Orin NX fused but fuses do not work?

michal.kaczmarek · August 14, 2025, 5:09pm

Hello,

I am writing with an issue with my board. I am using Orin NX 8GB module.
My board has written several fuses - it means:

PKC
SBK
OEM_K1
OEM_K2
BOOT_SECURITY_INFO

according to the documentation I have prepared fuse_config.xml file as given below.

Of course there are no zero keys in this file.
PKC is ECDSA P-256 Key, based on that key public key and its hash had been generated using ./tegrasign_v3.py --pubkeyhash <pkc.pubkey> <pkc.hash> --key <pkc.pem>
SecureBootKey is 32-byte long hex key.
Same for OEM_K1 and OEM_K2.

Fuses has been written using this command
sudo ./odmfuse.sh -X ./fuse_config.xml -i 0x23 jetson-orin-nano-devkit

I can confirm that fuses has been burned in OS using sudo nv_fuse_read.sh

odm_lock: 0x00000000
revoke_pk_h0: 0x00000000
revoke_pk_h1: 0x00000000
optin_enable: 0x00000000
public_key_hash: <SAME PKC HASH AS IN THE FUSE_CONFIG.XML>
boot_security_info: 0x0000000a
odmid: 0x0000000000000000
pk_h1: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
pk_h2: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
security_mode: 0x00000000
reserved_odm2: 0x00000000
reserved_odm3: 0x00000000
reserved_odm0: 0x00000000
reserved_odm1: 0x00000000
reserved_odm6: 0x00000000
reserved_odm7: 0x00000000
reserved_odm4: 0x00000000
reserved_odm5: 0x00000000
odminfo: 0x00000000
system_fw_field_ratchet1: 0x00000000
system_fw_field_ratchet0: 0x00000000
system_fw_field_ratchet3: 0x00000000
system_fw_field_ratchet2: 0x00000000
ecid: 0x847263392417f406

And here is were issue starts.
After flash I am unable to flash signed images into Jetson. If I generate image sudo ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash -u <pkc_keyfile> [-v <sbk_keyfile>] jetson-agx-orin-devkit internal

and then flash it

sudo ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash -u <pkc_keyfile> [-v <sbk_keyfile>] jetson-agx-orin-devkit internal

I have received just USB Timeouts (included end of log)

End of fuses write log

\\\[ 0.7946 \\\] tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed\\\[ 0.7950 \\\] BR_CID: 0x8A012344705DE5098000000005FD0180\\\[ 0.8183 \\\] Sending bct_br\\\[ 0.8489 \\\] Sending mb1\\\[ 0.8502 \\\] ERROR: might be timeout in USB write.Error: Return value 3Command tegrarcm_v2 --new_session --chip 0x23 0 --uid --download bct_br br_bct_BR.bct --download mb1 mb1_t234_prod_aligned_sigheader_encrypt.bin.signed --download psc_bl1 psc_bl1_t234_prod_aligned_sigheader_encrypt.bin.signed --download bct_mb1 mb1_bct_MB1_sigheader_encrypt.bct.signed\\\[ 0.8567 \\\] tegrarcm_v2 --chip 0x23 0 --ismb2applet\\\[ 0.8602 \\\] Retrieving board information\\\[ 0.8617 \\\] tegrarcm_v2 --chip 0x23 0 --oem platformdetails chip chip_info.bin\\\[ 0.8639 \\\] Retrieving EEPROM data\\\[ 0.8640 \\\] tegrarcm_v2 --oem platformdetails eeprom cvm /home/mikaczma/nvidia/Linux_for_Tegra/bootloader/cvm.bin --chip 0x23 0\\\[ 0.8708 \\\] tegrarcm_v2 --chip 0x23 0 --ismb2applet\\\[ 0.8727 \\\] Dumping customer Info\\\[ 0.8742 \\\] tegrarcm_v2 --chip 0x23 0 --oem dump bct tmp.bct\\\[ 0.8778 \\\] tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo /home/mikaczma/nvidia/Linux_for_Tegra/bootloader/custinfo_out.bin\\\[ 0.8791 \\\] File tmp.bct open failedError: Return value 19Command tegrabct_v2 --brbct tmp.bct --chip 0x23 0 --custinfo /home/mikaczma/nvidia/Linux_for_Tegra/bootloader/custinfo_out.binReading board information failed.

I have tried other machine (Ubuntu 20.04, 22.04, 24.04) / Intel / AMD processors / USB3.0 hubs / USB2.0 hubs. All that failed in same way.

I have assumed that it may be caused by not setting bit 9 in the boot_security_info fuse (mean 0x20a instead of 0xa) to inform that ODM Keys are valid.

But it is same story when comes to writing fuses right now. If I will provide odmfuse.sh script without PKC+SBK keys I have that information in the terminal, but if these keys are provided using -k and -S flags then fusing fails on USB Timeout.

Nevertheless I am able to write non-signed OS image into Jetson right now, what really confuse me.

————————————————————————————–
I am on daily basis using Ubuntu 22.04 on AMD64 with Jetpack 6.2.1

JerryChang · August 15, 2025, 2:40am

hello michal.kaczmarek,

let me have confirmation,
you’re able to boot into linux, but not able to re-flash the target?

it’s only PKC+SBK; you should also have bit-9 (Bit [9] ODM Key Valid) since you’ve burned OEM_K1.

please refer to developer guide, Burn Fuses with the Fuse Configuration file.
since it’s the board needs to have additional fuses burned, please have xml file with additional fuse, BootSecurityInfo.

<genericfuse MagicId="0x45535546" version="1.0.0">
   <fuse name="BootSecurityInfo" size="4" value="0x20a"/>
</genericfuse>

you should assign your PKC/SBK key to the fuse script for burning this fuse.
for instance,
$ sudo ./odmfuse.sh -X fuse.xml -i 0x23 -k PKC.key -S SBK.key jetson-orin-nano-devkit

michal.kaczmarek · August 18, 2025, 9:30am

Hi JerryChang

But it is same story when comes to writing fuses right now. If I will provide odmfuse.sh script without PKC+SBK keys I have that information in the terminal, but if these keys are provided using -k and -S flags then fusing fails on USB Timeout.

I have tried to burn additional fuse ( Bit [9] ODM Key Valid in BootSecurityInfo).

What should be result if I have burned OEM_K1 but ODM Key Valid is not burned?

Right now I have always USB timeout if I will provide PKC+SBK keys (in odmfuse.sh, or l4t_initrd_flash.sh).

But if I will not provide PKC+SBK in l4t_initrd_flash.sh while I flash image on Jetson - everything is fine and Jetson starts without hassle.

JerryChang · August 19, 2025, 2:40am

hello michal.kaczmarek,

that’s unexpected.
once you’ve fused a target, you’ll need to provide the exactly same keys for running flash command-line. otherwise, it’ll abort the flashing process. there’s Boot Rom communication in the early stage.
for instance,
it’ll report the errors like below and abort the process if you did not given keys to the fused target.
Error: Either RSA key file is not provided or SBK key file is provided for PKC protected target board.

could you please test again with the fresh new Jetpack installation image?

Topic		Replies	Views
Orin NX fuse burning issue Jetson Orin Nano security , inception	39	800	September 4, 2025
Orin fuse writing error, reloaded Jetson AGX Orin security	21	326	May 26, 2026
ERROR: might be timeout in USB write after Fuse burning Jetson Orin NX boot , reflash , security	5	2077	August 25, 2023
Cannot use flash cmd after burn fuse Jetson Orin NX security	23	460	August 28, 2025
Jetson Orin Nano SBKPKC Fused USB_TIMEOUT Cannot Flash/Read Etc Jetson Orin NX security	4	89	March 6, 2026
Jetson Orin NX - board can't flash after partial fuse burn Jetson Orin NX security , nvbugs	53	1493	March 18, 2026
Error during fuse Jetson Orin NX security	19	338	September 10, 2025
Orin NX 16G bricked after fused, no recovery usb available Jetson Orin NX security	16	357	September 10, 2025
Fusing on a virgin Orin nx made subsequent flashes fail Jetson Orin NX	3	154	August 5, 2025
Fused OrinNX: Disk Encryption Fail & Secure Boot (Usage Error vs ECID Null) Jetson Orin NX security	36	300	January 30, 2026

Orin NX fused but fuses do not work?

Related topics