The wrong boot authentication identification

Hi,

This is yet another follow up post from Boot failure after nvmflash.sh.

I have been very comfortable for burning fuses and executing mfi to flash a pre-built image with our PKC.

But I found I can not extract an image of a particular partition (APP) with the flash.sh command anymore.

$ sudo BOARDID=3448 FAB=200 BOARDSKU=0002 ./flash.sh -r -k APP -G ../nano_r32.3.1_original.img -u '/l4tpool/l4timages/emi_pkc_nano.pem'  jetson-nano-emmc mmcblk0p1
[sudo] password for tsato: 
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: NS, 
###############################################################################
Error: either RSA key file and/or SBK key file are proviced for none SBK and PKC protected target board.

As you can see, the Boot Authentication is recognized as NS. But it is actually PKC as follows.

$ ssh nvidia@192.168.1.142
nvidia@192.168.1.142's password: 
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.9.140-tegra aarch64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.

4 packages can be updated.
4 updates are security updates.

nvidia@nvidia-desktop:~$ 
nvidia@nvidia-desktop:~$ sudo ls -l /sys/devices/7000f800.efuse/7000f800.efuse\:efuse-burn/
[sudo] password for nvidia: 
total 0
-rw-rw---- 1 root root 4096 Apr  3 14:41 aid
-rw-rw---- 1 root root 4096 Apr  3 14:41 arm_jtag_disable
-rw-rw---- 1 root root 4096 Apr  3 14:41 debug_authentication
-rw-rw---- 1 root root 4096 Apr  3 14:41 device_key
lrwxrwxrwx 1 root root    0 Apr  3 14:41 driver -> ../../../bus/platform/drivers/tegra-fuse-burn
-rw-r--r-- 1 root root 4096 Apr  3 14:41 driver_override
-r--r--r-- 1 root root 4096 Apr  3 14:41 modalias
-rw-rw---- 1 root root 4096 Apr  3 14:41 odm_lock
-rw-rw---- 1 root root 4096 Apr  3 14:41 odm_production_mode
lrwxrwxrwx 1 root root    0 Apr  3 14:41 of_node -> ../../../firmware/devicetree/base/efuse@7000f800/efuse-burn
-rw-rw---- 1 root root 4096 Apr  3 14:41 pkc_disable
drwxr-xr-x 2 root root    0 Apr  3 14:41 power
-rw-rw---- 1 root root 4096 Apr  3 14:41 public_key
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm0
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm1
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm2
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm3
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm4
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm5
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm6
-rw-rw---- 1 root root 4096 Apr  3 14:41 reserved_odm7
-rw-rw---- 1 root root 4096 Apr  3 14:41 sec_boot_dev_cfg
-rw-rw---- 1 root root 4096 Apr  3 14:41 sec_boot_dev_sel
-rw-rw---- 1 root root 4096 Apr  3 14:41 secure_boot_key
lrwxrwxrwx 1 root root    0 Apr  3 14:40 subsystem -> ../../../bus/platform
-rw-r--r-- 1 root root 4096 Apr  3 14:40 uevent
nvidia@nvidia-desktop:~$ sudo cat /sys/devices/7000f800.efuse/7000f800.efuse\:efuse-burn/*
0x90a2f6a8
0x00000000
0x00000000
0xffffffff
cat: '/sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/driver': Is a directory
(null)
of:Nefuse-burnT<NULL>Cnvidia,tegra210-efuse-burn0x00000000
0x00000001
cat: '/sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/of_node': Is a directory
0x00000001
cat: '/sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/power': Is a directory
0x0bbae9e060e5dc4f7d2535f95066e8a433fe7e94730b43eaf0c44cbbf752e378
0x00000000
0x00000001
0x4389d821
0x60f20ce1
0x8d61caff
0x45c81062
0x9fcba14b
0xabcd0014
0x00000000
0x00000000
0xffffffffffffffffffffffffffffffff
cat: '/sys/devices/7000f800.efuse/7000f800.efuse:efuse-burn/subsystem': Is a directory
DRIVER=tegra-fuse-burn
OF_NAME=efuse-burn
OF_FULLNAME=/efuse@7000f800/efuse-burn
OF_COMPATIBLE_0=nvidia,tegra210-efuse-burn
OF_COMPATIBLE_N=1
MODALIAS=of:Nefuse-burnT<NULL>Cnvidia,tegra210-efuse-burn
nvidia@nvidia-desktop:~$ sudo ./tegrafuse.sh 
arm_jtag_disable : 0x00000000
odm_lock : 0x00000000
odm_production_mode : 0x00000001
pkc_disable : 0x00000001
sec_boot_dev_cfg : 0x00000000
sec_boot_dev_sel : 0x00000000
nvidia@nvidia-desktop:~$ exit
logout
Connection to 192.168.1.142 closed.

It was the same condition before I had enabled the odm_production_mode.

The secureboot on this box is correctly enabled?

Is there any way to fix this situation to extract an image?
If not, I am going to create our own image on a non-PKC protected device.

Thanks!

I found this doesn’t work, either.

$ sudo ./flash.sh -r -k APP -G ../backups/nano_r32.3.1_dltools.img  jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: , 
###############################################################################
./tegraflash.py --chip 0x21 --applet "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin" --skipuid --cmd "dump eeprom boardinfo cvm.bin" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0057 ] Generating RCM messages
[   0.0074 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin 0 0
[   0.0092 ] RCM 0 is saved as rcm_0.rcm
[   0.0105 ] RCM 1 is saved as rcm_1.rcm
[   0.0105 ] List of rcm files are saved in rcm_list.xml
[   0.0105 ] 
[   0.0106 ] Signing RCM messages
[   0.0124 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0142 ] Assuming zero filled SBK key
[   0.0273 ] 
[   0.0274 ] Copying signature to RCM mesages
[   0.0294 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0324 ] 
[   0.0324 ] Boot Rom communication
[   0.0339 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
[   0.0358 ] RCM version 0X210001
[   0.4029 ] Boot Rom communication completed
[   1.4098 ] 
[   1.4100 ] dump EEPROM info
[   1.4123 ] tegrarcm --oem platformdetails eeprom /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.4146 ] Applet version 00.01.0000
[   1.7562 ] Saved platform info in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.8325 ] 
Board ID(3448) version(400) 
copying bctfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/BCT/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg)... done.
copying bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying initrd(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
	populating kernel to rootfs... done.
	populating initrd to rootfs... done.
	populating /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb to rootfs... done.
Making Boot image... done.
Existing sosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin) reused.
copying tegraboot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/nvtboot.bin)... done.
copying cpu_bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying bpffile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/sc7entry-firmware.bin)... done.
Existing badpagefile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/badpage.bin) reused.
copying wb0boot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/warmboot.bin)... done.
Existing tosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tos-mon-only.img) reused.
Existing eksfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/eks.img) reused.
copying dtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
Copying nv_boot_control.conf to rootfs
Skip generating system.img
Existing tbcfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_cpu.bin) reused.
copying tbcdtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
copying cfgfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cfg/flash_l4t_t210_emmc_p3448.xml) to flash.xml... done.
copying flasher(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
Existing flashapp(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash.py) reused.
*** Reading [APP] and storing to /l4tpool/l4timages/Nano/L4T32.3.1/backups/nano_r32.3.1_dltools.img ***
./tegraflash.py --bl cboot.bin --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb  --chip 0x21 --applet nvtboot_recovery.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg  --cfg  flash.xml   --odmdata 0x94000  --cmd "read APP /l4tpool/l4timages/Nano/L4T32.3.1/backups/nano_r32.3.1_dltools.img"  
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0126 ] Generating RCM messages
[   0.0143 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0160 ] RCM 0 is saved as rcm_0.rcm
[   0.0171 ] RCM 1 is saved as rcm_1.rcm
[   0.0174 ] List of rcm files are saved in rcm_list.xml
[   0.0174 ] 
[   0.0174 ] Signing RCM messages
[   0.0190 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0209 ] Assuming zero filled SBK key
[   0.0353 ] 
[   0.0353 ] Copying signature to RCM mesages
[   0.0376 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0405 ] 
[   0.0406 ] Boot Rom communication
[   0.0424 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0442 ] BootRom is not running
[   0.2522 ] 
[   0.2522 ] Parsing partition layout
[   0.2544 ] tegraparser --pt flash.xml.tmp
[   0.2575 ] 
[   0.2576 ] Creating list of images to be signed
[   0.2597 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --list images_list.xml
[   0.2700 ] 
[   0.2701 ] Generating signatures
[   0.2722 ] tegrasign --key None --list images_list.xml --pubkeyhash pub_key.key
[   0.2743 ] Assuming zero filled SBK key
[   0.3903 ] 
[   0.3904 ] Send BCT from Host
[   0.3904 ] Generating br-bct
[   0.3921 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --chip 0x21 0
[   0.3932 ] Copying Sdram info from 0 to 1 set
[   0.3950 ] Copying Sdram info from 1 to 2 set
[   0.3950 ] Copying Sdram info from 2 to 3 set
[   0.3950 ] 
[   0.3950 ] Updating boot device parameters
[   0.3966 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatedevparam flash.xml.bin
[   0.3976 ] Warning: No sdram params
[   0.3979 ] 
[   0.3979 ] Updating bl info
[   0.3994 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updateblinfo flash.xml.bin --updatesig images_list_signed.xml
[   0.4025 ] 
[   0.4026 ] Updating secondary storage information into bct
[   0.4039 ] tegraparser --pt flash.xml.bin --chip 0x21 0 --updatecustinfo P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   0.4059 ] 
[   0.4060 ] Updating Odmdata
[   0.4077 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatefields Odmdata =0x94000
[   0.4092 ] Warning: No sdram params
[   0.4094 ] 
[   0.4094 ] Get Signed section of bct
[   0.4112 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --listbct bct_list.xml
[   0.4134 ] 
[   0.4134 ] Signing BCT
[   0.4167 ] tegrasign --key None --list bct_list.xml --pubkeyhash pub_key.key
[   0.4181 ] Assuming zero filled SBK key
[   0.4190 ] 
[   0.4191 ] Updating BCT with signature
[   0.4209 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatesig bct_list_signed.xml
[   0.4230 ] 
[   0.4230 ] Sending BCTs
[   0.4248 ] tegrarcm --download bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   0.4263 ] Applet version 00.01.0000
[   0.7619 ] Sending bct
[   0.7621 ] [................................................] 100%
[   0.9384 ] 
[   0.9385 ] Retrieving storage infomation
[   0.9406 ] tegrarcm --oem platformdetails storage storage_info.bin
[   0.9426 ] Applet version 00.01.0000
[   1.2779 ] 00000004: Failed to get an accessor of secondary boot device
[   1.2785 ] 
[   1.2806 ] tegradevflash --oem platformdetails storage storage_info.bin
^CTraceback (most recent call last):
  File "./tegraflash.py", line 1280, in <module>
    tegraflash_run_commands()
  File "./tegraflash.py", line 1149, in tegraflash_run_commands
    interpreter.onecmd(command)
  File "/usr/lib/python2.7/cmd.py", line 221, in onecmd
    return func(arg)
  File "./tegraflash.py", line 357, in do_read
    tegraflash_read(exports, args[0], file_path)
  File "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash_internal.py", line 429, in tegraflash_read
    tegraflash_get_storage_info()
  File "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash_internal.py", line 2224, in tegraflash_get_storage_info
    run_command(command)
  File "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash_internal.py", line 195, in run_command
    log = print_process(process, enable_print)
  File "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash_internal.py", line 155, in print_process
    output = process.stdout.read(1)
KeyboardInterrupt
Failed to flash/read t210ref.

This is actually the same result when I tried to run this command against the box above with PKC (but recognized as NS).

Then, I found a patch provided in this post, About the making of the mirror of the Jetson-nano module - #21 by JerryChang, then am successfully gettting an image (very slowly…).

Hi,
Please check

If there is follow-up questions, please let us know.

Now that it became clear that pkc_disable is correct, 0x1, but flash.sh does not work so. I think that’s why I get an error Error: either RSA key file and/or SBK key file are proviced for none SBK and PKC protected target board. as shown in the first post. Can you confirm this?

For the second post without PKC, I am able to backup an image with the patch. As a workaround, I work on a non-PKC box to build images, and each of which is backed up and used to create a mfi file.

So, it is fine for now, not urgent.

Hi,
Your understanding is correct. Please look at code in flash.sh

	NS)
		if [ "${keyfile}" != "" ] || [ "${sbk_keyfile}" != "" ]; then
			echo -n "Error: either RSA key file and/or SBK key file ";
			echo "are proviced for none SBK and PKC protected target board.";
			exit 1;
		fi;
		;;

I see. Then, flash.sh won’t work correctly if PKC is enabled (pkc_disabled = 0x1) because the script misunderstands it is NS. I hope this would be fixed in the next release.

Hi,
flash.sh is correct since pkc_disable=0x1 is NS. For enabling secureboot, you need to have -c PKC -p -k …/emi_pkc.pem so that pkc_disable keep 0x0. If you have -c PKC -k …/emi_pkc.pem(no -p), pkc_disable is burned to 0x1 and no longer returns to PKC mode forever.

Oh, I see. So, any test attempt without -p burns 0x1 on pkc_disable. So I should have burned all the fuses in a single step! Now I got it clearer.

I have finally tried burning fuses with a single command with -p. But then, mfi won’t succeed as follows.

Burning fuses.

burning fuses by ['sudo', '/l4tpool/releases/r32.3.1/Linux_for_Tegra/odmfuse.sh', '-j', '-i', '0x21', '-c', 'PKC', '-k', '/l4tpool/l4timages/emi_pkc_nano.pem', '-o', '0xC0210001ad0c787ec6ca1b18284eed05bc01a91a9dd0133b6e40804b00000000', '-p']
[sudo] password for tsato: 
*** Calculating HASH from keyfile /l4tpool/l4timages/emi_pkc_nano.pem ... done
PKC HASH: 0x78e352f7bb4cc4f0ea430b73947efe33a4e86650f935257d4fdce560e0e9ba0b
*** Generating fuse configuration ... done.
done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0051 ] Parsing fuse info as per xml file
[   0.0200 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0228 ] 
[   0.0229 ] Generating RCM messages
[   0.0250 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0268 ] RCM 0 is saved as rcm_0.rcm
[   0.0283 ] RCM 1 is saved as rcm_1.rcm
[   0.0285 ] List of rcm files are saved in rcm_list.xml
[   0.0285 ] 
[   0.0285 ] Signing RCM messages
[   0.0306 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0325 ] Assuming zero filled SBK key
[   0.0468 ] 
[   0.0469 ] Copying signature to RCM mesages
[   0.0490 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0522 ] 
[   0.0523 ] Boot Rom communication
[   0.0540 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0560 ] BR_CID: 0x321010016445c84600000000140504c0
[   0.2150 ] RCM version 0X210001
[   0.3907 ] Boot Rom communication completed
[   1.3983 ] 
[   1.3984 ] Blowing fuses
[   1.4004 ] tegrarcm --oem blowfuses blow_fuse_data.bin
[   1.4025 ] Applet version 00.01.0000
[   1.7401 ] Successfully burnt fuses as per fuse info blob
[   1.7582 ] 
*** The fuse configuration is saved in bootloader/odmfuse_pkc.xml
*** The ODM fuse has been secured with PKC keys.
*** Flash "signed BCT and bootloader(s)".
*** done.

Executing mass flash.

     3: [LNX-1] boot.img.encrypt (size=483328/67092480)
KFS1: 1048576 @ 29522082 SUM ee80c940 over 7905280 bytes
*** Updating BFS information on BCT succeeded.

*** Boot Rom communication
/l4tpool/releases/r32.3.1/Linux_for_Tegra/bootloader/mfi_jetson-nano-emmc/tegrarcm --instance 3-9 --chip 0x21 0 --rcm rcm_list_signed.xml
BR_CID: 0x621010016445c84600000000140504c0
RCM version 0X13
Boot Rom communication failed
*** Error: Boot Rom communication failed.

What’s wrong with this?

For your information, mfi was created as follows.

executing ['sudo', '/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/nvmassflashgen_reuse.sh', 'BOARDID=3448', 'FAB=200', 'BOARDSKU=0002', '-i', '0x21', '-c', 'PKC', '-u', '/l4tpool/l4timages/emi_pkc_nano.pem', 'jetson-nano-emmc', 'mmcblk0p1']
================================================================================
|| Generate Massflash Image in the master host:                               ||
|| Requires the Jetson connected in RCM mode.                                 ||
================================================================================
1 Jetson devices in RCM mode. USB: 3-9
+-------------------------------------------------------------------------------
| Step 1: Generate Command File
+-------------------------------------------------------------------------------
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
./tegraflash.py --chip 0x21 --applet "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin" --skipuid --cmd "dump eeprom boardinfo cvm.bin" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0313 ] Generating RCM messages
[   0.0333 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin 0 0
[   0.0353 ] RCM 0 is saved as rcm_0.rcm
[   0.0509 ] RCM 1 is saved as rcm_1.rcm
[   0.0509 ] List of rcm files are saved in rcm_list.xml
[   0.0509 ] 
[   0.0509 ] Signing RCM messages
[   0.0530 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0549 ] Assuming zero filled SBK key
[   0.0692 ] 
[   0.0692 ] Copying signature to RCM mesages
[   0.0714 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0745 ] 
[   0.0745 ] Boot Rom communication
[   0.0765 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
[   0.0786 ] RCM version 0X210001
[   0.4465 ] Boot Rom communication completed
[   1.4541 ] 
[   1.4542 ] dump EEPROM info
[   1.4563 ] tegrarcm --oem platformdetails eeprom /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.4584 ] Applet version 00.01.0000
[   1.7958 ] Saved platform info in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.8722 ] 
Board ID(3448) version(400) 
copying bctfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/BCT/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg)... done.
copying bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying initrd(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
	populating kernel to rootfs... done.
	populating initrd to rootfs... done.
	populating /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb to rootfs... done.
Making Boot image... done.
Existing sosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin) reused.
copying tegraboot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/nvtboot.bin)... done.
copying cpu_bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying bpffile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/sc7entry-firmware.bin)... done.
Existing badpagefile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/badpage.bin) reused.
copying wb0boot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/warmboot.bin)... done.
Existing tosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tos-mon-only.img) reused.
Existing eksfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/eks.img) reused.
copying dtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
Copying nv_boot_control.conf to rootfs
Reusing existing system.img... 
done.
Existing tbcfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_cpu.bin) reused.
copying tbcdtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
copying cfgfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cfg/flash_l4t_t210_emmc_p3448.xml) to flash.xml... done.
copying flasher(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
Existing flashapp(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash.py) reused.
./tegraflash.py --bl cboot.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --odmdata 0x94000 --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb --applet nvtboot_recovery.bin --cmd "flash; reboot"  --cfg flash.xml --chip 0x21    --bins "EBT cboot.bin; DTB tegra210-p3448-0002-p3449-0000-b00.dtb" 
saving flash command in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flashcmd.txt
saving Windows flash command to /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flash_win.bat
*** no-flash flag enabled. Exiting now... *** 
+-------------------------------------------------------------------------------
| Step 2: Sign Binaries
+-------------------------------------------------------------------------------
./tegraflash.py --bl cboot.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --odmdata 0x94000 --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb --applet nvtboot_recovery.bin --cmd " sign"  --cfg flash.xml --chip 0x21    --bins "EBT cboot.bin; DTB tegra210-p3448-0002-p3449-0000-b00.dtb"  --keep --skipuid
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0124 ] tegrasign --key None --getmode mode.txt
[   0.0136 ] Assuming zero filled SBK key
[   0.0137 ] 
[   0.0920 ] Generating RCM messages
[   0.0941 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0961 ] RCM 0 is saved as rcm_0.rcm
[   0.0973 ] RCM 1 is saved as rcm_1.rcm
[   0.0976 ] List of rcm files are saved in rcm_list.xml
[   0.0976 ] 
[   0.0976 ] Signing RCM messages
[   0.0996 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.1016 ] Assuming zero filled SBK key
[   0.1160 ] 
[   0.1160 ] Copying signature to RCM mesages
[   0.1182 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.1213 ] 
[   0.1213 ] Parsing partition layout
[   0.1234 ] tegraparser --pt flash.xml.tmp
[   0.1256 ] 
[   0.1256 ] Creating list of images to be signed
[   0.1276 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --list images_list.xml
[   0.1373 ] 
[   0.1373 ] Generating signatures
[   0.1393 ] tegrasign --key None --list images_list.xml --pubkeyhash pub_key.key
[   0.1411 ] Assuming zero filled SBK key
[   0.2626 ] 
[   0.2626 ] Generating br-bct
[   0.2646 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --chip 0x21 0
[   0.2664 ] Copying Sdram info from 0 to 1 set
[   0.2691 ] Copying Sdram info from 1 to 2 set
[   0.2691 ] Copying Sdram info from 2 to 3 set
[   0.2691 ] 
[   0.2692 ] Updating boot device parameters
[   0.2710 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatedevparam flash.xml.bin
[   0.2724 ] Warning: No sdram params
[   0.2726 ] 
[   0.2727 ] Updating bl info
[   0.2745 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updateblinfo flash.xml.bin --updatesig images_list_signed.xml
[   0.2778 ] 
[   0.2779 ] Updating secondary storage information into bct
[   0.2796 ] tegraparser --pt flash.xml.bin --chip 0x21 0 --updatecustinfo P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   0.2813 ] 
[   0.2813 ] Updating Odmdata
[   0.2831 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatefields Odmdata =0x94000
[   0.2848 ] Warning: No sdram params
[   0.2852 ] 
[   0.2852 ] Get Signed section of bct
[   0.2869 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --listbct bct_list.xml
[   0.2888 ] 
[   0.2888 ] Signing BCT
[   0.2923 ] tegrasign --key None --list bct_list.xml --pubkeyhash pub_key.key
[   0.2941 ] Assuming zero filled SBK key
[   0.2955 ] 
[   0.2955 ] Updating BCT with signature
[   0.2972 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatesig bct_list_signed.xml
[   0.2994 ] 
[   0.2995 ] Copying signatures
[   0.3013 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --updatesig images_list_signed.xml
[   0.3095 ] 
[   0.3095 ] Updating BFS information on BCT
[   0.3114 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.3132 ]    BFS:
[   0.3163 ]      0: [PT ] flash.xml.bin (size=4337/131072)
[   0.3168 ]      1: [TBC] nvtboot_cpu.bin.encrypt (size=65760/196608)
[   0.3173 ]      2: [RP1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   0.3181 ]      3: [EBT] cboot.bin.encrypt (size=484304/655360)
[   0.3186 ]      4: [WB0] warmboot.bin.encrypt (size=3952/131072)
[   0.3191 ]      5: [BPF] sc7entry-firmware.bin.encrypt (size=3376/262144)
[   0.3197 ] BFS0: 131072 @ 2560 SUM 99c0eaee over 2883584 bytes
[   0.3202 ]    BFS:
[   0.3205 ]      0: [PT-1] flash.xml.bin (size=4337/131072)
[   0.3208 ]      1: [TBC-1] nvtboot_cpu.bin.encrypt (size=65760/196608)
[   0.3211 ]      2: [RP1-1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   0.3216 ]      3: [EBT-1] cboot.bin.encrypt (size=484304/655360)
[   0.3220 ]      4: [WB0-1] warmboot.bin.encrypt (size=3952/131072)
[   0.3223 ]      5: [BPF-1] sc7entry-firmware.bin.encrypt (size=3376/262144)
[   0.3227 ] BFS1: 131072 @ 8704 SUM 99c0eaee over 2883584 bytes
[   0.3230 ]    KFS:
[   0.3648 ]      0: [DTB] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   0.3655 ]      1: [TOS] tos-mon-only.img.encrypt (size=54208/6291456)
[   0.3661 ]      2: [EKS] eks.img (size=1028/81920)
[   0.3665 ]      3: [LNX] boot.img.encrypt (size=483328/67092480)
[   0.3670 ] KFS0: 1048576 @ 29376546 SUM ee80c940 over 7905280 bytes
[   0.3715 ]    KFS:
[   0.4097 ]      0: [DTB-1] tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt (size=215840/1048576)
[   0.4105 ]      1: [TOS-1] tos-mon-only.img.encrypt (size=54208/6291456)
[   0.4111 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.4115 ]      3: [LNX-1] boot.img.encrypt (size=483328/67092480)
[   0.4120 ] KFS1: 1048576 @ 29522082 SUM ee80c940 over 7905280 bytes
[   0.4159 ] 
[   0.4160 ] Copying signed file in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/signed
Keep temporary directory /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/2314
+-------------------------------------------------------------------------------
| Step 3: Generate Mass-flash scripts
+-------------------------------------------------------------------------------
+-------------------------------------------------------------------------------
| Step 4: Generate Mass-flash image tarball
+-------------------------------------------------------------------------------
copying nvmflash.sh ... succeeded.
copying nvaflash.sh ... succeeded.
copying emmc_bootblob_ver.txt ... succeeded.
mfi_jetson-nano-emmc/
mfi_jetson-nano-emmc/tegrabct
mfi_jetson-nano-emmc/boot.img
mfi_jetson-nano-emmc/images_list.xml
mfi_jetson-nano-emmc/flash.xml
mfi_jetson-nano-emmc/system.img
mfi_jetson-nano-emmc/bct_list.xml
mfi_jetson-nano-emmc/tegraflash_internal.py
mfi_jetson-nano-emmc/badpage.bin
mfi_jetson-nano-emmc/LICENSE
mfi_jetson-nano-emmc/nvtboot.bin
mfi_jetson-nano-emmc/tegraflash.py
mfi_jetson-nano-emmc/nvtboot_cpu.bin.encrypt
mfi_jetson-nano-emmc/extlinux.conf
mfi_jetson-nano-emmc/nvtboot_recovery_cpu.bin
mfi_jetson-nano-emmc/rcm_list_signed.xml
mfi_jetson-nano-emmc/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct.encrypt
mfi_jetson-nano-emmc/tegra210-p3448-0002-p3449-0000-b00.dtb.encrypt
mfi_jetson-nano-emmc/sc7entry-firmware.bin
mfi_jetson-nano-emmc/images_list_signed.xml
mfi_jetson-nano-emmc/LICENSE.u-boot
mfi_jetson-nano-emmc/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
mfi_jetson-nano-emmc/cboot.bin
mfi_jetson-nano-emmc/bmp.blob
mfi_jetson-nano-emmc/rcm_1_encrypt.rcm
mfi_jetson-nano-emmc/l4t_initrd.img
mfi_jetson-nano-emmc/tegraparser
mfi_jetson-nano-emmc/nvidia-l4t-bootloader_32.3.1-20191209225816_arm64.deb
mfi_jetson-nano-emmc/boot.img.encrypt
mfi_jetson-nano-emmc/LICENSE.mkbootimg
mfi_jetson-nano-emmc/nvtboot.bin.encrypt
mfi_jetson-nano-emmc/mksparse
mfi_jetson-nano-emmc/warmboot.bin.encrypt
mfi_jetson-nano-emmc/LICENSE.mkbctpart
mfi_jetson-nano-emmc/chkbdinfo
mfi_jetson-nano-emmc/tos-mon-only.img
mfi_jetson-nano-emmc/LICENSE.chkbdinfo
mfi_jetson-nano-emmc/mkbctpart
mfi_jetson-nano-emmc/cboot.bin.encrypt
mfi_jetson-nano-emmc/tegrahost
mfi_jetson-nano-emmc/initrd
mfi_jetson-nano-emmc/mkbootimg
mfi_jetson-nano-emmc/eks.img
mfi_jetson-nano-emmc/rp4.blob
mfi_jetson-nano-emmc/tegradevflash
mfi_jetson-nano-emmc/rcm_0_encrypt.rcm
mfi_jetson-nano-emmc/mfi.log
mfi_jetson-nano-emmc/warmboot.bin
mfi_jetson-nano-emmc/rcm_0.rcm
mfi_jetson-nano-emmc/tos-mon-only.img.encrypt
mfi_jetson-nano-emmc/NVIDIA_Trademark_License_Addendum_SW.pdf
mfi_jetson-nano-emmc/cvm.bin
mfi_jetson-nano-emmc/nvaflash.sh
mfi_jetson-nano-emmc/nvmflash.sh
mfi_jetson-nano-emmc/sc7entry-firmware.bin.encrypt
mfi_jetson-nano-emmc/tegraflash_internal.pyc
mfi_jetson-nano-emmc/bct_list_signed.xml
mfi_jetson-nano-emmc/mkgpt
mfi_jetson-nano-emmc/rcm_1.rcm
mfi_jetson-nano-emmc/flash_win.bat
mfi_jetson-nano-emmc/tos.img
mfi_jetson-nano-emmc/LICENSE.tos-mon-only.img.arm-trusted-firmware
mfi_jetson-nano-emmc/flash.xml.bin
mfi_jetson-nano-emmc/emmc_bootblob_ver.txt
mfi_jetson-nano-emmc/nvtboot_recovery.bin
mfi_jetson-nano-emmc/nv_boot_control.conf
mfi_jetson-nano-emmc/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg
mfi_jetson-nano-emmc/rcm_list.xml
mfi_jetson-nano-emmc/tegrasign
mfi_jetson-nano-emmc/tegra210-p3448-0002-p3449-0000-b00.dtb
mfi_jetson-nano-emmc/tegrarcm
mfi_jetson-nano-emmc/nvtboot_cpu.bin
mfi_jetson-nano-emmc/BUP_generator.py
mfi_jetson-nano-emmc/LICENSE.mkgpt
mfi_jetson-nano-emmc/LICENSE.mksparse
********************************************************************************
*** Mass Flashing tarball mfi_jetson-nano-emmc.tbz2 is ready.
********************************************************************************
    1. Download mfi_jetson-nano-emmc.tbz2 to each flashing hosts.
    2. Untar mfi_jetson-nano-emmc.tbz2. ( tar xvjf mfi_jetson-nano-emmc.tbz2 )
    3. cd mfi_jetson-nano-emmc
    4. Connect Jetson boards(jetson-nano-emmc only) and put them in RCM mode.
    5. ./nvmflash.sh

But, I have successfully flashed an image with the ordinary flash.sh command.

$ sudo ./flash.sh -r -u /l4tpool/l4timages/emi_pkc_nano.pem jetson-nano-emmc mmcblk0p1
###############################################################################
# L4T BSP Information:
# R32 , REVISION: 3.1
###############################################################################
# Target Board Information:
# Name: jetson-nano-emmc, Board Family: t210ref, SoC: Tegra 210, 
# OpMode: production, Boot Authentication: PKC, 
###############################################################################
./tegraflash.py --chip 0x21 --applet "/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin" --skipuid --cmd "dump eeprom boardinfo cvm.bin" --key "/l4tpool/l4timages/emi_pkc_nano.pem" 
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0052 ] Generating RCM messages
[   0.0069 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin 0 0
[   0.0088 ] RCM 0 is saved as rcm_0.rcm
[   0.0291 ] RCM 1 is saved as rcm_1.rcm
[   0.0291 ] List of rcm files are saved in rcm_list.xml
[   0.0291 ] 
[   0.0291 ] Signing RCM messages
[   0.0311 ] tegrasign --key /l4tpool/l4timages/emi_pkc_nano.pem --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0331 ] PKC key in Open SSL format
[   0.0413 ] Key size is 256 bytes
[   0.0416 ] Saving public key  in pub_key.key
[   0.2501 ] Saving public key Hash as binary: pub_key.hash
[   0.2501 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   0.2501 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   0.2501 ] 
[   0.2501 ] Copying signature to RCM mesages
[   0.2522 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml --pubkeyhash pub_key.key
[   0.2551 ] 
[   0.2552 ] Boot Rom communication
[   0.2571 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml --skipuid
[   0.2590 ] RCM version 0X210001
[   0.6220 ] Boot Rom communication completed
[   1.6337 ] 
[   1.6339 ] dump EEPROM info
[   1.6362 ] tegrarcm --oem platformdetails eeprom /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   1.6381 ] Applet version 00.01.0000
[   1.9786 ] Saved platform info in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/cvm.bin
[   2.0551 ] 
Board ID(3448) version(400) 
copying bctfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/BCT/P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg)... done.
copying bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying initrd(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/l4t_initrd.img)... done.
	populating kernel to rootfs... done.
	populating initrd to rootfs... done.
	populating /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb to rootfs... done.
Making Boot image... done.
Existing sosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_recovery.bin) reused.
copying tegraboot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/nvtboot.bin)... done.
copying cpu_bootloader(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
copying bpffile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/sc7entry-firmware.bin)... done.
Existing badpagefile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/badpage.bin) reused.
copying wb0boot(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/warmboot.bin)... done.
Existing tosfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tos-mon-only.img) reused.
Existing eksfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/eks.img) reused.
copying dtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
Copying nv_boot_control.conf to rootfs
Reusing existing system.img... 
done.
Existing tbcfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/nvtboot_cpu.bin) reused.
copying tbcdtbfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/kernel/dtb/tegra210-p3448-0002-p3449-0000-b00.dtb)... done.
copying cfgfile(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cfg/flash_l4t_t210_emmc_p3448.xml) to flash.xml... done.
copying flasher(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/t210ref/cboot.bin)... done.
Existing flashapp(/l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/tegraflash.py) reused.
./tegraflash.py --cfg flash.xml --bl cboot.bin --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --odmdata 0x94000 --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb.signed --applet nvtboot_recovery.bin    --cmd "sign"  --chip 0x21 --key /l4tpool/l4timages/emi_pkc_nano.pem  
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0099 ] tegrasign --key /l4tpool/l4timages/emi_pkc_nano.pem --getmode mode.txt
[   0.0114 ] PKC key in Open SSL format
[   0.0118 ] Key size is 256 bytes
[   0.0161 ] 
[   0.0320 ] Generating RCM messages
[   0.0342 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0361 ] RCM 0 is saved as rcm_0.rcm
[   0.0374 ] RCM 1 is saved as rcm_1.rcm
[   0.0374 ] List of rcm files are saved in rcm_list.xml
[   0.0374 ] 
[   0.0375 ] Signing RCM messages
[   0.0394 ] tegrasign --key /l4tpool/l4timages/emi_pkc_nano.pem --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0414 ] PKC key in Open SSL format
[   0.0419 ] Key size is 256 bytes
[   0.0422 ] Saving public key  in pub_key.key
[   0.2594 ] Saving public key Hash as binary: pub_key.hash
[   0.2594 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   0.2594 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   0.2594 ] 
[   0.2595 ] Copying signature to RCM mesages
[   0.2617 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml --pubkeyhash pub_key.key
[   0.2634 ] 
[   0.2635 ] Parsing partition layout
[   0.2654 ] tegraparser --pt flash.xml.tmp
[   0.2683 ] 
[   0.2683 ] Creating list of images to be signed
[   0.2696 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --list images_list.xml
[   0.2759 ] 
[   0.2759 ] Generating signatures
[   0.2784 ] tegrasign --key /l4tpool/l4timages/emi_pkc_nano.pem --list images_list.xml --pubkeyhash pub_key.key
[   0.2803 ] PKC key in Open SSL format
[   0.2808 ] Key size is 256 bytes
[   0.2812 ] Saving public key  in pub_key.key
[   1.6106 ] Saving public key Hash as binary: pub_key.hash
[   1.6106 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   1.6106 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   1.6106 ] 
[   1.6107 ] Generating br-bct
[   1.6129 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.cfg --chip 0x21 0
[   1.6148 ] Copying Sdram info from 0 to 1 set
[   1.6174 ] Copying Sdram info from 1 to 2 set
[   1.6174 ] Copying Sdram info from 2 to 3 set
[   1.6174 ] 
[   1.6175 ] Updating boot device parameters
[   1.6194 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatedevparam flash.xml.bin
[   1.6213 ] Warning: No sdram params
[   1.6217 ] 
[   1.6217 ] Updating bl info
[   1.6235 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updateblinfo flash.xml.bin --updatesig images_list_signed.xml
[   1.6267 ] 
[   1.6268 ] Updating secondary storage information into bct
[   1.6285 ] tegraparser --pt flash.xml.bin --chip 0x21 0 --updatecustinfo P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   1.6306 ] 
[   1.6306 ] Updating Odmdata
[   1.6324 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatefields Odmdata =0x94000
[   1.6340 ] Warning: No sdram params
[   1.6343 ] 
[   1.6344 ] Get Signed section of bct
[   1.6361 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --listbct bct_list.xml
[   1.6381 ] 
[   1.6382 ] Signing BCT
[   1.6416 ] tegrasign --key /l4tpool/l4timages/emi_pkc_nano.pem --list bct_list.xml --pubkeyhash pub_key.key
[   1.6434 ] PKC key in Open SSL format
[   1.6439 ] Key size is 256 bytes
[   1.6442 ] Saving public key  in pub_key.key
[   1.7552 ] Saving public key Hash as binary: pub_key.hash
[   1.7552 ] Saving public key Hash as big-endian text: pub_key.hash_txt
[   1.7552 ] Saving public key Hash as little-endian(sysfs) text: pub_key.hash_sysfs_txt
[   1.7553 ] 
[   1.7553 ] Updating BCT with signature
[   1.7573 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatesig bct_list_signed.xml --pubkeyhash pub_key.key
[   1.7596 ] 
[   1.7597 ] Copying signatures
[   1.7616 ] tegrahost --chip 0x21 0 --partitionlayout flash.xml.bin --updatesig images_list_signed.xml --pubkeyhash pub_key.key
[   1.7719 ] 
[   1.7720 ] Updating BFS information on BCT
[   1.7739 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin --pubkeyhash pub_key.key
[   1.7758 ]    BFS:
[   1.7791 ]      0: [PT ] flash.xml.bin (size=4319/131072)
[   1.7799 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   1.7810 ]      2: [RP1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   1.7824 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   1.7833 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   1.7841 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   1.7850 ] BFS0: 131072 @ 2560 SUM 24d4977e over 2883584 bytes
[   1.7857 ]    BFS:
[   1.7858 ]      0: [PT-1] flash.xml.bin (size=4319/131072)
[   1.7865 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   1.7876 ]      2: [RP1-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   1.7888 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   1.7895 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   1.7902 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   1.7909 ] BFS1: 131072 @ 8704 SUM 24d4977e over 2883584 bytes
[   1.7914 ]    KFS:
[   1.8279 ]      0: [DTB] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   1.8291 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   1.8298 ]      2: [EKS] eks.img (size=1028/81920)
[   1.8302 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   1.8308 ] KFS0: 1048576 @ 29376546 SUM 8582e3fa over 7905280 bytes
[   1.8342 ]    KFS:
[   1.8722 ]      0: [DTB-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   1.8733 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   1.8740 ]      2: [EKS-1] eks.img (size=1028/81920)
[   1.8745 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   1.8752 ] KFS1: 1048576 @ 29522082 SUM 8582e3fa over 7905280 bytes
[   1.8780 ] 
[   1.8780 ] Copying signed file in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/signed
./tegraflash.py --bl cboot.bin.signed --bct  P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --odmdata 0x94000 --bldtb tegra210-p3448-0002-p3449-0000-b00.dtb.signed --applet rcm_1_signed.rcm --cmd "secureflash;reboot"  --cfg flash.xml --chip 0x21    --bins "EBT cboot.bin; DTB tegra210-p3448-0002-p3449-0000-b00.dtb"  --key "/l4tpool/l4timages/emi_pkc_nano.pem" 
saving flash command in /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flashcmd.txt
saving Windows flash command to /l4tpool/l4timages/Nano/L4T32.3.1/Linux_for_Tegra/bootloader/flash_win.bat
*** Flashing target device started. ***
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0112 ] Parsing partition layout
[   0.0128 ] tegraparser --pt flash.xml.tmp
[   0.0155 ] 
[   0.0156 ] Updating BFS information on RCM BCT
[   0.0173 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.0190 ]    BFS:
[   0.0221 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.0225 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0229 ]      2: [RP1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.0235 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.0239 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.0243 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0248 ] BFS0: 131072 @ 2560 SUM 1a760fd1 over 2883584 bytes
[   0.0252 ]    BFS:
[   0.0275 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.0278 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.0283 ]      2: [RP1-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.0289 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.0294 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.0299 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.0304 ] BFS1: 131072 @ 8704 SUM 1a760fd1 over 2883584 bytes
[   0.0308 ]    KFS:
[   0.0709 ]      0: [DTB] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.0716 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.0721 ]      2: [EKS] eks.img (size=1028/81920)
[   0.0724 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.0729 ] KFS0: 1048576 @ 29376546 SUM 8582e3fa over 7905280 bytes
[   0.0771 ]    KFS:
[   0.1147 ]      0: [DTB-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.1156 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.1163 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.1168 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.1175 ] KFS1: 1048576 @ 29522082 SUM 8582e3fa over 7905280 bytes
[   0.1206 ] 
[   0.1206 ] Updating BFS information on BCT
[   0.1224 ] tegrabct --bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct --chip 0x21 0 --updatebfsinfo flash.xml.bin
[   0.1243 ]    BFS:
[   0.1275 ]      0: [PT ] flash.xml.bin (size=4366/131072)
[   0.1281 ]      1: [TBC] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1289 ]      2: [RP1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.1299 ]      3: [EBT] cboot.bin.signed (size=484304/655360)
[   0.1305 ]      4: [WB0] warmboot.bin.signed (size=3952/131072)
[   0.1311 ]      5: [BPF] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1318 ] BFS0: 131072 @ 2560 SUM 1a760fd1 over 2883584 bytes
[   0.1324 ]    BFS:
[   0.1328 ]      0: [PT-1] flash.xml.bin (size=4366/131072)
[   0.1333 ]      1: [TBC-1] nvtboot_cpu.bin.signed (size=65760/196608)
[   0.1340 ]      2: [RP1-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.1349 ]      3: [EBT-1] cboot.bin.signed (size=484304/655360)
[   0.1356 ]      4: [WB0-1] warmboot.bin.signed (size=3952/131072)
[   0.1362 ]      5: [BPF-1] sc7entry-firmware.bin.signed (size=3376/262144)
[   0.1369 ] BFS1: 131072 @ 8704 SUM 1a760fd1 over 2883584 bytes
[   0.1375 ]    KFS:
[   0.1741 ]      0: [DTB] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.1752 ]      1: [TOS] tos-mon-only.img.signed (size=54448/6291456)
[   0.1760 ]      2: [EKS] eks.img (size=1028/81920)
[   0.1765 ]      3: [LNX] boot.img.signed (size=483328/67092480)
[   0.1771 ] KFS0: 1048576 @ 29376546 SUM 8582e3fa over 7905280 bytes
[   0.1804 ]    KFS:
[   0.2178 ]      0: [DTB-1] tegra210-p3448-0002-p3449-0000-b00.dtb.signed (size=215840/1048576)
[   0.2189 ]      1: [TOS-1] tos-mon-only.img.signed (size=54448/6291456)
[   0.2196 ]      2: [EKS-1] eks.img (size=1028/81920)
[   0.2201 ]      3: [LNX-1] boot.img.signed (size=483328/67092480)
[   0.2208 ] KFS1: 1048576 @ 29522082 SUM 8582e3fa over 7905280 bytes
[   0.2237 ] 
[   0.2237 ] Boot Rom communication
[   0.2258 ] tegrarcm --chip 0x21 0 --rcm rcm_1_signed.rcm
[   0.2275 ] BootRom is not running
[   0.4290 ] 
[   0.4291 ] Sending BCTs
[   0.4311 ] tegrarcm --download bct P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   0.4331 ] Applet version 00.01.0000
[   0.7748 ] Sending bct
[   0.7750 ] [................................................] 100%
[   0.9521 ] 
[   0.9522 ] Sending bootloader and pre-requisite binaries
[   0.9543 ] tegrarcm --download ebt cboot.bin.signed 0 0 --download rp1 tegra210-p3448-0002-p3449-0000-b00.dtb.signed 0
[   0.9563 ] Applet version 00.01.0000
[   1.2908 ] Sending ebt
[   1.2914 ] [................................................] 100%
[   1.3952 ] Sending rp1
[   1.4293 ] [................................................] 100%
[   1.4933 ] 
[   1.4953 ] tegrarcm --boot recovery
[   1.4973 ] Applet version 00.01.0000
[   1.8356 ] 
[   1.8357 ] Retrieving storage infomation
[   1.8378 ] tegrarcm --oem platformdetails storage storage_info.bin
[   1.8397 ] Applet is not running on device. Continue with Bootloader
[   2.4055 ] 
[   2.4075 ] tegradevflash --oem platformdetails storage storage_info.bin
[   2.4095 ] Cboot version 00.01.0000
[   2.5707 ] Saved platform info in storage_info.bin
[   2.5720 ] 
[   2.5721 ] Flashing the device
[   2.5741 ] tegradevflash --pt flash.xml.bin --storageinfo storage_info.bin --create
[   2.5760 ] Cboot version 00.01.0000
[   2.7507 ] Writing partition GPT with gpt.bin
[   2.7513 ] [................................................] 100%
[   2.7556 ] Writing partition BCT with P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[   4.0445 ] [................................................] 100%
[   4.0481 ] Writing partition NVC with nvtboot.bin.signed
[   4.4408 ] [................................................] 100%
[   4.4502 ] Writing partition PT with flash.xml.bin
[   4.4743 ] [................................................] 100%
[   4.4787 ] Writing partition TBC with nvtboot_cpu.bin.signed
[   4.5011 ] [................................................] 100%
[   4.5199 ] Writing partition RP1 with tegra210-p3448-0002-p3449-0000-b00.dtb.signed
[   4.5682 ] [................................................] 100%
[   4.5913 ] Writing partition EBT with cboot.bin.signed
[   4.6407 ] [................................................] 100%
[   4.6736 ] Writing partition WB0 with warmboot.bin.signed
[   4.7263 ] [................................................] 100%
[   4.7432 ] Writing partition BPF with sc7entry-firmware.bin.signed
[   4.7911 ] [................................................] 100%
[   4.8077 ] Writing partition NVC-1 with nvtboot.bin.signed
[   4.8575 ] [................................................] 100%
[   4.8799 ] Writing partition PT-1 with flash.xml.bin
[   4.9413 ] [................................................] 100%
[   4.9584 ] Writing partition TBC-1 with nvtboot_cpu.bin.signed
[   5.0184 ] [................................................] 100%
[   5.0373 ] Writing partition RP1-1 with tegra210-p3448-0002-p3449-0000-b00.dtb.signed
[   5.0980 ] [................................................] 100%
[   5.1214 ] Writing partition EBT-1 with cboot.bin.signed
[   5.1832 ] [................................................] 100%
[   5.2158 ] Writing partition WB0-1 with warmboot.bin.signed
[   5.2928 ] [................................................] 100%
[   5.3092 ] Writing partition BPF-1 with sc7entry-firmware.bin.signed
[   5.3696 ] [................................................] 100%
[   5.3864 ] Writing partition VER_b with emmc_bootblob_ver.txt
[   5.4467 ] [................................................] 100%
[   5.4637 ] Writing partition VER with emmc_bootblob_ver.txt
[   5.5140 ] [................................................] 100%
[   5.5308 ] Writing partition APP with system.img
[   5.5807 ] [................................................] 100%
[ 465.6815 ] Writing partition DTB with tegra210-p3448-0002-p3449-0000-b00.dtb.signed
[ 466.7033 ] [................................................] 100%
[ 466.7377 ] Writing partition TOS with tos-mon-only.img.signed
[ 466.7758 ] [................................................] 100%
[ 466.7878 ] Warning: EKS partition magic header mismatch!
[ 466.8434 ] Writing partition EKS with eks.img
[ 466.8439 ] [................................................] 100%
[ 466.8538 ] Writing partition LNX with boot.img.signed
[ 466.8892 ] [................................................] 100%
[ 466.9153 ] Writing partition DTB-1 with tegra210-p3448-0002-p3449-0000-b00.dtb.signed
[ 466.9460 ] [................................................] 100%
[ 466.9623 ] Writing partition TOS-1 with tos-mon-only.img.signed
[ 467.0015 ] [................................................] 100%
[ 467.0136 ] Writing partition EKS-1 with eks.img
[ 467.0497 ] [................................................] 100%
[ 467.0604 ] Writing partition LNX-1 with boot.img.signed
[ 467.0960 ] [................................................] 100%
[ 467.1223 ] Writing partition BMP with bmp.blob
[ 467.1516 ] [................................................] 100%
[ 467.1947 ] Writing partition RP4 with rp4.blob
[ 467.2310 ] [................................................] 100%
[ 467.2947 ] 
[ 467.2978 ] tegradevflash --write BCT P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[ 467.2998 ] Cboot version 00.01.0000
[ 467.4588 ] Writing partition BCT with P3448_A00_4GB_Micron_4GB_lpddr4_204Mhz_P987.bct
[ 467.4599 ] [................................................] 100%
[ 467.8793 ] 
[ 467.8793 ] Flashing completed

[ 467.8794 ] Coldbooting the device
[ 467.8815 ] tegradevflash --reboot coldboot
[ 467.8835 ] Cboot version 00.01.0000
[ 468.0429 ] 
*** The target t210ref has been flashed successfully. ***
Reset the board to boot from internal eMMC.

Also confirmed this box boots up correctly with pkc_disable=1 and odm_production_mode=1.