UEFI not boot-able when enable secure boot

Robotics & Edge Computing Jetson Systems Jetson Orin NX
1

Hi,

I have Orin NX 16GB, fused with following configuration

<genericfuse MagicId="0x45535546" version="1.0.0">
    <fuse name="PublicKeyHash" size="64" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="PkcPubkeyHash1" size="64" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="PkcPubkeyHash2" size="64" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="SecureBootKey" size="32" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="PscOdmStatic" size="4" value="0x60"/>
    <fuse name="OemK1" size="32" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="OemK2" size="32" value="0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"/>
    <fuse name="BootSecurityInfo" size="4" value="0x3E9"/>
    <fuse name="SecurityMode" size="4" value="0x1"/>
</genericfuse>

I updated eks.img with the command:

$ python3 gen_ekb.py
        -chip t234 \
        -oem_k1_key oem_k1.key \
        -in_sym_key sym_t234.key \
        -in_sym_key2 sym2_t234.key \
        -in_auth_key auth_t234.key \
        -out eks_t234.img

oem_k1.key is the key that fused, sym_t234.key is generated as README of gen_ekb, sym2 key is all 0, auth key is generated as README of gen_ekb.
I didn’t enable UEFI secure boot, just fused and generate new eks_t234.img .

After flashed, the board is failed with following uart log:

NOTICE:  BL31: v2.8(release):l4t-r36.4.4
NOTICE:  BL31: Built : 2025-06-16 15:14:01
I/TC: 
I/TC: Non-secure external DT found
I/TC: OP-TEE version: 4.2 (gcc version 13.4.0 (GCC)) #1 Mon Jun 16 15:53:22 UTC 2025 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
M/TC: engine AES0 engine [AES/RNG](16) post op: SE0 err_status register 0x10f8 nonzero (value 0x80000000)
M/TC: SE abnormal cond, error info: 0x30040000
M/TC: HW error: d(0), e(0), ro(0x110), rv(0xb0040000), che(0x30), act(0x0)
M/TC: device SE0(0) post op: error_capture 0x30040000
M/TC: AES crypto failed: -17
E/TC:00 00 se_aes_encrypt:35 se_aes_encrypt failed with: -17
I/TC: Derive EKB_RK from #1 fuse key failed, ignored.
M/TC: engine AES0 engine [AES/RNG](16) post op: SE0 err_status register 0x10f8 nonzero (value 0x80000000)
M/TC: SE abnormal cond, error info: 0x30040000
M/TC: HW error: d(0), e(0), ro(0x110), rv(0xb0040000), che(0x30), act(0x0)
M/TC: device SE0(0) post op: error_capture 0x30040000
M/TC: AES crypto failed: -17
E/TC:00 00 se_aes_encrypt:35 se_aes_encrypt failed with: -17
E/TC:00 00 hwkey_derivation_process:452 hwkey_derivation_process: Failed to derive SSK root key (ffff0000)
E/TC:00 00 ekb_extraction_process:404 Tried all EKB_RKs but still can't extract the EKB image.
E/TC:00 00 jetson_user_key_pta_init:1154 jetson_user_key_pta_init: Failed (ffff000f).
E/TC:00 00 call_initcalls:43 Initcall __text_start + 0x0016b3f0 failed
I/TC: Primary CPU switching to normal world boot

  Jetson UEFI firmware (version v36.4.4 built on 2024-10-01T15:28:28+00:00)



I/TC: Reserved shared memory is disabled
I/TC: Dynamic shared memory is enabled
I/TC: Normal World virtualization support is disabled
I/TC: Asynchronous notifications are disabled
E/TC:?? 00 jetson_user_key_pta_uefi_vars_auth:984 UEFI variable auth key not set !
E/TC:?? 00 stmm_handle_variable_authentication:894 Failed to get signed CMAC ffff0008

ASSERT [FvbNorFlashStandaloneMm] /usr/src/debug/standalone-mm-optee-tegra/36.4.4/edk2-nvidia/Silicon/NVIDIA/Drivers/FvbNorFlashDxe/VarIntCheck.c(932): ((BOOLEAN)(0==1))

Can you please point me what is wrong and how I can solve this? Thank you so much.
Linh

2

*** Please note that this reply is generated by LLM automatically ***

Based on the provided information, it appears that you have a Jetson Orin NX 16GB module that has been fused with a specific configuration, but the board is failing to boot after flashing.

To help you troubleshoot the issue, let’s break down the key components involved in the fusing and boot process:

  1. OEMK1 key: This is the key that was fused to the module. It’s used for secure boot and authentication.
  2. symt234key: This is a key generated using the genekb tool, which is used to create a symmetric key for encryption.
  3. sym2 key: This is another key generated using the genekb tool, which is used for authentication.
  4. Auth key: This is a key generated using the genekb tool, which is used for authentication.

From the UART log, it’s not clear what specific error is causing the boot failure. However, I can provide some general guidance on potential issues and troubleshooting steps:

Potential issues:

  1. Incorrect key configuration: Double-check that the OEMK1 key, symt234key, sym2 key, and auth key are correctly configured and generated.
  2. Incompatible key formats: Ensure that the keys are in the correct format (e.g., PEM, DER, etc.) and are compatible with the Jetson Orin NX module.
  3. Secure boot not enabled: Although you mentioned that UEFI secure boot is not enabled, it’s possible that the module is still expecting a secure boot configuration. Try enabling UEFI secure boot and see if it resolves the issue.
  4. Fusing issues: Verify that the fusing process was successful and that the keys were properly written to the module.

Troubleshooting steps:

  1. Re-check the fusing process: Verify that the fusing process was successful and that the keys were properly written to the module.
  2. Verify key formats: Ensure that the keys are in the correct format (e.g., PEM, DER, etc.) and are compatible with the Jetson Orin NX module.
  3. Enable UEFI secure boot: Try enabling UEFI secure boot and see if it resolves the issue.
  4. Check the UART log: Analyze the UART log to see if there are any specific error messages that can help identify the issue.
  5. Contact NVIDIA support: If none of the above steps resolve the issue, consider contacting NVIDIA support for further assistance.

In comparison to other similar issues, it’s possible that the problem is related to the key configuration or fusing process. For example, in the “Xavier doesn’t boot after Secure Boot flash (JetPack 5.1.2 / L4T R35.4.1)” topic, the issue was resolved by re-flashing the module with the correct secure boot configuration.

In the “Can’t Image-Based OTA update after I patch my tos-img in bootloader” topic, the issue was resolved by updating the bootloader and re-flashing the module.

In your case, it’s essential to verify the key configuration and fusing process to ensure that everything is correct. If you’re still unsure, feel free to provide more information or clarification on the issue, and I’ll do my best to assist you further.

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

4

Re-generate eks.img file solves this. Thank you.