Secure Boot on Jetson Xavier AGX

[AbdulWasey]

Hi @JerryChang
Kindly guide me regarding these questions

@AbdulWasey

Combining everything together for flash command kindly check and correct me if I am wrong.

For

@JerryChang

Signing and Encrypting Kernel, Kernel-DTB, and Initrd Binary Files ,

We will add
-r -k <partition id>
Question1:
for -k swtich will we add -k cpu-bootloader

@JerryChang

for example, $ sudo ./flash.sh -r -k cpu-bootloader jetson-xavier mmcblk0p1

or will we add -k kernel-dtb

@JerryChang

$ sudo ./flash.sh --no-flash -r -k kernel-dtb jetson-xavier mmcblk0p1

For

@JerryChang

Tool for EKB Generation ,

We will add
-u <rsa_priv.pem> -v <sbk.key> --user_key <user.key>

@JerryChang

after that, please run flash.sh with “-u <rsa_priv.pem> -v <sbk.key> --user_key <user.key>” options to flash the board.

Now combining everything together
Sudo BOARDID=3668 BOARDSKU=0001 FAB=100 BOARDREV=H.0 ./flash.sh --no-flash -r -k <partition id> -u <pkc_file> -v <sbk_file> --user_key <user.key> jetson-agx-xavier-devkit mmcblk0p1

Question2:
Do I have to add ROOTFS_ENC=1 in this command for disk encryption? as mentioned in guide

@AbdulWasey

> # the disk encryption key in the EKB partition
$ echo "00000000000000000000000000000000" > ekb.key
$ sudo ROOTFS_ENC=1 ./flash.sh -i "./ekb.key" <board> <rootdev>
> ```

Question 3:
Do we need -i <enc rfs key file> in this command for disk encryption.
and kindly point out If I am missing any thing else
so far I have done this

@JerryChang

• Signing and Encrypting Kernel, Kernel-DTB, and Initrd Binary Files ,

• Tool for EKB Generation ,

and also cboot patch

@JerryChang

yes, please dig into CBoot sources and apply the patch.

you should follow the readme file for the instructions to build CBoot binary; please rename the binary lk.bin to cboot_t194.bin to use with the Jetson Xavier,
please overwrite it with $OUT/Linux_for_Tegra/bootloader/cboot_t194.bin , you need to enable flash script to Flashing a Specific Partition instead of flashing the whole device by using the command line, ‑k switch.
for example, $ sudo ./flash.sh -r -k cpu-bootloader jetson-xavier mmcblk0p1

Thanks