Using SED (Self-encrypting drive) on Jetson Orin Nano

Robotics & Edge Computing Jetson & Embedded Systems Jetson Orin Nano
1

i would like to use an SED drive on Orin Jetson Nano and install jetpack on it. I saw some high-level information about using sedutil and u-boot configuration.

  1. I am using Jetpack.
  2. I want to use SED and use sedutil to lock and unlock the drive. I don’t need any other encyption like LUKS.
  3. Based from what i’ve read, I need to run the sedutil via u-boot to unlock the SED before it boots up.
  4. Regarding u-boot configuration, should I use the u-boot source code from here GitHub - u-boot/u-boot: "Das U-Boot" Source Tree or is there a specific U-boot source code that i should use for the Jetpack?
  5. Do i really need to modify the u-boot? Are there any other alternatives to be able to unlock the SED before it boots up?

thanks

3

just for confirmation, you’re working with Jetson Nano (t210) instead of Jetson Orin Nano (t234), right?
it’s due to t234 series is not using uboot

4

yes, I’m using t234 Jetson Orin Nano. And is this absence of u-boot mentioned on any documentation online?

Based from what I’ve researched, I need to call the sedutil command on u-boot to be able to unlock the SED. If Orin Nano isn’t using u-boot, what are my options to be able to unlock the SED before it boots-up?

thank you

5

hello nvidiartx10000,

the boot sequence is… MB1 → MB2 → UEFI → linux kernel.
it’s UEFI uses an OS loader (L4TLauncher) to load the file system,
you may please refer to developer guide, UEFI Adaptation for more details.

7

Hi Jerry,

I read the UEFI adaptation but I am a bit lost. I dont have much experience with UEFI but I’ll ask anyway and might need some guidance.

I have an executable compiled in C that unlocks the Self Encrypting Drive. I need to run this executable, which will ask for a passphrase, before the SED gets mounted and/or before the kernel gets loaded. This SED has a Jetpack OS installed on it.

Given that the SED drive is locked on power-up, how will i be able to execute and include this executable on boot-up before the Jetson Nano accesses the SED drive with the Jetpack OS on it? (by the way, I wont be using LUKS, i will solely use the SED’s hardware encryption/decryption)

thanks

8

hello nvidiartx10000,

as you can see per Disk Encryption section, it uses EKB key to flash a target to enable disk encryption.
we’re not supported with a prompt for passphrase to unlock. please customize it by yourself.