Secure Boot, Encrypted FS; Flashing Fails with ERROR: might be timeout in USB write; Fuse Write Also doesnt work

kris_12345 · January 27, 2026, 7:24pm

Board - Jetson Orin Nano Dev Kit | Jetson 6.2.1 | nvme external drive | host: x86 Ubuntu 24.04 (have tried others)

Enabling Secure Boot and Encrypted FS

Issue 1: I cant successfully write encrypted FS to NVME. I keep getting errors referring to ERROR: might be timeout in USB write when trying to flash encrypted images to the dev kit. I’ve had errors like this regularly doing any type of flashing to the board.
I’ve tried:

Different Ubuntu Versions (Disk Encryption docs say use 24.04)
Different cables
Disabling USB Autosuspend (as per the FAQ)
Re-doing RCM mode at each stage of the l4t_initrd_flash.sh process

This command: ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --showlogs --flash-only

Results in this error:

 [   0.0279 ] BR_CID: <>

[   0.0348 ] Sending bct_br

[   0.0407 ] Sending mb1

[   0.0412 ] ERROR: might be timeout in USB write.

Error: Return value 3

I can only get the previous commands to work if I prepend the environment variable flags so it doesnt talk to the board during the operation, e.g.:

BOARDID=3767 FAB=300 BOARDSKU=0005 BOARDREV=K.2 ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash -S 60GiB -i sym2_t234.key -u pkc.pem -v sbk.key --network usb0 --usb-instance 1-8 --device-instance 0 --external-device nvme0n1 --external-only --append -c tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml jetson-orin-nano-devkit external

Issue 2: The Fuse burning process doesnt burn any fuse other than the PKC. I’ve changed the BootSecurityInfo to 0x3E9 after reading the forums and finding my board shipped with a pre-burned value. However despite odmfuse completing successfully it doesnt write any of the other fuses. I need SecureBootKey and OemK1 - for use with LUKS (I followed the documentation here: Disk Encryption — NVIDIA Jetson Linux Developer Guide

The odmfuse process completes successfully, but the logs to show this which has me concerned (the PKC key was the only thing that burned successfully)

[   3.1144 ] Assuming zero filled SBK key

[   3.1152 ] Warning: pub_key.key is not found

I’ve been through the forums for the last few days and tried all of the suggestions buried within aswell as following the various processes in the docs.

I thought using the ethernet protocol may improve things with l4t_initrd_flash (as per the README) but I couldnt get that method to function at all.

I have successfully flashed and used the Jetson using a non-encrypted FS; even after the PKC fuse was burned, but secure boot was still disabled - presumably because the SecurityMode and BootSecurityInfo fuses didnt burn at all; so the device isnt bricked.

Any guidance much appreciated!

carolyuu · January 27, 2026, 7:52pm

*** Please note that this reply is generated by LLM automatically ***

Based on the provided context, it appears that you are experiencing issues with flashing an encrypted file system to the Jetson Orin Nano Dev Kit using an NVMe external drive. You have tried various troubleshooting steps, including using different Ubuntu versions, disabling USB autosuspend, and redoing RCM mode at each stage of the process.

To address your issue, I will provide a comprehensive analysis of the potential causes and offer guidance on how to resolve the problem.

Potential Causes:

Incorrect Environment Variables: You mentioned that you can only get the previous commands to work if you prepend the environment variable flags. This suggests that there might be an issue with the environment variables not being set correctly.
Fuse Burning Issues: You reported that the odmfuse process completes successfully, but only the PKC fuse is burned. This could indicate a problem with the fuse burning process or the configuration of the fuses.
LUKS Configuration: You are trying to use LUKS (Linux Unified Key Setup) for disk encryption, but the documentation you followed might not be accurate or up-to-date.
Communication Issues: You mentioned trying to use the ethernet protocol, but it didn’t work. This could indicate a problem with the communication between the host machine and the Jetson Orin Nano Dev Kit.

Guidance:

Verify Environment Variables: Double-check that the environment variables are set correctly. Make sure that the ENC_ROOTFS variable is set to 1 to enable disk encryption.
Fuse Burning Configuration: Review the fuse burning configuration and ensure that the correct fuses are being burned. You can refer to the Jetson Orin Nano Dev Kit documentation for more information on fuse burning.
LUKS Configuration: Verify that the LUKS configuration is correct. You can refer to the Linux Unified Key Setup documentation for more information on configuring LUKS.
Communication Protocol: Try using the USB protocol instead of ethernet. Make sure that the USB connection is stable and that the Jetson Orin Nano Dev Kit is in RCM mode.
Debugging: Enable debugging logs to get more information about the errors you are experiencing. This will help you identify the root cause of the issue.

Comparison with Other Boards:

Based on the provided context, it appears that you have successfully flashed and used the Jetson Orin Nano Dev Kit with a non-encrypted file system. This suggests that the issue is specific to the encrypted file system configuration.

In comparison to other boards, the Jetson Orin Nano Dev Kit has specific requirements for fuse burning and LUKS configuration. It’s essential to follow the documentation specific to the Jetson Orin Nano Dev Kit to ensure that the configuration is correct.

Additional Recommendations:

Check the Jetson Orin Nano Dev Kit documentation: Review the documentation specific to the Jetson Orin Nano Dev Kit to ensure that you are following the correct procedures for flashing an encrypted file system.
Seek Support: Reach out to the NVIDIA support team or the Jetson Orin Nano Dev Kit community for further assistance. They may be able to provide more specific guidance or troubleshooting steps to resolve the issue.

By following these recommendations and verifying the environment variables, fuse burning configuration, and LUKS configuration, you should be able to resolve the issue and successfully flash an encrypted file system to the Jetson Orin Nano Dev Kit.

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

cristian.hidalgo · January 27, 2026, 9:03pm

Could please share the output of the following command:

sudo ./flash.sh --read-info jetson-orin-nano-devkit internal

Please focus on the part where the fuses values are shown, it may look like the following:

PublicKeyHash: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 PkcPubkeyHash1: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 PkcPubkeyHash2: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 BootSecurityInfo: 00000000 ArmJtagDisable: 00000000 SecurityMode: 00000000 SwReserved: 00000000 DebugAuthentication: 00000000 OdmInfo: 00000000 OdmId: 0000000000000000 OdmLock: 00000000 ReservedOdm0: 00000000 ReservedOdm1: 00000000 ReservedOdm2: 00000000 ReservedOdm3: 00000000 ReservedOdm4: 00000000 ReservedOdm5: 00000000 ReservedOdm6: 00000000 ReservedOdm7: 00000000 Sku: 000000d5 Uid: c00201100000006c19e55d7004000000 OptEmcDisable: 0000000c

I have experienced a similar problem as yours after “burning” the fuses.

Also, just to make sure, are you using an Orin Nano?

Regards,

Embedded Software Engineer
RidgeRun | https://www.ridgerun.com/

Contact us: support@ridgerun.com
Developers wiki: https://developer.ridgerun.com/

kris_12345 · January 27, 2026, 10:26pm

Hi Cristian - thanks for the reply - output from that command is below - PKC value is correc, the rest appears to be null. Yes its a Jetson Orin Nano

==== Fuse Info (/Linux_for_Tegra/bootloader/fuse_t234.bin) ====

PublicKeyHash: 0eedf04a8b358——-c5cc89138890d1a89e

PkcPubkeyHash1: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

PkcPubkeyHash2: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

BootSecurityInfo: 000001e0

ArmJtagDisable: 00000000

SecurityMode: 00000000

SwReserved: 00000000

DebugAuthentication: 00000000

OdmInfo: 00000000

OdmId: 0000000000000000

OdmLock: 00000000

ReservedOdm0: 00000000

ReservedOdm1: 00000000

ReservedOdm2: 00000000

ReservedOdm3: 00000000

ReservedOdm4: 00000000

ReservedOdm5: 00000000

ReservedOdm6: 00000000

ReservedOdm7: 00000000

Sku: 000000d5

Uid: 8000ff120000001cc5f85d7004000000

OptEmcDisable: 0000000c

cristian.hidalgo · January 27, 2026, 10:38pm

Hello @kris_12345

Could you please share you fuse configuration file as well the commands to perform fuse burning and its log outputs?

Regards,

Embedded Software Engineer
RidgeRun | https://www.ridgerun.com/

Contact us: support@ridgerun.com
Developers wiki: https://developer.ridgerun.com/

JerryChang · January 28, 2026, 2:53am

hello kris_12345,

please refer to below, we’ve verified disk encryption on fused Orin-NX.
we took sample script for calling gen_ekb.py to re-create EKS image.
for instance,
$public_sources/r36.4.4/Linux_for_Tegra/source/atf_and_optee/optee/samples/hwkey-agent/host/tool/gen_ekb/example.sh

echo "xxxxxxxxxxxxxxxxxx" > oem_k1.key
echo "xxxxxxxxxxxxxxxxxx" > sym_t234.key
echo "xxxxxxxxxxxxxxxxxx" > sym2_t234.key
echo "xxxxxxxxxxxxxxxxxx" > auth_t234.key

python3 gen_ekb.py -chip t234 -oem_k1_key oem_k1.key \
        -in_sym_key sym_t234.key \
        -in_sym_key2 sym2_t234.key \
        -in_auth_key auth_t234.key \
        -out eks_t234.img

here’re flash commands..
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --no-flash -u rsa_priv-3k.pem -v sbk.key --showlogs -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" jetson-orin-nano-devkit internal
$ sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -i ./sym2_t234.key -u rsa_priv-3k.pem -v sbk.key -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml --external-only --append --network usb0 jetson-orin-nano-devkit external
$ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs -u rsa_priv-3k.pem -v sbk.key --network usb0 --flash-only

this looks incorrect, BootSecurityInfo remain the default values with 0x1e0.
you should at least update Bits[2:0] to map to Secure Boot Authentication Scheme.
such as..
001b: 3072-bit RSA
010b: ECDSA P-256 Curve
011b: ECDSA P-521-Curve
100b: Ed25519

kris_12345 · January 28, 2026, 7:34am

Ok - so would the incorrect BootSecurityInfo (or other keys) in the fuse config can the USB TIMEOUT error (board rejecting some config and disconnecting?

gen_ekb command (I used an edited version of example.sh) - it completed successfully.

python3 gen_ekb.py -chip t234 -oem_k1_key oemk1.key \

        -in_sym_key sym_t234.key \

        -in_sym_key2 sym2_t234.key \

        -in_auth_key auth_t234.key \

        -in_ftpm_sn <serial> \

        -in_ftpm_eps_seed ftpm_eps_seed_file \

        -in_ftpm_rsa_ek_cert ftpm_rsa_ek_cert.der \

        -in_ftpm_ec_ek_cert ftpm_ec_ek_cert.der \

        -in_sid_cert sid_cert.der \

        -in_ftpm_rsa_ek_csr ftpm_rsa_ek_csr.der \

        -in_ftpm_ec_ek_csr ftpm_ec_ek_csr.der \

        -out eks_t234.img

Fuse Config XML:

fuse name=“PublicKeyHash” size=“64” value=“0x—PKC That fused ok—”
fuse name=“SecureBootKey” size=“32” value=“0x—SBK—”
fuse name=“BootSecurityInfo” size=“4” value=“0x3E9”
fuse name=“SecurityMode” size=“4” value=“0x1”

Fuse Command
./odmfuse.sh -i 0x23 -X fuse_config.xml jetson-orin-nano-devkit

Flash Commands I Used:
BOARDID=3767 FAB=300 BOARDSKU=0005 BOARDREV=K.2 ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --no-flash --showlogs -S 60GiB -p "-c bootloader/generic/cfg/flash_t234_qspi.xml" jetson-orin-nano-devkit internal

BOARDID=3767 FAB=300 BOARDSKU=0005 BOARDREV=K.2 ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --no-flash -i sym2_t234.key -u pkc_rsa.pem -v sbk.key --network usb0 --usb-instance 1-8 --device-instance 0 --external-device nvme0n1 --external-only --append -c tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml -S 60GiB jetson-orin-nano-devkit external

./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --showlogs --flash-only

Things I can see from your suggestions are:

missing -u and -v params in the final flash command
BootSecurityInfo incorrect for 3072-bit RSA

JerryChang · January 28, 2026, 8:10am

hello kris_12345,

you should have BootSecurityInfo maps to your authentication scheme.
besides.. please also include PKC/SBK keys to your internal flash command-line.

kris_12345 · January 28, 2026, 2:14pm

I tried fusing using both BootSecurityInfo 0x1E9 (board default + RSA + SBK) and 0x3E9 (board default + RSA + SBK + OemK1) - neither of which fused - the board remains in default mode.

(I need to ultimately end up with OemK1 aswell for Disk Encryption)

This is the fuse command again - are there any additional flags I need (ive seen --force etc used elsewhere in forum)? Do the xml and pkc files need to be in the Linux_For_Tegra root?

./odmfuse.sh -i 0x23 -X fuse_config.xml -k pkc_rsa.pem jetson-orin-nano-devkit

JerryChang · January 29, 2026, 2:43am

hello kris_12345,

let me have confirmation, is your target fused before with SBKPKC?

this is command to burn additional fuse variables onto PKC fused device,
your xml file should include addition keys only, and it must use the same PKC key for this command-line.

kris_12345 · January 29, 2026, 7:55am

Hi JerryChang,

Yes - the first fuse command worked on the PKC fuse only - the rest remained unset - see above fuse info for PublicKeyHash:

==== Fuse Info (/Linux_for_Tegra/bootloader/fuse_t234.bin) ====
PublicKeyHash: 0eedf04a8b358——-c5cc89138890d1a89e

I’ll try removing the PKC line from the XML and running the fuse burn again.

kris_12345 · January 29, 2026, 8:19am

That didnt work either - XML below resulted in no additional fuses set (PKC remains set as previous):

./odmfuse.sh -i 0x23 --force -X fuse_config.xml -k pkc_rsa.pem jetson-orin-nano-devkit

<fuse name="SecureBootKey" size="32" value="0xREMOVED"/>
<fuse name="OemK1" size="32" value="0xREMOVED"/>
<fuse name="BootSecurityInfo" size="4" value="0x3e9"/>
<fuse name="SecurityMode" size="4" value="0x1"/>

PublicKeyHash: REMOVED
BootSecurityInfo: 000001e0
ArmJtagDisable: 00000000
SecurityMode: 00000000

JerryChang · January 29, 2026, 3:08pm

hello kris_12345,

it’s BootSecurityInfo’s bit [3:0] to indicate the target’s secureboot authentication scheme.
here’s looks strange you’ve PKC fused, but the bit-[2:0] shows all 0s.
please try to burn only BootSecurityInfo, assume it’s PKC key with 3072-bit RSA. (i.e. 001b for BootSecurityInfo)
$ sudo ./odmfuse.sh -X <fuse_config> -i 0x23 -k <pkc.pem> <target_config>

<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="BootSecurityInfo" size="4" value="0x1e1"/>
</genericfuse>

kris_12345 · January 29, 2026, 3:23pm

Hey JerryChang,

Thanks yes that worked - the BootSecurityInfo flag has now changed to 1e1 - see below.

Fuse reading is done. The fuse values have been saved in: /Linux_for_Tegra/bootloader/fuse_info.txt
PublicKeyHash: REMOVED
BootSecurityInfo: 000001e1

So I can progress with fusing the SBK and then updating the BootSecurityInfo to reflect PKC+SBK - individually fusing these?

Given successful boot I understand I can then fuse OEMK1 → use that for eks image generation and nvme encryption?

JerryChang · January 30, 2026, 5:50am

hello kris_12345,

please refer to developer guide, Burn Fuses with the Fuse Configuration file.
you may have have additional fuses by running odmfuse.sh with the -k command to assign your PKC key.

it’s suggest to program PscOdmStatic as well since you have OEM keys.
please refer to Jetson Orin Fuse Specification for the fuse variable, FUSE_KEYS_PSC_STATIC_OEM*.
its fuse name is “PscOdmStatic” in the xml file, we recommend burning it to 0x60, which sets the purpose of below..
– OEM_K1 to encryption. (see-also OEM_K1_PURPOSE=0x0)
– OEM_K2 to KDK(key derive key) (see-also OEM_K2_PURPOSE=0x6)

BTW,
as mentioned by developer guide, it recommends burning all the fuses you need in a single operation.

Topic		Replies	Views
Failed Assert during Boot (Post fuse burn) Jetson Orin Nano security	10	163	May 7, 2026
Jetson Orin flashing with UEFI and disk encrytion Jetson AGX Orin security	14	414	October 29, 2025
Use both secureboot and disk encrypt boot failed Jetson Orin Nano security	4	166	September 16, 2025
Jetson Orin Nano SBKPKC Fused USB_TIMEOUT Cannot Flash/Read Etc Jetson Orin NX security	4	92	March 6, 2026
Burn ODM Key Valid fuse bit on PKCSBK fused Jetson orin nano Jetson Orin Nano boot , security	22	326	December 11, 2025
Cannot use flash cmd after burn fuse Jetson Orin NX security	23	466	August 28, 2025
Issue with enabling secure boot and disk encryption -> USB timeout error Jetson Orin NX security , jetson	10	123	July 2, 2026
Unable to boot fused Jetson Orin Nano despite flashing process appearing to succeed Jetson Orin Nano security	26	640	July 21, 2025
Orin Nano Devkit showing error during boot Jetson Orin Nano boot , board-design	1	252	May 13, 2024
Flashing Jetson Orin Nano - File rcm_state open failed, Error: failed to read rcm_state Jetson Orin Nano security	3	1218	January 10, 2024

Secure Boot, Encrypted FS; Flashing Fails with ERROR: might be timeout in USB write; Fuse Write Also doesnt work

Related topics