Flash paration failed after enable secure boot

[779784017]

I flashed the tx2nx with jp4.6.3 and enable the secure boot and disk encryption, it can boot successfully, then I tried to flash the cpu-bootloader or kernel paration and it failed.
My flash steps:
1、burn fuse: sudo ./odmfuse.sh -i 0x18 -p -k key/pkc/pkc.pem -S key/sbk/sbk.key --KEK2 key/kek2/kek2.key --force jetson-xavier-nx-devkit-tx2-nx
2、flash: sudo ROOTFS_ENC=1 ./flash.sh -u key/pkc/pkc.pem -v key/sbk/sbk.key -i key/encrypt/encrypt.key --user_key key/user/user_for_flash.key -S 13GiB jetson-xavier-nx-devkit-tx2-nx mmcblk0p1
(the function “get_fuse_level” in flash.sh and odmfuse.func are different about getting “SBKPCK” so I modified)
3、boot successfully
4、flash kernel paration: sudo ROOTFS_ENC=1 ./flash.sh -k kernel -u key/pkc/pkc.pem -v key/sbk/sbk.key -i key/encrypt/encrypt.key --user_key key/user/user_for_flash.key jetson-xavier-nx-devkit-tx2-nx mmcblk0p1
5、then the flash.sh will holding and cannot over.
6、the debug log only shows :
[0016.880] E> Blob is not set
[0017.397] C> cpu waypoint0 failed
[0017.400] C> ERROR: Highest Layer Module = 0x32, Lowest Layer Module = 0x40,
Aux Inf

So I don’t know what’s the problem, I want some help, thanks.
I will provide the flash log.
flash.log (23.6 KB)

[JerryChang]

@779784017

4、flash kernel paration: sudo ROOTFS_ENC=1 ./flash.sh -k kernel -u key/pkc/pkc.pem -v key/sbk/sbk.key -i key/encrypt/encrypt.key --user_key key/user/user_for_flash.key jetson-xavier-nx-devkit-tx2-nx mmcblk0p1

hello 779784017,

you cannot perform partition update, i.e. -k kernel once you’ve enable Jetson security. that’s due to a partial flash should never be used in factory environment, on the fused device.

hence,
please make sure a clean-full flashing for your fused targets.