For secured boot how to sign the files externally and update on System

[sagarkoli159]

Hi,

Below are the list to check on the jetson agx xavier secure boot System.

Components That Can Still Be Updated After Fuses Are Burned

1. Linux Kernel (Image or zImage)

2. Can be updated as long as the new kernel is signed with the same OEM private key.

3. Kernel modules (.ko) can also be updated if they are signed (if kernel module verification is enabled).

4. Root Filesystem (rootfs)

5. Can be updated freely if not encrypted.

6. If dm-verity or full disk encryption (FDE) is enabled, updates must follow their integrity policies.

7. Device Tree (dtb)

8. Can be updated if signed with the same OEM key.

9. Kernel Command Line Parameters (bootargs)

10. Can be updated if the bootloader allows modifying them.

11. If “secure boot with rollback protection” is enabled, updates must be signed.

12. Userspace Applications (/usr/bin, /lib, etc.)

13. Can be updated like any Linux system.

Components That Cannot Be Updated After Fuses Are Burned

1. Bootloader (MB1, MB2, cboot, UEFI)

2. Cannot be modified unless a signed update is provided .

3. If rollback protection is enabled, the bootloader will reject updates with an older version number.

4. Secure Boot Key Hash (OEM Public Key)

5. Permanent once burned (prevents key replacement).

6. SBK Key (if using encrypted boot)

7. Irreversible and locks down encrypted boot process.

8. Rollback Counter (if enabled)

9. Enforced at boot time to prevent downgrades to vulnerable firmware.

’
How can we verify this on secure boot agx xavier system?

Please provide the related document and detailed information on this.

Thanks!

[JerryChang]

hello sagarkoli159,

FYI, partition update has disabled once you enable Jetson security boot.
in other words, you have to full-flash a target (of course, given your keys to flash command-line) for updating image/binary.
besides, please see-also similar topics, such as Topic 289466 and Topic 266387 to verify secure boot.