I think I’ve solved the issue on version jetpack 5.1.4 by adding -u vio_rsa_priv.pem -v sbk.key to all commands.
But I don’t know the reason why I had to include those flags together. Could you explain it to me? @JerryChang
Here are the steps I followed to successfully flash JetPack 5.1.4:
tar -xpvf Jetson_Linux_R35.6.0_aarch64.tbz2
cd Linux_for_Tegra/rootfs/
sudo tar -xpvf ../../Tegra_Linux_Sample-Root-Filesystem_R35.6.0_aarch64.tbz2
cd .. # in Linux_for_Tegra folder
sudo ./apply_binaries.sh # Copy NVIDIA user space libraries into target file system
sudo ./tools/l4t_flash_prerequisites.sh # Install the prerequisite dependencies for flashing just one time
vim example.sh to edit kek2.key as following.
echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" > kek2.key
./example.sh
#!/bin/bash
# [T194 example]
# This is default KEK2 root key for unfused board
echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" > kek2.key
# This is the fixed vector for deriving EKB root key from fuse.
# It is expected user to replace the FV below with a user specific
# FV, and code the exact same user specific FV into OP-TEE.
echo "bad66eb4484983684b992fe54a648bb8" > fv_ekb_t194
# Generate user-defined symmetric key files
# For each key, uncomment the random generate key and comment out the next line for production
# openssl rand -rand /dev/urandom -hex 16 > sym_t194.key
echo "00000000000000000000000000000000" > sym_t194.key
# openssl rand -rand /dev/urandom -hex 16 > sym2_t194.key
echo "00000000000000000000000000000000" > sym2_t194.key
# openssl rand -rand /dev/urandom -hex 16 > auth_t194.key
echo "00000000000000000000000000000000" > auth_t194.key
python3 gen_ekb.py -chip t194 -kek2_key kek2.key \
-fv fv_ekb_t194 \
-in_sym_key sym_t194.key \
-in_sym_key2 sym2_t194.key \
-in_auth_key auth_t194.key \
-out eks_t194.img
cp eks_t194.img ./Linux_for_Tegra/bootloader/.
cp sym2_t194.key ./Drivers/Linux_for_Tegra/.
cp kek2.key sbk.key vio_rsa_priv.pem ./Linux_for_Tegra/.
- (1) Reattach the device to the host in RM mode
sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u vio_rsa_priv.pem -v sbk.key --no-flash --showlogs -p "-c bootloader/t186ref/cfg/flash_l4t_t194_qspi_p3668.xml" jetson-xavier-nx-devkit-emmc mmcblk0p1
- (2) Reattach the device to the host in RM mode
sudo ./flash.sh -u vio_rsa_priv.pem -v sbk.key --no-flash -k A_eks jetson-xavier-nx-devkit-emmc mmcblk0p1
sudo cp bootloader/eks_t194_sigheader.img.encrypt ./tools/kernel_flash/images/internal/.
- (4) Reattach the device to the host in RM mode
sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u vio_rsa_priv.pem -v sbk.key -p --no-flash -i ./sym2_t194.key -c ./tools/kernel_flash/flash_l4t_t194_nvme_rootfs_enc.xml jetson-xavier-nx-devkit-emmc mmcblk0p1
Done!
