How to enable UEFI variable authentication for Orin AGX

[jpeeee]

I am not clear how to enable UEFI variable authentication as documented here with meta-tegra.

I have generated a custom EKB as follows and the generated my_eks_t234.img file has been added to our build:

openssl rand -rand /dev/urandom -hex 16 > sym2_t234.key         # disk encryption key
openssl rand -rand /dev/urandom -hex 16 > auth_t234.key         # uefi variables authentication key
# openssl rand -rand /dev/urandom -hex 16 > sym_t234.key        # UEFI payload encryption (not supported by meta-tegra scarthgap)

python3 gen_ekb.py -chip t234 -oem_k1_key ./../../fused_keys/my_keys/oem_k1.key \
        -in_sym_key2 sym2_t234.key \
        -in_auth_key auth_t234.key \
        -out my_eks_t234.img

The image is built with the following variables set:

• TEGRA_UEFI_DB_KEY
• TEGRA_UEFI_DB_CERT
• TEGRA_SIGNING_ARGS

The image loads and boots, but I am not sure whether this is enough to enable UEFI variable authentication.

Could someone let me know if this is enough to enable UEFI variables authentication and how to confirm that the UEFI variables signature is being verified by the L4TLauncher?

This is on scarthgap 36.4.3.

[madisongh]

IIRC variable authentication is automatically enabled (and required) when you turn on UEFI secure boot. I don't think there's a separate knob for enabling/disabling it.

[Lexmark-chad]

That is correct. If you wanted to resolve all doubt you could turn on UEFI debug and make ensure that the measurement code is executed and returns success.

https://github.com/NVIDIA/edk2-nvidia/blob/r36.4.3-updates/Silicon/NVIDIA/Drivers/FvbNorFlashDxe/VarIntCheck.c#L543