Hi, Is there any way to enable readout protection so the system partition can’t be read in recovery mode? This is a common option in MCUs

hello urielom8ug, please check r32.5 release notes . secureboot enhanced for Jetson AGX Xavier and Jetson Xavier NX to extend encryption support to kernel, kernel-dtb, and initrd. FYI, the kernel encryption support is enabled for Xavier series for now, you may expect next public release (i.e. l…

hello urielom8ug, may I know what’s the actual use-case? could you please also share what’s the partition you would like to protect, thanks

Hi, The use case is protecting an encryption key(residing in system partition) , I know recently there is an option to do full disk encryption but it is rather complicated and still one partition (/boot) is not encrypted so it doesn’t protect against someone with physical access to the device which…

hello urielom8ug, please access Fuse Specification App Note , your keys should programmed in the fuse. thanks

That doesn’t help because it means the OS will have access anyway to the fuse so you can use recovery mode to flash a different OS and then access the fuses…

hello urielom8ug, that’s not correct, when you begin production and burn the ODM production fuse, secure boot is enabled, JTAG debug is disabled, and all the fuses become inaccessible except Reserved_ODM. however, Reserved_ODM fuse are programmable until it disabled by the ODM_lock fuse. thanks

Then my app doesn’t have access to it too, what you are suggesting is going with full disk encryption : https://docs.nvidia.com/jetson/l4t/#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/bootloader_disk_encryption.html# According to that page: " Because the bootloader cannot read enc…

I am looking to what this topics talks about: [image] How to block RCM mode and JTAG by enabling bits in fuse blob? Jetson AGX Xavier hi all, when you begin production and burn the ODM production fuse, secure boot is enabled, JTAG debug is disabled, and all the fuses beco…

Few questions: What you mean by RCM code be signed? is the RCM residing in MB2? can MB2 be deleted and those RCM disabled?

hello urielom8ug, they’re signed such as BCT or bootloader, some of other partitions were not signed and encrypted, please check Topic 154143 as see-also. you may also refer to Jetson TX2 Boot Flow for reference, again, all the fuses become inaccessible if you enable the Jetson security, and al…

Readout protection

Robotics & Edge Computing Jetson Systems Jetson TX2

JerryChang February 22, 2021, 8:08am 10

hello urielom8ug,

we don’t support disable the recovery mode. please also check Topic 64984 for reference.
moreover, if you’d enable secureboot, the RCM code will be signed.

Topic		Replies	Views
Ways to prevent data accessing in the recovery mode Jetson TX2	6	816	May 18, 2021
Secure OS / Rootfs Encryption Jetson TX2	5	2632	December 11, 2018
How to verify that secure boot with kernel encryption and disc encryption is enabled in Jetson TX2? Jetson TX2 boot , security , nvbugs	18	1701	September 13, 2023
Disabling flash rear/write in recovery mode Jetson TX2 security	7	742	July 12, 2020
Securing data access Jetson AGX Xavier security	4	923	February 7, 2021
Data encryption using secure boot and odm_reserved fuse in Jetson Nano Jetson Nano security	10	3271	August 12, 2021
Disk Encryption on TX2 Jetson TX2 security	3	1502	March 29, 2021
Not able to use LUKS Disk Encryption on Jetson NX Jetson Xavier NX security	1	1071	February 8, 2021
Disk encryption key in EKS partition Jetson Orin NX security	12	514	December 13, 2024
How Can I Encrypt Rootfs with SD Boot? Jetson AGX Xavier boot , security	2	755	April 9, 2021

Readout protection

Related topics