Issues Updating Bootloader via Capsule Update on Jetson Xavier NX (EMMC) with Secure Boot Enabled

Hi everyone,

I’m currently working on a bootloader update using Capsule Update on a Jetson Xavier NX with eMMC storage and Secure Boot enabled. However, I am experiencing some strange behavior during the process.

To generate the payload (bl_only_payload), I use the -u and -v options with our respective keys, and then create the TEGRA_BL.cap file. Up to this point, everything appears to be working correctly.

I am following the procedure outlined in this official forum post:
👉 JetPack 5.1 Bootloader Update using UEFI Capsule

During boot, the system detects the capsule and completes the update successfully. Here’s an example of the boot output:

Jetson UEFI firmware (version v35.4.1 built on 2023-08-04T23:11:08+00:00)

ESC   to enter Setup.
F11   to enter Boot Manager Menu.
Enter to continue boot.

Update Progress - 100% **************************************************����

Also, when I run nvbootctrl dump-slots-info, I get:

Current version: 35.4.1
Capsule update status: 1
Current bootloader slot: B
Active bootloader slot: B
num_slots: 2
slot: 0,             status: normal
slot: 1,             status: normal

Everything indicates that the update is applied successfully, but when I test by changing the UEFI menu timeout value (expecting it to reflect after the update), the value remains unchanged before and after the update.

So here are my questions:

  1. Is it possible that some UEFI configuration values, such as the menu timeout, cannot be updated via Capsule Update?
  2. Are there any parts of the firmware that are not affected by this type of update?
  3. Has anyone experienced a similar issue where configuration changes are not reflected after a Capsule Update?

I appreciate any guidance or shared experience.

Hi oscar.mendez1,

Are you trying to update from r35.4.1 to r35.4.1?
Does the UEFI build time showing in serial console log get updated after capsule update finished?

Please share the detailed steps how do you update the UEFI menu timeout before generating capsule payload.

Hi @KevinFFF

Yes, I’m trying to stay on the same version (R35.4.1). What I’m attempting to do is apply some optimizations to reduce boot time, following the guide available here:
Boot Time Optimization

As I mentioned in my previous message, the UEFI menu timeout value did not change, even though the update process completed successfully.
Our goal is to avoid performing the flash process, because when we do flash the device, the changes are applied correctly, which suggests that the modifications we’re making are valid.

However, in our current workflow, doing the flash process each time is not a feasible option.

Any insights into why certain UEFI config values like the timeout aren’t being updated via Capsule, or if there’s a specific method needed to include those changes, would be greatly appreciated.

Thanks again!

hello oscar.mendez1,

it looks like this issue. UEFI secure boot is canceled when Capsule Update from R35.4.1 to R35.6.0

is it possible for moving forward to the latest JetPack 5.1.5/r35.6.1 to test UEFI config values update via Capsule.

Hi @oscar.mendez1,

I’ve verified it locally and the current behavior is expected.
Capsule update will not reset/erase UEFI variables. (i.e. uefi_variables partition), but flashing process does.
You can find all variables in /sys/firmware/efi/efivars/

If you want to update the autoboot timeout to 1s, please simply run the following commands on your board.

$ printf "\x07\x00\x00\x00\x01\x00" > /tmp/var_tmp.bin 
$ sudo dd if=/tmp/var_tmp.bin of=Timeout-8be4df61-93ca-11d2-aa0d-00e098032b8c bs=6;sync
$ sudo reboot

Hi @KevinFFF,

Thank you very much for your response. By any chance, is there any documentation or could you let me know which parts of the bootloader can be updated with a Capsule? I’d really appreciate it!

hello oscar.mendez1,

I’ve tested to update rce-fw remotely.
I’ve replaced $OUT/Linux_for_Tegra/bootloader/camera-rtcpu-t234-rce.img with the latest firmware binary. and.. execute below to generate an OTA payload package to only update Bootloader.
$ sudo -E ./tools/ota_tools/version_upgrade/l4t_generate_ota_package.sh --external-device nvme0n1 -b jetson-orin-nano-devkit R35-4

you may check partition layouts for those bootloader partitions.
basically, they should be able to update remotely.