Secure Boot on Jetson Orin Nano with Yocto/meta-tegra: FSKP vs. odmfuse.sh

Robotics & Edge Computing Jetson Systems Jetson Orin Nano
1

Hello NVIDIA team,

We are working with the Jetson Orin Nano platform and building our system image using Yocto with the meta-tegra layer. We want to enable Secure Boot on our devices.

We have a few questions regarding the current recommended approach:

It is stated in the recent documentation that odmfuse.sh has been deprecated in favor of the Factory Secure Key Provisioning (FSKP) tool. Does this mean odmfuse.sh is no longer supported and should not be used at all for fusing on Orin Nano?

  1. Can we still safely use odmfuse.sh to burn secure boot fuses, or is it mandatory to switch to the FSKP process?

  2. Since we are using Yocto/meta-tegra, is the following the correct way to ensure that our bootloader and images are signed during the build?

    TEGRA_SIGNING_ARGS = "-u /path/to/pkc-signing-key.pem -v /path/to/sbk.key --user_key /path/to/user.key"

We would greatly appreciate clarification on the correct and supported method for enabling Secure Boot on Jetson Orin Nano with Yocto.

Thank you!

3

hello firas.loukil,

>> Q1
odmfuse.sh is still available with JetPack 6.2 public release version. you may using it to enable Jetson security.

>> Q2
unfortunately, I don’t have experience with Yocto/meta-tegra. but it looks correct for sending keys to sign/encrypt the binary for image creation.

1 Like
4

Hello again,

We are currently working on enabling Secure Boot for our Jetson using the official odmfuse.sh script and followed the steps described in the documentation Burn Fuses with the Fuse Configuration File.

We used both PKC and SBK keys, and we are running the process with the --test flag first, to validate the operation.

Here is the command we used:

 sudo ./odmfuse.sh -X fuse_config.xml -i 0x23 \
 -k "/home/floukil/secure_boot_keys/rsa_priv.pem" \
 -S "/home/floukil/secure_boot_keys/sbk.key" \
 --test jetson-orin-nano-devkit

The command runs through all key generation, signature creation, and BCT processing stages successfully, but fails at the final step with the following message:

...
Existing camerafw(/home/floukil/Linux_for_Tegra/bootloader/camera-rtcpu-t234-rce.img) reused.
Existing wb0boot(/home/floukil/Linux_for_Tegra/bootloader/sc7_t234_prod.bin) reused.
sed: -e expression n°34, caractère 12: option inconnue pour « s »
failed.
5

Hello , any one can help me about this error?

6

hello firas.loukil,

Yocto is not supported per developer guide, Prerequisites Secure Boot.

An X86 host running Ubuntu 18.04 LTS, or 20.04 LTS.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.