Can't flash firmware after FUSED

Hi,

On Nano production module, I fused the key by command:

sudo ./odmfuse.sh -c PKC -i 0x21 -p -k "${CRE_FOLDER}/secureboot_sign_key/rsa_priv.pem"

Then I can flash the firmware with following command:

sudo MACHINE=orbit-nano BOARDID=3448 FAB="400" BOARDSKU="0002" BOARDREV="b00" ./tegra210-flash-helper.sh -B 1048576  flash.xml.in tegra210-orbit-nano-rev3-imx482.dtb orbit-nano.cfg 0xA4000 "" boot.img uwcam-image.ext4 -u ${CRE_FOLDER}/secureboot_sign_key/rsa_priv.pem

Everything works fine. I have done many boards with this command without problem.

Today I fused another Nano production module with extra options to turn off the JTAG and fixed the boot source to eMMC only, then the command is:

./odmfuse.sh -c PKC -i 0x21 -p --disable-jtag -r 0x08 -k "${CRE_FOLDER}/secureboot_sign_key/rsa_priv.pem"

The odmfuse.sh command returns success.
Then I come with the command to flash firmware above (exactly the same firmware file, same command). But the flashing hangs at following, only able to quit if CTRL+c or reboot the board or power off.

[   0.1240 ]
[   0.1240 ] Boot Rom communication
[   0.1248 ] tegrarcm --chip 0x21 0 --rcm rcm_1_signed.rcm
[   0.1254 ] BootRom is not running
[   0.1719 ]
[   0.1719 ] Sending BCTs
[   0.1728 ] tegrarcm --download bct orbit-nano.bct

Compare with the fused but working board, I think that the bootrom of NOT working board was never run after I burnt its FUSE.

On another compare, I run the fuse command again:
On working board:

sudo ./odmfuse.sh -c PKC -i 0x21 -p -k "${CRE_FOLDER}/secureboot_sign_key/rsa_priv.pem"       
*** Calculating HASH from keyfile /work/works/uwcam/code/credencitals/secureboot_sign_key/rsa_priv.pem ... done                    
PKC HASH:                                                        
*** Generating fuse configuration ... done.                                                                                        
*** Start fusing  ...                                                                                                              
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"                                       
Welcome to Tegra Flash                                                                                                             
version 1.0.0                                                                                                                      
Type ? or help for help and q or quit to exit                                                                                      
Use ! to execute system commands                                                                                                   
                                                                                                                                   
[   0.0017 ] Parsing fuse info as per xml file                                                                                     
[   0.0027 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin                                                            
[   0.0035 ]                                                                                                                       
[   0.0036 ] Generating RCM messages                                                                                               
[   0.0047 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0056 ] RCM 0 is saved as rcm_0.rcm
[   0.0060 ] RCM 1 is saved as rcm_1.rcm
[   0.0061 ] List of rcm files are saved in rcm_list.xml
[   0.0061 ] 
[   0.0061 ] Signing RCM messages
[   0.0069 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0075 ] Assuming zero filled SBK key
[   0.0116 ] 
[   0.0116 ] Copying signature to RCM mesages
[   0.0127 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0146 ] 
[   0.0146 ] Boot Rom communication
[   0.0157 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0174 ] BR_CID: 0x621010016446080218000000100682c0
[   0.0185 ] RCM version 0X13
[   0.0316 ] Boot Rom communication failed
[   0.0317 ] 
Error: Return value 3
Command tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
failed.

On not working board:

sudo ./odmfuse.sh -c PKC -i 0x21 -p -k "${CRE_FOLDER}/secureboot_sign_key/rsa_priv.pem"
*** Calculating HASH from keyfile /work/works/uwcam/code/credencitals/secureboot_sign_key/rsa_priv.pem ... done
PKC HASH: 
*** Generating fuse configuration ... done.
*** Start fusing  ... 
./tegraflash.py --chip 0x21 --applet nvtboot_recovery.bin --cmd "blowfuses odmfuse_pkc.xml;"
Welcome to Tegra Flash
version 1.0.0
Type ? or help for help and q or quit to exit
Use ! to execute system commands
 
[   0.0016 ] Parsing fuse info as per xml file
[   0.0026 ] tegraparser --fuse_info odmfuse_pkc.xml blow_fuse_data.bin
[   0.0034 ] 
[   0.0035 ] Generating RCM messages
[   0.0041 ] tegrarcm --listrcm rcm_list.xml --chip 0x21 0 --download rcm nvtboot_recovery.bin 0 0
[   0.0047 ] RCM 0 is saved as rcm_0.rcm
[   0.0050 ] RCM 1 is saved as rcm_1.rcm
[   0.0051 ] List of rcm files are saved in rcm_list.xml
[   0.0051 ] 
[   0.0051 ] Signing RCM messages
[   0.0061 ] tegrasign --key None --list rcm_list.xml --pubkeyhash pub_key.key
[   0.0071 ] Assuming zero filled SBK key
[   0.0112 ] 
[   0.0112 ] Copying signature to RCM mesages
[   0.0122 ] tegrarcm --chip 0x21 0 --updatesig rcm_list_signed.xml
[   0.0139 ] 
[   0.0139 ] Boot Rom communication
[   0.0148 ] tegrarcm --chip 0x21 0 --rcm rcm_list_signed.xml
[   0.0156 ] BootRom is not running
[   0.0581 ] 
[   0.0582 ] Blowing fuses
[   0.0606 ] tegrarcm --oem blowfuses blow_fuse_data.bin

#### CTRL + C here





[   0.0626 ] Applet is not running on device. Continue with Bootloader
[   4.7888 ] 
Error: Return value 8
Command tegrarcm --oem blowfuses blow_fuse_data.bin
failed.

Is that correct that I broke the board by adding “–disable-jtag” or “-r 0x08” or both? I don’t think these options cause the broken, but they are the only different I changed in Fusing command.
Is there any ways what I can flash firmware on above not working board?

Any idea of what happened are welcome. Thank you.

hello nvl1109,

you cannot turn off the JTAG due to the -p options (ODM production fuse) has enabled.
FYI,
when you begin production and burn the ODM production fuse, secure boot is enabled, JTAG debug is disabled, and all the fuses become inaccessible except Reserved_ODM, (i.e. -r options)
however, Reserved_ODM fuse are programmable until it disabled by the ODM_lock fuse.
thanks

Hello Jerry,

Does it mean my board now is unusable?
In case the -p and —disable-jtag are overlapped, then the burning process should work the same way with or without —disable-jtag?
Is the “-r 0x08” ignore boot selection relevant to the problem that board now can’t communicate with BootRom?

Thank you.

Hi again,
Looks like forum has error after I replied via email, I can’t edit my post or create another reply on web now.

Just want to know if my board is completely unusable now or is there a way to use it?

And if -p and --disable-jtag can’t work together as you said, then it should be mentioned in secure boot document page, or in the help/usage of the odmfuse.sh script?

Thank you for your reply.

hello nvl1109,

the fuse value only able to write once, once you’ve burn the bits to 1, you cannot revert it back to 0.
after the ODM production fuse has enabled, only Reserved_ODM is able to update.

hello nvl1109,

I’ve seen some issue after burning FUSE_RESERVED_SW [3].
may I know what’s the actual use-case, for example, which boot device you’re going to use?

Hi,

I’m going to use eMMC as boot source only. Then I set the reserved_sw[3] to 1 and reserved_sw[2:0] to 0.

However, am I understanding you correctly that the “–disable-jtag” together with “-p” causes the broken on my board?
Thanks.

hello nvl1109,

that’s correct,
however, it’s by default boot from eMMC, you may ignore this reserved_sw burning.

no, --disable-jtag should not even burned since you’ve already enable -p option.
this may related to reserved_sw; please contact the NVIDIA Customer Care team for RMA process.
thanks

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.