Thor fuse key

Robotics & Edge Computing Jetson Systems Jetson Thor
1

Hi,

I’m configuring the fuse file

Reffer to the Jetson_thor_fuse_specification

image
image552×628 63.7 KB

Is there any different among Psc*/Oesp*/Sb* key of kd0/kd1/sbk key?

I did not see any definition on guide or doc

Are those shadow fuse?

image
image611×143 21.1 KB

Besides, What is the oem_kdk1.key in optee/samples/hwkey-agent/host/tool/gen_ekb/example.sh?

image
image994×397 61.8 KB

I’ve seen that " PscSecureBootKey , OespSecureBootKey and SbSecureBootKey , must be programmed with the same value. "

image
image800×134 13 KB

Should I set all *kdk0 and *kdk1 the same?

But in the example of guide they’re different

image
image815×497 98.7 KB

3

hello zax,

let me reply your questions as below..

>> Is there any different among Psc/Oesp*/Sb* key*

they’re keys for different domains.
for instance,
PSC = Platform Security Controller.
OESP = Operational Environment Security Processor.
SB = StrongBox/SB.

>> But in the example of guide they’re different

actually not, for the SBK key, three domain-specific keys are copies of the same SBK (Secure Boot Key), it’s used for boot-image encryption/decryption
for instance, PscSecureBootKey = OespSecureBootKey = SbSecureBootKey = 0x1234....eeff

>> PscOemKdk0, OespOemKdk0 and SbOemKdk0

it’s unlike the SBK key, these three keys can be different.

4

Is this “oem_kdk1.key” means PscOemKdk1 ?

5

hello zax,

that’s correct.
as mentioned by developer guide, Tool for EKB Generation.

$ python3 gen_ekb.py -chip t264
                     -oem_kdk1_key <oem_kdk1.key> \
                     -in_sym_key <sym_t264.key> \
                     -in_sym_key2 <sym2_t264.key> \
                     -in_auth_key <auth_t264.key> \
                     -out <eks_t264.img>

<oem_kdk1.key> is the key that is stored in the PSC_OEM_KDK1 fuse. (note, it was OEM_K1 for Orin series)

7

hello zax,

please refer to developer guide, FSKP Fuse Burn Script.
it’s --test option to performs a dummy operation and does not burn fuses.

8

If I only need pure secure boot function

I don’t need uefi secure boot/disk encryption …etc

Should I also need to update EKB?

9

you may skip EKB update if you don’t need UEFI secure boot/disk encryption …etc

10

Does Thor support massflash the secure image?

11

hello zax,

I assume you’re asking for Jetson security with bootloader secureboot, right?

firstly, were those devices already fused?
if no, you’ll need to have massfusing tool generates massfuse blob to fuse one or more Jetson devices simultaneously.
please refer to readme file, $OUT/Linux_for_Tegra/bootloader/README_Massfuse.txt

secondly, if you’ve those devices fused already, and, assume they’re using identical keys.
please refer to readme file, $OUT/Linux_for_Tegra/tools/kernel_flash/README_initrd_flash.txt
you may check [Workflow 7: Secure initrd Massflash] for the sample commands,
for instance, $ sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u <pkckey> [-v <sbkkey>] --no-flash --massflash 5 jetson-agx-thor-devkit internal