Hi Nvidia:
As the topic said, we were trying to enable secure boot without fusing the SOM.
We are using Jetpack 6.0 + Custom Board + AGX Orin 64GB.
From the document and posts on the forum, I tried the following :
$ sudo apt install efitools
$ cd Linux_for_Tegra/
$ mkdir uefi_keys && cd uefi_keys
# Gen Keys for secure boot.
$ openssl ecparam -name secp521r1 -genkey -noout -out james_PK.key
$ openssl ecparam -name secp521r1 -genkey -noout -out james_KEK.key
$ openssl ecparam -name secp521r1 -genkey -noout -out james_db_1.key
$ openssl ecparam -name secp521r1 -genkey -noout -out james_db_2.key
# Use the key to gen Certs
# Instead of generating key and crt at the same time, the key should be generated separately.
$ openssl req -new -x509 -sha256 -days 3650 -key james_PK.key -subj "/CN=my Platform Key/" -out james_PK.crt
$ openssl req -new -x509 -sha256 -days 3650 -key james_KEK.key -subj "/CN=my Key Exchange Key/" -out james_KEK.crt
$ openssl req -new -x509 -sha256 -days 3650 -key james_db_1.key -subj "/CN=my Signature Database key 1/" -out james_db_1.crt
$ openssl req -new -x509 -sha256 -days 3650 -key james_db_2.key -subj "/CN=my Signature Database key 2/" -out james_db_2.crt
$ openssl ecparam -name secp521r1 -genkey -noout -out james_private_key.pem
Update the config ($ nano uefi_keys/uefi_keys.conf):
UEFI_PK_KEY_FILE="james_PK.key";
UEFI_PK_CERT_FILE="james_PK.crt";
UEFI_KEK_KEY_FILE="james_KEK.key";
UEFI_KEK_CERT_FILE="james_KEK.crt";
UEFI_DB_1_KEY_FILE="james_db_1.key";
UEFI_DB_1_CERT_FILE="james_db_1.crt";
UEFI_DB_2_KEY_FILE="james_db_2.key";
UEFI_DB_2_CERT_FILE="james_db_2.crt";
Gen UEFI capsules:
# Gen UEFI Capsule
$ cd Linux_for_Tegra/
$ sudo ./tools/gen_uefi_default_keys_dts.sh uefi_keys/uefi_keys.conf
$ sudo chmod 644 uefi_keys/_out/*.auth
$ sudo cp uefi_keys/UefiDefaultSecurityKeys.dtbo bootloader/
Flash them to NVMe:
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u uefi_keys/james_private_key.pem --uefi-keys uefi_keys/uefi_keys.conf -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" --no-flash --network usb0 jetson-agx-orin-devkit internal
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u uefi_keys/james_private_key.pem --uefi-keys uefi_keys/uefi_keys.conf --no-flash --external-device nvme0n1p1 -S 70GiB -c ./tools/kernel_flash/flash_l4t_t234_nvme.xml --external-only --append --network usb0 jetson-agx-orin-devkit external
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u uefi_keys/james_private_key.pem --network usb0 --flash-only
So far, I suppose that we have one signed & encrypted orin + one signed & encrypted nvme. As comparison, we use another Linux_for_Tegra folder to flash another orin & nvme by:
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" --no-flash --network usb0 jetson-agx-orin-devkit internal
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -S 70GiB -c ./tools/kernel_flash/flash_l4t_t234_nvme.xml --external-only --append --network usb0 jetson-agx-orin-devkit external
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --network usb0 --flash-only
However, we do a couple tests to check if anything secure or not:
| AGX Orin Encrypted? | NVMe Encrypted? | OS Boot? | Serial Log File |
|---|---|---|---|
| Y | Y | Y | SecurityBoot-log1_dtbo.txt |
| Y | N | Y | SecurityBoot-log2_dtbo.txt |
| N | Y | Y | SecurityBoot-log3_dtbo.txt |
SecurityBoot-log1_dtbo.txt (81.8 KB)
SecurityBoot-log2_dtbo.txt (82.7 KB)
SecurityBoot-log3_dtbo.txt (81.2 KB)
Now I’m curious about:
- Enable UEFI secure boot without fuse is even possible?
- If possible, what’s wrong with the steps above?
- In document Ref, it said
Refer to Using the Fuse Burning Toolkit for T234 from Jetson Download Center for more information.But I can’t find it in Jetson Download Center. Is this the root cause? Since thel4t_initrd_flash.shreportedPlease install the Secureboot package to use initrd flash for fused boardduring the flash.
Please help.
Many Thanks.
