How to Enable Massflash Mode for Jetson Orin NX 16GB in Production Batch

Robotics & Edge Computing Jetson Systems Jetson Orin NX
,
1

I am setting up secure boot for a Jetson Orin NX 16GB using the following process:

tar -xvf Jetson_Linux_r36.4.3_aarch64.tbz2
cd Linux_for_Tegra/rootfs
sudo tar -xvf ../../Tegra_Linux_Sample-Root-Filesystem_r36.4.3_aarch64.tbz2
cd ..
sudo ./tools/l4t_flash_prerequisites.sh
sudo ./apply_binaries.sh

# Initial flash for verification
sudo ./nvautoflash.sh --print_boardid # Check board name
sudo ./nvsdkmanager_flash.sh --storage nvme0n1p1

sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u ./rsa.pem -v ./sbk.key \
--uefi-keys uefi_keys/uefi_keys.conf --uefi-enc sym_t234.key --showlogs \
-p "-c bootloader/generic/cfg/flash_t234_qspi.xml" \
--no-flash --network usb0 jetson-orin-nano-devkit-super-maxn-nvme internal

sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u ./rsa.pem -v ./sbk.key \
--no-flash --external-device nvme0n1p1 -i ./sym2_t234.key --uefi-keys uefi_keys/uefi_keys.conf \
--uefi-enc sym_t234.key -p "-T 998118064" -S 472GiB -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
--external-only --append --network usb0 jetson-orin-nano-devkit-super-maxn-nvme external

sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v sbk.key \
--uefi-keys uefi_keys/uefi_keys.conf --uefi-enc sym_t234.key --network usb0 --flash-only

This process works for flashing a single Jetson device. Now, I want to flash a production batch using massflash mode. Could someone please guide me on how to set up and enter massflash mode for multiple Jetson Orin NX devices? Thank you!

2

Please check the ‘README_initrd_flash.txt’ file located in Linux_for_Tegra/tools/kernel_flash/. Specifically, ‘Workflow 7: Initrd Massflash’ should meet your requirements.

4

hello user34150,

it’s by default to have per-device unique LUKS key for disk encryption.
please have --generic-passphrase options added to create mass flash package.

please see-also developer guide, Creating Encrypted Images with a Generic Key.
you may also refer to Topic 291335 to create encrypted images with a generic key.

5

Hi JerryChang,

Could you please help verify if my Secure Boot process for the Jetson Orin NX is correct? Here are my detailed steps:

Step 1: Test fuse key burning with command:

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml --test jetson-orin-nano-devkit-super-maxn-nvme

Step 2: Actually burn keys by removing the --test option:

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml jetson-orin-nano-devkit-super-maxn-nvme

Step 3: Create initial image using:

sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u ./rsa.pem -v ./sbk.key \
--uefi-keys uefi_keys/uefi_keys.conf --uefi-enc sym_t234.key --showlogs \
-p "-c bootloader/generic/cfg/flash_t234_qspi.xml" \
--no-flash --network usb0 jetson-orin-nano-devkit-super-maxn-nvme internal

Step 4: Generate massflash image:

sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u ./rsa.pem -v ./sbk.key \
--no-flash --external-device nvme0n1p1 -i ./sym2_t234.key -p "--generic-passphrase" --uefi-keys uefi_keys/uefi_keys.conf \
--uefi-enc sym_t234.key -p "-T 998118064" -S 470GiB -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
--external-only --append --network usb0 --massflash 1 jetson-orin-nano-devkit-super-maxn-nvme external

Step 5: Flash the first device with massflash:

cd mfi_jetson-orin-nano-devkit-super-maxn-nvme
sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v ../sbk.key \
--uefi-keys ../uefi_keys/uefi_keys.conf --uefi-enc ../sym_t234.key --network usb0 --flash-only --massflash 1

For subsequent devices, I will:

  • Test fuse key burning:
sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml --test jetson-orin-nano-devkit-super-maxn-nvme
  • Then flash using the massflash image:
cd mfi_jetson-orin-nano-devkit-super-maxn-nvme
sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v ../sbk.key \
--uefi-keys ../uefi_keys/uefi_keys.conf --uefi-enc ../sym_t234.key --network usb0 --flash-only --massflash 1

Could you confirm if the above procedure is correct or suggest necessary adjustments?

Thank you!

6

During flashing Jetson Orin with the following command:

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml --test jetson-orin-nano-devkit-super-maxn-nvme

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml jetson-orin-nano-devkit-super-maxn-nvme

cd mfi_jetson-orin-nano-devkit-super-maxn-nvme
sudo cp ../p3768-0000-p3767-0000-super-maxn.conf .
sudo cp ../p3768-0000-p3767-0000-super.conf .
sudo cp ../p3768-0000-p3767-0000-a0.conf .
sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v ../sbk.key \
--uefi-keys ../uefi_keys/uefi_keys.conf --uefi-enc ../sym_t234.key --network usb0 --flash-only --massflash 1

I encountered this error:

gremsy_soft@gremsysoft:~/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v ../sbk.key --uefi-keys ../uefi_keys/uefi_keys.conf --uefi-enc ../sym_t234.key --network usb0 --flash-onlyit-super-maxn-nvme$ shudo ./too# Entry added by NVIDIA initrd flash toolwlogs -u rsa.pem -v ../sbk.key --uefi-keys ../uefi_keys/uefi/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/tools/kernel_flash/tmp 127.0.0.1(rw,nohide,insecure,no_subtree_check,async,no_root_squash)
rpcbind: another rpcbind is already running. Aborting
Export list for localhost:
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/tools/kernel_flash/tmp 127.0.0.1
# Entry added by NVIDIA initrd flash tool
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/tools/kernel_flash/tmp 127.0.0.1(rw,nohide,insecure,no_subtree_check,async,no_root_squash)
rpcbind: another rpcbind is already running. Aborting
Export list for localhost:
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/tools/kernel_flash/tmp 127.0.0.1
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/tools/kernel_flash/l4t_initrd_flash_internal.sh --network usb0 --usb-instance 1-2 --device-instance 0 --flash-only --external-device nvme0n1p1 -c "./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml" -S 470GiB --network usb0 jetson-orin-nano-devkit-super-maxn-nvme external
**********************************************
*                                            *
*  Step 1: Build the flashing environment    *
*                                            *
**********************************************
Create flash environment 0
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/bootloader /home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme
Finish creating flash environment 0.
****************************************************
*                                                  *
*  Step 2: Boot the device with flash initrd image *
*                                                  *
****************************************************
/home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme/temp_initrdflash/bootloader0 /home/gremsy_soft/Documents/Linux_for_Tegra/mfi_jetson-orin-nano-devkit-super-maxn-nvme
./tegraflash.py --bl uefi_jetson_minimal_with_dtb_sigheader_encrypt.bin.signed --bct br_bct_BR.bct --securedev  --bldtb tegra234-p3768-0000+p3767-0000-nv-super.dtb --applet rcm_2_signed.rcm --applet_softfuse rcm_1_signed.rcm --instance 1-2 --cmd "rcmboot"  --cfg secureflash.xml --chip 0x23 --mb1_bct mb1_bct_MB1_sigheader_encrypt.bct.signed --mem_bct mem_rcm_sigheader_encrypt.bct.signed --mb1_cold_boot_bct mb1_cold_boot_bct_MB1_sigheader_encrypt.bct.signed --mb1_bin mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --psc_bl1_bin psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --mem_bct_cold_boot mem_coldboot_aligned_sigheader_encrypt.bct.signed  --bins "psc_fw pscfw_t234_prod_sigheader_encrypt.bin.signed; mts_mce mce_flash_o10_cr_prod_sigheader_encrypt.bin.signed; tsec_fw tsec_t234_sigheader_encrypt.bin.signed; mb2_applet applet_t234_sigheader_encrypt.bin.signed; mb2_bootloader mb2_t234_with_mb2_cold_boot_bct_MB2_sigheader_encrypt.bin.signed; xusb_fw xusb_t234_prod_sigheader_encrypt.bin.signed; pva_fw nvpva_020_sigheader_encrypt.fw.signed; dce_fw display-t234-dce_sigheader_encrypt.bin.signed; nvdec nvdec_t234_prod_sigheader_encrypt.fw.signed; bpmp_fw bpmp_t234-TE980M-A1_prod_sigheader_encrypt.bin.signed; bpmp_fw_dtb tegra234-bpmp-3767-0000-3768-super-maxn_with_odm_sigheader_encrypt.dtb.signed; rce_fw camera-rtcpu-t234-rce_sigheader_encrypt.img.signed; ape_fw adsp-fw_sigheader_encrypt.bin.signed; spe_fw spe_t234_sigheader_encrypt.bin.signed; tos tos-optee_t234_sigheader_encrypt.img.signed; eks eks_t234_sigheader_encrypt.img.signed; kernel boot0.img; kernel_dtb tegra234-p3768-0000+p3767-0000-nv-super.dtb"    --bct_backup 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 

 Entering RCM boot

[   0.0196 ] mb1_t234_prod_aligned_sigheader_encrypt.bin.signed filename is from --mb1_bin
[   0.0196 ] psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed filename is from --psc_bl1_bin
[   0.0196 ] rcm boot with presigned binaries
[   0.0208 ] tegrarcm_v2 --instance 1-2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
[   0.0220 ] BR_CID: 0x80012344705DE8CD18000000050001C0
[   0.0467 ] Sending bct_br
[   0.0600 ] Sending mb1
[   0.0604 ] ERROR: might be timeout in USB write.
Error: Return value 3
Command tegrarcm_v2 --instance 1-2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed
Cleaning up...

Could you please provide guidance or solutions to resolve this error?

7

After checking the fuse values with the command:

sudo ./odmfuseread.sh -i 0x23 -k rsa.pem -S sbk.key jetson-orin-nano-devkit-super-maxn-nvme

I obtained the following result:

[   9.3535 ] MB2 Applet version 01.00.0000
Fuse reading is done. The fuse values have been saved in: /home/gremsy_soft/Documents/Linux_for_Tegra/bootloader/fuse_info.txt
PublicKeyHash: 15xxxxx50
BootSecurityInfo: 000001e0
ArmJtagDisable: 00000000
SecurityMode: 00000000
SwReserved: 00000000
DebugAuthentication: 00000000
OdmId: 0000000000000000
OdmLock: 00000000
ReservedOdm0: 00000000
ReservedOdm1: 00000000
ReservedOdm2: 00000000
ReservedOdm3: 00000000
ReservedOdm4: 00000000
ReservedOdm5: 00000000
ReservedOdm6: 00000000
ReservedOdm7: 00000000

However, I’m confused as to why SecurityMode is not enabled (SecurityMode: 00000000), despite having clearly specified it in my XML file as follows:

<genericfuse MagicId="0x45535546" version="1.0.0">
  <fuse name="PublicKeyHash" size="64" value="0x15xxx50"/>
  <fuse name="SecureBootKey" size="32" value="0x7axx3b"/>
  <fuse name="OemK1" size="32" value="0xafbxx5e"/>
  <fuse name="BootSecurityInfo" size="4" value="0x209"/>
  <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

Could you please provide any insights or suggestions on how to fix this issue?

8

hello user34150,

please see-also Topic 335952, BOOT_SECURITY_INFO was burned (by manufacturing) to 0x1E0 as default value now.
you’ll need to perform an OR with your BOOT_SECURITY_INFO to the xml file for fuse burning.

9

I modified my XML file as follows:

<genericfuse MagicId="0x45535546" version="1.0.0">
  <fuse name="PublicKeyHash" size="64" value="0x15xxx50"/>
  <fuse name="SecureBootKey" size="32" value="0x7axx3b"/>
  <fuse name="OemK1" size="32" value="0xafbxx5e"/>
  <fuse name="BootSecurityInfo" size="4" value="0x3E9"/>
  <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

Then, I executed the fuse command with test mode enabled:

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml --test jetson-orin-nano-devkit-super-maxn-nvme

After performing this step, I read back the fuse values using the following command:

sudo ./odmfuseread.sh -i 0x23 -k rsa.pem -S sbk.key jetson-orin-nano-devkit-super-maxn-nvme

However, the output still shows that BootSecurityInfo is 0x000001e0 and SecurityMode is 0x00000000, indicating the fuse process did not succeed:

PublicKeyHash: 15xxx50
BootSecurityInfo: 000001e0
SecurityMode: 00000000

It appears the changes in the XML file weren’t applied correctly. Could you please advise how I can resolve this issue?

Thank you!

10

I tested with a new SOM using the following command to fuse:

sudo ./odmfuse.sh -i 0x23 -k rsa.pem -S sbk.key -X fuse.xml jetson-orin-nano-devkit-super-maxn-nvme

With the XML file previously modified according to your instructions, the output was:

I> Task: Crypto init
I> Task: Program CBB PCIE AMAP regions
I> Task: Burn fuses
I> Index : 1    PublicKeyHash    size: 64
I> Index : 2    SecureBootKey    size: 32
I> Index : 3    OemK1    size: 32
I> Index : 4    BootSecurityInfo    size: 4
I> Index : 5    SecurityMode    size: 4
I> Fuse Blob found
I> 
I> Burning fuses
I> 1. Start PublicKeyHash burn
I> 1. PublicKeyHash burnt successfully
W> No handling of CRC-32 for PublicKeyHash
I> 
I> 2. Start SecureBootKey burn
I> 2. SecureBootKey burnt successfully
W> No handling of CRC-32 for SecureBootKey
I> 
I> 3. Start OemK1 burn
I> 3. OemK1 burnt successfully
W> No handling of CRC-32 for OemK1
I> 
I> 4. Start BootSecurityInfo burn
I> 4. BootSecurityInfo burnt successfully
W> No handling of CRC-32 for BootSecurityInfo
I> 
I> 
I> Calculated H2 CRC ecc is 0xa3b4ba07
I> Successfully burnt fuses as per fuse info
I> Index : 1    PublicKeyHash    size: 64
I> Index : 2    SecureBootKey    size: 32
I> Index : 3    OemK1    size: 32
I> Index : 4    BootSecurityInfo    size: 4
I> Index : 5    SecurityMode    size: 4
I> Fuse Blob found
I> No RPMB provisioning details is found. Skip RPMB Provisioning.
I> FSKP finished

Afterwards, I successfully executed these commands:

sudo ./tools/kernel_flash/l4t_initrd_flash.sh -u ./rsa.pem -v ./sbk.key \
--uefi-keys uefi_keys/uefi_keys.conf --uefi-enc sym_t234.key --showlogs  \
-p "-c bootloader/generic/cfg/flash_t234_qspi.xml" \
--no-flash --network usb0 jetson-orin-nano-devkit-super-maxn-nvme internal
  • If fuse operation fails, the command above will fail and the device only enters recovery mode once. Afterward, it will boot to the logo screen and will not enter recovery mode again.
sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u ./rsa.pem -v ./sbk.key \
--no-flash --external-device nvme0n1p1 -i ./sym2_t234.key --uefi-keys uefi_keys/uefi_keys.conf \
--uefi-enc sym_t234.key -p "-T 998118064" -S 472GiB -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
--external-only --append --network usb0 jetson-orin-nano-devkit-super-maxn-nvme external

sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa.pem -v sbk.key \
--uefi-keys uefi_keys/uefi_keys.conf --uefi-enc sym_t234.key --network usb0 --flash-only

I currently have two units that appear to have unsuccessful fuse operations (or at least I think they have failed). Do you have any suggestions or ideas regarding this issue?

Thank you!

11

hello user34150,

please try removing PKC key from your xml file, and also ignore SecurityMode for adding the fuses.
for instance,

please see-also Burn Fuses with the Fuse Configuration file.
please execute below to have additional fuses burns.
$ sudo ./odmfuse.sh -X <fuse_config> -i 0x23 -k <pkc.pem> <target_config>

12

Thank you very much for your support and the provided guidance. After following your instructions to remove the PKC key and SecurityMode from my fuse XML file, the issue was resolved successfully. Now my fuse settings are correctly applied and functioning as expected.

I appreciate your timely help and clear instructions.