Nitrokey 3A dead after Firmware Upgrade in VM

Hi,

I tried to update my Nitrokey 3A firmware with the nitrokey 3a being attached to a VM. The Update aborted after transferring the 451k to the device and now the Nitrokey is no longer listed by lsusb (neither as nitrokey nor as NXP semiconductor device when it was in bootloader mode).

I guess the device is bricked now and I will need to get a new one? Or is there any chance to recover?

I can’t attach the full log (created new forum account) but here are the last relevant lines together with some of the DEBUG lines listing the transfer (there were many more of them before):

15735     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15736     DEBUG spsdk.mboot.interfaces.usb OUT[60]: 02, 00, 38, 00, 53, 5A, D8, 84, 4D, 27, 1A, DA, 3D, 12, 41, B7, F8, E0, BD, AA, 7B, 52, AC, 8D, DF, 1C, 8E, 5A, 7E, 07, F4, 5B, 3E, 92, 06, 4F, 97, 58, C4, 04, C7, 02, 2F, CF, 5F, 3E, 68, 99, 4E, 65, 4E, BD, 84, F9, 92, CC, B8, FD, 8A, D7
15736     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[60]: 0x02003800535ad8844d271ada3d1241b7f8e0bdaa7b52ac8ddf1c8e5a7e07f45b3e92064f9758c404c7022fcf5f3e68994e654ebd84f992ccb8fd8ad7
15736     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15737     DEBUG spsdk.mboot.interfaces.usb OUT[60]: 02, 00, 38, 00, 14, 3C, 88, D6, 54, 92, D2, 1D, 94, 77, 9F, 57, DE, EC, C6, A5, 6B, 2E, 56, CF, 12, 5E, 3F, 36, 5D, 10, 47, 8E, 17, D9, 3F, 07, 95, 17, 6A, F6, 69, 97, 57, E4, 16, 6B, 18, 7A, B6, E9, 25, CE, A8, 7D, 3E, E2, 9F, FD, 70, EE
15737     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[60]: 0x02003800143c88d65492d21d94779f57deecc6a56b2e56cf125e3f365d10478e17d93f0795176af6699757e4166b187ab6e925cea87d3ee29ffd70ee
15737     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15738     DEBUG spsdk.mboot.interfaces.usb OUT[60]: 02, 00, 38, 00, 53, 55, A2, D9, D6, F9, F0, 18, 0A, E8, 9F, B1, B8, A8, EC, A0, 7B, 8F, CC, 6F, E8, 6B, 16, AE, 13, 71, 4F, 58, 24, C4, C7, 63, DB, 73, CB, 37, 8A, 50, D4, 06, CA, CC, 56, 21, 31, BF, 2D, B5, E3, 21, 75, 6D, 0C, E7, 71, 5D
15738     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[60]: 0x020038005355a2d9d6f9f0180ae89fb1b8a8eca07b8fcc6fe86b16ae13714f5824c4c763db73cb378a50d406cacc562131bf2db5e321756d0ce7715d
15738     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15739     DEBUG spsdk.mboot.interfaces.usb OUT[60]: 02, 00, 38, 00, 09, 6B, 9B, 01, A5, 25, A7, 96, 9D, 9B, FD, 65, 0B, 73, 8A, B7, F0, 89, C5, 49, B3, 69, D2, 36, 18, 0F, CF, 8F, 7A, 07, D2, 92, 33, 86, 12, D3, B7, 49, 47, 9A, 0C, 52, A6, 35, BF, FA, BE, CD, 87, 4B, A2, 90, 84, 5E, 4C, 0F
15739     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[60]: 0x02003800096b9b01a525a7969d9bfd650b738ab7f089c549b369d236180fcf8f7a07d292338612d3b749479a0c52a635bffabecd874ba290845e4c0f
15739     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15740     DEBUG spsdk.mboot.interfaces.usb OUT[60]: 02, 00, 38, 00, D0, 9E, 30, BD, EE, 75, A8, A6, 9D, 65, 94, 68, 01, 42, 0D, 48, 01, 1E, A9, 61, 92, 47, 42, 53, B4, CC, CC, BF, 55, B3, 8E, 37, F3, 9B, F1, EC, 14, F9, 3C, 3E, BA, 41, 5C, AF, 63, F4, 0E, 7D, 72, 1D, 76, 09, BF, FC, C5, 98
15740     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[60]: 0x02003800d09e30bdee75a8a69d65946801420d48011ea96192474253b4ccccbf55b38e37f39bf1ec14f93c3eba415caf63f40e7d721d7609bffcc598
15740     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 60 bytes
15741     DEBUG spsdk.mboot.interfaces.usb OUT[20]: 02, 00, 10, 00, 28, C3, 03, 9C, 64, 30, F1, 5C, 0D, 43, 08, 69, 42, 66, 60, B5
15741     DEBUG libusbsio.hidapi.dev HID device 24392416 writing[20]: 0x0200100028c3039c6430f15c0d430869426660b5
15741     DEBUG libusbsio.hidapi.dev HID device 24392416 wrote 59 bytes
17744     DEBUG libusbsio.hidapi.dev HID device 24392416 read[0]: None
17744     ERROR spsdk.mboot.interfaces.usb Cannot read from HID device, error=0
17745     DEBUG spsdk.mboot.mcuboot RX: No Response, Timeout Error !
17752      INFO spsdk.mboot.mcuboot Closing: MCU HID GENERIC DEVICE (0x20A0, 0x42DD)
17752     DEBUG spsdk.mboot.interfaces.usb Close Interface
17753      INFO libusbsio.hidapi.dev HID device 24392416 closed
17753     DEBUG       root print: Critical error:
17756     DEBUG       root print: Failed to perform firmware update
17759     ERROR       root MBoot: Connection issue -> No Response from Device
Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 213, in _send_data
    response = self._device.read()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/interfaces/usb.py", line 238, in read
    raise TimeoutError()
TimeoutError

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 362, in _perform_update
    device.update(image, callback=callback)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/bootloader/lpc55.py", line 106, in update
    success = self.device.receive_sb_file(
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 658, in receive_sb_file
    result = self._send_data(CommandTag.RECEIVE_SB_FILE, data_chunks, progress_callback)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 217, in _send_data
    raise McuBootConnectionError("No Response from Device") from e
spsdk.mboot.exceptions.McuBootConnectionError: MBoot: Connection issue -> No Response from Device

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/__init__.py", line 129, in main
    nitropy()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/decorators.py", line 38, in new_func
    return f(get_current_context().obj, *args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/nk3/__init__.py", line 447, in update
    exec_update(ctx, image, version, ignore_pynitrokey_version)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/nk3/update.py", line 140, in update
    return updater.update(device, image, version, ignore_pynitrokey_version)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 215, in update
    self._perform_update(bootloader, container)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 364, in _perform_update
    raise self.ui.error("Failed to perform firmware update", e)
pynitrokey.cli.exceptions.CliException: Failed to perform firmware update
MBoot: Connection issue -> No Response from Device
17767     DEBUG       root listing all connected devices:
17826     DEBUG       root :: 'Nitrokey FIDO2' keys
17826     DEBUG       root :: 'Nitrokey Start' keys:
17862     DEBUG       root :: 'Nitrokey 3' keys
17865      INFO  libusbsio HID enumeration[32132416]: initialized
17865     DEBUG  libusbsio HID enumeration[32132416]: device #0: QEMU USB Tablet
17866     DEBUG  libusbsio HID enumeration[32132416]: device #1: MCU HID GENERIC DEVICE
17866      INFO  libusbsio HID enumeration[32132416]: finished, total 2 devices
17934      INFO spsdk.mboot.mcuboot Connect: MCU HID GENERIC DEVICE (0x20A0, 0x42DD)
17934     DEBUG spsdk.mboot.interfaces.usb Open Interface
17934      INFO libusbsio.hidapi.dev Opening HID device at path: 'b'/dev/hidraw2''
17993      INFO libusbsio.hidapi.dev HID device 30798576 is now open
17993      INFO spsdk.mboot.mcuboot CMD: GetProperty('UniqueDeviceIdent', index=0)
17993     DEBUG spsdk.mboot.mcuboot TX-PACKET: Tag=GetProperty, Flags=0x00, P[0]=0x00000012, P[1]=0x00000000
17994     DEBUG spsdk.mboot.interfaces.usb OUT[16]: 01, 00, 0C, 00, 07, 00, 00, 02, 12, 00, 00, 00, 00, 00, 00, 00
17994     DEBUG libusbsio.hidapi.dev HID device 30798576 writing[16]: 0x01000c00070000021200000000000000
17995     DEBUG libusbsio.hidapi.dev HID device 30798576 wrote 59 bytes
19997     DEBUG libusbsio.hidapi.dev HID device 30798576 read[0]: None
19997     ERROR spsdk.mboot.interfaces.usb Cannot read from HID device, error=0
19997     DEBUG spsdk.mboot.mcuboot RX-PACKET: No Response, Timeout Error !
19998     DEBUG spsdk.mboot.mcuboot RX-PACKET: Tag=0x07, Flags=0x00 [14, 27, 00, 00]
19998      INFO spsdk.mboot.mcuboot Closing: MCU HID GENERIC DEVICE (0x20A0, 0x42DD)
19998     DEBUG spsdk.mboot.interfaces.usb Close Interface
19999      INFO libusbsio.hidapi.dev HID device 30798576 closed
19999     DEBUG       root Unable to list devices. See log for the details.
19999     ERROR       root Unable to list devices
Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 213, in _send_data
    response = self._device.read()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/interfaces/usb.py", line 238, in read
    raise TimeoutError()
TimeoutError

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 362, in _perform_update
    device.update(image, callback=callback)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/bootloader/lpc55.py", line 106, in update
    success = self.device.receive_sb_file(
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 658, in receive_sb_file
    result = self._send_data(CommandTag.RECEIVE_SB_FILE, data_chunks, progress_callback)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/spsdk/mboot/mcuboot.py", line 217, in _send_data
    raise McuBootConnectionError("No Response from Device") from e
spsdk.mboot.exceptions.McuBootConnectionError: MBoot: Connection issue -> No Response from Device

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/__init__.py", line 129, in main
    nitropy()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/click/decorators.py", line 38, in new_func
    return f(get_current_context().obj, *args, **kwargs)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/nk3/__init__.py", line 447, in update
    exec_update(ctx, image, version, ignore_pynitrokey_version)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/nk3/update.py", line 140, in update
    return updater.update(device, image, version, ignore_pynitrokey_version)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 215, in update
    self._perform_update(bootloader, container)
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/updates.py", line 364, in _perform_update
    raise self.ui.error("Failed to perform firmware update", e)
pynitrokey.cli.exceptions.CliException: Failed to perform firmware update
MBoot: Connection issue -> No Response from Device

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/helpers.py", line 209, in local_critical
    nitropy.commands["list"].callback()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/__init__.py", line 113, in list
    _list()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/__init__.py", line 106, in _list
    nk3.commands["list"].callback()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/cli/nk3/__init__.py", line 140, in list
    uuid = device.uuid()
  File "/home/user/.local/pipx/venvs/pynitrokey/lib/python3.9/site-packages/pynitrokey/nk3/bootloader/lpc55.py", line 87, in uuid
    raise ValueError("Missing response for UUID property query")
ValueError: Missing response for UUID property query
20008     DEBUG       root print: --------------------------------------------------------------------------------
20011     DEBUG       root print: Critical error occurred, exiting now
20013     DEBUG       root print: Unexpected? Is this a bug? Would you like to get support/help?
20016     DEBUG       root print: - You can report issues at: https://support.nitrokey.com/
20019     DEBUG       root print: - Writing an e-mail to support@nitrokey.com is also possible
20022     DEBUG       root print: - Please attach the log: '/tmp/nitropy.log.og_oi2an' with any support/help request!
20024     DEBUG       root print: - Please check if you have udev rules installed: https://docs.nitrokey.com/nitrokey3/linux/firmware-update.html#troubleshooting

When device changes its mode, I normally have to re-attach it to the VM. And I guess this is what was not concerned in the update script, so instead of waiting for the device to re-appear it aborted the process in a critical state.

Thank you in advance!

It is important to note that while I was able to upgrade using a Virtualbox VM, it is not recommended. The documentation explicitly warns against disconnecting the device. during the process. That can easily happen with a VM.

It would be better to use a Linux LiveCD or the new Nitrokey-App v2.0.1 on Windows.

However, in my experience, the update process still was quite robust in a VM and after the firmware is being flashed, the Nitrokey should reappear as Nitrokey 3 Bootloader [0100] and you need to connect it again to the VM.

In previous releases, it worked for me even when becoming disconnected during the flash process. nitropy should detect that the device already is in bootloader mode and would continue.

Do you see Clay Logic in lsusb? Do you have the latest udev rules in place?

For the latest firmware release, there was an additional step where the existing data automatically gets converted.

$ nitropy nk3 reboot --bootloader

Command line tool to interact with Nitrokey devices 0.4.30
Please press the touch button to reboot the device into bootloader mode ...

$ lsusb

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 20a0:42e8 Clay Logic Nitrokey 3 Bootloader
Bus 001 Device 002: ID 80ee:0021 VirtualBox USB Tablet
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Well, there is a warning to not disconnect the device during flashing. This happens of course in a VM but an explicit warning against doing this imho would have been better.

And yes, I had the device re-appear as Nitrokey 3 Bootloader and then connected it again to the VM (had to be quick). Afterwards, the actual flashing process started before it disconnected again and became broken.

The device does not appear in lsusb at all. Neither it does appear in dmesg and no LEDs get lit up when inserting it.

Later on I updated three other Nitrokeys (not 3A) using physical hardware which worked fine (but only on x84-64 - on i386 I was unable to build the app as one of the rust components was not buildable).