Jetson Orin AGX Boot fail after UEFI Secureboot flash 36.3 (Devkit)

[elhamriothman]

Hello there,

Since yesterday I’ve been trying to put the uefi secureboot to work, I followed the documentation, here are the steps that I followed:

1- Preparing the PK, KEK, and db keys on the host.
2- Creating a UEFI Keys Config File.
Since Im trying to enable the secureboot at flash time, I used the --uefi-keys option:

sudo ./flash.sh --uefi-keys uefi_keys/uefi_keys.conf jetson-agx-orin-devkit internal

The flash is made with success but the problem is after the first boot of the jetson orin agx, I get an initrd signature violation which is weird cause I never changed the payload nor it’s signature, It was my first boot here are the problems that I get:

Then the system reboot and give me this:

and finally I get this:

[KevinFFF]

Hi elhamriothman,

Please share the detailed steps you’ve done. (including every commands you used on host)

We would also like to check the following 2 logs files.

1. flash log from the host
2. serial console log during boot up from the devkit

[elhamriothman]

For the commands that I ran on my devkit:

1/ mkdir uefi_keys

2/ openssl req -newkey rsa:2048 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj “/CN=my Platform Key/” -out PK.crt

3/openssl req -newkey rsa:2048 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj “/CN=my Key Exchange Key/” -out KEK.crt

4/openssl req -newkey rsa:2048 -nodes -keyout db_1.key -new -x509 -sha256 -days 3650 -subj “/CN=my Signature Database key/” -out db_1.crt

5/openssl req -newkey rsa:2048 -nodes -keyout db_2.key -new -x509 -sha256 -days 3650 -subj “/CN=my another Signature Database key/” -out db_2.crt

results of the commands:

gedit uefi_keys.conf:

after:

6/ sudo chmod 644 uefi_keys/_out/*.auth

Finally:

sudo ./flash.sh --uefi-keys uefi_keys/uefi_keys.conf jetson-agx-orin-devkit internal.

I’ll put the logs in the next post.

[elhamriothman]

Here is the flash log from the host:
flash_uefi_secureboot.txt (97.2 KB)

[elhamriothman]

Here is the log for the boot up from the devkit:

bootup_log.txt (8.1 KB)

[elhamriothman]

Idk what happened exactly but reinstalling the rootfs and the rebuilding the flashing folder made it afterwards. We can close this.