How to update the UEFI on devices in the field?

Robotics & Edge Computing Jetson Systems Jetson Orin Nano
1

Hi Nvidia,

According to the forum post below, the QSPI RAM is not accessible from Linux due to a security feature in L4T 35.2.1:

So, what is the recommended way to perform updates on the UEFI, e.g., to add overlays in the field?
How should we update in case of CVEs in the field?

Thanks and regards!

3

Hi business37,

Are you using the devkit or custom board for Orin Nano?
What’s your Jetpack version in use?

UEFI will come with the Jetpack L4T release.
It is open source and you could build and update with the following instruction.
Build without docker · NVIDIA/edk2-nvidia Wiki (github.com)

4

Hi KevinFFF,

I’m using JetPack 5.1.2 L4T R35.4.1. I’m running Yocto to build an OS image for different Jetson boards (Orin Nano 8GB, NX 16GB …) currently I’m using the devkit, but later, I’ll need to support a custom board with the OS. Therefore, I’m creating overlays in Yocto. The problem is, these overlays are written into an SPI partition which I cannot access/update from the running Linux (see other post). So, I’m wondering what is NVIDIA’s recommendation to do updates in the field?

5

Hi,

You can use this command to update only the QSPI memory on the module, which would not affect the rootfs partition Linux runs on:

sudo ./flash.sh --no-systemimg -c bootloader/t186ref/cfg/flash_t234_qspi.xml <board> <storage device>

6

I know how to flash all parts using flash.sh utility, but I am searching for a possibility to OTA update the QSPI NOR flash partitions during operation.

7

For OTA update, you cannot choose to update the specific partition.
You can select update rootfs only or bootloader only or both.
Please refer to the following instruction when you generate the OTA package in details.
Software Packages and the Update Mechanism — Preparing for an Image-Based OTA Update

8

Thank you!