Issue with enabling secure boot and disk encryption -> USB timeout error

[wal.footrot]

Hi all,

I am currently having an issue trying to enable secure boot and disk encryption on my Jetson Orin NX.

Issue Description:

When I go to flash the Orin I get the following error:

ERROR: might be timeout in USB write

After the host PC sends mb1

After watching the connected devices on linux with

watch -n 0.2 lsusb

It seems during the early stages of the flashing script the Orin drops out of recovery mode (NVIDIA Corp. APX) disappears.

I can confirm it is not an issue with the USB cable used in this process. I have used the cable to flash multiple unencrypted devices.

Hardware / Software configuration

Host PC: Ubuntu 20.04

Jetpack: 5.1.2 (must be this version)

Jetson Linux: r35.4.1 (must be this version)

Board: Jetson Orin NX

Carrier: CTI Hardon Dual Mipi w/ 1TB NVMe

Configuration process

Device was originally flashed with an unencrypted version of the same BSP (5.1.2, r35.4.1, etc). Following a successful flash of the device the following was conducted on the exact same hardware setup.

1. A new ‘clean’ copy of the BSP was downloaded and installed on the host machine.

   1. NVIDIA component was downloaded using SDKManager cli.

      sdkmanager --cli \
--login-type devzone \
--action install \
--archived-versions \
--version 5.1.2 \
--target JETSON_ORIN_NX_TARGETS \
--host \
--select 'Jetson Linux' \
--select 'Jetson Runtime Components' \
--deselect 'Jetson SDK Components' \
--download-folder "${DOWNLOAD_DIR}" \
--target-image-folder "${INSTALL_DIR}" \
--license accept \
--collect-usage-data disable \
--exit-on-finish

   2. CTI component was downloaded and extracted.

      INSTALL_DIR="/media/ubuntu/nvidia/nvidia_sdk"
T4L_DIR="${INSTALL_DIR}/JetPack_5.1.2_Linux_JETSON_ORIN_NX_TARGETS/Linux_for_Tegra"
cd "$T4L_DIR"
wget -c https://connecttech.com/ftp/Drivers/CTI-L4T-ORIN-NX-NANO-35.4.1-V013.tgz
tar -zxf CTI-L4T-ORIN-NX-NANO-35.4.1-V013.tgz
cd CTI-L4T
sudo ./install.sh
cd ..

   3. Driver Package for 35.4.1 was downloaded and installed in the correct directory: https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v4.1/sources/public_sources.tbz2

2. Keys were generated.

   1. Generate PKC.pem

      openssl ecparam -name secp521r1 -genkey -noout -out pkc.pem

   2. Generate PKC hash

      ./tegrasign_v3.py --pubkeyhash pkc.pubkey pkc.hash --key pkc.pem > pkc.key

   3. Generate SBK

      openssl rand -hex 32 | tr -d '\n' > sbk.key

   4. Generate User Encryption Key

      openssl rand -hex 32 | tr -d '\n' > uek.key

   5. Generate DiskEncryption Key

      openssl rand -hex 32 | tr -d '\n' > dek.key

   6. Generate OEMK1

      openssl rand -hex 32 | tr -d '\n' > oemk1.key

   7. Generate PK

      openssl req -newkey rsa:2048 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=My Platform Key/" -out PK.crt

   8. Generate KEK

      $ openssl req -newkey rsa:2048 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=My Key Exchange Key/" -out KEK.crt

   9. Generate db_1

      $ openssl req -newkey rsa:2048 -nodes -keyout db_1.key -new -x509 -sha256 -days 3650 -subj "/CN=My Signature Database key 1/" -out db_1.crt

   10. Generate db_2

       $ openssl req -newkey rsa:2048 -nodes -keyout db_2.key -new -x509 -sha256 -days 3650 -subj "/CN=My Signature Database key 2/" -out db_2.crt

   11. Generate UEFI Config

       cat << 'EOF' > uefi_keys.conf
UEFI_PK_KEY_FILE="PK.key";
UEFI_PK_CERT_FILE="PK.crt";
UEFI_KEK_KEY_FILE="KEK.key";
UEFI_KEK_CERT_FILE="KEK.crt";
UEFI_DB_1_KEY_FILE="db_1.key";
UEFI_DB_1_CERT_FILE="db_1.crt";
UEFI_DB_2_KEY_FILE="db_2.key";
UEFI_DB_2_CERT_FILE="db_2.crt";
EOF

   12. Generate dtbo

       sudo gen_uefi_default_keys_dts.sh uefi_keys/uefi_keys.conf
sudo chmod 644 uefi_keys/_out/*.auth

   13. Generate fv

       openssl rand -rand /dev/urandom -hex 16 > fv

   14. Generate EKB

       # EKB is generated and then used to replace original in bootloader/
gen_ekb.py -chip t234 \
-oem_k1_key oemk1.key \
-fv fv \
-in_sym_key uek.key \
-in_sym_key2 dek.key \
-out eks_t234.img

3. Create / Test / Burn Fuses

   1. Create fuse file (fuse.xml)

      <genericfuse MagicId="0x45535546" version="1.0.0">
<fuse name="PublicKeyHash" size="64" value="0xPKC_KEY_HASH_HERE"/>
<fuse name="SecureBootKey" size="32" value="0xSBK_HERE"/>
<fuse name="OemK1" size="32" value="0xOEMK1_HERE"/>
<fuse name="BootSecurityInfo" size="4" value="0xB"/>
</genericfuse>

   2. Test fuse burning

      sudo ./odmfuse.sh --test -X fuse.xml -i 0x23 cti/orin-nx/hadron-dual-mipi/base

   3. Burn fuses

      sudo ./odmfuse.sh -X fuse.xml -i 0x23 cti/orin-nx/hadron-dual-mipi/base

   4. Read fuses from device to confirm (confirmed PKC Hash and BootSecurityInfo)

      sudo ./odmfuseread.sh -i 0x23 cti/orin-nx/hadron-dual-mipi/base

4. Flash device

sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh \
--external-device nvme0n1p1 \
-u pkc.pem \
-v sbk.key \
-i dek.key \
--uefi-enc uek.key \
--uefi-keys uefi_keys/uefi_keys.conf \
-p "-c ./bootloader/t186ref/cfg/flash_t234_qspi.xml" \
-c ./tools/kernel_flash/flash_l4t_nvme_rootfs_enc.xml \
--showlogs \
--network usb0 \
cti/orin-nx/hadron-dual-mipi/base \
internal

At this point the flash fails (see flash logs and device debug logs below)

flash_device.log (22.7 KB)

device_debug.log (173.5 KB)

Thanks in advance for your help

[JerryChang]

hello ethan.batt,

according to BR_CID: 0x80012344705DF8A08000000005FE0080
it seems you’re not fuse a board actually, can you perform odmfuseread again to ensure you’ve expected fuse variables?

let’s have issue narrow down,
you may give it a try to enable only bootloader secureboot, and then disk encryption, and later UEFI secureboot.
for instance, if you’ve confirm a board has fused, please try re-flash a target by given PKC/SBK only.

[wal.footrot]

Hi JerryChang,

The issue was with my BootSecurityInfo fuse. Apparently after 2025 Nvidia started burning this fuse with 0x1E0 so I needed to OR this with my desired value 0x20B. The result allowed me to burn:

<fuse name="BootSecurityInfo" size="4" value="0x3EB"/>

Which removed the USB error and allowed me to flash the device with this command:

sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh
--external-device nvme0n1p1
-u pkc.pem
-v sbk.key
-i dek.key
--uefi-enc uek.key
--uefi-keys uefi_keys/uefi_keys.conf
-p "-c ./bootloader/t186ref/cfg/flash_t234_qspi.xml"
-c ./tools/kernel_flash/flash_l4t_nvme_rootfs_enc.xml
--showlogs
--network usb0
cti/orin-nx/hadron-dual-mipi/base
internal

However, I am now getting a separate issue where the Orin won’t boot off the NVMe and instead enters the Shell. Below is the debug logs when booting (and flashing logs)

boot_after_flash.log (31.8 KB)

flash.log (31.0 KB)

Thanks in advance for your help.

[JerryChang]

hello ethan.batt,

it seems stuck at UEFI, but I don’t see error logs besides the prompt message.
for instance,

e[1me[33me[40mstartup.nshe[0me[37me[40m or any other key to continue.e[72DPress 
e[1me[37me[40mESCe[0me[37me[40m in 4 seconds to skip e[1me[33me[40mstartup.nshe[0me[37me[40m or any other key to continue.e[72DPres

please try exclude below two for testing.

@wal.footrot

--uefi-enc uek.key
--uefi-keys uefi_keys/uefi_keys.conf

[wal.footrot]

Hi JerryChang,

Removing those flags and reflashing seemed to work, the now Orin boots from the NVMe.

Ideally I would still like to implement the UEFI secure boot and payload encryption.

When the Orin was getting stuck at UEFI I did try using the Boot Manager TUI. Every time I tried to select the NVME option it would fail silently and return back to the boot manager.

I tried booting manually by running BOOTAA64.efi in the active shell (FS3:\EFI\BOOT directory), however, I kept getting an “Accessed Denied” error.

As it stands my UEFI config file is:

UEFI_PK_KEY_FILE="pk.key";
UEFI_PK_CERT_FILE="pk.crt";
UEFI_KEK_KEY_FILE="kek.key";
UEFI_KEK_CERT_FILE="kek.crt";
UEFI_DB_1_KEY_FILE="db_1.key";
UEFI_DB_1_CERT_FILE="db_1.crt";
UEFI_DB_2_KEY_FILE="db_2.key";
UEFI_DB_2_CERT_FILE="db_2.crt";

And my UEFI key directory is setup as:

ls -la uefi_keys/
total 64
drwxrwxr-x 3 electrical electrical 4096 Jun 23 10:09 .
drwxrwxr-x 15 electrical electrical 4096 Jun 29 08:44 ..
-rw-rw-r-- 1 electrical electrical 1180 Jun 23 09:46 db_1.crt
-rw------- 1 electrical electrical 1704 Jun 23 09:46 db_1.key
-rw-rw-r-- 1 electrical electrical 1180 Jun 23 09:48 db_2.crt
-rw------- 1 electrical electrical 1708 Jun 23 09:48 db_2.key
-rw-rw-r-- 1 electrical electrical 1159 Jun 23 09:45 kek.crt
-rw------- 1 electrical electrical 1708 Jun 23 09:45 kek.key
drwxr-xr-x 2 root root 4096 Jun 23 10:01 _out
-rw-rw-r-- 1 electrical electrical 1147 Jun 23 09:45 pk.crt
-rw------- 1 electrical electrical 1704 Jun 23 09:45 pk.key
-rw-r--r-- 1 root root 4042 Jun 23 10:01 UefiDefaultSecurityKeys.dtbo
-rw-r--r-- 1 root root 12009 Jun 23 10:01 UefiDefaultSecurityKeys.dts
-rw-rw-r-- 1 electrical electrical 240 Jun 23 09:54 uefi_keys.conf
electrical@electrical-Latitude-3580:~/nvidia/nvidia_sdk/

$ ls -la uefi_keys/_out
total 56
drwxr-xr-x 2 root root 4096 Jun 23 10:01 .
drwxrwxr-x 3 electrical electrical 4096 Jun 23 10:09 ..
-rw-r--r-- 1 root root 2154 Jun 23 10:01 db_1.auth
-rw-r--r-- 1 root root 831 Jun 23 10:01 db_1.cer
-rw-r--r-- 1 root root 875 Jun 23 10:01 db_1.esl
-rw-r--r-- 1 root root 2154 Jun 23 10:01 db_2.auth
-rw-r--r-- 1 root root 831 Jun 23 10:01 db_2.cer
-rw-r--r-- 1 root root 875 Jun 23 10:01 db_2.esl
-rw-r--r-- 1 root root 2126 Jun 23 10:01 kek.auth
-rw-r--r-- 1 root root 815 Jun 23 10:01 kek.cer
-rw-r--r-- 1 root root 859 Jun 23 10:01 kek.esl
-rw-r--r-- 1 root root 2118 Jun 23 10:01 pk.auth
-rw-r--r-- 1 root root 807 Jun 23 10:01 pk.cer
-rw-r--r-- 1 root root 851 Jun 23 10:01 pk.esl

This issue seems to be with the UEFI secure boot as flashing the script with --uefi-keys included and --uefi-enc excluded I get the same results.

Once again, thanks for your help

[JerryChang]

hello ethan.batt,

please refer UEFI Secureboot.
you may give it a try to enable UEFI Secureboot through UEFI utilities.

besides..
just for your reference, we’ve also tested it locally.
it’s confirmed.. bootloader Secureboot + UEFI Secureboot (uefi-keys) + UEFI payload encryption (uefi-enc) + Disk Encryption (ROOTFS_ENC) is working on SBKPKC fused Jetson AGX-Xavier on JP-5.1.5/r35.6.1
here’s the flash command-line we’re using.
$ sudo ROOTFS_ENC=1 ./flash.sh -u rsa_priv.pem -v sbk.key -i ./sym2_t194.key --uefi-keys ./uefi_keys/uefi_keys.conf --uefi-enc ./uefi_keys/sym_t194.key jetson-agx-xavier-devkit mmcblk0p1

you should double check you’ve re-generate a new EKS image.
it’s due to UEFI variable protection feature is always enabled, you should provide UEFI variable authentication key (auth_t234.key) in EKS image. otherwise UEFI will block the booting.

[wal.footrot]

Hi JerryChang,

The version of Jetpack I am using is 5.1.2 / r35.4.1. The optee script for generating the EKS for this version only includes:

$ python3 gen_ekb.py

  -chip t234 \

  -oem_k1_key oem_k1_key_file \

  -fv fv_for_ekb_file \

  -in_sym_key user_key_file \

  -in_sym_key2 user2_key_file \

  -out eks.img

With no mention of any “auth_t234.key” key.

Are newer versions of this script / documentation backwards compatible?

Thanks

[JerryChang]

hello ethan.batt,

just for confirmation.

@wal.footrot

--uefi-enc uek.key

this uek.key should be the same -in_sym_key user_key_file

@wal.footrot

-i dek.key

and, this dek.key should be the same -in_sym_key2 user2_key_file

[wal.footrot]

Hi JerryChang,

That is correct:

uek.key is my in_sym_key (32B)

dek.key is my in_sym_key2

I was originally using a 32 byte dek.key however reading the gen_ekb.py documentation it looks like it should be 16 bytes.

Noting this I flashed the Orin with a 16 byte dek.key and now it fails to decrypt the NVMe on boot.

16B_dek_boot.log (48.5 KB)

Thanks for your help.

[JerryChang]

hello ethan.batt,

here is demonstration disk encryption key.. f0e0d0c0b0a001020304050607080900, it’s 16-bytes.

you’ve passed UEFI and boot into linux kernel, the failure to unlock the encrypted device due to an incorrect disk encryption key of your EKS image. you should re-generate EKS image, and re-flash a target for double check.

[wal.footrot]

Hi JerryChang,

I have finally got the full security stack working. As a bit of a summary for future users:

My first issue where I encountered ERROR: might be timeout in USB write was due to my BootSecurityInfo fuse not be correctly fused. An important takeaway for this was:

For devices purchased after 2025 the BootSecurityInfo is pre-burnt by the manufacturer with 0x1E0. To burn this fuse you must complete an OR operation with the desired value. For instance, a desired value of 0x20B becomes 0x20B | 0x1E0 → 0x3EB.

The second issue I faced was my device getting stuck at UEFI. This was because the “Disk Encryption Key” (DEK or sym2_t234) must be 16 bytes (or 32 hexadecimal characters).

The final issue I faced was the kernel failing to decrypt the rootfs. This issue was due to the custom fixed vector (FV) that I was utilising for disk encryption. If you wish to use a custom FV, you must edit the optee/optee_os/core/pta/tegra/jetson_user_key_pta.c file in the OPTEE src and replace static unit8_t fv_for_ekb[] = {...} with your custom FV. Once replaced you must rebuild OPTEE and replace the tos-optee_t234.img. This is outlined in topic 263994.

The process I utilised to implement Secure Boot + UEFI Secure Boot + UEFI Payload Encryption + Disk Encryption from scratch for the Jetson Orin NX with Jetpack 5.1.2 and Jetson Linux r35.4.1 was:

Prepare the BSP

Install NVIDIA BSP

sdkmanager --cli \
      --login-type devzone \
      --action install \
      --archived-versions \
      --version 5.1.2 \
      --target JETSON_ORIN_NX_TARGETS \
      --host \
      --select 'Jetson Linux' \
      --select 'Jetson Runtime Components' \
      --deselect 'Jetson SDK Components' \
      --download-folder "${DOWNLOAD_DIR}" \
      --target-image-folder "${INSTALL_DIR}" \
      --license accept \
      --collect-usage-data disable \
      --exit-on-finish

Install carrier board components (CTI)

cd /
cd "$T4L_DIR"
wget -c https://connecttech.com/ftp/Drivers/CTI-L4T-ORIN-NX-NANO-35.4.1-V013.tgz
tar -zxf CTI-L4T-ORIN-NX-NANO-35.4.1-V013.tgz
cd CTI-L4T
sudo ./install.sh
cd ..

Secure Boot Keys

1. Generate PKC pem

cd ${T4L_DIR}
openssl ecparam -name secp521r1 -genkey -noout -out pkc.pem

2. Generate PKC hash

./bootloader/tegrasign_v3.py --pubkeyhash pkc.pubkey pkc.hash --key pkc.pem > pkc.key

3. Generate SBK key

openssl rand -hex 32 | tr -d '\n' > sbk.key

UEFI Secure Boot

4. Generate PK

mkdir uefi_keys
cd uefi_keys
openssl req -newkey rsa:2048 -nodes -keyout PK.key  -new -x509 -sha256 -days 3650 -subj "/CN=Innovaero Platform Key/" -out PK.crt

5. Generate KEK

$ openssl req -newkey rsa:2048 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Innovaero Key Exchange Key/" -out KEK.crt

6. Generate db_1

$ openssl req -newkey rsa:2048 -nodes -keyout db_1.key  -new -x509 -sha256 -days 3650 -subj "/CN=Innovaero Signature Database key 1/" -out db_1.crt

7. Generate db_2

$ openssl req -newkey rsa:2048 -nodes -keyout db_2.key  -new -x509 -sha256 -days 3650 -subj "/CN=Innovaero Signature Database key 2/" -out db_2.crt

8. Create Config

cat << 'EOF' > uefi_keys.conf
UEFI_PK_KEY_FILE="PK.key";
UEFI_PK_CERT_FILE="PK.crt";
UEFI_KEK_KEY_FILE="KEK.key";
UEFI_KEK_CERT_FILE="KEK.crt";
UEFI_DB_1_KEY_FILE="db_1.key";
UEFI_DB_1_CERT_FILE="db_1.crt";
UEFI_DB_2_KEY_FILE="db_2.key";
UEFI_DB_2_CERT_FILE="db_2.crt";
EOF

9. Create .dtbo

cd ${T4L_DIR}/tools
sudo gen_uefi_default_keys_dts.sh uefi_keys/uefi_keys.conf
sudo chmod 644 uefi_keys/_out/*.auth
cd ..

UEFI Payload Encryption

10. Generate User Encryption Key

openssl rand -hex 32 | tr -d '\n' > uek.key

Disk Encryption

11. Generate Disk Encryption Key

openssl rand -hex 32 | tr -d '\n' > dek.key

OPTEE Install

12. Generate FV

openssl rand -rand /dev/urandom -hex 16 > fv

13. Get Driver Package for 35.4.1: https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v4.1/sources/public_sources.tbz2

    cd ~/Downloads
    wget -c https://developer.nvidia.com/downloads/embedded/l4t/r35_release_v4.1/sources/public_sources.tbz2
    tar -I lbzip2 -xpf atf_src.tbz2 
    cp Linux_for_Tegra/source/public/atf_src.tbz2 ${T4L_DIR}/source/public
    cp Linux_for_Tegra/source/public/nvidia-jetson-optee-source.tbz2 ${T4L_DIR}/source/public
    cd ${T4L_DIR}/source/public
    

    1. Extract nvidia-jetson-optee-source into ${L4T_DIR}/source/public

       tar -I lbzip2 -xpf nvidia-jetson-optee-source.tbz2
       

    2. Extract atf_src into ${L4T_DIR}/source/public

       mkdir aft_build
       tar -I lbzip2 -C aft_build -xpf atf_src.tbz2
       

14. Download the tool chain for the host PC: https://developer.nvidia.com/embedded/jetson-linux/bootlin-toolchain-gcc-93

    cd ~/Downloads
    wget -c https://developer.download.nvidia.com/embedded/L4T/bootlin/aarch64--glibc--stable-final.tar.gz
    sudo mkdir -p /toolchain/aarch64--glibc--stable-final
    cp aarch64--glibc--stable-final.tar.gz /toolchain/aarch64--glibc--stable-final
    

    1. Extract and build toolchain

       cd /toolchaina/arch64--glibc--stable-final
       sudo tar -xpf aarch64--glibc--stable-final.tar.gz
       

15. Set environment variables

export CROSS_COMPILE_AARCH64_PATH=/toolchain/aarch64--glibc--stable-final
export CROSS_COMPILE_AARCH64=/toolchain/aarch64--glibc--stable-final/bin/aarch64-buildroot-linux-gnu-
export UEFI_STMM_PATH=${T4L_DIR}/bootloader/standalonemm_optee_t234.bin

17. Modify fv_for_ekb to match generated FV in optee/optee_os/core/pta/tegra/jetson_user_key_pta

cd ${L4T_DIR}
perl -0777 -i -pe 'BEGIN{$a=shift @ARGV} s/static uint8_t fv_for_ekb\[\] = \{\s*.*?\s*\};/static uint8_t fv_for_ekb[] = {\n\t$a,\n};/s' "$(tr -d '\n\r[:space:]' < fv | sed 's/../0x&, /g; s/, $//')" source/public/optee/optee_os/core/pta/tegra/jetson_user_key_pta.c

18. Build OPTEE

cd ${L4T_DIR}/source/public/
optee_src_build.sh -p t234

19. Build dtb

dtc -I dts -O dtb -o ./optee/tegra234-optee.dtb ./optee/tegra234-optee.dts

20. Install AFT

cd atf_build/arm-trusted-firmware
make BUILD_BASE=./build \
   CROSS_COMPILE="${CROSS_COMPILE_AARCH64}" \
   DEBUG=0 LOG_LEVEL=20 PLAT=tegra SPD=opteed TARGET_SOC=t234 V=0
cd ../..

21. Create TOS image

python3 ./../../nv_tegra/tos-scripts/gen_tos_part_img.py \
  --monitor ./atf_build/arm-trusted-firmware/build/tegra/t234/release/bl31.bin \
  --os ./optee/build/t234/core/tee-raw.bin \
  --dtb ./optee/tegra234-optee.dtb \
  --tostype optee \
  ./tos-optee_t234.img

22. Copy TOS image to ${L4T_DIR}/bootloader

EKB Generation

23. Generate OemK1

cd ${L4T_DIR}
openssl rand -hex 32 | tr -d '\n' > oemk1.key

24. Generate EKS

python3 source/public/optee/samples/hwkey-agent/host/tool/gen_ekb/gen_ekb.py \
          -chip t234 \ 
          -oem_k1_key oemk1.key \ 
          -fv fv \
          -in_sym_key uek.key \ 
          -in_sym_key2 dek.key \
          -out eks_t234.img

25. Replace bootloader/eks_t234.img with eks_t234.img

Burn Fuses

26. Create fuse file

cat > fuse.xml <<EOF
<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="PublicKeyHash" size="64" value="0x$(tr -d '\n\r[:space:]' < pkc.pem)"/>
    <fuse name="SecureBootKey" size="32" value="0x$(tr -d '\n\r[:space:]' < sbk.key)"/>
    <fuse name="OemK1" size="32" value="0x$(tr -d '\n\r[:space:]' < oemk1.key)"/>
    <fuse name="BootSecurityInfo" size="4" value="0x3EB"/>
</genericfuse>
EOF

At this stage device must connected in recovery mode

27. Test fuse burning

sudo ./odmfuse.sh --test -X <fuse_config> -i 0x23 cti/orin-nx/hadron-dual-mipi/base

28. Burn the fuses. Irreversible.

sudo ./odmfuse.sh -X <fuse_config> -i 0x23 cti/orin-nx/hadron-dual-mipi/base

Flash Device

sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh \
    --external-device nvme0n1p1 \
    -c ./tools/kernel_flash/flash_l4t_nvme_rootfs_enc.xml \
    -p "-c ./bootloader/t186ref/cfg/flash_t234_qspi.xml" \
    -u pkc.pem \
    -v sbk.key \
    -i dek.key \
    --uefi-enc uek.key \
    --uefi-keys uefi_keys/uefi_keys.conf \
    --showlogs \
    --network usb0 \
    cti/orin-nx/hadron-dual-mipi/base \
    internal