Jetson Nano and u-boot external DTB

Hello,

I am working with a Jetson Nano Developer Kit and got the latest mainline u-boot to work. But, I want to attach a public key to u-boot using the EXT_DTB environment variable:

make EXT_DTB=u-boot_pubkey.dtb

When doing so, the produced binary does not load and the jetson goes into an infinite reset loop without any visible errors.

Is there a way to get more debug information from L4T Cboot ?
Has anyone got something similar working ?

Here is the boot log (This is exactly the same as a working u-boot except u-boot doesn’t show up of course).

Boot log

[0000.157] [L4T TegraBoot] (version 00.00.2018.01-l4t-c536fca9)
[0000.163] Processing in cold boot mode Bootloader 2
[0000.167] A02 Bootrom Patch rev = 1023
[0000.171] Power-up reason: software reset
[0000.175] No Battery Present
[0000.177] pmic max77620 reset reason
[0000.181] pmic max77620 NVERC : 0x0
[0000.184] RamCode = 0
[0000.186] Platform has DDR4 type RAM
[0000.190] max77620 disabling SD1 Remote Sense
[0000.194] Setting DDR voltage to 1125mv
[0000.198] Serial Number of Pmic Max77663: 0x2321f6
[0000.206] Entering ramdump check
[0000.209] Get RamDumpCarveOut = 0x0
[0000.212] RamDumpCarveOut=0x0, RamDumperFlag=0xe59ff3f8
[0000.217] Last reboot was clean, booting normally!
[0000.222] Sdram initialization is successful
[0000.226] SecureOs Carveout Base=0x00000000ff800000 Size=0x00800000
[0000.232] Lp0 Carveout Base=0x00000000ff780000 Size=0x00001000
[0000.238] BpmpFw Carveout Base=0x00000000ff700000 Size=0x00080000
[0000.243] GSC1 Carveout Base=0x00000000ff600000 Size=0x00100000
[0000.249] GSC2 Carveout Base=0x00000000ff500000 Size=0x00100000
[0000.255] GSC4 Carveout Base=0x00000000ff400000 Size=0x00100000
[0000.261] GSC5 Carveout Base=0x00000000ff300000 Size=0x00100000
[0000.267] GSC3 Carveout Base=0x000000017f300000 Size=0x00d00000
[0000.283] RamDump Carveout Base=0x00000000ff280000 Size=0x00080000
[0000.289] Platform-DebugCarveout: 0
[0000.292] Nck Carveout Base=0x00000000ff080000 Size=0x00200000
[0000.298] Non secure mode, and RB not enabled.
[0000.302] Read GPT from (4:0)
[0000.409] Csd NumOfBlocks=31176704
[0000.414] Set High speed to 1
[0000.423] Using GPT Primary to query partitions
[0000.427] Loading Tboot-CPU binary
[0000.437] Verifying TBC in OdmNonSecureSBK mode
[0000.447] Bootloader load address is 0xa0000000, entry address is 0xa0000258
[0000.454] Bootloader downloaded successfully.
[0000.458] Downloaded Tboot-CPU binary to 0xa0000258
[0000.463] MAX77620_GPIO5 configured
[0000.466] CPU power rail is up
[0000.469] CPU clock enabled
[0000.473] Performing RAM repair
[0000.476] Updating A64 Warmreset Address to 0xa00002e9
[0000.481] Loading NvTbootBootloaderDTB
[0000.505] Verifying NvTbootBootloaderDTB in OdmNonSecureSBK mode
[0000.578] Bootloader DTB Load Address: 0x83000000
[0000.583] Loading NvTbootKernelDTB
[0000.607] Verifying NvTbootKernelDTB in OdmNonSecureSBK mode
[0000.679] Kernel DTB Load Address: 0x83100000
[0000.684] Loading cboot binary
[0000.713] Verifying EBT in OdmNonSecureSBK mode
[0000.755] Bootloader load address is 0x92c00000, entry address is 0x92c00258
[0000.762] Bootloader downloaded successfully.
[0000.766] Read PT from (2:0)
[0000.782] Using BFS PT to query partitions
[0000.786] PT: Partition NCT NOT found !
[0000.789] Warning: Find Partition via PT Failed
[0000.794] Next binary entry address: 0x92c00258
[0000.798] BoardId: 3448
[0000.803] Overriding pmu board id with proc board id
[0000.807] Display board id is not available
[0000.836] Verifying SC7EntryFw in OdmNonSecureSBK mode
[0000.892] /bpmp deleted
[0000.894] SC7EntryFw header found loaded at 0xff700000
[0001.089] OVR2 PMIC
[0001.091] Bpmp FW successfully loaded
[0001.095] WB0 init successfully at 0xff780000
[0001.099] Set NvDecSticky Bits
[0001.103] GSC2 address ff53fffc value c0edbbcc
[0001.109] GSC MC Settings done
[0001.112] TOS Image length 53680
[0001.115] Monitor size 53680
[0001.118] OS size 0
[0001.125] Secure Os AES-CMAC Verification Success!
[0001.130] TOS image cipher info: plaintext
[0001.134] Loading and Validation of Secure OS Successful
[0001.149] SC7 Entry Firmware - 0xff700000, 0x4000
[0001.154] NvTbootPackSdramParams: start.
[0001.159] NvTbootPackSdramParams: done.
[0001.163] Tegraboot started after 85380 us
[0001.167] Basic modules init took 746423 us
[0001.171] Sec Bootdevice Read Time = 12 ms, Read Size = 65 KB
[0001.176] Sec Bootdevice Write Time = 0 ms, Write Size = 0 KB
[0001.182] Storage Device Read Time = 106 ms, Read Size = 2241 KB
[0001.188] Storage Device Write Time = 0 ms, Write Size = 0 KB
[0001.193] Next stage binary read took 24290 us
[0001.197] Carveout took -35972 us
[0001.201] CPU initialization took 371171 us
[0001.205] Total time taken by TegraBoot 1105912 us

[0001.209] Starting CPU & Halting co-processor

64NOTICE: BL31: v1.3(release):de895fd9e
NOTICE: BL31: Built : 12:23:48, Oct 16 2020
ERROR: Error initializing runtime service trusty_fast
[0001.332] RamCode = 0
[0001.336] LPDDR4 Training: Read DT: Number of tables = 2
[0001.341] EMC Training (SRC-freq: 204000; DST-freq: 1600000)
[0001.354] EMC Training Successful
[0001.357] 408000 not found in DVFS table
[0001.364] RamCode = 0
[0001.367] DT Write: emc-table@204000 succeeded
[0001.372] DT Write: emc-table@1600000 succeeded
[0001.377] LPDDR4 Training: Write DT: Number of tables = 2
[0001.419]
[0001.420] Debug Init done
[0001.422] Marked DTB cacheable
[0001.425] Bootloader DTB loaded at 0x83000000
[0001.430] Marked DTB cacheable
[0001.433] Kernel DTB loaded at 0x83100000
[0001.437] DeviceTree Init done
[0001.450] Pinmux applied successfully
[0001.454] gicd_base: 0x50041000
[0001.458] gicc_base: 0x50042000
[0001.461] Interrupts Init done
[0001.465] Using base:0x60005090 & irq:208 for tick-timer
[0001.470] Using base:0x60005098 for delay-timer
[0001.474] platform_init_timer: DONE
[0001.478] Timer(tick) Init done
[0001.482] osc freq = 38400 khz
[0001.485]
[0001.486] Welcome to L4T Cboot
[0001.489]
[0001.491] Cboot Version: 00.00.2018.01-t210-4686ce50
[0001.496] calling constructors
[0001.499] initializing heap
[0001.501] initializing threads
[0001.504] initializing timers
[0001.507] creating bootstrap completion thread
[0001.511] top of bootstrap2()
[0001.514] CPU: ARM Cortex A57
[0001.517] CPU: MIDR: 0x411FD071, MPIDR: 0x80000000
[0001.522] initializing platform
[0001.529] Manufacturer: MF = 0xc2, ID MSB = 0x25
[0001.534] ID LSB = 0x36, ID-CFI len = 194 bytes
[0001.538] Macronix QSPI chip present
[0001.542] SPI device register
[0001.545] init boot device
[0001.547] allocating memory for boot device(SPI)
[0001.552] registering boot device
[0001.561] sdmmc node status = okay
[0001.565] sdcard instance = 0
[0001.567] sdcard gpio handle 0x5b
[0001.571] sdcard gpio pin 0xc9
[0001.574] sdcard gpio flags 0x0
[0001.577] vmmc-supply 0x9e
[0001.579] Instance: 0
[0001.581] Allocating memory for context
[0001.585] enabling clock
[0001.588] sd card init
[0001.590] Check card present and stable
[0001.594] Send command 0
[0001.610] Send command 3
[0001.614] Set RCA for the card
[0001.617] Query card specific data by command 9
[0001.624] Parse CSD data
[0001.626] Send command 7
[0001.637] Calling sd device register
[0001.640] Init sdcard
[0001.642] Allocating memory for boot device
[0001.646] Registering user device
[0001.659] Enable APE clock
[0001.662] Un-powergate APE partition
[0001.665] of_register: registering tegra_udc to of_hal
[0001.671] of_register: registering inv20628-driver to of_hal
[0001.676] of_register: registering ads1015-driver to of_hal
[0001.682] of_register: registering lp8557-bl-driver to of_hal
[0001.688] of_register: registering bq2419x_charger to of_hal
[0001.693] of_register: registering bq27441_fuel_gauge to of_hal
[0001.705] gpio framework initialized
[0001.708] of_register: registering tca9539_gpio to of_hal
[0001.714] of_register: registering tca9539_gpio to of_hal
[0001.719] of_register: registering i2c_bus_driver to of_hal
[0001.724] of_register: registering i2c_bus_driver to of_hal
[0001.730] of_register: registering i2c_bus_driver to of_hal
[0001.736] pmic framework initialized
[0001.739] of_register: registering max77620_pmic to of_hal
[0001.745] regulator framework initialized
[0001.748] of_register: registering tps65132_bl_driver to of_hal
[0001.754] initializing target
[0001.760] gpio_driver_register: register ‘tegra_gpio_driver’ driver
[0001.768] board ID = D78, board SKU = 0
[0001.772] Skipping Z3!
[0001.777] fixed regulator driver initialized
[0001.795] initializing OF layer
[0001.798] NCK carveout not present
[0001.801] Skipping dts_overrides
[0001.805] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.822] I2C Bus Init done
[0001.825] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.835] I2C Bus Init done
[0001.838] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.848] I2C Bus Init done
[0001.851] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.861] I2C Bus Init done
[0001.864] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.874] I2C Bus Init done
[0001.877] of_children_init: Ops found for compatible string maxim,max77620
[0001.887] max77620_init using irq 118
[0001.892] register ‘maxim,max77620’ pmic
[0001.896] gpio_driver_register: register ‘max77620-gpio’ driver
[0001.902] of_children_init: Ops found for compatible string nvidia,tegra210-i2c
[0001.913] I2C Bus Init done
[0001.917] NCK carveout not present
[0001.926] Find /i2c@7000c000’s alias i2c0
[0001.930] get eeprom at 1-a0, size 256, type 0
[0001.939] Find /i2c@7000c500’s alias i2c2
[0001.943] get eeprom at 3-a0, size 256, type 0
[0001.947] get eeprom at 3-ae, size 256, type 0
[0001.952] pm_ids_update: Updating 1,a0, size 256, type 0
[0001.957] I2C slave not started
[0001.960] I2C write failed
[0001.963] Writing offset failed
[0001.966] eeprom_init: EEPROM read failed
[0001.970] pm_ids_update: eeprom init failed
[0001.974] pm_ids_update: Updating 3,a0, size 256, type 0
[0002.004] pm_ids_update: The pm board id is 3448-0000-400
[0002.011] Adding plugin-manager/ids/3448-0000-400=/i2c@7000c500:module@0x50
[0002.019] pm_ids_update: pm id update successful
[0002.024] pm_ids_update: Updating 3,ae, size 256, type 0
[0002.054] pm_ids_update: The pm board id is 3449-0000-400
[0002.060] Adding plugin-manager/ids/3449-0000-400=/i2c@7000c500:module@0x57
[0002.068] pm_ids_update: pm id update successful
[0002.098] eeprom_get_mac: EEPROM invalid MAC address (all 0xff)
[0002.104] shim_eeprom_update_mac:267: Failed to update 0 MAC address in DTB
[0002.112] eeprom_get_mac: EEPROM invalid MAC address (all 0xff)
[0002.118] shim_eeprom_update_mac:267: Failed to update 1 MAC address in DTB
[0002.126] updating /chosen/nvidia,ethernet-mac node 00:04:4b:e7:01:74
[0002.133] Plugin Manager: Parse ODM data 0x00094000
[0002.145] shim_cmdline_install: /chosen/bootargs: earlycon=uart8250,mmio32,0x7
[0002.160] Find /i2c@7000c000’s alias i2c0
[0002.164] get eeprom at 1-a0, size 256, type 0
[0002.173] Find /i2c@7000c500’s alias i2c2
[0002.176] get eeprom at 3-a0, size 256, type 0
[0002.181] get eeprom at 3-ae, size 256, type 0
[0002.185] pm_ids_update: Updating 1,a0, size 256, type 0
[0002.191] I2C slave not started
[0002.194] I2C write failed
[0002.196] Writing offset failed
[0002.199] eeprom_init: EEPROM read failed
[0002.203] pm_ids_update: eeprom init failed
[0002.207] pm_ids_update: Updating 3,a0, size 256, type 0
[0002.237] pm_ids_update: The pm board id is 3448-0000-400
[0002.244] Adding plugin-manager/ids/3448-0000-400=/i2c@7000c500:module@0x50
[0002.251] pm_ids_update: pm id update successful
[0002.255] pm_ids_update: Updating 3,ae, size 256, type 0
[0002.285] pm_ids_update: The pm board id is 3449-0000-400
[0002.291] Adding plugin-manager/ids/3449-0000-400=/i2c@7000c500:module@0x57
[0002.298] pm_ids_update: pm id update successful
[0002.329] Add serial number:1422919084057 as DT property
[0002.336] Applying platform configs
[0002.343] platform-init is not present. Skipping
[0002.348] calling apps_init()
[0002.373] Found 14 GPT partitions in “sd0”
[0002.377] Proceeding to Cold Boot
[0002.380] starting app android_boot_app
[0002.384] Device state: unlocked
[0002.387] display console init
[0002.395] could not find regulator
[0002.419] hdmi cable not connected
[0002.422] is_hdmi_needed: HDMI not connected, returning fDT entry for leds-pwmd
a[0002.433] lse
[0002.435] hdmi is not connected
[0002.438] sor0 is not supported
[0002.441] display_console_init: no valid display out_type
[0002.449] subnode volume_up is not found !
[0002.453] subnode back is not found !
[0002.457] subnode volume_down is not found !
[0002.461] subnode menu is not found !
[0002.464] Gpio keyboard init success
[0002.508] found decompressor handler: lz4-legacy
[0002.522] decompressing blob (type 1)…
[0002.556] display_resolution: No display init
[0002.560] Failed to retrieve display resolution
[0002.565] Could not load/initialize BMP blob…ignoring
[0002.616] decompressor handler not found
[0002.619] load_firmware_blob: Firmware blob loaded, entries=2
[0002.625] -------> se_aes_verify_sbk_clear: 747
[0002.630] se_aes_verify_sbk_clear: Error
[0002.633] bl_battery_charging: connected to external power supply
[0002.640] xusb is supported
[0002.646] error while finding nvidia,portmap
[0003.151] xusb blob version 0 size 124416
[0003.155] firmware size 124416
[0003.159] Firmware timestamp: 0x5da88fc3, Version: 50.25 release
[0003.167] xhci0: 64 bytes context size, 32-bit DMA
[0003.207] usbus0: 5.0Gbps Super Speed USB v3.0
[0003.227] uhub0: <Nvidia XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on u0
[0003.877] uhub0: 9 ports with 9 removable, self powered
[0004.877] failed to get HID devices
[0004.880] failed to init xhci or no usb device attached
[0004.888] display_console_ioctl: No display init
[0004.892] switch_backlight failed
[0004.898] device_query_partition_size: failed to open partition sd0:MSC !
[0004.905] MSC Partition not found
[0004.911] device_query_partition_size: failed to open partition sd0:USP !
[0004.918] USP partition read failed!
[0004.922] blob_init: blob-partition USP header read failed
[0004.927] android_boot Unable to update recovery partition
[0004.932] kfs_getpartname: name = LNX
[0004.936] Loading kernel from LNX
[0005.051] load kernel from storage
[0005.063] decompressor handler not found
[0005.135] Successfully loaded kernel and ramdisk images
[0005.141] display_resolution: No display init
[0005.145] Failed to retrieve display resolution
[0005.150] bmp blob is not loaded and initialized
[0005.154] Failed to display boot-logo
[0005.158] NCK carveout not present
[0005.161] Skipping dts_overrides
[0005.165] NCK carveout not present
[0005.174] Find /i2c@7000c000’s alias i2c0
[0005.178] get eeprom at 1-a0, size 256, type 0
[0005.187] Find /i2c@7000c500’s alias i2c2
[0005.191] get eeprom at 3-a0, size 256, type 0
[0005.195] get eeprom at 3-ae, size 256, type 0
[0005.200] pm_ids_update: Updating 1,a0, size 256, type 0
[0005.205] I2C slave not started
[0005.208] I2C write failed
[0005.211] Writing offset failed
[0005.214] eeprom_init: EEPROM read failed
[0005.218] pm_ids_update: eeprom init failed
[0005.222] pm_ids_update: Updating 3,a0, size 256, type 0
[0005.252] pm_ids_update: The pm board id is 3448-0000-400
[0005.259] Adding plugin-manager/ids/3448-0000-400=/i2c@7000c500:module@0x50
[0005.267] pm_ids_update: pm id update successful
[0005.272] pm_ids_update: Updating 3,ae, size 256, type 0
[0005.302] pm_ids_update: The pm board id is 3449-0000-400
[0005.308] Adding plugin-manager/ids/3449-0000-400=/i2c@7000c500:module@0x57
[0005.316] pm_ids_update: pm id update successful
[0005.346] eeprom_get_mac: EEPROM invalid MAC address (all 0xff)
[0005.352] shim_eeprom_update_mac:267: Failed to update 0 MAC address in DTB
[0005.360] eeprom_get_mac: EEPROM invalid MAC address (all 0xff)
[0005.366] shim_eeprom_update_mac:267: Failed to update 1 MAC address in DTB
[0005.374] updating /chosen/nvidia,ethernet-mac node 00:04:4b:e7:01:74
[0005.381] Plugin Manager: Parse ODM data 0x00094000
[0005.393] shim_cmdline_install: /chosen/bootargs: earlycon=uart8250,mmio32,0x7
[0005.401] Add serial number:1422919084057 as DT property
[0005.410] “bpmp” doesn’t exist, creating
[0005.416] Updated bpmp info to DTB
[0005.421] Updated initrd info to DTB
[0005.424] “proc-board” doesn’t exist, creating
[0005.430] Updated board info to DTB
[0005.434] “pmu-board” doesn’t exist, creating
[0005.440] Updated board info to DTB
[0005.443] “display-board” doesn’t exist, creating
[0005.449] Updated board info to DTB
[0005.452] “reset” doesn’t exist, creating
[0005.457] Updated reset info to DTB
[0005.460] display_console_ioctl: No display init
[0005.465] display_console_ioctl: No display init
[0005.469] display_console_ioctl: No display init
[0005.474] Cmdline: tegraid=21.1.2.0.0 ddr_die=4096M@2048M section=512M memtype
[0005.508] DTB cmdline: earlycon=uart8250,mmio32,0x70006000
[0005.514] boot image cmdline: root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4
[0005.527] Updated bootarg info to DTB
[0005.530] Adding uuid 00000001644495020c000000010280c0 to DT
[0005.536] Adding eks info 0 to DT
[0005.542] WARNING: Failed to pass NS DRAM ranges to TOS, err: -7
[0005.548] Updated memory info to DTB
[0005.556] set vdd_core voltage to 1075 mv
[0005.560] setting ‘vdd-core’ regulator to 1075000 micro volts
[0005.577] Found secure-pmc; disable BPMP
– Then it resets and do the same thing over and over again

Thanks,

Robin BASTIDE

Hello,

What is your step to hit this issue? I mean where do you use the command “make EXT_DTB=u-boot_pubkey.dtb” ?

The goal is to set up U-Boot Verified Boot.
Here is what I am doing in more details.

Setting up L4T Driver Package and Sample Root Filesystem:

tar xf Tegra210_Linux_R32.4.4_aarch64.tbz2
cd Linux_for_Tegra/rootfs/
sudo tar xpf ../../Tegra_Linux_Sample-Root-Filesystem_R32.4.4_aarch64.tbz2
cd ..
sudo ./apply_binaries.sh

Getting u-boot sources and configuration:

git clone https://github.com/u-boot/u-boot
cd u-boot
-- Set CONFIG_SYS_BOOTM_LEN to 0x2100000 in common/bootm.c
export CROSS_COMPILE=/opt/gcc-linaro-7.5.0-2019.12-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-
tools/genboardscfg.py
make p3450-0000_defconfig
make menuconfig
-> Boot images -> Support Flattened Image Tree = y
               -> Enable signature verification of FIT uImages = y

Generating keys:

mkdir keys
cd keys/
openssl genrsa -out cle.key 4096
openssl req -batch -new -x509 -key cle.key -out cle.crt
cd ..

Generating signed fitImage and public key dtb:

-- I'm getting linux kernel image, initrd and dtb from the sample rootfs
sudo cp ../rootfs/boot/Image ../rootfs/boot/initrd ../rootfs/boot/tegra210-p3448-0000-p3449-0000-a02.dtb .
-- u-boot_pubkey.dts and fitImage.its can be found below
make tools
dtc u-boot_pubkey.dts -O dtb -o u-boot_pubkey.dtb
tools/mkimage -f fitImage.its -K u-boot_pubkey.dtb -k keys/ -r fitImage
sudo cp fitImage ../rootfs/boot/
fitImage.its
/dts-v1/;

/ {
   	description = "fitImage pour la Jetson Nano (noyau, fdt, ramdisk)";
        #address-cells = <1>;

        images {
                kernel-1 {
                        description = "Noyau Linux";
                        data = /incbin/("Image");
                        type = "kernel";
                        arch = "arm";
                        os = "linux";
                        compression = "none";
                        load = <0x80080000>;
                        entry = <0x80080000>;
                        hash-1 {
                            algo = "sha256";
                        };
                };

                ramdisk-1 {
                        description = "Initrd";
                        data = /incbin/("initrd");
                        type = "ramdisk";
                        arch = "arm";
                        os = "linux";
                        compression = "none";
                        load = <0x83200000>;
                        entry = <0x83200000>;
                        hash-1 {
                            algo = "sha256";
                        };
                };

                fdt-1 {
                       	description = "DTB";
                        data = /incbin/("tegra210-p3448-0000-p3449-0000-a02.dtb");
                        type = "flat_dt";
                        arch = "arm";
                        compression = "none";
                        load = <0x83000000>;
                        entry = <0x83000000>;
                        hash-1 {
                            algo = "sha256";
                        };
                };
        };

	configurations {
                default = "conf-1";

                conf-1 {
                        description = "Configuration signée";
                        kernel = "kernel-1";
                        ramdisk = "ramdisk-1";
                        fdt = "fdt-1";
                        signature {
                            algo = "sha256,rsa4096";
                            key-name-hint = "cle";
                            sign-images = "fdt", "ramdisk", "kernel";
                        };
                };
        };
};
u-boot_pubkey.dts
/dts-v1/;
/ {
    model = "Keys";
    compatible ="vendor,board";
    signature {
        key-cle {
            required ="image";
            algo ="sha256,rsa4096";
            key-name-hint ="cle";
        };
    };
};

Compiling u-boot with the public key dtb attached and flashing:

make EXT_DTB=u-boot_pubkey.dtb
sudo cp u-boot.bin ../bootloader/t210ref/p3450-porg/
cd ..
sudo ./flash.sh jetson-nano-devkit mmcblk0p1

This cause endless reboots on the jetson nano before even accessing u-boot.
U-boot boots correctly if I compile it without attaching the public key dtb (make instead of make EXT_DTB=u-boot_pubkey.dtb).

There is no update from you for a period, assuming this is not an issue any more.
Hence we are closing this topic. If need further support, please open a new one.
Thanks

Hello,

We don’t have experience for what you are trying to do. Thus, I can only ask you to enable some debug log inside uboot and see where gets stuck. Maybe you can also ask on the public U-Boot mailing list.

Does the EXT_DTB you are providing contain a full copy of what U-Boot needs from its DTB?
Why not just modify the DTB that’s already part of U-Boot instead of trying to use a different one?