Customer requirement OTA, Secure Boot, Read-only rootfs and partition encryption

Robotics & Edge Computing Jetson Systems Jetson Orin Nano
,
7

Hi @JerryChang
Sorry, our JetPack 6.2 with Orin NX module, NVMe storage.

I did sample test follows Q4 Topic 264454 as follows.

  1. $ echo "f0e0d0c0b0a001020304050607080900" > ekb.key
  2. $ sudo ./tools/kernel_flash/l4t_initrd_flash.sh -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" --no-flash --showlogs --network usb0 jetson-orin-nano-devkit-super internal
  3. $ sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -i ./ekb.key -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml --external-only --append --network usb0 jetson-orin-nano-devkit-super external
  4. $ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --network usb0 --flash-only
    Flash successful and boot failed as follows.
    ENC
    ENC2174×586 132 KB

Addition, added ROOTFS_AB support in step 2. as follows..
$ sudo ROOTFS_AB=1 EXT_NUM_SECTORS=2000409008 ROOTFS_RETRY_COUNT_MAX=3 ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --external-device nvme0n1p1 -i ./ekb.key -S 40GiB -c tools/kernel_flash/flash_l4t_nvme_rootfs_ab_enc.xml --no-flash --showlogs --external-only --append --network usb0 jetson-orin-nano-devkit-super external
Flash successful and boot failed as follows.

ABENC
ABENC3292×932 275 KB

Error message changed, ROOTFS_AB work with ROOTFS_ENC look like.

I will find “crypt_root_other & crypt_UDA command not found” and reading forum therad and DiskEncryption.

Notice: Our testing Orin NX is unfuse, but I saw disk encryption only enabled with a fused device.
No idea about fused, fused key in Secure Boot or other?

Thanks a lot.