Greetings all, I have been facing an issue which I can’t seem to overcome:
Brief description of issue: Tried to enable secure boot and disk encryption of Jetson Orin NX 16GB. Managed to perform the flash using l4t_initrd_flash.sh but ended up getting the error “No key available with this passphrase” and “Kernel panic - not syncing” (see attached image at the bottom).
Configuration:
JETPACK_VERSION=“36.4.0”
BOARD_CONFIG=“jetson-orin-nano-devkit”
STORAGE_DEVICE=“nvme0n1p1”
DISK_SIZE_GIB=400
NUM_SECTORS=$(( DISK_SIZE_GIB * 1024 * 1024 * 1024 / 512 ))
DISK_SIZE=“${DISK_SIZE_GIB}GiB”
L4T_DIR=“Linux_for_Tegra”
Host version: Ubuntu 22.04 (and Ubuntu 20.04 Docker)
Carrier board: Default Jetson Orin Nano Developer Kit
Module: Jetson Orin NX 16GB-DRAM (Production)
Steps followed:
Extract files and setup
tar xvf Jetson_Linux_R36.4.0_aarch64.tbz2
sudo tar xvf Tegra_Linux_Sample-Root-Filesystem_R36.4.0_aarch64.tbz2 -C Linux_for_Tegra/rootfs/
tar xvf public_sources.tbz2
cd Linux_for_Tegra/source
tar xvf nvidia-jetson-optee-source.tbz2
cd ../
sudo ./tools/l4t_flash_prerequisites.sh
sudo ./apply_binaries.sh
Generate Keys
# RSA
openssl genrsa -out rsa.pem 3072
PKCS_KEY_XML_HASH=$(./bootloader/tegrasign_v3.py --pubkeyhash rsa.pubkey rsa.hash --key rsa.pem | grep "tegra-fuse format" | awk '{print $NF}')
# SBK
SBK_0=$(openssl rand -hex 4)
SBK_1=$(openssl rand -hex 4)
SBK_2=$(openssl rand -hex 4)
SBK_3=$(openssl rand -hex 4)
SBK_4=$(openssl rand -hex 4)
SBK_5=$(openssl rand -hex 4)
SBK_6=$(openssl rand -hex 4)
SBK_7=$(openssl rand -hex 4)
SBK_KEY=$(echo "0x${SBK_0} 0x${SBK_1} 0x${SBK_2} 0x${SBK_3} 0x${SBK_4} 0x${SBK_5} 0x${SBK_6} 0x${SBK_7}")
echo "${SBK_KEY}" > sbk.key
SBK_KEY_XML="0x${SBK_0}${SBK_1}${SBK_2}${SBK_3}${SBK_4}${SBK_5}${SBK_6}${SBK_7}"
echo "${SBK_KEY_XML}" > sbk_xml.key
# KEK
KEK_2_0=$(openssl rand -hex 4)
KEK_2_1=$(openssl rand -hex 4)
KEK_2_2=$(openssl rand -hex 4)
KEK_2_3=$(openssl rand -hex 4)
KEK_2_4=$(openssl rand -hex 4)
KEK_2_5=$(openssl rand -hex 4)
KEK_2_6=$(openssl rand -hex 4)
KEK_2_7=$(openssl rand -hex 4)
KEK_2_KEY=$(echo "0x${KEK_2_0} 0x${KEK_2_1} 0x${KEK_2_2} 0x${KEK_2_3} 0x${KEK_2_4} 0x${KEK_2_5} 0x${KEK_2_6} 0x${KEK_2_7}")
echo "${KEK_2_KEY}" > kek.key
KEK_2_KEY_XML="0x${KEK_2_0}${KEK_2_1}${KEK_2_2}${KEK_2_3}${KEK_2_4}${KEK_2_5}${KEK_2_6}${KEK_2_7}"
echo "${KEK_2_KEY_XML}" > kek_xml.key
KEK_2_KEY_OPTEE="${KEK_2_0}${KEK_2_1}${KEK_2_2}${KEK_2_3}${KEK_2_4}${KEK_2_5}${KEK_2_6}${KEK_2_7}"
echo "${KEK_2_KEY_OPTEE}" > kek_optee.key
# symmetric encryption keys
openssl rand -rand /dev/urandom -hex 32 > sym_t234.key
openssl rand -rand /dev/urandom -hex 16 > sym2_t234.key
openssl rand -rand /dev/urandom -hex 16 > auth_t234.key
# UEFI,
mkdir -p uefi_keys
cd uefi_keys
GUID=$(uuidgen)
# PK
openssl req -newkey rsa:2048 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 \
-subj "/CN=my Platform Key/" -out PK.crt
cert-to-efi-sig-list -g "${GUID}" PK.crt PK.esl
# KEK
openssl req -newkey rsa:2048 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 \
-subj "/CN=my Key Exchange Key/" -out KEK.crt
cert-to-efi-sig-list -g "${GUID}" KEK.crt KEK.esl
# db_1
openssl req -newkey rsa:2048 -nodes -keyout db_1.key -new -x509 -sha256 -days 3650 \
-subj "/CN=my Signature Database key/" -out db_1.crt
cert-to-efi-sig-list -g "${GUID}" db_1.crt db_1.esl
# db_2
openssl req -newkey rsa:2048 -nodes -keyout db_2.key -new -x509 -sha256 -days 3650 \
-subj "/CN=my another Signature Database key/" -out db_2.crt
cert-to-efi-sig-list -g "${GUID}" db_2.crt db_2.esl
# UEFI keys config
cat > uefi_keys.conf <<EOF
UEFI_DB_1_KEY_FILE="db_1.key";
UEFI_DB_1_CERT_FILE="db_1.crt";
UEFI_DEFAULT_PK_ESL="PK.esl"
UEFI_DEFAULT_KEK_ESL_0="KEK.esl"
UEFI_DEFAULT_DB_ESL_0="db_1.esl"
UEFI_DEFAULT_DB_ESL_1="db_2.esl"
EOF
cd ..
sudo tools/gen_uefi_keys_dts.sh uefi_keys/uefi_keys.conf
Generate OP-TEE image
python3 ./source/optee/samples/hwkey-agent/host/tool/gen_ekb/gen_ekb.py \
-chip t234 \
-oem_k1_key kek_optee.key \
-in_sym_key sym_t234.key \
-in_sym_key2 sym2_t234.key \
-in_auth_key auth_t234.key \
-out bootloader/eks_t234.img
Create fuse config
# read SBK and KEK if not in memory
if [ -z "$PKCS_KEY_XML_HASH" ]; then
PKCS_KEY_XML_HASH=$(./bootloader/tegrasign_v3.py --pubkeyhash rsa.pubkey rsa.hash --key rsa.pem | grep "tegra-fuse format" | awk '{print $NF}')
fi
# read SBK and KEK if not in memory
if [ -z "$SBK_KEY_XML" ]; then
SBK_KEY_XML=$(cat sbk_xml.key)
fi
if [ -z "$KEK_2_KEY_XML" ]; then
KEK_2_KEY_XML=$(cat kek_xml.key)
fi
cat > fuse.xml <<EOF
<genericfuse MagicId="0x45535546" version="1.0.0">
<fuse name="PublicKeyHash" size="64" value="${PKCS_KEY_XML_HASH}"/>
<fuse name="SecureBootKey" size="32" value="${SBK_KEY_XML}"/>
<fuse name="OemK1" size="32" value="${KEK_2_KEY_XML}"/>
<fuse name="BootSecurityInfo" size="4" value="0x209"/>
<fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>
EOF
Burn fuse
sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml "$BOARD_CONFIG"
Setup qspi
sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
--uefi-keys uefi_keys/uefi_keys.conf \
--network usb0 \
--no-flash \
--showlogs \
-p "-c bootloader/generic/cfg/flash_t234_qspi.xml" \
"$BOARD_CONFIG" internal > qspi_flash.log 2>&1
Setup rootfs
# update NUM_SECTORS in flash config
FLASH_CONFIG="./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml"
sed -i "s/EXT_NUM_SECTORS/${NUM_SECTORS}/g" "$FLASH_CONFIG"
# setup encrypted rootfs
sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh \
--uefi-keys uefi_keys/uefi_keys.conf \
-i ./sym2_t234.key \
--external-device nvme0n1p1 \
-c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
--showlogs \
--no-flash \
--external-only \
--append \
--network usb0 \
"$BOARD_CONFIG" \
external > rootfs_flash.log 2>&1
Flash board
sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
--showlogs \
-u rsa.pem \
-v sbk.key \
-i sym2_t234.key \
--uefi-keys uefi_keys/uefi_keys.conf \
--network usb0 \
--flash-only > flash_device.log 2>&1
The flash was successful.
Logs and errors:
qspi_flash.log (206.8 KB)
rootfs_flash.log (175.8 KB)
flash_device.log (75.8 KB)
I’ve been stuck at these setup steps for a long time. Would appreciate the help!