Build the Massfuse Blob failed

hello zjfsharp,

it’s fuse commands generation filed. since --auth is included in r32.5, could you please have a try with below for confirmation?
for example,
$ sudo FAB=400 BOARDID=2888 BOARDSKU=0004 BOARDREV=L.0 FUSELEVEL=fuselevel_production ./ -i 0x19 -c SBKPKC -p -k xxx/rsa_pri.pem -S xxx/SBK --KEK2 xxx/KEK2 jetson-agx-xavier-devkit

Not work, Error is:

*** Error: --auth is missing
*** Error: generation failed

I used L4T R32.5.1 and secureboot_R32.5.0_aarch64.tbz2 that downloaded from

Can this problem be reproduced at your place?

hello zjfsharp,

could you please have a try to include below patch to, and test again,
it extracts xml file from fuseblob.

@@ -28,6 +28,7 @@ FUSECMD="";

@@ -983,11 +984,17 @@ odmfuse_args="$@";
 if [ "${CHIPID}" = "0x21" ] || [ "${CHIPID}" = "0x12" ]; then
        odmfuse_args=$(echo "${odmfuse_args}" | sed -e s/${ext_target_board}//);
+rm -f "${FUSEBLOB}"
 if [ $? -ne 0 ]; then
        echo "*** Error: ${FUSECMD} generation failed.";
        exit 1;
+if [ ! -f "${FUSEBLOB}" ]; then
+       echo "*** Error: fuseblob file generation failed.";
+       exit 1;
+tar xjf "${FUSEBLOB}" "${BLDIR}/odmfuse_pkc.xml" "${BLDIR}/${FUSECMD}"
 if [ ! -f "${BLDIR}/${FUSECMD}" ]; then
        echo "*** Error: command file generation failed.";
        exit 1;

Not work, error in step 2:

Error: Return value 4
Command tegrahost_v2 --chip 0x19 --align encrypted_signed_t19x/nvboot_recovery_t194.bin_signheader.encrypt.signed
Keep temporary directory /home/tmp/Linux_for_Tegra/bootloader/8968
Error: Signing binaries failed

hello zjfsharp,

could you please delete the temporary directory to have another trial.
please also check to execute with ONLINE approach, i.e. without BOARDID=2888 BOARDSKU=0004 FAB=400 BOARDREV=H.0

I have only one device and burned it, so I can’t check to execute which i will get error of Production mode is set, you can't burn any manufacturing fuses now.

So, How can I fix the problem to build mass fuse blob offline?

hello zjfsharp,

may I know what’s the secure mode enabled, is it PKC or PKC+SBK? is it possible to share the fuse commands for reference?

Thanks for your reply.




sudo BOARDID=2888 BOARDSKU=0004 FAB=400 BOARDREV=L.0 FUSELEVEL=fuselevel_production ./ -j -i 0x19 --auth SBKPKC -p -k 
 rsa_priv.pem  -S SBK --KEK0 KEK0 --KEK1 KEK1 --KEK2 KEK2 jetson-agx-xavier-devkit

I have enabled secureboot with PKC+SBK, so i got error of Production mode is set, you can’t burn any manufacturing fuses now when build fuse blob ONLINE, command:

sudo ../ -j -i 0x19 --auth SBKPKC -p -k 
 rsa_priv.pem  -S SBK --KEK0 KEK0 --KEK1 KEK1 --KEK2 KEK2 jetson-agx-xavier-devkit

hello zjfsharp,

it looks you’re confused with and,
please check the readme file, it’s massflashing tool generates massflash blob in trusted environment. so, you should at least exclude -p options in your command line.

I don’t really understand what you mean.

I want to generate massfush blob in trusted environment so that I can give massflash blob to my customers who can burn fuse without private key and SBK. I have read bootloader/README_Massfuse.txt that indicate how to generate massblob ONLINE or OFFLINE, but all need -p option. You can check it.

hello zjfsharp,

may I know which JetPack release version you’re using?
I’ve check README_Massflash.txt from JetPack-4.5.1 release, and the -p options doesn’t shown in the sample command-line.
for example,

   To generate jetson-agx-xavier-devkit (16GB) SBK encrypted + PKC signed massflash blob:
     sudo BOARDID=2888 BOARDSKU=0001 FAB=400 BOARDREV=H.0 \
     FUSELEVEL=fuselevel_production ./ -x 0x19 -y SBKPKC \
     -u <pkc_keyfile> -v <sbk_keyfile> jetson-agx-xavier-devkit mmcblk0p1

I download secureboot_R32.5.0_aarch64.tbz2 from

MD5 (secureboot_R32.5.0_aarch64.tbz2) = 3baf9536ae69506e65defc3ef87e145e

You can read Linux_for_Tegra/bootloader/README_Massfuse.txt.

But I don’t think the -p option is the cause of the error, can you share your relative package of secureboot_xxxx.tbz2

hello zjfsharp,

oh, I see that -p options is actually there from readme file of secureBoot package. what I’m referring to is the file installed by NVIDIA SDK Manager | NVIDIA Developer.

nevertheless, it’s not the -p options to cause the failure.
could you please execute to parse the fuse info of your Jetson AGX Xavier.


Currently I only have NX devices around, no agx devices. Let’s take the NX device as an example (both NX and agx devices have secureboot enabled), the error is reported as follows:

$ sudo ./ -i 0x19 -k rsa_priv.pem -S SBK  jetson-xavier-nx-devkit
Error: return value 3
Command tegrarcm_v2 --chip 0x19 0 --rcm rcm_list_signed.xml --skipuid
Reading board information failed

As I know that can’t read device fuse information which enabled secureboot with production mode. And I generate mass fuse blob **offline** without device on, so I thintk if I can get fuse information no help.


hello zjfsharp,

what’s the actual platform you’re using now?
don’t this topic filed for Jetson AGX Xavier, let’s keeping the discussion for the same platform, initial new topic if necessary.

BTW, is this Xavier NX with eMMC module? note, secureBoot only supported with production modules.

Sorry, Sorry

Currently, I have an NX device on hand, and the AGX device is not around, but there are problems experimenting with either device. so I take the NX device as an example now.

I just want to generate massfuse blob OFFLINE, So what I mean is that you can experiment even if you don’t have the devices.


here’s another thread I’ve just verified with the offline approach, by generating Massflash image on the host machine.
it’s able to generate Mass Flashing tarball for Jetson Xavier NX, i.e. mfi_jetson-xavier-nx-devkit-emmc.tbz2
please check this thread for details. Build the massflash blob tarball failed - #26 by JerryChang

This is for mass flash blob offline, But I need mass fuse blob offline. ):

As I said generate flash blob right for me above.

hello zjfsharp,

please have confirmation, are you working with supported Xavier NX?