How to update camer_rtc_debug image

jp5.1.1 R35.3.1 Orin Nano 4GB
[Request debug RTCPU image for JP5.1.1]
I get debug image referring to the above connection:
and follow the instructions:

step1
sudo ./tools/kernel_flash/l4t_initrd_flash.sh \
--external-device nvme0n1p1 \
-c tools/kernel_flash/flash_l4t_external.xml \
-p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" \
--showlogs --network usb0 p3509-a02+p3767-0000 internal

step2-step3

step4:
 sudo ./tools/kernel_flash/l4t_initrd_flash.sh -k A_rce-fw --flash-only --showlogs

but step 4:

ERROR: might be timeout in USB write.
Error: Return value 3

And then, perform step1 to reflash the system, The cpu fan runs fine at startup, no boot logo (nvidia).
even if I use a whole normal ssd(which can boot linux on other boards), it doesn’t light up the device. How do I recover this board and how do I update the debug image?

Did you put Orin Nano to recovery mode and connect to the host by USB cable? Confirm by lsusb command.

Also you can using sdkmanger to flash to check if able to recover the device.

When executing flash, the device usb is connected and in rcm, (otherwise the script will show no device); every time after executing step4 , the device will reset,then need to manually enter the rcm.

I can still access the rcm after the failure, but I don’t know how to brick it to boot linux (even without a debug image).

Of course, I still expect the debug image to be flashed

Could be relative with below topic.

Now, Can boot up normally with original firmware via:

sudo ./tools/kernel_flash/l4t_initrd_flash.sh --external-device nvme0n1p1 -c tools/kernel_flash/flash_l4t_external.xml -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" -p --showlogs --network usb0 jetson-orin-nano-devkit internal

I’m a little bit confused about step3. May I know whether security boot is enabled, and where to get the private key for signature?

Step 3 just generate the encrypt RCE firmware.

camera-rtcpu-t234-rce_sigheader.img.encrypt

https://forums.developer.nvidia.com/t/request-debug-rtcpu-image-for-jp5-1-1/260583
Refer to above, reflash the camera debug image using the jetson-orin-nano-devkit configuration.

log:

Writing camera-rtcpu-t234-rce_sigheader.img.encrypt (parittion: A_rce-fw) into /dev/mtd0
[ 1]: l4t_flash_from_kernel: Sha1 checksum does not match (10f9d72e9c6e32a54e9319de41371b84b512ea1c != b29617e45575fc530728bf18fe5e5dcfeaae47b6) for /mnt/internal/camera-rtcpu-t234-rce_sigheader.img.encrypt
Erasing A_rce-fw for 537952 bytes at 28770304
[ 1]: l4t_flash_from_kernel: Successfully flash the emmc
Erased 1048576 bytes from address 0x01b70000 in flash
Writing /mnt/internal/camera-rtcpu-t234-rce_sigheader.img.encrypt (537952 bytes) into /dev/mtd0:28770304
Copied 537952 bytes from /mnt/internal/camera-rtcpu-t234-rce_sigheader.img.encrypt to address 0x01b70000 in flash

On the linux console:

root@ytmipi:/sys/kernel/debug# cat camrtc/rtos/state
t234-rce-safe (debug) on silicon
root@ytmipi:/sys/kernel/debug# cat camrtc/version
version cpu=rce cmd=6 sha1=97e50cbff52bc4b542b2989187109c001c01cf77

How do I check if fw reflash was successful?

Launch camera to check dmesg if show relative messages.

Thanks