Enabling Secure Boot on AGX

[SimonCahill]

Hi there,

We're currently working on enabling secure boot on our Jetson AGXs (Xavier).
I have to say I find the documentation rather confusing and was hoping I could get some tips and insight here!

Reading this document from Nvidia reveals that there is a "legacy" secure boot, and secure boot with UEFI, yet the document doesn't make a clear "cut" IMO.

I'm assuming with the latest release of L4T I need to use the UEFI secure boot mechanism?
Are there any changes I need to make to the Yocto layer, such as a different platform configuration?

Please excuse my potentially daft questions, I'm still fairly new to Yocto and especially L4T, previously only developing software for/on a running system.

Thanks in advance for your help!

[ichergui]

Hey @SimonCahill
Welcome to the OE4T community.

We have our wiki page for the secure boot and UEFI secure boot. Please take a look.
Let us know if you have any question.

[SimonCahill]

Yes I've been looking at your wiki pages, but I still haven't quite figured it all out.

[madisongh]

Also, which "AGX" are you working with? AGX Xavier or AGX Orin?

[SimonCahill]

Xavier, sorry.

[madisongh]

Got it. IIRC, the "legacy" references in the doc are mainly about the fuse burning sequence, and only apply to Xavier.

Anyway, as @ichergui suggests, start with the wiki page that discusses the UEFI and OP-TEE signing additions you'll need to implement.

[SimonCahill]

I'll continue reading the wiki-pages, it makes more sense now.

Do I need to update the flash layout XML?
FWIL I need to apply the tegra-xxx-enc_ab.xml file? Does that seem right to you?

Currently we're using a flash layout based on flash_t194_sdmmc.xml IIRC.

[ichergui]

@SimonCahill
You don't need to update the flash layout xml file except to enable A/B system update or Disk encryption.
I think you are planing to enable disk encryption right ? if so, you need to handle your self that.
For now, we are only offering secureboot + UEFI secureboot

[SimonCahill]

Yes, the plan is to use secure boot and A/B updates w/ encryption.

Is disk encryption a planned feature?

[madisongh]

The pieces you need to put together should all be there. It's difficult to offer a turnkey solution in a Yocto BSP layer, but hopefully we can at least document one or more approaches you can take to assemble the necessary parts to enable it.

[ichergui]

I'm not sure about planning the encryption support in our tegra-demo-distro.
It can be really custom (partition layout, number of partitons, size, ...)
FYI, tegra meta layer have all the necessary SW components to allow you to perform the disk encryption.

I created a new room on Gitter, you can join and share your blocking points and we will try to help you
Kindly use the following link:
https://matrix.to/#/#nv-jetson-secureboot:gitter.im

[SimonCahill]

It's difficult to offer a turnkey solution in a Yocto BSP layer

That's probably the first thing I noticed! :D

Like I said I'm really new to Yocto, so it's all a bit overwhelming for now.

[SimonCahill]

I've finally got the majority sorted out, but now I'm missing the gen_ekb.py script.

Calling find . -name "*gen_ekb*" in the repo root doesn't yield any results, although gen_uefi_default_keys_dts.sh exists and is executable.

Any ideas?

[ichergui]

@SimonCahill
You need to download the Driver Package (BSP) Sources

decompress public_sources.tbz2 then go to Linux_for_Tegra/source/public
decompress nvidia-jetson-optee-source.tbz2 then you can fine the gen_ekb.py python script here optee/samples/hwkey-agent/host/tool/gen_ekb

Let me know if you need help

[SimonCahill]

Thanks, I'll check it out!

[ichergui]

@SimonCahill
Please join the gitter room for Jetson security discussions.
I will try to answer your questions

[SimonCahill]

Sadly I can't open that link from within the company network.

[ichergui]

Sadly I can't open that link from within the company network.

No worries