Error when flashing BSP to fused Orin NX

Hi,

I did the following steps and get an error when I tried to re-flash a fused Orin NX. The error code is 3. Could you please help to provide more information about the error code, and what could be the cause? Many thanks.

(1) I downloaded the Nvidia BSP 36.4.3 and signed the image using the following command.

sudo BOARDID=3767 FAB=300 BOARDSKU=0000 ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash --external-device nvme0n1p1 -p “-c ./bootloader/generic/cfg/flash_t234_qspi.xml” -c ./tools/kernel_flash/flash_l4t_t234_nvme.xml --showlogs --network usb0 -u rsa-3d-priv-key.pem jetson-orin-nano-devkit nvme0n1p1

(2) I flashed a signed BSP image to a Orin NX development platform using the following command

sudo ./tools/kernel_flash/l4t_initrd_flash.sh --flash-only --external-device nvme0n1p1 -p “-c ./bootloader/generic/cfg/flash_t234_qspi.xml” -c ./tools/kernel_flash/flash_l4t_t234_nvme.xml --showlogs --network usb0 jetson-orin-nano-devkit nvme0n1p1

Now the system could boot;

(3)then I fused the Orin NX with the following fuse contents. I tested the fuse process and finally burned the fuse bits successfully to enable secure boot.

(4) Then it seems the system is not booting because I cannot see any output from serial.

(5) I tried to reflash the Orin NX, then I got the following error.

xxxx@xxxxxx-2:~/Linux_for_Tegra/bootloader$ sudo bash ./flashcmd.txt
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands

Entering RCM boot

[ 0.0126 ] mb1_t234_prod_aligned_sigheader.bin.signed filename is from --mb1_bin
[ 0.0126 ] psc_bl1_t234_prod_aligned_sigheader.bin.signed filename is from --psc_bl1_bin
[ 0.0126 ] rcm boot with presigned binaries
[ 0.0131 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.signed
[ 0.0134 ] BR_CID: 0xC1012344705DF10F3000000004000140
[ 0.2642 ] Sending bct_br
[ 0.3611 ] Sending mb1
[ 0.3619 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.signed

I tried both 36.4 and 36.4.3, it seems this can be triggered even with --test

hello yanlin.li,

please put the device enter forced recovery mode, and let’s read the fuse through flash script.
for instance, $ sudo ./flash.sh --read-info -u <pkc> -v <sbk> <target_conf> <rootdev>
and… please check Jetson Orin Fuse Specification, especially the FUSE_BOOT_SECURITY_INFO_0

Hi Jerry,

Many thanks of your prompt response and help. I am using RSA 3K keys

==== Fuse Info (/home/xxxx/ebs/bsp-openssl/orin-bsp-36-4-ready-to-sign/ready-to-sign-hsm-pkc2-uefi-signed/bootloader/fuse_t234.bin) ====

PublicKeyHash: 6f5311951fb519a0b8768e9fe50540cc025f82108536727ce220b1e26f84582720ed8f99d1eba61040c368ab6f99609894a1887f00d5e6ea25ac436ddfb956be

PkcPubkeyHash1: 372148c9926ab7a362d0b442cb93b1d4c456ade6fe24c2408adee6ce0379396ba3966cb0f2bb1d43685dab1e054836570192d0366cead058a2f17aaf1eba13c6

PkcPubkeyHash2: f0668100bed9c45db0c1c83b6b1603afba155126d7ab20ab61f4f48efe68ee1a25c12a41679a20701875eb05084281515654dacc0ad0ce190492321a8398cb62

BootSecurityInfo: 00000001

ArmJtagDisable: 00000000

SecurityMode: 00000001

SwReserved: 00000000

DebugAuthentication: 00000000

OdmInfo: 00000000

OdmId: 0000000000000000

OdmLock: 00000000

ReservedOdm0: 00000000

ReservedOdm1: 00000000

ReservedOdm2: 00000000

ReservedOdm3: 00000000

ReservedOdm4: 00000000

ReservedOdm5: 00000000

ReservedOdm6: 00000000

ReservedOdm7: 00000000

Sku: 000000d3

Uid: c001fd020000003c20e85d7004000000

OptEmcDisable: 00000000

@JerryChang more details.

I build and sign the image on AWS EC2. Because EC2 cannot detect any Orin NX attached, I comment out fill_devpaths in l4t_initrd_flash.sh, when I run the build script. However, the flashing operation is done locally on a Ubuntu machine with one Orin NX in the recovery mode. When I do flashing, I added the fill_devpaths back in l4t_initrd_flash.sh

Therefore, is that possible when I build and sign the image on EC2, it does not sign the RCM messages? Therefore the flashing failed?

I did build, sign, and flash by using one command on a local machine with one Orin NX attached several times already, all worked. However, the image I build on AWS cannot be flashed.

hello yanlin.li,

all right, it might be the issue on AWS side.

please refer to $OUT/Linux_for_Tegra/tools/kernel_flash/README_initrd_flash.txt for [Workflow 8: Secure initrd Massflash].
it shows the steps to create massflash package.

1 Like

Thank you, @JerryChang !

Hi @JerryChang it seems it works now when I use openssl keys to sign the BSP images. However, I still have the same problems when I sign the images using AWS CloudHSM keys.

Could you please share some advices what would be the common or previous mistakes you saw when using AWS CloudHSM to do the signing? I would greatly appreciate any advice.

Many thanks!

Hi @JerryChang

Are there specific ways that I can verify the signatures of the images on my local machine? The reason I am asking this is that, it seems the error is caused by invalid signatures. The host is sending some packages with signatures to Orin NX when this error happens. How can I find the corresponding signature files and raw data, so that I can verify the signatures on my local machine? For example, how can I verify if the signature of mb1_t234_prod_aligned_sigheader.bin.signed is correct?

In short, what is the way that I can use to verify the signing results on my local machine?

[ 0.0126 ] mb1_t234_prod_aligned_sigheader.bin.signed filename is from --mb1_bin
[ 0.0126 ] psc_bl1_t234_prod_aligned_sigheader.bin.signed filename is from --psc_bl1_bin
[ 0.0126 ] rcm boot with presigned binaries
[ 0.0131 ] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader.bct.signed
[ 0.0134 ] BR_CID: 0xC1012344705DF10F3000000004000140
[ 0.2642 ] Sending bct_br
[ 0.3611 ] Sending mb1
[ 0.3619 ] ERROR: might be timeout in USB write.

hello yanlin.li,

that’s a good question, you should flash the image to the target, it’ll booting up only when the signature is matched.

Hi @JerryChang thank you for all your help. I already figured out the root cause, now I can boot a BSP-36.4 image signed by a RSA 3K key in cloudhsm.

Two quick comments on the BSP code:
(1) the l4t_initrd_flash.sh calls fill_devpaths in the offline mass flash mode, which should be a bug in the BSP.
(2) When signing using Tegraopenssl, the python or bash script does not check if the Tegraopenssl signing returns error or not. In my case, it still generated the final image though the signing failed.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.