Disk encryption not working (2) . AGX Orin but also Orin Nano - r35.5.0

Robotics & Edge Computing Jetson Systems Jetson Orin Nano
,
18

I just check every step twice. You can see that for updating that file I use a cp. I’ve checked removing first and copying after to be sure the remaining file is the new one. Same error.

I’ve checked your link. A few things:

  • example.sh contains t194 and t234 example. So first I comment t194 example.
  • Then, I change echo "f0e0d0c0b0a001020304050607080900" > sym2_t234.keyby (2) $ echo "f0e0d0c0b0a0010203040506070809aa" > sym2_t234.key. But, error appears of course, because the topic solution you refer is not updated.
    FileNotFoundError: [Errno 2] No such file or directory: ‘device_id_cert.der’

File,which I really don’t know what it is. So, ok, I remove this line. And these others:

       -in_device_id device_id_cert.der \
        -in_ftpm_sn 00000000000000000000 \
        -in_ftpm_eps_seed ftpm_eps_seed_file \
        -in_ftpm_rsa_ek_cert ftpm_rsa_ek_cert.der \
        -in_ftpm_ec_ek_cert ftpm_ec_ek_cert.der \

But, here at the example you say for t194:

# This is default KEK2 root key for unfused board
#echo "00000000000000000000000000000000" > kek2.key

And for t234:

# [T234 example]
# Fill your OEM_K1 fuse key value
echo "2d4a614e645267556b58703273357638792f423f4428472b4b6250655368566d" > oem_k1.key

I guess this second value,is for a fused board. Because mine is not fuse, I’ve been using this as you could see:
echo "0000000000000000000000000000000000000000000000000000000000000000" > sym_t234.key

I guess this is the right way. And that your Topic answer in wrong because is outdated. Please,confirm this is right. The resulting example.sh should be:

# [T234 example]
# Fill your OEM_K1 fuse key value
echo "0000000000000000000000000000000000000000000000000000000000000000" > oem_k1.key

# This is the fixed vector for deriving EKB root key from fuse.
# It is expected user to replace the FV below with a user specific
# FV, and code the exact same user specific FV into OP-TEE.
echo "bad66eb4484983684b992fe54a648bb8" > fv_ekb_t234

# Generate user-defined symmetric key files
# For each key, uncomment the random generate key and comment out the next line for production
# openssl rand -rand /dev/urandom -hex 32 > sym_t234.key    # kernel/kernel-dtb encryption key
echo "0000000000000000000000000000000000000000000000000000000000000000" > sym_t234.key
# openssl rand -rand /dev/urandom -hex 16 > sym2_t234.key   # disk encryption key
echo "f0e0d0c0b0a0010203040506070809aa" > sym2_t234.key
# openssl rand -rand /dev/urandom -hex 16 > auth_t234.key   # uefi variables authentication key
echo "d9f7b49e3b6264985f1326f541bb43c9" > auth_t234.key

python3 gen_ekb.py -chip t234 -oem_k1_key oem_k1.key \
        -fv fv_ekb_t234 \
        -in_sym_key sym_t234.key \
        -in_sym_key2 sym2_t234.key \
        -in_auth_key auth_t234.key \
        -out eks_t234.img

Then I execute your suggested commands:

  923  cd Linux_for_Tegra/
  924  sudo ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --no-flash --showlogs -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" jetson-agx-orin-devkit internal
  925  sudo ./flash.sh --no-flash -k A_eks jetson-agx-orin-devkit internal
  926  sudo cp bootloader/eks_t234_sigheader.img.encrypt ./tools/kernel_flash/images/internal/.
  927  sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -i ./sym2_t234.key -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml --external-only --append --network usb0 jetson-agx-orin-devkit external
  928  sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --network usb0 --flash-only

One thing that surprises me is: A_eks. Where is it getting from ,I didn’t get error executing its line. It’s also strange for me because is every different to every solution I’ve found at the forum. And those steps don’t say anythin about modify NUM_SECTORS of .xml. That is weird. But I’ve followed to test those steps as you asked.

The result is a black screen too. But before keep digging, please, because I think those steps are not complete, don’t you have updated and complete steps to provide?