_PERSISTENT: 0x3  
TPM2_PT_HR_PERSISTENT_AVAIL: 0x0  
TPM2_PT_NV_COUNTERS: 0x0  
TPM2_PT_NV_COUNTERS_AVAIL: 0xC  
TPM2_PT_ALGORITHM_SET: 0x0  
TPM2_PT_LOADED_CURVES: 0x5  
TPM2_PT_LOCKOUT_COUNTER: 0x0  
TPM2_PT_MAX_AUTH_FAIL: 0x3  
TPM2_PT_LOCKOUT_INTERVAL: 0x3E8  
TPM2_PT_LOCKOUT_RECOVERY: 0x3E8  
TPM2_PT_NV_WRITE_RECOVERY: 0x0  
TPM2_PT_AUDIT_COUNTER_0: 0x0  
TPM2_PT_AUDIT_COUNTER_1: 0x0  
root@test-desktop:~/work#

NV Storage Capacity:

A total of 2,792 bytes of NV storage can be used.

When defining an NV area with the following command, an insufficient space for NV allocation error occurs:
The operation fails due to insufficient NV allocation space. Reducing the specified size would allow the operation to succeed.

root@test-desktop:~/work# size=`wc -c < cert.der`  
root@test-desktop:~/work# tpm2_nvdefine 0x0181FFFE -C o -s ${size}  
WARNING:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:344:Esys_NV_DefineSpace_Finish() Received TPM Error  
ERROR:esys:src/tss2-esys/api/Esys_NV_DefineSpace.c:122:Esys_NV_DefineSpace() Esys Finish ErrorCode (0x0000014b)  
ERROR: Failed to define NV area at index 0x181FFFE  
ERROR: Esys_NV_DefineSpace(0x14B) - tpm:error(2.0): insufficient space for NV allocation  
ERROR: Failed to create NV index 0x181fffe.  
ERROR: Unable to run tpm2_nvdefine  
root@test-desktop:~/work#
2

— 🤖 This is an automated AI response. I’m here to help, but please verify important details! —

I could not find clear support for that in the provided Jetson Orin NX documentation.

— We support team will also look into your issue to have further suggestions soon. please stay tuned. —

3

Please refer to fTPM handles don’t persist after a reboot - Jetson Systems / Jetson Orin NX - NVIDIA Developer Forums to see if can help.

5

hello kayccc,

I am looking for the procedure to expand the available number of persistent handles and the usable capacity of NV storage, but haven’t found it yet.
Are these procedures outlined in the topic you mentioned or in The fTPM Boot Flow?
Could you kindly point me to the relevant section if it exists?

6

I was able to increase the NV_MEMORY_SIZE in the OPTEE source code (TpmProfile.h) to achieve the expansion.

Regarding the expansion of NV memory size, there are no clear documentation entries found.
As it was not done through formal procedures and the impact is unknown, it currently appears to be functioning without issues.

  1. Modify the OPTEE Source Code:

    cd ~/JETSONNX/Linux_for_Tegra/source/tegra/optee-src/nv-optee/

cp -p ./optee/samples/ms-tpm-20-ref/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/reference/include/TpmProfile.h \
      ./optee/samples/ms-tpm-20-ref/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/reference/include/TpmProfile.h.bak

sed -i 's/^#define NV_MEMORY_SIZE[[:space:]]\+16384$/#define NV_MEMORY_SIZE                  28672/' \
  ./optee/samples/ms-tpm-20-ref/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/reference/include/TpmProfile.h

grep -n "NV_MEMORY_SIZE" \
  ./optee/samples/ms-tpm-20-ref/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/reference/include/TpmProfile.h

  2. Rebuild the TOS Image
    Rebuilding and Updating the TOS Image for fTPM Support

  3. Flash the TOS Partition (A_secure-os/B_secure-os) on the target device.

Persistent Handle Capacity:

TPM2_PT_HR_PERSISTENT: 0x0
TPM2_PT_HR_PERSISTENT_AVAIL: 0xA

NV Storage Capacity:
2,048 byte * 8 = 16,384 byte

root@test-desktop:# tpm2_getcap handles-nv-index -T device:/dev/tpmrm0
- 0x181FFF7
- 0x181FFF8
- 0x181FFF9
- 0x181FFFA
- 0x181FFFB
- 0x181FFFC
- 0x181FFFD
- 0x181FFFE
root@test-desktop:# tpm2_nvreadpublic -T device:/dev/tpmrm0 0x0181FFF7
0x181fff7:
  name: 000b269fc5c2c8a1f0cd3a1c2061aa2968a478911da9f136c7d04850f99b0d8417e5
  hash algorithm:
    friendly: sha256
    value: 0xB
  attributes:
    friendly: ownerwrite|authwrite|ownerread|authread|written
    value: 0x6000620
  size: 2048
7

Thanks for sharing the update.

It looks like the NV storage size can be expanded by modifying NV_MEMORY_SIZE in TpmProfile.h, then rebuilding the TOS image and flashing the secure OS partition.

At this time, we do not see clear public documentation for this method. Since it is not a formal supported procedure, the overall impact is still unknown, although it appears to be working in your current testing.