Cloning and Encrypting Nvidia Jetson Orin Nano Dev Board

Issue Overview

Users of the Nvidia Jetson Orin Nano Dev board are encountering difficulties when attempting to clone a disk-encrypted system and flash it to another device. This issue specifically affects systems using Jetson Linux 35.4.1/Jetpack 5.1.2 with disk encryption enabled (ROOTFS_ENC=1). The primary challenge lies in the inability to create a customized, encrypted system image that can be easily deployed across multiple devices.

Possible Causes

1. Security Constraints: The disk encryption feature is designed with strict security measures that prevent direct cloning or backup of encrypted systems to other devices.

2. ECID Dependency: Encrypted disks are tied to a specific ECID (Electronic Chip ID), making it impossible to directly transfer the encrypted system to another device.

3. Software Installation Limitations: Some packages, particularly those from NVIDIA repositories like nvidia-jetpack, have built-in checks that prevent installation outside of a Jetson device environment.

4. Encryption Timing: Disk encryption can only be enabled at the time of flashing, not after the system has been set up and customized.

Troubleshooting Steps, Solutions & Fixes

Understanding the Limitations

1. Recognize that directly cloning an encrypted Orin Nano system to another device is not possible due to security constraints.

2. Understand that the l4t_backup_restore.sh script does not support backing up and restoring encrypted systems across different devices.

Creating a Generic Encrypted Image

To deploy a similar setup across multiple devices, follow these steps:

1. Create a general massflash package with disk encryption enabled:

   • Refer to the NVIDIA documentation for creating encrypted images with a generic key.
   • Use the following link for detailed instructions:
     https://docs.nvidia.com/jetson/archives/r36.3/DeveloperGuide/SD/Security/DiskEncryption.html#creating-encrypted-images-with-a-generic-key

2. Customize the rootfs before encryption:

   • Only packages from Canonical repositories can be added to the rootfs before encryption.
   • Use the following guide for rootfs customization:
     https://docs.nvidia.com/jetson/archives/r36.3/DeveloperGuide/SD/RootFileSystem.html

Post-Encryption Setup

For software that cannot be included in the pre-encrypted image:

1. Flash each device with the generic encrypted image.

2. After flashing and initial boot, install additional software manually on each device:

   • This includes NVIDIA-specific packages like nvidia-jetpack.
   • Custom software and tools should also be installed at this stage.

Alternative Approach

If extensive customization is required:

1. Create an unencrypted system image with all necessary software and customizations.

2. Flash this unencrypted image to each device.

3. Enable disk encryption on each device individually after flashing:

   • Note that this approach requires manual encryption setup for each device.
   • Use the following command during flashing to enable encryption:

     ./flash.sh <board> <rootdev> ROOTFS_ENC=1
     

Important Considerations

• NVIDIA packages like nvidia-jetpack cannot be pre-installed in a customized rootfs due to built-in checks.
• Always ensure you have a backup of your data before attempting any system-wide changes or encryption processes.
• Keep in mind that while this approach allows for some level of standardization, it still requires individual setup for each device after flashing.