Hi Team,
We need to encrypt the partition on the production device with Jetson Orin Nano 8Gb module and custom carrier board.
First of all I found a solution for Jetson Orin Nano 8Gb devboard.
It’s based on these two topics:
Generate custom key
cd ./source/public/optee/samples/hwkey-agent/host/tool/gen_ekb/
./example.sh
cd ../../../../../../../..
cp ./source/public/optee/samples/hwkey-agent/host/tool/gen_ekb/sym2_t234.key ./sym2_t234.key
rm ./bootloader/eks_t234.img
cp ./source/public/optee/samples/hwkey-agent/host/tool/gen_ekb/eks_t234.img ./bootloader/eks_t234.img
Modify
./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml
like this for ~230Gb device and 200Gb LUKS partition
<device type="external" instance="0" sector_size="512" num_sectors="460000000" >
...
<partition name="APP_ENC" id="2" type="data" encrypted="true" reencrypt="false">
<allocation_policy> sequential </allocation_policy>
<filesystem_type> basic </filesystem_type>
<size> 214748364800 </size>
Connect dev-board by USB and UART to host machine.
Put it to recovery mode.
Explicitly build something with new key by outdated scripts
sudo ./flash.sh --no-flash -k A_eks -i "sym2_t234.key" jetson-agx-orin-devkit mmcblk0p1
Prepare images for internal device (and reset flashing image folders)
sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -p "-c ./bootloader/generic/cfg/flash_t234_qspi_nvme.xml" --no-flash --network usb0 jetson-orin-nano-devkit internal
Copy something key-related manually to internal device
sudo cp ./bootloader/eks_t234_sigheader.img.encrypt ./tools/kernel_flash/images/internal/eks_t234_sigheader.img.encrypt
Prepare images for external device
sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -i ./sym2_t234.key -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml --external-only --append --network usb0 jetson-orin-nano-devkit external
Flash to device physically
sudo systemctl stop udisks2.service
sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --network usb0 --flash-only
This sequence is working and I have my dev-board flashed with an encrypted partition.
Successul flashing log flash_5-1_0_20240702-170918.log.txt (49.8 KB)
Also I attach the part of UART output before and after “waiting for reboot phase” flashing_uart_devboard_success.log (7.1 KB)
PRODUCTION BOARD HAS AN ISSUE
First of all I need to use the first stage with a BOARDSKU explicity mentioned
sudo BOARDID=3767 BOARDSKU=0005 ./flash.sh --no-flash -k A_eks -i "sym2_t234.key" jetson-agx-orin-devkit mmcblk0p1
This SKU is different that production board has.
Dev-board BOARDSKU=0005
Prod-board BOARDSKU=0003
Image building stages passed well.
Log: build_internal_prodboard.log (190.0 KB)
Log: build_external_prodboard.log (134.5 KB)
Flashing process stuck on waiting for reboot and failed on timeout even hasn’t started the real flashing
Log:flashing_host_prodboar_fail.log (9.6 KB)
The last part of UART output for failed prod-board flashing is
flashing_uart_prodboard_fail.log (6.8 KB)
[ 6.758618] tegra-qspi 3270000.spi: Adding to iommu group 8
[ 6.759258] tegra-qspi 3270000.spi: Prod config not found for QSPI: -19
[ 6.760314] spi-nor spi0.0: mx25u51279g (65536 Kbytes)
[ 67.859091] using random self ethernet address
[ 67.859097] using random host ethernet address
[ 67.866284] Mass Storage Function, version: 2009/09/11
[ 67.866289] LUN: removable file: (no medium)
[ 67.867760] LUN: removable file: (no medium)
Add /dev/nvme0n1
[ 67.868994] LUN: removable file: (no medium)
[ 67.870165] LUN: removable file: (no medium)
[ 67.872963] usb0: HOST MAC aa:0d:b6:4f:96:37
[ 67.872968] usb0: MAC 9a:5f:79:9e:ca:f8
[ 67.875135] tegra-xudc 3550000.usb: EP 0 (type: ctrl, dir: out) enabled
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
bash-5.1#
Actually I have the same Error -19 for QSPI and bash-5.1# during the successful flashing process for dev-board, so it’s not looking as an issue
[ 6.655278] tegra-qspi 3270000.spi: Adding to iommu group 9
[ 6.655796] tegra-qspi 3270000.spi: Prod config not found for QSPI: -19
[ 6.656846] spi-nor spi0.0: mx25u51279g (65536 Kbytes)
[ 67.756256] using random self ethernet address
[ 67.756262] using random host ethernet address
[ 67.763332] Mass Storage Function, version: 2009/09/11
[ 67.763338] LUN: removable file: (no medium)
[ 67.764679] LUN: removable file: (no medium)
Add /dev/nvme0n1
[ 67.766039] LUN: removable file: (no medium)
[ 67.767218] LUN: removable file: (no medium)
[ 67.769904] usb0: HOST MAC 12:89:79:64:44:f7
[ 67.769910] usb0: MAC 96:23:8e:71:d7:34
[ 67.771123] tegra-xudc 3550000.usb: EP 0 (type: ctrl, dir: out) enabled
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
bash-5.1# [ 68.319702] tegra-xudc 3550000.usb: EP 5 (type: intr, dir: in) enabled
[ 68.319724] tegra-xudc 3550000.usb: EP 3 (type: bulk, dir: in) enabled
[ 68.319737] tegra-xudc 3550000.usb: EP 2 (type: bulk, dir: out) enabled
[ 68.319860] IPv6: ADDRCONF(NETDEV_CHANGE): usb0: link becomes ready
[ 68.320014] tegra-xudc 3550000.usb: EP 7 (type: bulk, dir: in) enabled
[ 68.320031] tegra-xudc 3550000.usb: EP 4 (type: bulk, dir: out) enabled
Any suggestions how to fix this flashing process for production Jetson Orin Nano 8Gb board with QSPI+SSD by file-system with Encrypted partition?
I use Jetpack 6 for this
wget https://developer.nvidia.com/downloads/embedded/l4t/r36_release_v2.0/release/jetson_linux_r36.2.0_aarch64.tbz2
wget https://developer.nvidia.com/downloads/embedded/l4t/r36_release_v2.0/release/tegra_linux_sample-root-filesystem_r36.2.0_aarch64.tbz2
wget https://developer.nvidia.com/downloads/embedded/l4t/r36_release_v2.0/sources/public_sources.tbz2