Flashing a new kernel natively on Xavier

Can we just flash (via dd command) a kernel image to eMMC partition directly on Xavier without using recovery mode and flash.sh script?

Here’s the eMMc card partition layout on our Xavier…

Model: MMC HBG4a2 (sd/mmc)
Disk /dev/mmcblk0: 31.3GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: 

Number  Start   End     Size    File system  Name              Flags
 1      20.5kB  30.1GB  30.1GB  ext4         APP               msftdata
 2      30.1GB  30.1GB  512kB                mts-mce           msftdata
 3      30.1GB  30.1GB  512kB                mts-mce_b         msftdata
 4      30.1GB  30.1GB  4194kB               mts-proper        msftdata
 5      30.1GB  30.1GB  4194kB               mts-proper_b      msftdata
 6      30.1GB  30.1GB  524kB                cpu-bootloader    msftdata
 7      30.1GB  30.1GB  524kB                cpu-bootloader_b  msftdata
 8      30.1GB  30.1GB  393kB                bootloader-dtb    msftdata
 9      30.1GB  30.1GB  393kB                bootloader-dtb_b  msftdata
10      30.1GB  30.1GB  2097kB               secure-os         msftdata
11      30.1GB  30.1GB  2097kB               secure-os_b       msftdata
12      30.1GB  30.1GB  131kB                eks               msftdata
13      30.1GB  30.1GB  1049kB               bpmp-fw           msftdata
14      30.1GB  30.1GB  1049kB               bpmp-fw_b         msftdata
15      30.1GB  30.1GB  1049kB               bpmp-fw-dtb       msftdata
16      30.1GB  30.1GB  1049kB               bpmp-fw-dtb_b     msftdata
17      30.1GB  30.1GB  262kB                xusb-fw           msftdata
18      30.1GB  30.1GB  262kB                xusb-fw_b         msftdata
19      30.1GB  30.1GB  524kB                rce-fw            msftdata
20      30.1GB  30.1GB  524kB                rce-fw_b          msftdata
21      30.1GB  30.1GB  4194kB               adsp-fw           msftdata
22      30.1GB  30.1GB  4194kB               adsp-fw_b         msftdata
23      30.1GB  30.1GB  524kB                sce-fw            msftdata
24      30.1GB  30.1GB  524kB                sce-fw_b          msftdata
25      30.1GB  30.1GB  6291kB               sc7               msftdata
26      30.1GB  30.1GB  6291kB               sc7_b             msftdata
27      30.1GB  30.2GB  134MB                BMP               msftdata
28      30.2GB  30.4GB  134MB                BMP_b             msftdata
29      30.4GB  30.4GB  67.1MB               kernel            msftdata
30      30.4GB  30.5GB  67.1MB               kernel_b          msftdata
31      30.5GB  30.5GB  524kB                kernel-dtb        msftdata
32      30.5GB  30.5GB  524kB                kernel-dtb_b      msftdata
33      30.5GB  30.5GB  1049kB               CPUBL-CFG         msftdata
34      30.5GB  30.5GB  8389kB               RP1               msftdata
35      30.5GB  30.5GB  8389kB               RP2               msftdata
36      30.5GB  31.3GB  743MB                UDA               msftdata

Wow, 36 partitions, how more complicated it can get?


So partition #29 looks interesting? How about the following?

dd if=zImage of=/dev/mmcblk0p29 ???

Would it work or not?


hello albertr,

I haven’t tried to update kernel partition with dd commands,
however, you should note that Xavier was encrypt boot.img and flashing that into kernel partition.
system will not able to boot-up if you just overwrite the zImage with your own build image.
here’s part of flashing message for your reference.

$ sudo ./flash.sh -r -k kernel jetson-xavier mmcblk0p1

[  15.5855 ] Writing partition
[  15.5868 ] tegradevflash_v2 --write kernel boot_sigheader.img.encrypt
[  15.5882 ] Bootloader version 01.00.0000
[  15.6855 ] Writing partition kernel with boot_sigheader.img.encrypt
[  15.6860 ] [................................................] 100%

This encryption is BS, considering the price NVidia is charging for Xavier… it should not be a closed platform. Where decryption part is done? In the boot-loader?


hello albertr,

we will investigate this internally,
will get back to you while we come out some conclusions, thanks

hello albertr,

I will still suggest you using flash script to update kernel partition.

$ sudo ./flash.sh -r -k kernel jetson-xavier mmcblk0p1

however, if you want to update the kernel remotely.
please follow below steps to encrypt the boot image, and using the dd commands to update it.

  1. to compiler the kernel sources, and copy the Image file to output folder
  2. convert kernel image (Image) into boot.img,
./mkbootimg --kernel $OUT/kernel/Image --ramdisk initrd --board mmcblk0p1 --output boot.img
  1. commands to generate an encrypt boot.img
sudo ./tegraflash.py --bl nvtboot_recovery_cpu_t194.bin  --chip 0x19 --applet mb1_t194_prod.bin --sdram_config tegra194-mb1-bct-memcfg-p2888.cfg,tegra194-memcfg-sw-override.cfg --uphy_config tegra194-mb1-uphy-lane-p2888-0000-p2822-0000.cfg --device_config tegra19x-mb1-bct-device-sdmmc.cfg --misc_cold_boot_config tegra194-mb1-bct-misc-l4t.cfg --misc_config tegra194-mb1-bct-misc-flash.cfg --pinmux_config tegra19x-mb1-pinmux-p2888-0000-a04-p2822-0000-b01.cfg --gpioint_config tegra194-mb1-bct-gpioint-p2888-0000-p2822-0000.cfg --pmic_config tegra194-mb1-bct-pmic-p2888-0001-a04-p2822-0000.cfg --pmc_config tegra19x-mb1-padvoltage-p2888-0000-a00-p2822-0000-a00.cfg --prod_config tegra19x-mb1-prod-p2888-0000-p2822-0000.cfg --scr_config tegra194-mb1-bct-scr-cbb-mini.cfg --scr_cold_boot_config tegra194-mb1-bct-scr-cbb-mini.cfg --br_cmd_config tegra194-mb1-bct-reset-p2888-0000-p2822-0000.cfg --dev_params tegra194-br-bct-sdmmc.cfg  --cfg  flash.xml --bin "mb2_bootloader nvtboot_recovery_t194.bin; mts_preboot preboot_c10_prod_cr.bin; mts_mce mce_c10_prod_cr.bin; mts_proper mts_c10_prod_cr.bin; bpmp_fw bpmp_t194.bin; bpmp_fw_dtb tegra194-a02-bpmp-p2888-a04.dtb; spe_fw spe_t194.bin; tlk tos_t194.img; eks eks.img; kernel boot.img; kernel_dtb tegra194-p2888-0001-p2822-0000.dtb; bootloader_dtb tegra194-p2888-0001-p2822-0000.dtb"  --cmd "sign boot.img"
  1. copy the encrypted boot.img to your target device.
  2. check the kernel partition, you could check the partition id as below,
$ ls -al /dev/disk/by-partlabel
lrwxrwxrwx 1 root root  16 Dec  5 04:32 kernel -> ../../mmcblk0p29
  1. using dd commands to overwrite the kernel partition, and perform warm-reboot to take effect.
$ sudo dd if=/tmp/boot_sigheader.img.encrypt of=/dev/mmcblk0p29
$ sudo reboot

I am curious…I see “–ramdisk initrd”. Does cboot load a ramdisk directly? Or is this just something needed for an indirect effect?

again, these steps should be developing testing only.
“–ramdisk initrd” command just something needed for mkbootimg binary to convert Image into boot.img file.

where is ‘initrd’ located?

Hi JerryChang,

I tried the command below you mentioned, which didn’t update the kernel.

$ sudo ./flash.sh -r -k kernel jetson-xavier mmcblk0p1

I’m trying another method you mentioned to generate the boot.img…

$ ls -al /dev/disk/by-partlabel
    lrwxrwxrwx 1 root root  16 Des  6 10:00 kernel -> ../../mmcblk0p30

$ sudo dd if=/tmp/boot_sigheader.img.encrypt of=/dev/mmcblk0p30

Failed to open ‘/tmp/boot_sigheader.img.encrypt’, No such file or directory. I’m using Jetpack 4.2.2 for Xavier and try to update the kernel without erasing existing contents.

Or does NVidia have a better way to do this?

hello andrew.li1216,

  1. “-k kernel” update device kernel partition with $OUT/Linux_for_Tegra/kernel/Image
  2. your “No such file or directory” failure means you did not actually copy the signed image to remote target or you had file with different naming.

Hi JerryChang,
Thanks, solved.