How can I enable DISK encryption in Orin nx?

[minorukatsuragi]

Hi.

I have questions about to enable DISK encryption in Orin nx?

For context, my os is based on yocto kirkstone branch, with l4t R35.4.1 JetPack release: 5.1.2
and I am building for nvida jetson Orin NX.

MACHINE ?= "p3768-0000-p3767-0000"

STEP1 Enabled Secure boot

In meta-tegra/recipes-bsp/tegra-binaries/tegra-bootfiles_35.4.1.bb

ODMFUSE_FILE ? = "${S}/bootloader/fuse_config_security.xml"

The image was built with the above settings.

fuse_config_security.xml

-------------------------------------------------------------------------------------------------------------------------------------------- Result The following fuse-related scripts were generated in the generated compressed file.

burnfuses.sh
l4t_sign_image.sh
secureflash.xml
odmfuse_pkc.xml

STEP2
Do you know how can I enable DISK encryption in Orin nx?
I have read the following guide but do not understand how it relates to meta-tegra.
https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/OpTee.html#sd-security-optee-keymaintenanceandekbs-ekbgeneration
Any information would be very helpful.

Regards.

[madisongh]

I don't think we have a reference implementation for L4T R35.x around at the moment, but the basic approach described in this ELC presentation - slides are here - could be adapted.