EKS/EKB partition redundancy on TX2

Autonomous Machines Jetson & Embedded Systems Jetson TX2
,
1

I’m trying to enable redundancy on TX2.
In default Linux_for_Tegra/bootloader/t186ref/cfg/flash_l4t_t186_enc_rootfs_ab.xml
I coudn’t see a eks_b partition, so I have added one myself:

<partition name="eks" type="data" oem_sign="true">
           <allocation_policy> sequential </allocation_policy>
           <filesystem_type> basic </filesystem_type>
           <size> 2097152 </size>
           <file_system_attribute> 0 </file_system_attribute>
           <allocation_attribute> 8 </allocation_attribute>
           <percent_reserved> 0 </percent_reserved>
           <filename> EKSFILE </filename>
           <description> **Optional.** Contains the encrypted keys. </description>
       </partition>
       <partition name="eks_b" type="data" oem_sign="true">
           <allocation_policy> sequential </allocation_policy>
           <filesystem_type> basic </filesystem_type>
           <size> 2097152 </size>
           <file_system_attribute> 0 </file_system_attribute>
           <allocation_attribute> 8 </allocation_attribute>
           <percent_reserved> 0 </percent_reserved>
           <filename> EKSFILE </filename>
           <description> **Optional.** Slot B; contains the encrypted keys. </description>
       </partition>

But after flashing and changing bootslot I see that MB2(TBoot-BPMP) using 0 slot for EKB, even if ekb_b partition exists:

   [0000.186] I> Welcome to MB2(TBoot-BPMP)(version: 01.00.160913-t186-M-00.00-mobile-03715cad)
   [0000.195] I> Boot-device: eMMC
   [0000.202] I> sdmmc bdev is already initialized
   [0000.207] I> pmic: reset reason (nverc)        : 0x0
   [0000.239] I> Found 19 partitions in SDMMC_BOOT (instance 3)
   [0000.259] I> Found 37 partitions in SDMMC_USER (instance 3)
   [0000.265] I> A/B: bin_type (16) slot 1
   [0000.269] I> Loading partition bpmp-fw_b at 0xd7800000
   [0000.274] I> Reading two headers - addr:0xd7800000 blocks:1
   [0000.279] I> Addr: 0xd7800000, start-block: 58782912, num_blocks: 1
   [0000.306] I> Binary(16) of size 534416 is loaded @ 0xd7800000
   [0000.312] I> A/B: bin_type (17) slot 1
   [0000.315] I> Loading partition bpmp-fw-dtb_b at 0xd79f0000
   [0000.321] I> Reading two headers - addr:0xd79f0000 blocks:1
   [0000.326] I> Addr: 0xd79f0000, start-block: 58786168, num_blocks: 1
   [0000.354] I> Binary(17) of size 604720 is loaded @ 0xd796c400
   [0000.585] I> Loading SCE-FW ...
   [0000.588] I> A/B: bin_type (12) slot 1
   [0000.591] I> Loading partition sce-fw_b at 0xd7300000
   [0000.596] I> Reading two headers - addr:0xd7300000 blocks:1
   [0000.602] I> Addr: 0xd7300000, start-block: 58792312, num_blocks: 1
   [0000.622] I> Binary(12) of size 125168 is loaded @ 0xd7300000
   [0000.628] I> Init SCE
   [0000.630] I> Loading APE-FW ...
   [0000.633] I> A/B: bin_type (11) slot 1
   [0000.637] I> Loading partition adsp-fw_b at 0xd7400000
   [0000.642] I> Reading two headers - addr:0xd7400000 blocks:1
   [0000.647] I> Addr: 0xd7400000, start-block: 58773512, num_blocks: 1
   [0000.667] I> Binary(11) of size 77216 is loaded @ 0xd7400000
   [0000.673] I> Copy BTCM section
   [0000.676] I> A/B: bin_type (13) slot 1
   [0000.680] I> Loading partition cpu-bootloader_b at 0x96000000
   [0000.685] I> Reading two headers - addr:0x96000000 blocks:1
   [0000.691] I> Addr: 0x96000000, start-block: 58741768, num_blocks: 1
   [0000.713] I> Binary(13) of size 302064 is loaded @ 0x96000000
   [0000.719] I> A/B: bin_type (20) slot 1
   [0000.722] I> Loading partition bootloader-dtb_b at 0x8520f400
   [0000.728] I> Reading two headers - addr:0x8520f400 blocks:1
   [0000.734] I> Addr: 0x8520f400, start-block: 58743816, num_blocks: 1
   [0000.757] I> Binary(20) of size 374528 is loaded @ 0x8520f400
   [0000.763] I> A/B: bin_type (14) slot 1
   [0000.766] I> Loading partition secure-os_b at 0x8530f600
   [0000.772] I> Reading two headers - addr:0x8530f600 blocks:1
   [0000.777] I> Addr: 0x8530f600, start-block: 58750984, num_blocks: 1
   [0000.801] I> Binary(14) of size 394672 is loaded @ 0x8530f600
   [0000.809] I> TOS boot-params @ 0x85000000
   [0000.812] I> TOS params prepared
   [0000.816] I> Loading EKS ...
   [0000.818] I> A/B: bin_type (15) slot 0 <# !!! Here
   [0000.822] I> Loading partition eks at 0x8590f800
   [0000.826] I> Reading two headers - addr:0x8590f800 blocks:1
   [0000.832] I> Addr: 0x8590f800, start-block: 58757128, num_blocks: 1
   [0000.851] I> Binary(15) of size 1040 is loaded @ 0x8590f800
   [0000.857] I> EKB detected (length: 0x400) @ 0x8590f800
   [0000.862] I> Copied encrypted keys
   [0000.866] I> boot profiler @ 0x275844000
   [0000.869] I> boot profiler for TOS @ 0x275844000
   [0000.874] I> Unhalting SCE
   [0000.877] I> Primary Memory Start:80000000 Size:70000000
   [0000.882] I> Extended Memory Start:f0110000 Size:1856f0000
   [0000.889] I> MB2(TBoot-BPMP) done

So this is my fault or TX2 does not support EKS partition redundancy?

3

It looks like a limitation in MB2(TBoot-BPMP) .
According to docs

Both are released to OEMs as source code for reference

But I can’t find source code for TBoot so I can fix it.

EKS partition redundancy is required so I can change EKB keys, if they are compromised

4

hello sshmarov,

may I know which JetPack release you’re working with,
FYI, eks_b partition was not implemented due to EKS partition doesn’t need to be update during OTA.
thanks

6

I’m using latest Jetpack 32.5.1.
I see that eks_b partition is implemented in bootloader/t186ref/cfg/flash_l4t_t194_*.xml configs.
And I actually want to update EKS partition during OTA update, in case EKB keys were compromised but KEK2 is not.

8

hello sshmarov,

it needs bootlader changes, we have an internal discussion for adding eks_b partition to support redundancy feature on TX2.
I’ll update the status after we come out the conclusions. thanks