Odmfuse.sh fails when I use DK

[broothy]

Hi,

I would like to use secure boot features on Jetson Nano. If I use odmfuse with PKC only it runs without error:

sudo ./odmfuse.sh -i 0x21 -c PKC -k ../nano_priv.pem
*** Calculating HASH from keyfile /home/balazad/nano/nano_priv.pem ... done
PKC HASH: 0x791c44563ad7ef6de799843b2a7166d97b13411edbebcb40241529fde0b14ed6
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0013 ] Parsing fuse info as per xml file
[   0.0022 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0031 ] 
[   0.0031 ] Generating RCM messages
[   0.0038 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0046 ] RCM 0 is saved as rcm_0.rcm
[   0.0049 ] RCM 1 is saved as rcm_1.rcm
[   0.0049 ] List of rcm files are saved in rcm_list.xml
[   0.0049 ] 
[   0.0049 ] Signing RCM messages
[   0.0056 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0062 ] Assuming zero filled SBK key
[   0.0101 ] 
[   0.0101 ] Copying signature to RCM mesages
[   0.0108 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0117 ] 
[   0.0118 ] Boot Rom communication
[   0.0124 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0130 ] BR_CID: 0x321010016441f807000000000c060440
[   0.1064 ] RCM version 0X210001
[   0.2022 ] Boot Rom communication completed
[   1.2114 ] 
[   1.2115 ] Blowing fuses
[   1.2136 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.2154 ] Applet version 00.01.0000
[   1.4001 ] Successfully burnt fuses as per fuse info blob
[   1.4129 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.

When I try to specify Device Key I get the following error:

sudo ./odmfuse.sh -i 0x21 -c PKC -k ../nano_priv.pem -D ../nano_dk.key
*** Error: SBK is missing.

I thought SBK is not supported on Jetson Nano, the documentation says the followings:

Secureboot Key (SBK): AES encryption key for encrypting bootloader (T186 and T194).

If I try to call odmfuse with DK and SBK I always get the following error:

sudo ./odmfuse.sh -i 0x21 -c PKC -k ../nano_priv.pem -D ../nano_dk.key -S ../nano_sbk.key
*** Calculating HASH from keyfile /home/balazad/nano/nano_priv.pem ... done
PKC HASH: 0x791c44563ad7ef6de799843b2a7166d97b13411edbebcb40241529fde0b14ed6
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0013 ] Parsing fuse info as per xml file
[   0.0023 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0036 ] 
[   0.0037 ] Generating RCM messages
[   0.0044 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0051 ] RCM 0 is saved as rcm_0.rcm
[   0.0054 ] RCM 1 is saved as rcm_1.rcm
[   0.0054 ] List of rcm files are saved in rcm_list.xml
[   0.0054 ] 
[   0.0055 ] Signing RCM messages
[   0.0062 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0070 ] Assuming zero filled SBK key
[   0.0116 ] 
[   0.0116 ] Copying signature to RCM mesages
[   0.0127 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0139 ] 
[   0.0140 ] Boot Rom communication
[   0.0148 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0156 ] BootRom is not running
[   0.1514 ] 
[   0.1515 ] Blowing fuses
[   0.1546 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   0.1574 ] Applet version 00.01.0000
[   0.3422 ] Failed to burn fuses as per fuse info blob, Error:1179996997
[   0.3617 ] 0000005c: Failed to process oem command
[   0.3619 ] 
Error: Return value 92
Command tegrarcm --oem blowfuses blow_fuse_data.bin
failed.

How should I use odmfuse.sh if I want to use PKC and DK together?

Kind regards,
Adam

[DaneLLL]

Hi,
DK+SBK=SSK is the strict rule. Since SBK is not supported on Jetson Nano, DK is not supported also.

[broothy]

Dear @DaneLLL,

The following document explicitly mentions DK as a Jetson Nano supported fuse (while KEK0, KEK1, KEK2 and KEK256 are unsupported):
L4T Secureboot:

DK
Applies to: Jetson Nano and Jetson TX1

A 32-bit number stored in a file in big-endian HEX format.
For example: 0xddccbbaa

Are you 100% sure it is unsupported on Jetson Nano?

Kind regards,
Adam

[DaneLLL]

Hi,
Please check
https://developer.nvidia.com/jetson-nano-fuse-specification-application-note

DK has to be paired with SBK. On TX1/Nano, we suggest users use PKC only and the steps are described in document. If you would like to enable SBK on Nano, I need to check this with internal team.

[broothy]

Dear @DaneLLL,

Thank you for your response. It is possible that I have misconceptions… In my understanding:
-PKC: If PKC is set the device will refuse booting if the image is not signed with the corresponding key (protects against unwanted modifications)
-DK + SBK: SSK is generated from them
-SBK: If PKC is disabled SBK is used for secure booting, not so secure -> obsolete
-SSK: ??? (maybe the whole image can be encrypted with this key?)

PKC can protect the firmware from unwanted modifications, however it will be still readable for anyone. I would like to encrypt the whole image to disallow third parties to read it. Is it a supported use-case? Could you help please how I could do it? I hope SSK does exactly this.

Thank you,
Adam

[DaneLLL]

Hi,
For having SBK, we would suggest use TX2 or Xavier.

[DaneLLL]

Hi,
Please also refer to

Secureboot on Nano

Hi TakenoriSato, A few notes, . For DK, what’s the main purpose of using it in your product? Keep in mind, once ODM Production Bit is burned, all the fuses are not readable, including DK. Reserved ODM fuse is another option to consider. . The reason why the error message from script is due to SSK calculation will be from DK and SBK. . The document you referred to is correct. So is the secure boot package. Sorry for the confusion. Nano is using TX1 so the fuses are mostly the same. We will ma…

On Jeetson Nano, if you need to have keys for your own purpose, please utilize reserved ODM fuse.

A reference of burning ODM fuse:

How to burn ODM fuse bits?

Hi TakenoriSato, Please try below command: $ sudo ./odmfuse.sh -i 0x21 -c PKC -k ../emi_pkc.pem -o 0x0000000000000000000000000000000000000000000000000000000100000000

[broothy]

Dear @DaneLLL,

Jetson Nano Fuse Sepcification explicitly mentions both DK and SBK on Nano and TX1. You mean the document is incorrect?

As far as I know TX2 and Xavier don’t even contain DK, they have KEK0, KEK1, KEK2, KEK256 instead. Only TX1 and Nano have DK, and I haven’t found its exact purpose in the documentation. Just the same with SecureStorageKey, it is mentioned a lot but I do not know its purpose. Could you refer / summarize them?

As I mentioned I would like to have an encrypted mmc. It would be readable only for a device with the right key [I hope SSK is for this]. I cannot solve this use-case with reserved ODM fuses, since the key should be hidden from user level.

Kind regards,
Adam

[DaneLLL]

Hi,
Probably I don’t give determined information about this. We have DK and SBK in hardware design and Nano , but we don’t support to enable it on Nano. We support to enable PKC on Nano. We have verified enabling PKC on Nano.

If you need SBK, please use TX2 or Xavier.

[broothy]

Dear @DaneLLL,

I see. So from the point of view of an end user both DK and SBK are completely useless on Jetson Nano, we should ignore them, they have absolutely no function?

Kind regards,
Adam

[DaneLLL]

Hi,

@broothy

So from the point of view of an end user both DK and SBK are completely useless on Jetson Nano, we should ignore them, they have absolutely no function?

The hardware design is there and fixed. New design can be applied to next TX2 or Xavier, but cannot be applied backwards.
With some discussion between teams, we enable PKC on Jetson Nano and TX1. Please ignore DK and SBK on Jetson Nano.

[broothy]

Dear @DaneLLL

Thank you for the clear answer!

Kind regards,
Adam