hello iced-nero,
FYI,
here’re some lesson learned for burning fuse onto those 0x1e0 modules.
you may see-also Topic 336374, and Topic 336683,
it’s resolved by 2-step approach for having BootSecurityInfo burned firstly.
BTW,
we’ve also tested disk encryption with the Orin module fused with PKC/SBK/OEM_K1.
here’re steps for your reference.
(1) Edit fused “oem_k1.key” and “sym2_t234.key” from source code.
(2) Generate eks_t234.img from optee package.
$ python3 gen_ekb.py -chip t234 -oem_k1_key oem_k1.key -fv fv_ekb_t234 -in_sym_key sym_t234.key -in_sym_key2 sym2_t234.key -in_auth_key auth_t234.key -out eks_t234.img
(3) Update the eks image accordingly.. Linux_for_Tegra/bootloader/eks_t234.img
(4) Flash command:
$ sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --external-device nvme0n1p1 -i ./sym2_t234.key -u ecp521_v3_0.pem -v sbk-256.key -c tools/kernel_flash/flash_l4t_t234_nvme.xml -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" --showlogs --network usb0 jetson-orin-nano-devkit internal