Orin NX fuse burning issue

Robotics & Edge Computing Jetson & Embedded Systems Jetson Orin Nano
,
1

I’m working on implementing Secure Boot on the Orin NX 8GB module, following the recommended steps

# Generate a PKC Key Pair

openssl genrsa -out rsa_priv.pem 3072

# Generate the Public Key (<pkc.pubkey>) and Public Key Hash (<pkc.hash>)

./tegrasign_v3.py --pubkeyhash <pkc.pubkey> <pkc.hash> --key <pkc.pem>

./Linux_for_Tegra/bootloader/tegrasign_v3.py --pubkeyhash pkc.pubkey pkc.hash --key rsa_priv.pem

# Use the Generated Outputs for Secure Boot in XML

# Generate a 32-byte SBK Key

Use below script to generate

——————————————————————————————

#!/bin/bash

# Generate eight 32-bit (4-byte) random values

SBK_0=$(openssl rand -hex 4)

SBK_1=$(openssl rand -hex 4)

SBK_2=$(openssl rand -hex 4)

SBK_3=$(openssl rand -hex 4)

SBK_4=$(openssl rand -hex 4)

SBK_5=$(openssl rand -hex 4)

SBK_6=$(openssl rand -hex 4)

SBK_7=$(openssl rand -hex 4)

# Combine them with 0x prefix and spaces (format for flash.sh -v option)

SBK_KEY=$(echo “0x${SBK_0} 0x${SBK_1} 0x${SBK_2} 0x${SBK_3} 0x${SBK_4} 0x${SBK_5} 0x${SBK_6} 0x${SBK_7}”)

echo “SBK key file (for flash.sh -v):”

echo “${SBK_KEY}” > sbk.key

cat sbk.key

# Combine them into one single hex string (for fuse XML SecureBootKey value)

SBK_KEY_XML=$(echo “0x${SBK_0}${SBK_1}${SBK_2}${SBK_3}${SBK_4}${SBK_5}${SBK_6}${SBK_7}”)

echo

echo “SBK key for fuse config (SecureBootKey value):”

echo “${SBK_KEY_XML}” > sbk_xml.key

cat sbk_xml.key

——————————————————————————————

This will generate sbk_xml.key and sbk_xml.key

# Generate fuse_nx.xml

# Test Fues

sudo ./Linux_for_Tegra/odmfuse.sh --test -X fuse_nx.xml -i 0x23 jetson-orin-nano-devkit

# To burn fuse

sudo ./odmfuse.sh -X fuse_nx.xml -i 0x23 jetson-orin-nano-devkit

# To sign without flashing

sudo ./flash.sh --no-flash -u ../rsa_priv.pem -v ../sbk.key jetson-orin-nano-devkit nvme0n1p1

# Flashing command

sudo ./flash.sh -u ../rsa_priv.pem -v ../sbk.key jetson-orin-nano-devkit nvme0n1p1

However, when attempting to burn the fuses, it seems the process isn’t completing as expected. Later, when I try to flash the signed image, I receive an error stating:
# OpMode: production, Boot Authentication: NS,
which suggests Secure Boot hasn’t been enabled.

Screenshot 2025-08-23 at 09.59.16
Screenshot 2025-08-23 at 09.59.161568×394 62.9 KB

I also noticed a recent update indicating that FUSE_BOOT_SECURITY_INFO_0 is now reserved by NVIDIA, and I’m unsure how this change affects the fuse burning process.

Additionally, I found a forum post suggesting a different sequence: perform a normal flash first, then burn the fuses, followed by flashing the signed firmware. I tried this approach as well, but it didn’t resolve the issue. Could someone help identify where things might be going wrong?

Jetson-Orin-Series-Modules-Fuse-Update-FSB_DA-12546-001v01.pdf (256.8 KB)

fuse_burning_log.txt (96.9 KB)

2

*** Please note that this reply is generated by LLM automatically ***

I’d be happy to help you troubleshoot the issue with burning fuses and enabling Secure Boot on your Jetson Orin NX 8GB module.

Overview of the Secure Boot process

To enable Secure Boot, you need to generate a PKC key pair, prepare an SBK key, and burn fuses using the odmfuse.sh script. Then, you need to flash the device with secured images using flash.sh with the -u and -v options.

Comparison of your steps with the recommended steps

Your steps seem to be mostly correct, but there are a few potential issues:

  1. Fuse burning sequence: You are trying to burn fuses before flashing the device. However, the recommended sequence is to perform a normal flash first, then burn the fuses, and finally flash the signed firmware. You tried this approach, but it didn’t resolve the issue.
  2. Reserved fuse: You mentioned that the 0x23 fuse is now reserved by NVIDIA. This might be the cause of the issue. You can try using a different fuse value or checking the latest documentation for updates on fuse values.
  3. SBK key generation: Your script for generating the SBK key seems correct. However, you might want to double-check that the SBK key is correctly formatted and that the sbkkey file is correctly generated.
  4. Fuse configuration file: You generated the fusenxxml file, but you didn’t provide the contents of the file. Make sure that the file is correctly formatted and that the fuse values are correct.

Troubleshooting suggestions

  1. Check the fuse burning log: You provided the fuseburninglog.txt file, but it’s not clear what the error message is. Please check the log file for any error messages or clues about what went wrong.
  2. Verify the SBK key: Double-check that the SBK key is correctly generated and formatted. You can try using a different SBK key generation script or tool to verify that the key is correct.
  3. Try a different fuse value: If the 0x23 fuse is reserved, try using a different fuse value. You can check the latest documentation for updates on fuse values.
  4. Check the device’s fuse configuration: Use the odmfuse.sh script to read the device’s fuse configuration and verify that the fuses are correctly set.

Additional resources

  1. Jetson Orin Series Modules Fuse Update: You provided the JetsonOrinSeriesModulesFuseUpdate_FSB-DA-12546-001_v01.pdf file, which might be helpful in understanding the fuse update process.
  2. NVIDIA documentation: Check the latest NVIDIA documentation for updates on Secure Boot, fuse values, and SBK key generation.

I hope these suggestions help you troubleshoot the issue and enable Secure Boot on your Jetson Orin NX 8GB module. If you have any further questions or need more help, feel free to ask!

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

4

I’ve attached a sample fuse XML file for your reference. Additionally, I haven’t been able to locate the latest documentation for the different fuse values of JP515. Below are a few error messages extracted from the log file:

sudo ./Linux_for_Tegra/odmfuse.sh -X fuse_nx.xml -i 0x23 jetson-orin-nano-devkit

copying minratchet_config(/home/hq-2/nvidia/nvidia_sdk/JetPack_5.1.5_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)… done.

./tegraflash.py --chip 0x23 --applet “/home/hq-2/nvidia/nvidia_sdk/JetPack_5.1.5_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra/bootloader/mb1_t234_prod.bin” --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins “mb2_applet applet_t234.bin” --cmd “dump eeprom cvm cvm.bin; dump custinfo custinfo_out.bin; reboot recovery” --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts

Welcome to Tegra Flash

version 1.0.0

Type ? or help for help and q or quit to exit

Use ! to execute system commands

[ 0.0147 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet

[ 0.0154 ] File rcm_state open failed

[ 0.0154 ] ERROR: failed to read rcm_state

[ 0.0154 ]

[ 0.0165 ] tegrasign_v3.py --key None --getmode mode.txt

[ 0.0167 ] Assuming zero filled SBK key

[ 0.0158 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts

[ 0.0205 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts

[ 0.0272 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts

[ 0.0317 ] Parsing partition layout

[ 0.0323 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp

[ 0.0334 ] Kernel DTB used: None

[ 0.0334 ] WARNING: dce base dtb is not provided

[ 2.1357 ] Pre-processing mb2bct config: tegra234-mb2-bct-misc-p3767-0000.dts

[ 2.1444 ] Generating coldboot mb2-bct

[ 2.1444 ] tegrabct_v2 --chip 0x23 0 --mb2bct mb2_cold_boot_bct.cfg --mb2bctcfg tegra234-mb2-bct-misc-p3767-0000_cpp.dtb --scr tegra234-mb2-bct-scr-p3767-0000_cpp.dtb

[ 2.1451 ] ERROR: value 0x31 is out of range

[ 2.1459 ] ERROR: value 0x31 is out of range

[ 2.1461 ] ERROR: value 0x31 is out of range

[ 2.1462 ] ERROR: value 0x31 is out of range

[ 2.1463 ] WARNING: unknown property ‘tfc_version’

[ 2.1464 ] WARNING: unknown property ‘addr_header_version’

[ 2.1546 ] Updating mb2-bct with storage information

*** Start fusing from fuse configuration …

./tegraflash.py --sdram_config tegra234-p3767-0001-sdram-l4t.dts --dev_params tegra234-br-bct-p3767-0000-l4t.dts --mb2bct_cfg tegra234-mb2-bct-misc-p3767-0000.dts --deviceprod_config tegra234-mb1-bct-cprod-p3767-0000.dts --wb0sdram tegra234-p3767-0001-wb0sdram-l4t.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --pinmux_config tegra234-mb1-bct-pinmux-p3767-dp-a03.dtsi --scr_config tegra234-mb2-bct-scr-p3767-0000.dts --pmc_config tegra234-mb1-bct-padvoltage-p3767-dp-a03.dtsi --pmic_config tegra234-mb1-bct-pmic-p3767-0000-a02.dts --br_cmd_config tegra234-mb1-bct-reset-p3767-0000.dts --prod_config tegra234-mb1-bct-prod-p3767-0000.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --gpioint_config tegra234-mb1-bct-gpioint-p3767-0000.dts --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts --bldtb tegra234-p3767-0001-p3768-0000-a0.dtb --bins “mb2_bootloader fskp_t234_updated.bin; mts_mce mce_flash_o10_cr_prod.bin; mb2_applet applet_t234.bin; dce_fw display-t234-dce.bin; xusb_fw xusb_t234_prod.bin; nvdec nvdec_t234_prod.fw; sce_fw camera-rtcpu-sce.img; psc_fw pscfw_t234_prod.bin; rce_fw camera-rtcpu-t234-rce.img; ape_fw adsp-fw.bin; tos tos-optee_t234.img; bpmp_fw bpmp_t234-TE980M-A1_prod.bin; bpmp_fw_dtb tegra234-bpmp-3767-0001-3509-a02.dtb; eks eks_t234.img; kernel boot.img; kernel_dtb tegra234-p3767-0001-p3768-0000-a0.dtb; spe_fw spe_t234.bin” --cfg flash.xml --odmdata gbe-uphy-config-8,hsstp-lane-map-3,hsio-uphy-config-0 --chip 0x23 --applet mb1_t234_prod.bin --concat_cpubl_bldtb --bl uefi_jetson_with_dtb.bin --cpubl uefi_jetson.bin --cpubl uefi_jetson.bin --concat_cpubl_bldtb --bl uefi_jetson_with_dtb.bin --ramcode 2 --cmd “burnfuses fuse_ZC6Dju.xml”

Welcome to Tegra Flash

version 1.0.0

Type ? or help for help and q or quit to exit

Use ! to execute system commands

[ 0.0163 ] Burning fuses. Please check the uart to get the result of fuse burning.

[ 0.0170 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet

[ 0.0176 ] File rcm_state open failed

[ 0.0178 ] ERROR: failed to read rcm_state

[ 0.0178 ]

[ 0.0190 ] tegrasign_v3.py --key None --getmode mode.txt

[ 0.0191 ] Assuming zero filled SBK key

[ 0.0181 ] Pre-processing config: tegra234-Existing cfg(/home/hq-2/nvidia/nvidia_sdk/JetPack_5.1.5_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra/bootloader/flash.xml) reused.

Existing applet(/home/hq-2/nvidia/nvidia_sdk/JetPack_5.1.5_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra/bootloader/mb1_t234_prod.bin) reused.

Existing cpubl(/home/hq-2/nvidia/nvidia_sdk/JetPack_5.1.5_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra/bootloader/uefi_jetson.bin) reused.

(standard_in) 1: syntax error

MagicId=0x45535546 version=0x1

node: name=PublicKeyHash size=64

value=0x1b1c0e70b750cc9bc76936d5eedc0ca14f6eda315a87c399fd885c943f5a38256cc3df0fdb9915c14f46c81a35204c29e3f1de2f8e49a86c874bab6e2c8cd35c

node: name=SecureBootKey size=32

value=0xc247832d99d2578cfda4cff5f3daa73b2941a8589f9060c1cf4478ba5418f90e

node: name=BootSecurityInfo size=4

value=0x0000020b

node: name=SecurityMode size=4

value=0x00000001

done.

size of FSKP binary 382336

size of Fuse Blob 172

File saved as fskp_t234_updated.bin

done.

6

hello Techgeek,

according to fuse_info.txt, it has.. BootSecurityInfo: 000001e0.
please note that, the fuse value for boot_security_info was burned (by manufacturing) to 0x1E0.
please also refer to Jetson Orin Series Modules Fuse Update Field Services Bulletin for the details to the FUSE_BOOT_SECURITY_INFO_0 fuse for ALL Jetson Orin Series Modules.

could you please share your fuse_nx.xml for cross check?
you may see-also similar forum topic, such as Topic 335952 for reference.

8

Follwing is my XML,

image
image2704×236 64.1 KB

9

hello Techgeek,

I doubt the previous fuse burn process has actually burn all of them, are you able to boot-up the device for confirmation?
here’s script file, nv_fuse_read.sh to read fuses in the target board,
for instance, $ sudo nv_fuse_read.sh .

you’ll need fuse your devices with a BootSecurityInfo value of 0x3EB (an OR of 0x20B and 0x1E0)
please try ignore SecurityMode at the moment for testing, otherwise, additional fuse write requests has blocked since you’ve enable the SecurityMode.

10

Hi JerryChnag,

Below are the fuse values extracted using sudo nv_fuse_read.sh

revoke_pk_h0: 0x
revoke_pk_h1: 0x
pk_h1: 0x
odminfo: 0x
pk_h2: 0x
odmid: 0x
system_fw_field_ratchet1: 0x
system_fw_field_ratchet0: 0x
system_fw_field_ratchet3: 0x
system_fw_field_ratchet2: 0x
optin_enable: 0x
public_key_hash: 0x
ecid: 0xcat: /sys/devices/platform/efuse-burn/ecid: No such file or directory
reserved_odm2: 0x
reserved_odm3: 0x
reserved_odm0: 0x
reserved_odm1: 0x
reserved_odm6: 0x
reserved_odm7: 0x
reserved_odm4: 0x
reserved_odm5: 0x
boot_security_info: 0x
security_mode: 0x
odm_lock: 0x

Have you reviewed the steps I mentioned earlier? If yes, could you point out where I might be making a mistake?

11

hello Techgeek,

you’ll need fuse your devices with a BootSecurityInfo value of 0x3EB (an OR of 0x20B and 0x1E0)
please double check [Jetson Orin Series Modules Fuse Update Field Services Bulletin] for the details to the FUSE_BOOT_SECURITY_INFO_0 fuse.

13

Hi JerryChang,

I successfully fused the Orin NX and generated signed images, but now I’m encountering a USB timeout error when trying to flash the device. Below are the full logs,

###############################################################################
L4T BSP Information:
R35 , REVISION: 6.1
User release: 0.0
###############################################################################
ECID is 0xEB012344705DF74A8000000019008080
Target Board Information:
Name: jetson-orin-nano-devkit, Board Family: t186ref, SoC: Tegra 234,
OpMode: production, Boot Authentication: SBKPKC,
Disk encryption: disabled ,
###############################################################################

copying emc_fuse_dev_params(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-br-bct-diag-boot.dts)… done.
copying device_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-device-p3767-0000.dts)… done.
copying misc_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-misc-p3767-0000.dts)… done.
copying minratchet_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)… done.
./tegraflash.py --chip 0x23 --applet “/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/mb1_t234_prod.bin” --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins “mb2_applet applet_t234.bin” --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts --cmd “dump eeprom cvm cvm.bin; dump custinfo custinfo_out.bin; reboot recovery” --key “/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem” --encrypt_key “/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key”
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[ 0.0132 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[ 0.0139 ] File rcm_state open failed
[ 0.0139 ] ERROR: failed to read rcm_state
[ 0.0139 ]
[ 0.0151 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --getmode mode.txt
[ 0.0159 ] Key size is 384 bytes
[ 0.0153 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts
[ 0.0201 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts
[ 0.0270 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts
[ 0.0316 ] Parsing partition layout
[ 0.0322 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[ 0.0333 ] Kernel DTB used: None
[ 0.0333 ] WARNING: dce base dtb is not provided

[ 0.0333 ] Parsing partition layout
[ 0.0340 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[ 0.0348 ] Creating list of images to be encrypted and signed
[ 0.0353 ] Generating ratchet blob
[ 0.0354 ] Generating coldboot mb1-bct
[ 0.0359 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[ 0.0365 ] MB1-BCT version: 0.13

[ 0.0379 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[ 0.0381 ] Added Platform Config 9 data with size :- 100
[ 0.0382 ]
[ 0.0382 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[ 0.0382 ]
[ 0.0383 ] Updating mb1-bct with firmware information
[ 0.0389 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[ 0.0396 ] mb1_cold_boot_bct_MB1.bct
[ 0.0396 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[ 0.0397 ] header_magic: 4d423142
[ 0.0403 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[ 0.0409 ] Generating SHA2 Hash for mb1bct
[ 0.0429 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[ 0.0437 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[ 0.0433 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[ 0.0437 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[ 0.0453 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[ 0.0461 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[ 0.0674 ] Key Size is 32 bytes
[ 0.0682 ] Performing aes-gcm encryption
[ 0.0683 ] --key e1972fb7a7133674218362d2c3340540168afbf104a0838045783b55601b818d
[ 0.0685 ] --iv bdb101f7688482b3db98217c
[ 0.0685 ] --aad 4d4243544016000000000000000000000000000000000000000000000000000400000000000000000000000000000000157a7b9606d3958e4ad3ea408066e3fe00000000bdb101f7688482b3db98217c
[ 0.0695 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[ 0.0700 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[ 0.0707 ] Key size is 384 bytes
[ 0.1027 ] Saving pkc public key in pub_key.key
[ 0.1025 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[ 0.1038 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --ratchet_blob ratchet_blob.bin --list images_list.xml oem-rsa
[ 0.1044 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[ 0.1050 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[ 0.1052 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[ 0.1085 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[ 0.1087 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[ 0.1119 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[ 0.1121 ] adding BCH for mb2_t234_aligned.bin
[ 0.1142 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[ 0.1224 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[ 0.1226 ] adding BCH for mb2_t234_aligned.bin
[ 0.1338 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[ 0.1348 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[ 0.1554 ] Key Size is 32 bytes
[ 0.1565 ] Performing aes-gcm encryption
[ 0.1567 ] --key b7bd25bc0b342cc08629c88067d62ce930a943933abe7514a8772c7c092145f8
[ 0.1569 ] --iv 8901e9525098d042ede722b0
[ 0.1569 ] --aad 4d423142903004000000005000000050010401000000000000000000000000040000000000000000000000000000000072382c61b4bac425cf218d136b80e127000000008901e9525098d042ede722b0
[ 0.1645 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[ 0.1647 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.1653 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.1661 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.1668 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.1682 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[ 0.1691 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[ 0.1893 ] Key Size is 32 bytes
[ 0.1903 ] Performing aes-gcm encryption
[ 0.1905 ] --key 65247766a1fc9e0c51cac876890472dff15fab5ec1c82fb927b057455d7aa0c2
[ 0.1907 ] --iv 191872e7753ac0f1a13a0cff
[ 0.1908 ] --aad 4d4231429030040000000050000000500104010000000000000000000000000400000000000000000000000000000000591381aee4df6cbb64e8308da342f53c00000000191872e7753ac0f1a13a0cff
[ 0.1988 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[ 0.1991 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.1996 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2004 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.2010 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2024 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[ 0.2031 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[ 0.2232 ] Key Size is 32 bytes
[ 0.2240 ] Performing aes-gcm encryption
[ 0.2242 ] --key a90c58306a3fc187215ba7e86d318e4a51d95812a45ee2b3efdf5b39599bc652
[ 0.2244 ] --iv 1bd3a71243cd0697de269d4c
[ 0.2245 ] --aad 505343420000020000001200000412000802020000000000000000000000000400000000000000000000000000000000929126c615ae438455e02c39dc5e3401000000001bd3a71243cd0697de269d4c
[ 0.2288 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[ 0.2289 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.2295 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2301 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.2307 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2320 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[ 0.2331 ] Perform key derivation on mb2_t234_sigheader.bin
[ 0.2538 ] Key Size is 32 bytes
[ 0.2549 ] Performing aes-gcm encryption
[ 0.2553 ] --key ca1715c2b3a78f77f981bae79223ce0b5c8ad8556ccd247e4c72b5404795c0d4
[ 0.2555 ] --iv 8cda6c109fabf28320fa6afd
[ 0.2556 ] --aad 4d423242c0eb050000000000000000000000000000000000000000000000000400000000000000000000000000000000ec739f0b19519fe97f17223a517aee87000000008cda6c109fabf28320fa6afd
[ 0.2664 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[ 0.2668 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[ 0.2674 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[ 0.2681 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[ 0.2686 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[ 0.2700 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[ 0.2707 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[ 0.2907 ] Key Size is 32 bytes
[ 0.2916 ] Performing aes-gcm encryption
[ 0.2918 ] --key 98b139c7036ff8d7323f358e44281ac997cd5747593888a970f271dd4559a20a
[ 0.2919 ] --iv d72c425419319875ce30dcda
[ 0.2921 ] --aad 50534342000002000000120000041200080202000000000000000000000000040000000000000000000000000000000090fdd45fbf6eee7cbcd7dc6cbc3ea31c00000000d72c425419319875ce30dcda
[ 0.2962 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[ 0.2964 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.2970 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2978 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[ 0.2984 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[ 0.2998 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[ 0.3008 ] Perform key derivation on mb2_t234_sigheader.bin
[ 0.3216 ] Key Size is 32 bytes
[ 0.3227 ] Performing aes-gcm encryption
[ 0.3230 ] --key 7a229d8e6c74fa2e100ced04f539e4558761e0033683a83b3a5744b3d5817a34
[ 0.3232 ] --iv 1f4f8a46cead331d1ed30337
[ 0.3233 ] --aad 4d423242c0eb0500000000000000000000000000000000000000000000000004000000000000000000000000000000009ba7fa5083be261ea2ac2c9fe75998dc000000001f4f8a46cead331d1ed30337
[ 0.3340 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[ 0.3347 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[ 0.3353 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[ 0.3360 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[ 0.3365 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[ 0.3380 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list images_list.xml --pubkeyhash pub_key.key --sha sha512
[ 0.3387 ] Key size is 384 bytes
[ 0.5271 ] Saving pkc public key in pub_key.key
[ 0.5261 ] Parsing dev params for multi chains
[ 0.5311 ] Generating br-bct
[ 0.5317 ] Updating dev and MSS params in BR BCT
[ 0.5318 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[ 0.5325 ] Updating bl info
[ 0.5332 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[ 0.5338 ] WARNING: boot chain is not completed. set to 0
[ 0.5344 ] Perform encryption on bct
[ 0.5357 ] tegrasign_v3.py --file br_bct_BR.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=br_bct_BR_kdf.yaml
[ 0.5363 ] Perform key derivation on br_bct_BR.bct
[ 0.5372 ] ERROR: 0[ 0.5574 ] Key Size is 32 bytes
[ 0.5582 ] Performing aes-gcm encryption
[ 0.5583 ] --key 9749e8927f079f362eedbe8959202e32eb61b29ea2ae854963daaf821a2e7b97
[ 0.5585 ] --iv 34d32cf3d183bf59daeeacea
[ 0.5585 ] --aad 9f61b3e9972ab7eb421816d58d7e92a442435442133215d1000000000000000000000000000000000000000034d32cf3d183bf59daeeacea
[ 0.5595 ] Sha saved in br_bct_BR_tmp_encrypt.sha
[ 0.5587 ] Get Signed section of bct
[ 0.5593 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --listbct bct_list.xml
[ 0.5600 ] Signing BCT
[ 0.5611 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list bct_list.xml --pubkeyhash pub_key.key --sha sha512
[ 0.5619 ] Key size is 384 bytes
[ 0.5939 ] Saving pkc public key in pub_key.key
[ 0.5929 ] Updating BCT with signature
[ 0.5937 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesig bct_list_signed.xml --pubkeyhash pub_key.key
[ 0.5944 ] Offset :4608 Len :3584
[ 0.5946 ] Generating SHA2 Hash
[ 0.5957 ] tegrasign_v3.py --key None --list bct_list.xml --sha sha512
[ 0.5959 ] Assuming zero filled SBK key
[ 0.5959 ] Assuming zero filled SBK key
[ 0.5978 ] Sha saved in br_bct_BR.sha
[ 0.5970 ] Updating BCT with SHA2 Hash
[ 0.5976 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesha bct_list_signed.xml
[ 0.5981 ] Offset :4608 Len :3584
[ 0.5983 ] Offset :68 Len :8124
[ 0.5984 ] Generating coldboot mb1-bct
[ 0.5991 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[ 0.5996 ] MB1-BCT version: 0.13

[ 0.6010 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[ 0.6012 ] Added Platform Config 9 data with size :- 100
[ 0.6012 ]
[ 0.6012 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[ 0.6012 ]
[ 0.6012 ] Updating mb1-bct with firmware information
[ 0.6018 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[ 0.6025 ] mb1_cold_boot_bct_MB1.bct
[ 0.6025 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[ 0.6025 ] header_magic: 4d423142
[ 0.6032 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[ 0.6038 ] Generating SHA2 Hash for mb1bct
[ 0.6059 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[ 0.6069 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[ 0.6065 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[ 0.6070 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[ 0.6086 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[ 0.6093 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[ 0.6292 ] Key Size is 32 bytes
[ 0.6301 ] Performing aes-gcm encryption
[ 0.6303 ] --key b6732df25f636045b35a36ddd2aa0b62ba750c2e7ac0b12299f39cac1a1a4758
[ 0.6304 ] --iv d86369b79dbb3ecda91c99d7
[ 0.6305 ] --aad 4d4243544016000000000000000000000000000000000000000000000000000400000000000000000000000000000000caef62db9d1b96cddc5a3a7178f4e24100000000d86369b79dbb3ecda91c99d7
[ 0.6315 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[ 0.6320 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[ 0.6327 ] Key size is 384 bytes
[ 0.6645 ] Saving pkc public key in pub_key.key
[ 0.6643 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[ 0.6655 ] Generating recovery mb1-bct
[ 0.6662 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[ 0.6668 ] MB1-BCT version: 0.13

[ 0.6681 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[ 0.6683 ] Added Platform Config 9 data with size :- 100
[ 0.6683 ]
[ 0.6683 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[ 0.6683 ]
[ 0.6684 ] Updating mb1-bct with firmware information
[ 0.6692 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct_MB1.bct --recov --updatefwinfo readinfo_t234_min_prod.xml.bin
[ 0.6701 ] mb1_bct_MB1.bct
[ 0.6701 ] Encrypting and signing mb1_bct_MB1.bct
[ 0.6702 ] header_magic: 4d423142
[ 0.6709 ] tegrahost_v2 --chip 0x23 0 --align mb1_bct_MB1_aligned.bct
[ 0.6715 ] Generating SHA2 Hash for mb1bct
[ 0.6736 ] Sha saved in mb1_bct_MB1_aligned.sha
[ 0.6744 ] Sha saved in mb1_bct_MB1.sha
[ 0.6740 ] tegrahost_v2 --appendsigheader mb1_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[ 0.6746 ] adding BCH for mb1_bct_MB1_aligned.bct
[ 0.6762 ] tegrasign_v3.py --file mb1_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_bct_MB1_aligned_sigheader_kdf.yaml
[ 0.6769 ] Perform key derivation on mb1_bct_MB1_aligned_sigheader.bct
[ 0.6968 ] Key Size is 32 bytes
[ 0.6976 ] Performing aes-gcm encryption
[ 0.6978 ] --key c5ac206f6556afe3e79e091165cf699d2728878fcf2d14b9d4bc030788b1777c
[ 0.6981 ] --iv 8f40cde7d20131d968f15656
[ 0.6981 ] --aad 4d42435440160000000000000000000000000000000000000000000000000004000000000000000000000000000000002a1bac8f6a1d209f0cd651c9276d1930000000008f40cde7d20131d968f15656
[ 0.6992 ] Sha saved in mb1_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[ 0.6996 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[ 0.7003 ] Key size is 384 bytes
[ 0.7321 ] Saving pkc public key in pub_key.key
[ 0.7318 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[ 0.7327 ] Error: Skip generating mem_bct because sdram_config is not defined
[ 0.7327 ] Error: Skip generating mem_bct because sdram_config is not defined
[ 0.7327 ] Copying signatures
[ 0.7336 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml --pubkeyhash pub_key.key
[ 0.7374 ] Boot Rom communication
[ 0.7381 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[ 0.7387 ] BR_CID: 0xEB012344705DF74A8000000019008080
[ 0.7702 ] Sending bct_br
[ 0.8135 ] Sending mb1
[ 0.8142 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
Reading board information failed.

I tried using different USB cables and ports on my host PC, but the error persists.

14

hello Techgeek,

may I know what’s your flash command-line, you may also setup serial console to gather the UART logs during image flashing.

15

Hi JerryChang,

Initially, I attempted a straightforward flashing approach using the command below:

sudo ./flash.sh -u rsa_priv.pem -v sbk.key jetson-orin-nano-devkit nvme0n1p1
However, this method didn’t work.

After checking the forum, I found an alternative approach that involves generating the binaries using the --no-flash flag, and then flashing it separately. The commands I used for this are listed below.

For creating binaries -

sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
  --no-flash \
  --external-device nvme0n1p1 \
  -u rsa_priv.pem \
  -v sbk.key \
  -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" \
  -c tools/kernel_flash/flash_l4t_t234_nvme.xml \
  --showlogs --network usb0 \
  jetson-orin-nano-devkit nvme0n1p1

For flasshing -

sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
  --flash-only \
  --external-device nvme0n1p1 \
  -u rsa_priv.pem \
  -v sbk.key \
  -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" \
  -c tools/kernel_flash/flash_l4t_t234_nvme.xml \
  --showlogs --network usb0 \
  jetson-orin-nano-devkit nvme0n1p1

Unfortunately, I didn’t have the UART logger set up during the flashing process, so I wasn’t able to capture the logs.

16

hello Techgeek,

note, you’ll need to flash the QSPI. it’s root-of-trust start from the BootROM for bootloader secureboot.

please try below to perform image flashing on fused target.
(1) Image creation,
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash -u PKC.pem -v SBK.key --external-device nvme0n1p1 -c tools/kernel_flash/flash_l4t_external.xml -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" --showlogs --network usb0 jetson-orin-nano-devkit internal
(2) Image flashing
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --flash-only -u PKC.pem -v SBK.key jetson-orin-nano-devkit internal

17

Hi JerryChang,

I tried using the commands you provided, but the error still persists.

$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --flash-only -u /filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem -v /filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/sbk.key jetson-orin-nano-devkit internal

/home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/tools/kernel_flash/l4t_initrd_flash_internal.sh  --usb-instance 1-5.1 --device-instance 0 --flash-only --external-device nvme0n1p1 -c "tools/kernel_flash/flash_l4t_external.xml" --network usb0 jetson-orin-nano-devkit internal
**********************************************
*                                            *
*  Step 1: Build the flashing environment    *
*                                            *
**********************************************
Create flash environment 0
/home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader /home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra
/home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra
Finish creating flash environment 0.
****************************************************
*                                                  *
*  Step 2: Boot the device with flash initrd image *
*                                                  *
****************************************************
/home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/temp_initrdflash/bootloader0 /home/filer/nvidia-flahing/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra
./tegraflash.py --bl uefi_jetson_with_dtb_sigheader_encrypt.bin.signed --bct br_bct_BR.bct --securedev  --bldtb tegra234-p3767-0000-p3768-0000-a0.dtb --applet rcm_2_signed.rcm --applet_softfuse rcm_1_signed.rcm --cmd "rcmboot"  --cfg secureflash.xml --chip 0x23 --mb1_bct mb1_bct_MB1_sigheader_encrypt.bct.signed --mem_bct mem_rcm_sigheader_encrypt.bct.signed --mb1_cold_boot_bct mb1_cold_boot_bct_MB1_sigheader_encrypt.bct.signed --mb1_bin mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --psc_bl1_bin psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --mem_bct_cold_boot mem_coldboot_aligned_sigheader_encrypt.bct.signed  --bins "psc_fw pscfw_t234_prod_sigheader_encrypt.bin.signed; mts_mce mce_flash_o10_cr_prod_sigheader_encrypt.bin.signed; mb2_applet applet_t234_sigheader_encrypt.bin.signed; mb2_bootloader mb2_t234_with_mb2_cold_boot_bct_MB2_sigheader_encrypt.bin.signed; xusb_fw xusb_t234_prod_sigheader_encrypt.bin.signed; dce_fw display-t234-dce_sigheader_encrypt.bin.signed; nvdec nvdec_t234_prod_sigheader_encrypt.fw.signed; bpmp_fw bpmp_t234-TE980M-A1_prod_sigheader_encrypt.bin.signed; bpmp_fw_dtb tegra234-bpmp-3767-0000-a02-3509-a02_with_odm_sigheader_encrypt.dtb.signed; sce_fw camera-rtcpu-sce_sigheader_encrypt.img.signed; rce_fw camera-rtcpu-t234-rce_sigheader_encrypt.img.signed; ape_fw adsp-fw_sigheader_encrypt.bin.signed; spe_fw spe_t234_sigheader_encrypt.bin.signed; tos tos-optee_t234_sigheader_encrypt.img.signed; eks eks_t234_sigheader_encrypt.img.signed; kernel boot0.img; kernel_dtb tegra234-p3767-0000-p3768-0000-a0.dtb"    --bct_backup  --instance 1-5.1
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands


 Entering RCM boot

[   0.0128 ] rcm boot with presigned binaries
[   0.0134 ] tegrarcm_v2 --instance 1-5.1 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   0.0139 ] BR_CID: 0xEB012344705DF74A8000000019008080
[   0.0183 ] Sending bct_br
[   0.0220 ] Sending mb1
[   0.0224 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --instance 1-5.1 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
Cleaning up...
18

hello Techgeek,

please try fuse read to verify the board status,
for instance, $ sudo ./flash.sh --read-info -u <pkc> -v <sbk> <target_conf> <rootdev>

besides… we’ll need to check the bootloader logs for the details. is it possible to setup serial console to gather the UART logs?

19

HI JerrryChang,

I executed the command

 .sudo /flash.sh --read-info -u $KEYS_PATH/rsa_priv.pem  -v $KEYS_PATH/sbk.key jetson-orin-nano-devkit internal

and the output is shown below.

###############################################################################
# L4T BSP Information:
# R35 , REVISION: 6.1
# User release: 0.0
###############################################################################
ECID is 0xEB012344705DF74A8000000019008080
# Target Board Information:
# Name: jetson-orin-nano-devkit, Board Family: t186ref, SoC: Tegra 234,
# OpMode: production, Boot Authentication: SBKPKC,
# Disk encryption: disabled ,
###############################################################################
copying emc_fuse_dev_params(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-br-bct-diag-boot.dts)... done.
copying device_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-device-p3767-0000.dts)... done.
copying misc_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-misc-p3767-0000.dts)... done.
copying minratchet_config(/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/t186ref/BCT/tegra234-mb1-bct-ratchet-p3767-0000.dts)... done.
./tegraflash.py --chip 0x23 --applet "/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/Linux_for_Tegra/bootloader/mb1_t234_prod.bin" --skipuid --cfg readinfo_t234_min_prod.xml --dev_params tegra234-br-bct-diag-boot.dts --device_config tegra234-mb1-bct-device-p3767-0000.dts --misc_config tegra234-mb1-bct-misc-p3767-0000.dts --bins "mb2_applet applet_t234.bin" --minratchet_config tegra234-mb1-bct-ratchet-p3767-0000.dts --cmd "dump eeprom cvm cvm.bin; dump custinfo custinfo_out.bin; reboot recovery" --key "/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem" --encrypt_key "/home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

[   0.0193 ] tegrarcm_v2 --chip 0x23 0 --ismb2applet
[   0.0199 ] File rcm_state open failed
[   0.0201 ] ERROR: failed to read rcm_state
[   0.0201 ]
[   0.0213 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --getmode mode.txt
[   0.0224 ] Key size is 384 bytes
[   0.0217 ] Pre-processing config: tegra234-mb1-bct-device-p3767-0000.dts
[   0.0294 ] Pre-processing config: tegra234-mb1-bct-misc-p3767-0000.dts
[   0.0383 ] Pre-processing config: tegra234-mb1-bct-ratchet-p3767-0000.dts
[   0.0468 ] Parsing partition layout
[   0.0485 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.0504 ] Kernel DTB used: None
[   0.0504 ] WARNING: dce base dtb is not provided

[   0.0505 ] Parsing partition layout
[   0.0515 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.tmp
[   0.0527 ] Creating list of images to be encrypted and signed
[   0.0542 ] Generating ratchet blob
[   0.0543 ] Generating coldboot mb1-bct
[   0.0556 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.0566 ] MB1-BCT version: 0.13

[   0.0591 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[   0.0593 ] Added Platform Config 9 data with size :- 100
[   0.0593 ]
[   0.0593 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[   0.0593 ]
[   0.0593 ] Updating mb1-bct with firmware information
[   0.0602 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.0612 ] mb1_cold_boot_bct_MB1.bct
[   0.0612 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[   0.0612 ] header_magic: 4d423142
[   0.0622 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.0628 ] Generating SHA2 Hash for mb1bct
[   0.0652 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.0663 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.0659 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   0.0665 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.0683 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[   0.0692 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[   0.0909 ] Key Size is 32 bytes
[   0.0916 ] Performing aes-gcm encryption
[   0.0918 ] --key fd8334ecb1388d5c6b92dbff7f77957a5059b1e3bce0499c906e10c95fce305e
[   0.0920 ] --iv 69a8247645127e6e843df58d
[   0.0920 ] --aad 4d4243544016000000000000000000000000000000000000000000000000000400000000000000000000000000000000d7ef134c7c5cd7a7c0a27877942eae670000000069a8247645127e6e843df58d
[   0.0929 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   0.0933 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.0940 ] Key size is 384 bytes
[   0.1247 ] Saving pkc public key in pub_key.key
[   0.1243 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[   0.1255 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --ratchet_blob ratchet_blob.bin --list images_list.xml oem-rsa
[   0.1260 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.1268 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.1270 ] MB1: Nvheader already present is mb1_t234_prod_aligned.bin
[   0.1304 ] Header already present for mb1_t234_prod_aligned_sigheader.bin
[   0.1306 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.1340 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.1342 ] adding BCH for mb2_t234_aligned.bin
[   0.1364 ] MB1: Nvheader already present is psc_bl1_t234_prod_aligned.bin
[   0.1444 ] Header already present for psc_bl1_t234_prod_aligned_sigheader.bin
[   0.1446 ] adding BCH for mb2_t234_aligned.bin
[   0.1558 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[   0.1568 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[   0.1772 ] Key Size is 32 bytes
[   0.1781 ] Performing aes-gcm encryption
[   0.1784 ] --key 45fa3cc33525b661bbc125c3e644833f7257c7c5c6db5ed67caea10a58f7ea25
[   0.1785 ] --iv cf85bb5c8ed6dd2391085fb5
[   0.1786 ] --aad 4d4231429030040000000050000000500104010000000000000000000000000400000000000000000000000000000000e43350c136387533a53d23dcca63474600000000cf85bb5c8ed6dd2391085fb5
[   0.1861 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   0.1861 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   0.1866 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.1873 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   0.1879 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.1893 ] tegrasign_v3.py --file mb1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_t234_prod_aligned_sigheader_kdf.yaml
[   0.1901 ] Perform key derivation on mb1_t234_prod_aligned_sigheader.bin
[   0.2103 ] Key Size is 32 bytes
[   0.2112 ] Performing aes-gcm encryption
[   0.2114 ] --key 05a829cb84090df0360544d32adac4e1d0038139d5cbf592de6ec17014df0671
[   0.2116 ] --iv 1f64fbf263f7d927bb805d27
[   0.2117 ] --aad 4d423142903004000000005000000050010401000000000000000000000000040000000000000000000000000000000056a376c2143a6971e2e841b9f64e8584000000001f64fbf263f7d927bb805d27
[   0.2190 ] Sha saved in mb1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   0.2191 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   0.2196 ] INFO: updated file for <A_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.2204 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin
[   0.2210 ] INFO: updated file for <B_mb1 mb1_bootloader mb1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.2225 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[   0.2232 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[   0.2432 ] Key Size is 32 bytes
[   0.2439 ] Performing aes-gcm encryption
[   0.2440 ] --key a6ea1bfddf62c9a6a7418666df188963198419f818208efd39b1ea564e9c84ab
[   0.2443 ] --iv b2dadfca4a8a85e7c2011736
[   0.2444 ] --aad 5053434200000200000012000004120008020200000000000000000000000004000000000000000000000000000000004ce8860b41b75355e678fb5259e2196a00000000b2dadfca4a8a85e7c2011736
[   0.2483 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   0.2484 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   0.2489 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.2497 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   0.2502 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.2516 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[   0.2526 ] Perform key derivation on mb2_t234_sigheader.bin
[   0.2734 ] Key Size is 32 bytes
[   0.2743 ] Performing aes-gcm encryption
[   0.2745 ] --key ddfa2e287fed91ebccb8c4b8eb820219db5902995e5eb0623945440a4fd8cf0c
[   0.2748 ] --iv 1f8e8b7ec83231f1bbfe9920
[   0.2749 ] --aad 4d423242c0eb0500000000000000000000000000000000000000000000000004000000000000000000000000000000001670ecbbb5ca5706d5b0d6e14c82c0cd000000001f8e8b7ec83231f1bbfe9920
[   0.2848 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[   0.2851 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   0.2857 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   0.2864 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   0.2869 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   0.2883 ] tegrasign_v3.py --file psc_bl1_t234_prod_aligned_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=psc_bl1_t234_prod_aligned_sigheader_kdf.yaml
[   0.2891 ] Perform key derivation on psc_bl1_t234_prod_aligned_sigheader.bin
[   0.3088 ] Key Size is 32 bytes
[   0.3095 ] Performing aes-gcm encryption
[   0.3097 ] --key 0efab3ed096b090be8812b2d63ecebfb4e9cd89ba474d87936c15c11a0e68b9c
[   0.3099 ] --iv ca6b2a8cf2bf1ad5c5b39e86
[   0.3100 ] --aad 5053434200000200000012000004120008020200000000000000000000000004000000000000000000000000000000006e2937e1b6bd6ee432b31da4713e45f100000000ca6b2a8cf2bf1ad5c5b39e86
[   0.3139 ] Sha saved in psc_bl1_t234_prod_aligned_sigheader_tmp0_encrypt.sha
[   0.3140 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   0.3145 ] INFO: updated file for <A_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.3152 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin
[   0.3158 ] INFO: updated file for <B_psc_bl1 psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin> successfully
[   0.3173 ] tegrasign_v3.py --file mb2_t234_sigheader.bin --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb2_t234_sigheader_kdf.yaml
[   0.3182 ] Perform key derivation on mb2_t234_sigheader.bin
[   0.3386 ] Key Size is 32 bytes
[   0.3396 ] Performing aes-gcm encryption
[   0.3399 ] --key 11a7778b3157114c6860f4a8b03ce8ba0cb8cf87028c1444dc5a6a38a48a6e7a
[   0.3402 ] --iv 848ae28d46d01e49175a789f
[   0.3403 ] --aad 4d423242c0eb050000000000000000000000000000000000000000000000000400000000000000000000000000000000263f6afe5bb2d4af5bedd1ead9816c4800000000848ae28d46d01e49175a789f
[   0.3508 ] Sha saved in mb2_t234_sigheader_tmp0_encrypt.sha
[   0.3511 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   0.3518 ] INFO: updated file for <A_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   0.3525 ] tegraparser_v2 --pt readinfo_t234_min_prod.xml.bin --update_part_filename B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin
[   0.3531 ] INFO: updated file for <B_mb2 mb2_bootloader mb2_t234_sigheader_encrypt.bin> successfully
[   0.3545 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list images_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.3553 ] Key size is 384 bytes
[   0.5390 ] Saving pkc public key in pub_key.key
[   0.5379 ] Parsing dev params for multi chains
[   0.5426 ] Generating br-bct
[   0.5433 ] Updating dev and MSS params in BR BCT
[   0.5434 ] tegrabct_v2 --dev_param tegra234-br-bct-diag-boot_cpp.dtb --brbct br_bct.cfg --chip 0x23 0
[   0.5441 ] Updating bl info
[   0.5447 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updateblinfo readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml
[   0.5453 ] WARNING: boot chain is not completed. set to 0
[   0.5458 ] Perform encryption on bct
[   0.5471 ] tegrasign_v3.py --file br_bct_BR.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=br_bct_BR_kdf.yaml
[   0.5477 ] Perform key derivation on br_bct_BR.bct
[   0.5484 ] ERROR: 0[   0.5676 ] Key Size is 32 bytes
[   0.5682 ] Performing aes-gcm encryption
[   0.5684 ] --key 482cebc81b55b2bcad17f4bb9c135e9ba3885edbe04e372ded66da7027f95831
[   0.5685 ] --iv 1ad0186cff7da4035336f305
[   0.5685 ] --aad 12b9fd11286a7987f44d019cd51bfee742435442acd3a30c00000000000000000000000000000000000000001ad0186cff7da4035336f305
[   0.5694 ] Sha saved in br_bct_BR_tmp_encrypt.sha
[   0.5686 ] Get Signed section of bct
[   0.5693 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --listbct bct_list.xml
[   0.5699 ] Signing BCT
[   0.5711 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.5719 ] Key size is 384 bytes
[   0.6031 ] Saving pkc public key in pub_key.key
[   0.6020 ] Updating BCT with signature
[   0.6026 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesig bct_list_signed.xml --pubkeyhash pub_key.key
[   0.6032 ] Offset :4608 Len :3584
[   0.6034 ] Generating SHA2 Hash
[   0.6046 ] tegrasign_v3.py --key None --list bct_list.xml --sha sha512
[   0.6047 ] Assuming zero filled SBK key
[   0.6047 ] Assuming zero filled SBK key
[   0.6066 ] Sha saved in br_bct_BR.sha
[   0.6057 ] Updating BCT with SHA2 Hash
[   0.6063 ] tegrabct_v2 --brbct br_bct_BR.bct --chip 0x23 0 --updatesha bct_list_signed.xml
[   0.6069 ] Offset :4608 Len :3584
[   0.6071 ] Offset :68 Len :8124
[   0.6072 ] Generating coldboot mb1-bct
[   0.6078 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.6083 ] MB1-BCT version: 0.13

[   0.6096 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[   0.6098 ] Added Platform Config 9 data with size :- 100
[   0.6098 ]
[   0.6098 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[   0.6098 ]
[   0.6098 ] Updating mb1-bct with firmware information
[   0.6104 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_cold_boot_bct_MB1.bct --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.6112 ] mb1_cold_boot_bct_MB1.bct
[   0.6112 ] Encrypting and signing mb1_cold_boot_bct_MB1.bct
[   0.6113 ] header_magic: 4d423142
[   0.6119 ] tegrahost_v2 --chip 0x23 0 --align mb1_cold_boot_bct_MB1_aligned.bct
[   0.6125 ] Generating SHA2 Hash for mb1bct
[   0.6146 ] Sha saved in mb1_cold_boot_bct_MB1_aligned.sha
[   0.6155 ] Sha saved in mb1_cold_boot_bct_MB1.sha
[   0.6151 ] tegrahost_v2 --appendsigheader mb1_cold_boot_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   0.6156 ] adding BCH for mb1_cold_boot_bct_MB1_aligned.bct
[   0.6172 ] tegrasign_v3.py --file mb1_cold_boot_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_cold_boot_bct_MB1_aligned_sigheader_kdf.yaml
[   0.6180 ] Perform key derivation on mb1_cold_boot_bct_MB1_aligned_sigheader.bct
[   0.6376 ] Key Size is 32 bytes
[   0.6382 ] Performing aes-gcm encryption
[   0.6384 ] --key 192352d2aa349a3ef578a7d5b6f91bc66f59a12c09f3106e51a0f59083491e8d
[   0.6386 ] --iv dc8f48a3710cdfcbd366daac
[   0.6386 ] --aad 4d424354401600000000000000000000000000000000000000000000000000040000000000000000000000000000000069cb2c47e46358f658293f2d53613b3700000000dc8f48a3710cdfcbd366daac
[   0.6394 ] Sha saved in mb1_cold_boot_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   0.6399 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.6407 ] Key size is 384 bytes
[   0.6718 ] Saving pkc public key in pub_key.key
[   0.6714 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_cold_boot_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[   0.6726 ] Generating recovery mb1-bct
[   0.6732 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct.cfg --misc tegra234-mb1-bct-misc-p3767-0000_cpp.dtb --device tegra234-mb1-bct-device-p3767-0000_cpp.dtb --minratchet tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb --ratchet_blob ratchet_blob.bin
[   0.6738 ] MB1-BCT version: 0.13

[   0.6752 ] Parsing config file :tegra234-mb1-bct-device-p3767-0000_cpp.dtb
[   0.6754 ] Added Platform Config 9 data with size :- 100
[   0.6754 ]
[   0.6754 ] Parsing config file :tegra234-mb1-bct-ratchet-p3767-0000_cpp.dtb
[   0.6754 ]
[   0.6755 ] Updating mb1-bct with firmware information
[   0.6761 ] tegrabct_v2 --chip 0x23 0 --mb1bct mb1_bct_MB1.bct --recov --updatefwinfo readinfo_t234_min_prod.xml.bin
[   0.6769 ] mb1_bct_MB1.bct
[   0.6769 ] Encrypting and signing mb1_bct_MB1.bct
[   0.6769 ] header_magic: 4d423142
[   0.6776 ] tegrahost_v2 --chip 0x23 0 --align mb1_bct_MB1_aligned.bct
[   0.6782 ] Generating SHA2 Hash for mb1bct
[   0.6804 ] Sha saved in mb1_bct_MB1_aligned.sha
[   0.6812 ] Sha saved in mb1_bct_MB1.sha
[   0.6807 ] tegrahost_v2 --appendsigheader mb1_bct_MB1_aligned.bct oem-rsa --chip 0x23 0 --magicid MBCT --ratchet_blob ratchet_blob.bin
[   0.6812 ] adding BCH for mb1_bct_MB1_aligned.bct
[   0.6828 ] tegrasign_v3.py --file mb1_bct_MB1_aligned_sigheader.bct --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/sbk.key --kdf kdf_file=mb1_bct_MB1_aligned_sigheader_kdf.yaml
[   0.6835 ] Perform key derivation on mb1_bct_MB1_aligned_sigheader.bct
[   0.7034 ] Key Size is 32 bytes
[   0.7041 ] Performing aes-gcm encryption
[   0.7043 ] --key 5bb72f7c2c036cd0a58819946bfdfc33a58367fec3cb323d612181aec6582bc0
[   0.7045 ] --iv caacf962b420c5492febca5a
[   0.7045 ] --aad 4d424354401600000000000000000000000000000000000000000000000000040000000000000000000000000000000078c972af037bbb435657bbe0f97f590500000000caacf962b420c5492febca5a
[   0.7055 ] Sha saved in mb1_bct_MB1_aligned_sigheader_tmp0_encrypt.sha
[   0.7059 ] tegrasign_v3.py --key /home/hq-2/nvidia/nvidia_sdk/JP_5.1.5_orin-nx-secure-boot/rsa_priv.pem --list mb1_bct_MB1_aligned_sigheader_encrypt.bct_list.xml --pubkeyhash pub_key.key --sha sha512
[   0.7065 ] Key size is 384 bytes
[   0.7374 ] Saving pkc public key in pub_key.key
[   0.7371 ] tegrahost_v2 --chip 0x23 0 --pubkeyhash pub_key.key --updatesigheader mb1_bct_MB1_aligned_sigheader_encrypt.bct.signed mb1_bct_MB1_aligned_sigheader_encrypt.bct.sig oem-rsa
[   0.7380 ] Error: Skip generating mem_bct because sdram_config is not defined
[   0.7380 ] Error: Skip generating mem_bct because sdram_config is not defined
[   0.7380 ] Copying signatures
[   0.7386 ] tegrahost_v2 --chip 0x23 0 --partitionlayout readinfo_t234_min_prod.xml.bin --updatesig images_list_signed.xml --pubkeyhash pub_key.key
[   0.7422 ] Boot Rom communication
[   0.7428 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   0.7433 ] BR_CID: 0xEB012344705DF74A8000000019008080
[   0.7771 ] Sending bct_br
[   0.8242 ] Sending mb1
[   0.8249 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
Reading board information failed.

My USB UART logger is currently not functioning, so I’m unable to capture UART logs at the moment.

20

hello Techgeek,

may I know what’s the platform you’re working with? for instance, is it Jetson Orin Nano developer kit, or a customize board?
please give it another try to setup a fresh new Jetpack installation, and have image creation/flashing again for testing.

21

Hi JerryChang,

The carrier board I’m using was developed and is sold by Tanna TechBiz. You can find the link to the board below.

I’m not sure whether it qualifies as a custom carrier board or not.

22

hello Techgeek,

is it possible to replace with Orin NX carrier board for verification?

23

Hi JerryChang,

I tried using a different carrier board, the Leetop A606, but the issue persists.
Do you have any suggestions for a compatible carrier board? Also, are you certain that replacing the carrier board will resolve the issue?

24

hello Techgeek,

please see-also EEPROM Modifications,
please check you’ve the following MB2 BCT modification for a customized carrier board.
i.e. cvb_eeprom_read_size = <0x0>